Standarts for risk management and IT security
Financial analysis in risk management
24 November 2021
ISO 27005- Process model of Risk management
1. Financial analysis in risk management decision making
2. Time value of money
3. Financial analysis applications
• Analyzing insurance coverage bids
• Risk-control investment decisions
24 November 2021
Overview
• Risk managers must make a number of important decisions.
• The risk manager’s decisions are based on economics—weighing the costs
and benefits of a course of action to see whether it is in the economic interests
of the company and its stockholders.
• Financial analysis can be applied to assist in RM decision making.
• To make decisions involving cash flows in different time periods, the risk
manager must employ time value of money analysis.
24 November 2021
Financial analysis in risk management decision making
• Because RM decisions will likely involve cash flows in different time periods,
the time value of money must be considered.
• The time value of money means that when valuing cash flows in different
time periods, the interest-earning capacity of money must be taken into
consideration.
• e.g.: A dollar received today is worth more than a dollar received one year
from today because the dollar received today can be invested immediately to
earn interest. Therefore, when evaluating cash flows in different time periods,
it is important to adjust dollar values to reflect the earning of interest.
24 November 2021
Time value of money
Suppose you open a bank account today and deposit $100. The value of the
account today—the present value (PV)—is $100. Further assume that the bank is
willing to pay 4% interest, compounded annually, on your account. What is the
account balance one year from today? At that time, you would have your original
$100, plus an additional 4% of $100, or $4 in interest:
$100 + ($100 x 0.04) = $104
Factoring, you would have:
$100 x (1 + 0.04) = $104
Thus, if you multiply the starting amount (PV) by 1 plus the interest rate (i), it will
give you the amount 1 year from today - the future value (FV):
PV X (1 + i) = FV
24 November 2021
Time value of money - Math problem
If you wish to know the account balance after 2 years, simply multiply the balance
at the end of the first year by 1 plus the interest rate. In this way, we arrive at the
simple formula for the future value of a present amount:
P V (1 + i) n = F V
where ”n”is the number of time periods In the second year, not only will you earn
interest on the original deposit, but you will also earn interest on the $4 in interest
you earned in the first period. Because you are earning interest on interest
(compound interest), the operation through which a present value is converted to a
future value is called compounding
24 November 2021
Time value of money
Compounding also works in reverse. Assume that you know the value of a future
cash flow, but you want to know what the cash flow is worth today, adjusting for
the time value of money. Dividing both sides of our compounding equation by
(1 + i) n
yields the following expression:
FV
P V = ______
(1 + i) n
If you want to know the present value of any future amount, divide the future
amount by 1 plus the interest rate, raised to the number of time periods. This
operation—bringing a future value back to present value—is called discounting.
24 November 2021
Time value of money
• Assume that a risk manager would like to purchase property insurance on a
building. He/she is analyzing 2 insurance coverage bids. The bids are from
comparable insurance companies, the coverages are identical, and the policy
limits are the same. The premiums and deductibles, however, differ. Insurer A’s
coverage requires an annual premium of $90,000 with a $5,000 per-claim
deductible. Insurer B’s coverage requires an annual premium of $35,000 with a
$10,000 per-claim deductible. The risk manager wonders whether the
additional $55,000 in premiums is warranted to obtain the lower deductible.
Using some of the loss forecasting methods just described, the risk manager
predicts the following losses will occur:
24 November 2021
1. Analyzing insurance coverage bids
Expected Number of Losses Expected Size of Losses
12 $5,000
6 $10,000
2 over $10,000
n=20
• Which coverage bid should he/she select, based on the number of expected
claims and the magnitude of these claims? For simplicity, assume that
premiums are paid at the start of the year, losses and deductibles are paid at the
end of the year, and 5% is the appropriate interest (discount) rate.
24 November 2021
1. Analyzing insurance coverage bids
• With Insurer A’s bid, the expected cash outflows in 1 year would be the first
$5,000 of 20 losses that are each $5,000 or more, for a total of $100,000 in
deductibles.
100, 000
P V = __________________= 95, 238
(1 + 0.05)1
• The present value of the total expected payments ($90,000 insurance premium
at the start of the year plus the present value of the deductibles) would be
$185,238.
• With Insurer B’s bid, the expected cash outflows for deductibles at the end of
the year would be
($5,000 x 12) + ($10,000 x 6) + ($10,000 x 2) = $140,000
24 November 2021
1. Analyzing insurance coverage bids
• The present value of these deductible payments is
140,000
P V = __________ = $133, 333
(1 + 0.05)1
• The present value of the total expected payments ($35,000 insurance premium
at the start of the year plus the present value of the deductibles) would be
$168,333. The present values calculated represent the present values of
expected cash outflows. The bid from Insurer B has a lower present value of
the expected cash outflows compared to the bid from Insurer A.
24 November 2021
1. Analyzing insurance coverage bids
• Risk-control investments are undertaken in an effort to reduce the frequency
and severity of losses.
• Such investments can be analyzed from a capital budgeting perspective by
employing time value of money analysis.
• Capital budgeting is a method of determining which capital investment projects
a company should undertake. Only those projects that benefit the organization
financially should be accepted. If not enough capital is available to undertake
all of the acceptable projects, then capital budgeting can assist the risk manager
in determining the optimal set of projects to consider.
24 November 2021
2. Risk-control investment decisions
• A number of capital budgeting techniques are available (NPV, IRR, payback
method, discounted payback, and accounting rate of return).
• NPV is preferred-it employs time value of money, uses the appropriate cash
flow and provides monetary answer that is easy to interpret.
• The net present value (NPV) of a project is the sum of the PVs of the future
net cash flows minus the cost of the project.
• The internal rate of return (IRR) on a project is the average annual rate of
return provided by investing in the project.
24 November 2021
2. Risk-control investment decisions
Cash flows are generated by ↑ revenues and ↓ expenses. To calculate the NPV, the
cash flows are discounted at an interest rate that considers the rate of return
required by the organization’s capital suppliers and the riskiness of the project. A
+(-) NPV represents an ↑ (↓) in value for the firm if the investment were made.
24 November 2021
2. Risk-control investment decisions
• Math problem: The risk manager of an oil company that owns service stations
may notice a disturbing trend in premises-related liability claims. Patrons may
claim to have been injured on the premises (e.g., slip-and-fall injuries near gas
pumps or inside the service station) and sue the oil company for their injuries.
The risk manager decides to install camera surveillance systems at several of
the ”problem”service stations at a cost of $85,000 per system. The risk
manager expects each surveillance system to generate an after-tax net cash
flow of $40,000 per year for three years.
• The present value of $40,000 per year for three years discounted at the
appropriate interest rate (we assume 8%) is $103,084. PV of future cash flows
— cost of project = NPV $103,084 — $85,000 = $18,084
• As the project has a positive NPV, the investment is acceptable.
24 November 2021
2. Risk-control investment decisions
• The project’s IRR could be determined and compared to the company’s
required rate of return on investment. The IRR is the interest rate that makes
the NPV equal zero.
• When the IRR is used to discount the future cash flows back to time zero, the
sum of the discounted cash flows equals the cost of the project.
• For this project, the IRR is 19.44%. As 19.44% is greater than the required rate
of return, 8%, the project is acceptable.
• The benefits that will be obtained by investing in the project may come in the
form of ↑ revenues, ↓ expenses, or combination of the two.
• Although some revenues and expenses associated with the project are easy to
quantify, other values—such as employee morale, reduced pain and suffering,
public perceptions of the company, and lost productivity when a new worker is
hired to replace an injured experienced worker—are difficult to measure.
24 November 2021
2. Risk-control investment decisions
Thank you for your attention!
24 November 2021