Explain what a risk management framework involves and how risk is governed
The idea
A risk management framework does not seek to minimise risk but to take the intended risks in the intended amounts and to avoid the unintended ones. It comprises risk governance, which sets the risk tolerance at the senior level and establishes accountability; risk identification and measurement; risk infrastructure, meaning the people, data and systems; policies and processes; monitoring and reporting; and strategic risk analysis. Governance must sit above the risk-taking units, because a function reporting to those it monitors cannot constrain them.
A practice question
An executive proposes minimising every risk the firm faces. What is wrong with that as an objective?
- It would raise the capital the firm has to holdWhy not: Reducing risk lowers capital needs. The objection is that the firm would lose the return it earns for bearing risk.
- Risk and return are linked, so removing risk also removes the return - correct
- It would increase the volatility of the firm's earningsWhy not: Cutting risk would make earnings steadier, not more volatile. The problem is that it would remove the source of return.
Risk is what a firm is paid to take. A firm earns a return by taking risks, so removing all risk would remove all return. The aim of risk management is to take the intended risks in the intended amounts, and to avoid unintended ones. Minimising every risk is therefore the wrong goal. Reducing risk would lower, not raise, the capital needed and the volatility of earnings, so those are not the problem.
A harder one
Adrian Hale is reviewing the risk governance of an asset manager. The chief risk officer reports to the head of trading, whose bonus depends on the returns of the trading desks. Adrian recommends one change so that the firm's risk management framework is sound. Which change should he recommend?
- Have risk report to senior management, independent of trading - correct
- Make the head of trading responsible for approving risk limitsWhy not: This deepens the conflict. Those who take the risks and are paid for the return should not be the ones who set and police the limits on them.
- Cut the number of positions each trader may holdWhy not: A cap on positions is a control, but it does not fix the reporting line that stops the risk function being independent.
A risk management framework does not try to remove risk. It takes the intended risks in the intended amounts. Risk governance sets the risk tolerance at senior level and creates accountability. The risk function must sit above or apart from the people taking the risks. A chief risk officer who reports to a head of trading paid on returns cannot be expected to restrain them. The fix is to report to senior management or the board, independent of trading. Letting trading approve limits worsens the conflict, and capping positions leaves the reporting line unchanged.
The hardest tier
In an enterprise risk management framework, which element covers the people, systems and data used to measure exposures consistently across the whole organisation?
- Risk infrastructure - correct
- Risk governanceWhy not: Governance sets oversight, roles and risk appetite. It does not supply the systems that measure exposures.
- Risk mitigation and managementWhy not: This covers acting on risks that have been identified, such as avoiding or transferring them, and depends on the data being available first.
A risk management framework has several parts. Risk infrastructure is the people, systems and data used to measure and add up exposures across the whole organisation. Governance sets the rules, roles and how much risk is acceptable. Mitigation means acting on risks once they are known. Total exposure = Sum of exposures in every division. Example: a bank holding one borrower's loans in several divisions needs systems that add them up. Without that, nobody sees the full exposure in time to act.
In the app: 9 practice questions on this outcome, a narrated walkthrough with diagrams, spaced review that brings it back before you forget it.
Take the free diagnostic →