Looking beyond models

This article serves my point that fixation with risk models and complacency with having these models is dangerous and the results from risk models must be applied in the right context and combined with good, common sense judgement.

From the CROForum

Excerpts from http://www.croforum.org/home.ecp

What has been learnt in the light of the crisis

A good deal of the pre-crisis discussion went around the details of risk modelling. If there is one thing the crisis reinforces, it is: Risk management is much more than models. The CRO Forum believes that risk models are indispensible for managing the business.
However the risk models must be – and in many cases are already – complemented with Internal Controls, such as risk concentration limits on a notional gross and net basis, Probable Maximum Loss (PML) limits, or stress and scenario testing. Finally, there is no substitute for a deep understanding of the risks involved in the business – and for common sense.

Every crisis of this dimension is associated with fundamental changes of business
models and hence implies changes of basic parameters. Parameter values, e.g. default
probabilities and equity market stresses, which have been estimated from pre-crisis times may no longer be adequate during and maybe even after the crisis. Risk management isjust as much about preparing for what has not happened as it is for understanding and preparing for what has been experienced in the past. Stress tests and scenario planning can address the problems related to system change.


Given the huge market value losses in certain financial institutions, the CRO Forum
believes that Risk Management must be viewed as an investment into the company's
future rather than simply as a cost factor. We expect to see management and regulators
seeking to further strengthen ERM functions, resulting in growing powers and
responsibilities of CROs and their teams. Given the role of risk management as second
line of defence after line management, it is important that risk teams have the freedom
and the capability to take an independent view from business management. A word of
caution here: independence does by no means imply ignorance. We are firmly convinced that both operating units and risk management functions need a deep understanding of the business. Independence has to be supplemented by mutual understanding and respect. Hence risk management will increasingly become an integral part of the business.