Risk Management Failures: What Are They and When Do They Happen?

The difficulties of the past year have convinced many observers that current risk management practices are deeply flawed, and that such flaws have contributed greatly to the current financial crisis. In this paper, the author challenges this view by showing the need to distinguish between flawed assessments by risk managers and corporate risk‐taking decisions that, although resulting in losses, were reasonable at the time they were made. In making this distinction, the paper also identifies a number of different ways that risk management can fail. In addition to choosing the wrong risk metrics and misidentifying or mismeasuring risks, risk managers can fail to communicate their risk assessments and provide effective guidance to top management and boards. And once top management has used that information to help determine the firm's risk appetite and strategy, the risk management function can also fail to monitor risks appropriately and maintain the firm's targeted risk positions. But if risk management has been mistakenly identified as the culprit in many cases, current risk management practice can be improved by taking into account the lessons from financial crises past and present. In particular, such crises have occurred with enough frequency that crisis conditions can be modeled, at least to some extent. And when models reach their limits of usefulness, companies should consider using scenario planning that aims to reveal the implications of crises for their financial health and survival. Instead of relying on past data, scenario planning must use forward‐looking economic analysis to evaluate the expected impact of sudden illiquidity and the associated feedback effects that are common in financial crises.