检测危机与最佳行为准则之一：公司风险检查

 

企业如何才能走出危机？面对风险又如何能抓住机遇？

 

风险思考曾经是一种后台管理型思维，风险报告也常常会令董事会成员昏昏欲睡。但今后这种情况再也不会出现了。由于风险带来的混乱和影响显著增加，那些拥有独特技能，具有灵活性和敏锐性的企业一夕之间获得了极大的优势。

 

我们认为，最佳做法包括四个方面：

1.公司风险检查(我们面临的风险是什么？)

2.公司核心问题检查(我们抓对问题了吗？) 

3.公司战略检查(我们正在采取正确的行动吗？)

4.公司管理检查(我们为持续发展做好结构优化了吗？)

 

任何一方面的疏忽和延误都会导致公司失败或表现不佳。在好的年份，业绩不佳往往是可被接受的。但在当下的艰难时刻，业绩不佳已不再是可以接受的。身体在疾病流行的时候出问题和在好的出问题显然是不一样的。资金匮乏，资金提供者不再慷慨，竞争对手变得更为强硬。我们都知道，一些公司将表现尤为突出。这是创造财富的年代，是适者生存的年代。我们的分析是公司能充分应对风险的准则。对于上述四条建议，忽视其中任何一条都难以达到预期效果，所以只有让四个方面同时进行并使之保持平衡才能实现真正的成功。

 

我将会在三篇文章中对此进行阐述，今天我们将分析第一部分：公司风险检查。

 

每家公司现在都应该知道受到的冲击在哪里。理想的情况下，公司甚至应该知道其主要客户和供应商所受到的冲击。我们不理解为什么那些公司突然之间便陷入了困境。当今世界，应该已经没有什么事情让我们感到意外了。我们应该对新的风险，对所有的风险保持开放的态度，并且要做好充分的准备。尽管事前准备不能完全应对实际的风险，但是仍有助于计划的提出和组织架构的形成，因此，那些有准备的公司对风险的反应将会更快、更好、更有力。

 

风险和机遇可能来自许多不同的方面。例如，老派、传统的银行家关于风险存在于市场或信贷或日常经营中的观点早已不再成立。突然之间，各种风险开始相互交汇、相互作用、变得复杂化。资本供应、市场混乱和价值波动同时出现在信贷、市场和银行的日常经营中。因此，我们不得不重新制定计划，并且不能再依赖于以前的判断。鉴于上述原因，我们建议采取以下4个步骤进行风险管理：

I. 识别风险

II. 评估风险

III. 管理风险

IV. 构架风险

 

首先是风险识别。风险识别不能使用自下而上的方式，比如问你的雇员风险是什么，因为他们通常不会从大局出发。风险识别也不能依赖于一个人或一个部门的判断，而是需要高级管理层基于下层报告而做出的意见交流和判断。例如，一家知名公司，管理层向董事会递交风险报告前对绝大多数的员工进行了调查，然后集中调查数据，向董事会报告说大多数员工最关注的风险是增值税合规问题。因此，个人风险观得汇集并不能等同于整个公司应有的风险观。

 

但另一方面，自下而上的方法仍很重要。2007年4月，瑞银一位年轻的交易员报告，称次级抵押贷款结构性金融产品存在问题。其老板、瑞银投行部门高管约翰·科斯塔斯(John Costas)曾试图说服瑞银高管层正视这些潜在问题，但是并没有用。在劝说无效后他从瑞银离职，而漠视的后果众人皆知。另外，对旧有风险的识别同样需要重新考虑。例如，银行存款在过去被认为是稳定的，但在当今不确定的环境下，可能有必要对这种存款进行重新的审视。

 

一旦确定了主要的风险，对其进行评估将有助于更好的理解这些风险。即使不可量化的风险也是可以进行评估的。这种评估并不需要精确，尽力就足够了。对风险进行评估的优点在于：形成一种可以用来交流和筹备的语言。对风险进行准确的评估是很难的，否则，就不能称之为风险了。评估的作用并不在于评估本身是否成功，而是在于对风险意识的提高。

 

用来进行评估的工具很多。大型投资或敏感性领域需要使用多种评估工具。敏感性分析(龙卷风图(tornado diagrams)和蛛网图(Spider Diagrams))、情景分析和蒙特-卡罗模拟分析法有不同的粒度和方便性，它们都是非常有用的工具。那些与风险近距离接触的人通常使用的口头评估方法也是很有用的工具。使用工具的目的不是增加文书工作，而是为了增强认识。因此，所有能够有助于我们正确认识风险潜在影响的工具都是可以使用的。

 

如果风险存在，是不是消除风险是最佳选择呢？这就是第三步管理风险需要解决的问题了。这里，我们提出一个过于保守的问题，你的投资

者希望你承担一定的风险。需要消除的风险应该是那些非核心风险，然后就要以完全透明的方式进行风险管理。在这里我们发现，需要管理的风险是那些导致下行的风险。航空公司燃油成本风险可能是一个很好的例子：当油价非常高的时候，航空公司损失的可能性更大。美国西南航空公司以每桶25美元左右的价格对其2004年至2009年的燃油成本进行对冲，这成为其持续实现盈利的主要原因。另一方面，宝马公司中止欧元兑美元的对冲交易导致其损失数十亿美元，这一事实表明，一些人认为对冲只是时机问题。如果CFO或财务主管们很擅长判断时机，那么他们应该去做交易员，这样可以赚更多的钱。因此，对于任何风险管理计划而言，问这样一个问题：它能够真正为我们的股东创造价值吗？许多风险管理计划可能更多的是给公司经理带来满足而不是为股东创造更多的价值。那么，风险管理取决于时机吗？任何依赖时机的风险管理计划都是投机性的。这又引发另一个问题？你如此擅长投机吗？

 

最后，架构风险和共担风险最近已经取得了很大的成功。先是在公司的关系网(投资者、客户、供应商等)中发现不同的风险，然后就风险共担达成协议，让最不受风险冲击也最有能力克服风险的一方承担最大的风险，以此为所有人创造价值。上述原则通常应用于合资公司和并购案例中，另外在商业条款中也得到了很好运用。例如，全球最大肥料和杀虫剂生产商之一先正达公司(syngenta)通过向农民提供收益担保大大推动了拉美业务的增长。具有高风险的农民将部分风险转移至先正达公司，而后者又可以将风险转移至商品交易商。这样，先正达公司赢得了更多的业务，而面临的信用风险又在降低，因为“被保险的”农民支付货款的几率提高。先正达公司在拉美地区的经验可以在其他地区推广。在当前动荡的环境下，明智的风险架构可以使整个局面变得非常的不同。

 

（欢迎英文评论）作者英文原文：

How are businesses working out the crisis and what are the best-practices in terms of confronting risks and seizing opportunities?

 

Risk thinking used to be a back office type of thinking and risk reports used to put board members to sleep. Not any more. As the confusion and the impact of risks have dramatically increased, suddenly those that have developed special skills, flexibility and  acumen gather terrific advantages.

 

We find that best practices align four dimensions:

1. a physical health check (what are we exposed to?)

2. a mental health check (are we capturing the right problems?)

3. a strategic check (are we doing the right moves?)

4. a governance check (are we well structured for continued awareness?). 

 

Any slippage in any dimension may doom companies to failure or underperformance. In the good times, underperformance was often acceptable as everybody did so well. In today’s tough times, underperformance is no longer acceptable. Being unhealthy during an epidemic is not the same as being unhealthy during good times. Money has become scarce, generosity of fund providers is rare and competitors are becoming tougher.  We all know that some will do particularly well. These are times when fortunes are made as well. These are times of survival of the fittest. Our analysis is the guideline on adequate risk fitness for corporates. Doing one of our recommendations and not doing the other is like doing the running in the morning and not building the rest of life: you can become a good jogger and waste life’s true opportunities. You will live long and do nothing with your life. Thus balancing the views and aligning the work is a necessity for real success.

 

In the first of this three-part series, we will analyze the physical health check.

 

Every firm should now be aware of where it hurts. Ideally, it should even be aware of its major clients’ and its suppliers’ pains. We are puzzled at companies entering difficulties almost by surprise. In today’s world, nothing should surprise us anymore.  We need to open our minds to new risks, to all risks, and be somehow prepared. While preparation will never match the actual risks, it still helps frame the mind, the organization and the network so that those prepared will react faster, better and stronger.

 

Threats and opportunities may come from many different sides. For example, the old and traditional bankers’ view of risks falling in either markets, credit or operations has blown to pieces (and Basle II is certainly at threat). Suddenly, risks are converging, interconnecting and becoming complex. Supply of capital, disruption of markets and the volatility of values address at once the credit side, the market side and the operations of banks.  We thus have to put the plan on the drawing board again and cannot rely on our old estimates. For this, we suggest the following process of 4 steps for technical risk mastery:

I. Identify your Risks

II. Assess your Risks

III. Manage your Risks

IV. Structure your Risks

 

First, risk identification. Identifying risks cannot be left to a bottom up approach: asking your employees what risks are. They will often miss the big picture. It cannot be left to a single person or a single department view. It requires a sharing of views at the top level of management fed by bottom up type of reporting (with open lines of communication in the corporation).  A well-known company, when they started risk reporting to their board, decided to develop a large survey involving most employees. They then congregated the data and reported to the board the major risk, the one most consistently of high impact for each and every employee: VAT compliance. And thus the compilation of each individual’s major risk view may not combine into a good risk view for the whole corporation. On the other hand, the bottom up approach and listening to it is still important. A young trader reported difficulties on subprime structured products in UBS in April 2007. His boss, the famous John Costas, who has successfully brought up UBS’s franchise in that field, tried to convince senior management of the potential difficulties and was not listened to. He left the firm with the consequences we know. Old risk identification needs to be revisited as well. For example, deposits for banks may have looked stable in the past. Rethinking that exposure may be essential in today’s uncertain world.

 

Once major risks are identified, assessing them is crucial to have a better understanding of these risks. Even non-quantifiable risks can be assessed. The assessment does not need to be exact. Best efforts suffice. The advantage of the assessment is that it develops a common language that can then be used to communicate and prepare. Risks cannot be assessed well. Otherwise, they would not be risks. The role of the assessment is not to be successful in the assessment itself, but to grow awareness.

Many tools are available for assessment.  Multiplication of tools on large investments or in sensitive areas is recommended. Sensitivity analyses (tornado diagrams or spider diagrams), scenarios and Monte-Carlo simulations are all useful tools, with different granularity and different ease of use. All are useful and so is a verbal assessment, done by those closest to risk. The goal is not to increase paperwork but rather to increase awareness. Thus all tools that get us closer to true awareness of the potential impact of risks identified are welcome.

 

If risks are present, isn’t the best to eliminate them? Managing risks then may become primordial. Here, we flash an issue, which is to be too conservative. Your investors expect you to take risks.  Risks to be eliminated should be those that are not core, and then risk management should be done in all transparency. For example, gold mines hedging gold prices without full disclosure may mislead investors choosing them for their gold price exposure. We find that best risks to manage are those that create more downside than upside. Airlines fuel cost exposures may be a good example:  an airline has more to lose at having very high oil prices than it has at having very low oil prices. Southwest Airlines’ remarkable hedge of fuel costs in 2004 all the way to 2009 at prices around $25 per barrel has been the major reason for its continued profitability while all other US airlines went under. On the other hand, BMW stopping its Euro/$ hedges early and thus losing 1.5 billion on these currencies show that some are seeing hedges as a timing issue. If CFOs or treasurers were so good at timing, they should be traders. They would make more money and would be done by 5 pm. And thus, for any risk management program, it is necessary to ask: does it truly create value for our shareholders? Many risk management programs may create some comfort to managers rather than value to the business. Also, is it dependent on timing? Any management program that depends on timing is a speculative program. You have then to ask the question: are you so good at speculation?

 

Finally, the structuring of risks and the sharing of risks has had dramatic successes in recent times. It consists of finding in the network of relationships of the business (investors, clients, suppliers, etc) the different risk exposures and agreeing in risk sharing towards the least sensitive to risks (the one most able to overcome them), to create value for all. Often used in JVs, in acquisitions (with earnouts), the principle has been well used in commercial terms as well. For example, Syngenta, one of the largest producers of fertilizers and pesticides in the world, has boosted its Latin American business by providing farmers with yield guarantees. The high risk farmers (typically going bankrupt in bad times) are able to pass on some of their risks to Syngenta who in turn can direct them towards a commodity trader. Syngenta thus obtains more business, with less credit risk (as the “insured” farmers have more chances to pay) at typically higher prices.  Syngenta’s lessons from the Latin American crisis can now be levered in the US and in Easter Europe and Russia.  In today’s turmoil, with parties so sensitive to risks, smart risk structuring can make a big business difference.

 

Once the physical check past, it is time to address the mental check, the strategic check and governance check. We are briefer on these although deep investigation creates much value there as well.

 

Next week we will move on to the mental health check. Stay tuned.

 

Didier Cossin is the UBS Professor of Banking and Finance at IMD, the leading global business school based in Lausanne, Switzerland (www.imd.ch).