Know your company, know your risk

As Asia Pacific's capital markets continue to recover and resume growth, an increasing number of institutions are participating more actively in the markets. This throws up numerous challenges associated with managing the risk of derivative businesses as well as traditional treasury and lending businesses.

Many institutions are looking to redesign and implement robust risk management solutions to cope with the various risks inherent in their businesses. While development of a risk management process takes time and can be quite complex, we believe there are a few key ingredients which go a long way towards ensuring success: recognizing and adopting the right risk management culture, strengthening it for risk taking, and finally, using the best possible risk measurement methods to support and represent the culture.

Risk management

One of the best things a company can do is establish a culture whose purpose is to make risks transparent, ie, readily visible to managers throughout the organization. Within this environment, placing a high priority on two initiatives will naturally promote transparency and thus enable managers to make the most informed decisions:

* Investing in procedures to aggregate, quantify and report risk positions in a timely manner; and

* Establishing a common language to communicate about risk.

Aggregating, quantifying and reporting risk positions involve not only an information technology investment, but also the development of managerial procedures that encourage and require businesses to include the risks of new activities as they occur. A common language enables managers to consistently compare and make decisions on market risks across different asset classes, credit risk, and other risks that affect that capital of the institution.

Seven attributes of a strong risk management culture

Our experience in implementing a comprehensive risk management approach at major institutions around the world has shown that risk management is a combination of art and science that needs to incorporate a number of basic characteristics:

* Transparency of risks: Risks that are not identified cannot be managed effectively. The primary goal is to develop a culture that strives to make risk readily visible to managers throughout the organization.

* Effective policies and control: Companies should have clearly-defined policies for risk taking and risk-based limits in all business areas, and procedures to aggregate and control risk positions on a portfolio basis.

* Analytically rigorous measurement: Risks can be measured and all efforts should be made to develop a framework that can accurately quantify the firm's appetite for risk taking.

* Timeliness and quality of information: Risk measurement needs timely, high-quality data on positions and on markets to permit management to make informed decisions on potential changes in the risk profile of the firm. This area is usually associated with the largest investments, mostly in information technology systems.

* Disciplined judgment: Though statistical processes govern the risk measurement process, managers must apply disciplined judgment and an understanding of how risk statistics relate to the current market environment.

* Independent oversight: While risk management is the role of the firm's position takers, monitoring of risk should be the responsibility of an independent group reporting directly to senior management.

* Diversification: One of basic tasks of all risk managers is to promote a diversified risk profile by continually searching out hidden concentrations.

Creating a risk management culture

Buying in to the conceptual framework for managing risk must start at the CEO and board levels, and then spread across the organization through proper education. JP Morgan's early leadership in risk management can be attributed to former CEO Dennis Weatherstone, and his famous request to have a report summarizing all market risks on his desk by 4.15 pm. Not just risk managers, but senior managers, new recruits, front-, middle- and back-office personnel should go through risk training programs.

In the end, the discipline of risk management is more about people than analytics and data. Steve Thieke, the former head of JP Morgan's Corporate Risk Management Group, likes to say "A Players with B models will outperform B Players with A models". The best models in the world can only generate numbers. What you do with those numbers will make the difference.

Once a company develops a culture for risk management, effective risk measurement should follow naturally.

Over the last few years, quantification of risks with VaR has become a cornerstone for day-to-day risk measurement for most major financial institutions, and increasingly for corporates with significant treasury operations. While this is certainly a positive trend, other aspects of risk measurement, such as rigorous stress testing, should also be emphasized.

Risk measurement: Stress testing

Increasingly, risk managers and regulators agree that companies must complement VaR with rigorous stress testing to create a complete Picture of Risk. Stress tests should be designed to estimate potential economic losses in abnormal markets.

Forward-looking stress testing

Stress tests can be framed around two central questions:

* How much could I lose if a stress scenario occurs, eg, the US equity market crashes?;

* What event could cause me to lose more than the pre-defined threshold amount, eg, $100 million?

The first question is commonly asked in a top-down approach for stress testing. For example, senior management may ask how much could the firm lose in a major equity market crash.

The second question is best asked at the book or business level. After scenarios are collected from individual risk-takers, cross-firm analysis can be done to see if events are diversified or exacerbated. An example of such a bottom-up approach for stress testing is the JP Morgan Vulnerabilities Identification (VID) process.

JP Morgan introduced the VID process by asking each risk-taking unit to (a) qualitatively list what event could cause it to lose more than a specified threshold dollar amount, and (b) assign a probability to each event. The Corporate Risk Management Group (CRMG) polled the entire firm and aggregated the results into a searchable database. CRMG could then conduct cross-firm analysis to see which scenarios were "diversified" away and to identify exacerbating scenarios that many risk taking units were exposed to in common.

Historical stress testing

History holds a lot of useful information for stress testing. Historical events give insight into the occasional extreme behaviour of markets, when assumptions about how markets move together often break down. To facilitate historical stress testing, RiskMetrics Group Research has compiled a database of historical stress scenarios that simulate the largest losses for global fixed income and equity investors. The database is assembled from a representative global model portfolio consisting 60% equities and 40% fixed income to identify pertinent time periods for historical stress tests.

The severity of portfolio losses appears to be related to the level of volatility in the world, as measured by the RMVI. For example, the Mexican peso fallout, which occurred during a period of relative market calm when RMVI was at an average level of approximately 100, resulted in a one-day return of only -1%, while the Asian crisis and Russia devaluation, which occurred while the RMVI was significantly above 100, resulted in more severe portfolio losses of 1.9% and 3.8%.

This suggests just how nonsensical it is to run the same static stress tests in all market regimes - more volatile markets require more severe stress tests. To make stress scenarios more responsive to market conditions, the RMVI can be used as a dynamic scaling factor for stress scenarios.

Use of implied volatility to predict crises

Implied volatilities are derived from options prices, as opposed to analyzing historical asset price changes. Like historical volatilities, implied volatilities can be applied to develop stress scenarios that are relevant to current market conditions. In some instances, implied volatilities can even help predict events, as RiskMetrics Group Research discovered when analyzing the Asian crisis.

Market-driven credit exposure

Some of the largest losses from the Asian crisis were credit related. As more Asian companies now use derivatives to hedge currency and interest rate exposures, credit risk will only grow in importance. Credit risk, after all, is much more difficult to shed than market risk. Companies that are active users of Market Driven Instruments (MDIs) such as swaps, forwards, and options can use VaR concepts to measure credit exposure and average exposure.

Exposure limits by time band should be set for current and peak exposure, and credit transfer pricing can be calculated based on average exposure. It is important to get the basics of credit enhancement right, and capture how netting rules, collateral, and MTM structures reduce credit risk.

For interest rate swaps, including a drift and mean reversion parameter can improve the accuracy of long-term forecasts (beyond one year). After capturing credit exposure for MDIs, companies can take the next step to calculate credit risk, by using the CreditMetrics framework.

Conclusion

A number of institutions in Asia Pacific see the need for risk management, but have many questions on how best to approach the task. It is important to emphasize the need for transparency quickly, rather than continuing to work in the dark until a comprehensive solution can be put in place. This will not be achieved overnight. However, an initial assessment of a firm's key risk exposures can be done quickly with the technology that is readily available.

The initial assessment provides management with a good perspective of the firm's overall risk, which can sometimes highlight areas of risk concentration that were not immediately obvious. Once key risks are highlighted, firms can prioritize resources and gradually improve risk visibility by devising a firm-wide approach that fits the institution.

This may include regionally-specific tasks such as procuring regional market data, developing localized credit scoring techniques, and estimating region-specific liquidity constraints. By emphasizing transparency, management will naturally be encouraging the appropriate types of risk management activities and investments.

Alan Laubsch, sales & business development and Alvin Lee, director of business development, Riskmetrics Group.