This article in the July/August 2009 edition of The Corporate Board describes how scenario analysis can be used by boards to better understand firms\' risk exposures.

1. Scenario Analysis For Board
Risk Management
by Elizabeth Mays, Ph.D.
There is plenty of blame to go around for the suited to overseeing risk analysis and management.
past year’s market meltdown, but one charge Further, the audit committee already has a full agenda
points directly at corporate boards—they on which to focus, and may be unable to give risk
failed to understand the risks firms were tak- management the attention it deserves.
ing on. There are effective risk management Some companies, especially banks and insurance
techniques available to boards, beginning with companies have the principal function of risk tak-
sound scenario analysis. This power tool is a ing. They have formed separate risk committees of
scientific way for boards to ask “What’s the the board to focus exclusively on identification and
worst that could happen?” evaluation of the company’s risks.
The 2008 financial crisis and ongoing recession Boards must satisfy themselves that they un-
have made clear that corporate management must derstand the types and magnitudes of risks
increase its understanding of the risks facing their the company faces.
companies and enhance risk management practices.
It is also made clear that boards must do a better job More companies are considering adding a risk
of understanding and evaluating companies’ risks committee. In general, if a company’s risks are sig-
and the magnitude of their exposure. nificant and complex enough that a chief risk officer
The OECD Steering Group on Corporate Gover- is needed, a separate risk committee is almost surely
nance published a report in February 2009 on fail- called for. The full board should certainly be briefed
ures in corporate governance during the financial periodically on risk, but a committee comprised of
crisis. They concluded that “the financial crisis can members with significant risk backgrounds is best
be to an important extent attributed to failures and positioned to understand and oversee these signifi-
weaknesses in corporate governance arrangements. cant issues.
When they were put to a test, corporate governance In addition to understanding how risk is managed
routines did not serve their purpose to safeguard by the firm, boards must satisfy themselves that the
against excessive risk taking.” reports they receive are sufficient to allow them to
Corporate boards are responsible for ensuring understand the types and magnitudes of risks the
management has as full an accounting of their risk company faces, and how they change over time.
exposures as possible, and that they have quantified Reporting should include a full “inventory” report
possible effects of risks on earnings, revenue, and of all material risks facing the company.
capital. In addition, monitoring reports showing the finan-
The audit committee has the primary responsibility cial impact of prior risk effects will allow the board
for risk oversight at most corporations. Many com- to evaluate how risk taking affects the firm. To assess
panies have now augmented their boards and audit how risk may affect future performance, management
committees with accounting experts recruited for and boards can use scenario analysis.
their expertise in evaluating accounting and financial
reporting risks. These directors generally have a very Elizabeth Mays, Ph.D., is senior vice president and head of
different background and set of skills from profes- consumer risk modeling and analytics at JPMorganChase.
sional risk managers, though, and may not be ideally [e-mail: emays@insight.rr.com]
THE CORPORATE BOARD JULY/AUGUST 2009 17

2. Elizabeth Mays, Ph.D.
Scenario analysis, sometimes known as stress the 2008 financial crisis). If used properly, though,
testing, is a tool that helps management quantify they can be very helpful in shedding light on risk
how revenue, expense, and other significant metrics exposures and measuring their magnitude.
may change. Outside market factors such as prices In the wake of the financial crisis, the Institute of
are considered. International Finance brought together a consortium
The terms “stress testing” and “scenario analysis” of commercial banks, investment banks, and insur-
are often used interchangeably. Sometimes, however, ance firms. This group laid out a set of best prac-
stress testing is used when we examine changes to a tices on risk management and other topics to guard
single market factor. Scenario analysis may examine against future crises. They recommended that firms
changes in multiple factors simultaneously. undertake a comprehensive stress-testing program,
Scenario analysis shows how vulnerable a company one well integrated into its overall risk management
may be to a variety of events. It can help management infrastructure. The group listed the following prin-
and boards have meaningful discussions about the cipals for implementing and using scenario analysis
risks the company faces and what should be done and stress testing:
to manage them. Stress testing needs to have a meaningful
For more than a decade, financial services com- impact on business decisions. Senior management
panies have used scenario analysis to estimate how and boards have an important role evaluating stress
revenue, expense, and capital may be affected by testing results and their impact on the risk profile of
various scenarios. The OECD report also noted that the firm.
the “importance of qualified board oversight, and Firms should develop internal procedures that
robust risk management . . . is an essential, but often make stress testing part of the management culture,
neglected, governance aspect in large, complex non- so that these results have a meaningful impact on
financial companies.” company decisions.
One very common use of scenarios analysis is Stress testing should include challenging sce-
to assess interest rate risk. The analysis examines narios. These should be defined and developed as
how net income and net worth are likely to change conditions evolve.
if interest rates should go up or down by say, 100 Stress testing policies should be designed so that
or 200 basis points. the likelihood of severe events is not consistently
Credit risk can be examined in a similar way by underestimated.
evaluating what risk factors cause obligors to default,
and varying those risk factors to evaluate the resulting
risk. Often, financial firms use their internal data to To use scenario analysis effectively firms need
build models that help them understand the sensitivity to identify major risks, determine how internal
of the external risk factors to internal metrics. Non- financial metrics may change in response to
financial companies can and should do the same for market variables, select the right scenarios
a better understanding of the risks they face. to examine, and evaluate the exposures.
Identify the risks. If we take a very broad view
Risk models have their limits (as we saw in of risk, we can define it as any unexpected cost or
the 2008 financial crisis). Yet they can be very unanticipated decline in revenue that arises due to un-
helpful in shedding light on risk and measur- predicted circumstances or events. We mainly focus
ing its magnitude. on financial risks here, but you can build scenarios
around other risks as well, such as natural disasters,
Risk models undoubtedly have limitations (and industrial accidents, IT security, and so forth.
certainly many model users in the industry missed Most companies already have a good understand-
18 JULY/AUGUST 2009 THE CORPORATE BOARD

3. BOARD RISK MANAGEMENT
ing of many of the risks they face. Most financial ring, but would deal a severe blow to the company
risks that can be analyzed with scenario analysis fall if they did.
into the category of market risk, counterparty risk Boards and management should discuss how the
(including credit risk), or operational risk. Market models deal with these scenarios. Because they are
risk is a risk faced by all participants in a particular rarely seen, little historical data is likely to exist to
market. Examples include exposure to foreign cur- estimate how expenses or revenues would behave
rency, interest rates, or commodities prices changes. in reaction to them. In that case, management may
Counterparty risk occurs when someone with whom make informed projections to cover the more extreme
the firm has contracted does not follow through with scenarios.
their obligations. This includes those to whom the Compile a set of scenarios. Management is
company has extended credit (loans or purchases of likely to have its own set of scenarios it believes are
debt instruments). Operational risks arise during the important to analyze, but this is a place where the
execution of a corporation’s business functions. board should have input as well.
There will always be some risks that are not en- To determine appropriate scenarios for market risk
visioned by either the board or management. Some factors, look at historical data on the factor going
are known but cannot be measured. Corporations back several years (or ideally, as long as data on the
must recognize that such risks will always exist, and risk factor has been collected). Examine data on com-
hold an extra capital cushion to protect the company modity prices, exchange rates, or interest rates going
from them. back several decades. Look for highs and lows, large
Estimate how cash flows will vary. To do sce- jumps or ramps up or down over a short period of
nario analysis, we first need to estimate how cash time, or other extreme behavior. These values form
flows will change in reaction to changes in market the basis for scenarios to be examined.
factors. Sometimes the relationship is clear and easy If any of these market variables are currently at
to quantity. For example, it is straightforward to a historical high, ask how long that might persist.
calculate by how much the dollar value of overseas For example: Is a particular commodity overvalued
sales revenue changes when exchange rates fluctuate relative to its long-term sustainable trend? Thus,
(assuming sales stay constant). Similarly, it is clear should scenarios involving large declines be given
how much expenses will increase if the price of a more credence? Although difficult to spot before
commodity should double. they burst, asset bubbles do occur, and when they
Other relationships are not so clear, however, and pop can be disastrous.
may need to be estimated using historical data and
statistical behavioral models. Such models require
past data on the metric of interest and the outside The financial sector did not believe such a
market factor so their correlation can be calculated. dramatic drop in house prices could happen.
Also required are analytics personnel who have the No one envisioned a scenario where prices in
knowledge to build such models and estimate the some markets would fall 40 percent.
sensitivity of market factors. If a company lacks this
capability, many consultants and vendors make such Housing prices and technology stock values are
models available. two examples of bubbles that burst with resounding
Boards are unlikely to have the capacity to delve effects. Oil prices have also shown great volatility,
into these models in depth. However, they should collapsing in late 2008 after having doubled in the
at least be informed of any significant assumptions preceding two years.
incorporated into them. Some of the most important Boards should not hesitate to request analysis of
scenarios a firm should examine are those at the scenarios that may seem extreme. If mortgage in-
extremes. These have a low likelihood of occur- dustry analysts had given more weight to scenarios
THE CORPORATE BOARD JULY/AUGUST 2009 19

4. Elizabeth Mays, Ph.D.
Try Assuming The Worst
Sample Risk Scenarios
To use scenario analysis effectively, companies should:
List and rank their exposures to external factors
Develop a set of scenarios that includes extreme but possible scenarios
Discuss the likelihood of each scenario
Evaluate their ability to measure and manage the risk
Scenario
Risk Factor A B C D E
Interest rate risk –50 basis +50 basis +100 basis +200 basis +500 basis
Variable rate debt points points points points points
Hedging instruments
Net exposure
Currency risk –10% +10% +25% +100% +200%
Euro
Pounds sterling
Commododities risk –10% +10% +25% +100% +200%
Fuels
Supply inputs
involving steep housing value declines, the current and by more than 20 percent nationally, as has now
financial crisis might have been avoided. occurred.
A late 2008 Brookings Institute study analyzed It is exactly these types of scenarios boards need
why lenders failed to recognize the huge risk they to envision. This crisis should prod management
were taking by lending to high-risk customers and and directors to think about unlikely—but entirely
collateralizing the loans with homes whose values possible—scenarios their own companies face.
had skyrocketed. They questioned whether lenders When developing scenarios to analyze, it may
and mortgage security investors failed to understand also be useful to look at experiences of competitors,
the effect a housing burst would have on mortgage other industries or even other countries to see what
default rates. If this was understood, had lenders extreme scenarios have occurred there.
simply failed to believe that house values could turn We only have to look across the Atlantic to observe
down so steeply? several examples of housing busts since the 1970s.
The authors of the study concluded that the risk Finland, Spain, the UK, Italy, The Netherlands,
models used during this expansion did indeed prop- Norway, Sweden, and Switzerland all experienced
erly capture the sensitivity of mortgage defaults to peak to trough declines in house prices of 30 percent
declines in homeowner equity. The industry’s error or more. This makes housing busts seem not just
was in not believing house prices would stage such possible, but entirely likely. If analysts had seri-
a dramatic drop. Lenders and industry observers ously considered similar scenarios in 2005-2006,
appeared to believe that, at worst, the rapid spike lenders might have tempered their exuberance, and
in values might slow down or level off in coming investors would have limited their vast appetite for
years. Almost no one envisioned a scenario where mortgage-backed bonds.
house prices would drop 40 percent in some markets Careful evaluation of possible extreme moves in
20 JULY/AUGUST 2009 THE CORPORATE BOARD

5. BOARD RISK MANAGEMENT
commodities prices, interest rates, exchange rates of fuel and other supply inputs, exchange rates, and
or other risk factors may lead a company to rethink so forth can help boards form appropriate scenarios
hedging programs, or could even prompt a change to examine. Scenarios that are more extreme than
in strategic direction. those that have historically occurred should be part
Examine the exposures. Once the sensitivi- of the analysis.
ties have been estimated and scenarios selected, Directors should ask, “What are the risk/reward
the exposures can be examined. Reports should be tradeoffs, and is the company appropriately remuner-
compiled and reviewed with the board that lay out ated for the risks we are taking?” “Is the corporation
the most important risks and the various scenarios exposed to catastrophic losses?” Boards should ask
under review. themselves how well management is able to measure
It is vital that the board hear directly from the chief each risk. If a particular risk is not well understood
risk officer or other person charged with managing and its measurement rests on questionable assump-
risk. The CRO can best explain how the scenario tions, data, or models, perhaps that risk needs to be
analysis was designed and risk effects estimated. lessened or even eliminated.
Interaction with the risk manager also helps the board An important output of this process is a list of risk
delve into any unaddressed risk issues, or privately “mitigants.” These are actions that management may
question anything that may appear troublesome from take, either before, or in the wake of a major move.
a risk perspective. Being prepared with an action plan may help to
To consider how scenario analysis works in prac- limit damage in the event the scenario, or a similar
tice, consider the example of a fertilizer manufacturer one, plays out.
that operates in the U.S. and Europe. In addition to
regulatory risk, competitive risks, risks of low sales
due to weather conditions and others, the company You can never envision and quantify all risks.
is subject to at least three financial risks. A capital cushion is needed to protect a com-
Because the firm’s operations are funded with pany against unknown risks.
short-term floating-rate loans, it is exposed to rising
interest rates. The firm may choose to hedge this ex- Companies with any significant risk exposures
posure with interest rate swaps or other hedging tools. should consider forming a risk committee on the
Through its manufacturing and sales in Europe, it is board. Using scenario analysis can quantify the
subject to currency risk. In addition, its profitability effects of stress scenarios that can harm company
may be severely hurt by increases in fuel costs and performance.
prices of raw materials used in production. Management should rank their significant risks,
Risks and effects on the metrics of the various and discuss each scenario with the board, the likeli-
scenarios should be ranked, reviewed, and discussed hood of each scenario, their ability to react to them,
by management and the board. Results should be and how they might mitigate any risks they are not
examined, both gross and net of any hedging instru- comfortable with. Extreme or nearly unthinkable
ments. scenarios may not be so implausible after all, so do
Boards and management should discuss the like- not hesitate to evaluate them. The present financial
lihood of each scenario. Assigning a probability to crisis has encouraged us to think the unthinkable.
each scenario may make it more real to reviewers, Finally, recognize you can never envision and
and help evaluate the significance of the risk. The properly quantify all risks. A capital cushion should
probabilities should be updated as market conditions be held to protect the company against unknown and
change. As noted earlier, historical data on the price unquantifiable risks.
THE CORPORATE BOARD JULY/AUGUST 2009 21