Risk governance, risk tolerance and risk budgeting

The framework needs someone to say how much risk is too much, and a way to share that limit out. Those two jobs belong to governance and to the risk budget.

What is risk governance?

Memorize

Risk governance is the top-down process and guidance that directs risk management activities to align with and support the overall goals of the enterprise. It usually comes from a board of directors with fiduciary duties. The board does three things.

• It sets the organization’s goals, direction and priorities, which are the foundation for risk management.
• It sets the risk appetite or tolerance: which risks are acceptable, which are to be mitigated and how far, and which are unacceptable. It also gives a sense of the worst losses that could be tolerated in various scenarios.
• It provides risk oversight, including compliance with regulation, and gives management clear authority to carry the framework out.

Effective risk governance has these elements.

Risk governancetop-down process that aligns risk management with the enterprise goals

• Enterprise view Memorize whole economic balance sheet, not one business line
• Risk tolerance set in advance Memorize which risks are acceptable, which to mitigate, which not at all
• Risk management committee Memorize regular forum at management level
• Chief risk officer Memorize executive who builds and runs the framework
• Visible commitment from the top Use it risk culture, compliance, regular oversight

The enterprise view

Enterprise risk management is an overarching approach, applied across the organization and consistent with its strategy, that focuses risk activities on the objectives, health and value of the whole organization. It means looking at the entire economic balance sheet, not one part in isolation.

A manufacturer shows why. Its treasury team, judged on its own results, might put the company’s cash reserve into shares of cyclical companies for extra return. But the manufacturer’s own sales are cyclical too. In a recession the shares would fall just as sales dropped and the cash was most needed. A risk that looks tolerable for the treasury portfolio alone is not tolerable for the enterprise, and only a view of all its assets, liabilities and cash flows together shows the overlap.

The same view applies to individuals. A client’s wealth includes human capital as well as financial assets. An airline pilot who also holds a large stake in airline shares is concentrated in one risk.

The committee and the chief risk officer

A risk management committee gives managers a regular forum to discuss the risk framework and key issues. It parallels the board’s deliberations at an operational level. A chief risk officer (CRO) is the executive responsible for building and implementing the framework. A CRO is a strategic participant, not only a police role. In a large organization neither the CEO nor the chief financial officer (CFO) is a good substitute, because neither can give risk the specialized attention it needs.

Go deeper Risk culture: why the tone at the top matters

When risk is built into every key decision, the organization has an effective risk culture . Governance needs visible commitment from the top, because rules alone do not change behavior. Incentives matter too. Pay that rewards short-term profit without regard to the risk taken pushes people toward the excessive leverage and risky strategies that a stated tolerance is meant to rule out. Compare the board and risk themes in the corporate governance topic.

What is risk tolerance, and how does it shape risk management?

Memorize

Risk tolerance is the extent to which an organization is willing to experience losses or opportunity costs and to fail in meeting its objectives. It sits at the center of risk governance, and it is a board decision. The board does not usually choose the activities. Management does that within the tolerance.

The analysis starts with two views that are then integrated.

• Inside view. What shortfalls would cause the organization to fail, or to miss a critical goal?
• Outside view. What uncertain forces is it exposed to? These are its risk drivers.

Risk tolerancethe extent to which losses or missed goals are acceptable

• Starting analysis two views, integrated
  • Inside view Use it what shortfalls would make the organization fail its critical goals
  • Outside view Use it what uncertain forces (risk drivers) it is exposed to
• Should shape it
  • Goals, expertise and strategy Use it
  • Ability to respond dynamically to adverse events Use it
  • Loss it can take and still be a going concern Use it
  • Competitive and regulatory landscape Use it
• Often does, but should not
  • Personal agendas of board members (agency problem)
  • Size, a calm market, short-term pressure, pay

A board with a clear tolerance can then draw firm limits in advance, the way a lift has its maximum load stamped on the wall before anyone steps in. It can pursue risks where it has expertise and limit or hedge risks outside its core skills. A stated tolerance also steers strategy away from easy but reckless profit, such as excessive leverage or selling options on its own shares.

Once the tolerance is set, the rest of the framework measures, manages and reports compliance with it. Risk management then aligns risk exposure with risk appetite.

A shipping company’s board might decide that annual operating profit must never fall more than USD 25 million below plan. Every hedging, financing and investment decision is then tested against that limit. A strategy with a higher expected return that could breach the limit is rejected or hedged.

The individual’s decision is similar but harder. Individuals maximize their own utility rather than an observable market value, and many only think about it after a loss.

What is risk budgeting?

Memorize

Risk budgeting picks up where tolerance leaves off. Tolerance says how much risk is acceptable. Budgeting says how that risk is taken. It quantifies and allocates the tolerable risk by specific metrics, bridging the board’s decision and the many management decisions that create the actual exposures. In the purest sense a budget implies a total risk limit for the organization.

A risk budget can be one-dimensional or multi-dimensional.

Risk budgetany means of allocating by risk characteristics

• One dimension
  • Standard deviation Use it
  • Beta Use it
  • Value at risk Use it
  • Scenario loss Use it
• Several dimensions
  • Risk classes Use it equity, fixed income, commodity risk
  • Risk factors Use it exposure to value, growth and other premiums

The risk view often tells you more than the asset-class view. A foundation’s portfolio labeled 50% shares, 30% corporate bonds and 20% private credit looks spread across three asset classes. Viewed by what drives its returns, though, all three lose when the economy weakens and credit spreads widen, so most of its risk comes from a single source: the business cycle. Labels say little on their own. A water utility’s shares can be steadier than a fund of high-yield bonds. The risk factor approach goes further and budgets exposure to factors, such as value or momentum, in the hope of capturing the associated premiums.

The main benefit is that a budget forces trade-offs. If everything management wants to do exceeds the budget, risk goes first to the activities with the highest return per unit of risk. Management must also choose between doing less of a risky investment or doing more with a hedge, which tests each idea against the market’s risk-return line. Many individuals fail to budget: they hold large amounts of their employer’s shares, so their wages and savings depend on one firm.

Combining sources of risk

Standalone risks do not add up. If two sources are uncorrelated, they combine as the square root of the sum of the squares, which is less than the plain sum. With a correlation, a cross term is added.

$$\sigma_p = \sqrt{\sigma_1^{2} + \sigma_2^{2} + \cdots + \sigma_n^{2}}$$

$$\sigma_p = \sqrt{\sum_i \sigma_i^{2} + 2\rho\sum_{i<j}\sigma_i\sigma_j}$$

Raise the correlation slider from 0 to 0.5 and the default sources go over budget. At zero correlation the visual also shows how much of the budget each source uses.

$$\text{Share}_i = \frac{\sigma_i^{2}}{\sigma_p^{2}} \quad (\text{uncorrelated sources})$$

In the example the shares are 5.76 ÷ 8.89 = 64.8% for equity selection, 16.2% for fixed income and 19.0% for tactical allocation. Equity selection is by far the biggest user of the budget even though its standalone risk is only twice that of the others, because variance goes with the square.

Exam tip Risk budgeting does not require or prohibit hedging. Hedging is just one tool for staying inside the budget. A rule that limits the money spent on hedges is not a risk budget.

Go deeper Enterprise risk management versus siloed risk management

Siloed risk management gives each unit its own limit and optimizes it alone. The units may then hold risks that offset or, worse, compound at the level of the whole organization, and nobody sees it. The enterprise view sets a risk tolerance for the whole, budgets it across the units and measures total exposure. The cost of the enterprise approach is a bigger measurement and communication task, which is why it depends on infrastructure and on a CRO with real authority.