Cost of risk management

(First of two parts)

Most company executives perceive that establishing a risk management practice can be a costly endeavor. However, most company executives would have difficulty estimating or providing a clear understanding us to the costs and mechanisms required to institute a reasonable risk management framework. Far more disturbing is the fact that the consequential loss arising from a potential risk materializing or the likelihood that such a risk may occur is not considered or integrated in determining the cost of risk (in a company).

The cost of risk is not a common term in the balance sheet, it is not a quantitative number typically seen on financial statements. Despite actions by regulators in recent times to include stricter disclosures on risk issues, the practice of risk management in general is still an evolving process and one that needs to be incorporated in the whole decision making process of most companies.

There are many signs of risk issues that materialized which have cost significant financial constraints to companies. Companies dependent on commodities such as steel, copper, oil, gold or even corn are generally susceptible to movement in commodity prices. In the end, we all know how risk may have a significant effect on the bottom line. Yet, the practice of good risk management is largely ignored or is not properly understood in the context of managing enterprises in general.

What exactly is the total cost of risk (TCOR)? We define TCOR as the resources spent by an organization to identify, analyze, and treat risks that may prevent it from achieving its strategic and financial goals. More specifically, TCOR comprises the following components: 1) Cost of Risk Retention, 2) Cost of Risk Transfer, 3) Cost of Risk Control, and 4) Cost of Risk Administration.

The following discussions will focus on these elements in order to clarify what they are and how they may affect management’s perception on their activities to mange risks within their own organization.

Cost of risk retention

The cost of risk retention is composed of losses that companies absorb – whether deliberately or not, and whether directly or indirectly. These are impacts of risks that have been either consciously or unconsciously retained. They also include all other losses arising from a risk event. Some examples are:

1) Additional cash infusion caused by capital dissipation, including the cost of raising capital – such as interests and other bank charges;

2) Deductibles shouldered by the insured companies during a claim on property damage, income losses, liabilities and personnel injuries, sickness and death;

3) Loss allocations provided in contract agreements not covered by any insurance coverage, such as demurrage and force majeure claims; and,

4) Uninsured perils as contained in the exclusion clauses of insurance contracts.

Retained losses increase when risks are not anticipated and adequately evaluated. There is lack of preparedness to deal with contingencies; hence, the inability to respond effectively. Such is the case with the global crisis we face today. The culprit is that of unsound risk management practices. The tremendous amount of bailout money illustrates the gravity of risk mismanagement.

To prevent the organization from exceeding its ability to absorb losses, it is prudent to have a risk retention policy guided by established and approved risk appetite and risk tolerance limits. In turn, these limits are influenced by the financial strength of the company and the robust risk management practices within the organization, which sustains such ability to retain risks.

Cost of Risk Transfer

Risk transfer is the process of moving the assumption of risk from one entity to another. When does risk transfer occur? Risk transfer occurs when the risk identified may have a significant effect on the company (financial or otherwise) such that the cost of transferring is conceivably more acceptable than maintaining the risk in the organization. A common way to transfer risk is through the procurement of an insurance contract. 

There are a variety of insurance protections covering a significant part of the risk spectrum – from life to non-life insurable interests. They include exposures on property, income, liability and personnel risks. 

Risk transfer instruments also vary by taking either insurance or non-insurance forms, such as derivatives and other alternative risk financing schemes. The concept is to pay a premium to another party to assume your risks instead of bearing them yourself.

Transferring all risks in bulk is not cost effective or reasonable. Insurance works on a risk sharing concept. Insurers would normally charge more for taking risks from ground up. An insured who shares the risk with the insurance company gets premium credits. The key is to balance the risk retention and risk transfer levels so that an organization only assumes a tolerable amount of losses at a minimum cost of insurance.

(Daniel Z. Barlicos is a Senior Manager for Risk Advisory Services of Manabat Sanagustin & Co., CPAs, a member firm of KPMG network of independent member firms affiliated with KPMG International, a Swiss cooperative.

The views and opinions expressed herein are those of Daniel Z. Barlicos and do not necessarily represent the views and opinions of KPMG in the Philippines. For comments or inquiries, please email [email protected] or [email protected]).