The Humble PI of Risk Management
A lot of approaches and frameworks are discussed in companies that are relatively new to implementing Risk Management process – the types of control processes, committee structure, risk reports, estimation methods, quantification models, systems, people, etc. In fact, these discussions sometimes go so intense and deep that it all becomes a big circle that keeps coming back to itself, and eventually nothing moves. If you’ve ever been a part of such an implementation, you too would be painfully aware of this fact.
One of the ways to simplify things while starting a new Risk Management Initiative in the company, or while revamping an old one is, to focus at the heart of a Risk Management Function – its purpose. And at the core of a Risk Management Function is a powerful, yet Humble PI of Risk Management – the Probability – Impact (PI) matrix.
What is the Humble PI Matrix?
For energy and commodity trading companies, each of the risks can be positioned in a PI Matrix. The risks could be as subjective as key-person risk (key trader / senior management leaving the company) and reputation risk, or more quantifiable like market / price risk, liquidity risk, currency risk, interest rate risk, counterparty credit risk, etc. What’s most important for any organization is identifying which risks are most relevant to them and try to estimate their probability of occurrence. This exercise is usually done based on the past experiences & data, and future plans of business growth. For quantifiable risks, it’ll be easier to estimate the probabilities of occurrence as there are several models available to help you do that. But for other types of risks, companies generally take the qualitative / subjective estimation approach. Generally, the first few tries will not be ideal, and its important to accept that it is a process, which will eventually evolve into a useful framework if the entire team keeps at it.
Understanding the PI Matrix:
Once the probabilities of those risk events have been arrived at, the next step is to calculate the impact each of those events would have on the P&L in case they materialize. It is okay to start with a good approximation here rather than aiming for precision – which can only be achieved over a period of time. Combining the probability and impact of each risk event gives their position in the PI Matrix as given below:
The policies, control processes, systems and reports should then be designed as per the position of the risk event – for example, all risk events falling under Quadrant 1 should be actively managed, which means there needs to be a sophisticated system, reporting process, regular review and control process built around those events. On the other hand, those falling in Quadrant 2 may just be actively monitored, which means they too need to have their limits monitored on a regular basis, with only periodic hedging / de-hedging / trading decisions taken to reduce these risks. Risk elements in Quadrant 3 just need passive monitoring, which means risk events falling under this quadrant need to be assessed at periodic monthly / quarterly basis or on an as-and-when basis since for these, both the probability of occurrence and impact on P&L are low. Risk Events in Quadrant 4 need to be managed with limits and some kind of quantification, but not so actively – since these risks have relatively lesser impact on the P&L.
Conclusion:
The PI Matrix, therefore, is not a solution in itself for Risk Management, but it certainly gives companies a good starting point. But far more importantly what it does is, it sends a message across the organization to focus on a few risk events rather than all of them. Unless the organization has a well-established Risk Function, it is rarely ever possible for them to manage all the risks equally – those who attempt to do so, realize rather painfully that they are actually managing none of the risks. The PI matrix helps you choose your battles, the most important ones first – and that is what makes it one of the most powerful starting points in Risk Management.