One fundamental task of any manager is to create sustainable value in a timely way that guarantees the survival of the company. So it is surprising to see how frequently companies make decisions that underestimate the importance of risk – an essential component of economic value. They confuse apparent profitability with real profitability, note Francisco J. López Lubián and Pablo García Estévez, finance professors at the IE Business School, in their new book, How to Manage Corporate Risks.

Their book, written from the viewpoint of a manager of a non-financial company, offers useful tools for identifying, quantifying and analyzing the key components of managing risk properly, and preventing risk from becoming a problem. Companies run a risk whenever there is volatility in projected results, but history can offer managers some strong signals about what to expect in the future. History enables managers to analyze risky scenarios using statistical data to estimate such key parameters as the mean, the variation about the mean, and so forth.

Nevertheless, the authors recommend that managers keep in mind a fundamental requirement for managing business risk: Companies need to understand that risk is not something entirely objective; it depends on the subjective criteria of the people who manage economic events. “When defining, managing and quantifying business risk, managers need to prioritize the criterion of reasonability rather than maintain the illusion that there is one precise way to measure risk by using complicated mathematical calculations, which [in fact] often [turn out to] have an innate tendency to conceal ignorance.”

Universia-Knowledge at Wharton: The current economic crisis has made it clear that companies have a lot of problems when it comes to managing risk. What do you attribute that to?

Francisco J. López Lubián: Whenever someone has a problem, a typical incorrect reaction is for him or her to deny that it exists. That denial can take various forms, from considering that “this doesn’t affect me,” to convincing yourself that “other people are to blame [rather than me].” This can happen with some specific risks that exist within companies. You may not be aware that [a risk] exists [because you think that it involves other people], or you believe that [the risk] is very hard to quantify and manage. But “difficult” is not the same thing as “impossible.”

In my experience, when a manager thinks about the risks in his company, the problem is that he doesn’t know how to assess their impact [on his company]. For example, if I am highly leveraged, how can foreign exchange risks affect me? In many cases, managers lack a methodology that helps them identify their risks and relate them with one another.

Clearly, the solution is to try to be more proactive about managing risk, and to avoiding over-reacting. It is as much an over-reaction to believe that risk doesn’t exist at all as to believe that you can act only when you have totally eliminated any risk.

Universia-Knowledge at Wharton: Given this relative failure, do you believe that it would be necessary for banks and other sectors to reconsider how they manage risks, and the tools they use?

Pablo García Estévez: More than doing a reassessment, they should return to caution. They have always had the tools and rules. It is another thing for them to be relevant [tools and rules]. In our book, we explain a methodology for identifying risks, and we detail the financial tools that can be used to cover those risks.

Now we are going to continue to be in an extremely conservative period because there are no alternatives. Before the crisis, the people responsible for making investments were capable of side-stepping risk committees by using the excuse that if they did not approve a project, the company would stay outside the market. But now we’re back to where we need to be: Corporate risk committees are as important as they always used to be. We hope that when growth returns, the excesses won’t also return.

Universia-Knowledge at Wharton: What lessons have been learned in this crisis?

López Lubián: The main lesson is that you cannot confuse apparent profitability with real or economic profitability, and that risk is an essential component of economic profitability. People always confuse apparent profitability with the real thing because they undervalue risk. In the case of the current crisis, everything began with an apparent value (because risk magically disappeared) created by securitized assets based on sub-prime real estate loans. The securitized assets went from being the stars of the financial firmament to pariahs that were considered infected or poisonous. Apparent profitability turned into real losses that spread like a cancer.

There are other lessons that we should all learn from this crisis:

  • Managers should not delegate control and risk management to the ratings agencies.
  • Be prepared for things to happen that managers never thought would happen.
  • Do not use the maximum amount of financial leveraging — flexibility always has its compensation.
  • Know how much risk you are exposed to on your [corporate] balance sheet.

For example, the entire world [that can] is now focusing on refinancing and restructuring its debt. At times like these, you notice if those who negotiated the debt understood and took into account the risks that they were assuming.

Universia-Knowledge at Wharton: The book focuses on risk management from the perspective of a manager of a non-financial company. In this sense, what types of risks exist? Are they all equally easy to manage?

López Lubián: In our book, we propose a methodology for analyzing risks and for distinguishing between operational risks and financial risks.

Operational risks are related to operational aspects of the company, and are identified and measured in a similar way to the way we classify the operations of the company. Generally speaking, the operational risk of a non-financial company can be measured by the volatility of the cash flows that it generates. The greater the volatility of those flows, the greater the operational risk is.

Financial risk is measured by the extent to which the [company’s] debt is involved in financing the assets of the company, that is to say, the [degree of] financial leveraging.

For a non-financial company, operational risks are more important than financial ones. Actually, financial problems occur when the company maintains an indebtedness policy that is not consistent with the cash flows that the company generates. In other words, the best indicator of the financial health of such a company is its ability to generate cash flows in a sustainable, reliable, and stable way.

Universia-Knowledge at Wharton: Do you believe that nowadays companies are paying enough attention to risks when they make decisions? Or, are they looking too much at the short term, as you suggest in your book?

García Estévez: Looking at the short term is the result of not having enough information to act. And this behavior occurs both during crisis situations as well as during good times. When there is a crisis, the entire world worries about risk. When the problem is how to manage growth, those people who talk about risk are branded as overly pessimistic. The solution isn’t to take one or the other path; it is to analyze business decisions while taking into account the ratio between risk and reward.

Some basic rules:

Rule 1: You can’t make a profit without taking risks. Although we are used to talking about return [on investment] first and then later about the risk, the reality is the reverse. The return you get is the payoff for bearing the risk. The manager must analyze whether the anticipated return is sufficient, given the company’s exposure to the risk.

Rule 2: Regarding knowledge — the first thing that we must do is to study and understand the risks we are exposing ourselves to. If we don’t do that, it is better not to take on those risks. If we move into markets that have risks that we don’t understand, we can drive our company to disaster.

Rule 3: Ask experts for help. It makes no sense to think that managers can know everything. But there are [outside] experts who can help us understand the risks involved in making certain investments. If a bank proposes to finance a thermo-solar power plant, it must first assess the technology that it wants to finance, as well as its legal terms and its development. Ultimately, it is people who manage risks; not mathematical algorithms.

Rule 4: Regarding communications — the more that a management team gets involved in managing a risk, the greater the likelihood that it will manage that risk effectively. We have to communicate the potential threats and contingencies to the entire team.

Universia-Knowledge at Wharton: Generally speaking, what kinds of mistakes do companies make when they try to measure risks? And what do you recommend they do in order to measure risk so it does not become a problem?

López Lubián: The most common mistakes are the following: First, incorrectly identifying risks, which includes thinking, “That doesn’t affect us.” Second, confusing apparent profitability (which carries no risk) with real profitability (which carries risk). Third, not employing appropriate instruments for covering risks.

One recommendation we have is for managers to use external advice that contributes specific solutions. For example: Operational risk depends on the volatility of cash flow. What moves can you make to reduce that volatility? Also, is there a relationship between the operational and financial policies of a corporation? Do we have a reasonable level of financial leveraging?

Universia-Knowledge at Wharton: What instruments can you count on? What are the challenges today?

García Estévez: The current crisis has not created any new tools for covering risks. The important thing is to use [the traditional tools] correctly, without confusing speculation with coverage.

To deal with risks, I suggest taking the following steps:

  • Identify the risks.
  • Analyze if it is necessary or possible to hedge them.
  • Look for the kind of contract that minimizes your possible losses at a reasonable cost.
  • Finally, figure out the right time to formalize the contract.

Universia-Knowledge at Wharton: How important a role does risk management play for Spanish companies?

García Estévez: If we’re talking about non-financial companies, you have to differentiate between the big companies and the rest. In theory, small and midsize companies usually lack the sort of financial culture that permits them to manage risk the way the big companies do it.

On most occasions, risk management comes into play whenever projects are followed-up [later on]. It is surprisingly easy [for many companies] to take decisions that are not followed up properly later on.