Risk Management after the Great Crash

The conventional story-line before the Great Crash was that risk management as a science has made considerable progress in the past two decades or so and that financial innovations such as risk transfer techniques had actually made the balance sheet of financial institutions stronger. However, my analysis of risk management failures associated with the global financial crisis (and supplemented by insights gained from studying earlier crisis episodes such as the crash of LTCM in 1998) [Blommestein (2000)]uncovers deep flaws in the effectiveness of risk management tools used by financial institutions.

The crisis has not only shown that many academic theories were (are) not well-equipped to properly price the risks of complex instruments such as CDOs [Blommestein (2008b, 2009)], especially during market down-turns [Rajan (2009)], but also that risk management methodologies and strategies based on  basic academic finance insights were not effective or even misleading. A core reason is that academic risk-management methodologies are usually developed for a system with ‘well-behaved or governed’ financial institutions and markets that operate within a behavioral framework with ‘well-behaved’ incentives (that is, risk management is not hampered by dysfunctional institutions, markets, or financial instruments and/or undermined by perverse incentives). 

In this paper, I will, therefore, not only focus on the quantitative dimension of risk management systems such as the mispricing of risks (of complex products) and measurement problems but also on the qualitative dimension covering such issues like those involving the above mentioned ‘practical’ obstacles of an institutional-, organizational- and incentive nature. In addition to the well-documented role of the perverse incentives associated with misconstrued compensation schemes, it will be argued that the institutional, or organizational, embedding of risk management is of crucial importance as well. It will be suggested that the qualitative dimension of risk management is equally (or perhaps even more) important to the measurement or quantitative side of the process of risk management. 

This view implies that even if the risk management divisions of these financial institutions had acted with the longer-term interests of all stakeholders in mind (which many of them did not), they would still have had an uphill battle in effectively managing the risks within their firms because of (a) the inadequate tools  that were at their disposal (based, crucially, on insights from academic finance); (b) the complex organizational architecture, and sometimes dysfunctional institutional environment, in which many risk managers had (have) to operate; and (c) excessive risk-taking associated with business strategies that incorporated perverse compensation schemes. In other words, had the risk management divisions of these institutions effectively implemented the state-of-the-art tools that were provided to them by academic finance (including, crucially, reliable information about the riskiness of complex financial instruments such as structured products), they would still have to struggle with the complex institutional- or organizational embedding of risk management situations as well as the various channels through which an unsound incentive structure (operating between financial institutions and the market) can have an adverse structural impact on the pricing of financial assets[2].

This perspective can then also be used to explain why it is very difficult or even impossible to effectively manage the totality of complex risks faced by international banks and other financial institutions.  More specifically, it is the reason why effective enterprise-wide risk management is an extremely hard objective, especially in a rapidly-changing environment. This echoes a conclusion from a 2005 paper on this topic: “But successful implementation of ERM is not easy. For example, a recent survey by the Conference Board, a business research organization, shows that only 11 per cent of companies have completed the implementation of ERM processes, while more than 90 per cent are building or want to build such a framework.”[Blommestein (2005b)]

For all these reasons we have to have a realistic attitude towards the practical capacity of risk management systems, even advanced ones based on the latest quantitative risk measures developed in the academic literature. An additional reason to take a very modest view on real abilities of available risk control technologies is the fact that academically developed risk measures predominantly deal with market-and-credit risk. Academic finance has much less to say about the analytical basis for liquidity risk, operational risk, and systemic risk.  Unfortunately, the latter types of risks played major roles in the origin of the Great Crash [Blommestein (2008a)], showing that they were not adequately diagnosed, managed, and/or supervised.    

Against this backdrop, we will, first, cast a critical eye at what has been suggested to be the principal cause of the recent financial crisis: the systemic mispricing of risks and the related degeneration of the risk management discipline into a pseudo quantitative science. After that we will show that the disappearance or weakening of due diligence by banks in the securitization process was an important crisis-factor that was not detected by conventional, quantitative risk management systems. In fact, it is another important example why individual financial institutions can fail, and complete systems collapse, when not enough attention is being paid to the qualitative dimension of risk management [Blommesteinet al. (2009)]. 

An increasingly interconnected and complex financial system made it harder to price risks correctly. Both market participants and supervisors underestimated the increase in systemic risk. Early on I concluded in this context: “The sheer complexity of derivatives instruments, coupled with consolidation in the financial industry, has made it increasingly hard for regulators and bankers to assess levels of risk. In the credit derivatives market, risks that have been noted include a significant decline in corporate credit quality, little information on counterparties, operational weaknesses that may result from the novelty of these instruments, and a disincentive to manage actively portfolio credit risk. As a result, systemic risk in this complex, often opaque financial landscape is likely to be higher than before.” [Blommestein (2005b)]

Although risk managers had more rigorous risk management tools at their disposal than in the past, the rapidly changing financial landscape (characterized by more complex products and markets, a higher level of systemic risk, and increased financial fragility) weakened the applicability and conditions under which these quantitative tools and techniques can  be used effectively. Many market participants (including sophisticated ones) had difficulties in understanding the nature and pricing of new products and markets, due to the sheer complexity of many new financial instruments and the underlying links in the new financial landscape. In a 2005 study I noted: “Even sophisticated market participants might, at times, have difficulties understanding the nature of these new products and markets. Consequently, risks may be seriously mispriced. In the market for collateralized debt obligations (CDOs), the high pace of product development requires the rapid adaptation of pricing machines and investment strategies. Although the ability to value risky assets has generally increased, concerns have been raised about the complex risks in this fast-growing, market segment and, more to the point, whether investors really understand what they are buying.”[Blommestein (2005b)].

Moreover, as explained above, securitization was adversely affected by problems with incentives and information as well as the pricing of tail events [Cechetti (2009)]. More generally, a number of widely held  assumptions proved to be costly wrong, in particular  that the originate-and-distribute (securitize) model would decrease residual risk on the balance sheet of banks, that the growing use of credit risk transfer instruments would result in better allocated risks and a more stable banking sector, and that ample market liquidity would always be available.   

The outbreak of the financial crisis proved these assumptions wrong, whereby the dark side of the risk paradox became visible [Blommestein, H.J. (2008c)]. In effect, it became increasingly clear that there had been a significant and wide-spread underestimation of risks across financial markets, financial institutions, and countries [Trichet (2009)]. For a variety of reasons, market participants did not accurately measure the risk inherent in financial innovations and/or understand the impact of financial innovations on the overall liquidity and stability of the financial system. Indeed, there is growing evidence that some categories or types of risks associated with financial innovations were not internalized by markets; for example, tail risks were underpriced and systematic risk (as externality) was not priced, or was priced inadequately. This wide-spread and systemic underestimation of risks turned out to be at the core of the financial crisis. At the same time, the availability of sophisticated quantitative risk tools created a false sense of security and induced people to take greater risks. “Professional enthusiasm about new risk control technology may give rise to overconfidence and even hubris.” [Helwig (2009)]. 

The underestimation of risks reflected to an important degree mistakes in both the strategic use of risk management systems as well as the technically inadequate risk management tools. During the unfolding of the crisis, many financial institutions revealed a huge concentration of risks, suggesting that risk management systems failed (a) to identify key sources of risks, (b) to assess how much risk was accumulated, and (c) to price financial risks properly (or to use reliable market prices, in particular of structured products). The underlying problem was that risk management did not keep pace with the risks and uncertainty inherent in financial innovations and the fast-changing financial landscape. Risk managers placed too much trust into the existing risk models and techniques (see below), while underlying assumptions were not critically evaluated. Unfortunately, the use of these models proved to be inadequate, both from a technical and a conceptual point of view. On top of this, risk management fell short from a qualitative perspective; that is, too little attention was paid to corporate governance processes, the architecture and culture of organizations, business ethics, incentives, and people.

The (impact of the) securitization of mortgages and financial innovations such as CDO and CDS markets came under heavy criticism as being an important cause of the global financial crisis [Blommestein (2008a); Tucker (2010); Jacobs (2009)]. Risks were significantly underpriced [Blommestein (2008b)] (in particular by rating agencies) while risk management systems failed.

Naturally, also regulators and central bankers made mistakes. Most studies, however, seem to suggest that had we gotten a better understanding of  the correct pricing of complex structured products such as CDOs, CLOs and CDSs over the cycle, then we might have been able to prevent the seriousness of the global financial crisis. For example, popular CDO pricing models such as the Gaussian copula function are based on the dubious key assumption that correlations are constant over the cycle. The above reasoning implies that had we been able to employ a far superior method (in terms of accuracy and/or robustness) than the Gaussian copula function, then we would have valued more accurately structured products over the cycle. As a result, the Great Crash would not have occurred.

However, the conclusion that better quantifications would have prevented a major crisis can be challenged on the following three key grounds. First, as noted above, pricing in the fast-moving, complex financial landscape is a huge challenge. Pricing models are therefore subjected to significant model risk. For example, the foundation of the pricing of risk in structured products such as CDOs and CDSs is based on the key theoretical notion of perfect replication. Naturally, perfect replication does not exist in reality and has to be approximated by historical data which in many cases is very incomplete and of poor quality. Instead, researches and practitioners had to rely on simulation-based pricing machines. The input for these simulations was very shaky as they were based on “relatively arbitrary assumptions on correlations between risks and default probabilities” [Colander et al. (2009)].

Second, many institutions have major difficulties in quantifying the ‘regular’ risks associated with credit- and market instruments. However, the Great Crash demonstrated that this was even more so the case for firms’ operational and liquidity risks. These complications multiply when one tries to aggregate the various risks of divisions or departments within larger financial institutions[3]. 

Third, from a more conceptual perspective, the financial crisis brought to light that the risk management discipline had developed too much into a pseudo quantitative science with pretensions beyond its real risk management capabilities[4]. The over-reliance on sophisticated though inadequate risk management models and techniques contributed to a false sense of security [Honohan (2008)]. Indeed, many professionals were too confident in the ability of quantitative models to reliably measure correlations and default probabilities [Helwig and Staub (1996).]. It was assumed that quantitative risk management models represented stable and reliable stochastic descriptions of reality. Ironically, by relying to an increasing degree on sophisticated mathematical models and techniques, the risk management discipline lost its ability to deal with the fundamental role of uncertainty in the financial system[5]. In addition to this fundamental methodological problem, the financial crisis revealed technical failures in risk management in the sense that even sophisticated methods and techniques turned out not to be refined enough. At the core of many risk management systems was (is) the concept of Value-At-Risk (VAR), which became a key tool in the quantification of risk, the evaluation of risk/return tradeoffs, and in the disclosure of risk appetite to regulators and shareholders[6]. This concept is effectively based on the idea that the analysis of past price movement patterns could deliver statistically robust inferences relating to the probability of price movements in the future [FSA (2009)]. However, the financial crisis revealed severe problems with applying the VAR concept to the world of complex longer-term social and economic relationships [Danielsson (2002)].

Focusing too much on the technical intricacies of models for the ‘correct’ pricing of these assets, although important, ensures that we ignore another, often neglected, crucial reason why markets for securitized assets became so big and fragile and finally collapsed[7]. In fact, as noted before, the quantitative approach to risk management does not fully cover the range of important risks and uncertainties. First, the insight that the ‘originate- to- securitize’ process (and its embedded risks) was capable of generating not very well understood negative spillovers via the shadow banking sector to commercial banks [Tucker (2010)]. 

Second, the originate-to-securitize business model or process had as (unintended) consequence the fatally weakening of due diligence undertaken by originators[8]. With the originators relinquishing their role as the conductors of due diligence it was left to the credit rating agencies (CRAs) to fill this information gap. But, on top of their inadequate pricing methodologies, CRAs never had sufficient access to the required information about underlying borrowers to have any idea of their true state of health. That crucial information was in principle in the hands of the issuing bank, but, as noted, they had stopped caring about collecting that kind of information when they started selling the mortgages onto other investors [Keys et al. (2010)]. So, the rating agencies had to use aggregate data to rate these instruments, or to rely on the credit quality of the insurer who had provided credit enhancement to the security [Fabozzi and Kothari (2007)]. In either case, neither the credit enhancer nor the rating agency had any idea about the underlying quality of the borrowers [Shojai and Feiger (2010)].

Third,perverse incentives, associated with flawed compensation structures, are keeping valuations from their ‘true’ (equilibrium) prices [Blommestein (2008b)]. As a result, excessive risk-taking (was) is manifesting itself in part through asset bubbles with significantly underpriced risks. Moreover, experience and tests show that humans have an ingrained tendency to underestimate outliers [Taleb (2007)] and that asset markets have a tendency to generate a pattern of bubbles (with prices much higher than the intrinsic value of the asset), followed by crashes (rapid drops in prices) [Haruvy et al. (2007)].  

However, prior to the crisis, these underlying structural problems did not dampen the demand from institutional investors for AAA paper. Institutional investors believed that it was possible to squeeze out a large quantity of paper rated AAA via the slicing and dicing through repeated securitization of the original package of assets (mortgages, other loans). Consequently, all that was needed to expose the underlying weaknesses was a correction in house prices, which is exactly what happened. Moreover, it became indeed painfully clear that the complex securities issued by CDOs are very hard to value, especially when housing prices started to drop and defaults began to increase. 

The key insight of this overview is that modern risk transfer schemes (that re-allocate risk, or, in many cases more accurately stated, uncertainty) may undermine due diligence (and prudence more generally), especially in combination with compensation schemes that encourage excessive risk-taking. This structural lack of prudential behavior infected not only the structured finance segments but the entire financial system. All types of players (bankers, brokers, rating agencies, lawyers, analysts, etc.) were operating under business plans with a (implicit) short-term horizon that put institutions and systems at risk. Deeply flawed incentive schemes encouraged dangerous short-cuts, excessive risk-taking, but also unethical practices[9]. The culture of excessive risk-taking and dubious ethics [Blommestein (2005a)] in the banking industry spread like a virus during the past decades and became firmly entrenched [Blommestein (2003)]. Even if the top management of banks aim to maximize long-term bank value, it may then be extremely hard to impose incentives and control systems that are consistent with this objective. In fact, prior to the crisis, there was a move away from this long-term objective, with an increasing number of bank CEOs encouraging business strategies based on aggressive risk-taking. This in turn engendered excess risk-taking and non-ethical practices within firms and at all levels (traders, managers, CEOs).

Hence, a relatively small and local crisis could transform itself into the Great Crash.

Clearly, the many complex and new risks and uncertainties in the fast-moving financial landscape could not be effectively diagnosed and managed via a purely quantitative approach. In fact, it encouraged additional risk-taking induced by a false sense of confidence in sophisticated risk-control technologies. We, therefore, need a paradigm shift in risk management that also includes an assessment of uncertainties through the lens of qualitative risk management. Only in this way would we be able to tackle the adverse influences of organizational issues, human behavior, and incentives schemes [Blommestein (2009)]. This would also allow us to account for the fact that all risk measurements systems are far more subjective than many experts want to accept or admit. Empirical risk control systems are the result of subjective decisions about what should be incorporated into the risk model and what should not[10].

The first key conclusion is that prior to the Great Crash too much reliance was placed on the quantitative side of risk management and too little on the qualitative dimension. In this context is was argued that there is an urgent need for dealing effectively with inherent weaknesses related to institutional-, organizational-, governance-, and incentives’ aspects[11]. More sophistication and a further refinement of existing quantitative risk management models and techniques is not the most important or effective response to the uncertainties and risks associated with a fast-moving financial landscape. In fact, too much faith in a new generation of complex risk models might even lead to more spectacular risk management problems as the one witnessed during the last decade. Instead, as noted by Blommestein et al. (2009), a more holistic and broader approach to risk management is needed as part of a paradigm shift where more attention is given to the qualitative dimension of risk management.

A final key finding is that it would still be impossible to prevent major crises in the future, even if a coherent picture associated with the aforementioned qualitative issues is being provided. The underlying epistemological reason is the (by definition) imperfect state of academic knowledge about new uncertainties and risks associated with a fast-moving society, on the one hand, and the inherently inadequate risk-management responses that are available as tools to risk managers, their top management and, indeed, also to their supervisors, on the other. Indeed, we have shown in a related analysis that the Great Crash is another illustration of the fact that risk management as a scientific discipline is not capable of dealing adequately with fundamental uncertainties in the financial system [Blommestein et al. (2009)]. From this perspective it is therefore no surprise that some authorities are considering to constrain or restructure parts of the architecture of the new financial landscape [see Annex below, and Group of Thirty (2009)].  

Paul Tucker (2010) recently analyzed the question of whether the structure or fundamental architecture of the new financial landscape needs to be constrained or restructured by the authorities. In doing so he focused on a key weakness in the new financial landscape: the shadow banking sector.

In Tucker’s analysis, the dangerous side of ‘shadow banking’ refers to “those instruments, structures, firms or markets which, alone or in combination, and to a greater or lesser extent, replicate the core features of commercial banks: liquidity services, maturity mismatch and leverage.” The un(der)regulated shadow banking activities can then create an unstable and fragile banking sector. For example, the money fund industry is a major supplier of short-term funding to banks, while its own maturity mismatch served to mask the true liquidity position of the banking sector. This in turn fatally injected additional fragility into the financial system as a whole. Warnings were published quite a few years ago [Edwards (1996)], while Paul Volcker, former chairman of the U.S. Federal Reserve, is reported to have expressed serious concerns at internal Federal Reserve meetings around thirty years ago [Tucker (2010)].

So, like in the case of the ‘originate- to- securitize’ process, this was an example of a structural weakness waiting to erupt, although the wait was longer. But during the global financial crisis they both became a reality.  “When the Reserve Fund “broke the buck” after Lehman’s failure, there was a run by institutional investors” …..  “Echoing Paul Volcker’s concerns, the Bank of England believes that Constant-NAV money funds should not exist in their current form” [Group of 30 (2009)]