Risk Management in Financial Institutions
1.Chapter 1: Introduction to Risk Management
1.1 What is risk?
What is risk? It is a personal feeling (risk appetite/aversion), depending on the type of risk at
hand, the impact it could have, and the likelihood with which it can occur.
=> The concept of "risk" is hard to grasp, subjective, and multidimensional. Intuition does not
necessarily align with formal concepts in economics/finance.
A common starting point is Knight’s distinction between "risk" and "uncertainty".
- Uncertainty refers to situations in which multiple possible outcomes exist, but we do
not know the probabilities with which these outcomes occur.
- Risk refers to situations of uncertainty in which probabilities can be assigned to the
possible outcomes.
→ The issue is that there is no impact/there is nothing at risk. For example a simple coin flip
is a risk but has nothing attached to it.
An intuitive definition of risk is the likelihood of a harmful consequence. It Incorporates the
concept of uncertainty/probabilities and also stresses potential of negative consequences
deviating from expectations. In addition, this definition also allows us to define "opportunity"
as the related likelihood of a favourable outcome. The dual concept is very helpful in the risk
management context: by limiting risk, you also limit opportunities; exploiting opportunities,
implies exposure to risk.
Risk aversion: to fully characterize risk, we should also account for the utility associated with
the possible outcomes. Most people are risk averse! Taking risk aversion into account will, in
general, not lead to a unique ranking of opportunities. The ranking depends on individual
preferences. We therefore ignore individual preferences in risk management. Instead, we
define a "risk appetite" at the company level.
,1.2 Risk management, risk measurement and regulation
What kind of financial institutions exist?:
- Banks
- Insurance companies
- Investment funds
=> The goal of risk management is to keep firms solvent. To this end, companies have
capital that can cover for unexpected losses.
=> What about expected losses? → included in pricing, mitigated by processes (high
likelihood - low severity).
Risk management is particularly important for financial institutions:
- Their business model relies on taking risks.
- Failures of financial institutions can have high costs due to contagion.
=> Especially because of potential externalities, regulation aims at supporting financial
stability.
Risk is central to banking: a bank is in the business of taking risks and the bank balance
sheet reflects these risks:
(Banking book for example bonds purchased to finance for example interest payments on
deposits, they don’t have an intention of selling them. Trading book on the other hand is a
portfolio of assets the bank holds with intent of trading them)
- The production of loans creates credit risk.
- The investment portfolio has credit risk and market risk.
- The transformation of deposits into loans creates liquidity risk (maturity
transformation) and market risk (interest rate risk).
- Running the business entails operational risk (e.g. fraud).
- The production of deposits creates leverage (which reinforces the above risks).
=> Monitoring risk is thus essential for financial institutions.
=> Notice the contrast with non-financial institutions: risk is a result of their business, but
their focus is on avoiding them, not on taking them.
=> Leverage (especially from deposit production) intensifies the risks banks are exposed to
and makes them extremely vulnerable to shocks.
To achieve the goal of supporting financial stability:
- Micro-prudential regulation is concerned with the stability of individual institutions: it
evaluates their responses to exogenous shocks.
- Macro-prudential regulation is concerned with the stability of the financial system as
a whole: it monitors the response of the system to endogenous risk.
=> This course focuses on micro-prudential regulation.
,Risk is also central for insurance companies. Their business model is to take on risks from
policy holders and manage them via mutualisation.
- The production of insurance policies loans creates underwriting risk.
- The investment portfolio has credit risk and market risk.
- The investment of insurance premiums creates market risk (interest rate risk).
- Running the business entails operational risk (e.g. fraud).
Financial institutions set internal boundaries for their risk management process to ensure
solvency. Their boundaries reflect the company’s risk appetite, not individual preferences
and are in line with external regulatory restrictions: capital adequacy requirements,
disclosure requirements, governance requirements, ...
=> Importantly, managing risk is distinct from measuring risk:
- Managing risk is about strategic business development; it involves controlling people,
IT, infrastructure, processes, measuring risk, …
- Measuring risk is about quantifying risk (both the nature and size).
A sound risk management system therefore consists of consecutive steps:
- Identify risks: spot risks.
- Measure risks: quantify potential deviations from target/expected values.
- Control risks: take actions to bring risk exposures in line with risk appetite.
- Monitor risks: ensure that actions are effective.
- Report risks: report on spotted risks and effectiveness of actions
=> Important that top management is ultimately accountable for risk management, not the
institution’s risk management function.
Risk appetite is typically defined per risk type and expressed through:
- Alarm levels per risk measure: if breached, more attention is paid to the underlying
risk; first mitigating steps are taken.
- Limits for each risk measure that the company does not want to breach; if breached,
strong immediate steps are taken.
Risk measures and their status with respect to alarm levels and limits are regularly reported
to top management to ensure managers are continuously aware of the status (periodicity
of reporting can vary by risk measure), and to get buy-in on the risk appetite and risk
management processes.
Different ways of managing risk:
- Ignore: not an option.
- Exploit: part of the business model of financial institutions.
- Accept: within risk appetite.
- Reduce: take mitigating steps.
- Avoid: do not take the risk.
- Transfer: (re)insurance or similar mechanisms.
, Risk measurement (and thus management) becomes better when it considers multiple risk
measures:
- Volatility (dispersion), skewness, kurtosis;
- Value-at-risk (VaR);
- Expected shortfall (ES).
Value-at-risk (VaR): a common risk measure in the financial context. Loosely speaking, VaR
is the money at stake in an extremely bad scenario. More formally, VaR is the loss that we
are fairly sure will not be exceeded if the current portfolio is held over some period of time.
To compute VaR we thus need a probability distribution for P&L or returns.
1.3 Recent financial scandals
Listing and studying risk events is beneficial for two main reasons:
- Reminds us of the likelihood of big losses: we are subject to disaster myopia: we
underestimate major risks if things go well and forget quickly after a disaster. Positive
feedback helps us to accurately assess the likelihood of disaster.
- Allows us to learn and to improve risk management processes: triggers questions
and helps us to categorize loss events (fraud loss events are judged as immoral and
need to be ruled out and penalized, while losses from legitimate business
development are harder to deal with).
What are the key elements of good risk management?
- Learn from past failures: risk management needs to be adapted over time.
- Risk management should be effective.
- Risk limits should be translated into boundaries within which employees act:
limits should be closely monitored and evaluated.
- Penalize violations of limits even if they result in profits.
- Have appropriate systems in place to detect problems timely; this includes a
separation of tasks (front, middle, backoffice), validation, effective board, ...
A core challenge is to control risk without limiting business development.
- Risk-free banking or insurance does not exist.
- Balance "taking risk" with "controlling risk".
=> A clearly formulated risk appetite is key to bringing everyone on the same page.
1.Chapter 1: Introduction to Risk Management
1.1 What is risk?
What is risk? It is a personal feeling (risk appetite/aversion), depending on the type of risk at
hand, the impact it could have, and the likelihood with which it can occur.
=> The concept of "risk" is hard to grasp, subjective, and multidimensional. Intuition does not
necessarily align with formal concepts in economics/finance.
A common starting point is Knight’s distinction between "risk" and "uncertainty".
- Uncertainty refers to situations in which multiple possible outcomes exist, but we do
not know the probabilities with which these outcomes occur.
- Risk refers to situations of uncertainty in which probabilities can be assigned to the
possible outcomes.
→ The issue is that there is no impact/there is nothing at risk. For example a simple coin flip
is a risk but has nothing attached to it.
An intuitive definition of risk is the likelihood of a harmful consequence. It Incorporates the
concept of uncertainty/probabilities and also stresses potential of negative consequences
deviating from expectations. In addition, this definition also allows us to define "opportunity"
as the related likelihood of a favourable outcome. The dual concept is very helpful in the risk
management context: by limiting risk, you also limit opportunities; exploiting opportunities,
implies exposure to risk.
Risk aversion: to fully characterize risk, we should also account for the utility associated with
the possible outcomes. Most people are risk averse! Taking risk aversion into account will, in
general, not lead to a unique ranking of opportunities. The ranking depends on individual
preferences. We therefore ignore individual preferences in risk management. Instead, we
define a "risk appetite" at the company level.
,1.2 Risk management, risk measurement and regulation
What kind of financial institutions exist?:
- Banks
- Insurance companies
- Investment funds
=> The goal of risk management is to keep firms solvent. To this end, companies have
capital that can cover for unexpected losses.
=> What about expected losses? → included in pricing, mitigated by processes (high
likelihood - low severity).
Risk management is particularly important for financial institutions:
- Their business model relies on taking risks.
- Failures of financial institutions can have high costs due to contagion.
=> Especially because of potential externalities, regulation aims at supporting financial
stability.
Risk is central to banking: a bank is in the business of taking risks and the bank balance
sheet reflects these risks:
(Banking book for example bonds purchased to finance for example interest payments on
deposits, they don’t have an intention of selling them. Trading book on the other hand is a
portfolio of assets the bank holds with intent of trading them)
- The production of loans creates credit risk.
- The investment portfolio has credit risk and market risk.
- The transformation of deposits into loans creates liquidity risk (maturity
transformation) and market risk (interest rate risk).
- Running the business entails operational risk (e.g. fraud).
- The production of deposits creates leverage (which reinforces the above risks).
=> Monitoring risk is thus essential for financial institutions.
=> Notice the contrast with non-financial institutions: risk is a result of their business, but
their focus is on avoiding them, not on taking them.
=> Leverage (especially from deposit production) intensifies the risks banks are exposed to
and makes them extremely vulnerable to shocks.
To achieve the goal of supporting financial stability:
- Micro-prudential regulation is concerned with the stability of individual institutions: it
evaluates their responses to exogenous shocks.
- Macro-prudential regulation is concerned with the stability of the financial system as
a whole: it monitors the response of the system to endogenous risk.
=> This course focuses on micro-prudential regulation.
,Risk is also central for insurance companies. Their business model is to take on risks from
policy holders and manage them via mutualisation.
- The production of insurance policies loans creates underwriting risk.
- The investment portfolio has credit risk and market risk.
- The investment of insurance premiums creates market risk (interest rate risk).
- Running the business entails operational risk (e.g. fraud).
Financial institutions set internal boundaries for their risk management process to ensure
solvency. Their boundaries reflect the company’s risk appetite, not individual preferences
and are in line with external regulatory restrictions: capital adequacy requirements,
disclosure requirements, governance requirements, ...
=> Importantly, managing risk is distinct from measuring risk:
- Managing risk is about strategic business development; it involves controlling people,
IT, infrastructure, processes, measuring risk, …
- Measuring risk is about quantifying risk (both the nature and size).
A sound risk management system therefore consists of consecutive steps:
- Identify risks: spot risks.
- Measure risks: quantify potential deviations from target/expected values.
- Control risks: take actions to bring risk exposures in line with risk appetite.
- Monitor risks: ensure that actions are effective.
- Report risks: report on spotted risks and effectiveness of actions
=> Important that top management is ultimately accountable for risk management, not the
institution’s risk management function.
Risk appetite is typically defined per risk type and expressed through:
- Alarm levels per risk measure: if breached, more attention is paid to the underlying
risk; first mitigating steps are taken.
- Limits for each risk measure that the company does not want to breach; if breached,
strong immediate steps are taken.
Risk measures and their status with respect to alarm levels and limits are regularly reported
to top management to ensure managers are continuously aware of the status (periodicity
of reporting can vary by risk measure), and to get buy-in on the risk appetite and risk
management processes.
Different ways of managing risk:
- Ignore: not an option.
- Exploit: part of the business model of financial institutions.
- Accept: within risk appetite.
- Reduce: take mitigating steps.
- Avoid: do not take the risk.
- Transfer: (re)insurance or similar mechanisms.
, Risk measurement (and thus management) becomes better when it considers multiple risk
measures:
- Volatility (dispersion), skewness, kurtosis;
- Value-at-risk (VaR);
- Expected shortfall (ES).
Value-at-risk (VaR): a common risk measure in the financial context. Loosely speaking, VaR
is the money at stake in an extremely bad scenario. More formally, VaR is the loss that we
are fairly sure will not be exceeded if the current portfolio is held over some period of time.
To compute VaR we thus need a probability distribution for P&L or returns.
1.3 Recent financial scandals
Listing and studying risk events is beneficial for two main reasons:
- Reminds us of the likelihood of big losses: we are subject to disaster myopia: we
underestimate major risks if things go well and forget quickly after a disaster. Positive
feedback helps us to accurately assess the likelihood of disaster.
- Allows us to learn and to improve risk management processes: triggers questions
and helps us to categorize loss events (fraud loss events are judged as immoral and
need to be ruled out and penalized, while losses from legitimate business
development are harder to deal with).
What are the key elements of good risk management?
- Learn from past failures: risk management needs to be adapted over time.
- Risk management should be effective.
- Risk limits should be translated into boundaries within which employees act:
limits should be closely monitored and evaluated.
- Penalize violations of limits even if they result in profits.
- Have appropriate systems in place to detect problems timely; this includes a
separation of tasks (front, middle, backoffice), validation, effective board, ...
A core challenge is to control risk without limiting business development.
- Risk-free banking or insurance does not exist.
- Balance "taking risk" with "controlling risk".
=> A clearly formulated risk appetite is key to bringing everyone on the same page.
