I should like to thank the organisers for giving me an opportunity to address the topic of "Risk Management-the Way Forward". Much has already been said ex post facto about "risk management-the way it should have been" and I think that it is time to focus ahead.
Nevertheless, it is worth reminding ourselves that we are far from where we were just over a year ago, when economic conditions were benign and the prospect of severe difficulties was perceived to be too distant-and costly-to be worth anticipating.
In those heady days, amidst the bustle of manufacturing and commerce, notions of hedging risk were of somewhat less than paramount concern. To paraphrase a proverb, the general view was that so long as waters were calm, crocodiles did not lurk.
Events of the last 12 to 18 months have certainly put paid to that view. Our commercial and financial environment has changed by more than anyone could have reasonably expected, leaving us with little room for complacency towards risk.
But does this mean necessarily imply a special effort by firms to manage risk?
One question is whether managers should engage in risk-management activities at the level of the firm when shareholders could be doing it for themselves in the stockmarket.
After all, with the existence of a liquid secondary market in corporate equity, shareholders should be able to diversify their portfolios by choosing their exposure to certain companies or sectors and freely trading away the risk that they do not wish to hold.
Another question is whether the costs of managing risk are really worth the benefits it accrues to firms and their shareholders.
"There is no such thing as a free lunch," or so says Milton Friedman, and that goes not only for the one we have just enjoyed but also to risk-management activities.
Take, for example, attempts by corporate managers to moderate fluctuations in income streams. What, you may ask, could be more counter-intuitive than to limit the potential upside of cash-flows? And by transferring or avoiding these risks, would we not also be giving up the expected value they bring?
I put it to you that firms must indeed begin to make a special effort to identify, understand, measure, monitor and control the risks they face.
One reason is that that traditional views of risk no longer seem to hold anymore.
Market risk, for instance, has become more correlated-though not necessarily more predictable-during major events. The global stockmarket contagion last October, over fears about the Hong Kong dollar's peg, provides the most recent example of this.
Risk is also looking increasingly non-linear. P&L characteristics of certain market exposures tend to grow disproportionately with their risk factors. One observer, using options terminology, has described this tendency as "negative gamma", or a case of make a little, make a little-lose a lot.
What these two observations suggest is that we are likely to have to change the way we identify and treat risk.
For shareholders, unpredictable bouts of high correlation can diminish the power of diversification just when it is needed the most. The non-linearity of market exposures can cloud the true extent of P&L risk and therefore the value they are expected to create.
Another reason for firms to pursue risk management is that by not doing so, it is likely that will forgo significant net benefits to their managers, shareholders and to society as a whole. Take the example of risk-management I used earlier: the hedging of future cash-flows.
For corporate managers, this can provide job protection. Smoothing out income streams contributes to a firm's financial solvency, which lowers the risk that they will be replaced.
Why is this likely to be an important consideration? One reason is that managers tend to invest relatively more human capital into a firm than its shareholders. Evidence from the United States suggests that the behaviour of managers who hold share-option schemes is driven precisely by such considerations.
For the firm's owners, risk management can maximise the value of their shares, even if it imposes a hedge on pre-tax income. Studies on the use of derivatives by Fortune 500 companies have shown that one objective of corporate risk management is to lower expected tax burdens.
Many tax write-offs, such as depreciation, are not independently tradable, although they may be carried forward. It may make sense, then, for a firm to hedge against situations in which it cannot exploit tax deductions because of low or negative income.
Studies have also shown that companies use derivatives to avoid costly external financing. Firms may find that reducing the variability of their income stream helps to ensure the availability of adequate internal funds.
An important benefit of risk management from both the viewpoint of the firm as well as of the public is that it can mitigate the costs of financial distress. These may include direct legal and regulatory costs of bankruptcy as well as the indirect costs that result from a deterioration in the relationship between a firm and its employees and customers.
Of course, risk management involves more than simply moderating fluctuations in cash-flows.
Someone once defined risk as "danger, volatility of outcomes or simply uncertainty." In other words, risk is not simply the incidence of adverse outcomes. Favourable but unpredictable ones also constitute risk.
Moreover, opportunity losses can be as important as actual losses. In theory, forgoing a positive net present value investment is just as significant as the cost of choosing a negative net present value outcome.
And when maximising wealth is the objective, selling an asset too soon may be just as costly as holding on for too long.
Hence, the "topography" of risk management must include risks that relate to operational and strategic aspects of managing the business, as well as those that relate directly to the value of the firm.
It should be of no surprise, therefore, that the ability to identify, measure and monitor these risks is widely-thought to bring a firm significant competitive advantages-a point perhaps worth noting as competition among regional companies for domestic and international markets becomes increasingly more intense.
Companies that are clearly in control of the risks they face stand the best chance, by far, of attracting market confidence. In an environment of high uncertainty and risk-aversion, this is half the battle won.
The other half comes from seizing business opportunities in a timely and effective way. This requires an aggressive pursuit of the "right" kinds of risk while controlling for the wrong types.
With this in mind, I would argue that the way forward for risk management in Malaysia involves nothing less than a change in the corporate culture towards risk and risk control.
Why? Because it is becoming increasingly clear that in order for a firm to safeguard its long-run profitability, risk-management objectives and policies must be key drivers of business strategy and must be implemented through supporting operational procedures and controls.
This will mean at least three things for the way a firm is run.
- First, the board must assume ultimate responsibility for risk management, which must be driven top-down by those with responsibility for running the business.
- Second, the board and executive management must recognise a wide variety of risk types and ensure that these have adequate coverage in the risk-control framework.
- And third, support and control functions-such as back- and middle-offices, internal audit, compliance, legal, IT and human resources-must be an integral part of the risk-management framework
These are critical elements of a modern approach to corporate management and have already been recognised by senior executives in industrialised countries.
Let me give you some idea of what I think this is likely to mean for a firm's operations and structure.
One implication is that a firm will have to develop and adopt an integrated framework of responsibilities and functions covering all aspects of risk, including those that are not readily measurable.
Ideally, the framework will incorporate the board, which must have ultimate responsibility; top management; a dedicated risk-management group; and various support and control functions, all of whom must have clearly-defined responsibilities and reporting lines.
A dedicated risk-management function-which may well be pursued by different parts of a firm's organisational structure-will have day-to-day responsibility for monitoring, measuring (where possible) and evaluating risk.
Among other things, this function will be independent of business units, where there would be a clear conflict of interest with the implementation of policies on risk.
It is more likely that difficulties will arise through a failure of operational controls than with problems in measuring risk. Therefore, firm-wide support and control functions must be able to give risk-managers the assurance that policies on risk are being implemented effectively.
Appropriate risk-management systems will facilitate this process, especially if they are able to provide information on a timely and frequent basis. In addition, it is crucial that, to minimise operational risks, such systems display the highest levels of integrity.
But is that all there is to developing risk management in Malaysia-a change in mindset?
Let me make it clear: the development of risk management capacity in Malaysia is likely to include the better use of risk-management instruments, such as derivatives, and measuring risks more explicitly, for example by estimating the value-at-risk of balance sheets.
Indeed, the rapid development of new tools and techniques means that education and training will be among the ways forward for risk management within the industry.
Programmes such as the Malaysian Monetary Exchange's Users' Forum are therefore crucial to these efforts.
But the first step towards managing risk is for firms to know what they face and how much of it to take or avoid. In many cases, including some of the recent financial imbroglios involving derivatives, risk management can involve nothing more than ensuring that common-sense prevails.
By forsaking that common-sense, firms gamble their long-term success and, in some cases, survival.
Therefore, the way forward for risk management in Malaysia is for domestic firms, and in particular their senior management, to realise-and realise soon-that there are returns to be made not only by excelling at their core activities. Benefits also accrue to those who equally are adept at recognising, quantifying and managing the risks inherent in the environment.
