It had been generally accepted that the financial crisis was caused, in part, by an over-reliance on statistical computer models. Banks calculate their Value at Risk (VaR) every day using sophisticated computer modelling techniques based largely on historical data to determine, for example, that there is a less that 1% chance of losing $50 million in the next 10 days under normal market conditions. We are now experiencing the consequences of abnormal market conditions. Nassim Nicholas Taleb, in his book “The Black Swan – The Impact of the Highly Improbable”, conceptualises events that lie outside the realm of regular expectations and which carry extreme impacts. The current financial crisis is an example Black Swan as was the 9/11 attack on New York. Black Swan events cannot be modelled by VaR calculations or other statistical analysis that relies on historical data – the most recent historical data is from a 10–year bull market, not from a severe recession.
So what can we do? We can start by trying to get some clarity around what we mean by risk management. The financial sector has invested vast sums in developing processes, algorithms and systems for calculating VaR and as a result has created valuable performance management tools. They provide bank executives with greater visibility of their current status than was possible previously, facilitate risk-based allocation of capital and, of course, help meet regulatory requirements. Management of risk is a core competence for banks yet I would argue that through their risk management programmes they are managing performance but not risk in its broadest sense. With a few notable exceptions, they did not manage the sub-prime mortgage Black Swan.
One exception was Goldman Sachs where it is reported that in December 2006 management noticed a discrepancy between the VaR calculations and the P&L account for its mortgage business which showed losses for 10 days in a row. A meeting was convened and management took the decision based on qualitative judgement to get rid of mortgage-backed securities or to hedge the risk. As a result Goldman Sachs avoided a lot of the pain suffered by other banks in summer 2007.
The lesson from the financial crisis is that VaR is not the sole answer to managing risk in financial institutions. Management needs to recognise that statistical analysis based on historical data provides good performance management information but that something else is also needed to manage risk in its widest sense. This should start with making management responsible for identifying and tracking all of the risks (for example, on risk registers) that could cause material business impact, including Black Swans. Key metrics that could indicate the escalation of risk should be identified and tracked. But ultimately, management will need to take qualitative management decisions, based on much better risk information from a variety of sources. Informed human judgement rather than blind reliance on statistical models will be the way to avoid future Black Swans.