Your Financial Statements Conceal More Risk Than You Think
There are two types of companies in this world: those that manage risk in order to promote security and stability, and those that do not. The first offers financial statements that can be trusted without worry. Companies that manage risk are safer and more secure, and their financial statements can be relied on. The latter not only suffer from greater vulnerability, but their financial statements are misleading and often riddled with subtle risks that are easily missed.
As a leader in your company, you want to be aware of whether your company’s financials are secure and trustworthy, or vulnerable and risk laden. Not only is this knowledge very important to you, but it is also of great interest to your lenders. Naturally, they also want to know that your financials can be trusted.
The balance sheet from your company displays assets that are supposed to be constant and stalwart: the unspoken promise to your lenders is that, even following some sort of financial disaster, those assets will remain as valuable and available as ever. Of course, such balance sheets display liabilities as well. But even with uncontrollable factors in play, the goal is to ensure that those liabilities do not unexpectedly and significantly increase. That is the ardent wish of any lender that values their money, and it should be your goal, as well.
Unfortunately, the audit process does not accurately reflect that these goals are being met by your company in all cases. The audit process can be misleading when a company does not manage risk. Such companies often look very profitable on the surface, but that is due to the fact that they have lower initial expenses thanks to their lack of risk management.
The following example is a perfect representation of this potential pitfall.
Risk Capital
Capital is the lifeblood of any firm: it is needed to finance its day-to-day operations, including building rent, covering payroll, purchasing materials, and much more. These expenses are referred to as operational capital, which is measured by traditional financial statements.
However, a firm also requires capital in order to finance risk, or in other words, to pay for unexpected expenses, such as those caused by a lawsuit or a serious accident, fire, or flooding. This is referred to as risk capital. Despite its importance, it is not measured by traditional financial statements like operational capital is.
There are three sources that provide risk capital for a firm:
- Cash that the firm has available on hand. In order to meet the many risks a firm will face during its operation; such cash would have to be extremely significant. Even then, it would likely not last long with all the competing demands for its use.
- Off-balance sheet capital, such as credit lines, which would be utilized to finance sudden, major, and unforeseen expenses. But as with all credit, such loans would have to be repaid in time.
- Insurance. By being insured, a firm can transfer the consequences of a financial loss to an insurer in exchange for the premium that the firm pays for that insurance.
Thus far, it would seem like risk management is solely about having enough money on hand to deal with unforeseen expenses. However, there is more to it than that. Risk management isn’t just about paying for losses, but also preventing them from happening at all. Safety measures, quality control efforts, subcontractors, business partners that share some of the financial burden, and transference of risk to customers are all ways in which financial losses can potentially be prevented. By taking such measures, the need for risk capital is reduced.
Of course, that is very valuable. After all, the types of risks faced by a firm on a regular basis could be devastating. For example, if a lawsuit goes bad, the company could owe tens of millions of dollars to a plaintiff. Or, the entire facility could be rendered inoperable by a catastrophic event such as a fire or flood. But despite the massive financial loss these risks could incur to any firm, the management of these risks is barely, if ever, reflected in regular financial statements.
That is because financial statements do not take risk capital into consideration. At most, financial statements consider a cursory inspection of an insurance schedule as due diligence regarding any risks they may face. Whether or not set insurance policy limits are sufficient to cover the actual potential risk expenses a firm could face, not to mention whether the thousands of pages of terms and conditions actually cover what is needed, is not considered by such a lackluster audit.
This isn’t even the full extent of the problem. Loss control and contractual transfer, other elements of a risk management program, are not considered in these financial statements either. What this means is that potential risk is not being considered on a qualitative or quantitative basis, which obscures the true reality of a firm’s financials.
When risk capital is not used as a factor to compare various firms, all of those financial statements look alike. They all seem to be positive and profitable on the surface. A popular saying best puts it into perspective: “All boats float alike when the weather is calm.”
When everything is going well, the lack of funding for risk management seems more profitable for the company and the investors. But when the storm does hit, which it inevitably will, the perceived gain of saving money on risk management is drastically overshadowed by the massive deficit incurred by the disaster. Think of it like buying a case for a phone: sure, you will save money on the phone initially if you do not buy a case for it, but when you drop the phone and break it, the cost of repairs or replacement will far outstrip the cost of the protection you could have paid for to prevent it.
Risk Adjusted Return on Capital
Here is a more related example to consider. Imagine that there are two companies that both generate a 20% return on equity. One of these companies completely manages risk, while the other leaves such things to the whims of fate in its entirety. Initially, both companies appear equal according to the financial statements. And admittedly, they will be equal, at least until something bad happens that requires capital to cover it. Once some financial disaster strikes, the first company that was managing its risk will be much better off than the one that wasn’t, since the latter will be forced to cover a huge financial deficit they had not prepared for.
This reality is why the true measure of a company’s value is return on economic capital: the combined total of both operational capital and risk capital.
Regardless of what a firm does, its activities will generate risk. And no matter what, a certain amount of capital will be required to address that risk. However, the more risk that can be either prevented or transferred to other parties, the less risk capital a firm will need. For instance, if potential risk expenses are covered by an insurer, off-balance-sheet capital is being used, which reduces the firm’s need for on-balance sheet capital. The premium that the firm pays to the insurer would be considered an expense on the income statement.
Back to our example of the two firms, if they both generate $.20 for every dollar of capital that is measured by their financial statements, then the return on equity is 20% for both firms. The first in our example, Company A, completely manages its risk by using insurance and loss control. Because of this, the risk capital required by Company A is zero. This means that the risk-adjusted rate of return for Company A is actually 20%, as reflected by its financial statement.
However, the company that does not take any steps to manage risk, Company B, has no risk capital ready to deal with financial losses. Due to this, any financial risks they have to address will have to be paid either with cash or loans. For the sake of this example, assume that risk capital of $.75 is required by a firm for every dollar of operational capital. This would mean that the risk-adjusted rate of return for Company B is: .20/(1+.75) = 11.4%. As you can see, this is far less than the alleged 20% shown on Company B’s financial statement.
This is the little-discussed problem with traditional financial statements. Because they do not measure risk capital and the adjustments that it makes to a firm’s Return on Equity (ROE), Company A and B seem to have equal ROE when they truly do not.
This concept is often proven by the Securities and Exchange Commission when it reacts to major crises. The SEC often advises public companies to disclose how they are managing particularly potent risks such as cyber-attacks and terrorism. However, merely noticing the risk of an event that has occurred and reacting to it is not risk management. Risk management addresses a potential problem before it happens, not after.
After all, there are two tenets of risk management that are always true. First, historic financial losses require an extensive experience period before they can be used as valid predictors of future risk. The more remote and severe the historic loss is, the longer the experience period must be. Second, recency bias, a psychological phenomenon that causes people to place arbitrary importance on events that have recently occurred, must be ignored when assessing risk management. Even so, we should be grateful to the SEC for occasionally illustrating the fact that financial statements are incomplete without risk management factored into them. Having said all of this, our intent is not to advocate for a change in how financial statements are handled. It is up to the CPA world to make that decision. Our intent is to assert that, with the way financial statements exist today, provided that your CFO is not offering risk management reports, you may not be getting a clear image of your business and its profits.
At the end of the day, you cannot truly manage profits unless you also manage losses. The potential cost of making money impacts your bottom line. By ignoring potential financial risk, a firm is allowing their profits to be entirely dependent on luck, and whether they suffer some financial catastrophe on any given day. Profits are unreliable since the numbers can be swiftly manipulated. Even if a firm has years of good financial fortune under its belt, that profit cannot be trusted if no risk management exists, since it could disappear suddenly if a financial disaster strikes. A firm that is truly secure, stable, and reliable, not only produces consistent financial numbers for a CFO to take pride in, but also manages the risks that could impact those financial numbers negatively.
As a leader in your organization, you must keep this in mind. If risk management is not being factored into your financial reports, you run the risk of growing complacent with your company’s preparedness for disaster, and by extension, you risk its profits and net worth.
Shrink the risk, shrink the costs, and increase the profits!
The descriptions of coverages listed in this article are brief and subject to the provisions, limitations, and exclusions that can only be expressed in your policy and related endorsements. For additional information of how Swingle Collins & Associates can assist in meeting your coverage needs, please contact your dedicated risk manager. The information contained in this article is provided for informational and educational purposes only. It contains general information on insurance issues and may not reflect the most current developments in insurance coverage and is unlikely to apply in all factual scenarios. The information does not include all the terms, coverages, exclusions, limitations or conditions that may be contained in the actual insurance contract language. The policies themselves must be read for those details. Sample policy forms will be made available upon reasonable request. Thank you.
