Rating Risk Holistically

After years of sluggish progress, enterprise risk management (ERM) is finally making some headway in American companies. And nothing has given it more impetus than the increased interest of the big credit rating agencies, with Standard & Poor's leading the charge.

It's not hard to see why the agencies would want a holistic view of a company's risk. "A company that adopts ERM does so because it wants to have a comprehensive look at all its risks. Well, when we do a rating, we're doing it on the comprehensive enterprise," says David Ingram, director, enterprise risk management, at S&P. "So we saw a really good alignment between the objectives of the companies' ERM programs and the objectives we're looking for in a ratings evaluation."

Ingram heads up S&P's initiative to enhance the risk management component of its ratings framework, a project it launched about three years ago with a close look at trading risk management in financial institutions. In 2005, the rating agency rolled out what Ingram calls a "full ERM evaluation process" for insurers. Then it saw an opportunity to transfer the trading risk evaluation process to the utilities sector without a lot of additional development work. This work is ongoing, and Ingram expects to expand it into a full ERM view next year.

The ERM evaluation process "is a fundamental one that's integrated into our rating process," says Ingram. "It took us the better part of 9 or 10 months before it took hold and started to be really influential in our ratings decisions."

Initially, the analysts reported on ERM to the rating committees but didn't give it much weight. But before long, "it started to crop up regularly in our press releases on our rating committees, either as a driver of a ratings affirmation or a driver of a change in outlook on a rating or even a change of rating itself." ERM was a factor in only about a dozen rating changes or outlook changes, and the changes were both positive and negative, he reports.