How do you explain the failure in risk management so glaringly exposed by the current financial crisis?
Risk management at some companies performed quite well, but many more didn’t meet expectations. I would group companies with significant failures into two camps. In one camp I would put firms that didn’t know what they didn’t know. I call these firms “risk ignorant.” They outsourced risk management to the rating agencies and relied solely on debt ratings. Or they may have used credit risk models with six or seven years of benign default data and didn’t stress tested default rates and/or housing prices, and they didn’t evaluate the interdependencies across business, market, credit and liquidity risks. In the other camp I would put firms that knew their risk exposures but didn’t do enough with that knowledge. I call these firms “risk incompetent.” They may have had more detailed and accurate analyses of their risks, but because of adverse cultures and incentives, they simply didn’t do the right things for their shareholders.
