Risk management is an important strategic function of management, yet most companies fail to see its benefits and focus on short-term costs. The financial crisis provides an opportunity to integrate risk management as a competitive advantage.

If one lesson was learned by industry and finance from the Great Recession of 2007 to 2009, it was the folly of treating risk management as a kind of unproductive cost center. This attitude, which prevailed during the run-up to the meltdown, proved a catastrophic mistake.

For the better part of the decade preceding the crash, the most sophisticated financial and corporate operations in the world failed to manage or price risk correctly. One of the world’s largest insurance companies, AIG, demonstrated its utter incompetence in this area. Firms that failed to manage risk effectively committed a stupefying strategic error, creating for themselves significant competitive disadvantage.

After the fact, we can price that failure: in the United States alone, $14 trillion ($14,000,000,000,000) of wealth evaporated, according to the Federal Reserve’s conservative estimates. That’s the equivalent of a single year’s economic output. Millions around the world lost their jobs and their homes.  Tremendous political risk resulted.

In perfect hindsight, and with characteristic understatement, the AICPA, American accountancy’s professional association, concluded in 2009, “a well-considered, carefully calibrated risk management strategy may be more important now than it has ever been before.”

 

“May be”? Before the Great Recession, risk management strategies in general were not careful or calibrated, and nor were they given much importance. With few exceptions, corporations, governments and non-profits did not consider risk management an essential strategic function.  Since the crash, they have played a desperate game of catch-up. Some have learned the hard lesson and have undertaken the difficult task of making risk management an essential component of overall corporate strategy. Others are still struggling with the concept. Some progress has been made since 2007, but not nearly enough.

Risk management exists right in the heart of strategic analysis, formulation and implementation. Any company necessarily faces threats that must be described and analyzed if they are to be addressed effectively. Many of these threats (risks, essentially) are subject to risk management strategies and measures.

In terms of a SWOT analysis, risk management drives a company’s ability to ward off and neutralize certain threats. If Firm A is on the path of developing a “mature” risk management capability, it possesses a strength that helps define its competitive advantage.  On the other hand, if Firm B lacked risk management capability, it would classify that shortcoming as a weakness. From Firm A’s perspective, Firm B’s weakness is an opportunity Firm A might be able to exploit strategically with its relative competitive advantage over B.

In his 1998 book, Competitive Advantage, Michael E. Porter of Harvard Business School states, “Competitive strategy is the search for a favorable competitive position in an industry…  (I)t aims to establish a profitable and sustainable position…” He goes on, “It stems from the many discrete activities a firm performs,” which constitute the company’s value chain. In his thinking, “activities can be sources of competitive advantage in their own right.” What is often overlooked, even by Porter, is that risk management is one of these activities.

A common problem is that many companies do not understand how risk management contributes to the value chain. The costs of risk management are clear, but that is not always the case for its benefits. This is evident in trading operations, where floor traders are considered profit engines. In contrast, risk managers are warily eyed as expensive mechanics, who want to place governors on the racing engines, limiting their money-making drive. The need for a governor is only recognized after the engine runs too hard in the red too long, overheats and self-destructs. Several engines might burn out before someone sees the need to rein in the horsepower.

One can also compare risk management to insurance. Its costs are the premium. They are incurred regardless if the policy pays out or not. If there is no need to file a claim, the insurance resembles nothing more than an expensive drain on resources – costs with little or no associated return. Of course, when risk management is effective, the need to file a claim is minimized or eliminated. The whole point of risk management, like insurance, is never to need it, but to all the while recognize its utility when the need does arise. In those times, there is no doubt an ounce of prevention is worth a pound of cure.

Now should be one of those times. Risk management can create value and improve a company’s competitive position. It should be central to a company’s value proposition and its competitive advantage.

No one would question cost control is a basic strategic function of management. Few understand that risk management is fundamentally an effort to control costs – future costs – which are not accounted for in the current fiscal year’s financial statements. The accounting arts have not figured out yet how to allocate today future losses that might never materialize – thanks to an effective insurance policy. A company pays premiums today to avoid future losses, but only the premiums show up as expenses. For the time being, losses are “off income statement,” so to speak.

Risk management serves an important strategic function and creates immediate value. If this does not constitute a contribution to a company’s value chain, I do not know what does. It enhances present value for a corporation because it limits future losses, reducing future costs and increasing future free cash flows. Though the cost of risk management might decrease current returns today, increased future cash flows enhance returns because, well, those returns are less risky.

Risk is a cost, any way you look at it. Its value is misunderstood. It is little wonder risk is often and easily mis-priced. A fundamental misconception of risk leads companies to act as though future losses impose no present costs. They do. The general principle companies should follow is this: risk management is a cost, but risk itself is more costly. Risk management is worth the effort. What is astonishing is how few corporations have really come to understand that simple proposition.