Yesterday's proposal by the Obama Administration to limit activities of large banks is an interesting topic in risk management. Will it help protect the taxpayer in the future - no one knows. The fact that no one knows means that risk will most likely be increased, rather than decreased. Should the proposal pass, the rules would violate one of the major tenants of risk management - do no more harm.
Risk management is about identifying potential negative outcomes of an activity and placing them against the probability of earning a profit. Should the probability of a sustained profit above a firm's cost of capital be greater than the risk, then the activity actually serves to lower risk, not increase it. Ironically, subprime mortgage investing is a perfect example of this.
When subprime investing first got started back in 1995, default rates were around 12% and investors assumed they would take on losses of 18%. In other words, by investing in subprime, risk was lowered. This dynamic remained true until somewhere around early-2005 when actual defaults fell to 4% and expected losses were assumed to be in the 8% range. In retrospect, actual risk was closer to a 15% expected loss rate and so investing in subprime exacerbated risk. Should we have known better - yes. Could we have known better - yes. Despite all the consternation regarding failed risk models, the models were fairly accurate. Back in 2005, if you assumed a 30% reduction in housing value, expected losses jumped back to 19%, not too far than the 24% actual rate today. The problem was that in 2005, housing prices continued to ratchet up and most everyone assumed that they would plateau, instead of dramatically fall.
Our point here is that subprime presents a perfect example of an area where the regulation of the risk process can help. However, we draw the distinction between regulating risk instead of the risk management process. When someone sets out to regulate risk, it often does more harm than good, because of a phenomenon of something called risk homeostatsis.
Risk homeostatsis is the concept that humans handle risk by trading one risk off for another, so that overall risk either stays constant or increases. While having a 4WD vehicle is safer than a 2WD car, winter accidents are higher, not lower in 4WD vehicles. While cross-walks on streets should make pedestrians safer, the probability of getting hit in a cross-walk is higher, not lower than crossing in the middle of the street. Give someone a 4WD in the snow and they gain a false sense of confidence, resulting in faster speeds despite the weather. Give someone a cross-walk and they will pay less attention when they cross the street and increase their risk in the process.
Risk homeostatis is particularly applicable to banking and is even more acute when society attempts to regulate a risk that may not even be a risk. Often in these cases, bank managers, shareholders and the public will feel better about things and either assume the risk is lower or looks for other ways to take on risk. If proprietary trading is not available, bank managers will look for other areas to take on risk by getting into new lines of business, lowering underwriting standards or increasing operational risk - all against the false confidence that risk is under control.
Instead of regulating risk, particularly in the case where we don't even know a risk exists, perhaps the Administration would be better served to focus on forcing the improvement of the risk process and improving disclosures. At our current pace of financial reform, we are going to potentially end up doing more harm than good - resulting in less profitable banks, more risk and a false sense of security.