Question:
Why did Risk Management fail in US financial institutions?
Answer:
It was not a risk management failure, but a general management failure, because:
-
Management had failed to invest in adequate risk management resources and/or systems, or
-
Management had failed to listen to risk management professionals, or
-
Management had failed to understand what was being communicated
Notably, risk management did not completely fail in all financial institutions because some companies had a reasonable risk management culture and framework.
Management Issues
The problem was not caused by mid-tier traders, but by management ignoring fundamental issues like understanding and pricing risk. If they did understand the risks, then they could be accused of passing on those risks to unsuspecting investors via securitization of poor quality loans.
There is evidence that management had failed to heed warnings from risk management professionals, and therefore took on unacceptable levels of risk.
Operational Risk Issues
It also appears that financial institutions do not have adequate processes and systems for managing operational risk.
Financial risk management including market risk and credit risk can be automated to a large degree using quantitative data. On the other hand the management of operational risks such as failures of processes or systems, or workplace risk is very difficult to automate because it needs qualitative information.
The risk management systems used for market risk and credit risk cannot be simply applied to an operational risk context.
The Risk of Quantitative Risk
Quantitative risk management uses historical records to try to get better visibility of what may lie ahead. This is fine for relatively stable times, but misleading for tumultuous times.
Neither can quantitative risk analysis detect systemic breakdown of conditions external to one financial institution because they don’t have the necessary external data.
In a Risk and Insurance Management Society (RIMS) Executive Report, RIMS contends:
“There was an over-reliance on the use of financial models, with the mistaken assumption that the “risk quantification” (used as predictions) based solely on financial modeling were both reliable and sufficient tools to justify decisions to take risk in the pursuit of profit.”
The Compliance Risk
Incom has detected that many organizations focus on compliance, rather than an ‘all risks’ approach.
The abovementioned RIMS Executive Report contends:
“There was an over-reliance on compliance and controls to protect assets, with the mistaken assumption that historic controls and monitoring a few key metrics are enough to change human behavior”
“Simply instituting monitored compliance programs doesn’t address emerging risks, nor do such programs take into account an organization’s unique circumstances, nor the impact that risk considerations have on the key strategic and operational decisions it faces”
Cultural Issues
The abovementioned RIMS Executive Report contends:
“that the financial crisis resulted from a system-wide failure to embrace appropriate enterprise risk management behaviors—or attributes—within these distressed organizations.”
“there was an apparent failure to develop and reward internal risk management competencies. From the board room to the trading floor, individuals on the front line who were taking—and trading in—these risks ostensibly were rewarded for short-term profit alone.”
“there was a failure to use enterprise risk management to inform management’s decision making for both risk-taking and risk-avoiding decisions.”
Incom, a supplier of risk management information systems (RMIS), understands that a ‘risk management culture’ is more important than having a risk management database system, but how do you change culture if it is not easy for people to identify, assess and manage risks?
Where to from Here
If Risk Management is dealing with uncertainty, and uncertainty is now higher than since the end of World War II, why would you not ramp up risk management right now?
Uncertain times require more risk management.