As we progress through the fourth quarter, we continue to hear bad news in the financial sector. The sub-prime debacle and subsequent credit crisis continues to impact the financial and re/insurance sectors. The issue has accelerated in the fourth quarter with ongoing volatility and reductions in liquidity for any kind of sub-prime asset. Stocks directly or indirectly related to the crisis are also dropping. And unfortunately, there is likely more to come.

So what went wrong? In addition to the inappropriate level of scrutiny given to the sub-prime risks, I believe the crisis of confidence that we are watching unfold, is also the result of flawed risk management systems.
An institution where value is created by assuming risk must have a system for managing risk – not just return. The problem comes when those risk management ­systems fail.

Why do they fail? It’s unlikely due to the model itself, but rather the application of the model. Proper use of risk management systems requires communication and transparency. Clarity within and outside an organization about its appetite for and approach to risk is essential for effective risk management. From the top of an organization, all the way down the line to the person that makes the individual decision, it must be clear how that organization thinks about risk. Outside the organization, the company must provide information on the amount of risk a company is taking and what it might mean to that company’s balance sheet. Opaque external communication will lead to a surprise and a loss of credibility.

Another potential problem lays in the quality of information that companies use in their models and the amount of expertise available in-house to assess the outputs of the models. Many of the products that led to the current problems are less than five years old. I don’t believe you can estimate a 1-in-20 or 1-in-50 year event with only five years of data. Even with complete data and a robust model, the organization must interpret that data correctly; you cannot outsource that knowledge and understanding.

Third, even with the best models and interpretation, if an organization’s culture does not support risk taking through appropriate governance, there will be problems. For example, a risk assuming institution that puts too great a focus on return, without thinking of the risk that comes along with that return, will have a flawed culture. An appropriate culture is one where importance is placed on the assessment and valuation of risk, where risk management is integrated into the company’s policies and processes – not set off to one side – and where compensation systems recognize both return objectives and risk constraints.

A risk-assuming organization must not only understand the risks it is taking but have effective risk management systems embedded in the organization. At PartnerRe, we focus on the risk and getting the right amount of return per unit of risk – not the other way around. Risk management is at the core of what we do. We quantify our risk appetite and then we communicate that appetite and work within it to evaluate the risk, find the right price for it and manage it effectively once we’ve taken
it on.