Risk-Adjusted Performance: A Primer

The CFO is the de facto chief risk officer at many organizations, so finance leaders are generally quite comfortable wearing both the risk management and the performance management hats. And that's a good thing, argues a new report from IBM Global Business Services: Given their strategic role, knowledge of operations, support of data and measurement initiatives, and accountability to shareholders, CFOs are ideally positioned to guide enterprise risk management activities.

At the same time, risk analyses rarely impinge on business performance management (BPM) programs. Relatively few companies have attempted to integrate the two disciplines to create true risk-adjusted performance models. For example, only about one-quarter of organizations have formal performance monitoring that incorporates risk indicators, and only 29 percent do risk-adjusted forecasting, according to the study.

Risk management and performance management have a lot in common, including their data- and metrics-based approach; their focus on improving decision-making; their use of analysis tools and dashboards; and even, sometimes, their data sources. Clearly, CFOs have a key role to play in developing a more realistic, risk-aware performance management strategy that can help the enterprise neutralize threats and exploit opportunities.

Integrating risk into performance management is a two-step process:

1. Develop a more holistic view of risk. Start by identifying and defining the most important risks. The main focus should be on threats to the organization's main value drivers, such as margin advantages and returns on invested capital.

Next, assess internal and external risks across silos. Companies tend to focus on external risks such as competitors and market shifts, but internal risks around strategy and operations should also be examined. This calls for an enterprisewide view of exposures across countries, business units, and functions.

2. Integrate risk into planning, budgeting, reporting, and forecasting. This is where CFOs can apply their knowledge of the key components of performance management to help guide the risk management strategy:

• Enhancing strategic and operational planning. "What-if" scenarios are familiar components of performance management programs, and similar techniques can be applied to the risk calculus. Organizations should look beyond their initial responses to a given risk scenario to consider the "ripple effects" -- the follow-on risks that an action might generate. For example, a company might plan to reduce its workforce in the event of a sudden drop in demand for its products. But that action might result in a loss of corporate knowledge and experience which could threaten future operations, so the expected cost savings should be adjusted to account for that risk.

• Optimizing budgeting (addressing risk and benefits). The outcomes or actions identified in the planning process are incorporated into the budget as ranges of possible costs and revenues. Organizations should be able to adapt their budgets over time as risk events unfold, factoring in risk mitigation costs.

• Enhancing monitoring, reporting, and corrective action. Only one-half of companies' management reporting tools, such as dashboards and scorecards, currently incorporate risk factors, the report notes. Organizations should consider creating key risk indicators (KRIs) alongside their key performance indicators (KPIs) and incorporating them into a performance and risk dashboard.

• Improving forecast accuracy. Among the tools that companies might want to consider are rolling risk forecasts for exposures that change over time; predictive analytics; and risk-adjusted forecasts for key business drivers such as revenues, volumes, and profits. The outcome of the effort? Fewer surprises.

Read the complete report, "Orchestrating Risk-Adjusted Performance Management: Identify and Address Risk Events Better and Faster," from IBM Global Business Services, here.

Listen to William Fuessler, global leader, financial management, IBM Global Business Services, discuss some of the best practices that can advance both BPM and risk management initiatives here.