WIXLIB

Market risks: These are the financial risks that arisebecause of possible losses due to changes in futuremarket prices or rates. The price changes will often relateto interest or foreign exchange rate movements, but alsoinclude the price of basic commodities that are vital tothe business.EXAMPLE 1: CADBURY’S SCHWEPPES’EXPOSURE TO FOREIGN EXCHANGERATE RISKThe confectionery giant, Cadbury Schweppes,recognized in its 2007 annual report that it has anexposure to market risks arising from changes in foreignexchange rates, particularly the US dollar. More than80% of the group’s revenue is generated in currenciesother than the reporting one of sterling. This risk ismanaged by the use of asset and liability matching(revenue and borrowings), together with currencyforwards and swaps.the borrower or counterparty, repayment sources, thenature of underlying collateral, and other support givencurrent events, conditions and expectations.” Additionally,the bank splits its loan portfolios into consumer orcommercial categories, and by geographic and businessgroupings, to minimize the risk of excessive concentrationof exposure in any single area of business.Financing, liquidity and cash flow risks: Financing risksaffect an organization’s ability to obtain ongoing financing.An obvious example is the dependence of a firm on itsaccess to credit from its bank. Liquidity risk refers touncertainty regarding the ability of a firm to unwind aposition at little or no cost, and also relates to the availability of sufficient funds to meet financial commitmentswhen they fall due. Cashflow risks relate to the volatilityof the firm’s day-to-day operating cash flow.EXAMPLE 4: A CREDIT TRIGGERCredit risks: Financial risks associated with the possibilityof default by a counter-party. Credit risks typically arisebecause customers fail to pay for goods supplied on credit.Credit risk exposure increases substantially when a firmdepends heavily upon a small number of large customerswho have been granted access to a significant amountof credit. The significance of credit risk varies betweensectors, and is high in the area of financial services, whereshort- and long-term lending are fundamental to thebusiness.A firm can also be exposed to the credit risks of otherfirms with which it is heavily connected. For example, afirm may suffer losses if a key supplier or partner in a jointventure has difficulty accessing credit to continue trading.EXAMPLE 2: AMAZON’S CREDIT RISKSAmazon, the global online retailer, accepts payment forgoods in a number of different ways, including credit anddebit cards, gift certificates, bank checks, and paymenton delivery. As the range of payment methods increases,so also does the company’s exposure to credit risk.Amazon’s exposure is relatively small, however, becauseit primarily requires payment before delivery, and sothe allowance for doubtful accounts amounted to just 40 million in 2006, against net sales of 10,711 million.EXAMPLE 3: CREDIT RISK MANAGEMENT INTHE BANK OF AMERICAIn its 2007 annual report (p.69), Bank of America statesthat it manages credit risk “based on the risk profile of6MANAGEMENT ACCOUNTING GUIDELINEBanks often impose covenants within their lendingagreements (e.g., a commitment to maintain a creditrating), and access to credit depends on compliancewith these covenants. Failure to comply creates the riskof denial of access to credit, and/or the need to takeaction (and costs involved) to restore that rating.For example, the 2005 annual report of Swisscom AGshows that the company entered into a series of crossborder tax lease arrangements with US Trusts, in whichsections of its mobile networks were sold or leased forup to 30 years, and then leased back. The leasing termsincluded a commitment by Swisscom AG to meetminimum credit ratings. In late 2004, however, adowngrading by the rating agencies took the company’scredit rating to below the minimum specified level.As a result, Swisscom AG incurred costs of SwissFrancs 24 million to restore that rating.EXAMPLE 5: HOW NOT TO MANAGEFINANCING RISK: NORTHERN ROCKThe UK bank Northern Rock provides a classic exampleof a company that succumbed to financing risk. Itsbusiness model depended upon access to large levelsof wholesale borrowing. But in late 2007, this fundingdried up during the “credit crunch” that arose out of theUS subprime mortgage crisis. Without access to loansfrom other commercial banks, Northern Rock was unableto continue trading without emergency loans from theBank of England to bridge its liquidity gap. However,even massive emergency loans were unable to restoreinvestor confidence in the bank, and the BritishGovernment eventually felt compelled to nationalize it.

Why Manage Financial Risks?Firms can benefit from financial risk management in manydifferent ways, but perhaps the most important benefit isto protect the firm’s ability to attend to its core businessand achieve its strategic objectives. By making stakeholders more secure, a good risk management policyhelps encourage equity investors, creditors, managers,workers, suppliers, and customers to remain loyal to thebusiness. In short, the firm’s goodwill is strengthened inall manner of diverse and mutually reinforcing ways. Thisleads to a wide variety of ancillary benefits: The firm’s reputation or ‘brand’ is enhanced, as thefirm is seen as successful and its management isviewed as both competent and credible. Risk management can reduce earnings volatility,which helps to make financial statements anddividend announcements more relevant and reliable. Greater earnings stability also tends to reduceaverage tax liabilities. Risk management can protect a firm’s cash flows. Some commentators suggest that risk managementmay reduce the cost of capital, therefore raising thepotential economic value added for a business. The firm is better placed to exploit opportunities(such as opportunities to invest) through animproved credit rating and more secure access tofinancing. The firm is in a stronger position to deal with mergerand acquisitions issues. It is also in a strongerposition to take over other firms and to fight offhostile takeover bids The firm has a better managed supply chain, and amore stable customer base.These benefits show that it is difficult to separate theeffects of financial risk management from the broaderactivities of the business. It is therefore important toensure that all parties within the organization recognizeand understand how they might create or control financialrisks. For example, staff in the marketing departmentmight be trained on how to reduce financial risks throughtheir approach to pricing and customer vetting. Similarly,buying policies can create financial risks by, for example,creating an exposure to exchange rate movements.Consequently, it is important to establish an integratedframework for managing all financial risks.A Risk Management FrameworkOrganizations face many different types of risks, but theycan all be managed using a common framework1. Theframework summarized in this section therefore directlyapplies to financial risk management, and provides acontext for subsequent sections that (a) outline thedifferent types of financial risks, and (b) explain howfinancial risks may be identified and assessed beforeimplementing appropriate strategies and control systems.Figure 2: The Risk Management CycleEstablish risk managementgroup and set goalsIdentify risk areasReview and refine processand do it againUnderstand and accessscale of riskInformationfordecision makingImplementation andmonitoring of controlsDevelop riskresponse strategyImplement strategy andallocate responsibilitiesSource: Risk Management: A Guide to Good Practice, CIMA, 2002.7

Risk Identification and AssessmentCIMA’s risk management cycle, illustrated in Figure 2,shows that risk management forms a control loop thatstarts with defining risks by reference to organizationalgoals, then progressing through a series of stages to areassessment of risk exposures following theimplementation of controls.The first stage is to identify the risks to which theorganization is exposed. Risk identification needs tobe methodical, and to address the organization’s mainactivities and their associated risks. Risk identification maybe carried out via questionnaires, surveys, brainstormingsessions, or a range of other techniques such as incidentinvestigation, auditing, root cause analysis, or interviews.The aim is to use staff expertise to identify and describe allthe potential financial risks to which the organization maybe exposed.At the organizational level, the stages of the risk cycleare set against the background of a clearly articulated riskpolicy. Drafted by senior management, the policy indicatesthe types of risks senior management wants the organization to take or avoid, and establishes the organization’soverall appetite for risk taking. The starting point is therefore a general understanding of (a) the range and type ofrisks that an organization may face in pursuing its specificstrategic objectives, and (b) the scale and nature of anyinterdependencies between these risks. This overview canthen be used as the basis for constructing a more detailedrisk management strategy for each risk category – in thiscase, financial risks.The scale of each identified risk is then estimated, using amix of qualitative and quantitative techniques. (We willhave more to say on these techniques below. For the timebeing, however, we focus not on the techniques themselves, but on how estimates of these risk exposures areput to use.) After this, risks are prioritized. The resultingrisk ranking should relate directly back to overall corporateobjectives. A commonly used approach is to map theestimated risks against a likelihood/impact matrix, such asthat illustrated below. Often, both likelihood and impactwould be classified into high, medium, or low. The morelikely the outcome, and the bigger the impact, the moresignificant the risk would become. And it is especiallyimportant to identify and assess those risks that have thepotential to severely jeopardize the organization’s ability toachieve its objectives, or even to threaten its very survival.Based on the cycle illustrated in Figure 2, the coreelements of a financial risk management system are: Risk identification and assessment Development of a risk response Implementation of a risk control strategy and theassociated control mechanisms Review of risk exposures (via internal reports) andrepetition of the cycleThe estimated risks can then be prioritized using alikelihood/impact matrix, such as that illustrated in Figure 3.Figure 3: A Likelihood/Impact PACT86MANAGEMENT ACCOUNTING GUIDELINEHigh

The numbers relate to individually identified risks, and riskimpact may be expressed in either financial (quantitative)or nonfinancial (qualitative) terms. A private sectorbusiness may express impact in terms of forecast income,profit, or cash flow. On the other hand a public sectororganization may measure impact in terms of its ability toprovide services to a prescribed level.Let us suppose that risk number five in the grid relatesto the likelihood and risk of the impact on bad debts of arise in interest rates. For a company retailing small-ticketconsumer goods, the anticipated likelihood is shown ashigh – probably because of prevailing economic conditions– but the impact is relatively low. The accompanying riskregister will include more specific details of the risk, suchas specific interest rate forecasts, as well as the estimatedmonetary impact and the assumptions underlying itscalculation. In the case of a mortgage provider operatingunder the same economic conditions, this same risk maybe identified as having a much higher impact because ofthe size of the potential defaults and the fact that lending isits core business. In other words, the component risks andalso the resulting matrix of likelihood and consequenceswill vary from business to business, and are subject to adegree of subjective judgment. As long as this subjectivityis recognized, the grid provides a useful tool for rankingrisks and determining the appropriate levels of monitoringand control.Many firms find it useful to record their risk information ina risk register. Such a register would include informationon the type of risk, its likelihood of occurrence, its likelyconsequence, its potential monetary impact, and itsrelationship (if any) with other identified risks. The riskregister, which would also include information such asforecasts of key variables, the assumptions on whichcalculations are based, and the institution’s response toeach risk, would be regularly updated.Risk ResponseThe organization then needs to respond to the risks it hasidentified. An example would include setting out a policydefining the organization’s response to a particular risk, andexplain how that policy fits in with its broader objectives.It would also (a) set out the management processes tobe used to manage that risk, (b) assign responsibility forhandling it, and (c) set out the key performance measuresthat would enable senior management to monitor it. Inmore serious cases, it might also include contingencyplans to be implemented if a projected event actuallyoccurred.The organization should take account of the effectivenessof alternative possible responses. This requires that itbe possible to identify the level of “gross” risk prior toa response, and the level of “net” risk left after it. Theorganization should also take account of the costs andprospective benefits of alternative responses, as well astake account of how any response would relate to its riskappetite and its ability to achieve its strategic objectives.The possible responses can be categorized into threecategories, as illustrated in Figure 4.Internal strategies imply a willingness to accept the riskand manage it internally within the framework of normalbusiness operations. An example would be a decision touse the customer’s currency for pricing of all exports, andusing internal netting processes to manage currencyexposures.Risk sharing strategies relate to strategies that mitigate orshare risks with an outside party. An example would be aforward contract, which ‘locks in’ a particular future priceor rate. This prevents losses from unfavourable currencymovements, but locks the buyer into a fixed futureexchange rate. Another example is a joint venture.Figure 4: Risk Strategies and ToolsInternal Strategies:Accept and manage as a normal operating risk Natural Hedging Internal NettingRisk Sharing Strategies:Risk sharing arrangements involving outside parties Risk Transfer Strategies:Risk transfer while maintaining upside benefits Options Insurance SecuritizationForwardsFuturesJoint VenturesSwaps9

Risk transfer involves paying a third party to take overthe downside risk, while retaining the possibility of takingadvantage of the upside risk. An option, for example,creates the opportunity to exchange currency at a preagreed rate, known as the strike price. If the subsequentexchange rate turns out to be favorable, the holder willexercise the option, but if the subsequent exchange rate isunfavourable, the holder will let it lapse. Thus, the optionprotects the holder from downsi

A glossary of key terms provides a quick source of reference. Underlying all of the material in this MAG is the premise that the key aim of financial risk management is to assist management in controlling risks that may affect the achievement of organizational objectives. There is no single ideal ri