Don't be too surprised by the recent revelations that allegedly fraudulent activities of a trader at Société Générale went unnoticed for some time.  The chain of events put in motion by trading activities not only provide ample opportunity for a knowledgeable individual to exploit a weakness, but the sheer complexity of the discrete deal attributes in many markets introduce numerous chances for honest mistakes as well.

The market, credit, liquidity, operational, and other risks must all be considered in the appropriate context of the specific situation.  In fact, after many years as a credit manager working trade floors in the energy industry, I have personally seen numerous examples of control weaknesses and heard of countless others.  I have never heard of an entity which had no areas for improvement - particularly if they traded extensively in physical markets, with its numerous additional obligations associated with delivery of a commodity.

"Do we trade over the counter (OTC) or on an exchange"; "Standard enabling agreements, or via proprietary contracts?"; "Margining or no margining"?; "With the A-rated public entity or the three-man hedge fund?"; "Fixed or floating prices?"; "In the physical or the financial markets?"; and etcetera. 

The nature of the resulting risks changes with the answer to all of those and many other questions.  Before long, the resulting decision tree for one transaction alone has an impressive number of branches.  Now imagine tracking an entire forest of unique trees.  Broken branches are fairly common (to belabor the analogy).

Sometimes weaknesses are glaringly simple, such as finding users who post their passwords on a sticky note next to their computer.  Other times, and as was apparently the case at Soc Gen, it requires intimate knowledge of the control process.  Still others result from lack of training or simple oversights, such as failing to properly negotiate a letter of credit or incorrectly assuming that you have netting rights for offsetting exposures.

Unfortunately, such weaknesses are pervasive.  Even worse, not everyone recognizes that fact - although such naïveté is becoming less common.  As reported by the Wall Street Journal, Ken Moelis, former head of investment banking at UBS said "Until recently, every investment bank believed it had built an outstanding risk-management system".

Indeed, when reviewing the trading risk management efforts of numerous financial institutions, S&P Credit Analyst Prodyot Samanta said they found "no concentration of best practices at any single institution".  It is good that ratings agencies are aware of the problem.  When credit ratings begin to suffer due to weak controls - causing financing costs to rise, you can expect companies to pay significantly more attention to the issue.

Additionally, the growing interest in enterprise risk management (ERM) also signals that companies are finally beginning to appreciate the fact that market risks aren't the only risks worth addressing.

Those entities which aren't already doing so would be well advised to start taking this effort seriously.

Risk Managers, rejoice, you are getting smarter and better looking with each passing day!  Folks who help manage risk are enjoying unprecedented respect these days, much like “overnight sensations” in the music industry whose worth is finally discovered after spending most of their careers in dingy bars.  (That analogy turned out even better than I thought it would.)  I predict that 2008 will be the breakout year for those who provide enterprise risk management goods and services as entities race to implement greater controls and deal with decreased access to liquidity.

This epiphany has come about because the last 10 years or so have been a stunningly risky period for corporate stakeholders with one massive problem after another.  The most recent, the meltdown in the mortgage industry and its subsequent effects, may have been the coup de grâce for any remaining risk-tolerant holdouts.  The growing clamor for more effective risk controls has now turned into a deafening roar.

During the past decade alone, we have had an internet boom and subsequent bust; an energy bust and subsequent boom – with an “energy crisis” thrown in the middle for good measure; numerous geopolitical conflicts; prosecutions of corporations and their executives, both justified and overzealous; natural and unnatural disasters; deregulations and re-regulations; a credit market meltdown; and assorted other calamities.  That, my friends, is risk.  No wonder people are finally looking for help.

How would YOU like to be a corporate executive these days?  Using the energy industry as an example, where would you turn for help with risk mitigation?  The commodities market?  Please.  That is often the source of the problem.  Improperly structured market positions which fail to consider associated credit and liquidity risks can doom a company quicker than remaining unhedged.  A small producer who is otherwise profitably selling its products under fixed prices in a rising market could easily see margin calls deplete its liquidity, leaving none for operating needs.  And as we all know, net income doesn’t pay the bills – cash flow pays the bills.

How about the credit market?  As we have seen, it has contracted significantly due to the surprising collapse in the mortgage industry.  While it is still possible to get funding, the terms and conditions now reflect recent events.  Exacerbating the resulting liquidity shortage, more energy entities are transacting under contracts with risk-mitigating – but logistically challenging - margin provisions and face more collateral demands as described above.

Insurance products may or may not be cost effective, either.  Although coverage continues to evolve to address the risks of structured and other transactions, insurance companies have had their share of challenges lately, too.   For example, in addition to the billions in exposure for human-caused events like 9/11 and corporate malfeasance, insured losses for natural disasters such as earthquakes, hurricanes, and floods cost the industry a record $44 billion in 2004, nearly triple the previous year, and THAT record more than doubled to $94 billion in 2005, according to reinsurer Munich Re.  To top it all off, Lindsey Lohan started driving – sort of.

International energy matters continue to produce significant uncertainty as well.  In the last year alone, energy entities have been “strongly encouraged” to renegotiate their contracts or have had assets nationalized outright in Bolivia, Venezuela, and Russia, to name a few.  Additionally, there continues to be concern over the security of the gas supply from Russia to Europe, which is also moving quickly to deregulate its gas and power markets.  Think it is difficult to implement deregulation in the U.S.?  Imagine trying to do it while considering the demands of numerous sovereign entities with different languages and national interests.  How and when it will ultimately work is still to be decided.

For some, the prospect of increased regulation by government entities represents a considerable risk as well.  For example, as executives of numerous oil majors in the U.S. found out, even if you earn a return in line with other industries, you may still be hauled before Congress and threatened with criminal sanctions and a tax on “windfall profits”.  Additionally, hedge funds are being increasingly criticized by authorities for, among other things, failing to manage counterparty credit risks and for introducing systemic risk to energy markets.  Look for them to begin to respond by enacting greater controls fairly soon.

All of these issues, as well as many others, have contributed to the growing recognition of the need for entities to navigate the corporate minefields and effectively manage enterprise risk.  That will require investment in people, processes, and systems.  In fact, even if there is a significant effort already in place, it must be demonstrably effective and bring confidence and comfort to auditors and others.

 Whether the pressure is coming from regulatory entities who want to prevent abuse, investors and shareholders who want to know the risks they are assuming, employees who want to ensure that their companies are well run, or executives who are concerned with compliance demands, the value of a solid risk management effort has never been more appreciated.

So we salute you, Mr. and Ms. Risk Manager.  2008 is your year!

Companies active in the energy marketplace should employ Enterprise Risk Management (ERM) to accurately account for and value the market, credit, and operational risks they face and help appropriately establish their entity’s true risk-adjusted value.

Consider the case of an investor deciding between two companies in which to invest.  If they both had exactly the same assets, but one was located in an area prone to natural disaster, it would be wise to discount its value to accommodate that fact and deem the “safe” company the more attractive option.  This is a simple example of a risk-adjusted valuation.  Although such analyses have long been part of smart investor’s evaluation process, the move to identify and address – or at least disclose – risks of every imaginable type has never been greater.

In recent years, energy industry participants have begun to employ increasingly sophisticated processes to identify, measure, and if desired, mitigate market risk.  Well before the significant price volatility which recently occurred in numerous energy markets, trader limits, Value At Risk (VAR) calculations, advanced hedging techniques and the like were common concepts even on the trade floors of most physical market participants who, historically, have suffered the consequences of volatile markets and often view boom and bust cycles to be as natural as the seasons.

To a lesser degree, but closing fast, has been the push to address counterparty credit risks – including those which come about as market risk-mitigating efforts are translated into credit risk.  This makes great sense.  If you addressed your long or short market position by putting on an offsetting trade with a nearly-bankrupt company, have you really hedged yourself?  You could probably have avoided that dangerous scenario if you monitored your counterparties more effectively through automated scoring, potential future exposure (PFE) calculations, daily account monitoring, and other benefits typically offered by robust credit management systems.  Additionally, they can provide a holistic report of the company’s trading activities versus the view from trading systems, which is often presented on a portfolio basis. 

Although most entities have long been concerned with counterparty creditworthiness, they have not typically translated those concerns into the investments necessary to thoroughly address them.  It is an absolute fact that billions of dollars in credit exposures are tracked on spreadsheets throughout the industry.  However, the collapse of high-profile counterparties, increasing control requirements, and the recent availability of quality third-party software solutions make the sophisticated handling of counterparty credit risks quickly approach industry-standard status – if it cannot already be considered so.  Again, even physical market participants who have typically been less impressed with the theoretically pure, more financially oriented, Wall Street-style risk management than with traditional relationship management are seeing the value of actively managing credit risks.

The assault on operational risk, the last bastion of relatively unacknowledged and unaddressed exposure has now begun.  While there are several loosely similar definitions of operational risk, one useful view is that these are the risks of loss, according to the Basel Committee, “resulting from inadequate or failed internal processes, people and systems, or external events”.  For example, your VAR measurement identified a significant exposure to volatility in the market, you identified and entered into a mitigating trade of 10,000 barrels of Brent crude with a counterparty whose weak creditworthiness was identified and supplemented with a letter of credit, but your operations personnel failed to notice that the trade confirm showed a 100,000 barrel volume and your tape recording system malfunctioned.  The very act of implementing processes to address operational risk would likely identify these and other critical business functions and help ensure that they receive appropriate attention.

The company which puts in place an ERM system to actively manage its marketing, credit, and operational risks will not only be rewarded for having the foresight to do so, but will avoid being penalized for failing to employ what is increasingly becoming standard business practice.