Did Risk Management Cause the Crisis?

I recently read the article posted on the RMI course website entitled "Did Risk Management Cause the Crisis?" by RIMS.

From reading the article I learned that a variety of factors were at play in this crisis. For example, it was a failure to enact appropriate enterprise risk management behaviors, and also failure to develop and reward internal risk management competencies.

The one thing I found most interesting was that the article mentioned the main problem was that there was a "failure to use enterprise risk management to inform management’s decision making for both risk-taking and risk-avoiding decisions." In class we discussed the fact that risk management is very important and that it provides great information for reducing the cost of risk for a company. However, we also discussed the fact that this risk management ONLY adds value IF it is enacted and used to make better management decisions. Clearly, this article is trying to show that the risk management procedures in place didn't do this at all, they did not help the management add value, because they did not help make better risk-taking and risk-avoiding decisions. Therefore, risk management for them was not value added.

Another thing I found interesting about this article was that it takes time to examine different risk management approaches. It explains the difference between "risk management," "enterprise risk management," and "financial risk management." I thought this was interesting because our class is titled "RMI 4350: Enterprise Risk Management," and we had spent a great deal of time in class discussing the process of enterprise risk management. In the article it describes risk management and financial risk management as limitations of ERM, whereas ERM is more all-encompassing. It describes ERM as involving more than just physical and financial exposures, it takes into consideration other things too, such as long-term strategy, competitors, human capital, operations, etc. It seemed to be describing ERM just as we did in class, as a process in which all the steps must be completed: (1) Figure out risk tolerance (2) Identify and measure risk (3) Develop a risk portfolio (4) Finance risks.

I also found it interesting how how article discussed the necessity of taking risks, just like we have discussed in class. It explained that though ERM is a great thing, "ERM can potentially identify situations in which risk can be a competitive advantage instead of only a threat. ERM encompasses all aspects of an organization in managing risks and seizing opportunities related to the achievement of the organization’s objectives." This shows, that just like stated in class, it takes some risks to be rewarded, and making a profit is all about a company being better than all its competitors at managing its risks - reducing the costs of its risks as much as possible.

RIMS: Did Risk Management Cause the Crisis?