In our last article in this series, we discussed relative differences in risk appetite among builders and bankers. (You will recall that by builders, we mean those leaders who can “build a hot fire from a matchstick,” while bankers are those who can bank the coals of that fire to produce lasting “heat.”) In this, the final installment in the series, we will apply those relative differences to an application of Enterprise Risk Management (ERM): capital budgeting.
How can ERM be used in capital budgeting? If I know my residual risk level – the risk left over after mitigating responses – I can determine whether my capital level is adequate to cover new investments of capital to take advantage of strategic opportunities. That’s powerful knowledge to have.
Consider a credit union with $1 billion in assets and 10% capital. This credit union deploys an ERM program that quantifies risk in terms of impact, likelihood and mitigation. The impact is measured before mitigating responses, in terms of the potential impact of each exposure on a year’s worth of the credit union’s net income. The likelihood is also assessed before responses, in terms of the likelihood of each exposure’s occurrence in a given year, or for cyclical exposures, within the next 12 months.
We then consider all of our responses to each exposure, and estimate the degree to which those responses mitigate the exposure. Impact times likelihood equals inherent risk – the risk before responses, given the assessed likelihood. And inherent risk times one minus the completeness of mitigation (expressed in percentage terms) equals residual risk – the risk left over after our responses, i.e., the unmitigated impact.
For example, an exposure with an impact of $1 million and a likelihood of 50% would have inherent risk of $500,000. Assuming our responses mitigate 70% of that risk, we would be left with inherent risk of $150,000 – a considerable reduction in the potential exposure before responses. This amount of residual risk isn’t necessarily a bad thing; it may simply be seen as a cost of being in the risk-taking business, as all credit unions are.
When we sum the residual risk of all exposures across the credit union, we’re left with the total residual risk of the institution. For our example credit union, let’s say residual risk equates to $18 million. Dividing that by our total assets of $1 billion, we come up with residual risk equal to 180 basis points (bp).
Here’s where the application to capital budgeting comes in. The NCUA’s threshold for “well-capitalized” is 7%. If we add our residual risk of 180 bp to that, we have a proxy for a risk-adjusted capital threshold to remain well-capitalized in light of our unique residual risk position. That amount is 8.80%.
Given that our capital is at 10%, we have an adequate cushion – 120 bp – with which to take strategic action on new opportunities. If our actual capital ratio was, say, 9%, our cushion of 20 bp would provide far less comfort for most of us.
So how does that play into our discussion of builders vs. bankers? Some would argue that a more conservative approach to this exercise should be employed. One such alternative would be to run a Monte Carlo simulation of the individual years’ exposures, in which some exposures occur in some years, and do not occur in others. This should leave us with a normal distribution of residual risk, with the mean being approximately equal to our assessed residual risk.
The more conservative approach would use a proxy for an absolute worst-case scenario – the 99.9th percentile of our residual risk distribution – in applying the residual risk amount to the well-capitalized threshold. Let’s assume in our example that the 99.9th percentile is 250 bp. In this instance, our risk-adjusted capital threshold is 9.2%, leaving us with a 50 bp cushion for capital investment.
Here’s where the builders vs. bankers argument comes into play. The more risk-averse banker would likely use the 99.9th percentile as the basis for the risk-adjusted capital cushion. However, consider the unlikelihood of that scenario occurring: nearly every assessed exposure would occur within the next 12 months. We’d have a major data breach, merchant data breaches, a branch robbery, a natural disaster affecting our headquarters, a recession, a spike in interest rates … all in the same year. While possible, such a scenario is highly improbable.
Alternatively, the builder would consider the more aggressive (in terms of probability of occurrence) mean of the distribution, which again is analogous to our assessed residual risk. The builder would be more confident in his or her assessment of the likelihood of occurrence of the credit union’s exposures in the aggregate (although it may be wise to add a “margin of error” cushion of, say, 10% of assessed residual risk in the event the assessment is off, or we encounter an unexpected environmental factor that results in a larger-than-expected loss scenario).
Which approach is “right?” That all depends on one’s approach to risk. The more conservative banker would use the 99.9th percentile, but in so doing would likely have to forego some opportunities that might help better position the credit union against its competition. The less risk-averse builder, on the other hand, would use assessed residual value – again, possibly adding a cushion for margin of error. This credit union would be more aggressive in capitalizing on strategic opportunities in the pursuit of growth.
The trade-off is that this credit union would be at greater risk of falling below the well-capitalized threshold in the event of an unanticipated near-worst case scenario. One way to address that – under either approach – would be to determine the lowest acceptable level of capitalization in a near-worst case loss scenario, and factor that level into the capital budgeting exercise as a test of the results of such a severe loss occurrence. In this instance, we could apply the 99.9th percentile loss to our capital position using residual risk as our threshold, to determine whether an extreme loss scenario would penetrate the minimum acceptable capital level.
For more information on how to incorporate ERM into your credit union’s strategic planning process, or to assess your credit union’s risk appetite, contact Jeff Owen, Senior Consultant with The Rochdale Group, at (800) 424-4951, ext. 8011 or jowen@rochdalegroup.com.