Re-approaching risk management

I have been reading many good articles and write-ups on risk management that I do not know where to begin. Risk management takes priority in view of what has happened and now is as good a time as any in this organization to demonstrate, apply and implement the value of risk management.

The following are the list of articles, its excerpts and in the order of hierarchy and priority :

Setting the Tone

In the Fortune special report "What boards must do in a crisis", top consultants Ram Charan and Tom Neff say company directors have to roll up their sleeves in times like these and take a hard look at risk, targets, pay, and balance sheets.

"Boards have to spend more time thinking about the unthinkable -- scenarios that would have seemed irrational, maybe unimaginable, just a year ago. What if our lead bank disappears? What if we have a liquidity crisis? What if the Dow goes to 6,000? What if our stock keeps dropping and attracts raiders?

The other subject that boards need to focus more on is enterprise risk management. It's not just risk in the sense that banks need to focus on it, but what are the risks in our business model, what are the global risks that could affect our business? It's a holistic approach to the subject, and stress testing what we're doing."

Shaping Risk Management : Addressing qualities of risk managers, decision-making and culture

In another FT article, Personalizing Risk Management, part of a series of articles in Managing in a Downturn, a professor and executive in residence at the London Business School writes about how companies have evolved in managing risks and the shift in thinking about risk management that is required today.

"Personalisation of risk management does not mean throwing out the traditional systems and support structures. Rather, it means a subtle shift in emphasis from the management of a portfolio of risks to the underwriting of individual risk decisions. This approach is relevant across all sectors of the economy, not just to the world of financial services companies. "

The author suggests three approaches in personalizing risk management that I find has every relevance in this organization in its efforts to move forward with risk management:

1. High-quality insight. Those who make decisions require good quality information, effective analytical tools and the competence to interpret this information. But it is rare for all these things to come together. It is more likely for decisions to be made with poor insight from self-interested sources, and with the relevant information fragmented across different parts of the company. Effective personalisation of risk management is, therefore, about building a system that puts the right information into the hands of those making decisions, and then transforming that information into insight through experience.
2. Personal accountability. Effective risk management requires personal accountability, but most companies get this wrong as well. Sometimes there are too many decision makers, or the decision maker is too far removed from the action to feel any genuine responsibility. And often there is no link between the decisions taken and the rewards provided.
3. Supportive culture. The informal norms of behaviour in a company – its culture – should support the principles of high-quality insight and personal accountability. But all too often, these informal norms end up undermining the effectiveness of decision making. Some companies exhibit a fear culture where bad news is hidden from top executives; some are purely mercenary, where everyone looks out for themselves; some suffer from chronic risk aversion, with almost zero tolerance for false-positive errors.
   Of course, there is no simple way to build a supportive culture. It takes many years of consistent messages and actions from leaders. But there are, nonetheless, a couple of basic principles that can be applied.

Risk Measurement : What It Is and What It Is Not

There has been numerous debates as to the usefulness of Value-at-Risk (VaR) as a mathematical model based on statistical assumptions in predicting risk. The basic VaR model, the parametric model, relies on the extent of historical data available for a market and asset class, and for as long as you think history repeats itself, then the parametric VaR is your best indicator of what your portfolio predicted risk would be.

The nature of the financial crisis that evolved from 2007 till now has been unprecedented and as Nicholas Nassim Taleb said in a McKinsey article "my idea in The Black Swan is to make people think of the unknown and of the potency of the unknown, particularly a certain class of events that you can't imagine but can cost you a lot; rare but high-impact events." Therein lies the limitation of VaR and assuming market risk events can be represented by a probability distribution with a certain confidence level.

This article Risk Mismanagement from the New York times reinforces my overall philosophy that while VaR is a means to quantify risks, we must understand the assumptions behind VaR and certainly should never be complacent in thinking that once VaR is in place and that would represents all of our risks.

Nicholas Nassim Taleb was quoted in this article :

"Wall Street risk models, no matter how mathematically sophisticated, are bogus; indeed, he is the leader of the camp that believes that risk models have done far more harm than good. And the essential reason for this is that the greatest risks are never the ones you can see and measure, but the ones you can’t see and therefore can never measure. The ones that seem so far outside the boundary of normal probability that you can’t imagine they could happen in your lifetime — even though, of course, they do happen, more often than you care to realize. Devastating hurricanes happen. Earthquakes happen. And once in a great while, huge financial catastrophes happen. Catastrophes that risk models somehow always manage to miss."

"What he cares about, with standard VaR, is not the number that falls within the 99 percent probability. He cares about what happens in the other 1 percent, at the extreme edge of the curve. The fact that you are not likely to lose more than a certain amount 99 percent of the time tells you absolutely nothing about what could happen the other 1 percent of the time. You could lose $51 million instead of $50 million — no big deal. That happens two or three times a year, and no one blinks an eye. You could also lose billions and go out of business. VaR has no way of measuring which it will be. "

Gregg Berman of RiskMetrics posits differently :

"Obviously, we are big proponents of risk models,” he said. “But a computer does not do risk modeling. People do it. And people got overzealous and they stopped being careful. They took on too much leverage. And whether they had models that missed that, or they weren’t paying enough attention, I don’t know. But I do think that this was much more a failure of management than of risk management. I think blaming models for this would be very unfortunate because you are placing blame on a mathematical equation. You can’t blame math."

Richard Bookstaber :

"Richard Bookstaber, a hedge-fund risk manager and author of “A Demon of Our Own Design,” ranted about VaR for a half-hour over dinner one night. Then he finally said, “If you put a gun to my head and asked me what my firm’s risk was, I would use VaR.” VaR may have been a flawed number, but it was the best number anyone had come up with."

The NYT article is a good for all risk managers to understand what VaR represents and its limitations with quotes from proponents and dissenters of VaR. Read on.

Increasing Interest in Risk Management by CFOs

Financial Crisis Intensifies Interest in Risk Management Among CFOs was a survey commisioned by Towers Perrin to CFO Research Services, an affiliate of The Economist and CFO magazine, to gain insights on how companies view the seriousness of the financial crisis for their businesses.

For a complete view of the results of the survey and findings, please click here

According to Towers Perrin website, the findings that stand out are :

• Only 4% of respondents perceived the recent financial market meltdown as having a severe impact on their financial prospects. Although the majority acknowledged that the crisis would dampen profit expectations and leave a potentially lasting dent in the world economy, only five respondents feared a major negative impact on their financial results.
• Nonetheless, approximately 72% of respondents expressed concern about their own companies' risk management practices and ability to meet strategic plans. This suggests that finance executives, regardless of industry, perceive a need to invest in more effective risk identification, measurement and management procedures.
• In a related finding, a sizable minority (42%) foresaw more energized involvement by boards of directors in risk management policies, processes and systems, and a comparable minority foresaw intensified employee-level engagement.
• 61% expressed concern about raising short-term capital — a sobering percentage of the executives surveyed but hardly surprising given ballooning spreads in the commercial paper market.

Risk management practices on the top of the agenda for many CFOs

It is interesting that, despite the evident impact of the current financial crisis on liquidity and consumer confidence, more than half (55%) of the CFOs agree that they plan to put their risk management practices under a microscope and that this investigation will in many instances reach all levels of the organization, from the board down and from the shop floor up.
What Standard & Poor's stated so plainly when it announced the inclusion earlier this year of an explicit ERM component in its rating of corporate securities is echoed by America's leading finance executives: Effective risk management depends on effective risk culture — i.e., genuine awareness and control of risk throughout the organization, and genuine line-of-sight accountability.

FSA 2009 Financial Risk Outlook

The Financial Services Authority (FSA), the British financial services regulator, published its 2009 Financial Risk Outlook. For those who wish to read the 90 page report, please click here

The 2009 report, according to the Foreword, has a different structure in consideration of "the scale of the financial crisis and the uncertainty over the future of the financial system, in particular the banking system" and in view of the increased regulatory policies to contain financial risks.

There were key messages that are listed at the end of each section and I would like to draw attention to a few that I think bears relevance to this organization.

• Setting the tone Senior Management should ensure appropriate risk management is undertaken and that there is a clear understanding of the underlying risks to their business model, particularly risks associated with complex hedging strategies. Firms need to satisfy themselves that key risks are appropriately managed and continually re-assessed as financial market and economic conditions evolve.
• Measurement Stress testing and scenario analysis should form an integral part of firms’ risk management, business strategy and capital planning decisions. It is of particular importance in this unpredictable environment, when the financial sector is vulnerable to further shocks, that firms also consider the implications of deteriorating economic conditions and the long-term viability of and weaknesses present in their business models. In addition, the financial sector and economy will also remain vulnerable to potential shocks, such as a large-scale terrorist attack. Firms should continue to consider such risks in their business planning to ensure effective plans are in place for dealing with these shocks.
• Liquidity Risk Firms need to be aware of the vulnerabilities of their capital arising from the closure of individual markets and ensure that they have diversified funding channels and a varied investor base within each funding source. They also need a clear understanding of the availability of liquid assets which could be converted to cash if funding is suddenly unavailable, and the extent of their over-reliance on such ‘liquidity through marketability’. Many financial institutions continue to face liquidity pressures. Firms
  need to manage liquidity risk to ensure any gaps are filled by appropriate funding strategies. Internal risk management of liquidity issues needs to be addressed and reported effectively.
• Risk Management Is A Business Strategy Strategies need to be underpinned by strong risk management systems and controls for all areas of risk: credit; market and operational risk; conduct of business risks; compliance with relevant rules, codes and standards; and managing risks of fraud and financial crime.
• Do Your Own Due Diligence As a credit rating represents only one opinion on the creditworthiness of a particular product, a rating should not replace appropriate due diligence. Investors should assess how much reliance is appropriate to attach to the ratings produced by third parties, in light of rating performance and other forms of risk assessment relevant for the security concerned. Factors such as liquidity risk and price volatility can be as important in making an appropriate decision, and should be considered alongside other relevant indicators regarding the creditworthiness of an investment. (Refer to previous posting on Lloyd Blankfein and the similarities)
• Valuation Controls Systems and controls should also be in place to manage valuation difficulties and to ensure that questionable prices are identified. Appropriate governance procedures are also important when using non-independently sourced values.
• Disclosures To enhance market confidence, it is important that firms provide sufficient disclosures about the key judgements and uncertainties concerning valuations and any reclassifications in the accounts.

Lloyd Blankfein on Lessons Learnt

Much has been said about the financial crisis and the lessons that we should learn from the crisis.

Lloyd Blankfein, the CEO of Goldman Sachs, provided his opinion in the Comment section of FT here.

The lessons learnt :

Lesson #1 Risk management should not be entirely predicated on historical data. In the past several months, we have heard the phrase “multiple standard deviation events” more than a few times. If events that were calculated to occur once in 20 years in fact occurred much more regularly, it does not take a mathematician to figure out that risk management assumptions did not reflect the distribution of the actual outcomes. Our industry must do more to enhance and improve scenario analysis and stress testing.

Lesson #2 Too many financial institutions and investors simply outsourced their risk management. Rather than undertake their own analysis, they relied on the rating agencies to do the essential work of risk analysis for them. This was true at the inception and over the period of the investment, during which time they did not heed other indicators of financial deterioration.

Lesson #3 Size matters. For example, whether you owned $5bn or $50bn of (supposedly) low-risk super senior debt in a CDO, the likelihood of losses was, proportionally, the same. But the consequences of a miscalculation were obviously much bigger if you had a $50bn exposure.

Lesson#4 Many risk models incorrectly assumed that positions could be fully hedged. After the collapse of Long-Term Capital Management and the crisis in emerging markets in 1998, new products such as various basket indices and credit default swaps were created to help offset a number of risks. However, we did not, as an industry, consider carefully enough the possibility that liquidity would dry up, making it difficult to apply effective hedges.

Lesson #5 Risk models failed to capture the risk inherent in off-balance sheet activities, such as structured investment vehicles. It seems clear now that managers of companies with large off-balance sheet exposure did not appreciate the full magnitude of the economic risks they were exposed to; equally worrying, their counterparties were unaware of the full extent of these vehicles and, therefore, could not accurately assess the risk of doing business.

Lesson #6 Complexity got the better of us. The industry let the growth in new instruments outstrip the operational capacity to manage them. As a result, operational risk increased dramatically and this had a direct effect on the overall stability of the financial system.

Lesson #7 Perhaps most important, financial institutions did not account for asset values accurately enough. I have heard some argue that fair value accounting – which assigns current values to financial assets and liabilities – is one of the main factors exacerbating the credit crisis. I see it differently. If more institutions had properly valued their positions and commitments at the outset, they would have been in a much better position to reduce their exposures.

For Goldman Sachs, the daily marking of positions to current market prices was a key contributor to our decision to reduce risk relatively early in markets and in instruments that were deteriorating.

For the industry, we cannot let our ability to innovate exceed our capacity to manage. Given the size and interconnected nature of markets, the growth in volumes, the global nature of trades and their cross-asset characteristics, managing operational risk will only become more important.

Risk and control functions need to be completely independent from the business units. And clarity as to whom risk and control managers report to is crucial to maintaining that independence. (Cannot be emphasized enough)

Equally important, risk managers need to have at least equal stature with their counterparts on the trading desks: if there is a question about the value of a position or a disagreement about a risk limit, the risk manager’s view should always prevail. (The heart of any risk governance)

More generally, we should apply basic standards to how we compensate people in our industry. The percentage of the discretionary bonus awarded in equity should increase significantly as an employee’s total compensation increases. An individual’s performance should be evaluated over time so as to avoid excessive risk-taking. To ensure this, all equity awards need to be subject to future delivery and/or deferred exercise. Senior executive officers should be required to retain most of the equity they receive at least until they retire, while equity delivery schedules should continue to apply after the individual has left the firm.

For policymakers and regulators, it should be clear that self-regulation has its limits. We rationalised and justified the downward pricing of risk on the grounds that it was different. We did so because our self-interest in preserving and expanding our market share, as competitors, sometimes blinds us – especially when exuberance is at its peak. At the very least, fixing a system-wide problem, elevating standards or driving the industry to a collective response requires effective central regulation and the convening power of regulators.

Capital, credit and underwriting standards should be subject to more “dynamic regulation”. Regulators should consider the regulatory inputs and outputs needed to ensure a regime that is nimble and strong enough to identify and appropriately constrain market excesses, particularly in a sustained period of economic growth. Just as the Federal Reserve adjusts interest rates up to curb economic frenzy, various benchmarks and ratios could be appropriately calibrated. To increase overall transparency and help ensure that book value really means book value, regulators should require that all assets across financial institutions be similarly valued. Fair value accounting gives investors more clarity with respect to balance sheet risk.

The level of global supervisory co-ordination and communication should reflect the global inter-connectedness of markets. Regulators should implement more robust information sharing and harmonised disclosure, coupled with a more systemic, effective reporting regime for institutions and main market participants. Without this, regulators will lack essential tools to help them understand levels of systemic vulnerability in the banking sector and in financial markets more broadly.

Reinforcing skills required in risk management

Time and time again I have reinforced my views on what it takes to be a risk manager (not what it takes to build capability in risk management)

1. Possess the visionary in where risk management should be and the depth required to ensuring "the trains work and arrive on time".
2. Having a bigger picture of the organizational direction and the role of risk management in the organization.
3. Recognize risk management trends that impacts how risk management is implemented in this organization
4. Process-oriented in the application of risk frameworks, policies, controls and implementation and principle driven in applying risk management in the corporate context
5. Analytical capabilities in understanding the business, how risks arises and the drivers of risk (both market and internal drivers), identifying risks, how risk impact the business from strategic, tactical and operational perspective, the risk return trade off in business decision-making and prescribing practical risk management solutions

Changing perceptives on risk management

In implementing integrated financial risk management, senior management's view of risk management shapes the risk management thinking and culture throughout the organization. Key to this is a consistent message about the importance of risk management and changing perceptions regarding risk management.

The benefits of risk management is not clear throughout the organization resulting into inconsistent interpretation of the value proposition of risk management. The recent financial crisis has somewhat provided the impetus for pockets of people, entities or business units within this organization to consider risks in their businesses or where financial risks complacency existed, financial risks became a priority in their management radar. This is evidenced by the multitude of financial risk advisory and guidance that has been sought from us in the past 6 months, with market risk and counter-party risks as their top risk management concern.

This development that came about arising from the financial crisis is indeed a positive development in that businesses are realizing the importance of understanding how risks impact their businesses and makes efforts to manage these risks. In my view, these developments still fall short of what constitutes an effective risk management practice.

In this posting, I will attempt to list key risk management concept and ideas that I believe will shape the organization's thinking on the value proposition risk management brings and the practice of risk management.

Understanding the value proposition of risk management

Based on our experience in implementing integrated financial risk management, there are still companies that think of risk management as compliance and that risk management will stop businesses from expanding because their view is that risk management is risk aversion. There are also companies flush with cash that believes managing risks does not apply to them. Why manage risks when we have survived all these years without having the governance, framework and discipline of risk management in place?

These are dangerous mindsets because as I mentioned earlier, the practice of risk management is shaped by how senior management perceives it to be. Key to this is consistent message on risk management value proposition. Risk management (more so ERM), when designed comprehensively especially in a large organization is not just about having in place a process to protect businesses from setbacks, it enables better business performance by prioritizing risks that businesses want to reduce and risks that businesses want to profit from. With the uncertainty facing businesses in 2009, particularly brought about by economic uncertainty, subsidiaries and businesses should jump at the opportunity to leverage on the strengths of a risk management program in having a total view of its risks and knowing how these risks will impact their business growth strategies.

Credit Crunch : A Practical Guide

For those who are interested, I found this guide reinforcing or sharing our viewpoints in managing risks arising from the crisis.

Read on.

This hands-on booklet, The Credit Crunch: A Practical Guide, provides an explanation of some of the recent major financial events and an assessment of how they may affect the typical business. The guide also lays out 10 action items to consider as businesses manage through the crisis

http://www.boardmember.com/media/files/risk-mgmt-pdfs/TheCreditCrunch_GrantThornton.pdf

Integrated Financial Risk Management (IFRM) notes

IFRM Guidelines content

• Reference to the principles in the appropriate sections in CFP - principles of oversight and transparency
• Building on existing practices in the organization i.e. the risk organization in each entity, and identify governance improvements based on the compliance checklist i.e. risk tolerance levels as an agreed consensus by an entity's Board, the adequacy of risk management design and effectiveness of internal controls over financial risk
• Widely recognized principles in risk management - what are they? Leveraging risk management in light of the financial crisis and its impact
• What is the current baseline risk management practice in general, and financial risk management practice in particular?
• Lessons learnt in the CFP roll-out and differing risk management practices
• Integration of financial risks - where financial risks are embedded into key decision-making i.e.supply chain risk management, contractor risk assessment, project risk assessment
• Common tools and methodologies in risk assessment, risk compliance, risk measurement

To be continued

A Modeling Manifesto Now?

A spectre is haunting Markets – the spectre of illiquidity, frozen credit, and the failure of financial models.
Beginning with the 2007 collapse in subprime mortgages, financial markets have shifted to new regimes characterized by violent movements, epidemics of contagion from market to market, and almost unimaginable anomalies (who would have ever thought that swap spreads to Treasuries could go negative?). Familiar valuation models have become increasingly unreliable. Where is the risk manager that has not ascribed his losses to a once-in-a-century tsunami?
To this end, we have assembled in New York City and written the following manifesto.

Manifesto

In finance we study how to manage funds – from simple securities like dollars and yen, stocks and bonds to complex ones like futures and options, subprime CDOs and credit default swaps. We build financial models to estimate the fair value of securities, to estimate their risks and to show how those risks can be controlled. How can a model tell you the value of a security? And how did these models fail so badly in the case of the subprime CDO market?
Physics, because of its astonishing success at predicting the future behavior of material objects from their present state, has inspired most financial modeling. Physicists study the world by repeating the same experiments over and over again to discover forces and their almost magical mathematical laws. Galileo dropped balls off the leaning tower, giant teams in Geneva collide protons on protons, over and over again. If a law is proposed and its predictions contradict experiments, it's back to the drawing board. The method works. The laws of atomic physics are accurate to more than ten decimal places.

It's a different story with finance and economics, which are concerned with the mental world of monetary value. Financial theory has tried hard to emulate the style and elegance of physics in order to discover its own laws. But markets are made of people, who are influenced by events, by their ephemeral feelings about events and by their expectations of other people's feelings. The truth is that there are no fundamental laws in finance. And even if there were, there is no way to run repeatable experiments to verify them.

You can hardly find a better example of confusedly elegant modeling than models of CDOs. The CDO research papers apply abstract probability theory to the price co-movements of thousands of mortgages. The relationships between so many mortgages can be vastly complex. The modelers, having built up their fantastical theory, need to make it useable; they resort to sweeping under the model's rug all unknown dynamics; with the dirt ignored, all that's left is a single number, called the default correlation. From the sublime to the elegantly ridiculous: all uncertainty is reduced to a single parameter that, when entered into the model by a trader, produces a CDO value. This over-reliance on probability and statistics is a severe limitation. Statistics is shallow description, quite unlike the deeper cause and effect of physics, and can't easily capture the complex dynamics of default.

Models are at bottom tools for approximate thinking; they serve to transform your intuition about the future into a price for a security today. It's easier to think intuitively about future housing prices, default rates and default correlations than it is about CDO prices. CDO models turn your guess about future housing prices, mortgage default rates and a simplistic default correlation into the model's output: a current CDO price.

Our experience in the financial arena has taught us to be very humble in applying mathematics to markets, and to be extremely wary of ambitious theories, which are in the end trying to model human behavior. We like simplicity, but we like to remember that it is our models that are simple, not the world.
Unfortunately, the teachers of finance haven't learned these lessons. You have only to glance at business school textbooks on finance to discover stilts of mathematical axioms supporting a house of numbered theorems, lemmas and results. Who would think that the textbook is at bottom dealing with people and money? It should be obvious to anyone with common sense that every financial axiom is wrong, and that finance can never in its wildest dreams be Euclid. Different endeavors, as Aristotle wrote, require different degrees of precision. Finance is not one of the natural sciences, and its invisible worm is its dark secret love of mathematical elegance and too much exactitude.

We do need models and mathematics – you cannot think about finance and economics without them – but one must never forget that models are not the world. Whenever we make a model of something involving human beings, we are trying to force the ugly stepsister's foot into Cinderella's pretty glass slipper. It doesn't fit without cutting off some essential parts. And in cutting off parts for the sake of beauty and precision, models inevitably mask the true risk rather than exposing it. The most important question about any financial model is how wrong it is likely to be, and how useful it is despite its assumptions. You must start with models and then overlay them with common sense and experience.

Many academics imagine that one beautiful day we will find the 'right' model. But there is no right model, because the world changes in response to the ones we use. Progress in financial modeling is fleeting and temporary. Markets change and newer models become necessary. Simple clear models with explicit assumptions about small numbers of variables are therefore the best way to leverage your intuition without deluding yourself.

All models sweep dirt under the rug. A good model makes the absence of the dirt visible. In this regard, we believe that the Black-Scholes model of options valuation, now often unjustly maligned, is a model for models; it is clear and robust. Clear, because it is based on true engineering; it tells you how to manufacture an option out of stocks and bonds and what that will cost you, under ideal dirt-free circumstances that it defines. Its method of valuation is analogous to figuring out the price of a can of fruit salad from the cost of fruit, sugar, labor and transportation. The world of markets doesn't exactly match the ideal circumstances Black-Scholes requires, but the model is robust because it allows an intelligent trader to qualitatively adjust for those mismatches. You know what you are assuming when you use the model, and you know exactly what has been swept out of view.

Building financial models is challenging and worthwhile: you need to combine the qualitative and the quantitative, imagination and observation, art and science, all in the service of finding approximate patterns in the behavior of markets and securities. The greatest danger is the age-old sin of idolatry. Financial markets are alive but a model, however beautiful, is an artifice. No matter how hard you try, you will not be able to breathe life into it. To confuse the model with the world is to embrace a future disaster driven by the belief that humans obey mathematical rules.

MODELERS OF ALL MARKETS, UNITE! You have nothing to lose but your illusions.
The Modelers' Hippocratic Oath
~ I will remember that I didn't make the world, and it doesn't satisfy my equations.
~ Though I will use models boldly to estimate value, I will not be overly impressed by mathematics.
~ I will never sacrifice reality for elegance without explaining why I have done so.
~ Nor will I give the people who use my model false comfort about its accuracy. Instead, I will make explicit its assumptions and oversights.
~ I understand that my work may have enormous effects on society and the economy, many of them beyond my comprehension.

The Approach in Setting Risk Appetite

Coming soon

Lessons Learnt in 2008 and Looking Ahead in 2009

Happy 2009 to everyone and Good-Bye 2008!

I doubt if any risk manager would or could have anticipated the extent of events that had unfolded in 2008. I certainly didn't, and most of us in oil and gas, cushioned by crude oil prices reaching new highs, felt we were insulated by what really began in as early as 2007. I think we are all still reeling from the impact of events as we navigate ourselves, in our personal and professional capacities, to steer the ship to ride this storm.

What was unimaginable happened and having experienced this organization's weathering through the 1998 Asian Crisis and the 2008 Credit Crisis, these crises ultimately in my view, will have long term implications in shaping the practice of risk management.

There will be a series of risk management areas that I will be writing this year focussing on scrutinizing our own risk management practices and what we should be doing in shaping the practice of risk management in this organization.

I would like to begin with the topic of risk governance. Risk governance is the key element in risk management that sets the foundation for the remaining key elements. It is the glue that holds together the remaining elements in risk management. Without risk governance our efforts in risk management becomes futile.

What is risk governance? When we mention risk governance, we conjure images of risk management structure, principles of independence, creating a risk culture, developing risk capabilities etc. While these are crucial elements in risk governance, I am of the view that at the core of risk governance is that risk management must be given equal seat in any business decision-making process and treated at par with the growth and profitability strategies.

In the past risk management is treated as a process that each business activity or strategy undertakes to perform, identifying potential risk events and potential mitigation strategies and typically takes place in the form of workshops and templates. Unfortunately, the good intentions of these processes gives us a false picture or assurance that the risks are always mitigated. Now the reason I say that is

• Who monitors the effectiveness of such mitigation strategies?
• Who monitors the appropriateness of such mitigation strategies in the event of a stressed situation?
• Who re-evaluates whether the risk events and therefore its risk mitigation approaches and strategies are still relevant to the current situation? How quick do we respond to a certain risk event?
• Who executes the risk mitigation strategy? Given the multi-disciplinary experts required to manage such risks, who coordinates these collaborative approaches?
• Are our risk management talent empowered in a way that they have the ability to say "No" and business decision-makers pay heed to risk management because they bring value to the discussion table?

Who holds the answer to these questions depends on the risk governance approach and design of the organization.

• Is the risk culture pervasive enough that each business will be able to monitor the impact of risk events and trigger a chain of command to respond appropriately?
• Is there a risk management function at the business level that will work closely with the business decision-makers and act as an enabler to manage such risks?
• Or is there a role for those in Enterprise Wide Risk to play an intervention role when a risk event is triggered and before an action is taken, the impact to the Group is quickly assessed, rather than making a marginal business decision?

To be continued

Top Risk Management Concerns

This was apparently a survey done by the Conference Board that highlights the top 5 concerns among executives world-wide and I find similarities in listing our top concerns as we assessed the impact of the financial crisis to this organization culminating in our common concerns across all businesses :

1. Economic slowdown


2. Project/CAPEX spending


3. Customer


4. Supplier


5. Financial (which includes liquidity, counter-party, FX and interest rate risks)

The Year 2008 for FRM

It has been a busy year for all of us here in this division and nonetheless, for the FRM team. The FRM team has, against all odds,

• multitasked
• managed projects
• coordinating cross-departmental analysis
• responding quickly to demanding clients
• responding to the financial crisis
• co-operated in divisional initiatives in good spirits
• asserting their opinions where they have to, having a firm stand on principles, taking the lead in initiatives and tasks, taking the lead in discussions

achieving many incremental steps and giant leaps that makes me proud to have had the opportunity to work with you and learn from you in that process.

The year 2008 is also the year where we welcomed new members to FRM : Ghaf, Fiza, Nabil, Emylia, Eyna and Maheran. Your learning curve has been steep, I know, but you are all achievers and you bravely responded to all the challenges that a new organization brings about.

This year we also saw team members leave for the better : Wis2 to TBS, Idah to A&O, Tris to FI and Rita to Group Risk. I thank you for your contributions to FRM and I hope the FRM experience will be of value to you throughout your career, wherever that may be in future.

Which leaves the old timers, Haslina, Ray2, and Seed (even though Ray2 and Seed to their benefit is not as old a timer as Haslina) : How can I describe you? Steadfast, guardian, mentor, guiding and coaching, persistent, challenge the conventional, thought partners to your colleagues, you have been there for the new team members and you held your own, too, with the work stuff that lands on your desk from within and externally.

Thank you to Elie for your unwavering support to me and the team. Thank you.

So with that I leave you these quotes :

For new team members :

Coming together is a beginning. Keeping together is progress. Working together is success.

For those who have left us :

You are what you think. You are what you go for. You are what you do!

And for Haslina, Ray2 and Seed :

A difficult time can be more readily endured if we retain the conviction that our existence holds a purpose - a cause to pursue, a person to love, a goal to achieve.

And to all,

A true measure of your worth includes all the benefits others have gained from your success.

I certainly have gained experience and knowledge from the FRM team's achievements especially this year where it has been challenging for all of us!

Happy New Year and happy year end holidays to all!

Looking beyond models

This article serves my point that fixation with risk models and complacency with having these models is dangerous and the results from risk models must be applied in the right context and combined with good, common sense judgement.

From the CROForum

Excerpts from http://www.croforum.org/home.ecp

What has been learnt in the light of the crisis

A good deal of the pre-crisis discussion went around the details of risk modelling. If there is one thing the crisis reinforces, it is: Risk management is much more than models. The CRO Forum believes that risk models are indispensible for managing the business.
However the risk models must be – and in many cases are already – complemented with Internal Controls, such as risk concentration limits on a notional gross and net basis, Probable Maximum Loss (PML) limits, or stress and scenario testing. Finally, there is no substitute for a deep understanding of the risks involved in the business – and for common sense.

Every crisis of this dimension is associated with fundamental changes of business
models and hence implies changes of basic parameters. Parameter values, e.g. default
probabilities and equity market stresses, which have been estimated from pre-crisis times may no longer be adequate during and maybe even after the crisis. Risk management isjust as much about preparing for what has not happened as it is for understanding and preparing for what has been experienced in the past. Stress tests and scenario planning can address the problems related to system change.


Given the huge market value losses in certain financial institutions, the CRO Forum
believes that Risk Management must be viewed as an investment into the company's
future rather than simply as a cost factor. We expect to see management and regulators
seeking to further strengthen ERM functions, resulting in growing powers and
responsibilities of CROs and their teams. Given the role of risk management as second
line of defence after line management, it is important that risk teams have the freedom
and the capability to take an independent view from business management. A word of
caution here: independence does by no means imply ignorance. We are firmly convinced that both operating units and risk management functions need a deep understanding of the business. Independence has to be supplemented by mutual understanding and respect. Hence risk management will increasingly become an integral part of the business.

Managing in the Downturn : Boosting liquidity

Summary of the Economist article

Drivers

• Faced with huge difficulties of their own, banks have tightened their purse strings, lending less and driving up the cost of credit to consumers and corporations.
• Opinions differ as to how long and deep the global slowdown might be. But the combination of a battered banking system and shell-shocked consumers mired in debt suggests it could be particularly hard for many businesses, whatever the duration.
• For the foreseeable future, bank credit is likely to be harder to come by and will certainly be more expensive than when the financial crisis began.

Cash boosting strategy

• Companies have tapped new pools of capital, like sovereign-wealth funds, to bolster their finances. In July GE, an American conglomerate, set up an $8 billion, 50-50 joint venture with Mubadala, an investment arm of Abu Dhabi, to invest in areas such as clean energy and aviation.
• Sell businesses no longer central to a firm’s strategy. Although prices for corporate assets have been depressed by the downturn, this has not deterred some companies from putting them up for auction. This week, for instance, GM and Ford sold shares in Suzuki and Mazda respectively. By selling their stakes back to the Japanese firms, the American carmakers raised a total of $770m of badly needed liquidity.
• Letting less cash go out of the door. Several big companies including Alcoa, an American aluminium giant, Target, an American discount retailer, and AkzoNobel, a Dutch firm that makes paint and specialty chemicals, have recently cancelled plans to buy back shares using what was previously viewed as excess cash. Companies are starting to trim dividends too, though this will be unpopular with investors expecting a regular stream of income.
• Stretching out the payments on bank debt can also preserve cash. And firms should look out for opportunities to refinance existing loans early to give themselves greater financial flexibility.
• Put under the microscope a company's working capital, or the cash that gets tied up in day-to-day operations. “The first place to look for this money is in a firm’s inventory,” says Wayne Mincey, Hackett’s chief operating officer. All too often, poor sales forecasting and production planning mean that a lot of cash ends up trapped in a company’s warehouses in the form of unwanted products.

Oil and Gas News

Petrobras Bullish on Outlook for New Fields
http://www.ft.com/cms/s/0/00aa90ae-c7a6-11dd-b611-000077b07658.html

ExxonMobil to Invest in Refinery Expansion
http://www.ft.com/cms/s/0/27f2a81c-cb12-11dd-87d7-000077b07658.html

BP's Hopes for China Oil Growth
http://www.ft.com/cms/s/0/7646930e-c728-11dd-97a5-000077b07658.html

Reduced oil spending

From the plains of North Dakota to the deep waters of Brazil, dozens of major oil and gas projects have been suspended or canceled in recent weeks as companies scramble to adjust to the collapse in energy markets.

In the short run, falling oil prices are leading to welcome relief at the pump for American families ahead of the holidays, with gasoline down from its summer record of just over $4 to an average of $1.66 a gallon, and still falling.

But the project delays are likely to reduce future energy supplies — and analysts believe they may set the stage for another surge in oil prices once the global economy recovers.
Oil markets have had their sharpest-ever spikes and their steepest drops this year, all within a few months. Now, with a global recession at hand and oil consumption falling, the market’s extreme volatility is making it harder for energy executives to plan ahead. As a result, exploration spending, which had risen to a record this year, is being slashed.

The precipitous drop in oil prices since the summer, coming on the heels of a dizzying seven-year rise, was a reminder that the oil business, like those of most commodities, is cyclical. When demand drops and prices fall, companies curb their investments, leading to lower supplies. When demand recovers, prices rise again and companies start to invest in new production, starting another cycle.

As familiar as the pattern may be, the changes this time are taking place at record speed. In June, some analysts were forecasting oil at $200 a barrel and companies were scouring the earth for new places to drill; now, no one knows how low prices may fall.

“It’s a classic — if extraordinarily dramatic — cycle,” said Daniel Yergin, chairman of Cambridge Energy Research Associates and author of “The Prize,” a history of the oil business. “Prices have come down so far and so fast, it’s become a shock to the supply system.”

The list of projects delayed is growing by the week. Wells are being shut down across the United States; new refineries have been postponed in Saudi Arabia, Kuwait and India; and ambitious plans for drilling off the coast of Africa are being reconsidered.

Investment in alternative energy sources like biofuels that had flourished in recent years could dry up if prices stay low for the next few years, analysts said. Banks have become reluctant lenders, especially to renewable energy projects that may prove unprofitable in an era of low oil and gas prices.
These delays could curb future global fuel supplies by the equivalent of four million barrels a day within the next five years, according to Peter Jackson, an energy analyst at Cambridge Energy Research Associates. That is equal to 5 percent of current oil supplies.

One reason projects are being shut down so fast is that costs throughout the industry, which had surged in recent years, are still elevated despite the drop in oil prices. Many companies are waiting for those costs to come down before deciding whether to go forward with new projects.
“The global market has been turned upside down since the summer,” the International Energy Agency, a leading energy forecaster, said in a recent report.

In today’s uncertain environment, a slowdown in spending is inevitable, according to energy executives who are devising their budgets for next year. Last year, spending on exploration and production amounted to $329 billion, according to PFC Energy, a consulting firm. That figure is certain to fall.

“We’re in remission right now,” said Marvin E. Odum, the vice president for exploration and production for Royal Dutch Shell in the Americas. But once the economy picks up, he said, “the energy challenge will come back with a vengeance.”

Oil demand growth has weakened throughout the industrial world. The International Energy Agency projects that worldwide demand will actually fall this year, for the first time since 1983.
So much surplus oil is sloshing around the world right now that some companies, including Shell, are using oil tankers for storage.

Oil prices have declined by more than $100 a barrel since July, returning to levels last seen more than four years ago. They settled at $44.51 a barrel, down $1.77, on Monday in New York, as concerns about the economy outweighed efforts by oil producers to stem the slide in prices.
Prices could drop below $30 a barrel, according to Merrill Lynch and other forecasters, if the Chinese economy slows drastically next year, which looks increasingly likely.

Different companies have different price thresholds for going forward with drilling projects. But across the industry, a price drop this big has “a dampening effect,” according to Mr. Odum of Shell. “The big uncertainty is how long this economic environment is going to last.”

The biggest cutbacks so far have been in heavy oil projects in Canada, where some of the world’s highest-cost production is concentrated. Some operators there need oil prices above $90 a barrel to turn a profit.

StatoilHydro, a large Norwegian company, recently pulled out of a $12 billion project in Canada because of falling prices. Similarly, Shell, Nexen and Petro-Canada have all canceled or postponed new ventures in the province of Alberta in recent weeks.

Producers are bracing for a painful contraction, and the drop in prices could crimp investments even in places where production costs are low.

The Saudi monarch, King Abdullah, recently said he considered $75 a barrel to be a “fair price.” The kingdom, which has invested tens of billions of dollars in recent years to increase production, recently announced that two new refineries, with ConocoPhillips and Total of France, were being frozen until costs go down.

In neighboring Kuwait, the government recently shelved a $15 billion project to build the country’s fourth refinery because of concerns about slowing growth in oil demand.

The list goes on:

• South Africa’s national oil company, PetroSA, on Thursday dropped plans to build a plant that would have converted coal to liquid fuel.
• The British-Russian giant TNK-BP slashed its capital expenditure budget for next year by $1 billion, for a 25 percent reduction from this year.
• In North Dakota, oil drillers are scaling back exploration of the Bakken Shale, a geological formation recently seen as promising, where production is more expensive than in conventional fields.
  “People are dropping rigs up there in a pretty significant way already,” Mark G. Papa, the chief executive of EOG Resources, a small natural gas producer, recently told an energy conference.
• Another domestic producer, Callon Petroleum, suspended a major deepwater project in the Gulf of Mexico, called Entrada, weeks before completion because of what it described as a “serious decline in project economics.”
  According to research analysts at the brokerage firm Raymond James, domestic drilling could drop by 41 percent next year as companies scale back.

“We expect operators to significantly cut their activity in the coming weeks due to the holiday season, and many of these rigs will not come back to work,” the report said.

As scores of small wells are shut down, analysts at Bernstein Research have calculated that oil production in North America could decline by 1.3 million barrels a day through 2010, or 17 percent, to 6.14 million barrels a day. This decline, rather than cuts by members of the Organization of the Petroleum Exporting Countries, “will be the catalyst needed for oil prices to rebound,” Neil McMahon, an analyst at Bernstein Research, said in a conference call this month. The United States remains the world’s largest oil consumer.

The drop in energy consumption could afford some breathing room for producers, which had been straining in recent years to match fast-rising demand. But analysts warn the world can ill afford a lengthy drop in investment in energy supplies. To meet the growth in global population and the rising affluence expected in the future, the world will need to invest $12 trillion in order to increase its oil and natural gas supplies, according to the International Energy Agency.
“If we cut back dramatically on investments, we could end up in a situation where supply growth goes flat when the economy starts to recover,” said Mr. Jackson, the analyst. “The steeper the decline, the steeper the response.”

Risk Roundtable : Rethinking Risk Management

The success (or even failure) of risk management in this organization really does depend on the specific situations in the company with its specific histories, cultures and management.

Being involved in numerous risk management efforts, discussions and debates throughout the organization, in a an advisory capacity or as a risk management practitioner, there seems to be a continuing gap in major areas of :

• what expectations are on the promise of risk management (integrated or ERM)


• the understanding of what risk management is all about


• the spectrum of risks that an organization faces


• the guidance amd directives in managing risks


• the roles and responsibilities in risk management


• the tools that are used to identify, assess and control risks
  

I am sure there are more areas than those that I have listed above. I believe these are the broad areas and anything else would probably form as a sub-category under any one of the above.

This gap has been evident through the feedback from our clients (subsidiaries), the satisfaction (or dissatisfaction) levels on expectations of risk management, risk management practitioners sense of what people's perception risk management is and what is actually happening on the ground, and more importantly in my view, the ability (or inability) to respond quickly, decisively to situations triggered by events that adversely impacts the organization.

To be able to close this gap, in considering the legacy of risk management in this organization, I believe the following steps are imperative :

• Being honest with ourselves on the state of risk management in the organization today and where we want it to be
  
  What were the successes and failures of the past? Leverage on successes, do not repeat the mistakes that led to failures.
  

What is the greatest complaint on risk management? This is to get the change perspective in risk management

What does strong risk management look like? Is there anywhere in the organization that we can see strong risk management already in existence? Can we leverage on that strength rather than re-inventing the risk management wheel? What measures do we use to define success in risk management?

How strong do you want risk management to be? Which relates to what is the tone from the top on risk management? How much weight and importance should risk management have in this organization?

What is risk management now? Is risk management a defense, or both offense and defense, compliance or coordination and integration?

• The answer to all of the above should help in setting a clear vision of what risk management should be in this organization. Without going into specifics, the vision for risk management should be "Integration of Risk in Decision-Making" with the mission being "Changing the Perpectives of Risk Management in the Organization"




• How should risk management change?

1

From Risk management treated as a check in the box i.e. completed list of things to do, risk management seen as a compliance againts rules
To Risk management is about understanding key risk drivers in decision-making and evaluating the impact of market risks onto these drivers and how this will change business decision
Risk helps robust decision-making
2
From Risk management is about reporting
To Ability to see the totality of risks will enable risk return trade off, assess marginal impact of risk decision-making, and direct targeted risk intervention by top level risk oversight function
“Risk of the whole is greater than sum of the parts”
3
From Risk assessment or risk profiling
To Risk management is excellence in execution, controls and the speed, flexibility and adaptability to change.
Confidence in risk exposures and the extent of mitigation in place
4
From Risk management is the job of risk managers
To Risk management is no different than any other business activity
Risk management and business strategy is inextricably linked and integrated in the business value chain.

To be continued

Oil Outlook : From USD200/bbl to USD30/bbl

Remember this piece of news? Where is the prespoterousness in this report now?

Now Goldman is predicting oil price to fall to USD30/bbl in the next three months.

Analyst warns of $200 crude oil
By Javier Blas and Chris Flood in London
Published: May 7 2008 03:00 Last updated: May 7 2008 03:00

Crude oil prices could surge to $200 a barrel in the next two years, according to theGoldman Sachs analyst who three years ago correctly predicted a price "super-spike" above $100 a barrel.

The warning by Arjun Murti came as oil prices hit a fresh record high above $122 a barrel, boosted by supply disruptions in Nigeria, lower output in Russia and continued robust demand in China ahead of the Olympics.

Mr Murti said the energy crisis could be coming to a head as a lack of adequate supply growth was becoming apparent.

"The possibility of $150-$200 per barrel seems increasingly likely over the next 6-24 months," he added, warning also the spare capacity of the Organisation of the Petroleum Exporting Countries to cushion against unexpected supply shocks was low.

Last month, Chakib Khelil, president of Opec, also warned oil could reach $200 a barrel. The number of oil option contracts betting on oil hitting $200 a barrel in December have tripled since the beginning of the year.

Mr Murti's warnings carry weight in the oil market after he correctly predicted in March 2005 when oil traded at about $55 a barrel that prices could suffer a "super-spike" to $105 a barrel.
The warning in 2005 was criticised as "self-serving" because Goldman Sachs is one of the largest Wall Street investment banks trading oil and it could profit from an increase in prices.

The criticism forced the bank's chief executive at that time - Henry Paulson - to defend the bullish report. Mr Paulson is now US Treasury secretary.

Nauman Barakat, of Macquarie in New York, said: "The report should not be dismissed out of hand as preposterous as Goldman hit it on the head with its original super-spike story."

In New York, West Texas Intermediate crude futures yesterday jumped to a record $122.49 a barrel before settling at $121.84 while, in London, Brent crude futures closed at $120.31 a barrel.

The crude oil futures market signalled a growing belief that $100 a barrel is here to stay, with prices for oil to be delivered up to December 2016 trading above $110 a barrel. Kevin Norrish, of Barclays Capital, said the market was undertaking a "recalibration higher of expectations for long-term equilibrium oil prices".

Goldman said the unrelenting rise in long-dated oil prices was consistent with constrained supply driving demand rationing.

The role of CRO

The Chief Risk Officer (CRO) or Risk Management Director is now an established position in Finnish companies and is responsible for a wide range of tasks, the emphasis of which is moving from property risks to business risks.

The most significant challenge for these professionals is considered to be establishing risk management as an integrated part of the management system and business process. In order to be successful, the CRO must first convince line managers of the importance of risk management. This has to be our mantra.

At the same time as enterprise wide risk management (ERM) has become more common, a new group of professionals – the CRO:s – has evolved. The views and opinions of these professionals and the challenges they have experienced were studied in a research project during the spring of 2007. The research was organized by Ernst & Young in co-operation with the Finnish Risk Management Association. The target group was the risk management professionals working in Finnish companies and associations.The professional background of individual CRO:s varies a lot (figure 1).

This may be due to the relative newness of the position and that risk management in its entirety is quite an extensive area, covering many different sectors.

The risk management professionals who answered the questionnaire represented 15 different educational and experience backgrounds in total. When asked, only 17 % of those who answered stated that their education and experience were specifically connected to risk management. The vast majority, i.e. over 80%, have therefore moved to risk management work from another sector, the most common of which is insurance. The other common backgrounds are corporate safety, accounting and financing.

Risk management seeks security


The objectives that an organisation sets for risk management form an important starting point for the work of a CRO (figure 2). The most common objective that the organisations participating in the research work identified for risk management is “ensuring the achievement of targets”. Three-quarters of those who answered the questionnaire stated that they had set this objective.

Setting objectives is a fundamental part of ERM. According to this, hazards are all those factors that can put the achieving of business targets at risk – no matter which risk class they represent. Other objectives, which have been most commonly set are connected with improving risk awareness and the risk management function within the organisation, loss prevention and securing continuity of business operations.In contrast, the objectives connected to economy and financing, such as reducing the fluctuations in profits or cash flow, or ensuring the achievement of the forecasted profit are only rarely set. Thus the dogmas of business economics and financing do not seem to be applied to any significant degree in practical risk management work.

This is despite the fact that business economics and financing are well represented in the backgrounds of risk management professionals and that risk management directors or CRO:s very often report to the Chief Finance Officer.Chief Risk Officers participate in many activities and must work in several areas of risk in order to meet the objectives. Typical areas of work cover physical as well as intangible risks, technical as well as commercial risks, together with risks that are internal as well as external to the organisation. However, this does not mean that the CRO would be responsible for all of these risks; according to an established model, the Group Risk Management operates primarily as a coordinator and internal consultant for the managers of the business units, who in practise are responsible for the line risk management.Based on the research results, it is clearly more common for the CRO to participate in developing and co-ordinating risk management activities rather than to be completely responsible for the work. According to the survey, property risk management is the area for which the CRO bears most responsibility for developing risk management strategies.

It has been estimated that nowadays property risks occupy most of the time of the CRO (figure 3). Property risks represent the traditional area of risk management, as do health and safety risks, which also demand a substantial portion of the CRO’s time. Furthermore risks related to marketing, client contact, competitors and supply chain management have recently emerged, to broaden the scope of CRO’s area of responsibility.

In the future the emphasis will be on strategic risks. The results of the survey suggest that this trend will be further strengthened in the future. When asking the question; which types of risk the CRO:s will put the most effort into during the next three years, it is clear that the risks connected with marketing, clients contact, competitors, partners and networks are clearly expected to rise above the others.It seems that the focus for risk management work in the future will be concentrated towards the strategic risks of business operations. This is an area in which the CRO:s have not traditionally been involved.

Only a few of those who answered the questionnaire were of the opinion that in the future the focus should be on property risks. It was also considered that the risks connected to health & safety and economic reporting will demand less consideration in the future than is currently the case. However, this does not mean that these risks will disappear. But so much effort has already been put into these risks, that in the future it is anticipated they will demand less consideration, relative to the newly emerging areas of risk.

The main risk management activities for which the CRO:s are responsible include the development of risk management principles, reporting practices and tools and insurance (figure 4). However, only one in four of the CROs are responsible for identifying and assessing risks. The survey indicates that this task belongs primarily to those who are directly responsible for the risk, being typically found within the sphere of the specific business operations management.
However, it would be beneficial if those working in risk management, actually participate in the risk assessment and provide the necessary methods and tools to carry out the process. Thus it is alarming that almost 40 % of those who answered the questionnaire advised that the risk assessments of investments are carried out without the participation of the CRO, although, it is more common for the CRO to participate in due diligence processes.

The challenge is to take risk management to the business operation units. The biggest challenges for CRO:s are in connection with introducing risk management to the organisation (figure 5). As many as 80% of those who answered the questionnaire felt their main challenge was to integrate risk management into the management system and business processes. The second most important challenge the questionnaire highlighted was marketing risk management and proving its benefits to line management and business operation units. One third of those who answered also felt that the maintenance of defined operating methods in the organisation was a significant challenge. These three issues are closely connected to each other.To ensure that the organisation maintains the risk management processes, it is necessary that risk management is integrated into practical management and that the benefits it brings are clear for the business operation units. The selling of risk management to senior management in a company seems however, to be a lesser challenge, only stated by 25% of the participants. Using the words of one of those who answered the questionnaire: “Senior management has already begun to understand the significance of risk management, however, how do we increase the understanding of the next management levels”?

The most significant challenges when communicating with senior management are connected to understanding their expectations, clarifying their targets and meeting their targets, i.e. proving the operating ability of risk management to them and the board of directors.The operating environment of companies is constantly changing and developing and the new phenomena that are emerging in addition to familiar risks must be understood and managed. The world of risk is continuously expanding, so that the challenges facing the Chief Risk Officers will not decrease. On the other hand, the same development might ensure that the services of the CRO in greater and greater demand in the future.

Fredrik Åström, Manager, Advisory Services unit of Ernst & Young