CA Risk Management/ Internal Audit Group - 5 March 2008 Risk Management - Making it Real

Practical approaches to impact how you run your business Adrian Musto

Risk

Events, actions, or opportunities (taken or missed) which could impact on the ability of an organisation to meet its objectives and achieve its strategic goals Risk Management = Success Management!

We wish to protect against disasters and negative events…….but also identify and maximise the upside of business opportunities

Joined up Approach Needed Risk Workshops Risk Appetite Risk Logs / Inventory Risk Policies Risk Reports Issues: • Articulation of Risk Appetite • Time horizon for risks • Consistency logs & reports / appetite • Transience - keeping it all relevant

Model for Risk Appetite

Risk Appetite Risk Capacity Target Risk profile Actual Risk Profile Quantum of risk acceptable within overall capacity Maximum bearable risk (based on capital, Borrowing capacity etc.) Operational Risk Project Risk Market / Revenue Risk Strategic Risk Credit Risk Liquidity Risk Adapted from PwC model E.g. risk concentration

Measurement is key!

(A) Identify,

measure

capacity and articulate risk appetite and risk How much risk do we want / need and how much risk can we carry?

(B)

Measure

and monitor risk profile Does Target Risk profile = Actual risk profile ?

No “perfect” solution – some well established measures but each business needs to tailor to suit its own environment and create a consistent set of measures applicable across all business activities

Agree Risk Categories & Identify Risks Working towards an agreed risk appetite Risks with indirect financial impact Zero tolerance risks (e.g. fraud) Others (e.g. Staff retention) Review completeness and aptness of existing measures & reporting Risks with direct financial impact Identify measures Quantify risk: • Short term • Long term Develop / implement regular reports Socialise with Board members / develop common level of risk literacy Board set target risk / reward balance & risk appetite Review / Update Risk Policies & Limits Update risk reports / dashboards as a part of regular operational reporting cycle

Musto Energy

Define & Populate Risk Categories

• • • • • • •

Operational Risk Fraud Systems / Processes Plant availability Access HR risks Health & Safety Environmental Market / Revenue Risk

• • • • •

Commodity prices (inputs & outputs) Service prices Interest rates FX rates Sales volumes

• • • • • • •

Project Risk Staffing Planning Project Management Funding Budget Timetable Quality

• • • • • • • •

Strategic Risk Business Model Partnerships Procurement Sovereign / Political Legal / Regulatory Reputation Technology Competition

• • • • • • •

Credit Risk Trading Counterparts Plant / Equipment Suppliers Contractors JV Partners Insurers Banks Customers

• • •

Liquidity Risk Access to funding Headroom / horizon Contingent liabilities:

•

Covenants (Real & Implied)

• • •

Guarantees Letters of Credit Restricted Cash Musto Energy

Map Risk Logs to Risk Categories

Risk Logs: Business Unit 1 Business Unit 2 Etc.

Etc.

Corporate / Board Operational Risk Project Risk Market / Revenue Risk Credit Risk Liquidity Risk Strategic Risk

Musto Energy

Define Measures for Financial Risks

Short- term Long-term Liquidity Cash Flow at Risk

Market / Revenue Risk Credit Risk Liquidity Risk Strategic Risk Project Risk Operational Risk

Capital (Debt and Equity) Key Decisions:

•

Maximum risk

•

per category Maximum risk

•

per event Acceptable expected loss per year

•

Capital required for

•

unexpected losses Target Risk / Reward balance Capital at Risk Musto Energy

Decisions & Issues to be addressed

•

Interdependencies between categories:

• •

E.g. impact of Regulatory decisions on market prices Evaluate risks where they impact (not where they arise)

•

Interdependencies within categories:

•

E.g. correlation between commodity price risks in different businesses

•

E.g. correlation of defaults amongst counterparties within a sector

•

Within year risk vs. long-term risk:

•

Separate limits needed for annual risk (impacting cash flow) and long-term risks (impacting market capitalisation)

•

Composite risks - e.g. loss due to default of an insurer

•

What level of risk matters - e.g. P90, P95, or P99?

•

What losses matter - e.g. as % of market capitalisation?

Musto Energy

Risk Reporting Structure

Need for a framework for risks to be reported on and assessed • Risk Committee / Steering group – Clear terms of reference – Agreed dashboards / KPI’s – Regular Reporting.

• Scheduled review points with adequate time and reports to do it properly – Urgent will trump important if not planned for – Mindset and approach different to normal performance review.

Will not work without senior management support and active involvement!

Works best if cycle for risk reporting integrates with financial and operational reports

Risk Reporting Timetable

Monthly Reports: • Separate sets of reports for each major financial risk category: – Market risks (report against risk limits) – Credit risks (report against risk limits) – Liquidity – etc.

• Reports for all major non-financial risks – Operational risks (e.g. availability, reportable incidents, etc.) – Project risks – etc.

Biannual Reports on long-term capital at risk

Musto Energy

Risk Reporting: Liquidity Risk

• Risks to liquidity can affect both cash inflows and outflows • Risks to cash flow arise both directly and indirectly, e.g: – Market risk directly impacting income or costs – Cash calls for margin payments or collateral to support procurement activity • All forms of guarantee potential create liquidity risks: – Performance Guarantees – Financial Guarantees (e.g. Parent Company Guarantees) – Cash Deposits – Letters of Credit & Bonds – Implicit guarantees (e.g. support for SPVs) • Measurement & reporting requires projection of approved / non approved planned cash flows AND potential risks to cash flow Required Frequency: Monthly

Musto Energy

BU 1 Budget Contribution Market / Revenue Risk €m €m Credit Risk €m

Other Risk Reporting - Within Year

Required Frequency: Monthly BU 2 €m €m €m BU 3 Ireland €m €m €m BU 3 UK €m €m €m Etc.

€m €m €m Corporate n/a €m €m Operational Risk €m Project Risk €m €m €m €m €m €m ?

€m ?

?

?

FX Risk ( Translation ) ?

Total Risk €m ?

€m n/a €m €m €m €m €m €m €m Indicate change since previous report Total €m €m €m €m €m €m €m

Musto Energy

Capital at Risk

Key decision points are capital and strategy approvals

• Capital approval for an acquisition approves: – Market risk – Credit risks – Production / availability risk – Regulatory & jurisdictional risks – Project risk All impacting Capital at Risk • Similar risks accepted at times of other material decisions: – Entry to a new market – Capital expenditure / new project development approval – Approval of a new product or technology – Disposals • Need mechanisms to quantify risks and subsequently monitor them

Musto Energy

Possible Approach to Capital at Risk Limits

Long-term risks (evaluated as impact on market capitalisation):

• • • •

Separate limits at project, jurisdiction and risk category levels Limit maximum potential single write-off to €X million or around Y% of market capitalisation Limit jurisdictional limits to €XX million or around YY% of market capitalisation, but review for any new markets Set global limits for mission critical risk categories at €XXX million or around YYY% of market capitalisation Examples of impact:

• •

Exposure to any commodity in a single market would be limited to €XX million NPV Single write-off limit of €X million might impose a requirement for JV partners for certain new investments Musto Energy

Risk Reporting - Capital at Risk

Required Frequency: 6 Monthly PLUS Event Driven Updates BU 1 BU 2 BU 3 Ireland BU 3 UK Etc.

Corporate Total Market Valuation Market / Revenue Risk Credit Risk Political / Regulatory Risk Project Risk ?

€m €m €m €m €m €m €m €m €m €m €m €m €m €m €m €m €m €m ?

€m €m €m €m ?

n/a €m ?

n/a n/a €m €m €m €m €m FX Risk ( Translation ) ?

Total Risk €m ?

€m n/a €m €m €m €m €m €m €m €m €m

Musto Energy

Indicate change since previous report

Summary: Key Steps & Issues

• Risk identification - across all categories • Routine measurement, monitoring & reporting of risk • Embedding risk management & control into everyday business operations and decision making • Board level risk literacy and championship of risk management • Regular review of risk management framework, risk reward balance and risk appetite

Musto Energy

Musto Energy

Adrian Musto is an independent management consultant and interim manager with over 30 years experience. He has extensive experience at senior level in risk management and energy trading, together with general and project management skills.

Recent assignments include: – Development and implementation of a revised organisation for energy trading and risk management framework for Airtricity – Work to develop risk appetite and measures and reports for the full range of financial risks across Airtricity’s businesses – Advice to an energy sector insurer on new product development – 2 years as Centrica’s Director of Risk Management.

Tel. +447860183660 email: [email protected]