It has become a pretty standard part of business management practice. Every year, the demand is for MORE with the same or fewer resources and in the same or less time. The latest requirement to be a senior manager is the ability to stare a subordinate straight in the eye and demand that they significantly enhance productivity again when you have absolutely no idea how they will pull that rabbit out of their hat.
One very common way to work this magic is to spend less resources on things like risk management. Risk Management is rarely one of those places where more productivity is being required. In fact, during this productivity discussion, risk management is almost never mentioned. That is the hint that risk management is one of the areas where adjustments can be made to pick up some slack.
In a firm without a clear risk management culture, risk management will often just be skipped altogether. End of story.
But in a firm with a strong risk management culture, that would never be an acceptable course of action. What instead will happen is that substitutions will be made. Less time spent on risk management, less frequent checking of the need for mitigation. Less, Less, Less.
And if this happens in “normal” times, then there will be no feedback from the environment that there is any problem with Less Risk Management. If the original intention of the Risk Management was to protect against all but 1 in 100 year losses and there is a drift, an easing into Less Risk Management, then what was thought to be a 1/100 loss might become a 1/10 loss. There is still a 90% chance that the extreme loss will not happen.
That is the “Drift into Failure” of the Safety Engineers. In the book of that title, Dekker tells of an airplane maintenance schedule that drifts over time from the manufacturers recommended 350 hours of flight time to 2500 hours of flight time. Then one maintenance cycle was skipped and a plane crashed. The drift from 350 hours to 2500 hours was not one big decision. It was many little decisions, each moving things up only 10% to 20%. Skipping just one maintenance was not a big decision either. Things were tight one month and they needed the plane.
So Risk Management procedures need to allow for natural drift caused by Performance Pressure. And for normal degree of mistakes, like skipping a scheduled maintenance.
At JP Morgan, the Corporate Investment Office did not start out making gigantic trades for profit. They were doubtless like lots of other hedging operations. One quarter, they saw an odd situation where a profit could be made with a fairly high degree of certainty. So they asked permission and took a small gain. They were then told to look for other similar opportunities. After a while, they started to get a profit goal along with all the other business units. Like LTCM, they must have hit a period where such profit making opportunities stopped falling into their laps. So the started to go very big on something with small reward. One decision at a time. And probably risk management oversight that was one or two stages of their evolution behind.
It may well not have been one big bad wrong decision, it may well have been a series of small seemingly easy, sensible decisions that together spelled disaster.
But no one looked at them all together.
Riskviews 