Fundamentals Risk: Risk is one of the most important but misunderstood notions on Wall Street. Here I define risk, show how all risks consist of two essential components and explore some of the intriguing properties of risk. Risk has two components: 1. uncertainty, and 2. exposure. If both are not present, there is no risk. If a man jumps out of an airplane with a parachute on his back, he may be uncertain as to whether or not the chute will open. He is taking risk because he is exposed to that uncertainty. If the chute fails to open, he will suffer personally. In this example, a typical spectator on the ground would not be taking risk. They may be equally uncertain as to whether the chute will open, but they have no personal exposure to that uncertainty. Exceptions might include: A spectator who is owed money by the man jumping from the plane A spectator who is a member of the man's family Such spectators do face risk because they may suffer financially and/or emotionally should the man's chute fail to open. They are exposed and uncertain. A synonym for uncertainty is ignorance. We face risk because we are ignorant about the future. After all, if we were omniscient, there would be no risk. Because ignorance is a personal experience, risk is necessarily subjective. Consider another example: A person is heading to the airport to catch a flight. The weather is threatening, and it is possible the flight has been canceled. The individual is uncertain as to the status of the flight and faces exposure to that uncertainty. His travel plans will be disrupted if the flight is canceled. Accordingly, he faces risk. Suppose another person is also heading to the airport to catch the same flight. This person has called ahead and confirmed that the flight is not canceled. Accordingly, she has less uncertainty and faces lower risk. In this example, there are two individuals exposed to the same event. Because they have different levels of uncertainty, they face different levels of risk. Risk is subjective. Institutions can reduce some risks simply by researching them. A bank can reduce its credit risk by getting to know its borrowers. A brokerage firm can reduce market risk by being knowledgeable about the markets it operates in. Risk is a personal experience, not only because it is subjective, but because it is individuals who suffer the consequences of risk. Although we may speak of companies taking risk, in actuality, companies are merely conduits for risk. Ultimately, all risks which flow through an organization accrue to individuals stock holders, creditors, employees, customers, board members, etc. Credit risk is risk due to uncertainty in a counterparty's ability to meet its obligations. In assessing credit risk from a counterparty, an institution must consider two issues: credit quality: This encompasses both the likelihood of the counterparty defaulting as well as possible recovery rates in the event of a default. credit exposure: In the event of a default, what is the replacement cost of the counterparty's outstanding obligations likely to be? Credit exposure arises in many situations and is managed in a variety of ways. For example, securities lending creates credit exposure because the borrower of a security may fail to later return the security. That risk is typically reduced through collateralization. Settlement risk entails very large credit exposures which last for brief periods of time. Traditionally, credit exposure arose from lending activities, and was measured as simply the book value of all outstanding obligations from a counterparty. A bank would take credit risk when it issued a loan. An insurance company would take credit risk when it purchased a corporate bond. While book value was not an entirely accurate measure of credit exposure—the market value of obligations could diverge significantly from their book value—it was a simple and consistent measure that provided a reasonable sense of exposure to a counterparty. The pre-settlement risk of derivative instruments has made the task of measuring credit exposure more difficult. The notion of book value is not meaningful for most derivatives. While it is possible to measure the mark-to-market credit exposure of derivatives based upon their current market values, this measure provides an incomplete picture. For example, many derivatives such as forwards or swaps have a market value of zero when they are first entered. Mark-to-market credit exposure—which is based only on current market values— does not capture the potential for market values to increase over time. For that purpose some probabilistic measure of potential credit exposure must be used. Business activities entail a variety of risks. For convenience, we distinguish between different categories of risk: market risk, credit risk, liquidity risk, etc. Although such categorization is convenient, it is only informal. Usage and definitions vary. Boundaries between categories are blurred. A loss due to widening credit spreads may reasonably be called a market loss or a credit loss, so market risk and credit risk overlap. Liquidity risk compounds other risks, such as market risk and credit risk. It cannot be divorced from the risks it compounds. An important but somewhat ambiguous distinguish is that between market risk and business risk. Market risk is exposure to the uncertain market value of a portfolio. A trader holds a portfolio of commodity forwards. She knows what its market value is today, but she is uncertain as to its market value a week from today. She faces market risk. Business risk is exposure to uncertainty in economic value that cannot be marked-to-market. The distinction between market risk and business risk parallels the distinction between market-value accounting and book-value accounting. Suppose a New England electricity wholesaler is long a forward contract for on-peak electricity delivered over the next 3 months. There is an active forward market for such electricity, so the contract can be marked to market daily. Daily profits and losses on the contract reflect market risk. Suppose the firm also owns a power plant with an expected useful life of 30 years. Power plants change hands infrequently, and electricity forward curves don’t exist out to 30 years. The plant cannot be marked to market on a regular basis. In the absence of market values, market risk is not a meaningful notion. Uncertainty in the economic value of the power plant represents business risk. The distinction between market risk and business risk is ambiguous because there is a vast "gray zone" between the two. There are many instruments for which markets exist, but the markets are illiquid. Mark-to- market values are not usually available, but mark-to-model values provide a more-or-less accurate reflection of fair value. Do these instruments pose business risk or market risk? The decision is important because firms employ fundamentally different techniques for managing the two risks. Business risk is managed with a long-term focus. Techniques include the careful development of business plans and appropriate management oversight. book-value accounting is generally used, so the issue of day-to- day performance is not material. The focus is on achieving a good return on investment over an extended horizon. Market risk is managed with a short-term focus. Long-term losses are avoided by avoiding losses from one day to the next. On a tactical level, traders and portfolio managers employ a variety of risk metrics —duration and convexity, the Greeks, beta, etc.—to assess their exposures. These allow them to identify and reduce any exposures they might consider excessive. On a more strategic level, organizations manage market risk by applying risk limits to traders' or portfolio managers' activities. Increasingly, value-at-risk is being used to define and monitor these limits. Some organizations also apply stress testing to their portfolios. Enterprise Risk Management: A broad introduction to enterprise risk management, its purpose and methodologies. Any risk management strategy must address three critical elements: corporate culture, procedures and technology. These are introduced and discussed in detail. Enterprise Risk Management Published as: Holton, Glyn A., (1998). The new climate of risk, Treasury Management International, 69, 24-28. Section One Introduction ll organizations are in the business of placing capital at risk in pursuit of ventures which are uncertain. This includes financial institutions, governmental bodies, corporations and non-profit organizations. They all have goals, and they allocate resources to pursue them. Because all organizations face uncertainty in achieving their goals, they all face risk. Enterprise risk management is about optimizing the process with which risks are taken. It has become a critical issue for the 1990's because organizations have started suffering spectacular losses—often from risks they never should have taken in the first place. Examples include: Orange County (November 1994): Orange County's Investment Pool lost $1.7 billion from structured notes and leveraged repo positions. The treasurer, Robert Citron, took the positions with oversight from the county's five- person board of supervisors. The riskiness of the pool's investments was publicly discussed when Citron ran for, and won, reelection in 1994. Members of the board of supervisors claim that they did not receive critical information which would have indicated the risks that Citron was taking. Barings Bank (February 1995): Barings Plc lost $1.5 billion because a Singapore-based trader, Nick Leeson, took unauthorized futures and options positions linked to the Nikkei 225 and Japanese government bonds (JGBs). At the height of his activities, Leeson controlled 49% of open interest in the Nikkei 225 March 95 contract. Despite having to finance margin calls as the bank lost money, the Barings' board and management claim to have been unaware of Leeson's activities. Daiwa Bank (September 1995): One of Daiwa Bank's US-based bond traders, Toshihide Iguchi, concealed $1.1 billion in bond losses over a ten year period. When management learned of the losses, they attempted to hide them from US regulators. Ultimately, Daiwa was forced to cease its US operations and was fined $340MM in a plea agreement with US prosecutors. Sumitomo Corp. (June 1996): Sumitomo's head copper trader, Yasuo Hamanaka, disguised losses totaling $1.8 billion over a ten year period. During that time, Hamanaka performed as much as $20 billion of unauthorized trades a year. He was able to hide his activities because he headed his section and had trade confirmations sent directly to himself, bypassing the back office. In recent years, numerous organizations have suffered staggering losses such as these. These four, however, are some of the most significant. They illustrate two common characteristics. Each one: Was directly caused by the actions of a single individual. Could easily have been prevented through appropriate oversight. Losses such as these never used to occur. In the past, companies might go bankrupt or suffer losses, but the forces that did them in were macroscopic—competition, mismanagement or adverse economic conditions would bleed a company's vitality. Today, an individual can pick up a phone and place billions of dollars in notional capital at risk. This is new. The risk does not only come from derivative instruments. It arises from the many sources of leverage which are available today. These include derivatives, repos, securities lending and structured notes. Such tools have increased liquidity in the markets and enable institutions to efficiently manage many of their risk exposures. In the wrong hands, however, they can devastate an organization. The problem is not the financial tools, but the people who use them. While many financial tools are new, the problem of people acting fraudulently, or just irresponsibly, has always existed. In the past, risks were unleveraged, so trading losses were limited. They might cost a few individuals their careers, but they would rarely make the newspapers. Today, people take the same types of risks, but they leverage them, and the losses burgeon. Leverage doesn't only magnify market risk. As margins for error contract, other risks increase, including credit risk, liquidity risk, operations risk and legal risk. Organizations are focusing on all of these. Through enterprise risk management, they seek comprehensive solutions—not because the problem is new, but because the consequences of failure have become enormous. Regulators are also motivating a process of change. Awakened to the threat of leveraged risk, they are pursuing initiatives that: Enhance the disclosure of off-balance-sheet risks Promote corporate risk management Ensure that institutions are sufficiently capitalized for the risks that they take Reduce systemic risk Finally, organizations are embracing enterprise risk management because it makes good business sense. Today, they actively make the decision to change the way they take risks. They implement innovative procedures. They install new technology. They actively reshape their corporate culture to facilitate better risk taking. Implementing an effective strategy of enterprise risk management is not easy, and for each organization, it is different. There are, however, three fundamental elements which should comprise any risk management strategy: Corporate culture Procedures Technology The importance of each of these will vary depending upon the needs of an organization. Each will, however, be important in some sense or another. For example, a university endowment which manages all its assets externally, may not need much risk management technology, but it will need to ensure that the investment managers it hires do have—and appropriately utilize—such technology. These three elements of enterprise risk management are discussed in the following sections. Risk Measures: The most widely used techniques of measuring market and credit risk are presented. The discussion is introductory, but fairly comprehensive. Risk Measures Section One Introduction ome risks lend themselves to measurement or quantification. Others some of the most significant risks do not. This section presents a variety of risk measures that can be applied to the former. The reader is cautioned that these methods are all based on models of reality. Reliance on them entails model risk. The risk measures presented here fall into three general categories: statistical risk measures, factor sensitivities and single-scenario risk measures. Risk Measures Section Two Volatility olatility is the most basic statistical risk measure. It can be used to measure the market risk of a single instrument or an entire portfolio of instruments. While volatility can be expressed in different ways, the typical definition which is used in finance is: The volatility of a random variable is its standard deviation. In day-to-day practice, volatilities are calculated for all sorts of random financial variables: stock prices, interest rates, the market value of a portfolio, etc. Volatility measures the random variability of these quantities. See Exhibit 1: For example, the S&P 500 has annual volatility of about 15%. Intuitively, this might be interpreted as meaning that, over a typical year, the value of the stock market will stray from its anticipated year-end value by about 15%. There are two general methods for estimating volatility: Historical volatility estimates are based on recently observed market value fluctuations. For example, the return volatility of a mutual fund might be estimated from the fund's returns over the last 100 trading days. Some estimating techniques treat volatility as being variable. They may extrapolate future volatility based on recent trends. Implied volatility estimates are derived from option prices. Models for pricing options require volatility estimates as inputs. However, if an option's price is observed in the market, the same models can be used to infer the volatilities that would correspond to the observed price the volatilities implied by the option prices. While implied volatilities are useful in certain applications, they can only be calculated if there is a liquid market for a corresponding option. For example, implied volatilities can be calculated for many currencies or for the S&P 500; whereas they can not be calculated for most municipal bonds or the portfolio of a pension plan. For this reason, implied volatilities can be of limited usefulness to risk managers. Historical volatility estimates, on the other hand, are highly flexible. They can be applied to any instrument or portfolio for which historical data is available. They are widely used for risk management purposes, but do have limitations: There is a trade-off between basing historical volatility estimates on only the most recent data, or using data from a longer sample period. Estimates based only on recent data may be timely, but not statistically significant. Alternatively, estimates based on a lot of data, may be statistically significant, but out of date. Historical volatility estimates can provide a false measure of risk. For example, in a thinly traded market, prices may remain unchanged for an extended period of time. This would reflect a lack of market liquidity—not a lack of market risk. For traders or portfolio managers whose positions are constantly changing, historical volatility estimates are useless. The user needs to know the riskiness of the portfolio that exists today. Historical measures speak only to the riskiness of the portfolio as it existed a month ago—or a year ago. For many instruments, historical volatility says nothing about how risky they are today. For example, the price volatility of a call option (which is different from the price volatility of the option's underlier) will depend upon whether the option is in-the-money or out-of-the-money. If historical volatility were estimated from a period when a call option were out-of-the-money, but the option were now in-the-money, the historical volatility would be misleading. Such problems can be addressed with other risk measures. For example, value at risk measures the immediate riskiness of a portfolio based upon the historical volatilities of the instruments it currently holds. The Greeks provide measures of the sensitivity of an option to various sources of risk— particularly the price of the option's underlier. Risk Measures Section Three (a): The Greeks: Delta and Gamma ptions and other derivative instruments create a variety of risk exposures which can vary dramatically over time or as markets move. Often, it is not enough to know the total risk associated with a derivatives position. In order to adjust a hedge, or optimize a position, it is necessary to know specific exposures to each of several sources of risk. The Greeks are a set of factor sensitivities that describe those exposures for a position or an entire portfolio. They are called the Greeks because each factor sensitivity is named after a different letter from the Greek alphabet. The Greeks are summarized in Exhibit 1: The Greeks Factor Sensitivity Measures Exposure to: Delta Changes in the value of an underlier Gamma Changes in the value of an underlier Vega Changes in implied volatility Theta The passage of time Rho Changes in interest rates This article is divided into three sections. The second and third sections cover vega, rho and theta. This first section introduces delta and gamma... Changes in the value of an underlier are often the primary source of risk in a portfolio, so there are two Greeks that measure such risk. Delta and gamma represent first- and second-order measures of sensitivity to an underlier. Exhibit 2 illustrates how the price of a portfolio might respond to changes in the price of an underlier: Exhibit 2 fully describes the relationship between the portfolio's price and the underlier, based on prevailing market conditions. With just two numbers—delta and gamma—we can summarize the information contained in Exhibit 2. Certainly, two numbers can not describe the wealth of detail contained in a picture, but with delta and gamma we capture the two most important pieces of information in the picture. Let's start with delta. The most significant information that Exhibit 2 provides us about this particular portfolio is the fact that its value will increase if the underlier increases, and it will decline if the underlier declines. This is the information that delta conveys, along with the magnitude of such sensitivity. If we fit a tangent line to the curve in Exhibit 2 at the underlier's current value of 101, the slope of that line will capture the direction and magnitude of the portfolio's sensitivity to the underlier. Delta is defined as the slope of that tangent line. See Exhibit 3: For example, in Exhibit 3, the slope of the tangent line is .8 million (for each unit increase in the underlier, the portfolio's price appreciates by $.8MM). Accordingly, the portfolio's delta is .8 million. (see calculus footnote) This technical definition leads to an approximation for the behavior of a portfolio.  Where represents a change in the underlier, and represents the corresponding change in the value of the portfolio. For example, suppose a portfolio is exposed to IBM stock and has an IBM delta of 1.5 million. This means that the portfolio will gain about $1.5MM if IBM stock rises $1, or lose about $1.5MM if the stock falls $1. Note that the portfolio's exposure could result from an outright position in IBM stock, a derivatives position linked to IBM stock, or some combination of the two. If it is caused entirely by an outright position, then that position must consist of exactly 1.5 million shares of IBM stock. If it is caused by a derivatives position, then the delta tells us that the position's exposure to IBM will behave similarly to an outright position of $1.5 million shares. If the portfolio is exposed to several stocks, then it will have a delta for each. For example, it's Exxon delta might be -2 million. This would behave similarly to a short position in 2 million shares of Exxon stock. If the stock rose $1, the portfolio would lose about $2MM. If the stock declined $1, the portfolio would gain about $2MM. Now let's consider gamma. If delta summarizes the most significant piece of information about a portfolio's sensitivity to an underlier, gamma summarizes the second-most significant piece of information. Delta captured the fact that the graph in Exhibit 2 was upward sloping. It did not, however, capture its downward curvature. Gamma describes curvature. Exhibit 4 shows the best-fit parabola for the graph of Exhibit 2: Note that the best-fit parabola does not exactly overlay the curve in Exhibit 4 because the curve is not itself a parabola. In general, the best-fit parabola will have the form:  Where A, B and C are constants. Gamma is defined to be 2A. As it turns out, for the best-fit parabola, the constant B is the portfolio's delta, and C can be solved for based upon the portfolio's current market value (see calculus footnote). Gamma not only tells us the magnitude of curvature, but its direction as well. Positive gamma corresponds to curvature that opens upward. Negative gamma corresponds to curvature that opens downward. While the value of an underlier may be the primary determinant of a derivative instrument's price— and, hence, its risk—other variables also play a role. These include implied volatility, interest rates and the passage of time. There is a Greek factor sensitivity for each of these, called: vega, rho and theta, respectively. We will introduce vega in the next section. Risk Measures Section Three (B): The Greeks: Vega ega is applicable to instruments which entail optionality such as puts, calls, caps and many exotic derivatives. Such instruments are sensitive to the implied volatility of their underlier. In general, a long option position will benefit from rising implied volatilities, and suffer from declining implied volatilities. Short option positions display opposite behavior. Mathematically, vega is defined in much the same way as is delta. Like delta, it is a linear approximation to the price sensitivity of a derivative instrument or portfolio. The only difference is that delta measures sensitivity to the underlier; whereas vega measures sensitivity to implied volatility. See Exhibit 6: Exhibit 6 illustrates how the price of an in-the-money call option might respond to changes in implied volatility. A tangent line has been fitted to the curve at the current volatility of 10%. The slope of that line is the option's vega (see calculus footnote). Accordingly, we have the approximation:  Where represents a change in implied volatility. The two final Greeks are theta and rho. They measure exposure to the passage of time and changes in interest rates. I introduce them in the next section. Risk Measures Section Three (c): The Greeks: Theta and Rho heta and rho measure sensitivity to the passage of time and interest rates, respectively. Interest rates affect the price of a derivative instrument because today's price of a derivative should be the discounted mean of its future cash flows—and interest rates determine the rate at which the discounting is performed. The passage of time affects the price of a derivative instrument because derivatives mature. All things being equal, a long option position will lose value as its maturity date approaches. A short option position will gain value. Such depleted value is called the position's time value. Like delta and vega, theta and rho are linear risk measures. They represent the slope of a tangent line to: The portfolio's price as a function of time, for theta The portfolio's price as a function of interest rates, for rho Accordingly, we have the following approximations (see calculus footnote):   Where represents an increment of time, and represents a change in an interest rate. The Greeks delta, gamma, vega, theta and rho are used extensively by derivatives traders in hedging their positions. A perfectly hedged position is one for which all the Greeks—with the possible exception of theta are zero. In practice, a perfectly hedged position is rarely achievable—and sometimes not desired. Accordingly, the process of hedging a derivatives position is one of maintaining the Greeks within reasonable bounds and achieving a balance between their respective exposures. Risk Intuition: Seven questions to tease your intuition. You may forget them immediately, or they may change how you think about risk. Risk Intuition Question One Volatility Values are illustrated over time for three hypothetical assets. Which asset has the most market risk? Risk Intuition Answer One Volatility There is no one correct answer to this question. The riskiness of each asset depends upon an investor's time horizon. Over short horizons, the first asset is the most risky, and the third is the most stable. Over long horizons, the third asset is the most risky and the first is the most stable. Risk Intuition Question Two Gambling Ellen and Mark are gambling at a casino. Ellen is about to throw a 6-sided die. If it comes up 6, she will win $100. Otherwise, she will win nothing. Mark is playing a slightly different game. He is about to throw a 10-sided die. If it comes up 10, he will win $100. Otherwise, he will win nothing. Who faces more risk, Ellen or Mark? (Note that the amount each paid to play their respective game is irrelevant.) Risk Intuition Answer Two Gambling Ellen faces more risk. This can be determined by comparing the standard deviation of her possible returns to those of Mark. It is also intuitively clear that she faces more uncertainty Mark is more certain that he will receive nothing than is Ellen. Risk Intuition Question Three Compensation A trader's compensation consists of the following: a base salary of $250,000 plus 5% of his trading gains. What is wrong with this compensation package? Risk Intuition Answer Three Compensation he package promotes needless speculation. The trader is motivated to maximize possible profits, but has no reason to limit possible losses. To see how this promotes irresponsible behavior, let's suppose that the trader has only marginal trading skills. In a typical year he gains or looses about $10MM, translating into an annual bonus of between $0 and $500,000. The trader decides to increase the riskiness of his trading so that in a typical year he will gain or lose $100MM. With this arbitrary act, he increases his bonus range to be between $0 and $5MM! Another way to look at the trader's situation involves option pricing theory. Effectively, the trader holds a call option on 5% of his trading gains. The present value of an option depends upon the volatility of the option's underlier—but in this situation, the trader controls the volatility of the underlier! The more volatile he makes his trading returns, the more valuable that option is to him. Risk Intuition Question Four Diversification Two US-based investors enter into an agreement to help diversify their portfolios. Each month, if the unemployment rate in Holland rises, the first investor will pay the second $5MM. If, on the other hand, Dutch unemployment declines, he will receive $5MM from the other investor. Because Dutch unemployment tends to rise as often as it declines, the investors perceive that the arrangement will not affect the average returns on their portfolios. Furthermore, the Dutch unemployment rate has low correlation with their other investments. By adding this diversifying risk to their portfolios, the investors expect to reduce their overall risk. Is this a wise transaction? Why or why not? Risk Intuition Answer Four Diversification The transaction is foolish. However, beyond the fact that it is unconventional, identifying the flaw in the investors' reasoning is not easy. The investors are correct that their agreement represents a diversifying risk and that it will not affect the expected returns on their portfolios. Their mistake is in misunderstanding how diversification can reduce risk. Investors can reduce their overall risk by dividing their exposures among multiple diversifying risks. Compounding diversifying risks on top of existing risks will not result in risk reductions. This issue arises frequently with diversification; although it is not always recognized. Risk Intuition Question Five Time Decay Is theta—the rate at which a derivative position loses value due to the passage of time—a risk? Risk Intuition Answer Five Time Decay Theta does not represent a risk because there is no uncertainty in the passage of time. Theta can be likened to the accrual of interest on a fixed rate loan—it is inevitable and entirely predictable. Note, however, that a large theta may be indicative of gamma or vega risk. Risk Intuition Question Six RAROC AROC (Risk Adjusted Return On Capital) is an approach for allocating capital within a company. Sophisticated computer models are constructed which assign to each line of business within the company: An expected return on capital, and The risk associated with that line of business From these, a risk adjusted return on capital (RAROC) is determined for each line. Effectively: The company then allocates capital to its various lines of business in such a manner as to maximize the entire company's RAROC allocating capital to business lines which have high RAROC's and not allocating capital to business lines which have low RAROC's. What is wrong with this concept? Risk Intuition Answer Six RAROC athematically, RAROC is a useful model for capital allocation within a company. However, when the concept migrates from theory to practice—and companies actually attempt to calculate RAROC's and allocate capital according to them—RAROC becomes the antithesis of sound enterprise risk management. The practical implementation of RAROC does not promote personal responsibility. It suggests that management can place a company on auto-pilot and let a computer make decisions. It denies that risk management is about people and suggests that it is about mathematical formulas. For example, RAROC does not acknowledge that: Individuals make a difference in the profitability of a line of business. Individuals make a difference in the riskiness of a line of business. If a CEO is concerned about trading risk, he should visit with his traders, ask questions and look them in the eye. A bank which is concerned about credit risk should hire loan officers who take their job seriously and who ask probing questions before making a loan. A corporation which is concerned about the riskiness of a new product line should hire managers who are smart, experienced and will sweat the details. Such simple steps as these are about people. They can not be incorporated into a computer model, but they will profoundly impact both the riskiness and the profitability of a line of business. Risk Intuition Question Seven Know Your Client During an internal audit, a bank discovers it has incomplete background information on a corporate client to whom it has made a long-term floating-rate loan. It is an old loan which was made before the bank implemented improved lending policies. Accordingly, the bank decides to have two of its officers visit the client and perform an updated background check. Two weeks later, the officers return from their visit with grim news. The client is troubled and will probably default on the loan within the next six months. The recovery rate on the loan is likely to be less than 60%. With this background check, has the bank changed its credit risk? Has it increased it or decreased it? Risk Intuition Answer Seven Know Your Client Risk consists of two components: Uncertainty Exposure to that uncertainty In this instance, the bank's exposure is not changed because the terms of the loan remain unchanged. Its uncertainty, however, has changed. Uncertainty is a complex notion. Sometimes, if we research a topic, we will uncover information which will actually increase our uncertainty. In this example, however, it is fairly clear that the bank has decreased its uncertainty. It has gone from knowing little about the client's situation to having a fairly good idea of what to expect in the future. Accordingly, the bank has decreased its credit risk. When an organization sets out to manage risk, it is important to start off with a clear understanding of what constitutes risk and what practical benefits will be derived from risk management. In this example, the bank has not saved itself any money. It has, however, reduced its risk. Risk Intuition Conclusion The notion of risk has long been taken for granted on Wall Street—a problem which has only started to change in the latter part of this century. A significant accomplishment has been the development of quantitative models such as Modern Portfolio Theory and the Capital Asset Pricing Model. For the first time, such theories explicitly incorporated risk into the investment decision making process. The very success of those models has presented a new problem. They have come to dominate our thinking on financial risk. We have become accustomed to quantifying all risks—as if operations risk or legal risk were objective notions that could be summarized like the historical volatility of LIBOR. Some have gone so far as to propose that the future of enterprise risk management lies in risk aggregation—that all the disparate risks of an organization can be aggregated into a single number and presented to senior management at the end of each day. A review of some significant losses in recent years seems to reveal a different picture: Barings Bank succumbed to the meticulous fraud of a single individual. Robert Citron drove Orange county into bankruptcy. All the time, the voters and the board of supervisors knew what he was doing. The Common Fund lost $128MM because of a rogue trader at an outside investment management firm. Daiwa Bank was devastated, not so much by Toshihide Iguchi losing $1.1 billion, as by the misguided efforts of management to disguise the loss from US regulators. Enterprise risk management is about people. It is about how they think and interact. It is about what they know and what they don't know. It is about their strengths and weaknesses. It is about the complex combination of factors which shape the decisions we make. Through the preceding seven questions we have explored some of the subtle and intriguing aspects of the complex notion risk. If there is a unifying theme to the questions, it is that risk is exposure to uncertainty—and uncertainty is a lack of knowledge. When we attempt to measure risk, effectively we are trying to gain knowledge about our lack of knowledge! It can be done, but it isn't easy. I have faulted some of the ways that technology has been applied to risk management, but this does not mean that I oppose technology. Technology is one of the most valuable tools available for managing risk. Much of my consulting work is highly technical. Just explore this site. You will find it chock full of technical information on such topics as the mathematics of value at risk; credit exposure measurement and risk visualization technology. I count among my clients two software companies who have hired me specifically for my expertise in risk modeling. Risk is a fascinating and complex notion. The key to successful enterprise risk management is not to simplify risk, but to embrace its complexity.