At its core, risk financing exists to address one vexing problem: how to align a company’s willingness to take risks with its ability to do so, an exercise best done within the context of one’s organizational objectives. Risk management, of which financing is an integral part, is the set of measurable and sustainable actions for reducing the effect of uncertainty on those objectives. The establishment of measurable metrics is a key step in an organization’s growth toward a fully mature enterprise-wide risk management program.

Every enterprise of any appreciable size, with substantial obligations, and ambitious business endeavors allocates a portion of it capital and/or available cash as an offset to the uncertainty (e.g. risk) associated with the pursuit of its business objectives. Generally, the greater the degree of uncertainty or magnitude of consequence of its business risks, the greater the amount of contingent capital that should be assigned as reserves against those risks.

Risk, regardless whether it can be readily measured or if its probability of happening is considered highly remote, has a cost. That cost can be little more than expense to implement and maintain an automated process to monitor it status all the way up to and including integration of sophisticated data analytics supported by massive (IT) business information systems, to map emerging risks and their correlation with strategic plans. The University, through its schools, departments, centers, and business ventures, incurs a certain cost of risk arising out of all its business activities.

How well an organization manages its ‘risk’ capital (cash and contingent) is a good predictor of the competitiveness and long term success of that organization. It is incumbent on business leaders to identify and monitor key metrics that provide insight of its status against desired risk management results. One widely accepted metric is Cost of Risk (COR).

COR is a quantitative measure of the total direct and indirect expenditures dedicated to mitigating the risk exposures confronting an organization in pursuit of its business objectives. While typically interpreted to capture only those costs arising out of insurance activities (i.e. retained losses, risk control costs, insurance premiums, and dept administration expenses), true COR captures expenditures (risk spend) from all of the following major areas:

• External risk transfer [insurance premiums, credit/counterparty transfers, financial (hedging) instruments]
• Retained / self-insured losses [including indirect costs such as reduced productivity]
• Risk mitigation programs [environmental health and safety, emergency planning, regulatory compliance]
• External consultancy fees [legal, actuarial, modeling, analytics]
• Internal program administration [salaries, benefits, overhead]
• Collateral costs [LOC’s, trust accounts, pledged securities]
• Missed opportunity costs

Given that almost every organization uses some form of universal accounting rules as a key measure (“financial scorecard”) of its progress against business objectives, it follows that the yardstick should also explicitly view risk costs as part of the overall performance comparison, particularly when assessing how a company’s costs are changing relative to the overall growth rate of the business. Additionally, management can determine how the company’s COR is changing relative to industry benchmarks, and more importantly its main competitors. COR can serve as the foundational component of a structured risk management process for explicitly comparing what was anticipated to what was realized, helping focus corrective actions where necessary.

The main advantages of an enterprise using COR as its universal risk metric are two-fold: 1) calculating the total risk spend can help to highlight inconsistencies in our approach to enterprise-wide risk management; and 2) the process can identify areas where the cost of managing a particular risk may be excessive relative to our risk appetite, the opportunity / benefit realized by the underlying activity, or equally “risky” activities elsewhere in the organization. The insight can potentially lead to reallocation of some elements of the risk spend when imbalances are identified.

The Risk Finance and Insurance department keeps a watchful eye on many aspects of Harvard’s COR, particularly those data points falling within it primary mission realm. We publish semi-annual summary reports offering an aggregate view of Harvard’s COR and are investigating expanding the data reporting tools to enable drill down capabilities for individual schools to view their own COR data.