.png)
RISK MANAGEMENT IN THE AGE OF CoVID: HOW READY WERE PHILIPPINE BOARDS FOR THE PANDEMIC?
A. BACKGROUND
On April 6, 2020 as the SARS-Coronavirus-2 was beginning to spread throughout Metro Manila, the Institute of Corporate Directors (ICD) through its Research unit asked its members to answer a survey (see Annex A) designed to see how companies and their boards were responding to the pandemic.
By the time the survey was closed on April 21, sixty-eight (68) members had responded. The profile of respondents were roughly representative of ICD’s membership in terms of industries represented, annual revenues and type of ownership (i.e. privately-held or publicly-listed corporation [PLC]).
Of the 68 responses, 27 or approximately 40% of respondents said that they had a risk management strategy (RMS) in place prior to the crisis while the balance of 41 or 60% of respondents replied in the negative.
B. KEY FINDINGS
It pays to be prepared. Companies with an RMS felt that they were better prepared to deal with the crisis compared to those without one.
About 2/3 of respondents did not make use of any risk management tools. Of the ones who did, the most commonly used tool was a business continuity plan.
The majority of those companies with an RMS reported annual revenues of over P5 billion (approximately US$100Mn), were PLCs and belonged to the financial services sector. These companies seem to see the need for an RMS to manage their large and complex businesses.
While many companies have a risk management infrastructure in place (i.e. presence of an RMS, the appointment of Chief Risk Officers to oversee the risk management function on a day-to-day basis, dedicated risk committees at the board level), these did not necessarily guarantee satisfaction with management’s response to the crisis. According to the survey, the companies who were most satisfied with the responses of their management to the crisis had a risk management culture that articulated risk limits, considered novel risks1 such as CoVID-19 in their RMS’ and spent time specifically talking about risk at the board level.
Notwithstanding their apparent usefulness in coping with the pandemic, successful companies believe that there is still room for improvement in their RMS’ based on what they learned from their pandemic experience. They are also prepared to upgrade the skill set of their current boards and add more people who can help them better manage risk. In contrast, those companies without an RMS seem resistant to change.
C. SURVEY RESULTS & ANALYSIS
All Respondents
Financial services companies represented the greatest proportion of those with an RMS. This should not be surprising considering that the success or failure of companies in the financial services industries hinges on their ability to manage risk. Furthermore, regulators in these industries – the Bangko Sentral ng Pilipinas, the Insurance Commission and the Securities & Exchange Commission – are known to be particularly vigilant in the regulation of these sectors. Having said that, it is interesting to note that there was still a fairly significant proportion (20%) of companies in these industries which did not have an RMS. In contrast, the industries of those without an RMS were relatively evenly distributed among various sectors.
A significant disparity emerges when the annual revenues of both types of companies are considered. In the chart above, the greatest proportion of those firms without an RMS reported annual revenues of less than P100Mn while an even greater share of those companies with an RMS had annual revenues greater than P5Bn. This begs the following question: is the size of the company based on its annual revenues correlated with the presence/absence of an RMS? It is reasonable to expect that one of the reasons that a company is able to generate greater revenues than its counterparts lies in its ability to better manage the risks that it faces. In any event, the answer to that question will have to wait to be answered by another survey.
Another interesting trend emerges when we look at the profile of survey respondents based on the type of ownership of their companies. Almost 60% of those respondents who said that their companies were privately-held had no RMS. It is surprising that only half of PLCs reported having an RMS since these type of companies are expected to employ more sophisticated management practices than non-public ones.
I thought it was also significant that none of the not-for-profits reported having an RMS. Having worked in the not-for-profit sector for several years, I believe that this reveals a dangerous vulnerability since the limited sources of funding for such companies make them less resilient as profit-oriented companies.
Almost 30% of those companies without an RMS reported having between 3-5 directors on their board. In contrast, those with an RMS had more directors on their boards. One wonders whether the lack of warm bodies on the boards of smaller companies limited their ability to actively manage risk.
Around 70% of companies with an RMS reported assigning specific responsibility for managing risk on an operational basis to a CRO. In contrast, almost 60% of those without an RMS assigned this responsibility to their CEOs.
About 60% of all respondents with an RMS assigned board responsibility for overseeing the risk function to their risk committees. On the other hand, for those that lacked an RMS this responsibility was spread out among various board entities.
Another intriguing find involved the answers to the question on how much time the various boards spent specifically talking about risk on an annual basis. In this particular case, what struck me was not only the actual amount of time spent in discussions (about 20% of respondents from companies with an RMS spent more than 15 hours a year on the subject!) but an awareness of time spent as well. In the case of companies without an RMS, almost 70% of respondents left the question blank. On the other hand, none of the respondents from those companies with an RMS failed to answer the question. This suggests that they have a good idea of time spent talking about risk. Furthermore, it worth noting that the following about those respondents who said that they had RMS and spent more than 15 hours per year talking about risk:
ALL of them belonged to the financial services sector;
4 of them were PLCs.
5 of them had revenues > P5 billion.
ALL had risk committees
5 of them had dedicated CROs and
5 had RMS’ that covered novel risks.
Taken as a whole these suggest that, given the nature and size of their business as well as their public ownership, these companies took risk seriously. They set up their RMS and systems properly and took the time to ensure that these were working.
This level of attention is further emphasized in the slide above. Companies with an RMS used more tools to manage their risks than those without one. While a business continuity plan was the most prevalent tool used by those who answered the question, those with an RMS used balanced scorecards, scenario planning and risk registers as well. Note that about 75% of respondents without an RMS did not answer the question!
All the efforts taken by companies who had an RMS seem to have paid off during the crisis. About half of respondents with one had generally positive comments (i.e. OK or OK but could have been better) about the response of management and their boards during the crisis. On the other hand, those without an RMS did not submit any comments in roughly the same proportion.
Looking at the comments made by the respondents without an RMS (see Annex B), one cannot help but notice a degree of regret that their companies’ response were not more robust. This was a common sentiment expressed by those who were dissatisfied by their management or board response to the crisis.
Respondents Without An RMS
Looking past the crisis, we asked respondents without an RMS whether they would establish one given their experience during the pandemic. We found it interesting that more than half replied in the negative or were unsure.
It was also surprising that a significant majority of the same respondents felt that it was not necessary to appoint a CRO.
Respondents With An RMS
As for those with an RMS, it should be noted that almost 80% had either just updated these in 2019 or were in the process of doing so when the pandemic struck.
Almost half of those with an RMS included the possibility of novel risks occurring in their strategies.
Overall, about 90% of respondents with an RMS said that their strategies were of average use or better during the crisis.
The profile of these respondents were as follows :
financial institutions (14)
earned annual revenues of P1 billion or more (20)
had CROs (19)
had recently updated their RMS (2019-2020) (19)
spent more than 15 hours per year talking about risk (15)
had positive comments about the responses of management (15) and board (10) to the crisis (15)
Included ALL companies who had included novel risks in their RMS
specified risk capacities/risk tolerances/risk appetites (10)
ALL had used a tool like BCP (10), risk register (3), BSC (3)
The only reason given by those who were dissatisfied with their plans or useless was that they did not anticipate novel risks such as the eruption of Taal volcano or the pandemic.
85% of respondents with an RMS said that they would improve it further by taking into account the lessons learned during the crisis.
When asked specifically what aspects of their RMS’ they would improve upon, they answered that they would:
Document changes (18 respondents)
Strengthen measures vs compliance risk and operational risks (17)
Specify risk limits (9); 4 said they will adjust their limits based on their experiences from the pandemic
- 1 said it needs to put a peso value on risk (holding company PLC)
- 1 said the bank has established a risk appetite but did not do a sensitivity exercise to determine how much variation it could tolerate (financial services, PLC)
Change the composition of their boards to make them more responsive to risks(12)
Appoint a CRO (6) and
Include novel risks/crisis management in their RMS (2).
Finally, we asked them whether they would change their boards. Almost 45% of respondents with an RMS said they would.
D. CONCLUSION
The survey results give us to the answer to the question raised in the title to this paper. It is clear that the pandemic was a “Pearl Harbor” moment for many Philippine companies and boards. Looking at the answers provided by respondents whose companies did NOT have an RMS in place before the crisis, they had no plan in place to deal with a novel risk and were always reacting to rather than managing events. More significantly, it seems that many of these companies are condemned to repeat their experiences in the event that another novel risk occurs because of their refusal to make any changes to their risk management practices.
On the other hand, however, the lessons taken from respondents with an RMS (particularly those who considered novel risks) provide a road map through the pandemic and other crises for boards who are convinced that they need to take risk management seriously.
(Note: The survey also asked respondents other questions regarding their current and future board priorities and their predictions about the length and shape of economic recovery. The responses to these are found in Annex C.)
