Using scenarios to quantify corporate risks

By Lee Coppack

Consumer spending comprises more than 50 per cent of gross domestic product in many developed countries. It is more than 65 per cent in the United Kingdom and United States. Good risk analysis by consumer goods companies is clearly critical to these economies. New work by the Centre for Risk Studies in collaboration with IRM questions how they deal with high severity shocks.

Traditionally, recessions, reputation, consumer sentiment, business model disruptions and supply chains have been risk categories for the consumer sectors, and companies include them on their risk registers. High severity shocks in these risk areas are still a threat, but they are not the only ones. Heightened political risks and changes in climate and social sentiment regarding environmental issues are examples of new classes of risks that have yet to manifest fully through company balance sheets and in company risk disclosures to shareholders.

Avocado plc is a fictionalized food company drawn from similar companies in the FTSE100. Analysts at the Centre for Risk Studies created it to represent businesses in the consumer sector. They then took scenarios of high severity low probability threats to analyse the potential impact of such shocks on the company’s balance sheet over five years in a study on risk management in the consumer sector.

Part of the work involved reviewing the risks disclosed by global consumer companies in their annual reports and SEC submissions. This process revealed the limitation of public risk disclosures while at the same time legislation and governance requirements are putting companies under increasing pressure for transparency about their risks. Some differences were clearly idiosyncratic, unique to an individual company. What the analysis found, however, was that the heterogeneity of risk registers was more due to differences among corporations in their identification and communication of their risks than inherent differences in the risk landscape.

Such lack of common standards impedes the purpose of risk disclosure which is to allow assessment and calculation of the comparative risks and management quality of different companies. The centre’s report, therefore, proposes a more formalised taxonomy of risks to business based on the review of self-reported risk registers, a catalogue of historical case studies of distressed corporations, and other sources.

 Using scenarios

Consumer sector companies can rapidly enter financial distress given their exposures to a large set of fast-moving risks. Rating agencies tend to use financial balance sheet metrics to derive probabilities of company default. However, sudden triggers such as consumer boycotts fueled by social media, extreme weather duringpeak trading periods or an extensive cyber-attack can cause unaccounted losses to become material to a company’s balance sheet.

Threats internal to businesses, such as management inertia and ineffective operational response compoundedexogenous risks. Hindsight typically reveals these perils when companies become distressed or insolvent. Quantification of these risks, therefore, takes place after the event, when the management, regulators and stakeholders are looking for reliable methods of estimating exposures in advance and devising cost-effective mitigation.

A transparent and robust method of prioritizing and evaluating risks is to represent them by specific instances, namely scenarios, and then to estimate the consequences of each scenario on the business as a stress test. The energy and financial sectors regularly use this technique for planning and risk assessment. The experience can benefit many corporations, including consumer in the consumer sector.

Avocado was based on similar companies in the FTSE100. The risk centre used publicly available sources and information modelled from several real businesses, to represent the operations, organisational structure,geographical footprint, international markets, cashflows, and profit and loss accounts of similar businesses.

This approach provides a method for comparing scenarios from risks with widely different characteristics in a standardized way. By evaluating how each scenario would affect the processes and assets of the organisation, it is possible to the effect on the fundamentals of the business as a potential monetary loss metric. This provides a consistent risk metric that is meaningful to risk committees and senior managers.

Discounted cashflow models are well established methods of calculating valuations of businesses. The analysists applied a five-year discounted cashflow calculation to derive comparative metrics for the company if the scenario occurred and if business continued without it. The difference over five years is the valuation at risk from that scenario, which called 5yrEnterpriseValue@Risk, shortened to 5yrEV@Risk. Enterprise Value at Risk is an indicator of stock price instability and can be derived for a wide range of different types of risk.

This research is a development of the Risk Centre’s previous work using GDP@Risk as a metric for the economic impact of large-scale catastrophe risks. The scenario method is equally suitable for calculating the impact on corporate balance sheets of other low probability but high severity threats to individual companies, including specific risks such as a very large product contamination, recall and liability litigation.

Six scenarios

The six scenarios modelled for Avocado plc represent six major risk classes: finance, geopolitics, technology, environmental, social and governance.

  • Finance: A trade dispute involving the United States and European Union.
  • Geopolitical: a conflict involving India and Pakistan.
  • Environmental: flooding to a key facility.
  • Social: an influenza pandemic
  • Technology: a cyber attack in the form of a contagious malware infestation.
  • Governance: an equal pay movement.

These risks are unpredictable but foreseeable in that history provides some basis for estimating future impacts. They are major classes of risks that are commonly found in risk registers and serve as a foundation for comparative risk assessment and understanding cost- benefit tradeoffs in mitigations.

To apply the scenarios to a business required a standardized data structure to indicate the contributions of different components of a business to its overall financial performance. For Avocado, this meant creating a ‘digital twin’: a representation of its balance sheet and its future five-year earnings, deconstructed to the markets, products, production processes and supply chains of the company, with their representative ‘enterprise value’ to that balance sheet. The analyses then calculated the shock that the scenario would create for each of these components and the resulting lost value to the balance sheet.

The analysis then calculated three potential levels of severity for the impact of each scenario. Avocado, it found, was exposed to losses ranging from tens of millions of dollars in the least severe cases up to $2.6 billion in the worse case involving huge tariffs as a result of a US-European trade dispute or $2.45 billion from a flood in a key facility.

Converting a material risk into a loss number in this way gives management an effective way of ranking the severity of risks and the value of various mitigation strategies. This is the foundation for manging the company’s resilience in a universe of risks. Mitigation measures are of two types:

  • Threat-specific: efforts to diffuse the company’s vulnerability to an identified risk
  • Resilience-strengthening: generic measures to improve the ability of the company to withstand any shocks

Both need to be deployed to mitigate risk, and the scenario method can be used to assess the optimal balance between the two. This poses an important question about the role of insurance as risks on this scale are thought to be growing in significance for global companies.

Risk appetite

Risks reported in published regulatory accounts convey the perception of risk at least from the perspective of senior management . Publicly listed corporations remain accountable to shareholders through their quarterlyand annual reports. These reports are the company’s main communication channel on risk to investors and regulators.

The varied vocabulary used in annual reports to describe risk factors highlights the need for a consistent risk taxonomy. The risk centre’s surveys of executives’ perception of business risk confirmed those of manyother benchmarking studies: that risk registers are far from being consistent, even in businesses in the samesector. The interchange of primary threats and consequences from threats as risk factors further emphasises this point. Companies could well benefit from a more comprehensive checklist of a broader range of risk that could post strategic threats which can then form a framework for testing and prioritizing risks as part of a systematic approach to risk evaluation and mitigation.

Using evidence-based modelling approaches made it possible to estimate how each scenario would impact the economic environment in which Avocado plc operates and how its revenues, capital stocks, and profits and losses would be affected. Migrating risk reporting towards such scenario based probabilistic assessment, while using a reasonably standardized taxonomy of risk, could allow companies to improve their risk assessment and mitigation as well as providing more transparent risk disclosure.

Lee Coppack is senior associate communications at the Centre for Risk Studies at the University of Cambridge Judge Business School. The opinions expressed in this piece do not represent the official views of IRM

Download Risk management for the consumer sectors.

  • About Enterprise Risk Magazine

    Enterprise Risk Magazine is the leading quarterly title for risk managers and enterprise risk, with a print circulation of over 5,500.

    Enterprise Risk is published on behalf of the Institute of Risk Management (IRM). The majority of IRM members receive their copy of Enterprise Risk at their home address, meaning the title... Read more
  • Categories

  • Tags