Risk-Based Decision Making: Where ERM Creates Value (Chapter 24)
Book: Enterprise Risk Management: From Incentives to Controls
Author: James Lam
ISBN: 978-1-118-41361-6
Chapter 24 asks the question that matters most: how does ERM actually create value?
Lam tells a story from a research trip to Beijing. He met with the CRO of one of China’s largest banks. They reviewed the four ERM building blocks (governance, assessment, risk management, reporting). The CRO said risk assessment was most important because it identifies and analyzes risks accurately.
Lam disagreed. Risk management is the only component that actually changes the company’s risk/return profile. Assessment and reporting give you information. Decisions and actions create value.
The 80/20 Rule
Risk teams often spend 80% of effort on data, models, and reports. That produces maybe 20% of the value (better information).
Risk-based decision making takes 20% of the effort but produces 80% of the value (better business decisions).
The typical bottom-up approach to risk systems: define models and data → build the system → deliver prepackaged reports → recipients struggle to understand metrics → system becomes a compliance tool with little decision impact.
The better approach is top-down:
- Identify who makes decisions and what they need
- Design concise, useful reports (prototype and iterate)
- Build models and data sources to support those reports
Five Risk Decision Choices
- Risk acceptance or avoidance (new products, market expansion, M&A, capital budgeting)
- Risk mitigation (policies, limits, monitoring, contingency plans)
- Risk-based pricing (incorporate full cost of risk into product/service pricing)
- Risk transfer (hedging, insurance, securitization when retention costs more)
- Resource allocation (staff, economic capital, budgets to highest risk-adjusted returns)
Who Makes Which Decisions
Business units (first line): Accept/avoid daily risks, price products, implement tactical mitigation.
Corporate management + CRO (second line): Allocate capital, execute growth strategies, run enterprise risk transfer.
Board (third line): Set risk appetite and tolerances, approve capital structure and dividend policy, review major strategic decisions.
Four Value-Creating Applications
1. Risk-Based Pricing
Companies only get paid for risk at one point: pricing. Underpriced risk boosts short-term revenue but destroys long-term shareholder value.
Total cost of risk includes:
- Expected loss (average annual loss)
- Unexpected loss (economic capital × cost of equity)
- Risk transfer costs
- Risk management costs (staff, systems)
RAROC example: A $100M transaction with 2.5% margin generates $2.5M revenue. After $0.5M expected loss, $1.0M expenses, and 40% taxes, net income is $0.6M. With $2.0M economic capital allocated, RAROC = 30%.
If RAROC > cost of equity (Ke), the business creates value. Do more of it. If RAROC < Ke, raise prices, cross-sell profitable products, or exit.
Reverse pricing: If a competitor drops margin to 2.3% and your minimum hurdle is 20% RAROC, risk-based pricing calculates you need a 2.2% margin to hit that target.
Banks have used this for 20+ years. Non-financial companies (Microsoft, Airbus in Chapter 18) need it too.
2. Mergers & Acquisitions
Traditional M&A analysis looks at earnings dilution/accretion. It doesn’t adjust for risk.
Example: Company A considers acquiring B or C at the same price. Traditional analysis favors Company C (higher RAROC, higher market-to-book, anti-dilutive vs. dilutive for B).
But ERM adds diversification benefits. Acquiring B gives 30% economic capital reduction (210 vs. 300 combined). Acquiring C gives only 10% (270 vs. 300). After risk adjustment, B becomes the better deal with higher RAROC and market-to-book.
3. Risk Transfer at the Enterprise Level
Silo risk transfer is inefficient. The treasurer hedges interest rates. The insurance manager buys P&C coverage. Each solves a micro-problem.
ERM integrates all risks into a firm-wide portfolio. Benefits:
- Maximize diversification before transferring residual risk
- Avoid over-hedging some risks and under-hedging others
- Optimize insurance attachment points and derivative structures
- Arbitrage between traditional and alternative risk transfer products
Ceded RAROC measures the effective cost of risk transfer: incremental return change ÷ incremental economic capital change. If ceded RAROC < Ke, the transfer creates value. If ceded RAROC > Ke, you’re paying too much.
4. Strategic Risk Management
When companies suffer a 30%+ relative market value drop, research consistently shows strategic risk is the main cause:
| Study | Strategic | Operational | Financial |
|---|---|---|---|
| James Lam & Associates (2004) | 61% | 30% | 9% |
| Corporate Executive Board (2005) | 65% | 20% | 15% |
| Deloitte Research (2005) | 66% | 61% | 37% |
GE Capital Policy 6.0 is Lam’s best-practice example for strategic risk. Every new business, product, or investment requires:
- Key assumptions identified (business trends, customer needs, disruptive tech)
- Monitoring systems for KPIs, KRIs, and early warnings with named owners
- Trigger points (positive, expected, negative) that initiate management actions between quarterly reviews
- Management decisions (accelerate plan, mitigate, or exit)
Up to 70% of new business initiatives fail to meet expectations. Policy 6.0 helps reallocate resources to the 30% that work.
Case Study: Duke Energy
In July 2000, Duke Energy’s executives reviewed three scenarios: Economic Treadmill (1% GDP growth), Market.com (internet revolution), and Flawed Competition (uneven deregulation, price volatility).
They appointed Richard Osborne as their first CRO. Management set signposts for each scenario: macro indicators, regulatory trends, technology, competition, consolidation patterns.
Over time, many signposts for “Flawed Competition” were flagging. Duke acted accordingly. While competitors expanded rapidly into power demand, Duke sold unfinished Texas plant assets fearing oversupply.
For the five years ending December 2012, Duke delivered 6.7% shareholder return vs. 1.7% for the S&P 500 and 0.1% for the Philadelphia Utility Index. ERM wasn’t a profit inhibitor. It was a competitive advantage.
The Point
All four ERM building blocks matter. But risk management decisions are where the money is made or lost. Build your systems, reports, and assessments to support those decisions. Not the other way around.
Previous: Enterprise Risk Assessment | Next: ERM Dashboard Reporting