Independence, control, respect, and communication: best practices in ERM

RMA Journal, The, Sept, 2005 by Tanya Azarchs, Prodyot Samanta

During in-depth discussions with leading risk managers, S&P noted differences of opinion on several fundamental precepts of enterprise risk management in general and risk management of trading operations in particular. Three areas showed a range of opinion: 1) the role modern portfolio management measurement methods should play in risk management practices; 2) what "independence" of risk managers should actually mean; and 3) the extent of the power of the risk management function. From these discussions S&P has drawn some conclusions about best practices.

Measurements

The field of risk management has evolved in several significant ways over the past 20 years. The most visible--and perhaps most seductive--change has been in risk measurement. High-powered computing has made possible sophisticated modeling of market risks, based on the math of portfolio theory and statistics known as Value at Risk (VaR) models. That modeling capability is now being grafted onto the areas of credit and operational risk measurement.

The seeming simplicity and precision of the answers one can get using these measurement techniques are very attractive to managers and regulators. Meanwhile, some risk managers, even at major financial firms, remain unconvinced of VaR's benefits. These managers maintain models merely to placate regulators, and they may not invest in updating and enhancing them. But developing a robust model or even implementing an off-the-shelf model entails careful thought, massive amounts of data feeds, continual testing, and constant refinement. Those who do not invest effort and money do not get a robust model, or even a useful one for risk diagnostic purposes. Their models won't produce results comparable to other models using seemingly similar techniques.

Whether or not they find value in VaR models, firms rely more on older sensitivity measures for day-to-day risk management of individual trader positions. The belief is that such measures are more sensitive in picking up the risks of specific instruments than are the blunter measures of VaR. Firms also maintain very sophisticated models for the purpose of pricing the instruments they sell, because an incorrect price opens the firm to being picked off by other dealers or customers and to getting the profit-and-loss statement wrong.

Nevertheless, the VaR models appear to be a favorite tool of risk managers who see their main function as ensuring that the firm does not find itself with concentrated exposures to any risks. In contrast to the more granular types of risk limits traders have--notional amounts, sensitivity measures, and Greek measures, for example--VaR alone provides a common language of risk across all asset classes and remains more useful for analyzing aggregate exposures for complex portfolios. In addition, VaR helps a firm understand its exposure to certain scenarios or stress tests.

Most firms perform some sort of scenario or stress tests. The differences lie in how the stresses are developed--whether they represent only some historical worst cases or some hypothetical ones tailored to expose the firm's special vulnerabilities as well--and how sophisticated the models are in capturing the correlated effects of a shock to a specific market. For some firms, the stressed VaR becomes the firm-wide basis for limits setting and capital allocation. That is good if the stressed scenarios were thoughtfully elaborated. If not, however, the stressed VaR becomes merely a very high limit that will never be breached and therefore will never trigger hard discussions about risk exposure.

Most seasoned risk managers understand that VaR models are merely to be used as diagnostic tools; they do not provide precise or scientific predictions of worst-case losses for the firm. Assumption-laden and data-dependent, VaR is best suited to depicting the recent past and not a future that could always suffer a paradigm shift or temporary discontinuity. Stress tests are more realistic than daily VaR calculations for imagining a worst case and for setting capital. Daily VaR is more useful as a way of managing day-to-day trading exposures under normal market exposures.

S&P places emphasis on having robust models not because of their ability to produce precise measures of risk, but because of the systems requirements to operate them. These systems are very useful in providing a comprehensive aggregated view of risk positions, in a framework that makes it possible to analyze the risk positions and their correlations. VaR models also are the only way in which correlations can be viewed across multiple instruments.

Risk Function Independence

Given that risk measurement is not the be-all and end-all of managing risk, S&P places a great deal more emphasis on risk governance. Risk management is about the policies, the built-in incentives, and the communication of risk. It is about the way in which a firm defines and enforces its risk culture.

It would seem obvious that the risk management function, whether it pertains to credit risk or market risk management, should be independent. But what does independence really mean? In terms of organizational structure, risk managers and back offices should not report to the front office--to traders or heads of markets. On that there is little disagreement. However, beyond that there is little consistency.