Risk Management—the Revealing Hand

Many believe that the recent emphasis on enterprise risk management function is misguided, especially after the failure of sophisticated quantitative risk models during the global financial crisis. One concern is that top‐down risk management will inhibit innovation and entrepreneurial activities. The authors disagree and argue that risk management should function as a “revealing hand” that identifies, assesses, and mitigates risks in a cost‐efficient way. In so doing, risk management can add value by allowing companies to take on riskier projects and strategies. But to avoid problems encountered in the past, particularly during the recent crisis, risk managers must overcome deep‐seated individual and organizational biases that prevent managers and employees from thinking clearly and analytically about their risk exposures. In this paper, the authors draw lessons from seven case studies about the ways that a corporate risk management function can foster highly interactive dialogues to identify and prioritize risks, help to allocate resources to mitigate such risks, and bring clarity to the value trade‐offs and moral dilemmas that often must be addressed in decisions to manage risks. Developing an effective risk management system requires, first, an agreement about a company's objectives, values, and priorities; second, a clear formulation and communication of the firm's “risk appetite”; and, third, continuous monitoring of a firm's risk‐taking behavior against its declared risk limits. Quantitative risk models should not be the sole—or even the most important—basis for decision‐making. They cannot replace management judgment and are best used to trigger in‐depth discussions among managers and employees about the most important risks faced by the firm and the best ways to respond to them.