Recent articles in economic and financial media have reported that the US District Judge Shira Scheindlin has absolved YPF and its directors, Repsol, and the investment banks Morgan Stanley, Credit Suisse Goup AG and Goldman Sachs. Last February, an investor filed a lawsuit accusing them of failing to disclose the possibility of the company being nationalized by the Argentine government. This investor getting angry because the company and its advisors failed to disclose the existence of a risk poses an interesting challenge on the limits of disclosure in risk management. How far should we go in requiring firms to disclosing their risk map? Does this requirement change depending on the risk type? For example, should an investor have been entitled to sue Kodak and its directors for failing to disclose the possibility of disappearing because their business evaporated?
Every company faces risks; otherwise it could not obtain a profit. Firms generate value by assuming risks that they can manage efficiently, and transferring the ones that they do not want to bear. Risks have positive outcomes (upside), where firms make a profit, and negative outcomes (downside), where firms suffer a loss. Risk management can be summarized as “profiting from the upside, controlling the downside”. Risk is a central aspect in corporate life; is the justification for corporate profit, and furthermore, the justification of the existence of the firm. Firms that do not bear risks do not have a reason to exist. In order to profit from risk, firms need to recognize, classify and measure them in a Risk Map that helps classifying risks according to their probability of occurrence and impact.
In some cases, firms simply do not foresee some bad outcomes; things happen in an unexpected way, and surprise the company’s management. This means that some risks might simply not have been included in the risk map. In some other cases, firms know they are facing a risk, and decide to assume it, to take the chance. In this case, the risk should be included in the risk map.
Now, the question is, should firms be obliged to disclose all the risks identified in their risk map? Managers might not want to disclose such an important strategic tool, packed with sensitive information. On the other hand, I can understand the regulator willing to know what can go wrong, trying to avoid crowds of angry investors claiming for their losses. Still, it is not clear to me that companies should be forced to disclose all their relevant risks; some of them represent classified information that must not be disclosed. Then, who should make the decision regarding which risks to disclose? I think this poses an interesting dilemma.
In my opinion investors and other relevant stakeholders need to learn how to analyze the risks in their investments. Some investors might need to hire some specialized firm (consulting or investment banking firm specializing in risk management) that helps them in identifying and analyzing all the relevant risks in the investments they are considering. In this case, we will need to train consultants and investment bankers to do a better job at mapping risks for their clients!
