Risk is a key fact of economic life. People and firms make irrevocable investments in research and product development, plant and equipment, inventory, and human capital, without knowing whether the future cash flows from these investments will be sufficient to compensate those who have financed the project. When things go well, those cash flows are more than enough to pay off lenders, and the value of equity rises. But when things go badly, and operating losses exceed equity capital, the firm becomes insolvent, leaving lenders holding the bag.

One way firms can reduce the risk borne by debt holders is by estimating the probability of a bad outcome, then using the estimate to figure the amount of equity capital the firm should hold. Firms can never hold enough equity to guarantee their solvency – the possibility of catastrophic but extremely low probability outcomes always exists – but they can reduce the probability of insolvency to a socially acceptable small number. Firms can also mitigate the risk exposures they face. Purchasing insurance, hedging, screening customers, closely supervising employees and monitoring suppliers, and diversifying are all examples of ways firms can modify the probability of adverse outcomes.

Despite extensive efforts to control exposure to risk, even sophisticated investors and firms will still experience instances of sudden, unexpected, and devastating losses. In cases such as Barings, Metallgesellschaft, and Long-Term Capital Management, the losses were in the billions.

What is the source of these failures in risk management? Is it simply extreme bad luck, similar to being struck by lightning while out jogging, to experience the so-called "one hundred-year storm?” If so, it is hard to conclude that the victims were negligent; nor do such freakish outcomes say much about the desirability of either risk management or regular exercise.

But if such failures result from flaws in the way firms conceive of or implement risk management, one might expect such failures to be repeated. And to the degree that risk cannot be eliminated from the economy as a whole, but can only change form, there is a special role for banks to play.

MEASURING RISK IS DIFFICULT

One hundred-year storms do occur, but firms are far more likely to fail because they incorrectly estimate the potential distribution of outcomes. Measuring risk is no easy task. Estimation is usually based on historical data, but the availability of such data is often limited; and even when available, the data may have little forecasting value because of institutional or structural changes in the environment. Estimation of the likelihood of a spectacular loss or disaster – the area of special interest for risk managers – is especially difficult, since by definition the number of observations is limited.

Given these limitations, it is tempting to assume that outcomes will follow a bell curve, technically known as a normal distribution. This assumption has one very strong advantage The probability of an outcome can be estimated with measures of the mean and standard deviation. Because good estimates of the mean and standard deviation can be obtained from relatively few observations, this assumption allows risk managers to extrapolate the probability of extreme outcomes from relatively few data points.

But although this assumption is beguiling, it is not justified by empirical research. Many studies have concluded that most asset returns tend to have many more "very good” and "very bad” outcomes than would be predicted by a normal distribution – especially very bad outcomes. For example, using the mean and standard deviation of the monthly returns for both large stocks and long-term government bonds from 1926 through 1997 – and assuming a normal distribution – we can estimate the expected frequency of extreme losses. But the actual frequency of spectacular losses over the period was almost twice that number. "One hundred-year storms” occur more frequently than once every one hundred years. Alternatively, we can use models that do not depend upon the assumption of a particular distribution, but they typically require more data than are available. Or we can assume a distribution that looks more like the data we observe, but this often requires estimating parameters for which we have little confidence.

It is similarly tempting to assume that returns are not correlated over time (that the outcome this year does not depend on the outcome last year). Then relatively few observations are needed to extrapolate outcomes over a much longer period and, although runs of bad luck will occur, firms can ignore them in computing their required equity capital.

Unfortunately, this assumption is also not justified by the evidence. Again, monthly returns for both large stocks and long-term government bonds show that a high return one month is more likely to be followed by a high return the next; low returns are likely to be followed by more low returns. Firms that assume asset returns are not correlated will underestimate the frequency of bad outcomes and hold less equity capital than needed to achieve their desired level of protection against insolvency.

Likewise for firms that rely on diversification as a partial hedge for risk. Several recent studies find that during financial crises, asset returns tend to move together more than usual. Diversification that mitigates portfolio risk in "normal” times may fail to do so in a crisis. And at the very extreme, a firm may simply fail to recognize it has any exposure whatsoever, particularly in instances of new products or a change in the legal or technical environment that is not well understood.

Perhaps the most common way firms address the foregoing conceptual and measurement difficulties is to allow a margin for error. For example, commercial banks are currently permitted to use a common methodology known as "value-at-risk” to compute exposures, but are required to hold three times as much capital as indicated by the model. Firms also "stress-test” their current exposures by measuring the losses that would have occurred during some earlier period, such as the 1987 stock market crash or the 1998 Asian crisis, to determine if the firm has sufficient equity to weather such an event. One large international reinsurer stress-tests its portfolio under the assumption of simultaneous 8.5 Richter-scale earthquakes in Tokyo and Los Angeles. It should be noted, however, that we can"t know for certain if their margins for error are too little or too much.

BLUNDERERS AND ROGUES

It is a popular misconception that the objective of risk management is to eliminate risk. In fact, firms appear to pick and choose from among the types and degrees of exposure, taking on those risks they believe they have a competitive advantage in managing and laying others off into the capital markets, or accepting small or moderate exposures while insuring against catastrophic ones. Thus, a commercial bank may accept credit risk but avoid interest-rate risk, while an investment bank does the opposite.

Increasingly, both economists and strategic planners are coming to view risk management as related to the boundaries of the firm. In this framework, the decision either to assume or to mitigate a particular risk is analogous to the decision to integrate backward or to outsource a particular function. If a firm is especially good at mitigating a particular exposure, it can earn higher returns or grow faster than its competitors. Thus, risk management, like technology, distribution, or scale, can be a source of competitive advantage.

Risk mitigation can take a number of different forms. Perhaps the two most obvious are the purchase of insurance, where the firm pays a third party to assume the exposure, and hedging, where the firm takes an offsetting position in a security, commodity, or currency that is closely correlated with the exposure it wishes to mitigate. But firms also employ others, including market research, geographic and product line diversification, screening and monitoring of customers, outsourcing, imposing risk premiums in pricing products, carrying inventories or slack in productive capacity, and imposing procedures designed to minimize operational risks. To the extent that a firm is successful in mitigating the risks it assumes, it will require less equity capital.

But in the past few years, increased efforts by firms to mitigate risks have led to more instances where poor execution and mistakes in judgment have led to major losses, such as the prominent case of the German firm, Metallgesellschaft. (See sidebar.) Most failures arise because an employee inadvertently or purposefully fails to follow the procedures designed to mitigate risk. A rogue trader whose compensation or tenure depends on his trading results may fail to abide by position limits or hide cumulative losses; or maintenance personnel may overlook an incipient equipment failure. This so-called "agency risk” has been responsible for a number of notorious episodes, including the bankruptcy of Orange County, California, which occurred when a local official leveraged what was supposed to be a low-risk, short-term investment pool into a risky cash flow in an effort to increase returns and thereby enhance his professional reputation. When interest rates rose abruptly, the fund experienced massive losses. Barings, a British merchant bank, and Sumitomo, a Japanese trading company, were also victims of rogue traders who successfully concealed huge trading losses because they were responsible for reporting and settling their own trades.

More subtle is the tendency for management processes to fail incrementally over time. Case studies of industrial accidents have noted that such accidents are often preceded by a long incubation period marked by gradual degradation of the risk management processes. An initial failure to follow maintenance schedules or to test backup systems does not usually result in immediate harmful incidents, leading managers to conclude that the probability of failure has been overestimated or that mitigation efforts are redundant. The organization becomes desensitized to the existence of risk, and efforts to rectify the degradation of the risk mitigation procedures are less likely to occur as the degradation continues. Over time, incremental failures accumulate until some incident causes them to interact in a fashion that results in a major loss – a loss that could have been avoided had risk mitigation procedures been followed.

A similar process appears in financial crises. Financial crises are often preceded by a long period of gradually increasing exposures to a particular customer or asset type, with an accompanying loss of diversification. Because initially returns are attractive and losses minimal, managers often convince themselves that they have learned how to manage the risks, or that potential losses are less than previously believed, and that they are justified in increasing their exposures. Some observers have minimized the significance of lax regulatory policies as a contributing factor to the 1998 Southeast Asia crisis because the regulations were in place over a sustained period of time and were not relaxed immediately prior to the crisis. But such an argument ignores the long incubation period that occurs as procedures designed to mitigate risk undergo degradation.

THE MIGRATING NATURE OF RISK AND THE ROLE OF BANKS

But risk mitigation efforts can also run aground if firms fail to take account of the tendency for risk to change form and shift. Consider an interest-rate swap in which Party A pays a fixed rate and receives a variable rate and Party B receives the fixed rate and pays a variable one. By entering into the swap, A protects itself against a potential increase in short-term rates, since any increase in the cost of its liabilities will be offset by increased revenue from the swap. But such protection will only exist so long as B does not go belly up. That is, the swap does not really extinguish A's exposure, but transforms it from an exposure to interest rates to credit risk exposure to B. Indeed, the greater the success of the swap in mitigating interest-rate risk, the greater the credit exposure of A to B.

This points up a harsh reality. Any loss, whether resulting from operations or from market fluctuations, must ultimately be absorbed by someone's net worth. If a company suffers a loss due to a market fluctuation, its net worth will decline. If the loss exceeds its net worth, then the excess must be absorbed by the net worth of its creditors. If that net worth is insufficient, any excess must be absorbed by the net worth of the creditor's creditors. In short, like a row of dominoes toppling in sequence, losses will migrate through the financial system. Because ex post risk migration is more likely to occur when losses are large, this may also explain why asset returns tend to move together during extreme circumstances.

Because activities such as purchasing insurance or hedging cannot reduce this systemic risk, they also do not reduce the total amount of equity capital needed to absorb it. Rather, for the economy as a whole, the total amount of the equity capital cushion is independent of the amount of risk mitigation undertaken. Indeed, as in the example of the swap between A and B, the greater the amount of risk mitigation, the more likely unforeseen losses will migrate quickly from one market to another, or from one country to another. While hedging can reduce independent risk, it can also enhance systemic risk.

Furthermore, as risk migrates through the system, it tends to emerge in its most basic form, credit risk. The tendency for errors in risk management to emerge ultimately as credit exposures means that commercial banks play a special role. Commercial banks are in the business of accepting and managing credit risk. They act as shock absorbers, absorbing errors in risk management made elsewhere in the system. The capacity of banks to act as buffers against errors in risk management depends on their ability to measure and mitigate their own exposures, as well as the sufficiency of their equity capital. A well-managed and well-capitalized banking system is requisite for avoiding systemic economic and financial crises.

A "TEXTBOOK” HEDGING STRATEGY GONE WRONG METALLGESELLSCHAFT

In 1991, the German conglomerate Metallgesellschaft decided to establish a new business supplying long-term energy products at fixed prices. At the same time, it "supposedly put in place a 'textbook' hedging strategy," reported a later Federal Reserve study. A U.S. subsidiary contracted to sell millions of barrels of oil at fixed-price contracts extending over 10 years, and then sought to hedge the resulting exposure to oil price increases through oil futures and commodity swaps. But when the spot price of oil subsequently fell, although the long-term fixed-price contracts to deliver oil increased in value, Metallgesellschaft's futures and swap positions declined. And because the losses on its futures positions were computed and actually paid at the end of each day, while those on its delivery contracts were not, the firm experienced large cash outflows.

Another factor contributing to its losses was the structure Metallgesellschaft chose for the hedge - it constructed a rolling hedge consisting of short-term futures contracts. To hedge the long-term delivery contracts, these short-term contracts needed to be rolled over at delivery. Usually, petroleum spot market prices are higher than near-dated futures, so the firm would have made money each time it rolled the hedge. But soon after the firm established its position, the usual relationship reversed itself and the spot price of oil fell below the futures price. So each time Metallgesellschaft rolled the hedge, it hemorrhaged even more cash.

Evidently convinced they could not sustain further cash outflows, Metallgesellschaft's management chose to liquidate the hedge, leaving themselves exposed when oil prices subsequently rose again. By early 1994, losses were large enough to result in the firm's near collapse.

Ralph C. Kimball is an Economist at the Federal Reserve Bank of Boston and an Associate Professor of Finance at Babson College. His article, “Failures in Risk Management,” appeared in the January/February New England Economic Review.