When analysts at New York-based ratings agency Standard & Poors sit down with a companys management team, they want to know how well the executives understand and manage risk. Does the company have a chief risk manager? How strong is the risk-management function? What about operational as well as financial risks?
In these difficult times, when brand-name credits can fall quickly, effective enterprise risk management, or ERM, is emerging as a valuable factor in determining ratings, according to Puccia, who oversees S&P;s global insurance ratings criteria and quality. ERM has its roots in the financial-services industry, but companies in a wide range of industries are beginning to embrace it as a way to gain a competitive advantage over their rivals (see story, page 22). Two companies with equal risk-based capital are not equal in risk, Puccia says. The question is how their cash flows will emerge over time under various potential paths in the future, he says.
As companies seek to test various scenarios, the computer models are becoming increasingly sophisticated. But the assumptions behind the models need to be examined, and the models need to be validated to see if they deliver consistent results, Puccia says. We dont want to get ahead of the industry, he says. These are the early days, and we need to know if ERM systems are far enough along to have meaningful information for us.
If a companys executives meet with S&P;s analysts, however, and are unable to demonstrate that they have a handle on risk, this is likely to be a negative factor in a ratings determination.