Realigning Risk Management Priorities

Abstract

Industry surveys have shown that efforts of thwarting or at least mitigating strategic, operational, and financial risks may not always be adequately aligned: financial risks are given most of the attention, whereas lesser-mitigated strategic and operational risks account for most of a company’s volatility. The novelty of this article lies in the fact that we have made a sincere effort to efficiently estimate the total number of possible risk sources corresponding to three types of risk, namely, financial, operational and strategic. To address the issue of estimation, we have put forward two different approaches for what we call a proportional method, for a more balanced allocation of a company’s risk management priorities and resources by assuming a probability distribution for each of the three types of risk sources and then estimating the number of risk resources using the method of maximum likelihood. In addition, we have also discussed a scenario in which the risk-thwarting probability corresponding to any of three types of risks might be unknown, along with the unknown value of the number of risk sources.

1. Introduction

Over a decade or so, it has become increasingly evident that having a strong risk culture in any financial sector, medical sector and in many other allied industries is one of the key components of successful risk management, and management heads and/or competent authorities are focusing their attention in a more granular way in an effort to better understand risk behavior. Consequently, a significant amount of work has been directed across the industry over the past few years to effectively search for measures that will properly address all possible types of risk and subsequently take meaningful actions to safeguard from their detrimental nature at large.

Companies face three types of risk—strategic (S), operational (O), and financial (F) (Insurance companies additionally face insurance risks. Our considerations in this paper can be extended to any number of risks.)—and they come from multiple sources. We do not know the intensity of the risks, that is, the number of sources attacking a company, but wish to estimate the number for reasons such as better (re)alignment of a company’s risk management priorities and resources.

The number of risk sources is random and thus unknown, except perhaps that we can assume or estimate the distribution of the number. In what follows, we shall suggest two variations of a method, called the proportional method, that helps to cope with this randomness, given the degree of a company’s thwarting capabilities and the number of observed risk sources that have eluded the company’s capabilities. Namely, we shall either

(1)

Assume a certain intensity distribution for each of the three types of risk sources, such as the binomial, which we shall use in Section 4;

(2)

Estimate the likeliest number of risk sources, as we shall explore in Section 5.

Finally, some concluding remarks are made in Section 6.

2. Definitions of Strategic, Operational, and Financial Risks

In this section, we provide basic ideas related to three different types of risk, starting with the strategic risk.

Firms are exposed to several categories of risk that influence their performance, financial stability, and market valuation. Among the most significant are strategic risk, operational risk, and financial risk. These risks arise from different dimensions of the firm’s activities and collectively affect firm volatility and long-term sustainability.

2.1. Strategic Risk

Strategic risk refers to the risk arising from adverse business decisions, improper implementation of strategic initiatives, or failure to respond effectively to changes in the external environment. It is associated with long-term corporate strategy, including market positioning, mergers and acquisitions, innovation, and competitive dynamics.

According to [1], strategic risk reflects the uncertainty surrounding a firm’s ability to achieve its strategic objectives due to changes in industry structure, technological disruption, or macroeconomic conditions. Strategic risk can significantly influence firm value because unsuccessful strategic initiatives may lead to substantial financial losses and increased volatility in firm performance.

2.2. Operational Risk

Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people, systems, or external events. This definition is widely adopted by the Basel Committee on Banking Supervision [2] and is used extensively in the financial and risk management literature.

Formally, the Basel Committee defines operational risk as:

“The risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.”

According to [3], operational risk includes events such as internal fraud, system failures, process breakdowns, supply chain disruptions, and compliance failures. These risks can lead to direct financial losses, reputational damage, and operational disruptions, thereby contributing to firm volatility, see, for further details [4,5].

2.3. Financial Risk

Financial risk refers to the risk associated with a firm’s financial structure and its exposure to financial market fluctuations. It arises primarily from leverage, liquidity constraints, credit risk, interest rate risk, and foreign exchange risk.

As described by [3], financial risk reflects the uncertainty in a firm’s ability to meet its financial obligations due to variability in cash flows and exposure to financial market movements. Firms with higher leverage are generally more sensitive to economic shocks, which can amplify fluctuations in firm returns and increase overall volatility, see [6,7].

2.4. Interrelationship Between Risk Types

Although strategic, operational, and financial risks originate from different areas of the firm, they are often interrelated. Strategic decisions may influence financial leverage and operational processes, while operational failures or financial distress may undermine the execution of corporate strategy. Consequently, modern enterprise risk management (ERM) frameworks emphasize an integrated approach to identifying and managing these risk categories, see, for pertinent details [8,9,10,11].

In the next Section 3, we shall introduce some notation as well as numerical values to be used in our illustrative examples. In Section 4, we provide an outline of estimating the model parameters using the method of maximum likelihood. We complete this paper by providing some concluding remarks in Section 5.

3. Background Information

Let $p_S$, $p_O$, and $p_F$ denote the probabilities that any source of incoming strategic, operational, and financial risks, respectively, will be thwarted. Throughout the paper, we view these probabilities as main indicators of the company’s risk-thwarting capabilities. Given the number of employees working on thwarting risks and their level of expertise and experience, the three probabilities can, at least in principle, be assessed and thus assumed to be known, or at least bracketed.

Hence, suppose for the sake of argument that the company under consideration believes that ninety-nine out of one hundred risk sources can be thwarted in each of the three risk categories: strategic, operational, and financial. That is, the probabilities of thwarting the risks are:

$$p_S=0.99,p_O=0.99,\mathrm{and}{p}_F=0.99.$$

(1)

Consequently, the probability that any of the three types of risk is not thwarted is equal to $0.01$. It should be kept in mind, however, that probabilities (1) are subjective and reflect a company’s risk management point of view. We have chosen these probabilities to be equal to simplify our illustrative examples.

Next, suppose that a hundred risk sources have not been thwarted, and let their distribution be as follows:

$$\begin{array}{c}{k}_S=64 \left(\mathrm{observed}\right) \mathrm{strategic} \mathrm{risks};\hfill \\ k_O=35 \left(\mathrm{observed}\right) \mathrm{operational} \mathrm{risks};\hfill \\ k_F=1 \left(\mathrm{observed}\right) \mathrm{financial} \mathrm{risks}.\hfill \end{array}$$

(2)

The notably differing numbers suggest that mitigation efforts for the three risks are not properly aligned: the observed (i.e., not thwarted) strategic and operational risk sources greatly outnumber the observed financial risks. Certainly, we have made up these numbers, but they are in line with the percentages reported in the IMPACT Study by Huang, Scasso, and Segal (2009) [9], where it was found that the proportions of strategic, operational, and financial risk sources observed on the front page of the Wall Street Journal in the year 2006 were $0.64$, $0.35$, and $0.01$, respectively.

In what follows, we shall propose two procedures for achieving a better alignment of the risk management priorities and resources, given the illustrative “evidence” that we have specified in (1) and (2). We shall start with a simpler procedure, which we call a “rule of thumb,” and whose attractive feature is that it imposes no dependence structure on the risk sources—it can be any.

4. Realigning Risks: A Rule of Thumb

Throughout this section, we work under the following assumption.

Assumption 1.

Within each of the three risk categories, the company can thwart any risk source attacking the company with the same probability: $p_S$ in the case of strategic risks, $p_O$ in the case of operational risks, and $p_F$ in the case of financial risks.

This is a reasonable assumption if we want to establish a well-defined mechanism for (re)aligning risks so that a desirable risk distribution would be achieved. We do not, however, impose any condition on the dependence structure between risks, neither within nor between any of the three risk categories.

4.1. Estimation Strategy

Given the probabilities specified in (2), we can argue (The expectation of the sum of n random variables that take on values either 1 or 0 is equal to $nq$, where q is the probability of success (e.g., value 1) on each trial. If the number of observed successes is k, one would roughly (a kind of a rule of thumb) estimate the value of n from the equation $nq\approx k$, that is, $n\approx k/q$. This is how we have arrived at counts (3) using $q=1-p$.) that there might have been

$$\begin{array}{c}{n}_S=6400 \mathrm{inherent} \mathrm{strategic} \mathrm{risks};\hfill \\ n_O=3500 \mathrm{inherent} \mathrm{operational} \mathrm{risks};\hfill \\ n_F=100 \mathrm{inherent} \mathrm{financial} \mathrm{risks}.\hfill \end{array}$$

(3)

These are estimates of the intensities (i.e., the number of sources) of the three types of risks that are believed to have attacked the company. We call them “inherent” risks. Some of the risk sources have been thwarted, but some have not, and in the latter case, we call them “observed,” as we already did in (2).

4.2. Statistical Decision Approach

Suppose that after having looked at the intensities (3) of the three inherent risks, the company decides to realign risk management priorities and resources so that, on average, no more than 20 risk sources in each of the three risk categories would be observed. This means that the probabilities $p_S$, $p_O$, and $p_F$ (cf. (1)) should be adjusted in such a way that the three bounds $n_S(1-p_S)\le 20$, $n_S(1-p_O)\le 20$, and $n_S(1-p_F)\le 20$ would hold. With $n_S$, $n_O$, and $n_F$ given in (3), the three bounds can be rewritten as

$$p_S\ge p_S^0,p_O\ge p_O^0,\mathrm{and}{p}_F\ge p_F^0,$$

(4)

where the realignment probabilities are

$$p_S^0=0.997,p_O^0=0.994,\mathrm{and}{p}_F^0=0.8.$$

(5)

On comparing the corresponding probabilities in (5) and (1), we see that the efforts of thwarting strategic and operational risks have to be slightly increased, and this can be done at the expense of thwarting financial risks.

In general, given upper bounds $k_S^0$, $k_O^0$, and $k_F^0$ on the expected number of observed risk sources, the probabilities $p_S$, $p_O$, and $p_F$ should be such that bounds (4) hold with

$$p_S^0=1-{\displaystyle \frac{k_S^0}{n_S}},p_O^0=1-{\displaystyle \frac{k_O^0}{n_O}},\mathrm{and}{p}_F^0=1-{\displaystyle \frac{k_F^0}{n_F}}.$$

(6)

These realignment probabilities $p_S^0$, $p_O^0$, and $p_F^0$ are of course based on our “rule of thumb,” whose construction is based on the expected number of observed risk sources. In the next section, we shall depart from these expectation-based arguments and develop a probability-type method for deriving realignment probabilities. The method is reminiscent of the maximum likelihood technique.

5. Realigning Risks: Maximum Likelihood

Throughout this section, we work under the earlier introduced Assumption 1, as well as under the following one:

Assumption 2.

All the risk sources are independent.

This can be a strong assumption. We can depart from this assumption at the expense of more complicated mathematics. Indeed, extensions and generalizations of various parts of this paper are possible and will be explored in follow-up papers. From the practical point of view, but it allows us to explore deeper questions such as “what intensity could have likely caused the outcome that we have observed.”

Under this independence assumption, the distribution of, for example, strategic risk sources that the company has not succeeded in thwarting follows the binomial distribution $\mathrm{Bin}(N_S,1-p_S)$, where $1-p_S$ is the probability of not thwarting a strategic risk source, and $N_S$ is the (unknown) number of all inherent strategic risk sources. We do not know $N_S$, but we shall next estimate it using a maximum likelihood technique.

5.1. Estimating the Intensity of Inherent Risks

Assume that there are $k_S$ observed (i.e., not thwarted) strategic risk sources. Under the above assumed binomial model, the probability of such an event is equal to

$$\left({\displaystyle \genfrac{}{}{0pt}{}{N_S}{k_S}}\right){(1-p_S)}^{k_S}{p}_S^{N_S-k_S},$$

(7)

where $\left({\displaystyle \genfrac{}{}{0pt}{}{N_S}{k_S}}\right)$ is the binomial coefficient: “$N_S$ choose $k_S$.” Since the only unknown parameter in probability (7) is $N_S$, we obtain an estimate of it, denoted by ${\widehat{n}}_S$, by maximizing expression (7) with respect to all integers $N_S$ such that $N_S\ge k_S$. Hence, we view ${\widehat{n}}_S$ as a maximum likelihood estimate of $N_S$. In a similar fashion, we obtain estimates ${\widehat{n}}_O$ and ${\widehat{n}}_F$ of $N_O$ and $N_F$, respectively. We shall next explain how to easily implement this maximization procedure in practice, with further details relegated to Appendix A.1 at the end of this paper. In addition, some other legitimate procedures for estimating $N_S$ are also discussed in Appendix A.3.

5.2. Implementation and Numerical Results

In Appendix A.1, we shall show that probability (7) achieves its maximum with respect to $N_S$ at an integer value, say ${\widehat{n}}_S$, next to (left or right) the unique real number $x\in (k_S,\infty )$ that solves the equation

$${\psi }_0(x+1)-{\psi }_0(x-k_S+1)=log(1/p_S),$$

(8)

where ${\psi }_0\left(x\right)$ is the (classical) digamma function. This ${\widehat{n}}_S$ is our “maximum likelihood” estimate of $N_S$: it could be obtained by either rounding up or rounding down the solution x to Equation (8), with the choice between the two roundings carrying no practical importance. (In a numerical example below, we shall opt to round it up.) In a similar fashion, we obtain the estimates ${\widehat{n}}_O$ and ${\widehat{n}}_F$ of $N_O$ and $N_F$, respectively.

To illustrate the procedure, we work with the probabilities $p_S$, $p_O$, and $p_F$ specified in (1) (i.e., all of them are equal to 0.99), and with the same observed risk source numbers $k_S$, $k_O$, and $k_F$, as in (2). We get the following values:

$$\begin{array}{c}{\widehat{n}}_S=6400 \mathrm{inherent} \mathrm{strategic} \mathrm{risks};\hfill \\ {\widehat{n}}_O=3500 \mathrm{inherent} \mathrm{operational} \mathrm{risks};\hfill \\ {\widehat{n}}_F=100 \mathrm{inherent} \mathrm{financial} \mathrm{risks}.\hfill \end{array}$$

(9)

The obtained values are same as those in (3). Rounding down the solution x would have decreased the n’s by 1, which is, of course, of no significance from the practical point of view.

The fact that the two sets of observed risk sources are identical is somewhat puzzling, and this is not a general rule, as we shall see in Appendix A.2 at the end of this paper. There we shall put forth assumptions under which the two sets of numbers are similar, or even coincide. Next we shall elaborate on how to use the above obtained values to make better decisions.

5.3. Decision Making: Realigning Priorities

Given estimated risk intensities (9), the company wishes to reallocate its priorities and resources in such a way that, for example, there would be at most $K_S$, $K_O$, and $K_F$ observed strategic, operational, and financial risk sources, respectively, with probabilities at least as high as ${\pi }_S$, ${\pi }_O$, and ${\pi }_F$, respectively. These K’s and $\pi$’s are specified by the decision maker.

Hence, given the estimates ${\widehat{n}}_S$, ${\widehat{n}}_O$, and ${\widehat{n}}_F$, we want to find the smallest values (i.e., realignment probabilities) of the probabilities $p_S$, $p_O$, and $p_F$ such that

$$\begin{array}{c}\hfill I(p_S,{\widehat{n}}_S-K_S,K_S+1)\ge {\pi }_S,\end{array}$$

(10)

$$\begin{array}{c}\hfill I(p_O,{\widehat{n}}_O-K_O,K_O+1)\ge {\pi }_O,\end{array}$$

(11)

$$\begin{array}{c}\hfill I(p_F,{\widehat{n}}_F-K_F,K_F+1)\ge {\pi }_F,\end{array}$$

(12)

where I denotes the regularized incomplete beta function. If X follows the binomial distribution $\mathrm{Bin}(n,q)$, where n is the number of independent trials, with the success probability on each trial q, then the cumulative distribution function $F\left(k\right)=\mathbf{P}[X\le k]$ can be expressed in terms of the regularized incomplete beta function by the formula $F\left(k\right)=I(1-q,n-k,k+1)$. This expression is convenient because the regularized incomplete beta function is a built-in function in software Mathematica (version 14.3), which we use. For example, in the case of the strategic risk, we have the formula

$$I(p_S,{\widehat{n}}_S-K_S,K_S+1)=\sum _{k=0}^{K_S}\left({\displaystyle \genfrac{}{}{0pt}{}{{\widehat{n}}_S}{k}}\right){(1-p_S)}^k{p}_S^{{\widehat{n}}_S-k}.$$

The set of probabilities $p_S$, $p_O$, and $p_F$ that satisfy bounds (10) can easily be established using Mathematica. To exemplify the procedure, we set

• the maximal number of observed risks to $K_S=K_O=K_F=20$;
• the number of inherent risks ${\widehat{n}}_S$, ${\widehat{n}}_O$, and ${\widehat{n}}_F$ to those specified by (9);
• the degree of confidence to ${\pi }_S={\pi }_O={\pi }_F=0.95$.

With these values, bounds (10) become

$$p_S\ge p_S^0,p_O\ge p_O^0,\mathrm{and}{p}_F\ge p_F^0,$$

(13)

with the following realignment probabilities:

$$p_S^0=0.998,p_O^0=0.996,\mathrm{and}{p}_F^0=0.855.$$

(14)

On comparing the corresponding probabilities in (14) and (1), we see that the efforts of thwarting strategic and operational risks have to be slightly increased, and this can be done at the expense of mitigating financial risks. It is also instructive to compare probabilities (14) with those obtained using the “rule of thumb,” as reported in (5).

6. Concluding Remarks

Evaluation of risks and their proper alignment is of paramount importance to any production process. In this paper, we discuss some new strategies to appropriately capture the randomness of the number of risk sources appearing from multiple sources and to reallocate three types of risk with their due importance. Subsequently, we consider an associated intensity distribution for three different types of risk, namely, the binomial distribution. Some illustrative examples are provided to provide an insight into our proposed methods. We have also provided some real-life scenarios in which these methods can be used. Needless to say, other discrete probability models may also be examined, and associated classical and Bayesian inferences also need to be addressed. We plan to report this in a separate article somewhere else.