Part 1: How to Think About Risk Management During a Downturn
Hey folks,
The world is currently full of uncertainty. There’s massive volatility in the markets - tightening of venture capital - and all the things that come with that (layoffs, restructuring, business distress, and lower earning outlooks).
Every company is considering (or should be) ways to reduce cash burn and steer their business towards better profitability metrics. At the very extremes, some companies are reduced to focusing on survival until the next day.
If you’re someone making tough decisions and evaluating the trade offs of each, I hope this blog can help you think through your Risk Management team. In particular, I’d like to discuss some ways to consider the following aspects of risk management during a downturn:
-Part 1: Risk Management team headcount
-Part 1: Loss metrics & forecasting
-Part 2: Growth through risk management
-Part 2: Vendor spend
-Part 2: Automation & Scalability
Risk Management Team Headcount
I’ll start this off by saying I haven’t yet met a risk manager, especially in FinTech, that believes their team has adequate headcount. This is normal and expected - it’s the nature of how companies grow.
As an early stage company, you’re likely not dealing with huge fraud losses (you’re relatively unknown, a small target) - and credit losses generally don’t come from early adopters of your product (they’re taking a chance on you - and generally have the cash to support this bet). You may not even know what risk management is in your early stages.
The focus is on developing the product, selling the product, and growing the team & processes that support these functions. However, as companies grow, there’s an inflection point where the dollars being transacted through your product swells. You become a bigger target for bad actors & many businesses want your product (both healthy & unhealthy businesses!). You discover gaps in your product where funds can slip through to unintended destinations. These funds might be unrecoverable - and nobody knows which team owns the losses or dedicates bandwidth to addressing the issue.
This is where a risk team steps in.
Depending on the stage of your company, your risk team is likely playing catch up due to the nature of how this team is regularly built & developed. Parity between need and capabilities of risk management is established in later staged companies, as risk management is a crucial portion of the IPO process (or simply being a successful long term company). For fintechs, the size of risk teams can range from ~1-30 people (Series B - newly public companies). The team’s functions range from:
Policy
Analytics
Fraud Operations
Credit Operations
Product Management
Collections
Compliance / legal
Risk Engineering
Given the relatively lean makeup of the org - as well as the sensitivity and impact of the roles, you generally don’t see risk teams included in headcount reduction. If every team needs to be examined for redundancy - here are two ways you can look at your risk headcount:
Where is the company headed in terms of product & desired customer market segments? Many risk roles and functions are tied to serving a particular product or analyzing a certain segment of customers. If you’re moving away from something, that role and bandwidth could be strategically repurposed to the area you’re shifting to.
What function are you okay living without? Examine the main metrics of each team and consider if there’s an area to give on. Examples include:
Collections team: Recovery rate of lost funds
Fraud Operations: Fraud loss and customer approvals at onboarding (onboarding time, approval rate percentage)
Policy and Analytics: Operations volumes, false positives, credit and fraud loss rates
Credit Risk Operations: Delinquency and default rates
Would your company be better off if some of these metrics were materially worse? Does the benefit of a headcount reduction outweigh the impacts of your declining metrics (both dollar impact, internal stakeholder efficiency reduction, and customer trust impact)?
Unless you went on a risk management hiring spree (ever heard of that?), the answer is likely that your current team is crucial to the infrastructure of your business.
Loss Metrics and Forecasting
Companies lose money through risk-related events. It’s a cost of doing business and can be captured in a traditional risk-reward tradeoff framework.
In an environment of cutting costs, loss metrics are a lever that can be pulled to achieve this. For fintechs, you can generally categorize these losses into a few main buckets:
-Credit Loss
-Fraud Loss
-Account Takeover loss
-Chargebacks
For reliable forecasting (and the ability to adjust loss metrics), historical data from your platform’s customers is the most crucial piece of constructing these trade off scenarios and forecasts. Growth stage companies may not have this data (they’re newer companies!) and the infrastructure to capture that data may not exist, which will make it tough to create an accurate forecast. For this reason, it’s important to err on the very conservative end of loss forecasting & allowance for bad debts. One major risk event can blow your forecast.
If you don’t have data from your platform’s operating history, there are other helpful inputs for loss forecasting:
Industry benchmarks and averages (think resources like Moody’s CRE loss rates, SOFR rates, and other public sources)
Competitor data: Are your competitors public? You can find their loss rates on earnings reports. Do you have connections in the industry you can lean on for ballpark figures? Do your competitors securitize their debts or receivables? That information, while potentially expensive, is a goldmine for benchmark data.
Customer Segmentation: Create risk profiles of your customers and peg each bucket to an industry average or historical performance from your platform. Customer size and industry are two common ways to segment. How is each segment of customers performing in your portfolio?
Product Segmentation: Loss rates vary drastically across product type and money movement rails (example: ACH vs credit cards)
Stress tasting: Create a base model for current and historical losses on your platform. What does the number look like if there’s a 5%, 10%, or 20% increase in current loss performance?
Your company’s direction: If you’re aiming to change your customer segment mix or if you’re rolling out additional products, you’ll need to take these future considerations into account
Once you’ve developed a relatively accurate forecast, here are some simple formulas for how to think about changing your loss metrics:
Loss Reduction = less growth AND/ OR higher operational cost
Increase in Loss = higher growth AND/ OR lower operational cost
Growth, in this case, should be viewed as an increase in customer count or dollar volume processed. If you reduce growth, you will naturally constrain your loss volume. You can also intentionally constrain losses by reducing risk in lowest performing segments.
Operational costs, in this example, are headcount, vendor spend, and engineering resources. If you want to tighten the belt on losses, your operational team will be reviewing a lot more “high risk signals” while adding the likelihood of time-consuming false positives, your engineering team will need to build the tools and models to support this, and you may be reliant on a vendor’s product or algorithm to help implement this plan.
There are always tradeoffs - and it’s important to evaluate whether the savings in losses are worth the increases in operational costs or the reduction in growth. If your losses are huge and not contained, you can likely get much more bang for your buck by slightly tweaking your operations or growth strategy.
If you discover your losses are well outside of industry norms, this is likely the lever you should focus on tweaking.
“Look at loss as an investment in improvement”
That quote wraps it up for Part 1. Every “bad” thing you have happen on your platform can be used to learn and grow from - major losses are no different.
Thanks for reading!
Tom
