When we take a black-and-white perspective, is it rather:
(a) actually controlling risk, or
(b) legalizing / justifying / legitimizing (or whatever we call it) taking more risk for less capital (in the frame of the given regulatory framework, of course - and perhaps modifying it via the so-called industry best practices)?
(Even if there are many more colors in the life, black-and-white approach seems to be much more useful in practice.)
When I started my career in risk area back in 2005, I thought that the answer was (a). Now I'm not so sure any more... In fact, it rather looks like (b). What's your experience?
Replies
I think a banks risk control is about what management wants it to be. It's a service provider to management.
The function of a bank's risk control, unless it is set-up as a decision taking body, can hardly 'actually control' risk. That is the task of the responsible decision takers. However, if they use the risk function as a primary input for decisions, it might feel as if it actually controls risk.
A shift from (a) to be (b) reflects a change in in prioritites the management function sets. This can happen when pressure on management goes up and the perceived added risks remains acceptable in the given situation.
P.S. Reasons for a difference in risk perception are of course many. Duration on the job would be one of them. It would be fascinating to chart the average time managers hold to a position to risk/captial ratio you mention in (b).
Intersting question. I wouldn't say that the Risk function is there to control risk, rather to help the business to understand the risks inherent in doing business. In the process identify the controls necessary to manage those risks. The Risk function doesn't won any risks. The business by its very nature must own the risks. Once the abdicate the responsibility of risks to a function, then they would feel that they would have carte blanche to do b.
The business must decide how much risk they are prepared to purchase....i.e take for a given loss/return, but they need to understand that they still own that risk and the controls. It is upto the Risk function to report on the effectiveness of those controls.
The other element is the businesses risk appetite. Without an appetite statement from the top, there will be nothing to measure how much risk the business is taking on.