The WordPress.com stats helper monkeys prepared a 2012 annual report for this blog.
Here’s an excerpt:
4,329 films were submitted to the 2012 Cannes Film Festival. This blog had 42,000 views in 2012. If each view were a film, this blog would power 10 Film Festivals
You awake with a start. There is an eerie presence in your bedroom. A voice says “Come with me!”
You see yourself, many years ago, starting out in your career. With an interest in risk, you feel lucky that you were able to land a position in an insurance company. You are encouraged when you hear your boss say “its all about risk and reward”. But it didn’t take you too long to find out that while there were daily, weekly, monthly, quarterly, annual and special reports about the rewards that the company was experiencing, there was not one single report about risk. You confront your manager about this and he tells you that “risk isn’t something that you measure”, it is in your gut. You just know when something is risky. “. He advised that once you were more experienced, you too would be able to tell when something was risky or not.
You drift back to sleep when a second voice calls you to “Behold!”. You see yourself a manager in an insurance company:
You are being told that risk is very important. Your company takes risk management very seriously. Several years ago, the company spent millions to build a state of the art Economic Capital Model. Now, all plans and all performance is viewed in terms of the amount of risk associated with each and every activity. And you hate the whole thing!
To you, this has become a technocratic nightmare. Your performance is judged by a computer using an algorithm that seems to be spewing forth somewhat random values. It seems like your promotions and bonuses are being determined by a slot machine, but a slot machine with no window to see what is happening inside.
The high priests of risk operate the model. But they are too busy to actually explain what is going on in a manner that could help the business.
So if somehow, you are lucky enough to get to the top, that will be the last day for that complex risk model.
And you pull the covers up over your head. This is too much like a workday. You need your sleep. But before long, a third voice wakes you again. “This way…”
You are on the hot seat. The board wants to know how the company was able to get into such a problem. Didn’t you see that there were such enormous build ups of exposures to that risky indoor snow experience sector? The frostbite claims were double what they were last year. Dividends will have to be eliminated. And we probably need to turn down the corporate air conditioners. No longer could the offices be kept at a tolerable 31 degrees. Next summer would be unbearable. Your only defense is that your gut told you that there was little risk and big rewards in the indoor snow business. But that is not how it went. They end the meeting by letting you go. The inglorious end to your career as a risk manager.
You wake up shouting that it was not your fault. And you see the light coming in the window. You turn on the TV to find that all this happened in one night. You get dressed and go back into the office. You are finishing up your staff meeting and you direct your attention to your risk management staff.
Starting today, I want you to spend more of your time making your models more transparant and the findings more actionable. I am tired of risk being something that comes at us after the fact to tell us that something was wrong. We need to focus on leading indicators that all of the managers can use in real time to manage the business. You can still use that fancy model that you all so love, but I only want to hear about the model when it actually explains something about the business that I can use next quarter to do a better job of managing my risk and reward.
And with that, we ended the meeting and all went to our holiday party. Next year will be interesting…..
Many people are familiar with the Myers-Briggs Personality Type Indicator. It is widely used by businesses. What a shocker to read in the Washington Post last week that psychologists are not particularly fond of it.
The Myers-Briggs Personality types were developed directly from the work of Carl Jung, who is not highly regarded by modern psychologists according to the Washington Post story.
Psychologists have their own personality types. The chart below is from The Personal Growth Library, and is called the Five Factor Model.
You may be able to find options here that would allign with your ERM program.
Stability – You may seek Resilience, and settle for Responsiveness.
Originality – You may want to be an Explorer, but much more likely, your ERM program is a Preserver.
Accommodation – Your goal is to be a Challenger, you end up a Negotiator.
Consolidation – You should be able to achieve a Focused ERM program, but pressures of business and the never ending crises force you to be Flexible much too often.
That seems to provide some valuable introspection.
Next you need to look at the overall enterprise personality. Many successful companies will have a personality that is very different from the choices that you want to steer towards as the risk manager for your program. You should check it out and see.
If there is an actual allignment between your overall organization’s personality and the personality that you aspire to for your ERM program, then you will be running downhill to get that development accomplished.
What does that mean when the personality that you want for your ERM program is almost totally different from the personality of your organization? It means that you will be pulled constantly towards the corporate personallity and away from what you believe to be the most effective ERM personality. You then have to choose whether to run your ERM program as a bunch of outsiders. You then will need to form a tight knit support group for your outsiders. And make sure that you watch the movie Seven Samuri or The Magnificant Seven.
Or you can rethink the idea you have of ERM. Think of a version of ERM that will fit with the personality of your company. Take a look at The Fabric of ERM for some ideas. Along with the rest of the Plural Rationality materials.
RISKVIEWS has published this list before. You will notice that it is different from many other lists of the parts of ERM. That is because we do not presume that there is some sort of risk management process already in place that “automatically” takes care of several of these things. Many writers implicitly make that assumption so that they can focus solely upon the new, more exciting things, especially number 6 on the list below. But in fact, ERM must include all seven of these things to actually work to manage risk as most managers expect.
- DIVERSIFICATION: Risks must be diversified. There is no risk management if a firm is just taking one big bet.
- UNDERWRITING: These must be a process for risk acceptance that includes an assessment of risk quality. Firm needs to be sure of the quality of the risks that they take. This implies that multiple ways of evaluating risks are needed to maintain quality, or to be aware of changes in quality. There is no single source of information about quality that is adequate.
- CONTROL CYCLE: There must be a control cycle to manage the amount of risk taken. This implies measurements, appetites, limits, treatment actions, reporting, feedback
- CONSIDERATION: There must be a process for assuring that the consideration received for accepting risk is adequate. For risks that are not traded, such as operational risks, the benefit of the risk needs to exceed the cost in terms of potential losses.
- PROVISIONING: There must be appropriate provisions held for retained risks, in terms of set asides (reserves) for expected losses and capital for excess losses.
- PORTFOLIO: There must be an awareness of the interdependencies within the portfolio of risks that are retained by the insurer. This would include awareness of both risk concentrations and diversification effects. An insurer can use this information to take advantage of the opportunities that are often associated with its risks through a risk reward management process.
- FUTURE RISKS: There must be a process for identifying and preparing for potential future emerging risks. This would include identification of risks that are not included in the processes above, assessment of the potential losses, development of leading indicators of emergence and contingent preparation of mitigation actions.
The Law of Risk and Light applies to these aspects of risk management just as it applies to aspects of risk. The risk management that you do is in the light, the risk management that you skip is in the dark. When parts of a full risk management program are in the dark, the risk that part of the risk management process would have protected you from will accumulate in your organization.
Future posts will explain these elements and focus on why ALL of these principles are essential.
The fire cycle: “The action-cycle of a fire from birth to death follows a certain pattern. The fire itself may vary in proportion from insignificance to conflagration, but regardless of its proportions, origin, propagation or rate of progression, the cycle or pattern of controlling it includes these phases:
1. the period between discovery and the transmittal of the alarm or alerting of the fire forces;
2. the period between receipt of alarm by the fire service and arrival of firemen at the scene of the fire; and, finally,
3. the period between arrival on the fire ground and final extinguishment of the fire itself.
It is important to fire fighting to make sure that the right things happen during each phase and that each step takes as little time as possible. For the first phase, that means having fire detection equipment in place and working properly that produces a signal that will be noticed and conveyed to the fire forces. In the second phase, the fire fighters need to be organized to respond appropriately to the alarm. And the third phase includes the process of diagnosing the situation and taking the necessary steps to put out the fire.
That is a good process model for risk managers to contemplate. Ask yourself and your staff:
Severe and intense threats are usually associated with dramatic weather events, terrorist attacks, earthquakes, nuclear accidents and such like. When one of these types of threats is thought to be immanent, people will often cooperate with a cooperative ERM scheme, if one is offered. But when the threat actually happens, there are four possible responses: cooperation with disaster plan, becoming immobilized and ignoring the disaster, panic and anti-social advantage taking. Disaster planning sometimes goes no further than developing a path for people with the first response. A full disaster plan would need to take into account all four reactions. Plans would be made to deal with the labile and panicked people and to prevent the damage from the anti-social. In businesses, a business continuity or disaster plan would fall into this category of activity.
When businesses do a first assessment, risks are often displayed in four quadrants: Low Likelihood/Low Severity; Low Likelihood/High Severity; High Likelihood/Low Severity; and High Likelihood/High Severity. It is extremely difficult to survive if your risks are High Likelihood/High Severity, so few businesses find that they have risks in that quadrant. So businesses usually only have risks in this category that are Low Likelihood.
Highly Cooperative mode of Risk Management means that everyone is involved in risk management because you need everyone to be looking out for the threats. This falls apart quickly if your threats are not Severe and Intense because people will question the need for so much vigilance.
Highly Complex threats usually come from the breakdown of a complex system of some sort that you are counting upon. For an insurer, this usually means that events that they thought had low interdependency end up with a high correlation. Or else a new source of large losses emerges from an existing area of coverage. Other complex threats that threaten the life insurance industry include the interplay of financial markets and competing products, such as happened in the 1980’s when money market funds threatened to suck all of the money out of insurers, or in the 1990’s the variable products that decimated the more traditional guaranteed minimum return products.
In addition, financial firms all create their own complex threat situations because they tend to be exposed to a number of different risks. Keeping track of the magnitude of several different risk types and their interplay is itself a complex task. Without very complex risk evaluation tools and the help of trained professionals, financial firms would be flying blind. But these risk evaluation tools themselves create a complex threat.
Highly Organized mode of Risk Management means that there are many very different specialized roles within the risk management process. May have different teams doing risk assessment, risk mitigation and assurance, for each separate threat. This can only make sense when the rewards for taking these risks is large because this mode of risk management is very expensive.
Highly Unpredictable Threats are common during times of transition when a system is reorganizing itself. “Uncertain” has been the word most often used in the past several years to describe the current environment. We just are not sure what will be hitting us next. Neither the type of threat, the timing, frequency or severity is known in advance of these unpredictable threats.
Businesses operating in less developed economies will usually see this as their situation. Governments change, regulations change, the economy dips and weaves, access to resources changes abruptly, wars and terrorism are real threats.
Highly Adaptable mode of Risk Management means that you are ready to shift among the other three modes at any time and operate in a different mode for each threat. The highly adaptable mode of risk management also allows for quick decisions to abandon the activity that creates the threat at any time. But taking up new activities with other unique threats is less of a problem under this mode. Firms operating under the highly adaptive mode usually make sure that their activities do not all lead to a single threat and that they are highly diversified.
Benign Threats are things that will never do more than partially reduce earnings. Small stuff. Not good news, but not bad enough to lose any sleep over.
Low Cooperation mode of Risk Management means that individuals within their firm can be separately authorized to undertake activities that expand the threats to the firm. The individuals will all operate under some rules that put boundaries around their freedom, but most often these firms police these rules after the action, rather than with a process that prevents infractions. At the extreme of low cooperation mode of risk management, enforcement will be very weak.
For example, many banks have been trying to get by with a low cooperation mode of ERM. Risk Management is usually separate and adversarial. The idea is to allow the risk takers the maximum degree of freedom. After all, they make the profits of the bank. The idea of VaR is purely to monitor earnings fluctuations. The risk management systems of banks had not even been looking for any possible Severe and Intense Threats. As their risk shifted from a simple “Credit” or “Market” to very complex instruments that had elements of both with highly intricate structures there was not enough movement to the highly organized mode of risk management within many banks. Without the highly organized risk management, the banks were unable to see the shift of those structures from highly complex threats to severe and intense threats. (Or the risk staff saw the problem, but were not empowered to force action.) The low cooperation mode of risk management was not able to handle those threats and the banks suffered large losses or simply collapsed.
A question posed to RISKVIEWS:
Do you have a clear distinction between “What’s Risk vs What’s Actuarial?” It seems that the roles of Risk Management and Actuarial are utterly intertwined and overlapping, thus causing utter confusion, within the company of my employ. While we have internally agreed to a segregation of duties over two years ago, the organization has barely moved forward to align itself accordingly.
Any attempt I have made to seek external guidance has not resulted in any definitive clarity. In response to the question “What’s Risk vs What’s Actuarial?”, most consultants offer “it depends on the company”. Solvency II guidance seems to indiscriminately interchange, say, risk management function (risk management is everyone’s job) with Risk Management Department.
I should clarify – when I refer to Actuarial, I am referring to “all four legs of the actuarial stool” – namely, Pricing, Modeling/Projections, Valuation, and Experience Studies.
In fact, it really does depend upon the company. That is because actuarial roles are extremely broad in some companies and very narrow in others.
The four legs of the actuarial stool referenced, “Pricing, Modeling/Projections, Valuation, and Experience Studies” are in fact a moderately broad definition. In the most narrowly drawn situations, the actuarial role is limited solely to situations where an actuarial opinion is required by law or regulation. In companies that define the actuarial role in that manner, there is almost no overlap with the Risk function.
But Risk can be defined differently in different companies as well. In some companies, the definition of the Risk function takes in only what is needed to get capital relief from regulators or rating agencies. Or to satisfy other requirements of the same audiences.
In companies where both the Actuarial and Risk roles are broadly defined, there is great potential for overlap.
Some of the conflict is a matter of competition between the leader of a “new” function within the firm and the leader of an “old” function. The firms where this conflict is the worst would be the firms where there is a broadly defined Actuarial and Risk function. The development of a new Risk function in these firms can be interpreted as Actuarial losing influence. This perception would add to the conflict and to the confusion. Risk will want to control its own destiny, so would naturally want to control much of what had “always” been Actuarial. Actuarial would not want to lose any responsibility and may therefore seek to maintain parallel activities even where Risk is now performing a former Actuarial function.
At the other extreme, a number of companies see the very high degree of overlap between the Actuarial function and the Risk function and have named their Chief Actuary to be their Chief Risk Officer. The success of that approach will depend upon the degree to which the Chief Actuary is willing to appropriately prioritize the activities needed to support the new responsibilities. In these cases, the conflict described above between Risk and Actuarial will take place, but a large part of it will be inside the Chief Actuary / CRO’s head.
“We believe that effective risk management is critical to the success of our business and is the responsibility of all of our employees. All of our employees are risk managers. Employees are expected and encouraged to escalate incidents and any matters of concern to management and to our compliance and risk departments in order to effectively manage risk. Consequently, we have established — and continue to evolve and improve — a global enterprise wide risk management framework that is intended to manage all aspects of our risks.”
This is from a 10-k. Sounds like a great declaration of risk management. And this is about the clearest example of why much more than just words are needed for risk management.
These words are from the 2011 10-K of MF Global.
Riskviews 