This week’s Case ‘n Point will focus on the risk of misleading financial data. As our real-world example will show, inaccurate accounting can cause poor management decisions that ultimately hurt a contractor’s bottom line.   In a quick informal survey, I asked several members of our community what information they gather to make decisions. Every contractor said that financial statements are either the first or second resource of information.

Business functions across the gamut are tied to financial statement results: everything from hiring, equipment purchases, salaries/bonus, financial credit, to surety credit. For this reason, many of the risk factors in the category “Accounting Procedures” have high importance for contractors. We could easily make the case that financial statements have (or at least should have) the greatest influence on a company’s decision making.  

The Risk Victim
Conway Remodeling, Inc. (CRI) is a relatively young contractor who has been in business for six years. CRI has historically performed 80% residential and 20% commercial remodeling. Commercial projects are relatively small and almost never consist of more than two or three units of an office building.

During the most recent year, CRI took an opportunity to perform a large commercial project. Instead of the common two or three unit remodel, CRI was in charge of remodeling an entire five story office building. Since the commercial work was more sizable, management felt the carpentry work, which was typically subcontracted out, could be self-performed.  Using historical financial statements, management determined that the carpentry could be performed at a profit.

The Risk Impact
CRI’s management relied on their historical financial statements to make a decision, which is usually a good practice; decisions should be made by gathering the most information available.  However, just because a company has prepared financial statements does not guarantee that the information is accurate. The financial data could be of poor quality and relying on incorrect financial data is just as bad as guessing.

As is the case with many small contractors, CRI did not allocate some indirect costs to projects or to their labor burden rate.  Instead, the costs were kept as General and Administrative because they were not believed to be significant.  When management determined carpentry would be profitable, they used financial statements that didn’t properly allocate workers’ compensation premium to each project. Thus, they didn’t realize that the carpentry work would add significant costs and was not as lucrative as expected. If management had the correct labor burden rates and allocated costs correctly, they would have determined the margin was too small and continued to subcontract out carpentry.

The Lesson
As CRI’s workers’ compensation insurance policy came to a close, the insurance carrier came in for a final audit to determine the audit premium. Overall revenue had grown only slightly, so CRI expected the audit premium to be rather small. However, there was a fundamental change in the structure of CRI’s operations. Almost twice as much in wages was paid as a result of self-performing the carpentry work. Thus, workers’ compensation insurance was going to be twice as expensive and this would all be reflected on the final audit. CRI was shocked to learn that their audit premium for workers’ compensation was $30,000 and, as standard, was due in 30 days.

We mentioned that financial statements are the linchpin for decisions throughout the entire company. In addition to performing the carpentry work, CRI had made several other bad decisions based on the financial statements. Additional labor was hired, not enough cash was banked to cover the audit premium, slightly higher Christmas bonuses were paid to reflect what appeared to be a good year, and more commercial jobs were bid using the estimates from the last job.

In the above exhibit, CRI would have made a better decision if they used high quality financial data. By installing two controls, CRI could have had high quality financial statements:

1. Performing a monthly insurance audit: The monthly audit makes adjustments to the premium in order to reflect the year-to-date difference in estimated and actual wages. 
2. Use approprate labor burden rates: If CRI’s accounting system tied the indirect cost of workers compensation to wages paid, the calculations used to estimate profit margin would have signaled management to subcontract out the carpentry work. 

If both controls were in place, either would have sent off a red flag early in the project, or even before the project was bid. Unfortunately,  many contractors don’t install these controls until they are burned the first time.  

We can’t overstress the importance of controlling your “Accounting Procedure” risk factors. Our Free Construction Business Analysis reflects this same level of importance. Many contractors who perform a Business Analysis expect to score very high. However, they often receive lower than expected scores due to weak accounting procedures. Strengthening the business practices that control accounting procedures will have a large impact on decision making and help ensure that more earned revenue is sent directly to net profit.

Technorati Tags: Accrual Accounting, Construction Accounting, Construction Business Analysis, Construction Estimate, Construction Insurance Audit, Construction Labor Burden, Construction Risk, Construction Risk Management, Construction Workers Compensation, Cost Estimates, Enterprise Risk Management, ERM, Inaccurate Accounting, Indirect Cost Allocation

Today I met an individual who asked what I did for a living. I was somewhat distracted and mumbled the word “risk management.” As I regained my focus this gentleman said “Oh, you’re a risk manager. I’ve had trouble with my Workers’ Compensation…” and he began to talk about insurance.

This was a prime example of the perception surrounding the terms “risk management” and “risk manager,” and how they’ve been equated solely to insurance coverage and insurance professionals in the past.   I’ve witnessed this misrepresentation of the terms so many times that I felt not just inspired, but a public obligation, to write this article and help clear the confusion with the terminology that began long ago.

PASSING THE SMELL TEST

In the early 1960’s, two professors, Robert Mehr and Bob Hedges, developed the concept of Enterprise Risk Management. These two could easily be called the Godfathers of Risk Management. They published the first text to fully address the subject of business risk, “Risk Management in the Business Enterprise.”  The book introduced how risk management of an entire business could maximize efficiency, which would result in greater productivity. The basic premise was that all business risks should be managed, not simply those that could be “insured.”

Suffice it to say that over time, the term “risk management” began to take on a more limited meaning, referring just to insurable risks (for a slightly more elaborate outline see history of enterprise risk management). Now, some 45 years later, many large public firms are finally returning to the original roots of risk management. The Risk Managers of these firms manage the risk exposures of the entire business, not just those risks that are insurable. Mehr and Hedges would be very happy about this if they were here with us today. And, I might add, this helps put my mind at ease as well.

You see, having been heavily involved in construction for much of my lifetime and having witnessed many different construction business failures, it became evident to me that the causes for each failure all boiled down to risk. However, it never seemed to make sense that insurance brokers and agents called themselves risk managers, especially since they only provided a form of management that addressed insurable risk. It just never sat right with me. First of all, they really didn’t address anywhere close to all of the business risks that exist. Second, out of all the business failures I had witnessed, none were the result of having too little insurance or poor loss control procedures. When I finally came to understand how risk management evolved over the years it was somewhat of an awakening.

THE ENTERPRISE RISK MANAGEMENT PROCESS

Robert Mehr and Bob Hedges came up with the steps for the risk management process, and the basic form is still in practice to this day:

• Risk Identification (Identify all the risk factors; all the possible causes for loss in a typical company)
• Risk Analysis (Analyze the risk; assess and measure the potential for loss in the company to be examined)
• Risk Response (Determine what to do; either assume, transfer or reduce the risk)
• Risk Control (Implement internal controls to reduce or transfer the risk)
• Risk Monitoring (Select a method for monitoring results and put it in practice)

As originally intended, risk management would encompass management of the entire business enterprise; hence, the field became known as Enterprise Risk Management (ERM for short). ERM requires examination of all risks that an organization faces and applies directly to four distinct types of risk: Operational Risk, Financial Risk, Strategic Risk, and Hazard Risk.

For the most part, only hazard risks are insurable.  Thus, insurance brokers should have called themselves hazard risk managers instead of just “risk managers”.  Now, with the reemergence of ERM, traditional insurance-based “risk managers” are being pushed into a wider arena of risk management, one that incorporates all other areas of business risk, many new forms of risk analysis, and a wider array of risk control mechanisms.

The primary challenge of expanding risk management across the enterprise is that, because it involves so many different aspects of an organization’s operations, traditional insurance-based risk managers (who focus only on hazard risk) are simply not qualified as enterprise risk managers. They simply don’t have the experience or expertise necessary to have a firm grasp of all aspects of a business, and there are already signs they are losing their hold on the “risk manager” title. In fact, the fastest growing position in the business world today is that of Chief Risk Officer (CRO). As ERM continues to filter down from public companies to smaller and smaller private companies, you can expect a CRO type individual to become part of every management team. After all, the adoption rate of the ERM process has already reached 40% in public firms.

In order for risk managers to evolve from insurance minded professionals to ones who understand the risks of an entire business enterprise, they will have to learn the language and the approach of each business area, either alone or as a team. If they are to act as a team, the team leader will need to have a basic understanding of all the steps involved in the entire process of risk management and the methodology used in each business area. Clearly, traditional risk managers will need to obtain additional skills to be involved with enterprise risk management.

TYPES OF RISK MANAGERS

There is no doubt Enterprise Risk Management is making its way from large public firms to firms in the private arena. It is being dictated by credit providers of large public firms as a result of Sarbanes-Oxley and, given the current credit environment, may soon be expected of private firms too. It may not be long until ERM becomes an expected and necessary way for all companies to operate.

Since risk management has expanded to cover risk across the entire enterprise, one of the largest challenges has been finding individuals capable of understanding and managing such risk. Since insurance agents or brokers who only provide insurance advice to their clients do not fit the bill, corporate decision makers only have a couple options:

1. Salaried employees who can learn to manage a wider scope of risk for their company than traditional risk managers (often chief financial officers or treasurers); and
2. Independent consultants who provide comprehensive Enterprise Risk Management services.

Individuals who perform at this level are called CRO’s. They are in very high demand today and typically are drawing salaries even higher than the CFO. As time progresses, I expect that there will be a lot of CRO’s working on a consultancy basis since smaller firms won’t be able to find, much less afford individuals qualified to identify, assess, and control all of the risks in a business enterprise. Obviously, such individuals must be very specialized in a particular industry to serve their clients well.

To choose the best type of risk manager for their companies, corporate decision makers must now consider the potential increase in profits that the adoption of the Enterprise Risk Management process can bring. For those early adopters, employing an experienced professional in Enterprise Risk Management is the key to real benefit. If that person is a consultant, he can be used as the de facto enterprise risk manager who can be relied upon to retrain traditional risk managers already on staff so they can gain the full knowledge of how to control risk across the enterprise. As time will tell, the true risk manager will not be the traditional insurance professional who addresses Hazard risk, but will be the individual who can address Operational, Financial, and Strategic risk as well. That is how risk management is evolving and what is expected of a risk manager in many companies today.

Thus, will the real risk manager, please stand up!

By:  David F. Druml, ERM Specialist a My Risk Control, LLC

Excerpts from “Journal of Risk Management of Korea Volume 12, Number 1” D’Arcy, Stephen P., Professor of Finance, University of Illinois at Urbana-Champaign, May 30, 2001

Technorati Tags: Bob Hedges, Business Failure, Chief Risk Officer, construction consultants, Construction Risk, Construction Risk Management, CRO, Enterprise Risk Management, ERM, financial risk, hazard risk, Insurable Risk, operational risk, Risk management, Risk Manager, risk quadrants, Robert Mehr, strategic risk

This title seems especially appropriate following the recent Beijing Olympics. But today we are not talking about Chinese culture, we are talking about qualitative data and quantitative data, risk data and financial data, causes for success and causes for failure. What do these have in common? As the Chinese definition goes, they are two complimentary qualities that, when put together, form the whole.

At the end of the day, business is about achieving profitability, which is defined as the ability of an enterprise to generate revenues in excess of the costs incurred to produce those revenues and is often measured by a rate of profit or rate of return on investment. Credit underwriters also seek to achieve profitability, and that means avoiding large, unforeseen losses. To maximize profitability, underwriters need to find the optimal balance between premiums charged and risk present.

Unfortunately, as discussed in , underwriters are often working with insufficient, inadequate, or obsolete data so measuring the “risk present” becomes quite a tall order, and many times involves outright guessing. They have no way of knowing where the applicant lies in the . Fortunately, with the advent of a standardized mean to collect and analyze qualitative data, most of these underwriting deficiencies can be overcome. In this post, we’ll discuss how qualitative and quantitative data fit together to form a complete picture of an applicant during the credit underwriting process.

(more…)

Technorati Tags: credit underwriting, Enterprise Risk Management, ERM, failure risk, guarantee underwriting, maximum profitability, profitability risk, qualitative data, quantitative data, Risk analysis, risk data, risk premium