Derivatives in IT decision making

Doesn’t topic look strange? Yes I am referring to using derivatives in selecting IT solution. I haven’t got crazy working in IT industry after MBA finance but the fact is it relates. I read an amazing article from an analyst of Forrestor who had proposed this concept and I have highest respect for his knowledge and conceptual clarity of both the worlds – IT and Finance. So the credit for this post goes to him. I am trying in this post to explain my understanding of the report in simple words for benefit of non-IT guys.

Let me start with simple question – what does a business looks for from its IT? I know it may mean different to different businesses but in very crude terms we can say that IT must at very basic level facilitate the business to grow and thereby achieve its objective. Now the question for CIO is when business looks forward to IT for some solution to business problems he needs to select best from variety of alternatives available. This is very subjective since it has to take into consideration variety of constraints like budget, available skill set and future business outlook. But do all the necessary factors are factored in while making such decision? How is the cost-benefit done for each option? More often than not CIO would determine cost of implementation and the value of direct benefits from it and then select one which gives maximum value for given cost which should be within the budget. But is this the best way to take such decision? I will give simple example. Given business problem say introducing online shopping can be solved by solution A and solution B. Cost of solution A is say Rs 1 lakh while of solution B say 1.2 lakh which provides same functionality but with flexibility to add auction feature within a year. Now given above method of decision making CIO would select solution A since there is no way to factor the value of limited (time bounded) flexibility that solution B offers. So here if CIO is able to find the value of flexibility then he can make better decision. Then how to find its value?

The answer to this problem is call option from finance industry. This case is similar to concept of the call option which gives the buyer of the option a right to buy the underlying at strike price before expiry date of the option. Here also solution B offers CIO a right to implement auction functionality at certain determined cost within a year. The call options have value for the right they provide and similarly this flexibility should also have value. Call options price is found using Black Scholes option pricing formula:-

c= s*f(d1) –xe-rt f(d2)
d1={log(s/x) + (r + v2 /2)t}/v*sqrt(t)
d2 = d1 – v*sqrt(t)

where ,
s= price of underlying
x= strike price
r= risk free rate of interest
t= time duration for expiration of option
v = volatility for stock
f= standard normal cumulative distribution function.

We can use same formula to find value of the flexibility to make more informed decision since the concept is same. In our case

c= value of the flexibility provided
s= return on implementation of auction feature
x = cost of implementation of auction feature
t = 1 year here i.e. time available to avail the flexibility
v= volatility of industry can be used to predict volatility of business and hence technology usage.

So using this above option we can find value of this flexibility and that value can be deducted from option B to make it comparable with option A. This would enable better decision making for CIO than obvious methods that are used today. Further it provides him an opportunity to deliberate on future features that might be required and may facilitate him to provide more objective explanation to CFO for budgetary approval of flexible IT solution that may help business in longer term.
I know you may question lot of assumption like that of volatility and usage of normal distribution and most important the assumption made by Black-Scholes in pricing model etc. But this post is meant to bring to your knowledge entire new dimension of using the financial knowledge in IT decision making. We can always debate out the viewpoint and criticize the shortcoming of any model but at same time I think we should appreciate the new perspective.

Performance management for Risk Managers: A question unanswered

This thing struck me especially after I myself started working on risk management. I had taken extra course on compensation management much to surprise of most of my friends. One of the important take away from the course was the importance of tying of compensation with performance. In nutshell, right performance must be rewarded with right (desired) compensation technique. Thus performance management is tightly coupled with compensation management and can have far reaching impact on employee’s satisfaction. You may be wondering why am I writing this “gyaan “but this has to do with the current debate regarding executive compensation and its role in financial crisis.

To measure the performance for any role we must first define the metrics and the process for the same. Revenue generated, number of customer added etc are various metrics used to measure the performance of sales personnel. So what could be metrics for risk manager just try to think? It should be how well company performs or withstand during the adverse business conditions. But now consider how you would have appraised risk managers during 2003-05 when global economy was booming and nothing wrong or unexpected was happening. The companies earning were growing year on year basis. At this time imagine particular risk manager not allowing banks to give out loans for housing, asking to maintain high liquidity and not taking exposure to CDO and other complex instruments since he recognized they were dangerous. At same time all its competitor were doing exactly opposite and thus were able to grow at twice the rate of the other bank. How would have that risk manager been appraised at end of 2003? He would have been criticized for being risk averse and would have lost his job in year or two to other set of risk managers. This is because metrics to measure risk manager performance is not that clear. During that period there were no crisis so how you measure their performance. In absence of the adverse conditions everyone were able to “so called withstand” the year but some made more profits than the others so people tend to appraise the other risk manager with better grade and hence better compensation. Even the sophisticated technique like balance scorecard would fail to measure the performance of risk manger. Since here we would look from all perspective so on revenue and profit front the risk manager would score low. I know someone fresh out of MBA would like to use some business terms and explain me that performance should be in how well risk has been managed with respect to defined risk appetite of the company. I agree to this but who defines the risk appetite? If it is board or CEO then if risk manager followed that then why are they being condemned for their action today? It was in line with the goals set for them.

So then how should we appraise risk manager? What should be metrics and process? All human resource manager needs to work this out. I believe that we should now look at long term for appraisal and compensation management for risk managers. But then what should be this long term? I have no answer to this. The question is open for all of you to answer. Maybe someone can point to honorable Robert Kaplan to work out special metrics for risk manager or throw some light on this area. What say guys?

Risk management experience

This is my first hand experience in area of risk management. Risk management has been researched and practiced by companies in American and European countries. Even after putting in various processes and mitigation techniques financial crisis could not be avoided. At same time even though Indian companies do not have formal enterprise risk management practice in place, they are not in that trouble. So does that mean risk management is of no use and entire work done in that area has no value? Is it mere exhibition of mathematical supremacy of some geeks? Are those models part of problem or solution to today’s problems?

The answer I found when I started working for developing risk model for my company. After few days at work I was taken aback when there were no formal strategies in place nor any guidance or processes in area I was working. To start my work I decided to talk to various stakeholders and quickly realized that how could they manage without knowledge of risk involved and still earned profit. The answer lies in first blog post of mine. We Indians by nature are risk averse. In initial part of my career when I was involved in software development I had to estimate the effort for the development. I always use to pad it up by 20-30% to ensure timely delivery. But when my lead forwarded that estimates she would further pad it up by other 10% and so on till entire estimates gets padded up by almost 200%. Then client would negotiate and we would end up having at least 100% padded estimate. Though we did not have formal project risk management practice in place we ensure timely delivery. The same is true with most of Indian companies. They have mostly hierarchical organization structure rather than flat one and further at each level each one of them adds its own estimate of risk premium which ensures sufficient buffer, in fact more than required. Thus they have been able to withstand any deviation from expected.

Risk management is thus very important for Indian companies since it would free up lot of capital (or bring down estimates to appropriate level) and would help them to be more competitive. It would help them to improve their estimation. So unlike western countries where risk management increases capital requirement, eastern countries it might have opposite impact. But the fact remains risk management would certainly be of importance to both of them.

I had gained similar learning from my experience with startup. They were quite successful growing at almost 20-30% a year. They also did not risk management practice in place and neither believed in that. After detailed study of their company for a year or so I realized the risk aversion and management was inherently in culture and style of the entrepreneurs. All that I could suggest as part of process was indirectly implemented by them as part of their business.

Sometimes after learning lot of complex stuff, models we might miss out these socio-cultural factors that are very important for risk consultants. They might look silly but can have important consequences if you are working as risk consultants in different countries across the globe with companies of different size. Today I realized that small company without any knowledge of risk could have better risk management practice ingrained in its business than billion Dollar Company armed with professional from best of the B-schools.