Blog

Risk Models Only as Good as a Managers’  Business Acumen

Risk Models and Scenarios can be wonderful things.  They help provide comfort to a board, a set of non technical managers, and stakeholders who do not understand or have time to delve into the detail of the risks that the organization takes.  The challenge with these models is that they can reflect, be manipulated or massage the state that a portfolio, business unit or organization is in.   These scenarios also show information at a point in time.

Let’s take the concept of Value at Risk (VaR).  In and of itself, VaR is a worthwhile tool.  Developed by JP Morgan over a period of almost ten years, VaR is a set of mathematical and statistical models that allow the representation of risk in monetary value, usually with a 99% level of confidence.  By primarily using a normal distribution curve (Gaussian) i.e. a bell curve, VaR predicts that as numbers get to the middle of the bell curve, the smaller the change is and the more frequently the same result will occur.  In layman’s terms, the chances are greater that the change in a value will be less than 1% in a day versus, say 50% in a day. So, if a business has a $10m daily VaR, one can safely assume that the chances of losing more than $10m in a day, is 1% or less. 

VaR is also well accepted as it can measure a variety of assets and it can be easily aggregated, thus being useful in complex organizations.  In fact, VaR has been so successfully adopted (partly because JP Morgan gave it away for free) that market regulators adopted it as it made their job easier by allowing organizations that use it to effectively become self regulating (e.g. Basel, SEC, and others). 

Sounds great, however, there are also some challenges, such as:

• If an organization’s VaR is low, it could set aside less money (capital adequacy) to cover the losses under the regulator’s rules. 
• The 99% confidence level is done under normal conditions.  Exceptional situations like a run on a bank sudden financial meltdown or a major terrorist attack break the model.
• VaR is generally a short term measure i.e. days and weeks.

One example of the use of the VaR model with successful and unsuccessful results that has been reported in financial circles, was the ability of Goldman Sachs, possibly the most admired investment bank of our time, to navigate the financial mess that affected the banking, financial services and insurance markets in the past two years.

Goldman Sachs managers are trained to look at a whole set of information, rather than focus on one metric. The income statement for each business unit is looked at daily and weekly and managers are incentivized accordingly (source: New York Times).  The story goes that by early 2008, Goldman Sachs had realized that it had lost money in its mortgage based securities business for almost two weeks (i.e. the income statement). The managers then investigated further, looked at VaR numbers and trends (amongst many other metrics it measured), noticed that the VaR had substantially increased, and ultimately decided to either exit the mortgage securities business or hedge its positions.  VaR in itself was not the answer, but it was one of a number of factors considered when making a judgment.

However, in many other cases, VaR was blamed as the root of all missteps and errors, and that it caused the collapse of some prestigious institutions.  Some would say VaR is flawed, that it does not measure liquidity risk, or long term risk.  Some would say regulators were happy due to the VaR numbers seen in isolation, or CEO’s that pushed and took more risks, based on VaR and other metrics and disregarding emerging, worrying, financial trends.

Yet, and here is where the rubber hits the road, as it turned out Goldman Sachs leveraged its management knowledge to stay clear of the resulting meltdown.  Its managers ARE risk managers.  Where VaR failed many organizations, it actually contributed to Goldman Sachs’ success.  Ultimately, with the right tools, information and the maturity of management one firm succeeded where most failed. 

It is unfortunate that in so many firms we see today, risk managers are viewed as a necessary overhead, a person who has no clout but is required to satisfy regulations, stakeholders or best practice.  Any good business manager is necessarily a risk manager.  What managers need are consistent, analytical, methods and systems to ensure that they have a process for identifying, tracking and treating risks.