ANALYSIS: Effective risk management now a priority

By Brendon Donnellan and Alan Fish , financial services office of Ernst & Young It has long been accepted that risk management is a core competency for generating absolute returns within a hedge fund strategy. Until now historic performance levels have supported the view that expertise in identifying, measuring and managing risk was proprietary capabilities.

Prior to the current market downturn, hedge fund managers were able to diffuse investor requests for greater transparency in risk management practices, preserving policies that limited the information available to third parties. However, increased regulation, scrutiny and transparency are on the horizon for the hedge fund industry.

Market turmoil and a host of related financial missteps are transforming perceptions of the hedge fund industry. Investors, directors and regulators have been startled by the scope and magnitude of losses resulting from the market downturn and credit crisis, not to mention multiple breaches of fiduciary trust.

Proprietary processes, once considered a competitive advantage, are now viewed as potential sources of undue risk. High net worth investors, once deemed sophisticated by definition, now appear to be just the opposite, having exhibited little or no insight into the risks they were taking or the quality of risk management practices in place within hedge fund organisations.

As a result, there is profound investor regret, embarrassment and distrust. Investors, regulators and directors are demanding improvements, including formal and comprehensive approaches to governance and risk management that are open to independent third party review and evaluation.

Disclosure paradox
Hedge fund managers that adopt comprehensive, formal and transparent governance and risk management practices are more likely to be able to regain investor loyalty and trust. The more openness surrounding fundamental risk and governance strategies, the more leeway there will be in terms of protecting genuinely proprietary and uniquely differentiating competitive strategies and practices.

A handful of trends are leading to the transformation of hedge fund governance and risk management practices. For example, large institutional investors, sovereign wealth funds and fund of fund investment managers are now the principal sources of hedge fund investment capital.

These investors are expecting more sophisticated oversight functions designed to reduce or eliminate risks and surprises related to their investment dollars. In addition to regulatory compliance risk, hedge fund managers and their administrators are expected to make the necessary investments in infrastructure to support operational and information technology risk, including business continuity and disaster recovery.

In exchange for their capital, investors are demanding greater insight, during both initial investment selection due diligence and ongoing monitoring. Establishing and maintaining proper oversight verified by independent third-party evaluation is becoming a cornerstone of investor relationships.

Heightened investor expectations include a number of factors. First is greater rigor in credit and liquidity risk. Liquidity failures brought about by counterparty or service provider risk severely limit the ability to execute strategies and even threaten the continuity of a fund. Investors increasingly want assurances that hedge fund managers are able to identify, document and establish effective risk management practices related to their exposure to liquidity and counterparty credit risk.

Another is adherence to investment discipline. Breaches of investment discipline and style drift often expose investors to risks they have not agreed to. Investors expect hedge fund managers will maintain investment discipline and any changes to investment mandates will be formally approved, documented and communicated to investors. Breaches must be detected and corrected in a timely manner.

Greater transparency and reliability of valuations is needed. Investors want to know hedge fund managers have effective policies, procedures and practices in place to reduce conflict of interest risks and to ensure that assets are held in custody and accurately valued.

Volatility and illiquidity of financial assets held in hedge funds often coincide with limited independent sources of pricing data. Investors will be wary of values and performance returns without a robust and well-controlled valuation and pricing governance framework.

Stronger governance will be a focus as investors want to know hedge fund managers have effective policies, procedures, practices and controls. Fundamental internal control structures must be in place to prevent deviations from practices as well as to detect and correct financial inaccuracies, regulatory compliance violations or fraudulent activities. This includes maintaining adequate separation of duties as well as supervising and monitoring controls.

Needed response
Most financial organisations would agree investments in risk management offer a high return to the organisation. Hedge fund managers will find the right investment in governance and risk management practices will serve to increase investor confidence and enhance investment management and operational effectiveness.

Identifying and assessing risks require unique skills, approaches and methodologies. Managing risks requires strong corporate governance policies, procedures and internal controls to prevent, detect and correct potential issues that could lead to failures.

An emerging framework for risk governance establishes three lines of defence against various types of risk. The fundamental responsibility for risk management remains with the fund's manager and business functions and includes oversight of third party administrators and prime brokers.

Hedge fund managers and their business functions manage risk every day. They know best what risks are acceptable and bear the primary responsibility for monitoring, mitigating and reporting on them.

The second line of defence usually consists of an independent, yet fully integrated, risk management and compliance function.

An internal audit or validation function to provide independent testing and verification is the third line of defence.

Critical to the overall effectiveness of the these defences is a senior management team and board of directors providing a strong voice and who are able to ensure a culture of corporate governance and risk management is a high priority.

A company's approach to governance and risk management should also be tailored to its operating model. Three key elements to consider are risk assessment, risk monitoring and risk planning.

Risk response
Hedge fund managers should conduct periodic risk assessments to gain an understanding and provide an accurate risk profile of all business activities in which the fund is involved. The risk assessments should include the identification of any risks associated with those activities, the company's risk management capabilities and whether it is being compensated for the risk it engages.

To accomplish this, funds should perform risk assessments of their operations and major processes, including detailed analyses of higher risk areas.

Conflicts of interest analysis identifies areas where conflicts may exist or be inherent in a hedge fund manager's operating model and supporting processes. Most conflicts arise due to dealings involving insiders and related parties, inappropriate financial benefit, conflicting roles and responsibilities or unethical conduct. These risks should be anticipated, identified, managed and monitored on an ongoing basis.

An entitlement review identifies which staff members have access to what systems and whether their access is appropriate to their job function. Entitlement reviews often result in such basic measures as segregating the duties of portfolio managers and traders so managers can place orders for trades but not execute them. This segregation functions as a check on possible mistakes as well as potential misfeasance.

Scenario analysis involves hedge fund managers identifying events that could hurt the organisation and then constructing models to help evaluate the extent of the damage. For example, a hedge fund might ask what would happen to its positions if the yield curve were to invert.

Stress testing models is essential wherever a hedge fund manager uses financial and/or statistical models to help make investment decisions. Those models often rely on assumptions that could change gradually over time or suddenly, under unusual circumstances.

The credit crisis was exacerbated by model limitations that underestimated the correlation of investments under certain conditions. Worse was the fact some hedge fund managers relied on only a single model when sound risk management should feature a range of tests and crosschecks of assumptions.

Portfolio risk-exposure classification is a process in which a hedge fund manager periodically assesses the types of exposures it is engaging and identifies single-name risk, counterparty exposure, excess concentration, liquidity and sector/asset exposure.

Assessments of counterparty risk are particularly useful for funds relying on a relatively decentralised operating model. Some hedge funds allow their various business functions to negotiate individual service agreements. Some investment managers may fail to recognise providers or counterparties that appear unrelated are actually affiliates of a single company.

By doing business with the affiliates of one company, a hedge fund may inadvertently be subject to a higher than recognised degree of exposure to a single counterparty or provider.

The most forward thinking hedge fund managers are creating contingency plans across portfolios and affiliates in case of a counterparty failure.

Once the company has a clear assessment of the risks it is taking on, it should institute a monitoring programme to identify the changes, often difficult to detect, that may alter the hedge fund manager's investment profile, risk appetite, compensation structure or risk management capabilities. Successful monitoring programmes typically include one or more elements.

Portfolio monitoring puts increased focus on investment discipline. It is important to ask if hedge fund managers are concentrating on core areas or adopting strategies that introduce increased risk into the portfolio. Portfolio monitoring should be based on source data taken directly from a trading system rather than from individuals who may have a reason to manipulate the data. Done successfully, it provides an independent verification of performance against a risk-adjusted benchmark.

Monitoring risk thresholds involves clearly defining and tracking risk tolerances. For example, a fund could decide to limit its portfolio to no more than 15% invested in distressed debt. There must be clear escalation guidelines allowing managers to take corrective actions if tolerances are breached.

Causal factor analysis attempts to get at the root causes of risk is important, too. For example, fraud often increases when people are underpaid. Instead of monitoring the occurrence of fraud, a fund could use causal factor analysis to monitor pay levels across the organisation. Monitoring causal factors helps the firm gauge enterprise wide risk and warns senior management of changes in the fund's risk profile. It also helps the fund create risk indicators that can be monitored using a dashboard or some other form of risk reporting.

Service provider oversight and counterparty risk are a key focus of any risk-monitoring framework. Service providers and counterparties are often (but not always) one and the same entity. Usually key service providers include one or more prime brokers that act as counterparties to transactions.

Historically, hedge funds have used high quality service providers. Recent market events reveal a potential weakness in this strategy. Under certain unforeseen conditions, many companies that provide prime brokerage services will experience trouble simultaneously, exposing hedge funds to high levels of counterparty risk. Increasingly, funds with multiple affiliates are centralising some elements of counterparty monitoring to ensure consistent response and service.

Risk planning
The third part of a company's risk framework involves planning for a range of contingencies in areas such as capital adequacy or liquidity. This form of contingency planning is closely tied to scenario planning.

Risk planning maps out the steps a fund would take if a given event should occur. This is another incidence of the company deciding in advance to consider the unthinkable. For example, one form of contingency planning that is particularly useful for hedge funds, especially in the current environment, is liquidity planning. To set up a liquidity plan, hedge fund managers should consider several steps:

Establish forecasting and monitoring of contributions, redemptions and current liquidity facilities available to the fund in addition to normal portfolio liquidity measurements

Identify scenarios that could create a liquidity crisis (for example, counterparty failure, security class failure, run on the fund)

Identify standard responses such as discontinue business, tap liquidity funding, liquidate fund, consider gates or in kind payments to specific scenarios and establish a liquidity waterfall clearly identifying which assets would be tapped first

Develop a playbook for each scenario and response and identify key capabilities needed in each case.

Change may pose challenges to the decentralised, entrepreneurial cultures that exist within most hedge funds. The informal governance and risk management practices that at one time may have seemed to offer greater flexibility are now viewed by investors as potentially dangerous, casting doubt on the expected performance and overall reputation of any hedge fund manager.

By developing and implementing the type of governance and risk management framework described, funds can ensure that adequate assessment, monitoring and planning for various types of risk will take place as needed throughout the organisation.

This will go a long way toward addressing third party expectations surrounding risk management, disclosure and governance. At the same time it will help hedge funds to achieve operational efficiency and greater profitability.

Proprietary strategies that exploit risk to generate returns are at the heart of the hedge fund industry. Funds cannot afford to see their insight, differentiating capabilities or related intellectual property leak to competitors or investors.

Investors and regulators want greater assurances the risks relating to their investment capital are of a strategic nature and that they are not being exposed to potential lapses in risk management acumen or governance.

Hedge funds need to implement more effective governance and risk management. Simultaneously, investors, regulators and directors should be given greater visibility into a hedge fund manager's governance and risk programmes.

Representations made to investors, regulators and directors can be strengthened by third party verification of controls, governance and related risk management practices.

Ultimately, though paradoxically, sharing more about risk and governance will instil more confidence in key stakeholders and enable hedge fund managers to share even less relating to their own specific, value adding and generally proprietary investment strategies.

.