ERM Exam – Part 4 of 4

by Dr. Rick Nason, PhD, CFA
Partner, RSD Solutions Inc.

Introduction

(Note to Reader:  This Introduction is a repeat of the Introduction to part 1 of this four part blog.  If you have already read this introduction, skip to the exam question below)

I teach a course in Enterprise Risk Management (ERM) in the MBA program at Dalhousie University in Halifax Canada.  Although I am a big fan of ERM, I also believe that it is a bit of a weird course to teach at a Business School. 

The reasons why I think that ERM is a bit of an out-of-place course in an MBA program are many.  To begin, ERM as a subject area is really quite trivial and probably not worthy of a Masters Level degree (of course that same criticism could be leveled against 90% of a typical MBA curriculum).  While there are many aspects and techniques to learn about ERM, each one of them is quite trivial, or based on obvious common sense (yes – I know that there is nothing common about common sense!)  What is NOT trivial about ERM are the implementation issues.  Implementing ERM is hard and requires great creativity, business insight and a PORTFOLIO of skills and techniques that few mangers or management teams possess.  The difficulty of teaching ERM to MBA students is that while they may have learned a diverse portfolio of techniques, that is a far cry from having a portfolio of SKILLS and also a far cry from having sufficient business insight.

A second issue that arises when teaching ERM in the context of an MBA program is the issue of whether or not ERM is a separate subject from strategy.  In a way it is analogous to the humorous Shreddies commercial when they talk about the “new” diagonal shaped Shreddies as opposed to the “old” square shaped Shreddies.  In a lot of ways ERM class looks like a business strategy class.  Perhaps that is not a bad thing as it reflects my bias that ERM should be critically tied to and inseparable from the strategy function within a firm.

A third issue is that ERM is still a young field academically.  That is, there is not a lot of academic research of note that has produced testable theories about good and bad practices of ERM.  Perhaps that is just as well, as I am not sure that business academic research is all that valuable.  (How much time do you think practitioners spend reading and digesting academic business journals?)

A final issue (there are many more, but I want to get to the real purpose of this blog) is that ERM studies do not have a natural home within the traditional silos of business schools.  Is ERM a quantitative subject or a qualitative subject?  Is ERM Finance, Statistics, Operations, Strategy, Organizational Behaviour, Accounting, or some other field?  In my mind, ERM has components of all of the above.  This bias of mine about ERM was the basis of my earlier comment that ERM requires a portfolio of skills and techniques.  However, business schools, in their striving for academic respectability are taking specialization to the extremes.  This of course implies that there simply is no time – nor is there any respect - for any subject matter that is not “pure” in an academic sense.

Despite all of these shortcomings, I – in my stupidity and naïveté – attempt to teach ERM to MBA students.  To make up for the shortcomings I try to teach it as much as possible as a seminar class.  That is, students are given a weekly set of readings, as well as an open ended set of questions or issues, and then we discuss the questions and issues in the following class.  The class is taught by the Socratic method, and I attempt to get as much debate as possible generated.  Students are challenged to be creative, and perhaps most importantly to peel back the “layers of the onion” to see the issues behind the issues and the issues behind implementation.  As stated earlier, my belief is that ERM as a subject (taken at its face level) is trivial.  It is only when you think about the consequences of techniques and the implementation issues that it becomes interesting and a challenge.

Thus we get to the purpose of this blog – namely, how should I structure an exam for this class?  In this, and the following three blogs I am going to put forth my exam questions, and why I asked each exam question.  I welcome reader’s comments and thoughts on my questions.  Each of the questions has been designed with my biases (as stated above) in mind.  In the very first meeting with the students I outline my biases and give them plenty of time to find a “real” class that they can take in place of ERM for the semester.  For some strange reason most of the students do not drop the class.  (I wish they would – it would mean less marking for me.)

In any case, I hope you enjoy this set of blogs – and I truly would like to hear not only your comments about my questions, but also what you might suggest as answers.


Question 4:

(a)   Prepare a briefing (as you would for example to a Board member) explaining why a corporation (such as General Motors) should adopt an ERM process.

(b) Prepare a briefing explaining why a corporation (such as General Motors) should NOT adopt an ERM process.

(c) Assuming you are a Board member of a corporation (such as General Motors), would you elect to adopt or not adopt an ERM process for the company? What would be the main factor in your decision? 

This question is the obvious “pros and cons” question that can be expected on every subjective subject exam at the graduate level.  My attempt here is to force students to take both sides of the debate as well as make up their own minds, despite the fact that they know I am a big fan of ERM as a process.

There are indeed many pros and as many, if not more, cons of implementing an ERM process.  Complicating this question is that the sample company in question (General Motors) is a company in crisis.  The experienced ERM reader will of course have internalized the message stated many other places that risk management is not crisis management (although newbies to the ERM field frequently think the two are interchangeable).

The pros of ERM include, but are not limited to, (in fact I am intentionally leaving some of the more obvious ones out of this discussion – dinner is almost ready …):

• increase in organizational learning and organizational self-awareness
• possible mitigation of the effects of the next economic crisis
• possibly greater ability to capitalize on the next economic upturn
• better corporate governance and organizational direction
• better management and employee development
• improved organizational response time to changing conditions
• possible improvement in credit rating and ability to finance at better terms
• earlier recognition of problems and opportunities
• better accountability of line managers
• better corporate integration and communication
• better accountability to stakeholders

The cons of implementing an ERM program include (but again not limited to):

• cost
• organizational distraction from the task at hand
• time to develop and implement (which in the case of GM, time is not exactly on their side)
• the difficulty of answering the hard questions of what is the organizational definition of risk and the organization’s risk philosophy
• the energy required to instill a common organizational understanding of the above stated definition of risk and the risk philosophy
• the appearance of the intangibility of the successful outputs of ERM (note that I used the word “appearance” – I personally believe the benefits of a properly executed ERM program are very tangible)
• the sheer size of GM makes implementing a proper ERM program all the more difficult (and perhaps all the more necessary)

Ultimately whether you consider it a good idea for GM to be implementing ERM at this stage is dependent on your beliefs on the time & energy tradeoff versus short-term benefits of ERM.  My opinion is that since ERM is basically an all or none exercise (more on this in a later blog), and since GM is still in crisis mode, and since ERM is a long term exercise, it might be best to take a page from the medical field and stabilize the patient first, and then you can start to work on the factors that improve long term health.

ERM Exam – Part 3 of 4

by Dr. Rick Nason, PhD, CFA
Partner, RSD Solutions Inc.

Introduction

(Note to Reader:  This Introduction is a repeat of the Introduction to part 1 of this four part blog.  If you have already read this introduction, skip to the exam question below)

I teach a course in Enterprise Risk Management (ERM) in the MBA program at Dalhousie University in Halifax Canada.  Although I am a big fan of ERM, I also believe that it is a bit of a weird course to teach at a Business School. 

The reasons why I think that ERM is a bit of an out-of-place course in an MBA program are many.  To begin, ERM as a subject area is really quite trivial and probably not worthy of a Masters Level degree (of course that same criticism could be leveled against 90% of a typical MBA curriculum).  While there are many aspects and techniques to learn about ERM, each one of them is quite trivial, or based on obvious common sense (yes – I know that there is nothing common about common sense!)  What is NOT trivial about ERM are the implementation issues.  Implementing ERM is hard and requires great creativity, business insight and a PORTFOLIO of skills and techniques that few mangers or management teams possess.  The difficulty of teaching ERM to MBA students is that while they may have learned a diverse portfolio of techniques, that is a far cry from having a portfolio of SKILLS and also a far cry from having sufficient business insight.

A second issue that arises when teaching ERM in the context of an MBA program is the issue of whether or not ERM is a separate subject from strategy.  In a way it is analogous to the humorous Shreddies commercial when they talk about the “new” diagonal shaped Shreddies as opposed to the “old” square shaped Shreddies.  In a lot of ways ERM class looks like a business strategy class.  Perhaps that is not a bad thing as it reflects my bias that ERM should be critically tied to and inseparable from the strategy function within a firm.

A third issue is that ERM is still a young field academically.  That is, there is not a lot of academic research of note that has produced testable theories about good and bad practices of ERM.  Perhaps that is just as well, as I am not sure that business academic research is all that valuable.  (How much time do you think practitioners spend reading and digesting academic business journals?)

A final issue (there are many more, but I want to get to the real purpose of this blog) is that ERM studies do not have a natural home within the traditional silos of business schools.  Is ERM a quantitative subject or a qualitative subject?  Is ERM Finance, Statistics, Operations, Strategy, Organizational Behaviour, Accounting, or some other field?  In my mind, ERM has components of all of the above.  This bias of mine about ERM was the basis of my earlier comment that ERM requires a portfolio of skills and techniques.  However, business schools, in their striving for academic respectability are taking specialization to the extremes.  This of course implies that there simply is no time – nor is there any respect - for any subject matter that is not “pure” in an academic sense.

Despite all of these shortcomings, I – in my stupidity and naïveté – attempt to teach ERM to MBA students.  To make up for the shortcomings I try to teach it as much as possible as a seminar class.  That is, students are given a weekly set of readings, as well as an open ended set of questions or issues, and then we discuss the questions and issues in the following class.  The class is taught by the Socratic method, and I attempt to get as much debate as possible generated.  Students are challenged to be creative, and perhaps most importantly to peel back the “layers of the onion” to see the issues behind the issues and the issues behind implementation.  As stated earlier, my belief is that ERM as a subject (taken at its face level) is trivial.  It is only when you think about the consequences of techniques and the implementation issues that it becomes interesting and a challenge.

Thus we get to the purpose of this blog – namely, how should I structure an exam for this class?  In this, and the following three blogs I am going to put forth my exam questions, and why I asked each exam question.  I welcome reader’s comments and thoughts on my questions.  Each of the questions has been designed with my biases (as stated above) in mind.  In the very first meeting with the students I outline my biases and give them plenty of time to find a “real” class that they can take in place of ERM for the semester.  For some strange reason most of the students do not drop the class.  (I wish they would – it would mean less marking for me.)

In any case, I hope you enjoy this set of blogs – and I truly would like to hear not only your comments about my questions, but also what you might suggest as answers.


Question 3:  If you were to set up an ERM training course for a financial institution, how would you structure the training?  What would be the components of the course, what elements would you train on, what training or education methods would you use, and what structures would you put in place for continuous learning?  In other words, what are the most important elements of ERM that would have to be learned by the employees, and how would you go about having them learn these key elements?

This may be considered to be a trick question.  Can the skills needed for ERM be achieved through training?  There are certainly many tools and techniques that can be taught, but there is much more to successful ERM implementation than tools and techniques.  It brings up the old joke about how many psychologists does it take to change a light bulb?  Answer:  Only one, but the light bulb has to want to change.  Likewise a successful ERM implementation requires that the organization wants to have a successful risk makeover, and that desire cannot be brought about through training alone.

Having said that, there are several items that can be thought of as necessary components of ERM training.  The first, and perhaps most important component is to develop understanding (note – understanding, rather than simple knowledge of the facts) of some key terms and terminology.  The most basic, yet most contentious definition is that of the definition of the word “risk”.  I have blogged before on the definition of risk, and my experience has been that gaining a common understanding of the term is quite difficult for most corporations.

Another upfront component is to introduce the various frameworks for ERM.  I have also blogged and presented before on the topic of “Risk Frameworks are Evil”.  It is obvious that I am not a fan of simply picking a risk framework off of the shelf and applying it to an organization.  However knowledge of the various frameworks, as well as a critical examination of the pros and cons of the different frameworks helps an organization better understand the ERM tasks before them.

There are a variety of various topics and tools that need to be covered as well, including but not limited to:

• statistical measures for risk management (the obvious first choice, but in my experience one of the least useful topics to cover)
• VAR, EAR, CFAR etc.
• risk maps
• design of risk dashboards
• developing a flexible and useful taxonomy of risks
• risk identification and quantification techniques such as the Delphi Method
• risk philosophies
• the various types of responses to risk
• best practices of ERM
• worst practices of ERM
  

The list of potential topics is unlimited.  Risk knowledge is like backgammon – easy to learn but it takes a lifetime to master.

The important part in my opinion is how the risk knowledge is to be gained.  As stated previously in the Introduction, my philosophy is that ERM is easy to learn, but very difficult to implement.  Thus it is only through working through the implementation issues that the training becomes effective.  (An analogy I like to use harkens back to my previous career as a tennis teaching pro.  You can watch all of the tapes, and read all the books about tennis, and that will make you quite knowledgeable about the sport, and about what to do, and what not to do.  However, until you actually go out onto the court and try to hit the ball, you are clueless about how to play tennis.) 

I believe that ERM training is only effective if it is done in a hands-on workshop style using real case studies and real organizational problems.  This implies that the trainer not only has to be the knowledge expert and facilitator, but they also have to be a coach, a consultant, a cheerleader, and be able to deal with on-the-spot ambiguity in the training.  This requires experience, flexibility, creativity and a whole lot of energy.

The typical “three-ring-binder” style of training will not be effective for ERM implementation.  ERM is about doing and not about knowing.  Unfortunately, most workshops focus on the knowing and not on the doing.

A final component that I am a strong believer in is that of continuous learning.  Many organizations create an extensive training program, and upon completion they think the job is done!  ERM is not like that.  ERM is evolving knowledge.  For an organization to be successful they must develop ongoing training and workshops.  People’s ideas and understanding of ERM issues evolves through experience.  The organizational learning evolves through experience.  What was a set of risks (good or bad) becomes dealt with so naturally that it opens up opportunities for new risks to be managed.  These new risks and opportunities present new challenges for learning and development.  ERM learning should always be ongoing to a certain extent.

ERM Exam – Part 2 of 4

by Rick Nason, PhD, CFA
Partner RSD Solutions Inc.

Introduction

(Note to Reader: This Introduction is a repeat of the Introduction to part 1 of this four part blog. If you have already read this introduction, skip to the exam question below)

I teach a course in Enterprise Risk Management (ERM) in the MBA program at Dalhousie University in Halifax Canada. Although I am a big fan of ERM, I also believe that it is a bit of a weird course to teach at a Business School.

The reasons why I think that ERM is a bit of an out-of-place course in an MBA program are many. To begin, ERM as a subject area is really quite trivial and probably not worthy of a Masters Level degree (of course that same criticism could be leveled against 90% of a typical MBA curriculum). While there are many aspects and techniques to learn about ERM, each one of them is quite trivial, or based on obvious common sense (yes – I know that there is nothing common about common sense!) What is NOT trivial about ERM are the implementation issues. Implementing ERM is hard and requires great creativity, business insight and a PORTFOLIO of skills and techniques that few mangers or management teams possess. The difficulty of teaching ERM to MBA students is that while they may have learned a diverse portfolio of techniques, that is a far cry from having a portfolio of SKILLS and also a far cry from having sufficient business insight.

A second issue that arises when teaching ERM in the context of an MBA program is the issue of whether or not ERM is a separate subject from strategy. In a way it is analogous to the humorous Shreddies commercial when they talk about the “new” diagonal shaped Shreddies as opposed to the “old” square shaped Shreddies. In a lot of ways ERM class looks like a business strategy class. Perhaps that is not a bad thing as it reflects my bias that ERM should be critically tied to and inseparable from the strategy function within a firm.

A third issue is that ERM is still a young field academically. That is, there is not a lot of academic research of note that has produced testable theories about good and bad practices of ERM. Perhaps that is just as well, as I am not sure that business academic research is all that valuable. (How much time do you think practitioners spend reading and digesting academic business journals?)

A final issue (there are many more, but I want to get to the real purpose of this blog) is that ERM studies do not have a natural home within the traditional silos of business schools. Is ERM a quantitative subject or a qualitative subject? Is ERM Finance, Statistics, Operations, Strategy, Organizational Behaviour, Accounting, or some other field? In my mind, ERM has components of all of the above. This bias of mine about ERM was the basis of my earlier comment that ERM requires a portfolio of skills and techniques. However, business schools, in their striving for academic respectability are taking specialization to the extremes. This of course implies that there simply is no time – nor is there any respect - for any subject matter that is not “pure” in an academic sense.

Despite all of these shortcomings, I – in my stupidity and naïveté – attempt to teach ERM to MBA students. To make up for the shortcomings I try to teach it as much as possible as a seminar class. That is, students are given a weekly set of readings, as well as an open ended set of questions or issues, and then we discuss the questions and issues in the following class. The class is taught by the Socratic method, and I attempt to get as much debate as possible generated. Students are challenged to be creative, and perhaps most importantly to peel back the “layers of the onion” to see the issues behind the issues and the issues behind implementation. As stated earlier, my belief is that ERM as a subject (taken at its face level) is trivial. It is only when you think about the consequences of techniques and the implementation issues that it becomes interesting and a challenge.

Thus we get to the purpose of this blog – namely, how should I structure an exam for this class? In this, and the following three blogs I am going to put forth my exam questions, and why I asked each exam question. I welcome reader’s comments and thoughts on my questions. Each of the questions has been designed with my biases (as stated above) in mind. In the very first meeting with the students I outline my biases and give them plenty of time to find a “real” class that they can take in place of ERM for the semester. For some strange reason most of the students do not drop the class. (I wish they would – it would mean less marking for me.)

In any case, I hope you enjoy this set of blogs – and I truly would like to hear not only your comments about my questions, but also what you might suggest as answers.


Question 2: What do you believe are the three main SOLVABLE problems of risk management that might be cracked in the next 5 to 10 years? Indicate (or speculate on) how each of these problems might be solved. In other words, describe three areas or ideas or concepts where we might make significant progress in the development of the practice of ERM.

This was a truly nasty question to ask. (As a former PhD student in physics I considered it to be only fair payback / passing on of the torture I endured as a graduate student.)

In financial risk management we are currently in a world where it is considered very enlightened and new age to state “risk management is broken!” as you sip whatever the drink du jour is at the society cocktail party. In Enterprise Risk Management however we seem to believe that the “nut” has been cracked and it is only a matter of more forceful and patient implementation that solves all issues. However as alluded to in question 1, not all is rosy or straightforward in ERM land.

My belief is that the main potentially solvable issue in ERM is integration or correlation. There is a lot of promising work being done in this area, but just when we get close to the answer(s) we find the business / economic world presents us with a phase shift or paradigm shift. (I trust the readers of this blog spot the intended irony here.)

In my PhD days I studied volatility and diffusion – topical issues at the time. Today if I was to do a PhD (highly unlikely given where Finance PhD research is going) I would like to study correlation. Development of correlation models is one of those high risk, high reward PhD thesis topics. High risk as there is a very high probability that you never get something developed that is considered PhD worthy. High reward in that if you do crack the nut, then the risk and finance worlds will be your oyster. (As an aside, if I was to redo a PhD in business I would do it either on the marketing of churches, or on the marketing practices of street vendors. I find both topics to be fascinating.)

In the early 90’s we all wanted better models of volatility. Of course everyone remembers Salomon Brother’s GIFT model – a GARCH related model that was supposed to give meaningful volatility predictions. Not sure what happened to it – maybe it is still in use – but I have not heard much about it lately. Now the topic du jour is correlation. I suspect that each of the major banks, as well as several hedge funds are developing proprietary correlation models that promise to capitalize and profit from correlation analysis. (For the record I did one of the early PhDs based on ARCH Models. Basically I showed that it you simply took into account the number of times the specialists changed their quotes intraday that the ARCH effects went away. It was considered a good thesis on account of my methodology, but no one was interested in the results – too boring to consider that a bunch of “uneducated” floor traders who made their livelihood off of trading on the floor of the exchange would know anything about the markets.)

At this point I have to confess that I am not really sure what another potentially solvable problem is for ERM. I know that there are lots of problems – but are they solvable? Every problem I can come up with seems to have an immediately obvious roadblock. One such issue is that of adjusting each individual’s risk tolerance. With the exception of Andy Lo’s (and others) work on “neurobehaviouralfinancechemistry” I am not sure this is an area for academic development. My own academic ethics department I am sure would have trouble if I suggested doing work in this area.

Perhaps another potentially solvable problem of ERM is that of believing that we have to know everything in order for a field to be acceptable. In my mind ERM is a field by which we cannot know everything – but try telling that to a risk manager that has been trained in the field of mathematics. Knowing everything is only a matter of being smarter to know better the mind of God – or whatever deity that sets the whims of business risk.

The above point brings to mind something that I just read in the book “Shop Class as Soulcraft” by Matthew Crawford (The Penguin Press, 2009). He states “The mechanic and the doctor deal with failure everyday, even if they are expert, whereas the builder does not. This is because the things they fix are not of their own making, and are therefore never known in a comprehensive absolute way.” In my opinion, Matthew Crawford could have also been talking about risk engineers, as the things they try to fix (risks) are not of their own making – they are the making of the very complex socio-economic business world that we live in. I intend to write a blog in the near future on this specific theme.

The bottom line is that ERM as a field has to overcome the problem of believing that it has to be able to solve or prevent (or mitigate, or properly embrace) every risk that is known and even unknown. This is a fool’s errand. However I am not sure it is a solvable problem in our world that only listens to all-knowing, omnipotent experts.

There are of course a host of other problems that ERM experts and academics (notice I did not lump the two together) are working on, including:

• quantification of operational, strategic, legal, human, reputation etc. risks
• a common quantification scale for all of the above
• Black-Swan quantification / tail modeling
• systematic and comprehensive risk identification schemes
• accreditation programs (not sure why this is a problem, but I suspect that someone sees a solution ($$$$) in accreditation despite the lack of a problem)
• training for Boards of Directors

I am sure there are a host of others. As always, I would be delighted to have my readers share their thoughts on this.

ERM Exam – Part 1 of 4

by Rick Nason, PhD, CFA
Partner RSD Solutions Inc.

Introduction

I teach a course in Enterprise Risk Management (ERM) in the MBA program at Dalhousie University in Halifax Canada. Although I am a big fan of ERM, I also believe that it is a bit of a weird course to teach at a Business School.

The reasons why I think that ERM is a bit of an out-of-place course in an MBA program are many. To begin, ERM as a subject area is really quite trivial and probably not worthy of a Masters Level degree (of course that same criticism could be leveled against 90% of a typical MBA curriculum). While there are many aspects and techniques to learn about ERM, each one of them is quite trivial, or based on obvious common sense (yes – I know that there is nothing common about common sense!) What is NOT trivial about ERM are the implementation issues. Implementing ERM is hard and requires great creativity, business insight and a PORTFOLIO of skills and techniques that few mangers or management teams possess. The difficulty of teaching ERM to MBA students is that while they may have a learned a diverse portfolio of techniques, that is a far cry from having a portfolio of SKILLS and also a far cry from having sufficient business insight.

A second issue that arises when teaching ERM in the context of an MBA program is the issue of whether or not ERM is a separate subject from strategy. In a way it is analogous to the humorous Shreddies commercial when they talk about the “new” diagonal shaped Shreddies as opposed to the “old” square shaped Shreddies. In a lot of ways ERM class looks like a business strategy class. Perhaps that is not a bad thing as it reflects my bias that ERM should be critically tied to and inseparable from the strategy function within a firm.

A third issue is that ERM is still a young field academically. That is, there is not a lot of academic research of note that has produced testable theories about good and bad practices of ERM. Perhaps that is just as well, as I am not sure that business academic research is all that valuable. (How much time do you think practitioners spend reading and digesting academic business journals?)

A final issue (there are many more, but I want to get to the real purpose of this blog) is that ERM studies do not have a natural home within the traditional silos of business schools. Is ERM a quantitative subject or a qualitative subject? Is ERM Finance, Statistics, Operations, Strategy, Organizational Behaviour, Accounting, or some other field? In my mind, ERM has components of all of the above. This bias of mine about ERM was the basis of my earlier comment that ERM requires a portfolio of skills and techniques. However, business schools, in their striving for academic respectability are taking specialization to the extremes. This of course implies that there simply is no time – nor is there any respect - for any subject matter that is not “pure” in an academic sense.

Despite all of these shortcomings, I – in my stupidity and naïveté – attempt to teach ERM to MBA students. To make up for the shortcomings I try to teach it as much as possible as a seminar class. That is, students are given a weekly set of readings, as well as an open ended set of questions or issues, and then we discuss the questions and issues in the following class. The class is taught by the Socratic method, and I attempt to get as much debate as possible generated. Students are challenged to be creative, and perhaps most importantly to peel back the “layers of the onion” to see the issues behind the issues and the issues behind implementation. As stated earlier, my belief is that ERM as a subject (taken at its face level) is trivial. It is only when you think about the consequences of techniques and the implementation issues that it becomes interesting and a challenge.

Thus we get to the purpose of this blog – namely, how should I structure an exam for this class? In this, and the following three blogs I am going to put forth my exam questions, and why I asked each exam question. I welcome reader’s comments and thoughts on my questions. Each of the questions has been designed with my biases (as stated above) in mind. In the very first meeting with the students I outline my biases and give them plenty of time to find a “real” class that they can take in place of ERM for the semester. For some strange reason most of the students do not drop the class. (I wish they would – it would mean less marking for me.)

In any case, I hope you enjoy this set of blogs – and I truly would like to hear not only your comments about my questions, but also what you might suggest as answers.


Question 1: ERM has created a lot of excitement, but very few successful examples. Explain why you believe ERM has so few successful implementations.

After reading the introduction, you will immediately understand why I might start off with this question. ERM is not about techniques, diagrams or frameworks. ERM is about implementation. The tools, techniques and frameworks are easy to understand. They are as intuitive to understand as that of a parent’s love for their child. However, how to best love and care for a child is anything but trivial – just wait until you get teenagers and you will understand my point!

I believe that books could be written about why ERM succeeds so rarely. One reason in particular sticks out with me. That reason is that most companies that embark on an ERM initiative have no idea what successful implementation looks like from the get go. In other words, very few companies that start an ERM program can finish this sentence – “This ERM initiative will be successful if …” If you do not know what success looks like, then how will you know when you get there?

A second reason is that ERM is usually not tied sufficiently into the strategy of the business. ERM should be a value-added enabler of the strategy. The setting of the strategy should also be done in conjunction with the ERM capabilities. If the strategy cannot be successfully risk managed, then I would argue it is not a good strategy. Thus strategy cannot be set independent of the ERM capabilities, and likewise ERM cannot be done independent of strategy.

A third reason is that ERM is advanced as either a qualitative area (heavy on the HR) or a quantitative area (heavy on the metrics). In my opinion, both elements are critically necessary for ERM. Implementing ERM without a qualitative element AND a quantitative element is like trying to play ice hockey with either a stick or skates but not both.

A fourth reason is that ERM is tough! Easy to state and understand, but tough to implement! It requires brains, knowledge, creativity, flexibility, quantitative skills, qualitative skills, intuition, business knowledge, business insight and tenacity to implement. It requires the modern day equivalent of a business renaissance-man to implement – and those renaissance men and women are hard to find. Business (and business schools are largely to blame for this) has become a field of specialists, not generalists. Generalists tend to be low level staff, and for ERM you need a mix of people who can at least think like high level staff.

A fifth reason is that the ERM function is often seen as the “Department of No!”, when it should be the “Department of We Will Figure Out How to Do This Prudently”. ERM as the “Department of No!” creates several problems. To begin with, competent managers do not want to be associated with a career killing “Department of No!” assignment, and thus the ERM team frequently winds up being the “Department of People No Other Department Wants”. Hard to recruit good people for that team! Furthermore the “Department of No!” does not exactly increase morale anywhere within the organization.

There are a variety of other reasons why there are so few successful examples of ERM implantation. Some of these reasons are:

• insufficient resources being given to the department
• insufficient commitment by senior management and the Board
• ERM implementation is seen as “risk – washing “. (Think green-washing and its implications and reputation.)
• insufficient training
• inability of an organization to look upon itself from the outside to see the real issues
• the pitiful frameworks implemented by the most junior associates at the major bulge bracket accounting firms that now call themselves consulting firms (was that too harsh of a statement on my part?)
• inaccurate expectations as to the time necessary to successfully implement ERM (BTW – the time necessary for successful implementation is about 30% of the time stated by the bulge bracket accounting firms that now call themselves consulting firms)
• inaccurate expectations about what an ERM implementation can and can not do for the organization

What are the reasons that you have seen? Let me know – I need some answers myself. Part 2 of this blog will contain the second question of the exam.

Why Is It Only The B.Music Grads Who Are Driving Lamborghinis?

by Rick Nason, PhD, CFA

Partner RSD Solutions Inc.

I recently gave a speech with the above title to the risk group at a large financial institution. It was a very exciting yet intimidating audience to talk to. Most of the audience members had advanced degrees in Mathematics or Physics, while most of the younger audience members had Masters degrees in Financial Engineering or Financial Mathematics. It was a thrill and an honour for me to be invited to spend some time with them.

The title of my talk might seem a bit strange – and perhaps even insulting to such an audience. To insult them however was the exact opposite of my objective. The point of my talk instead was to focus on how the career in risk pendulum may have shifted and that mathematical skill may not be the competitive advantage it once was. Instead my hypothesis is that mathematical skill combined with creativity, artistic and humanistic skills are the portfolio of skills that are now necessary in risk management.

Before continuing I should explain some of my personal basis for my arguments. I am a physicist that converted a graduate career in physics into a graduate degree in finance during the early 1990’s. I very much benefited from the Wall Street hunger for physicists at the beginning of the “math boom” in finance. However it is my liberal arts undergraduate degree that I consider to be the most valuable in my development as risk manager. I believe that the ability to think in liberal arts terms as well as mathematical terms is the new black in risk management.

Knowledge of risk techniques is a commodity. The ability to think and implement risk management is the value added, and in order to think and implement risk you need to understand a variety of aspects of risk – some quantitative but most qualitative. Additionally you need to be creative and flexible in your thinking. Unfortunately the business schools and financial engineering schools (and corporate training programs that produce cookie cutter analysts and consultants) are very good at disseminating knowledge, facts and frameworks, but knowledge, facts and frameworks are not the same as the ability to think and do!

One could argue (and I will argue in a future blog) that risk management is more about understanding people at both the individual level (within an organization and within the level of immediate stakeholders) as well as at the sociological level. Economists and Finance academics are currently rushing to make their mea culpas that their models cannot work in a world composed of irrational masses. The Behavioural Finance field has evolved to chronicle our collective mass irrationality (stupidity?) but offers few if any solutions for overcoming this collective handicap.

We thus come back to the fact that it is the artists of the world who may be best prepared to deal with the current shortcomings of quantitative risk management and repair the image of the field. Ironically physics and mathematics used to attract the creative types – those who dreamed and thought creatively. When I was a graduate student in physics it was common for students to use psychedelic drugs not for pleasure but to help them think more creatively and more outside the box. (Names withheld for obvious reasons.) While I am most certainly not advocating illegal drug use, I do believe that there needs to be a call made for more creativity and artistic license in the field of risk management. Physicists and financial engineers also like to drive Lamborghinis and should release their inner artist in order to regain the comparative value added that allows them to do so.

Simple, Complicated or Complex?

Rick Nason, PhD, CFA
Partner, RSD Solutions Inc.

I have a confession; my first training and career was as a physicist. As a physicist we calculate natural phenomena to astounding degrees of precision, often under highly controlled laboratory conditions. Yet, with all of that precision, and hundreds of years of theoretical and experimental development, physicists still embrace and accept the concept of complexity as the term is scientifically defined.

Conversely, in finance and risk management – fields with much shorter histories of study, and nothing like laboratories with controlled conditions – we insist on making measurements to ever higher degree of precision (such as in option pricing), even though it is widely accepted that the models may be incomplete and the input data subject to uncertainty or interpretation.

In the sciences there is a classic distinction between those processes which are Basic, Complicated and Complex processes and systems. The best explanation that I have ever read is in the book “Getting to Maybe: How the World is Changed” by Frances Westley, Brenda Zimmerman, and Michael Quinn Patton, with a forward by Eric Young. (Random House 2006) [1] This book has nothing to do with risk management but I would most highly recommend it to every risk manager as one of the best books on how to think about risk management and how the practice of risk management might evolve.

In Getting to Maybe, the authors explain Basic, Complicated and Complex systems using the analogies of “Baking a Cake”, “Sending a Rocket to the Moon” and “Raising a Child” respectively. Their description, greatly summarized and adapted, is as follows. In baking a cake it helps to follow a recipe and it helps to have experience, but even if a few mistakes are made, and a few measurement errors are incorporated it is likely that something resembling a decent and edible cake will be produced. In sending a rocket to the moon it is critical that each and every step (and there are a great many steps) must be followed exactly, and if each step is followed exactly then the space mission will be a success. In other words, getting a rocket to the moon is a complicated process, but if followed exactly then success is assured. Raising a child on the other hand is a complicated process. Even if the parent does everything correctly, there is no guarantee of success. Furthermore you cannot break the process of raising a child into a set of discrete steps or processes. Raising the child is an integrated and holistic process. Furthermore it is impossible to a-priori say exactly what the most necessary or important steps for raising a successful child are going to be as each child is unique even though most children exhibit common characteristics. Finally post raising a child it is virtually impossible to state what the most critical factors were in the success or failure.

A moments thought allows one to see the many parallels between raising a child and implementing risk management. We tend to think of risk management as a complicated process, where if we simply (?) get all the pieces in place then success will follow. But the risk management field is littered with risk debacles that occurred at organizations that were the acknowledged leaders in risk management[2]. The point is that risk management is complex, not complicated. Best practices in risk management do not guarantee success. Furthermore, it is nearly impossible to tell exactly and precisely after the fact what were the key factors that led to success or failure of a risk management program. Additionally risk management is a holistic process – for example you cannot manage market risk while ignoring liquidity or credit risk.

That is not to say that risk management is an alchemist’s game. As in raising a child, we know there are factors and actions that lead to a higher probability of success or failure. Also, as anyone who is a parent knows, raising children requires experience, wisdom and flexibility to adapt to changing environments and to changing cycles in a child’s development. In other words, it is actions (technical knowledge), wisdom (experience and listening / watching the best and worst practices of other parents) as well as intuition all taken together that lead to higher probabilities of success or failure.

To put it bluntly, technical knowledge alone is not sufficient for success in risk management. Realizing that risk management is a complex, and not a complicated profession is what is required. In a complex system you need the technical knowledge, wisdom, intuition, and as I argued in a previous blog creativity are all necessary to increase the probability of risk management success.

Risk management is not basic. Risk management is not complicated. Risk management is complex, and accordingly requires a complex package of knowledge and skills to manage.

[1] The amazon.com link is http://www.amazon.com/Getting-Maybe-How-World-Changed/dp/067931444X/ref=sr_1_1?ie=UTF8&s=books&qid=1252101549&sr=8-1

[2] For more on this point, see my forthcoming article “Is Your Risk System Too Good” in the October issue of the RMA Journal.

The Most Important Training Question

Rick Nason PhD, CFA
Partner, RSD Solutions Inc.

I often get requests for training seminars where the client has a long list of topics that they want covered. These lists will often be accompanied by varying degrees of details on the current knowledge level of the participants as well as their current job functions. Clients that having training departments will also have suggestions as to timing, format and pre-seminar and post-seminar activities. While this data is most welcomed, it misses the most important training question of all: What is it that you want the seminar participants to do after the training that they could not, or would not do before?

When confronted with this question, training managers (or more often than not now with the parsing of training departments it will be the line manager) often stumble with their words. They simply do not know what the change in action is that they want to have occur because of the seminar. They have a well defined body of knowledge that they believe needs to be conveyed, but the exact business reasons why the participants need this knowledge is generally extremely hard for them to articulate.

Often when I actually conduct the seminar I realize that many of the participants already have a fairly comprehensive knowledge – or at least a working knowledge of the material to be covered. The issue therefore is not knowledge per se, but performing actions that utilize that knowledge. There are many reasons why employees may know something yet not act on it. Self-esteem, confidence, not understanding the rationale behind the knowledge, not understanding how important acting on the knowledge is for the company or unit to achieve its objective, or simply that it is much easier to act on other knowledge by default or through habit.

This brings home the point that professional training should be about changing actions, changing confidence and changing the ability of the seminar participant in helping the organization to succeed. Successful training is only 1 part technical knowledge. It is 10 parts action, 10 parts rationale behind the action, 20 parts confidence and motivation in taking that action and 30 parts having the right objectives for the training program in the first place.

One training manager that I once worked with strongly questioned this line of reasoning, until I asked the question: “Do you want employees who know things, or employees who do things?” That question brought it all home.

The next time you call us (or another training firm for that manner) be prepared to have a dialogue about the answer to the question, “What is it that you want the seminar participants to do after the training that they could not, or would not do before?” You will be glad you did.