Risk — the ground floor

Risk is the price of return

Investing is intrinsically risky. Return is the reward for taking risk. So defining, spotting and managing risk is a core part of portfolio management.

The workbook's definition: risk is the variability of outcomes, which can relate to the value of assets or to earnings.

Higher expected return comes with higher inherent risk. Some risks can be mitigated; a few cannot. A prudent investor keeps an optimal balance of risk and return.

The risk management process

At the strategic level, the portfolio manager creates a risk framework that fits the investment objective. It builds awareness and culture across both investment and operations teams. It must be maintained, monitored and modified continuously.

The six steps:

1. Setting objectives — define investment objectives together with their risks. This helps with risk tolerance, performance measurement, rebalancing and reporting.
2. Identification — list all major and minor risks, keeping the objective in mind.
3. Analysing — judge each risk's impact. Some are overwhelming, some negligible. Some can be quantified, others cannot.
4. Evaluating — rank risks by impact. The two key metrics are severity of risk and frequency of occurrence.
5. Treatment — take one or more of four actions: Tolerate, Mitigate, Transfer, Terminate (close the activity).
6. Control and monitor — capture, analyse and report data, and modify the framework. Risk management is iterative.

A good framework aligns risk with objectives, helps investors understand the portfolio's risk profile, limits unwarranted risk, avoids losses that could lead to bankruptcy, improves information flow, detects risks and frauds early, improves compliance and audit, and helps create value.

Two broad families of risk

• Investment risks — the portfolio's value and return are at risk (markets go up and down).
• Compliance and operational risks — from defaults, operational failures and so on.

Market risk (systematic)

Market risk comes from factors that affect all investment opportunities, though to different degrees.

Market risk cannot be diversified away. It is mitigated by hedging with options, futures and swaps. It is also called systematic risk. It is measured by beta.

Non-market risk (unsystematic)

Non-market risk is specific to companies, sectors or instruments — unique or idiosyncratic risk. It can be reduced by diversification.

It splits into:

• Sector-specific risk — affects companies in one sector only, such as a new regulatory compliance cost.
• Company-specific risk, of two kinds:
  • Business risk — actual performance falls short: product failure, price wars, supply chain disruption, labour issues, regulatory reprimands. Measured well by variability of cash flows or EBITDA.
  • Financial risk — a weak capital structure; more than sustainable debt is a sure cause. Measured by leverage measures.

The workbook treats operational, legal and compliance risk at company level as subsets of business risk.

Total investment risk = market (systematic) risk + specific (non-systematic) risk.

Portfolio risk and diversification

Portfolio risk depends on each asset's risk and return and on their correlations. An optimal portfolio gives the maximum return for the investor's risk tolerance.

When assets are not perfectly correlated, portfolio risk is less than the weighted sum of individual risks. That is diversification. But the law of diminishing returns applies: this chapter says after about 30 to 35 stocks, further risk reduction is very small. Later, under managing non-market risk, it suggests 35 or more constituents. Chapter 16 of the same workbook puts the flattening point at 20 to 30 securities. Know all three.

Perfectly negatively correlated assets would be ideal, but in real life they are hard to find — except insurance products or put options on the portfolio.

The other named risks

Liquidity risk. The risk of a big price impact when the market is not deep enough for the size you want to trade — or of not selling the desired size at the desired price. It shows up in the bid-ask spread: lower spread, higher liquidity. Exchange-traded securities are usually more liquid than over-the-counter ones. In bonds, on-the-run bonds trade more readily than others.

Operational risk. The risk of loss from inadequate or failed policies, processes, systems and people. Its genesis is poor planning and slow response by the operations manager. The fix is an "iron grip" MIS tracking delays, errors and reconciliation, plus: train people, audit IT systems, monitor deviations, review internal policies, and use forced breakdowns to find loopholes.

Regulatory risk. Changes in laws or regulation that raise costs or reshape competition — examples include Securities Transaction Tax, Dividend Distribution Tax, repatriation tax, separation of distribution and advisory, and the absence of Double Taxation Avoidance Treaties. It can even close a business. Non-compliance brings penalties and permanent loss of client trust. Portfolio managers have fiduciary duties, so this assessment is of highest importance.

Legal risk. A third party sues for breach of contract, causing loss through a (i) lengthy, (ii) costly or (iii) unfavourable verdict. Regulatory risk is a part of legal risk. Regulatory risk is about unfavourable changes in rules; legal risk is about enforceability of contracts.

Geo-political risk. A country's economy suffers because of its relations with other countries or regional groups. It is long-term and often priced in, but prices swing widely when tensions flare.

Currency risk. Adverse exchange-rate moves on foreign-currency investments. Largely mitigated with futures, forwards and swaps. Managers must also check investee companies' own currency exposure.

Country risk. How a country's economic, political and business environment can cause loss.

Generally, a better credit rating means lower country risk.

Concentration risk. Losses from a disproportionately large holding in one security, asset class or market — in short, lack of diversification. Three forms: intentional (sector funds), asset performance (one holding grows too big unless rebalanced), and correlated assets (looks diversified, moves together). Frameworks set threshold limits for security, sector, asset class and country.

Pandemic risk. Large outbreaks disrupt economic, social and political life. The workbook's example is COVID-19. Pandemic is a systematic risk, difficult to diversify, though some sectors are less affected.

Measuring risk

Modern risk measurement began with Markowitz's 1952 paper, which introduced the efficient frontier and mean-variance optimisation. Chapter 17 says Sharpe and Lintner added CAPM in 1964 (Chapter 16 dates Lintner's work to 1965), bringing in the risk-free asset, the super-efficient (market) portfolio, and beta as the relevant risk measure.

Value at Risk (VaR) is the estimated maximum potential loss (i) over a certain period, (ii) with a given probability, (iii) under a particular market condition.

Three ways to compute VaR:

VaR is simple, universally accepted including by regulators, and helps allocate capital. But it involves subjectivity and underestimates extreme losses and extreme gains.

Sensitivity analysis asks how the portfolio reacts to a factor: beta (equity), duration (bonds), delta, gamma, vega (options). Stress testing imagines an extreme negative event — past or hypothetical — to prepare for "black swan" shocks.

Liquidity risk is measured by the bid-ask spread and the time to execute without moving the price. Liquidity-adjusted VaR = regular VaR + cost of unwinding positions.

Credit risk is the risk that a counterparty fails to pay interest or principal fully and on time. Government and government-backed bonds are not expected to default domestically but are not completely credit-risk-free. In India a credit rating is mandatory before issuing any bond or commercial paper. Managers do their own research using the four Cs: Capacity, Collateral, Covenants and Capital, and look for warning signs such as a rating downgrade or a sudden widening of bid-ask spreads.

Managing risk

For market risk, strategies depend on the risk factors, the degree of leverage and regulatory guidelines. Risk parameters, scenario analysis, stress tests and VaR together set capital (risk budgeting), leverage, position limits, stop-loss limits, targets for beta and duration, and hedges such as a protective put. Past tolerate-and-mitigate thresholds, managers transfer risk — floating-to-fixed swaps, swaptions, reinsurance. If the risk is too large, they terminate.

For non-market risk: diversify (say 35 or more constituents), add poorly correlated assets, monitor investee companies, and terminate risks not worth carrying.

For risks that cannot be managed — the 2008 financial crisis, COVID-19, "Black Swan" events (a term coined by Taleb) — rely on preparedness: scenario planning, tail risk assessment, stress testing and simulation.

Beyond the book

Two Indian episodes show why the workbook's credit and liquidity warnings matter. IL&FS carried top-tier credit ratings until shortly before it began defaulting in 2018, and the downgrades came within weeks — the "sharp deterioration in credit quality" the workbook describes. In April 2020, Franklin Templeton India wound up six debt schemes, citing redemption pressure and illiquidity in the bond market during the COVID-19 shock — liquidity risk and credit risk arriving together. And the workbook's own regulatory-risk example, Dividend Distribution Tax, was itself abolished by the Finance Act, 2020 — a regulatory change in its own right.