A New Concern for Credit Rating Agencies

by François Masquelier, RTL Group Head of Treasury, Corporate Finance & ERM, and Honorary Chairman EACT

Management analysis is arguably one of the most qualitative and immeasurable among the many considerations of Credit Rating Agencies (CRA), when attributing and following rating of non-financial institutions. The quality of a management judgment is not easy to assess. It is also extremely difficult to benchmark the management level and performances via quantitative methods in the way the financial ratios for example; cash-flow models or earning capacities do to define precisely the company profile.

CRAs have decided to introduce ERM analysis into the credit rating process globally as a structured framework to evaluate management.

It seems that CRAs have decided to introduce ERM analysis into the credit rating process globally as a structured framework to evaluate management. ERM is a major component of a group overall risk profile. We believe it is an example of an initiative which could contribute to inoculate a better risk culture among European enterprises. Rating purpose could become an additional ‘good reason’ for setting up an appropriate ERM process within multinational rated corporations. Regulatory pressures, greater focus on governance and now credit rating agencies have been the stimulus for many changes in the industry. It is clear that there is recognition among the corporate community that they need to articulate risk appetite and tolerance more precisely. They should demonstrate their ability to withstand shocks, if any. Moreover, treasurers could be of help in translating risk metrics and methods into business decisions and reporting. They help also in setting the boundaries which form a dynamic link between strategy, target setting and risk management.

Introduction of ERM into corporate rating process

Rating agencies envisage introducing ERM analysis into their global credit rating process, as an additional means to better evaluate management as a principal component in determining the overall business profile, along with the financial profile. They decided to discuss with management about having a fair ERM evaluation and scoring the company properly. They want to benchmark the ERM process. They expect that deterioration or improvement in a company’s ERM quality would potentially drive rating and outlook changes before the consequences become apparent in published financial reports. Companies with superior ERM should have less volatility in earnings and cash flows, and will optimize the risk/return ratio.

The objective of codifying ERM analysis is to coincide with the intention expressed by many European companies to initiate their own ERM programs or other risk-management practices, to increase risk-adjusted returns, to improve strategic judgment and to avoid extraordinary losses due to lawsuits, fines, frauds, operational failures or negligence. The ability of corporates to meet their financial obligations in full and on time is more likely to be enhanced by strong(er) ERM. By having such a risk management process in place, a company could significantly limit the frequency and severity of losses that may potentially affect ratings and indirectly cost of funding.

[[[PAGE]]]

Scoring ERM, a challenge for CRA

They would like to assign scores for ERM quality to all non-financial companies reviewed. But using the same scale to compare the ERM process across companies of financial and non-financial sectors is almost impossible. Risk management for a financial firm is fundamental to its existence. The purchase and sale of risk is its core business. Non-financial enterprises accumulate risks as a consequence of operating activities. This explains why the CRAs proposed to apply different methods. They need to assess whether or not the rated company has an effective ERM process in place and loss and risk tolerance guidelines.

The best companies have an enterprise - wide view of risk and focus on loss control.

The best companies have an enterprise-wide view of risks and focus on loss control. Strong companies will not experience unexpected losses outside their tolerance level. The risk and reward optimization is essential for modern companies. These new processes of scoring ERM should start in 2008 (at least for S&P). Although an old adage said that a company must take risk to achieve rewards, they now need to measure the risks involved to know the expected potential rewards. The agencies are concerned by the risks that might prevent the firm from meeting its financial obligations. ERM provides company management with information to optimize returns while remaining within a well-pre-defined risk tolerance range. This ERM review by agencies could modify the approach of rated companies or even ‘force’ others to start implementing a comprehensive ERM process.

Criteria for a good ERM process

We believe that the ERM processes will be unlikely to radically change the rating assigned to firms but impose on them a minimum discipline in this field to demonstrate their ability to detect and control risks. CRAs will base analysis on experience gained with rated financial institutions and insurance companies, where risk management culture is, in principle, more historically developed. When we take recent examples, like terrible storms, hurricanes and flooding arisen in last years or the more recent ‘sub-primes crisis’, they all cost billions of EUR to some (financial) institutions or insurance companies. They have proved that effective ERM processes need to be reviewed and scored, as part of the whole credit rating assigned.

Some agencies have already launched in the USA new approaches for specific risks like energy companies. The idea of pilot projects is very interesting as a single method to be applicable to all companies does not seem to be possible to define or even to be recommended for application across industries. ERM is different for each sector. A sector approach is therefore necessary but cannot be implemented in a couple of weeks. It will be quite a long process to have scoring in place, in all industries. Agencies are starting with a process of scoring that could take a while to be fully reviewed and efficient. However, we believe that by such an initiative they will improve rating processes and encourage best practices in terms of ERM in Europe.

[[[PAGE]]]

Five main focuses of analysis:

(1) Risk management culture (e.g. importance of risk management in considering daily corporate judgment, no excessive compliance-culture, interest and implication of top management into processes);

(2) Governance (e.g. critical aspect of ERM assessment, communication and transparency, Risk Management Committees, internal policies, codes of conduct and ethics or group guidelines, accounting standards applied etc.);

(3) Risk controls (e.g. processes and systems in place to identify and manage risks, policies, infrastructure, personnel, Chief Risk Officer role and tasks, methodologies, processes, internal controls, BCPs/DRPs, KPI’s etc.);

(4) Emerging risk preparation (e.g. completely new risks or extremely rare adverse events, stress testing, sensitivity analysis, Value-at-risk, risk transfer policy, contingency planning etc.);

(5) Strategic risks (e.g. corporate strategic decision-making processes, based on enterprise value, capital budgeting, diversification and divestiture strategies, and economic capital methodology or performance measurement, review of investment proposals).

ERM could improve significantly the way ratings are assigned and measured.

They will also form opinions on the complexity of risks faced, vulnerability to them, sophistication of ERM practices to deal with more complex risks and adherence to systematic, consistent and defined practices, in light of peers’ own approaches of ERM.

Consequently, it was necessary for CRA to start analysing risk management processes. Corporates will have an opportunity to discuss it with their CRAs over the coming months. They will help them to identify best ERM approaches and existence of sound risk management organisations. Risk management has gained considerable attention among non-financial companies in recent years. But it is obvious that in Europe, ERM is still not really aligned with strategies and operating business decisions.

Conclusions

ERM could improve significantly the way rating are assigned and measured, provided agencies implement their own proved methodologies and benchmarks across industries and services, financial and non-financial. Of course it is not a panacea which would exclude any risks at all. The way they are assessed, measured, controlled, monitored and mitigated is essential. Nevertheless, it will help CRAs making judgments and company valuations. It may at least provide users with better understanding of the rating allocated and enable the risks each company could face to be anticipated. In the coming months, ERM processes will be discussed with rating agencies. CROs will have to convince their agencies of the quality of methodologies and risk management systems in place. It will also encourage companies with no ERM processes at all to launch or to think about launching such projects.

But ERM-compliance approach is not the best way to really control and mitigate operating and financial risks. ERM should be based on a real group risk culture. It is more complex to create an effective ‘risk culture’ within the company than simply to implement systems, and reporting. European companies are still under-ERM organized. But because of several regulations, rating agencies’ requirements, a few dramatic financial catastrophes, best practices and other good reasons, European groups will, step by step, set up or improve ERM systems. CRAs, together with other regulation constraints, will also contribute to a better ERM culture in the coming years. That is, at the end of the day, the ultimate goal to which all financial professionals involved with risk management aspire.

We should also add that treasurers are very often the executives, within the company, in charge of having the day-to-day contact with CRAs. It could also be another excellent reason to assign treasurers the new role of ‘Chief Risk Officer’ (CRO) in future or to give them this very crucial responsibility and these new tasks related to ERM. No doubt that it could be a new challenge for corporate treasurers in the coming years.