1. Introduction

Imagine a company - a market leader, a household name, recognized across the globe and considered virtually unassailable. Now imagine a number of risks that might affect the company over the course of a year - a large product recall, poor sales performance in one geographic location, problems with regulators and anti-trust investigations in another, a racial discrimination lawsuit and performance failing to meet expectations in several emerging economies.

What might happen to the company if these risks occurred? A slump in share price? Resignation of the chief executive?

There can be no doubt that a company’s ability to manage risk affects its share price. Poor management of risk has been behind spectacular catastrophes but has also, more commonly, resulted in significant losses. The increasing level of global corporate information, is likely to provide further publicity for those companies not managing their risks well, and increase the level of explicit evidence of poor risk management.  Whilst good risk management practice does not generate such head-line grabbing stories, companies are starting to publicize an increasing level of detail on their overall capabilities to manage risks, in addition to their attitudes on popular single risk issues such as environmental and health and safety matters etc.

Tighter corporate governance requirements are just examples of the mounting pressure from shareholders and regulators to improve the visibility of good risk management across the enterprise in a manner that complements their shareholder value creation strategy. The introduction of ‘sustainability indexes’ or similar such performance metrics also provide further evidence of this increasing trend.  As such, it is clear that establishing and managing the chain of cause and effect between risk and shareholder value is paramount to a company’s success.

Most companies today do not explicitly make this connection.

This article will look at the ways in which risk management can create and sustain - or destroy - shareholder value and how a company can manage this relationship to its own advantage.

2. A word on stakeholders

Access to customers, capital, labour and supplies is dependent on the modern corporation’s ability to meet the needs of all its stakeholder groups - shareholders, board of directors, management, employees, debt markets, auditors, governments, communities, families, suppliers, customers, media, business partners and many others. How these groups define and derive value from the business, their views on risk, and their expectations of risk management and communications will impact this ability. 

3. Shareholders and shareholder value

For publicly traded companies, there is perhaps no more important stakeholder than the shareholders of the company. Today’s shareholders demand continuous improvements in performance from their investments and a major focus of management is managing these expectations; indeed, this can sometimes be all-consuming. The capital markets have little pity for the under-performing company - one need only consider any of the high profile corporate melt-downs of the early nineties or, in early 2000, the high tech sector’s roller-coaster ride to understand their fickle loyalties!

Shareholder value is the static net present value of the existing business model, plus the value of future growth options (Figure 1) or more simply “the sum of the value of what a company does now and the value of what they could possibly do in the future”. The valuation of both old and new economy companies in today’s market can be viewed in this light.  Successful dotcoms tend to have enormous value on the side of future growth options while traditional bricks-and-mortar companies have a majority of their value determined by their net present value.

4. Shareholder value & risk management

Good risk management should allow businesses to exploit opportunities for future growth while protecting the value already created. By aligning risk management activity to what the shareholders consider vital to the success of the business the company provides shareholders with certainty that what they value is protected. So, by providing shareholders with this security, good risk management can in itself generate value for the business by positioning the company as one that exploits opportunities for growth whilst still being a safe investment.

There are four key steps in understanding and managing the link between risk and shareholder value:

• Establish what shareholders value about the company

• Identify the risks around the key shareholder value levers

• Determine the preferred treatment for the risks

• Communicate risk treatments to shareholders

Stage 1 - Establish what shareholders value about the company

The first stage of connecting risk management activity to shareholder value is to determine the specifics of what shareholders value in the company and the corporate processes that contribute to that value.  We call the most important processes “shareholder value levers” (Figure 2). By taking proactive steps to engage the investment community - equity analysts, institutional investors, and the like - in systematic discussions, it is possible to achieve a shared understanding of these key levers.

Ideally, these shareholder value levers can be broken down to a level that aligns directly with a company’s value creation processes and key performance indicators (KPIs).  It is important to establish and maintain this framework of aligning corporate processes and risk management to shareholder value.

In the example above, a hypothetical biotechnology corporation has consulted its institutional investors and equity analysts about the aspects of the company that provide the greatest shareholder value.  In this case, the shareholder value levers include key processes of capital allocation and efficiency in order to retain its present value, and innovation and the ability to execute in order to meet its future growth plans.

Stage 2 - Identify the risks around the key shareholder value levers

Next, companies must consider the universe of risks which may impact each of these shareholder value levers.  Risk can be defined as the degree of certainty around an event occurring and the subsequent impact on an organization’s ability to achieve or exceed its objectives if the event occurs or not.  Risks come in many forms - strategic, operational, financial, and knowledge.  All areas of risk should be assessed across the entire enterprise.

The investment community is once again crucial in developing this framework. Discussions with the capital markets should determine their views on risks to the company’s value levers (Figure 3) as well as the levers themselves.  In other words, what are the factors that the investment community could see influencing its valuation of the company?  In many cases, the capital markets will have a great deal of insight into industry risk and may have certain expectations of the risk the business should accept. The shareholders and the company should view themselves as partners in this exercise to determine the critical risks to shareholder value. Many leading analysts already use intangible parameters to determine their overall assessment of a company’s value, in response to growing pressure to establish new types of market indices which take into consideration non-financial measures including quality of management, people competency, brand strength and reputation, investment in R&D as well as the ability to manage risk and uncertainty.

To complete this picture, the company should also take on an intra-company risk assessment to determine all other key risks which can affect these important shareholder value levers, of which the investment community might not be aware.

To continue our hypothetical example, the company has now determined with its shareholders the major risks to its shareholder value levers.  These risks include failure to define the company’s strategies to the markets and regulatory change which could adversely impact the development of new drugs. In addition, upon the completion of an internal risk assessment, the board of directors also discovered some additional risks including loss of key staff and cost overruns in their Asia division.

How companies choose to view and ultimately manage these risks is a critical success factor. As we have seen, shareholder value is the static net present value of a firm plus the value of future growth options.  Risk can be viewed quite differently in light of these two distinctions.  While a company may wish to minimize risks around its present business model which is generating its static net present value, the company may also wish to maximize its risk and uncertainty around its future options - the more options and the more valuable those options are, the greater the potential value to the company in the market.

Equally, many of the risks facing a company are likely to be the same ones facing its competitors and peers. The strategic decision to accept these risks could be the first step in defining future core competencies for the company. For instance, one of the key risks to rapid growth is the ability to quickly convert sales to cash in an organization.  One example of a company that has transformed this risk into a core competency and exploited it to their advantage is Dell Computers.  Dell has used the cash conversion cycle (CCC) as a key performance measure.  By focusing metrics of days sales outstanding, days sales in inventory, and days of payable outstanding, Dell has been able to accelerate inventory turns and collection activities and slow down supplier payments.  This has resulted in Dell’s CCC being reduced from 40 days to 8 days, a clear advantage over their competitors, creating immense value for Dell’s shareholders.

Stage 3 - Determine the preferred treatment for the risks

Once a company has identified the risks to each of its shareholder value levers, it should then determine what shareholders will accept as suitable risk treatments.  Risk treatment can be defined as any strategy which affects the amount of risk being taken. This might mean avoiding the risk, managing it, insuring hedging it or one of numerous combinations of risk treatments.  Tactically, any action which would influence the relationship between the shareholder value lever and the risk and thereby have an impact on its valuation is a risk treatment. This can include expansion, mergers and acquisitions, spin offs, outsourcing, prevention programs, process changes, better supply chain management, management controls, risk transfers and financing, to name just a few.  Therefore, it is important to assess the capital market’s views on what they would like the company to do with their identified risks (Figure 4) as the treatment decision can have a negative or positive effect on its valuation.

Management will have its own views on effective risk treatment. However, equity analysts, institutional investors and similar groups will also have valuable insights and preferences as to how to treat a particular risk to their satisfaction.  Management should take these opinions on board when agreeing their approach, keeping in mind the linkage between shareholder value and risk management. Where differences are evident, the challenge for the management team is to convince the investment community that their suggested risk treatments are the most appropriate and effective.

If, therefore, a company can estimate how the market would reward them for executing individual risk treatments, then it can prioritise them.  The risk and reward of discrete business activities can be quantified by estimating the change in the capital market’s valuation of a company if a particular risk treatment was implemented. Once a company has achieved an estimate of the impact on its valuation if a particular risk treatment is adopted, it can then consider whether it is worth the investment needed to implement the treatment.

Stage 4 - Communicate risk treatments to the shareholders

A corporation has a vested interest in informing its shareholders of value creation plans, how it intends to execute them and any significant events that may impact their investment.  It is important for the long-term growth of the company that shareholders are well informed and that their view of the company is a positive one - that a shared vision is established.  Access to the markets is based on this shared vision of value - both present and future. But it is also based on the perceived risks to that value, and how those risks are being managed.  Good risk management is part of the shared vision.

As shown in Figure 5, communicating with the capital markets is essential if the company is to benefit from this connection between risk management and shareholder value.  Companies should discern from the shareholders their views on its value, the risks to that value, and appropriate risk treatments.  It must then communicate how it will create value through its current business model and/or future growth options, the effectiveness of its risk management programme and how that programme is aligned with these value levers.

This communication should go beyond mere reporting to the markets.  Indeed, communication in itself can be a form of risk management.  During periods of adverse market conditions for a particular industry, markets can often react unfavorably to all peers within that sector.  Proactive communications can lessen or even eliminate such a blow to a company’s valuation. For instance, if regulatory changes were to impact the biotechnology sector, many stocks would be devalued by the market.  If  our example company can quickly explain to analysts and markets how it plans to react, the market may very well reward the company versus its competitors.  If this sounds fanciful, consider an organisation which does NOT communicate in this way. For example, press commentary indicated Perrier’s reaction to the contamination of its stocks in France proved extremely costly, highlighting the importance of appropriate communication by the right person. The failure of a coherent message was a contributory factor to the subsequent share price collapse. Regulatory pressures are contributing to this trend to communicate not only to analysts but to the wider shareholder community.

5. Enterprise Risk Management and Shareholder Value

What, then, does this look like when it is all pulled together?  Corporations and their shareholders today are looking for ways to achieve value and risk optimization - to address value and risk in all their forms on a sustainable basis. The answer is a new perspective on risk management - to establish the practice of enterprise risk management linked directly to shareholder value (Figure 6).

In its simplest terms, Enterprise risk management seeks to create and sustain shareholder value. However, both aspects of shareholder value - the static net present value of the current business model and the value of future growth options - must be addressed. Enterprise risk management does this by protecting existing value, optimising risk, and financial engineering of risk and capital. 

a) Protecting existing value

Traditionally, risk management activity has focused on this area.  Protecting the existing business has been the cornerstone of risk management for decades - maintaining value by minimizing risk. However, many companies even in today’s competitive landscape manage the risks affecting the static present value in an ad hoc, uncoordinated way. They rely on stand alone internal risk management functions such as internal audit, insurance, IT security, legal, treasury, credit, market and so on, to ensure the adequacy of their risk responses. Whilst these functions may be managing a particular area of risk very well, the company often has no assurance that there are no gaps or even overlaps in its risk coverage.

An enterprise-wide risk management approach - one that looks at risk across the whole organisation rather than through the traditional functions - aligns risk management activities to shareholder value levers for the current business model.

b) Optimisation of Risk

The goal of optimizing risk is to create value by maximising the return achievable for the level of risk the organisation is willing to accept.  This is a relatively new field for risk management arising from future growth options, such as using enterprise risk management techniques to allow the business to reserve the right to play in as yet undefined markets.

By aligning risk management with the strategic decision making process of the corporation and with the relevant shareholder value levers, a business can achieve its future growth options. In this way, optimisation of risk looks across the enterprise and views risk as opportunities to be exploited

Commonly, companies manage risks around future options by using techniques meant for managing existing value.  This approach generally serves to stifle risk-taking within the corporation, and hinders innovation and flexibility, resulting in a lower market valuation. 

In today’s more competitive and rapidly-changing landscape, risk management techniques need to be more sophisticated. Leading edge companies are using real options strategy and strategic options management to improve their ability to innovate, execute strategy and grasp ever greater opportunities.  Others have been using complexity theory to model their business and understand the interrelationship of risk, processes and strategies to provide further insight on strategic decision making.

The pharmaceutical giant Merck utilises real options analysis to determine investments in R&D.  This approach allows it to evaluate investments at successive stages of the projects instead of making a one-off decision based on EVA or discounted cash flow.  Merck is then able to put more capital into those projects that have a higher chance of success and allows it to minimize the losses if the chances of success diminish.  In other words, it allows Merck continually to assess investment performance against established benchmarks and respond to changing market conditions. It can reserve the option of playing in many different markets at once even if it decides to postpone investment until a later date.

Strategic Options Management is another powerful technique to embrace risk and capture the value of positive uncertainty through capitalizing on upside and optionality and it is an integral part of Enterprise Risk Management. It combines forward looking probabilistic risk analysis with corporate finance and business strategy to create shareholder value through optimizing the risk and return profile of assets or asset portfolios from a capital market perspective.

The Strategic Options Management process is therefore a key element of an organisation’s Enterprise Risk Management approach. It clarifies initial frames and develops business, financing and partnering options which translate the differing levels of contribution, risk attitudes and expectations of multiple partners and stakeholders into win-win transactions and financing structure. Because it integrates seamlessly the complex business, financing and structuring aspects of critical investments and transactions, Strategic Options Management closes the gap between sound strategic decisions and their recognition in the capital markets.

c) Financial Engineering of Risk and Capital

Financial engineering of risk and capital aims to create and protect value by altering the nature of risk itself. These innovative risk management techniques seek to impact the corporate bottom line directly, through the increase of cash flow, improving the difference of return on invested capital (ROIC) and weighted average cost of capital (WACC), or simply reducing costs.  When a corporation can achieve these results, they can positively affect their market valuation through effective communications to shareholders and by freeing-up capital to increase flexibility and options for future growth. 

Financial engineering of risk and capital includes risk management methods to move risk on or off the balance sheet or up and down the value chain.  Research recently performed by Templeton College at Oxford University indicated that companies which have moved some contingent liabilities from off-balance sheet risk to provisions on the balance sheet have a market valuation 10% higher than their peers with greater off-balance sheet risk.

6. Sustaining the Link between Risk Management and Shareholder Value

An integrated Enterprise Risk Management framework is imperative if a company is to sustain and capitalise upon the link between risk management and shareholder value. Companies who fail to do so will increasingly fall behind their competitors and peers in the market.