Allow us to read your past and future...let's see, we are focusing on your mind, catching your aura, channeling your soul…we got it. We would say that you are mostly quiet, but when the mood strikes you, you can easily become the center of attention. We see a problem with a father-figure in your family. Wait, there is more, you are also having a problem with a friend or relative. This could be a next door neighbor. Our advice is to be the bigger person and settle. Finally, we are sensing you have more risk around you than you know. This risk will present itself soon and if not handled right, will go from an opportunity to an event that will cost you.
How did we do? Statistically, we were accurate for about 66% of you. How did we do it? Simple, we Shotgunned you, hit you with a Barnum Statement, gave you a little Forer action and then finished with a Rainbow Ruse. If we saw you in person we could pull out another set of techniques that would be keyed off your age, how you dress and your level of confidence. While we won't trample on anyone's spirituality, we can tell you that most fortune tellers utilize techniques that we read about in a book by magician Ian Rowland called The Full Facts Book of Cold Reading. A good fortune teller picks up information and then uses it as feedback to move the subject to believe that they have supernatural powers.
Sometimes risk managers do the same thing. When it comes to banking, risk can mean different things to different people. Even worse, oftentimes it is hard to understand what risk we are even talking about. These days, everyone is more susceptible to a risk story and that may be some of the problem. For example, rolling out a new product contains certain risk. However, not rolling out the product also contains risk. Like a good fortune teller, a risk manager can tell the story in a way to support either conclusion. In some cases, managers overlay a framework that may be just as arbitrary as the risk they are trying to solve. In other cases, the new product champion understates the risk and the opposite is true. In true form, risk is risk, so it must be balanced.
In defense of risk managers, handling bank risk is a fairly new field. It has only been in the last 5Ys that the tools and processes have become available to begin to provide rigor to this discipline. The current best practice for banks starts with a definition of risk and then goes on to define a methodology and framework (on how to measure and monitor a specific set of exposures). The important point here is to come up with a common language to discuss risk internally so everyone has tools to use. If the board were to say they want to take a "medium" level of risk, managers must ask what that means. How will it be measured? Does that mean medium credit risk and low interest rate risk? Is a certain amount of reputational risk acceptable, but regulatory risk is not?
Another problem comes when setting priorities. When a management team talks about risk, are they referring to the risk to capital, earnings or reputation? What is more important? What about the trade off between employees and customer performance? By ranking your risks, everyone in the organization should know that when you talk about "undue risk," what you are really talking about.
In order to move risk management away from vague statements, risk committees should spend time developing definitions, priorities and an understanding of what risk they seek to control. In addition, management teams should know that controlling risk is everyone's responsibility and an ongoing issue to measure, manage, monitor and control. By incorporating a more rigorous approach throughout the bank, risk management moves from the cloudy to the clear.