FOR the last two decades or so risk management has been “the” buzzword, the panacea, cure-all and end-all of all our financial market woes.

In the aftermath of the Asian financial crisis of 1997/98, financial institutions and corporations spurred on by international agencies and their national regulators have been rushing to implement “risk management” in their respective organisations.

All of them, in one way or another, can pinpoint a turning point or eureka moment when risk management suddenly became an essential “must-have” component of their organisation.

For regulators, this would be instances like the public embarrassment of large forex trading losses incurred in the management of national reserves, or the realisation of the fundamental flaws in their over optimistic dependence that the market will correct itself without pre-emptive intervention.

For financial institutions; rogue traders, valuation errors, or a combination of the two, have become an easy scapegoat for embarrassing loss events.

This drive towards risk management is for some, a crucial element of corporate strategy and for others it is merely paying lip service in a public relations exercise.

Sadly, if we see these examples as two extremes (or outliers), the majority will lie midway between the two. In the whole scheme of things, this is effectively “no man’s land”, in that you have done something to give the semblance of effectiveness but not enough to be effective when it really needs to be.

CEOs, senior managers and traders often say “oh, we have a risk management unit” as an all-encompassing statement, giving an impression that “we have effective risk management”. Occasionally, this is without actually knowing what the unit does or how it manages risks.

This is surprising for senior management, and downright alarming for proprietary traders. Often, traders will have only a cursory knowledge of risk measures and controls and be the first to challenge the risk numbers when it goes against them.

The risk team then gets bogged down with explaining the numbers and the traders gets another few days to fix the problem or work on their exit strategy. You lose sight of the bigger picture and urgency of the original message.

This lip service to risk management, with a token effort to manage risk, is what I describe as the ultimate placebo. As with the nature of placebos, it works well if you don’t really have a problem (the placebo effect is after all a psychological cure).

But if you have a real problem eg valuation issues, rogue traders, flaws in risk modelling or operational inefficiencies, placebos don’t address the root cause of problems. If Murphy’s Law holds true, “anything that can go wrong will go wrong at the worst possible time”.

A striking example being Long Term Capital Management’s spectacular failure in the late 90s, in what was perceived to be low risk arbitrage strategies. The placebo in question being adherence to a flawed risk arbitrage model that broke down in spectacular fashion at the worst possible time.

So what can an organisation do to escape the placebo effect and ensure risk management is the panacea (the cure-all of all our ailments)?


Embedding risk into the corporate DNA
This entails firstly creating a corporate culture that not only rewards and encourages high performance, but also embraces the risk recognition and management mindset as part of the way it does business.

That is, not only a top-down senior management level risk perspective but cascaded and embraced down to the lowest level of the corporation. Admittedly corporate culture is not an overnight development, but organisations should spend the time and effort to develop the “right” culture.

Secondly, to do so requires the corporate, division, department and individual trader reward structure to be realigned to give equal emphasis on performance benchmarks (profitability, return on investment) and risk measures (value at risk or similar measures of risk.)

In other words, the way we measure organisational performance must conform to this new paradigm, both in form and function, rather than embracing motherhood statements without concrete actions.

Thirdly, to enforce and embed this new paradigm, there is a need to tweak the internal systems and processes to give transparency as to each division, department, trader or support staff’s risk contribution.

The performance measurement and attribution systems must go hand-in-hand with risk measurement and attribution systems leading to the holy grail of risk adjusted return measures.


Recognise your own organisational deficiencies
Institutions and corporations have to be wary and recognise the limitations of their existing risk infrastructure. Businesses will undoubtedly continue irrespective of whether risk management can catch up.

As such organisations have to recognise it is just as important to bring in the right kind of talent into the risk fraternity as it is to bring in the right treasurer, trader or portfolio manager.

In addition there should be a willingness to take a step back and evaluate the organisation’s readiness. We should be willing and able to turn down propositions which don’t meet risk management standards or our operational readiness.

Organisations must also recognise that as with new business initiatives, risk is not an overnight solution. We must build the appropriate risk infrastructure from bottom up instead of our current, “tack on at the end” afterthought approach to risk management most organisations often adopt today.

A proper rollout of the basic risk toolkits in the organisation to understand and manage risk, and more importantly, stakeholders buy in, are essential for effective risk management.

In summary, organisations should be aware that giving lip service to risk management runs the danger of creating the ultimate placebo which masks the truth and give a false sense of security. This can be disastrously shattered by events to the detriment of the organisation’s longevity. Case in point; consider why Lehman Brothers, a major investment bank long considered a well managed, highly profitable market player with risk management well entrenched still went bankrupt in 2008?


Khairul Azwa is the head of risk management & compliance, KWAP


This article appeared in The Edge Financial Daily, December 14, 2009.