Understanding Risk Management failures

Rene Stulz has written a paper explaining what risk management and its failures are. 

He says the job of the risk management is to identify the risks and try and quantify it. If risks do materialise for the worse, it is the problem of senior management which took the risks. The blame lies on the management.

Deciding whether to take a known risk is not a decision for risk managers. The decision depends on the risk appetite of an institution. However, defining the risk appetite is a decision for the board and top management. That decision is at the heart of the firm’s strategy and of how it creates value for its shareholders. A decision to take a known risk may turn out poorly even though, at the time it was made, the expectation was that taking the risk increased shareholder wealth and hence was in the best interest of the shareholders.

….Whether taking large risks is worthwhile for an institution ultimately depends on the firm’s strategy. Risk managers do not set strategy. Suppose that a firm sets its risk appetite by choosing a target credit rating. Such an approach is well-established. Once the credit rating is chosen, there are multiple combinations of risk and capital that achieve the target rating. For a given choice of leverage, the firm does not have much choice in choosing its risk level if it wants to achieve its target rating. However, faced with good opportunities, the firm could choose to have less leverage so that it can bear more risk or it could choose to depart from its credit rating target.

In summary, risk management does not prevent losses. With good risk management, large losses can occur when those making the risk-taking decisions conclude that taking large, well understood risks creates value for their organization.

This is all well understood. However, the problem is with implementation. The risks are taken and no one really knows about them. After the risk turns bad, the stakeholders suddenly realise that all is over. What is needed is if a particular risk is taken, the risk management of the organisation should highlight and quantify the risks of the project.

What we instead get is all +ves about the project as put by top management with risk management being in the sidelines. What is needed is to treat risk management like an independent department in the organisation whose views should be shared with all stakeholders.

All this is difficult for a private organisation but should be implemented for a publicly listed firm.

Risk Management needs serious changes for financial sector for two reasons.  One, as Bank of England member said in his paper that people took risks knowing they would be bailed out. Two, large number of players in the sector are unregulated, unmonitored but can cause huge damage to the entire financial system by taking excessive risks. Just like Stulz says in his paper, LTCM knew the risks it is taking. As risks turned worse, it posed concern to the entire financial system.  

Stulz also highlights what risk management failures are:

1) Mismeasurement of known risks.
2) Failure to take risks into account.
3) Failure in communicating the risks to top
4) Failure in monitoring risks.
5) Failure in managing risks.
6) Failure to use appropriate risk metrics.

Interesting reading on risk management.