Risk Analysis

Risk analysis is the process of assessing the likelihood of an adverse event occurring within the corporate, government, or environmental sector. Risk analysis is the study of the underlying uncertainty of a given course of action and refers to the uncertainty of forecasted cash flow streams, the variance of portfolio/stock returns, the probability of a project's success or failure, and possible future economic states. Risk analysts often work in tandem with forecasting professionals to minimize future negative unforeseen effects.

Understanding Risk Analysis

A risk analyst starts by identifying what could go wrong. The negative events that could occur are then weighed against a probability metric to measure the likelihood of the event occurring. Finally, risk analysis attempts to estimate the extent of the impact that will be made if the event happens.

Quantitative Risk Analysis

Risk analysis can be quantitative or qualitative. Under quantitative risk analysis, a risk model is built using simulation or deterministic statistics to assign numerical values to risk. Inputs that are mostly assumptions and random variables are fed into a risk model.

For any given range of input, the model generates a range of output or outcome. The model is analyzed using graphs, scenario analysis, and/or sensitivity analysis by risk managers to make decisions to mitigate and deal with the risks.

A Monte Carlo simulation can be used to generate a range of possible outcomes of a decision made or action taken. The simulation is a quantitative technique that calculates results for the random input variables repeatedly, using a different set of input values each time. The resulting outcome from each input is recorded, and the final result of the model is a probability distribution of all possible outcomes. The outcomes can be summarized on a distribution graph showing some measures of central tendency such as the mean and median, and assessing the variability of the data through standard deviation and variance.

The outcomes can also be assessed using risk management tools such as scenario analysis and sensitivity tables. A scenario analysis shows the best, middle, and worst outcome of any event. Separating the different outcomes from best to worst provides a reasonable spread of insight for a risk manager.

For example, an American Company that operates on a global scale might want to know how its bottom line would fare if the exchange rate of select countries strengthens. A sensitivity table shows how outcomes vary when one or more random variables or assumptions are changed. A portfolio manager might use a sensitivity table to assess how changes to the different values of each security in a portfolio will impact the variance of the portfolio. Other types of risk management tools include decision trees and break-even analysis.

Qualitative Risk Analysis

Qualitative risk analysis is an analytical method that does not identify and evaluate risks with numerical and quantitative ratings. Qualitative analysis involves a written definition of the uncertainties, an evaluation of the extent of impact if the risk ensues, and countermeasure plans in the case of a negative event occurring.

Examples of qualitative risk tools include SWOT Analysis, Cause and Effect diagrams, Decision Matrix, Game Theory, etc. A firm that wants to measure the impact of a security breach on its servers may use a qualitative risk technique to help prepare it for any lost income that may occur from a data breach.

Almost all sorts of large businesses require a minimum sort of risk analysis. For example, commercial banks need to properly hedge foreign exchange exposure of overseas loans while large department stores must factor in the possibility of reduced revenues due to a global recession. It is important to know that risk analysis allows professionals to identify and mitigate risks, but not avoid them completely.

Value at risk (VaR) is a statistic that measures and quantifies the level of financial risk within a firm, portfolio, or position over a specific time frame. This metric is most commonly used by investment and commercial banks to determine the extent and occurrence ratio of potential losses in their institutional portfolios. Risk managers use VaR to measure and control the level of risk exposure. One can apply VaR calculations to specific positions or whole portfolios or to measure firm-wide risk exposure.

The historical method for calculating VaR simply re-organizes and examines actual historical returns, putting them in order from worst to best. It then assumes that history will repeat itself, from a risk perspective. As a historical example, let's look at the Nasdaq 100 ETF, which trades under the symbol QQQ (sometimes called the "cubes") and which started trading in March of 1999. If we calculate each daily return, we produce a rich data set of more than 1,400 points.

Now let's put these in a histogram that compares the frequency of return "buckets." For example, at the highest point of the histogram (the highest bar), there were more than 250 days when the daily return was between 0% and 1%. At the far right, you can barely see a tiny bar at 13%; it represents the one single day (in Jan 2000) within a period of five-plus years when the daily return for the QQQ was a stunning 12.4%.

Notice the red bars that compose the "left tail" of the histogram. These are the lowest 5% of daily returns (since the returns are ordered from left to right, the worst are always the "left tail"). The red bars run from daily losses of 4% to 8%. Because these are the worst 5% of all daily returns, we can say with 95% confidence that the worst daily loss will not exceed 4%. Put another way, we expect with 95% confidence that our gain will exceed -4%. That is VAR in a nutshell. Let's re-phrase the statistic into both percentage and dollar terms:

• With 95% confidence, we expect that our worst daily loss will not exceed 4%.
• If we invest $100, we are 95% confident that our worst daily loss will not exceed $4 ($100 x -4%).

You can see that VAR indeed allows for an outcome that is worse than a return of -4%. It does not express absolute certainty but instead makes a probabilistic estimate. If we want to increase our confidence, we need only to "move to the left" on the same histogram, to where the first two red bars, at -8% and -7% represent the worst 1% of daily returns:

• With 99% confidence, we expect that the worst daily loss will not exceed 7%.
• Or, if we invest $100, we are 99% confident that our worst daily loss will not exceed $7.

Risk is a probabilistic measure and so can never tell you for sure what your precise risk exposure is at a given time, only what the distribution of possible losses are likely to be if and when they occur. There are also no standard methods for calculating and analyzing risk, and even VaR can have several different ways of approaching the task. Risk is often assumed to occur using normal distribution probabilities, which in reality rarely occur and cannot account for extreme or 'black swan' events.

The financial crisis of 2008 that exposed these problems as relatively benign VaR calculations understated the potential occurrence of risk events posed by portfolios of subprime mortgages. Risk magnitude was also underestimated, which resulted in extreme leverage ratios within subprime portfolios. As a result, the underestimations of occurrence and risk magnitude left institutions unable to cover billions of dollars in losses as subprime mortgage values collapsed.