When it comes to navigating unchartered waters, one Head of FP&A learned the value of identifying and quantifying the company’s risks and creating a mitigation plan to address each one.

The AFP FP&A Case Study series is designed to help you build up key FP&A capabilities and skills by sharing examples of how leading practitioners have tackled challenges in their work and the lessons learned.

Presented at an AFP Advisory Council meeting, this case study contains elements that are anonymized to maintain privacy and encourage open discussion.

Insight: FP&A can leverage operational risk techniques to improve forecasting, agility and business relations.

Company Size:	Medium
Industry:	Pharmaceuticals
Geography:	Middle East/Africa
FP&A Maturity Model:	Finance & Business Acumen

Finance and business acumen: FP&A translates corporate and business strategy into a financial plan and supports the enactment of that plan through resource allocation. Processes generate input and insight through financial analysis, supported by enabling technology.

Background: General Information About the Company

The presenter of this case study was working as the Head of FP&A for the Middle East cluster in a global pharmaceutical company, handling more than 30 countries. It was 2020, and COVID-19 had turned the world upside down.

“Everything had been impacted,” he said. “How we lived and interacted with each other, how we worked and communicated, how we moved around and traveled. Every aspect of our lives had been affected.”

In the pharmaceutical industry generally and in his company specifically, the business had a lot of questions:

• How do we supply and distribute our goods?
• How do our pharmaceutical reps interact with doctors?
• How do we interact with patients?

What it all boiled down to was operational risk, i.e., failure to achieve your goals due to challenges faced in regard to people, processes, events, systems — anything involved in day-to-day business activities. As a category, this stands in contrast to market, credit or liquidity risks. The challenge of managing operational risk is identifying and quantifying events and outcomes that generally are discussed qualitatively.

Challenge: The Work or Difficulty FP&A Had to Address

The coronavirus pandemic upended the operational systems of companies globally, and risk was suddenly embedded in every routine aspect of the business for this pharmaceutical company, from the supply chain to personnel.

To understand the potential impacts, they first had to understand what the risks were. Finance started asking questions to the business, which led to separating operational risks into two overarching categories: supply chain and logistics risk and commercial risk.

• Supply chain and logistics risk: Securing a commitment from their CMOs and manufacturing sites was challenging due to all the volatility. Inventory levels at the distribution and manufacturing sites were prone to sudden changes, freight forwarder schedules became inconsistent, and customer demand was in flux due to the uncertainty they were experiencing. Should we maintain a high level of stock to avoid any potential risk, or should we minimize stock in order to maintain a healthy cash flow?
• Commercial risk: What new or updated regulations has the government instituted? If our sales representatives can’t meet with customers, and doctors can’t meet with patients, how can our sales force operate? How can we ensure that our in-market sales and consumption are running as they should? Are we able to submit tenders?

Approach: How FP&A Addressed the Challenge

Cataloging the Risks

The Head of FP&A relied on his experience as a finance business partner and used the opportunity to upskill his team. The team developed a standardized checklist for the three main business divisions, targeting the four primary functions in each division that held the greatest potential for financial loss, defined as a negative impact on the company’s cash flow and P&L. Their approach looked like this:

This effort produced a checklist for each business function’s key operational risks:

The data they gathered was then aggregated into a Business Input spreadsheet.

The team assigned finance ownership to each category and its associated risks and the functions, countries, franchises and products that would be affected. They then asked a series of questions:

• Is the risk impacting our budget?
• Is the risk included in the business plan or budget?
• Which quarter will it impact?
• What is the probability that this risk will happen?

“It is very important to quantify the risk,” said the Head of FP&A. “Everyone can say, yes, I have a risk, but how much, which months, which quarter? What is the probability of the risk?”

Next, they set about creating a mitigation plan. The plans were based on data gathered from the checklists, discussions with each function, and analysis of the probability of each risk.

Creating a Process for Risk Management

“Without proper governance, any new process, tool or initiative runs the risk of being disorganized and inconsistent. As finance professionals, it is our job to ensure governance requirements are met,” said the Head of FP&A.

To meet this task, the FP&A team developed a template. It was agreed upon with the stakeholders, supply chain division, manufacturing, commercial and regulatory pricing to input their quantified risk based on the data from the checklist. The team then quantified the risk for the entire year by quarter, function and product. “It was a comprehensive, well-quantified and precise exercise,” he said.

It was also decided that they would have weekly meetings with the general manager and executive team to discuss the risk tracker for each function, as well as any new risks and new mitigation plans.

How It Runs Today

All risks and opportunities with a 70% or greater probability are considered an adjustment item to the forecast. If the probability is below 70%, it’s kept on the tracker, but no action is taken. The net sales, OpEx and EBIT impacts are also considered and included. The end result is estimating the impact on their top and bottom lines.

Where does the accuracy come from? “To be honest, we didn't use advanced tools like predictive analytics or artificial intelligence, but we did leverage our business knowledge and our thorough discussions and cross-functional meetings,” he said.

In the weekly meetings, all new risks and opportunities are addressed, and a report is generated monthly, which is shared with the regional team. This is also when the findings are reported as final. “We meet weekly because, in the Middle East, there are a lot of challenges — oil prices, conflicts between countries — so every week we have to discuss any new items, exchange rates, etc., in order to be up to date with the business and its risks and opportunities,” said the Head of FP&A.

The weekly meetings are run as a cross-functional team, so items may be assigned to any division in the organization. For example, sometimes the mitigation plan is to expand their distributor’s credit limit, allowing them to accept new orders or higher stock so that items would be assigned to finance. Or they might need more promotional activities, so they assign it to the commercial division.

Storytelling is very important to the process — and very important for FP&A professionals to master, said the Head of FP&A. When they present the detailed template to their regional team, they insert the information into a PowerPoint presentation with great visuals, such as waterfall or walking charts. Included in the presentation are the budget, expected landing, key ticket items, risks and opportunities. They sometimes include a simple table that clearly communicates the top risks and opportunities for which a threshold is set, e.g., anything above $500,000.

Outcome: What Came of FP&A’s Efforts and What Was Learned

Working through this process helps the organization and management to have, on a weekly basis, full visibility of what is happening, the associated risks, and a clear mitigation plan. “It is a powerful tool and a powerful process,” said the Head of FP&A. Different scenarios are run based on the risk probability and a mitigation plan is agreed upon, as well as who owns each mitigation plan. “At the same time, we think like a team: how can we mitigate each risk item? All the functions work together to mitigate the risk,” he said.

The company was able to meet its annual budget during the very difficult period of widespread lockdowns. Other departments did not, but FP&A succeeded. After the initiative, the organization recognized the role of FP&A, and the tool is now considered a best practice and has been implemented across other regions.

Discussion: Q&A Among Council Members

What are some other approaches to reviewing risks?

Member 1: We use a common approach called risks and opportunities, where you look at both sides of the coin. On one side, you're trying to forecast events that have some probability of happening, and then there's the other side where there are opportunities, such as a delay in hiring or savings. For each side of the ledger, you have to ask what your action or mitigation plans would be. Have each business unit own its risk and opportunities portion of the portfolio, and hopefully, it balances to a net neutral EPS.

Member 2: Before I joined FP&A, I was in the operational risk division. We had a separate group focused on this topic, which is common in financial services companies. There was an audit team, a risk team and the finance team, and they had three separate and distinct roles and responsibilities. Absent specialized teams, finance picks up the slack for risk management.

Member 3: This kind of operational planning goes hand in hand with scenario planning because you're analyzing the financial impact, especially during the coronavirus pandemic, of different supply chain impacts, et cetera.

Speaker: As the FP&A director, I capture everything as the strategies that we're currently trying to move forward with. That way, it's always a positive conversation focused on the actions we are taking to address whatever problem is going on in our business versus focusing on all the possible things that can go wrong.

What was your secret formula for getting buy-in and creating trust so that you could truly engage the business and be collaborative?

I used two techniques. First, everyone wants to know, what is in it for me? If you tell them this is just a tool needed by finance, people will not think of it as a priority. Instead, if you tell them, this tool is to help you quantify your risks, manage your risks, manage your business and present your findings to management, you will get the buy-in because you are helping them achieve their target or mitigate the risks.

Second, I used a technique called hero and villain. This technique was very successful. The villain is created first; for example, explain that if something negative happens, we will not achieve the budget, and you won’t get your bonus. Then explain that we need a hero; we can use this tool to solve this issue, to solve this problem.

We also tried to make it user-friendly. Sometimes, we needed to sit with them and fill in the template together. Helping them can go a long way, but it’s even better to simply make the template user-friendly. Don't ask them to fill in a lot of information and deal with a very complex template. As much as you can, make it simple.

How do you use scenario planning relative to your risk list?

We don't consider the entire list of risks and opportunities. We take the top five or seven maximum key drivers, and we run that scenario, whether those drivers are having a positive or negative impact on our business.

Some of the risks we identify are generated from operations, so they're at a more tactical level. They apply maybe to that one group but not across the entire company.