What risk management is, and the risk management framework

Every business and every investor takes risk, whether or not anyone says so. Risk management is the discipline of doing it on purpose.

What is risk management?

Memorize

Risk management is the process by which an organization or individual defines the level of risk to be taken, measures the level of risk being taken, and adjusts the latter toward the former, with the goal of maximizing the value of the company or portfolio, or the satisfaction (utility) of the individual.

Three points follow from that wording.

• It is not about minimizing risk. A firm that shied away from all risk could not operate, and return without risk is a false hope. Risk is something to choose, understand and size.
• It is not about predicting risk. The aim is “no surprises”, meaning that when an unpredictable event hits, its effect on the organization was already quantified and discussed. A shipping lender’s risk manager cannot know when freight rates will collapse, but can show the board that a collapse like the worst on record would cost, say, a third of the lender’s capital, so that the board decides whether that is tolerable.
• It is continuous and front-loaded. Most of the work happens before an adverse event. In a poor process the same effort is spent afterward, when the damage is done.

Return is hard to control. Risk, and the exposure to it, can be managed. That is why risk management is an offensive tool as well as a defensive one: knowing what you can bear lets you take the risks that earn a return.

Driver, position and exposure

The word “risk” is used for three different things. Keeping them apart helps with the definitions that follow.

Riskused loosely for all three; keep them apart on the exam

• Risk driver Use it the underlying uncertainty, such as a swing in an exchange rate
• Risk position Use it the action taken, such as holding a foreign-currency asset
• Risk exposure Use it the possible change in value: position × driver

The risk exposure is what the organization actually stands to gain or lose, and in the simplest case it is the position multiplied by the driver.

$$\text{Exposure} = \text{Position} \times \text{Driver}$$

What are the seven features of a risk management framework?

Memorize

A risk management framework is the infrastructure, process and analytics needed to support effective risk management. It is not one-size-fits-all: it is built around the organization’s goals and resources. Every framework should still address the same seven features.

#	Feature	What it does
1	Risk governance	Board-level direction: sets goals and risk tolerance, grants authority and oversees risk
2	Risk identification and measurement	Finds and quantifies the risk drivers and exposures; the main quantitative core, with qualitative judgment too
3	Risk infrastructure	The people and systems that capture and analyze exposures: risk capture, databases, models, a scenario engine, reporting
4	Policies and processes	Governance extended into daily work: limits, constraints, due diligence, escalation of exceptions, checklists
5	Risk monitoring, mitigation and management	Watches exposure against tolerance and acts when they drift apart
6	Communications	Reports risk up, down and across, with a feedback loop to the board
7	Strategic analysis or integration	Uses risk measurement to see which activities add value and to improve decisions

The diagram shows how the features fit together. The board sets goals, risk tolerance and a risk budget; management chooses the risky activities; the loop of measuring, comparing and modifying keeps exposure inside the limit; and reports and strategic analysis feed back to the board.

Risk management frameworkoverlapping features, built to fit the organization

• Set the rules top-down
  • Risk governance Memorize board: goals, risk tolerance, oversight
  • Policies and processes Memorize limits and procedures for daily work
• Measure analytics
  • Risk identification and measurement Memorize the quantitative core
  • Risk infrastructure Memorize people, systems, data and models
• Act keep exposure inside tolerance
  • Risk monitoring, mitigation and management Memorize watch, then act when out of line
• Report and learn feedback loops
  • Communications Memorize reporting up, down and across
  • Strategic analysis or integration Memorize use risk insight to improve decisions

Some points the exam likes:

• Governance is the foundation. Policies, procedures and infrastructure are needed to implement the framework, but it is governance that gives the context.
• Identification and measurement is the analytical part. Communications and governance are largely qualitative.
• Monitoring, mitigation and management is where action happens. Its key test is whether exposure is in line with tolerance; if not, risk is modified (see the last lesson of this module).
• Technology supplements judgment. Better systems allow faster scenarios and more risk drivers, but they bring their own risk of errors, so data and models must themselves be tested.
• Monitoring frequency fits the organization. A large financial firm may monitor daily, a small business or an individual quarterly.

How does the framework run in practice?

A mid-size insurer shows the pieces working together.

1. The board sets a maximum one-year loss it can accept (governance).
2. The risk team measures exposures every week (identification and measurement).
3. The systems team builds and tests a scenario engine (infrastructure).
4. Procedures say who must approve a position over a limit (policies and processes).
5. Equity exposure breaches its limit, so management sells equity futures to bring it back (monitoring, mitigation and management).
6. A monthly report goes to the board (communications), and the board uses the same figures to decide where to take more or less risk (strategic analysis).

Reporting should happen whether exposure is in line or not. It matters even more when exposure is out of line.

Go deeper Does an individual need a framework?

Yes, in a scaled-down form. The individual is the governing body, and an adviser plays the role of management. Six steps cover it: set goals, choose investments and identify their risks, evaluate the exposure, consider ways to modify the risk if needed, implement the solution (insure, hedge, trade), then review. A small firm or an individual may rely on outside providers for the infrastructure and review less often, but the principles are the same.

When risk is built into every key decision, the organization has a risk culture. Individuals can have one too: aware of their risks, their rewards and their costs.

Go deeper Why do it? The benefits of good risk management

The curriculum lists six benefits. Fewer surprises and a better idea of the damage if one happens. More decision discipline and better risk-return trade-offs. Faster, better-informed response that trims the worst losses. Greater efficiency and fewer operational errors. More trust between the board and management, so delegation works better. A better reputation with analysts and investors. Together these raise the value of the enterprise. They do not prevent losses: even the best process cannot stop a portfolio falling in a market crash.