The 3 M of Risk Management

The 3 Ms of Risk Management

By

Nick Barcia, Ph.D.

Risk Management has become increasingly important over the past 15 years. Virtually every firm in the world is concerned with having an effective risk management process in place. Risk management disasters are increasingly common and are often on the front page of the main section of the paper. As products and strategies have become increasingly complex, the likelihood of a problem has increased. In addition, trading volumes have greatly increased, further increasing the likelihood of a problem.

Many firms still have major shortcomings in their risk management capabilities. Consider the following scenarios:

* A major market move occurs. The Chief Risk Officer ("CRO") of a broker/dealer wants to know right now what effect this has on the firm. Are they better or worse off? What actions should be taken? To determine the best course of action the CRO needs to know real-time (not as a result of a batch process!) what the positions are. The CRO must also be able to perform a risk analysis immediately (again, not a batch process). Inability to do this will consume resources, raise the firm's risk profile and possibly cause losses as a result of the market move.

* A major firm announces a significant profit restatement. The CRO of a major retail brokerage wants to know which accounts will be affected the most. The CRO needs to know real-time which accounts have concentrations in that industry and SIC code. Since it isn't clear yet what the full effect of the restatement will be on security prices, can the CRO perform a what-if analysis on specific accounts to determine the potential effects on the firm and the accounts so that proper actions can be taken? Inability to do this real-time will consume resources and increase the risk profile of the firm and the accounts.

In both cases, could the CRO have set up conditions so that the risk systems would have generated alerts as to problem positions or accounts when specific actions occur so that the CRO can spend less time finding risks and more time managing risks?

The industry has spent many dollars effecting comprehensive risk management capabilities. Ultimately risk management is, however, a process that requires tools and the right mindset, not just a system that measures risk. The purpose of risk management is the following: minimize the probability that an error occurs AND that it goes unnoticed. To do that, a firm must have all the components of effective risk management. The firm must have the ability to perform the 3 Ms of Risk Management: Measurement, Monitoring and Management of risk. In this paper, we will outline the basic capabilities of each of the three areas.

Risk Measurement

All firms must have the capability to measure their risks. Most firms have risk measurement systems. However, there is a lot more to it than that. Risk measurement involves ALL aspects of the capability to measure risk, not just having systems. To measure risk effectively and accurately, the firm must have accurate and timely information as to its positions, its counterparties and all relevant information regarding its positions and counterparties. This information should ideally be available on a real-time basis as batch processes take too long and the market will likely have moved by then (the risk analysis may no longer be valid). Measuring this information solely on an overnight (or end of day) basis will not be sufficient as market conditions change during the day, and customer and counterparty activity changes the firm's risk profile constantly. It is also not sufficient to simply do this several times a day. As market conditions change, the value of the firm's and its customers' positions changes accordingly, either favorably or unfavorably. In addition, as customers do trades during the day the firm must be able to track its customers' accounts as they transact business. This information must be accurate, accessible in a timely manner and able to be retrieved from the firm's computers and sent to the relevant analytical models for risk evaluation. During some recent risk events, many firms learned that they could not do this effectively, much to their dismay.

So what does effective risk measurement entail? Several key components are required:

* The risk measurement methodologies used must accurately measure the risks. There are many different ways to measure risks and firms use most of them. The two basic necessities for a risk measurement methodology to be effective are that they must reflect the risks they measure and all relevant parties must understand them.

* Different kinds of firms will require different kinds of risk measures. The measures needed for a portfolio-based approach to risk measurement are not exactly the ones needed for a retail operation. The portfolio approach requires position, position attribute, counterparty and counterparty attribute data. A retail operation will require all that and extensive information at the account level so it can see what individual accounts are doing real-time.

* The firm must be able to examine its risks at any level and aggregate up or drill down to any desired degree. For example, a broker dealer must be able to measure risk by security, security type, counterparty and type, industry or SIC classification, currency, geographical location, etc. The B/D should then be able to aggregate up or drill down in any direction (for example by country by currency or vice versa). A retail brokerage should be able to measure risk by account, by account type, by industry, SIC code, etc, and aggregate up. They should also be able to drill down to the account level after starting with a portfolio approach. In addition, a retail brokerage needs to perform sophisticated margin calculations on a wide variety of products. Also, they would need to be alerted when specific activities occur in selected accounts, e.g., large trades or prohibited activities.

* The firm must be able to perform scenario and what if analysis on a real time basis for any of its risk measurement categories. For a retail operation, this means even at the account level.

* The analytical models used to measure risk must be accurate and measure the right risks. The models must be appropriate to the business and the products. Different products may require different kinds of models and there is nothing wrong with that. Use as many models as is necessary and no more.

* The inputs to the models must be accurate.