Led by Standard & Poor’s, rating agencies are looking at corporations’ ERM programmes as part of their assessments

evaluation rating finance

Rating agency Standard & Poor’s has decided to assess corporates on their enterprise risk management (ERM) programmes, and the other rating agencies are likely to follow suit. The move is controversial, but what will it mean for management, and how can companies make the most of the move?

It is an uncomfortable paradox of the global financial crisis that its origins are widely seen as sloppy policy and regulation, and slipshod financial ratings. Yet tightening these discredited institutions is seen as the best way out of the current situation.

Hence, despite well-catalogued policy failures, new super-regulators are springing up in Europe and the USA. And ratings agencies - no stranger to controversy and criticism throughout the crisis - are broadening the scope of their activities.

The biggest reason for Standard & Poor’s move is speculation on how the subprime mortgage crisis in the USA would have been handled had financial institutions fully invested in their ERM programmes.

Lehman Brothers collapse puts agencies under scrutiny

From the moment Lehman Brothers collapsed in 2008, serious questions were asked of the credit agencies who, just weeks earlier, had awarded the stricken US bank a prized AAA rating. When the crisis turned into a sovereign debt issue, arguments over the agencies turned nastier.

Political decision-making logjams in the USA and, this year, Italy, led to controversial downgrades of those countries’ sovereign debt. They also raised difficult questions about the agencies themselves.

The European Commission will soon announce a slew of new rules in an attempt to rein in the power of the rating agencies.

These will include provisions preventing them from awarding ratings to companies that own shares in the agencies; insisting that all agencies rotate their work so that one agency does not monopolise assessment of companies or sovereign debt; and provisions encouraging new, smaller ratings agencies to enter the market and challenge the power of the big players.

Most experts agree that one of the key problems lay in the lack of a comprehensive, management-wide appreciation of enterprise risk. ERM has subsequently raced up the agendas of the financial sector companies, and is subsequently migrating to the corporate sector.

The better news for those fearing that their companies are likely to come under unwelcome scrutiny by agencies unaccustomed to examining risk in their sectors is that preparation for the change has been long in the pipeline.

Key topic of board discussion

Since 2005, ERM has been gradually incorporated into analysis of assessments of the financial sector, becoming a key topic of discussion on most financial services board’s agendas. A spokesman for S&P says that the move has not “radically changed the way we assign ratings”. But it has “provided deeper insights that have caused us to change the ratings and/or outlooks of many companies”.

Nor do the agencies only have experience with ERM in financial services. In 2006, S&P began a pilot programme directed at energy companies, evaluating the trading risk management programme of 10 energy firms. As a result, the agency gained significant additional new quantitative and qualitative information to augment its traditional capital and liquidity stress test data for the energy market.

Initially S&P was going to limit the focus of its analysis to the control processes for risk from trading in fuel and electricity markets, but it began to gain broader insights into the firms’ risk management capabilities and cultures that could influence the overall rating. Based on these results, the agency expanded ERM analysis to all energy companies by early 2008.

Moreover, several credit rating agencies have been conducting research into ERM in the corporate sector, to better understand how they can expand their ratings into other sectors. S&P has stressed that it will take into account the usual business practice within differing lines of business when applying its tests.

In general terms, what S&P and other raters will be looking for is the degree to which a firm has a comprehensive mastery of the risks they face, and the extent that the firm’s management optimises revenue for the risks they are willing and able to take.

Risk should be accounted for

The latter criteria is significant, because it signals that risk should be accounted for as an underlying strategic quotient of business plans. But, for companies fearing the kinds of internal management preparation they need to carry out for such a survey, the agency stresses that companies can see improvement as well as deterioration in their ratings as a result. So for some, the new test will be good news.

What is certain is that companies will start to scramble to implement modern ERM programmes. And since the analysis can have either a positive or negative effect on the overall company rating, firms will soon see the competitive advantages to be gained from proper implementation.

Additionally, since most experts believe that - as happened in the financial services segment - other rating agencies will soon follow suit, there will be little room for companies that have not committed to an ERM to dodge the issue.

How do you fare?