The best-laid plans ..

Strategic risk is recognised as a potential serious risk under Pillar II of Basel II. But isolating what strategic risk actually is, let alone how to quantify it, has caused some problems for risk managers. Bob Allen of the Australian Prudential Regulation Authority makes some suggestions

There is no commonly accepted standard definition of strategic risk. It is identified as a potentially significant risk in Pillar II of the Basel II framework, but no definition is provided. In its Pillar II guidelines, the Committee of European Banking Supervisors (CEBS) suggests the following: strategic risk is "the current or prospective risk to earnings and capital arising from changes in the business environment and from adverse business decisions, improper implementation of decisions or lack of responsiveness to changes in the business environment".

There is nothing inherently wrong with this definition, as far as it goes. But it is not particularly helpful in terms of providing guidance on how strategic risk might be analysed and quantified. First, there is considerable potential overlap with the standard Basel II definition of operational risk, which is: "the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events".

The two definitions overlap to the extent that they both deal with the potential for failed implementation of business decisions and the impact of external events. Also, both definitions muddy the picture by not clearly distinguishing between the inherent external risks the institution faces and the potential inadequacies in the internal governance and management processes in place to deal with those risks.

Another definitional issue arises with respect to the term 'business risk'. Business risk and strategic risk are often used interchangeably. In some cases, business risk is used to describe the risk arising from so-called operational leverage - the magnified sensitivity of net income to reductions in revenues due to the inability to quickly reduce fixed costs in line with reduced variable revenues. In other instances, business risk is given entirely different meanings: in the CEBS Pillar II guidelines, for example, it is used as an umbrella term to describe all Pillar I and Pillar II risks. For the purposes of this discussion, strategic risk and business risk will be considered as a single risk category, which will be referred to as 'strategic risk'.

One way to describe strategic risk is to consider what it isn't. So, inherent strategic risk could be defined as 'all external risks to the viability of the business that are neither financial (credit, market, liquidity) nor operational in nature'.

By itself, this definition would not be of much practical use. Perhaps the best way to expand it into something useful would be to look to the standard strategic planning analytical framework - that is, the strengths, weaknesses, opportunities and threats analysis. In this context, the threats would be the main focus.

This definition could be fleshed out by expanding on the nature of the threats involved in the 'changes in the business environment' element of the CEBS definition. It might be 'external risks to the viability of the business arising from unexpected adverse changes in the business environment with respect to: the economy (business cycle); the political landscape; law and regulation; technology; social mores; and the actions of competitors'.

These risks can manifest themselves in terms of the following:

- lower revenues - reduced demand for the products and services in question;

- higher costs - increased unit costs for the required factor inputs;

- cost inflexibility - inability to reduce (fixed) factor inputs quickly in line with lower-than-anticipated business volumes.

If any of these risks actually occur, it could lead to declining (or negative) ongoing profitability for the business activity in question, or immediately crystallised losses involving the write-off of assets and/or provisioning against expense commitments. Both result in the destruction (or possibly the total elimination) of shareholder value.

Potential strategic risks are a function of the environment in which the institution chooses to operate and apply equally to all institutions operating in a particular environment. However, the likelihood of suffering from these strategic risks - and the magnitude of their potential financial effects - is clearly a function of a particular institution's competence in strategic management and the quality of its governance and management processes for identifying, monitoring and mitigating the risks.

Quantifying strategic risk

A distinction is sometimes drawn between 'risk' and 'uncertainty'. These are often considered as one but, where the distinction is made, risk generally describes the situation where all possible outcomes fall within a definable universe and the likelihood of a particular outcome occurring can be determined quantitatively using standard statistical techniques. Uncertainty, on the other hand, is just that - uncertainty. Even the nature and range of possible outcomes is unknown, let alone the probability with which any particular outcome may occur. Much so-called strategic risk is in fact strategic uncertainty. It is just as likely that an unanticipated event of a type never experienced before will occur as it is that there will be a recurrence of an event that has been observed in the past. This might suggest that strategic risk is totally unquantifiable, but that may be unnecessarily defeatist.

Whether it be strategic risk or strategic uncertainty, the potential consequences are the same: unexpected losses may arise that erode available capital resources, potentially to the point of insolvency. Both institutions and their prudential regulators want comfort that available capital resources will be sufficient to absorb unexpected losses, and that the banks will remain solvent in most conceivable circumstances - not all conceivable circumstances, which is clearly impossible, but certainly most.

Given the existence of pure uncertainty, in addition to quantifiable risk, a standard value-at-risk (VAR) approach based on measurement of the potential unexpected loss for a required statistical confidence interval over a given time horizon, drawing exclusively from past experience, would not by itself generate a sufficient capital number. A two-step process would seem necessary. The first step would involve a VAR-type calculation based on relevant historical experience. This would then be supplemented by the results of scenario simulations involving a range of plausible but unlikely worst-case strategic planning assumptions.

It would be inappropriate to try to prescribe in detail what should or should not be included in the historically based VAR component of a strategic risk capital calculation, given the significant variations in different institutions' business models. But it would seem reasonable to expect that the analysis should at least draw on historic experience with respect to:

- revenue volatility around the long-term trend growth rate;

- the current level, long-term trend and volatility in the expense-to-revenue ratio; and

- significant actual (non-credit, market or operational risk-related) asset write-offs or realisation losses, and crystallised expense charges.

It would seem even less appropriate to be prescriptive with respect to the range of strategic risk scenarios that should be considered. But it should nonetheless seem reasonable to expect a rigorous strategic scenario-testing process. Also, in seeking to quantify the potential cost impact of these adverse strategic scenarios, it is important that not only the immediate costs or write-offs are taken into account, but also the reduction in franchise value resulting from damage to the institution's reputation.

- Bob Allen is a senior adviser at the Australian Prudential Regulation Authority (Apra) in Sydney, currently responsible for the design of Apra's approach to the implementation of Pillar II of the Basel II framework in Australia. The views expressed in this article are those of the author and do not necessarily reflect those of Apra. Nothing in the article should be construed as Apra policy. Email: [e-mail].