Standarts for risk management and IT security Financial analysis in risk management 17 November 2024 ISO 27005- Process model of Risk management 1.Financial analysis in risk management decision making 2. 2.Time value of money 3. 3.Financial analysis applications • Analyzing insurance coverage bids •Risk-control investment decisions 17 November 2024 Overview •Risk managers must make a number of important decisions. •The risk manager’s decisions are based on economics—weighing the costs and benefits of a course of action to see whether it is in the economic interests of the company and its stockholders. •Financial analysis can be applied to assist in RM decision making. •To make decisions involving cash flows in different time periods, the risk manager must employ time value of money analysis. 17 November 2024 Financial analysis in risk management decision making •Because RM decisions will likely involve cash flows in different time periods, the time value of money must be considered. •The time value of money means that when valuing cash flows in different time periods, the interest-earning capacity of money must be taken into consideration. •e.g.: A dollar received today is worth more than a dollar received one year from today because the dollar received today can be invested immediately to earn interest. Therefore, when evaluating cash flows in different time periods, it is important to adjust dollar values to reflect the earning of interest. 17 November 2024 Time value of money Suppose you open a bank account today and deposit $100. The value of the account today—the present value (PV)—is $100. Further assume that the bank is willing to pay 4% interest, compounded annually, on your account. What is the account balance one year from today? At that time, you would have your original $100, plus an additional 4% of $100, or $4 in interest: $100 + ($100 x 0.04) = $104 Factoring, you would have: $100 x (1 + 0.04) = $104 Thus, if you multiply the starting amount (PV) by 1 plus the interest rate (i), it will give you the amount 1 year from today - the future value (FV): PV X (1 + i) = FV 17 November 2024 Time value of money - Math problem If you wish to know the account balance after 2 years, simply multiply the balance at the end of the first year by 1 plus the interest rate. In this way, we arrive at the simple formula for the future value of a present amount: P V (1 + i) n = F V where ”n”is the number of time periods In the second year, not only will you earn interest on the original deposit, but you will also earn interest on the $4 in interest you earned in the first period. Because you are earning interest on interest (compound interest), the operation through which a present value is converted to a future value is called compounding 17 November 2024 Time value of money Compounding also works in reverse. Assume that you know the value of a future cash flow, but you want to know what the cash flow is worth today, adjusting for the time value of money. Dividing both sides of our compounding equation by (1 + i) n yields the following expression: FV P V = ______ (1 + i) n If you want to know the present value of any future amount, divide the future amount by 1 plus the interest rate, raised to the number of time periods. This operation—bringing a future value back to present value—is called discounting. 17 November 2024 Time value of money •Assume that a risk manager would like to purchase property insurance on a building. He/she is analyzing 2 insurance coverage bids. The bids are from comparable insurance companies, the coverages are identical, and the policy limits are the same. The premiums and deductibles, however, differ. Insurer A’s coverage requires an annual premium of $90,000 with a $5,000 per-claim deductible. Insurer B’s coverage requires an annual premium of $35,000 with a $10,000 per-claim deductible. The risk manager wonders whether the additional $55,000 in premiums is warranted to obtain the lower deductible. Using some of the loss forecasting methods just described, the risk manager predicts the following losses will occur: 17 November 2024 1. Analyzing insurance coverage bids Expected Number of Losses Expected Size of Losses 12 $5,000 6 $10,000 2 over $10,000 n=20 •Which coverage bid should he/she select, based on the number of expected claims and the magnitude of these claims? For simplicity, assume that premiums are paid at the start of the year, losses and deductibles are paid at the end of the year, and 5% is the appropriate interest (discount) rate. 17 November 2024 1. Analyzing insurance coverage bids •With Insurer A’s bid, the expected cash outflows in 1 year would be the first $5,000 of 20 losses that are each $5,000 or more, for a total of $100,000 in deductibles. 100, 000 P V = __________________= 95, 238 (1 + 0.05)1 •The present value of the total expected payments ($90,000 insurance premium at the start of the year plus the present value of the deductibles) would be $185,238. •With Insurer B’s bid, the expected cash outflows for deductibles at the end of the year would be ($5,000 x 12) + ($10,000 x 6) + ($10,000 x 2) = $140,000 17 November 2024 1. Analyzing insurance coverage bids •The present value of these deductible payments is 140,000 P V = __________ = $133, 333 (1 + 0.05)1 •The present value of the total expected payments ($35,000 insurance premium at the start of the year plus the present value of the deductibles) would be $168,333. The present values calculated represent the present values of expected cash outflows. The bid from Insurer B has a lower present value of the expected cash outflows compared to the bid from Insurer A. 17 November 2024 1. Analyzing insurance coverage bids •Risk-control investments are undertaken in an effort to reduce the frequency and severity of losses. •Such investments can be analyzed from a capital budgeting perspective by employing time value of money analysis. •Capital budgeting is a method of determining which capital investment projects a company should undertake. Only those projects that benefit the organization financially should be accepted. If not enough capital is available to undertake all of the acceptable projects, then capital budgeting can assist the risk manager in determining the optimal set of projects to consider. 17 November 2024 2. Risk-control investment decisions •A number of capital budgeting techniques are available (NPV, IRR, payback method, discounted payback, and accounting rate of return). •NPV is preferred-it employs time value of money, uses the appropriate cash flow and provides monetary answer that is easy to interpret. •The net present value (NPV) of a project is the sum of the PVs of the future net cash flows minus the cost of the project. •The internal rate of return (IRR) on a project is the average annual rate of return provided by investing in the project. 17 November 2024 2. Risk-control investment decisions Cash flows are generated by ↑ revenues and ↓ expenses. To calculate the NPV, the cash flows are discounted at an interest rate that considers the rate of return required by the organization’s capital suppliers and the riskiness of the project. A +(-) NPV represents an ↑ (↓) in value for the firm if the investment were made. 17 November 2024 2. Risk-control investment decisions •Math problem: The risk manager of an oil company that owns service stations may notice a disturbing trend in premises-related liability claims. Patrons may claim to have been injured on the premises (e.g., slip-and-fall injuries near gas pumps or inside the service station) and sue the oil company for their injuries. The risk manager decides to install camera surveillance systems at several of the ”problem”service stations at a cost of $85,000 per system. The risk manager expects each surveillance system to generate an after-tax net cash flow of $40,000 per year for three years. •The present value of $40,000 per year for three years discounted at the appropriate interest rate (we assume 8%) is $103,084. PV of future cash flows — cost of project = NPV $103,084 — $85,000 = $18,084 •As the project has a positive NPV, the investment is acceptable. 17 November 2024 2. Risk-control investment decisions •The project’s IRR could be determined and compared to the company’s required rate of return on investment. The IRR is the interest rate that makes the NPV equal zero. •When the IRR is used to discount the future cash flows back to time zero, the sum of the discounted cash flows equals the cost of the project. •For this project, the IRR is 19.44%. As 19.44% is greater than the required rate of return, 8%, the project is acceptable. •The benefits that will be obtained by investing in the project may come in the form of ↑ revenues, ↓ expenses, or combination of the two. •Although some revenues and expenses associated with the project are easy to quantify, other values—such as employee morale, reduced pain and suffering, public perceptions of the company, and lost productivity when a new worker is hired to replace an injured experienced worker—are difficult to measure. 17 November 2024 2. Risk-control investment decisions Thank you for your attention! 17 November 2024