Risk & Risk Management – few roving thoughts

Time transforms the risk. If there is no tomorrow there will be no risk. If we had fool proof tools to predict tomorrow, probably life would be much smooth.  But we live in a world which is full of uncertainties that is why tomorrow can’t be predicted with precision. If it was only risks & no uncertainties, probably statistical reasoning & logical thinking would have helped us with rational decisions. But alas it is not so. Because there are some risks which ‘we know that we know’, some risks which ‘we know that we do not know’, and some risks which ‘we do not know that we do not know’. It is difficult to predict these ‘unknown unknowns’. These are the black swan events like 9/11 or COVID 19. Their prominent characteristics are:

1. Rarity —- such events don’t occur frequently, these occur very rarely.
2. Impact — whenever they occur they make huge  impact
3. Predictability —- retrospective i.e. people come up with explanations for their happening after such events have happened

In the financial world too, we are confronted with such events. Take the example of GFC, 2008. Nobody saw it coming, but after it had struck so many claimed that they were expecting it to happen. It has left behind a trail of massive destruction which is still festering in some corners even after more than a decade. We have risk models to predict known risks but these unknown risks i.e. uncertainties are difficult to predict. Frank Knight, a noted economist has made a beautiful distinction between risk and uncertainty. He says that the variability that can be quantified in terms of probabilities can be best thought of as ‘risk’ while variability that cannot be quantified at all can be thought of simply as ‘uncertainty’.  

At times known risks give us an illusion of certainty while uncertainties give us an illusion of known risks. This illusion leads to misreading the future events and erroneously predicting the future. We witnessed the failure of one of the most commonly used risk model viz. VaR when it was most needed.  It completely failed to predict the losses banks suffered in the wake of GFC because such models are meant only for normal times & for measuring known risks. 

Banking is a business of risk as all banking activities carry an inherent risk. And risk is not loss but the probability of loss, that is why the objective of the banks is not to eliminate the risks but to minimise/mitigate it. Banks are aware that some losses are bound to happen which are simply the cost of doing business i.e what we call as Expected Losses (EL) in banking parlance. To cover such losses banks make Provisions but these have to be sufficient enough lest banks have to dip in their Reserves & Capital which essentially are meant to cover Unexpected Losses (UL). To ensure that banks have sufficient cushion to take care of their EL, they need to follow robust risk management practices & processes which disincentives underreporting of risks. 

This leads us to infer that Risk taking & Risk Management are in fact two sides of same coin. If there are no risks, hardly any need for risk management. We need risk management because we need to tame/contain the risks. Objective is not to reduce the risk to zero but to decide how much to take, decide the boundary within which to play. Because no risk means — no reward and until & unless banks make money neither they can reward their stake holders or can they remain going concern for long.

That being so what banks can do with the risks ?—- let us look at the four options;

1. Ignore the risk — at your own peril, it will be hara-kiri, simply not possible, 

2. Avoid the risk —- how can we, when our business is to take risk? Here avoidance means selective avoidance i.e. avoid being too mush adventuresome,   don’t venture in to uncharted territories, don’t undertake transaction/activities which you don’t understand & avoid taking exposure to those sectors where your NPA is much above the industry average etc.

3. Transfer the risk  —- banks usually go for it e.g to cover operational losses because of certain external events, they go for insurance cover etc. but in addition they need to develop necessary expertise to use derivatives such as CDS, CLN, TRS, IRF, FRA etc. to transfer the credit, market risk to the entities willing to take. 

4. Absorb the risk —– obviously the main banking function, but banks need to take well planned exposure based on banks risk appetite. For this they must have a well-articulated Risk Appetite Statement.

To protect the interest of the depositors & nurture their enduring trust, bank’s must never lose their prime focus of  prudently deploying the  funds.  This essentially means that before a bank elects to take exposure on any sector/activity/product/geography etc it   —

1. need to identify the inherent risks 
2. be able to measure the risk 
3. have well designed monitoring tools and 
4. deploys effective methods to minimising/mitigating the risks.

This in nutshell is what risk management is ———- that is the process of identifying, measuring, monitoring and mitigating the risks.

In the normal course of  business, banks carry a large number of risks (details in Basel Framework) but ‘unknown unknowns’ such as COBID – 19 either aggravate the extant risks or bring in its wake  totally new breed of risks. This calls for new/creative ideas and financial reengineering of existing processes & tools. However, care need to be exercised to ensure that reengineered risk management processes/tools are easy to understand & simple to implement lest COMPLEXITY of certain risk processes & measuring techniques itself  becomes a big risk..

I would like to close this randomised piece laced with zigzag thoughts by quoting an old adage which says that for banks to remain strong & resilient, “it will be much more sound for them to take risks they can measure rather than  measuring the risks they are taking”.