AM Best, another ratings agency, also has ERM on its radar, but its approach differs from S&P, says Edward Easop, vice president of rating criteria and rating relations. “They have a separate analytical team that meets with companies and assesses their risk management practices separately from assigning a rating on the company. We thought we really couldn’t separate the two because how well a company does at risk management is going to be evident in how strong its balance sheet is, etc.” But what is AM Best looking for? “We don’t believe every company has to have exactly the same process,” says Easop. “It will depend on products and scale, the strength of the management team and board, what the risk appetite of the company is, and so on.”
Yet even with that increased attention from arbiters of corporate financial health, “there’s a credibility issue about what it is that risk management is delivering to the bottom line,” asserts Paul Hopkin, technical director of Airmic, the UK professional organisation of risk managers. And he believes CFOs are partly to blame. “In the minds of CFOs, many are thinking, ‘Okay, I have to do this risk management,’ but for compliance, not for business efficiency, or that ERM is costing them money and adding work.”
That’s why Airmic — along with Norwegian consultancy Det Norske Veritas — recently began a project to study ERM’s influence on the bottom line, the first project of its kind, according to Hopkin. Around 20 companies are included in the project, each with ERM projects at least three years old and having some form of value analysis. The challenge of distilling ERM’s value “has been ever present,” he concedes, but he hopes the study “will give risk managers some ammunition when they go to their CFOs with ERM projects.” Airmic expects to publish its findings early next year.
Not everyone agrees that exercises to link ERM with the bottom line are useful. “I don’t think it’s possible to make any direct links [to the bottom line],” says Sally Russell, global supply risk manager at Diageo, a UK drinks company. Since the company was formed by a merger between GrandMet and Guinness ten years ago, risk management has evolved into a full ERM programme much admired in risk circles. “Unfortunately, it’s the nature of being a risk manager that if nothing untoward happens, you’ve been successful, but nobody can quite see that,” she adds.
That’s true up to a point, says Jens Madrian, Beckers’ risk controller at RWEn. “You will most likely never get the correct value because the correct value doesn’t exist,” he says. “The point is to understand the complexity and integration of that risk and to make the best mitigation on that basis. The quantification just gives us a hand in terms of visibility and transparency.” And it also provides a good story to tell at the next road show, Beckers would add.
Eila Rana is a senior editor at CFO Europe.