In a typical organization, risk management performs three key roles:

• Identify and evaluate the risks faced by the firm
• Communicate these risks to the key stakeholders (Senior management, and board)
• Monitor and manage the firm’s risk as per its objectives.

In order to ensure that the risk is monitored appropriately, the firm will decide on certain risk metrics and will try to keep the risk levels as per these risk metrics. On such risk metric is the Value at Risk (VaR).

In the recent financial crisis, we have heard in many places that it has been a risk management failure in many large financial institutions. What does it actually mean? If an institution suffers large losses, does it mean that there has been a risk management failure in the bank, or is it just a mistake by the bank?

The answer to this question is that a large loss does not necessarily translate into risk management failure.

We all have heard about the fall of LTCM. Let’s take a look at the returns of LTCM and build a hypothetical scenario to understand this phenomenon. Suppose you were the manager at LTCM and had the opportunity to invest in trades. There are 99% chances that the fund will produce 25% ‘returns before fee’ and 1% chance that it will lose 70% of capital. The expected returns from the portfolio is 25%*.99 + -70%*0.01 = 24.05%.

That’s pretty handsome expected returns and no fund manager would want to let go of such a lucrative investment opportunity.

Since these are probabilities, we can say that if these probabilities held true, and if the fund was allowed to operate for 100 years, then in 99 out of 100 years it would have actually produced 25% returns and the fund’s risk managers would have been applauded. But if the remaining 1% actually happened, the fund would have made huge losses (as it happened). So, does it mean that the risk management has failed?

Actually not! In fact, the job done by the risk managers could have been improved upon. As we mentioned earlier, the job of a risk manager is to evaluate the risks and communicate them to the senior managers or board. It is upto the board and senior management to decide whether they are ready for taking that risk or not and whether they have that much risk appetite.  To decide on this risk appetite is one of the most important functions of the management and board. Also whether it is worthwhile for an institution to take large risks also depended on its strategy. Both strategy and risk appetite are decisions of the management and board and the risk managers work further from there.

This article is based on the paper “Risk Management Failures: What are They and When Do They Happen?” by Rene M. Stulz, which is a part of the FRM syllabus.