As we begin emerging from the COVID-19 pandemic, it is clear that there will be much soul searching, analysis, post-mortems and the like, to understand what we did well and maybe not so well prior to, and during the crisis. This is the silver lining, the learning experience we can use to make our governance, risk management and, ultimately, our organisations, stronger.
One of the areas of focus is the role that ‘Capital’ plays as the ultimate backstop to disruptions in the future. ‘Capital’ is most often used in the financial sense to represent the financial resources available for financing the business and acting as a buffer for unforeseen losses. I am using the word ‘Capital’ here in the broadest sense, to include all of an organisation’s capitals, human, intellectual and the like.
‘Capital’ acts as the final internal buffer an organisation has between the net impact ‘loss’ it experiences after taking into account all of its controls, including insurance and risk management. It is the backstop, the last resort. After the ‘capital’ is used up, other than external (government, third party) assistance, it will fail.
My formative years in risk management in the late 80s and 90s were in the financial services sector. Regulated entities in this sector are required to hold sufficient financial capital. They are required to be ‘capital adequate’ by their regulators. Complex calculations and formulas are applied to ensure they have sufficient capital to act as a buffer against major financial impacts from severe, yet plausible events.
When is capital ‘adequate’?
In the 2004 version of the COSO Risk Management Standard, enterprise risk management is defined as ‘a process ‘…’ to provide reasonable assurance regarding the achievement of entity objectives’.
The keywords here are ‘reasonable assurance’.
There are no guarantees in risk management. We are not trying to ensure we are able to survive every single possible scenario and crisis. The question is, what is reasonable assurance?
In the financial services sector, reasonable assurance is assessed in the region of being 99.99 per cent confident that we will have sufficient financial capital over the next year to act as a buffer against severe but plausible events. The remaining 0.01 per cent chance covers the severe but implausible, often called the black swan events.
So, what are the capitals?
An organisation’s capitals will depend on the specific nature of the business and operations. They can be determined by considering which ‘assets’, financial, non-financial and intangible the business has, on which it relies. The serious degradation or loss of those assets will most likely lead to the organisation being in serious trouble.
Examples of these capitals
- Equity: The amount of financial capital we are able to lean upon to use to cover losses before liabilities exceed assets and the organisation is insolvent.
- Cashflow: The amount of funds and cash available to cover losses and cash requirements.
- Physical assets: This includes land, buildings, infrastructure, plant and equipment, stock, supplies etc.
- Supply assets: This covers supply-chain.
- Natural assets: This covers natural assets, including water, air, flora, fauna etc.
- Process assets: This covers the processes used for supply, manufacturing, and delivery.
- Human capital: The human resources including our people, knowledge, culture, team cohesion etc.
- Social capital: The extent of the social licence we need to operate and how robust that licence is in times of stress. This includes brand and reputation.
- Intellectual capital: This covers such things as patents, copyrights, software, licences.
- Relationship capital: This covers third-party relationships with all key external stakeholders.
- Customer assets: The customer relationships, customer supply contracts and customer demand.
The strength of your capitals against a range of future potential severe but plausible events should be part of your ongoing risk management.
How do we ensure our capitals are adequate?
As mentioned earlier, financial capital adequacy is a core part of financial services prudential regulation. This covers the determination of the minimum level of capital and the minimum level of liquidity that a financial services firm must always hold to make it resilient against a range of severe but plausible events.
The regulators have specific requirements on the calculation of this minimum capital but, regardless of the specific calculation, the underlying principles are as follows:
Step 1: Determine the maximum plausible loss based on a specific confidence level (around 99.9 per cent for financial institutions as mentioned above) and a time horizon (typically a one-year horizon).
This is achieved by:
- Identifying a range of severe but plausible scenarios across all the major risk types.
- Modelling these scenarios to achieve the required level of confidence and an aggregated view considering correlations. This is often done based on loss distribution statistics and techniques such as Monte Carlo simulation.
- The output is the maximum loss based on the confidence level. This represents the minimum required capital.
Step 2: Compare the actual financial capital to the required capital to ensure it is equal or in excess of the required capital.
This should then give you assurance that ‘we are 99.5 to 99.9 per cent confident that we have sufficient financial capital to remain solvent over the next 12 months’.
Applying this principle to the other capitals
This is where the application of the principles becomes more difficult because we are dealing with non-financial, and therefore difficult to quantify capitals. However, applying the same principle for each capital type:
- We need to consider what severe but plausible events could occur that would negatively impact that capital? The plausibility and severity of the scenario should be commensurate with a likelihood of occurrence equivalent to your required confidence level.
- We need to create an example of what such a scenario would look like and determine the impact that the scenario would have on that capital. This is scenario analysis.
- We then need to assess the extent that the selected capital would be eroded by the scenario. Where the capital is eroded to the point that the business could not continue, you are capital inadequate for that given scenario.
Using customer capital as an example:
- What severe but plausible scenarios would erode the current and future customer base to the point of being life-threatening for the organisation? This will include pandemic (we have seen many examples with COVID-19), severe economic downturn, failure of key customers and so on.
- In terms of creating an example of a scenario, we need to create a plausible, yet severe scenario for each of the risks. We then need to consider the extent to which the capital will be eroded. In this instance, how much will our current and future customer ‘capital’ base be eroded? In the case of COVID-19, this has been the key initial capital that has been depleted for airlines, restaurants and other deemed ‘non-essential’ services. The customer capital was found to be inadequate as it relied on ‘non-essential’ services.
- What is the strength of our customer capital now, and is it considered adequate against these scenarios to give us comfort that they are adequate at the required level of confidence?
For customer capital, this would include such things as:
- The level of concentration of customers based on large customers and customers concentrated in a specific industry, geographic location etc.
- The nature of customers in terms of essential and non-essential.
- The level of risk that customers businesses may be severely impacted and therefore the customers do not survive or dramatically reduce their demand.
- The extent of supply contractual arrangements in terms of contract periods and contract terms such as force majeure.
The ultimate objective
The ultimate objective in assessing the adequacy of your capitals is to be able to provide reasonable assurance as to the achievement of your objectives, in this instance, sustainability. Are you 99.9 per cent confident that you are resilient against, and will be able to survive, severe but plausible events?
What should you be doing?
If you have not yet carried out a health check of your capitals, now might be the time. From this point onwards, the strength of your capitals against a range of future potential severe but plausible events should be part of your ongoing risk management.
Assessing your COVID-19 organisational health
Free assessment tool
Protecht has created a free sample assessment workbook to manage your COVID-19 organisational health. The tool is only an example and not aimed at covering every matter that needs to be considered or tailored to every industry. The expectation is that it may help you to tailor a COVID-19 health check for your industry by:
- Tailoring the eight example areas of focus and
- Tailoring the example questions for each area of focus.
Free download here: protechtgroup.com/ebooks