Читать книгу The Failure of Risk Management - Douglas W. Hubbard - Страница 45

1 Best. The firm builds quantitative models to run simulations; all inputs are validated with proven statistical methods, additional empirical measurements are used when optimal, and portfolio analysis of risk and return is used. Always skeptical of any model, the modelers check against reality and continue to improve the risk models with objective measures of risks. Efforts are made to systematically identify all risks in the firm.

2 Better. Quantitative models are built using at least some proven components; the scope of risk management expands to include more of the risks.

3 Baseline. Intuition of management drives the assessment and mitigation strategies. No formal risk management is attempted.

4 Worse (the merely useless). Detailed soft or scoring methods are used, or perhaps misapplied quantitative methods are used, but at least they are not counted on by management. This may be no worse than the baseline, except that they did waste time and money on it.

5 Worst (the worse than useless). Ineffective methods are used with great confidence even though they add error to the evaluation. Perhaps much effort is spent on seemingly sophisticated methods, but there is still no objective, measurable evidence they improve on intuition. These “sophisticated” methods are far worse than doing nothing or simply wasting money on ineffectual methods. They cause erroneous decisions to be made that would not otherwise have been made.

A firm that conducts an honest evaluation of itself using the prescribed methods will find it falls somewhere along a spectrum of success and failure. Based on the standards I've described for the success of risk management, the reader has probably already figured out that I believe the solution to be based on the more sophisticated, quantitative methods. You may not yet be convinced that such methods are best or that they are even practical. We'll get to that later. For now, let's look at the proposed success/failure spectrum. (See the Risk Management Success-Failure Spectrum box.)

Note that in this spectrum doing nothing about risk management is not actually the worst case. It is in the middle of the list. Those firms invoking the infamous “at least I am doing something” defense of their risk management process are likely to fare worse. Doing nothing is not as bad as things can get for risk management. The worst thing to do is to adopt an unproven method—whether or not it seems sophisticated—and act on it with high confidence.