In a typical organization, risk management performs three key roles:
<ul>
	<li>Identify and evaluate the risks faced by the firm</li>
	<li>Communicate these risks to the key stakeholders (Senior management, and board)</li>
	<li>Monitor and manage the firm’s risk as per its objectives.</li>
</ul>
In order to ensure that the risk is monitored appropriately, the firm will decide on certain risk metrics and will try to keep the risk levels as per these risk metrics. On such risk metric is the <a title="Value at Risk (VaR)" href="https://financetrain.com/value-at-risk-var/">Value at Risk (VaR)</a>.

In the recent financial crisis, we have heard in many places that it has been a risk management failure in many large financial institutions. What does it actually mean? If an institution suffers large losses, does it mean that there has been a risk management failure in the bank, or is it just a mistake by the bank?

The answer to this question is that a large loss does not necessarily translate into risk management failure.

We all have heard about the fall of <a title="Case Study: Collapse of Long-Term Capital Management" href="https://financetrain.com/case-study-collapse-of-long-term-capital-management/">LTCM</a>. Let’s take a look at the returns of LTCM and build a hypothetical scenario to understand this phenomenon. Suppose you were the manager at LTCM and had the opportunity to invest in trades. There are 99% chances that the fund will produce 25% ‘returns before fee’ and 1% chance that it will lose 70% of capital. The expected returns from the portfolio is 25%*.99 + -70%*0.01 = 24.05%.

That’s pretty handsome expected returns and no fund manager would want to let go of such a lucrative investment opportunity.

Since these are probabilities, we can say that if these probabilities held true, and if the fund was allowed to operate for 100 years, then in 99 out of 100 years it would have actually produced 25% returns and the fund’s risk managers would have been applauded. But if the remaining 1% actually happened, the fund would have made huge losses (as it happened). So, does it mean that the risk management has failed?

Actually not! In fact, the job done by the risk managers could have been improved upon. As we mentioned earlier, the job of a risk manager is to evaluate the risks and communicate them to the senior managers or board. It is upto the board and senior management to decide whether they are ready for taking that risk or not and whether they have that much risk appetite.  To decide on this risk appetite is one of the most important functions of the management and board. Also whether it is worthwhile for an institution to take large risks also depended on its strategy. Both strategy and risk appetite are decisions of the management and board and the risk managers work further from there.

This article is based on the paper “Risk Management Failures: What are They and When Do They Happen?” by Rene M. Stulz, which is a part of the FRM syllabus.

Risk Management Failures

As we discussed in the <a title="Risk Management Failures" href="https://financetrain.com/what-are-risk-management-failures/">previous article</a>, risk management performs three they roles, and the failure can happen in performing any of these roles.

Identify and evaluate the risks

The first step is to identify and measure risk. Typically, risk management will choose certain risk metric to measure and benchmark risk. The choice of risk metric is critical and choosing a wrong metric that doesn’t suit the firm’s strategy can lead to risk management failure.

One metric commonly used by the financial institutions is <a title="Value at Risk (VaR)" href="https://financetrain.com/value-at-risk-var/">Value at Risk</a>. Even if the institution calculates the VaR correctly, it does not mean that the measure is suitable for everyone and it answers the right questions for the management. Specifically in case of VaR, it tells us the minimum worst loss that a firm will face in a given time horizon and at a given confidence interval. This by itself is good information. However, the management may actually be interested in knowing the worst expected loss, which is not what VaR tells.

After the correct risk metric has been selected, there are two key mistakes:
<ol>
	<li>The risk managers mismeasure the known risks</li>
	<li>The risk managers ignore some very important risks</li>
</ol>
Communicate Risks to Management

Once the risks have been identified, they need to be communicated to the management. Again the risk management may fail to communicate risk to the senior management and board. Since the senior management and board decides what risks to take and what to avoid, this communication failure can be disastrous.

Monitor and Manage Risks

Finally it’s the duty of risk managers to monitor and manage the risks as per the firm’s objectives. This involves hedging risks, setting limits on trades, etc. This also is a point of failure as the risk manager may fail to perform its duties.

How can Risk Management Fail?

One of the reasons for the failure of risk management is that even though the correct risk metric has been identified, the risk managers mismeasure the risks known to them.

This mismeasurement can happen in many ways. The two broad areas that provide scope for mismeasurement are the use of distribution and the use of historical data.
<h2>Distribution</h2>
With respect to the distribution of returns/losses, a couple of things can go wrong.

Distribution specification are wrong. Let’s take an example. Suppose a manager has chosen binomial distribution to measure risk. Even if he is right in choosing this distribution, he might get the probabilities wrong, for example, he might assess a lower probability of loss.  Alternatively he might assess the extent of loss incorrectly.

Correlations are mismeasured.  The risk management may incorrectly measure the correlations between different positions. So, even if the distribution estimates for specific positions are accurate, the overall distribution will be misspecified.

Wrong distribution is used. The risk management may use a distributionwhich is not suited for their requirement. In our LTCM example, we had assumed that there is a 99% chance of 25% returns and 1% chance of 70% capital loss. In reality it might have been so that there was 1% chance of 70% loss and 9% chance of a 100% loss of capital. This would change the expectations.
<h2>Use of Data</h2>
Another area that could lead to mismeasurement of known risks is the use of data, especially the historical data. For example, in case of subprime crisis, there was no historical data that could be used to generate the distribution of losses. In the absence of historical data or a good sample, the risk measure will statistical measures which makes it quite subjective.

This article is based on the paper “Risk Management Failures: What are They and When Do They Happen?” by Rene M. Slutz, which is a part of the FRM syllabus.

How Known Risks can be Mismeasured?

One more reason for the failure of risk management is that some of the important risks get ignored. This can take two different forms.

Known risks are ignored: In this case the risk manager ignores a known risk. This could be because the manager thinks that it’s not a material (important) risk. It could also be because the risk could not be incorporated in the risk model.

If a firm has a truly enterprise-wide risk management systems, then it will be able to capture all the risks. However, that is often not the case. For example, the firm may have centralized risk management systems, but many risks are managed independently and then integrated into the centralized system. Sometimes due to costs or other reasons, some risks may not get fully reported which might turn bigger with the passage of time.

In most organizations, due to regulations and convention, risk is typically separated into market risk, credit risk, and operational risk. This categorization is quite fictional and there are actually a lot of dependencies among these risks. Due to this reason, all the risks caused by a particular action may not get caputured. For example, a financial instrument may not just increase a firm’s market risk, but may also contribute to its credit risk which might get ignored. Similarly, Basel II has a very narrow definition of operational risk. However, normal business, not covered by Basel II’s definition of operational risk may actually be very important.

Risk was Unknown: This is the case where the risk was totally unknown to the risk manager. The unknown risks do not cause too much threat to the risk management decisions. As long as the manager understands his distribution, he does not have to worry about the specific risk causing the losses. For example, if as per his distribution assumptions, there is a 1% chance of a loss of more than 50%, then if an actual loss occurs because of a specific risk, the manager’s lack of knowledge of this unknown risk is irrelevant.

This article is based on the paper “Risk Management Failures: What are They and When Do They Happen?” by Rene M. Slutz, which is a part of the FRM syllabus.

Failure to Account for Known and Unknown Risks

Even though it’s the risk managers who run the risk management department and identify, measure and manage risk, they don’t do it for their own benefit. The risk management department is also not a profit center. The risk managers are just doing their job to maximize shareholder value at the direction of the senior management and the board.

The job of a risk manager is to evaluate the risks and communicate them to the senior managers or board. The board and senior management based on the firm’s objectives and the business strategy will decide what to do with these risks. The important question is what risk the investors are paying the firm to take. For example, should an airlines company take the oil price risk or not is the decision to be made by the senior management, not the risk manager.

The critical role performed by the risk manager at this stage is to effectively communicate the risk to the management. Even if the firm has the best risk management systems and policies in place, if the risk managers don’t communicate these risks effectively, then there could be more harm than good. This means that the top management should clearly understand the output and consequences to these risks.

The failure to communicate risks effectively was a prime reason behind the recent financial crisis.
<blockquote>“…a number of attempts were made to present subprime or housing related exposures. The reports did not, however, communicate an effective message for a number of reasons, in particular because the reports were overly complex, presented outdated data or were not made available to the right audience.”

- UBS report for its shareholders discussing the causes of its subprime-related write-downs</blockquote>
This article is based on the paper “Risk Management Failures: What are They and When Do They Happen?” by Rene M. Slutz, which is a part of the FRM syllabus.

Role of Effective Communication in Risk Management

Based on its communication with the top management and in line with their business objectives, the firms will decide to assume certain risks while mitigate, transfer or ignore the other risks. It’s the job of the risk management to ensure that this happens.

To do so, risk managers are required to constantly monitor the risk activity of the firm, and take necessary actions where required.

Financial firms have exposure to many derivative positions and instruments with embedded derivatives. Some of these products are extremely sensitive to changes in market conditions. Therefore, even if the firm doesn’t make any new trades or changes in its positions, the risk profiles of these existing positions can change drastically. For example, a position with a positive exposure could turn negative very quickly and that too with a very small change in a market variable such as interest rates.

This makes the job of monitoring and hedging these risks on a continuous basis very difficult. The risk managers may fail to do their job efficiently just because how quickly the risk profiles change and how very small changes in markets drive these changes.

The risk manager may have to identify possible scenarios and build solutions that could be implemented to reduce risks quickly. They may also be required to have contingency hedging plans in place.

Apart from this, we also have the problem of hidden risks. Especially in large organizations, it is possible for traders to take risks that can remain hidden for a long time. This could happen if the positions are created in such a way that the risks are not detected by the risk management systems.

A firm could design and organize its risk management function in such a way that it recognizes and identifies all risks, but that could become extremely expensive, and may also hurt the innovativeness and flexibility of the firm.

This article is based on the paper “Risk Management Failures: What are They and When Do They Happen?” by Rene M. Slutz, which is a part of the FRM syllabus.

Failure to Monitor and Manage Risk

We have seen the importance of risk models and risk management in general for the successful functioning of an organization. However, the risk models that are in place today have certain shortcomings.

Most models work with a one-year time horizon. However, a one-year time horizon may not be sufficient in all situations, and the model may not be designed to scale for a longer horizon. The extended time horizons become more valuable in the times of crisis. For example, in the times of crisis the markets may become very illiquid, and a position that was expected to be held for just a day or two may have to be held for months now. Second, the firms using daily VAR may have to accompany it with other measures for longer period because during crisis, the everyday losses may exceed daily VaR continuously.

Another problem is that the existing statistical risk models assume risks to be related just to the firm (Exogenous). They ignore risk concentrations across the financial institutions. For example, if a financial firm has exposure to sub-prime sector, the model will ignore that many other financial institutions also have exposure to the same sector which multiplies the risk.

The risk models may not also account for possibility of situations such as predatory trading. In such a situation the trades made by other traders affect your positions and compound your losses.

Since these risk models use historical data, it’s difficult for them to incorporate such complex situations. The risk management can think of complementing these risk models with other tools such as scenario analysis to deal with the crisis situations.

What other shortcomings do you think the existing risk models have?

This article is based on the paper “Risk Management Failures: What are They and When Do They Happen?” by Rene M. Slutz, which is a part of the FRM syllabus.

Shortcomings of Risk Models

Risk Management Failure

This frontmatter description will appear below the title

Risk Management Failure

Lessons

Take the Next Step in Your Data Career