< PreviousA PROFESSIONAL DEVELOPMENT JOURNAL for the CONSULTING DISCIPLINES 10 JULY | AUGUST 2021 the value examiner Figure 5: Figure 1 with Node C Formatted as a Line Chart Through this simple example, we get a taste of how much information BNs offer to valuators, their clients, and others involved in negotiating, litigating, and deciding firm value. Regime Change and Realism We can make Figure 1 more realistic (and complex), as shown in Figure 6. This model incorporates a constant growth or discounted cumulative cash flow value (DCCF Value, Node F) and related DCF inputs; Regime Change (Node E), with binary states True and False; and an Ensemble Value (Node G) that aggregates and weights the DCCF and Guideline values into a single distribution. The addition of the discrete Regime Change node demonstrates that BNs can simultaneously accommodate both continuous and discrete nodes (e.g., binary or “Boolean,” ranked or “ordinal,” and labeled or “categorical”). BNs that include both node types are called “hybrids.” Continuous nodes are a relatively recent innovation in Bayesian networks. While we call them “continuous,” they must first be “discretized” to permit Bayesian updating (i.e., updating the probability distributions after entry of evidence) through the algorithms that animate the BN. All BN platforms require discretization of continuous variables, though some are better at this task than others. AgenaRisk10, which employs a sophisticated “dynamic discretization” algorithm, was used in writing this article. 12 12 See Fenton and Neil, Risk Assessment and Decision Analysis with Bayesian Networks, 312–318, Appendix D. A C BA PROFESSIONAL DEVELOPMENT JOURNAL for the CONSULTING DISCIPLINES the value examiner JULY | AUGUST 2021 11 Figure 6: Bayesian Network Modeling Ensemble Value Based on DCCF and Market Approaches Node E represents a government action (e.g., COVID-19 restrictions) that reduces EBIT and Annual Cash Flow. In the Node E NPT, we set the prior probabilities to False = 0.90, True = 0.10. The NPTs for Node A and Annual CF (Node D) are “partitioned” for the True/False states of its parent, Node E; if Node E = True, nodes A and D are both modeled to drop by 30 percent. For simplicity, the NPTs for Nodes A and D are modeled identically, as shown in Figure 7. Figure 7: EBIT Node Probability Table Modeled as two truncated normal distributions embedded in a partitioned expression with mean and variance of 5 million and 2 million and bounds of -10 and 20. When Regime Change = “True,” EBIT is multiplied by 0.70. A C B E G F DA PROFESSIONAL DEVELOPMENT JOURNAL for the CONSULTING DISCIPLINES 12 JULY | AUGUST 2021 the value examiner For the posterior scenario, entering “True” as evidence in Node E forces 100 percent of the probability (green bar) into “True.” After rerunning the BN, the posterior results appear in each node as green lines or histograms. As expected, regime change narrows and shifts Nodes C, F, and G leftward, leaving very little visible probability for ensemble values over $30 million. Zooming in on Node G (Figure 8), we see that 90 percent of the posterior probability is located over an interval running from about $10.1 to $26.6 million. Figure 8: Ensemble Value Showing Prior and Posterior Distribution Assuming that Regime Change = True For each node, deeper analysis of prior and posterior central tendency, dispersion, and probabilities of specific value intervals is facilitated by exporting node data in csv, json, or xml format. For example, for Node G, Figure 9 presents partial data. By summing the “Prob” column for the $10–15 million value range (dark highlighted cells), we estimate the posterior probability of a “real” value in this range to be roughly 27 percent. For each node, deeper analysis of prior and posterior central tendency, dispersion, and probabilities of specific value intervals is facilitated by exporting node data in csv, json, or xml format.A PROFESSIONAL DEVELOPMENT JOURNAL for the CONSULTING DISCIPLINES the value examiner JULY | AUGUST 2021 13 Figure 9: Partial Posterior Data for Node G Node NameEnsemble ValueSummary Statistics Node IdEnsemble_valMean17.70386 Median17.32962 Intervals and probabilitiesVariance25.71182 Lower BoundUpper BoundProbStandard Deviation5.070683 -15.70852696-102.16E-07Lower Percentile [25.0]14.11628 -10-1.4077434616.84E-06Upper Percentile [75.0]20.88138 -1.407743461-11.53E-06 -106.58E-06 011.50E-05 8.8759.43750.010171 9.4375100.013113 1010.122765190.003256 10.1227651910.742806850.018994 10.7428068511.362848520.02323 11.3628485211.982890180.027883 11.9828901812.602931840.032253 12.6029318413.22297350.036627 13.222973513.843015170.040565 13.8430151714.463056830.04376 14.4630568315.083098490.046627 15.0830984916.323181810.098163 16.3231818117.563265140.09948 17.5632651418.18330680.048249 18.183306818.803348460.046554 18.8033484619.423390130.044073 19.4233901320.043431790.041437 20.0434317920.518419350.029687 42.6365850244.714291155.07E-05 44.7142911553.474524964.17E-05 53.4745249661.78534959.10E-07 While greater realism can add value to the discussion, a bit of modeling humility is in order. Simple or “parsimonious” models are often better than more complex, lifelike ones. We want a model that efficiently approximates reality. As Aswath Damodaran observes, “Your understanding of a valuation model is inversely proportional to the number of inputs required for the model.” 13 Here, what holds for the valuator holds doubly for the “law-trained” judge. Parsimony is a virtue. Happily, BNs are somewhat self-parsimonious. First, in a BN, complexity is locally constrained: it resides within each child’s conditional NPT. Second, the more parents a child node has, the greater the complexity and the computational resources required to recalculate the node’s probability distribution after entry of evidence. Thus, child nodes with more than three or four parents should generally be avoided, because such relationships can produce gargantuan NPTs through “combinatorial explosion.” For this reason, only two nodes in Figure 6—Cost of Equity and DCCF Value—have more than two parents. At this point, some readers may think, “But Figure 6 still looks pretty complex! How could I ever explain it to a law-trained judge?” One answer is that in BNs, all probabilities are local. Each NPT and probability distribution in the BN expresses only the relationship between one child and its parents. In using Figure 6 to negotiate, arbitrate, or litigate, the valuator would explain the nodes one by one, methodically building the narrative toward the target. Figure 6’s complexity can also be reduced by replacing nodes with constants, “divorcing” parent nodes through “binary factorization,” 14 or decomposing the BN into a collection of smaller, object-oriented BNs (OOBNs). 15 For example, the PV Factor node in Figure 6 relies on an unseen constant (5) representing the DCCF model’s five-year investment horizon. Similarly, Figure 6 could be broken into three OOBN modules: DCCF, Guideline, and Ensemble. Diagnostic Reasoning So far, we have limited ourselves to reasoning predictively, from cause to effect. Yet, in some contexts, it may be helpful to think in the opposite, diagnostic direction: from effect/child to cause/parent. While mortal minds have a difficult time thinking in this “backward” direction without technological assistance, BNs perform such analytical gymnastics without fuss. We simply set evidence in a child node and let the BN run back through the network to the parents. Example: In Figure 10, we ask, “Given an Ensemble Value of $20 million, what is the distribution of probabilities over plausible discount rates?” Answer: Setting the evidence in Node G at 20 shifts the Node H median slightly to the right of 0.19. 13 Aswath Damodaran, An Introduction to Valuation, slide 3 (Spring 2020), http://people.stern.nyu.edu/adamodar/pdfiles/eqnotes/Valintrospr20.pdf. 14 See Fenton and Neil, Risk Assessment and Decision Analysis with Bayesian Networks, 216–218. 15 Ibid., 233–239.A PROFESSIONAL DEVELOPMENT JOURNAL for the CONSULTING DISCIPLINES 14 JULY | AUGUST 2021 the value examiner Figure 10: Posterior Distribution of Discount Rate, Given Ensemble Value = $20 million G H Sensitivity Analysis Sensitivity analysis helps in model validation or interrogation and in understanding the impact of explanatory nodes on the target node. For example, the tornado graph in Figure 11 visualizes the sensitivity of Ensemble Value to three key input nodes: Discount Rate, Firm Beta, and Regime Change. The longest (top) bar signals that among these three nodes, Ensemble Value is most sensitive to Discount Rate. More specifically, as we move the Discount Rate “needle” from a high of 0.31 to a low of 0.09, the median Ensemble Value grows from about $18 million to nearly $27 million, a delta of approximately $9 million. By contrast, changes in Firm Beta and Regime Change can move the needle only by approximately $6 million and $5 million, respectively. Notably, as modeled, Regime Change is bad news only. A Regime Change value of “true” can drive value down further than the other two nodes, but a value of “false” offers next to no upside.A PROFESSIONAL DEVELOPMENT JOURNAL for the CONSULTING DISCIPLINES the value examiner JULY | AUGUST 2021 15 Figure 11: Sensitivity Analysis Tornado graph for Median (Ensemble Value) Cu11ent v.aluei ti.ihdian (Ennmble V.tlul!) = 22.103 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 Discount Rate = (O.J13g7191494041020 • Discount Rate = [0.09W2178582603847 • 0 .3244324828887137] 0 .10238246387 434187] Firm Beta = [1.62381.qQ682454623 • Firm Beta = [0.62.q8683298050514- 1.6862481331479879] 0 .687302484707577 ] P(Regime Change = True) P(Regime Chang,= False) Longer bars indicate greater sensitivity of the target node (Ensemble Value) to changes in Discount Rate, Firm Beta, and Regime Change This information can be cross-checked against the valuator’s theoretical understanding of the relationships among the nodes. It can also be used in a negotiation or litigation setting to interrogate or cross-examine model inputs assumed or demanded by a counterparty. Example: Why doesn’t your model consider positive Regime Change? Why so pessimistic?” Or this: “Look how sensitive your valuation is to the Discount Rate! Let’s take a closer look at its input nodes.” This second question might call for sensitivity analysis of Discount Rate, as shown in Figure 12. Figure 12: Sensitivity Analysis of Discount Rate Indicating high sensitivity to Firm Beta and Cost of Equity but nil sensitivity to Cost of Debt Figure 12 tells us that Cost of Debt has no impact on Discount Rate, while Firm Beta and Cost of Equity definitely do. Is this consistent with the firm’s capital structure and financing costs? Cost of Equity= (0.105:539085197796 • 0.116403880757687"8] Firm Beta = [0.6248683298050514- 0.6873024'14707577) Cost of Debt= [0.019200000000000002 -0.0195] 0.05 Tornado graph for Median (Discount Rate) Cune,nt value Median (Discount Rate)= 0.191 0.10 0.15 0.20 0.25 0.30 _.,, _______ _ 0.35 Cost of Equity= (0.34Q6QQ79195551715 • 0.36056468751540865) Fi,m Beta = (1.6238149682454623 - 1.68624'1133147Q87Q) Cost of Debt= [0.02:55 -0.0258) A PROFESSIONAL DEVELOPMENT JOURNAL for the CONSULTING DISCIPLINES 16 JULY | AUGUST 2021 the value examiner Persuading the court BNs are undeniably new to the valuation world. Courts tend to underappreciate innovation. Innovators bear the burden of persuading the bench to pour new wine into new bottles. A roadmap for introducing innovation into valuation litigation was offered by the Delaware Court of Chancery in 2010, in Global GT LP v. Golden Telecom, Inc. 16 A central issue in Global was which beta model to use in es- timating Golden’s cost of capital. Golden’s expert, Sherman, advocated a traditional, two-factor, regression-based model published by Bloomberg. Global’s expert, Gompers, charac- terized the Bloomberg model as backward-looking and out- dated, arguing for a newer, 13-factor, “predictive” MSCI Barra model, which he claimed was “academically and professionally sound.” 17 The beta estimates produced by the Bloomberg and Barra models were, respectively, 1.32 and 1.20. The court rejected the Barra model, stating the following reasons: (a) the Barra model was proprietary, with 13 undisclosed and undiscoverable factors, whereas the Bloomberg regression model was publicly available; (b) Gompers did not understand the Barra model well enough to produce for the court a Barra beta for Golden or any other company; (c) at the time, no “neutral academic support” (i.e., published study) for the Barra beta existed; and (d) in a previous case before the same court, Gompers had used a Bloomberg-like beta model and could not explain why his opinion had since then shifted in favor of Barra. 18 The court wrote: If the Barra beta is to be used in appraisal proceedings, a more detailed and objective record of how the Barra beta works and why it is superior to other betas must first be presented. To this point, it is more persuasive to a judge to know that a testimonial expert who is an academic has written about the reliability of a valuation methodology in an academic study in a peer-reviewed journal than to be among those first privileged in the world to hear from the academic about that issue in his expert reports and seat-of-the- pants testimony in a valuation assignment for a self-interested litigation client. 19 Unlike the Barra model in 2010, BNs should measure up well against Global’s valuation litigation innovation test. BNs are available in nonproprietary avatars, 20 though licensed software platforms like AgenaRisk, BayesiaLab, Bayes Server, Netica, or BNet.Builder are more user-friendly. The basic math of BNs is open-source and very well known. For example, the AgenaRisk algorithms are discussed in detail in a widely available, user-friendly text. 21 BNs have been tested extensively in academic and industry settings, as reflected in a large and rapidly growing body of published research. 22 This article contributes toward this already “detailed and objective record,” demonstrating how BNs work and how they can deliver reliable, high-quality results in business valuation settings. For professionals familiar with legal reasoning, Bayesian reasoning—which begins with prior beliefs and layers on evidence to reach posterior beliefs—should be especially 16 Global GT LP v. Golden Telecom, Inc., 993 A.2d 497 (Del. Ch. 2010). 17 Ibid., 518. 18 Ibid., 520–521. 19 Ibid., 521. 20 See, e.g., Marco Scutari and Jean-Baptiste Denis, Bayesian Networks with Examples in R, 2nd ed. (Boca Raton, FL: CRC Press, 2021), https:// www.bnlearn.com/book-crc-2ed/ (illustrating Bayesian network learning and inference using the open-source R package bnlearn). 21 See, e.g., Fenton and Neil, Risk Assessment and Decision Analysis with Bayesian Networks, 581–627 (walking through the algebra of node probability tables, junction tree algorithms, and dynamic discretization). 22 See, e.g., Bayesian Network Literature, https://library.bayesia.com/ articles/#!bayesialab-knowledge-hub/bibliography (summarizing and providing links to numerous recent journal articles featuring the use of BNs in many fields, including economics and law). Courts tend to underappreciate innovation. Innovators bear the burden of persuading the bench to pour new wine into new bottles.A PROFESSIONAL DEVELOPMENT JOURNAL for the CONSULTING DISCIPLINES the value examiner JULY | AUGUST 2021 17 familiar territory. Defenders of traditional approaches sometimes call out Bayesian priors as unscientifically “subjective” or “speculative.” Yet, every business valuation involves multiple subjective judgment calls, and all rely on prior beliefs. The divisive subject of discounts for lack of marketability (DLOMs) offers an illustration. One commercial database touts “over 3,000 transactions from 2001 to 2010, more than any other commercially available DLOM database,” adding that “the data is updated quarterly, so you always have the most current and accurate data to select from in developing your discount.” First, the decision to apply a DLOM at all is subjective, as are the selection of relevant DLOM transactions and any resulting DLOM prior. This DLOM data could be further processed into a linear regression model requiring the subjective choice of a statistical significance threshold or “alpha.” Similar subjectivity permeates valuation engagements. BNs shine a bright light on all such subjective judgments. They put every assumption, no matter how subjective or data-driven, on transparent display, providing easy access for further conversation. With a reasonable investment in software and training, professional valuators, attorneys, and courts can learn to use BNs. The author’s experience teaching BN valuation to graduate and undergraduate forensic accounting students over the past five years suggests that BNs are more intuitive and, therefore, less difficult to learn than traditional statistics. While learning BNs is not easy, it can be entertaining, and there is no shortage of high-quality resources. A sampling of BN learning and training resources appears on page 18. Conclusion Valuation is a probabilistic endeavor involving extensive reliance on subjective professional judgment. In dealing with uncertainty, subjectivity, and parameter estimation, 23 BNs are computationally superior and more transparent than the alternatives. In many settings, they communicate more clearly than spreadsheet-based valuation platforms. BNs deliver more of the information most needed in determining value in a more user-friendly way than competing technologies. To paraphrase John Tukey, in trained hands, BNs can deliver remarkably solid, though approximate, answers to the right vague and probabilistic valuation questions. They deserve a closer look. VE Kurt Schulzke, JD, CPA, CFE, teaches forensic accounting and audit analytics at University of North Georgia. He has published on materiality, expert witnessing, revenue recognition, and Benford’s Law in the Columbia Journal of Transnational Law, Vanderbilt Journal of Transnational Law, Tennessee Journal of Business Law, Journal of Forensic Accounting Research, the Columbia Law Blue Sky Blog, and The Value Examiner. With an MS in applied statistics, he is equally adept as counsel, expert witness, or neutral in valuation-related matters. Email: kurt.schulzke@ung.edu. 23 For estimating parameters from data (e.g., estimating the “central tendency” of an industry multiple based on a sample), BNs outperform and out-inform point-estimate statistics like means, medians, geometric means, and harmonic means. Parameter estimation is beyond our scope but is explored in detail in Fenton and Neil, Risk Assessment and Decision Analysis with Bayesian Networks, 322–333. The author’s experience teaching BN valuation to graduate and undergraduate forensic accounting students over the past five years suggests that BNs are more intuitive and, therefore, less difficult to learn than traditional statistics. A PROFESSIONAL DEVELOPMENT JOURNAL for the CONSULTING DISCIPLINES 18 JULY | AUGUST 2021 the value examiner Bayesian Network Learning Resources Books Norman Fenton and Martin Neil, Risk Assessment and Decision Analysis with Bayesian Networks, 2nd ed. (Boca Ra- ton, FL: CRC Press, 2018). Bayesian Networks and BayesiaLab — A Practical Introduction for Researchers (Changé, France: BayesiaLab, 2015), https://library.bayesia.com/articles/#!bayesialab-knowledge-hub/book (free, online). Marco Scutari and Jean-Baptiste Denis, Bayesian Networks with Examples in R, 2nd ed. (Boca Raton, FL: CRC Press, 2021), https://www.bnlearn.com/book-crc-2ed/. Judea Pearl and Dana Mackenzie, The Book of Why: The New Science of Cause and Effect (New York: Hachette Book Group, 2018). Training BayesiaLab Academy, https://library.bayesia.com/articles/#!bayesialab-knowledge-hub/training-academy (the author has completed and highly recommends the introductory and advanced courses). Bayesian Intelligence, https://www.bayesian-intelligence.com/training/. BayesFusion, https://www.bayesfusion.com/training/. LinkedIn groups Bayesian Belief Networks with BayesiaLab, https://www.linkedin.com/groups/3690985/. Bayesian Network Modelling and AgenaRisk, https://www.linkedin.com/groups/7473890/. Blogs Probability and Risk, https://probabilityandlaw.blogspot.com/. Machine Learning Mastery, https://machinelearningmastery.com/introduction-to-bayesian-belief-networks/. A PROFESSIONAL DEVELOPMENT JOURNAL for the CONSULTING DISCIPLINES the value examiner JULY | AUGUST 2021 19 VALUATION /////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// GDPR and the Increasing Cost of Cybersecurity By Dorothy Haraminac, MBA, CFE, MAFF, PI V irtually every organization today is affected by cybersecurity risks, and these risks are growing rapidly. It is critical, therefore, for business valuators to scrutinize cybersecurity as part of their risk assessments of subject companies. This article reviews an important component of cybersecurity risk: the increasing risk of fines under the EU’s General Data Protection Regulation (GDPR) and similar laws and regulations. The impact of the GDPR should not be underestimated. Its reach extends far beyond the confines of the EU, and fines may be levied for policy and processing failures, regardless of whether an organization has experienced a data breach. In future articles, I will take a deeper dive into the cybersecurity assessment process and provide a list of questions and other tools valuation practitioners can use to address cybersecurity risk from a nontechnical perspective. Background Five years ago, the EU shocked the tech world with its introduction of the GDPR, touted as the world’s toughest data privacy and security law. 1 The EU gave companies about two years to get their data affairs in order and many failed. New roles cropped up to help organizations understand their obligations under GDPR, including data protection attorney, data protection specialist, and data compliance consultant. As its name implies, GDPR is broad in scope. It applies not only to businesses that are located in the EU or conduct business there, but also to any organization that advertises 1 The GDPR was issued on April 27, 2016, and took effect on May 25, 2018. to residents (not citizens) of the EU. If an organization uses social media advertising and has not limited the geographic location of its ads, GDPR may apply. If an organization provides services to a GDPR-regulated firm, those regulations may also apply to it as a third-party service provider. In the U.S., 47 states have passed regulations that are similar to GDPR. Concerned organizations are examining other laws—such as those regulating deceptive trade practices or general business activities— to determine whether they apply to data protection. In addition, business contracts often incorporate some form of data security obligations. Prior to 2018, speculation abounded about the types of violations that would be targeted by the EU, and by mid- 2019, the world had some answers. Overall, GDPR fines were levied for breaches in access and breaches in processing agreements. Figure 1 shows the categories of fines levied under GDPR prior to July 2019. If an organization uses social media advertising and has not limited the geographic location of its ads, GDPR may apply.Next >