Risk management: Creating value

Click here to view an edited video of the discussion

The Participants

Keith Saxton - Global director, financial markets, IBM

What has the scale and complexity of the global financial crisis taught us about the nature of systemic risk?

Keith Saxton: The shock to the system has really heightened the fact that there is so much interconnectedness in the markets. Tracking that on a national system or tracking it by institution is all well and good, until you have this sort of extreme event. So the biggest shock here is not that the market is global or that firms operate globally, it is that everything is so interconnected.

Francis Lacan - Global risk and compliance solutions manager, financial services sector, IBM

Do you think we now have enough transparency and understanding of what went wrong to address the issue?

KS: The causes are pretty well written and studied now. What is still unknown is how we really measure the interconnectedness. We know where some pools of risk are created, we know where some of the data resides, we know where many of the transactions in the market are reported. But what we have not got is a picture of how you would visualise that and what you would do with that information.

Systemic risk is really a scenario-based approach at the very highest level. Of course, the super-regulators, the supra-national bodies such as the International Monetary Fund, already run big econometric models. What's wrong with running a financial model that starts to look at, and starts to track, some of this interconnectedness?

How has IBM engaged with the financial services community regarding this issue?

KS: After September 2008 we considered this issue in terms of what IBM can do to help. Because we are a large player in the financial services industry, it is clearly in our interest to help the industry to recover - that's the commercial aspect.

But the other aspect is: what are the assets and technologies and capabilities that a company such as IBM can bring to bear to really help the world get through this problem? Given the technology that is available today - and our knowledge of where super-computing and technology will be in five years' time - we know you can collect and measure and analyse data today that essentially will help us provide early warning systems and better structure to this market.

We shared this view with a large number of political bodies, supervisory bodies, central banks, regulators, major firms and exchanges initially, looking for a discussion about whether this was something that would gain some traction. Increasingly, the language started to be more consistent and we are at a point now where we have consistency of understanding.

How challenging has that process of engagement been for IBM?

KS: We haven't found it difficult to initiate a dialogue and we have found a big acceptance of our point of view - and, of course, there are others who have a similar point of view. We truly believe something pragmatic will happen, and we are probably going to see that in the next few months because we are looking at a market that has settled down somewhat. People have now got some time to think: 'OK, what should we start to do?' And then that will give us all an opportunity to do something tangible.

Can you elaborate on the role of technology in better managing Global systemic risk?

KS: Let's talk about it from a systemic regulator's point of view: there is a huge amount of data to analyse but, nevertheless, the speed of the current super computers and the known road map to the next generation of super computers that we are building make us very confident we can handle all the data in the market on an intra-day basis - maybe even on a live basis. The ability to handle that volume of data on an intra-day basis is predicated on developments and innovations in other technologies, such as storage.

So, at the systemic level, the picture is really about supercomputing. We use supercomputing for many other modelling problems around defence, for example, meaning this is something that has and can be done. We are very confident, going forward, that technology will allow the industry to do much more than was previously imagined.

In terms of internal risk management functions, how are your clients responding to growing regulatory pressure?

Francis Lacan: First, they are taking an enterprise view of risk. Most of the business management systems have developed in silos and within the domain of the particular business or particular business line. They do an excellent job of managing risk. It gets complicated, however, when it comes to bringing all these pieces together, not just at the enterprise level but at the industry level. So the big question is how to evolve from these very powerful systems that have been developed at the business-line level to build something that will better serve the entire organisation - not just in terms of avoiding disaster but also in terms of ensuring a proper balance of resource allocation and a balance between short-term and long-term profitability.

It is surprising to hear a strong defence of the risk management function. Many people would argue that these functions have performed very poorly.

FL: This issue is about the scope of definition and attribution of the function. Once you attribute a risk management division, or a risk manager, a well-defined function, budget and a scope of duties, it is very difficult to blame them afterwards and say: 'Well, actually the scope of your duties should not have been that, and your resources should have been bigger, and actually you should have done a very different job.' Most people would recognise that risk management is one of the many business management elements in a financial organisation: you cannot just blame one of the functions.

How do you respond to the argument that the entire risk management function should be overhauled?

FL: It is tempting, given the gravity of what has occurred, but it takes 10 to 20 years to develop this sort of complexity in an organisation. Look at the efforts of the Bank for International Settlements: it took almost a decade to come up with the latest version of Basel II.

It is a lot of effort, a lot of discussion, a lot of modelling and lots of role development. It is very difficult to overhaul all that. In the information technology industry, for example, you can't just decide to rip out and replace an operating system because it crashes once: you're probably better off just trying to fix it and improve it all the time.

Given the current economic climate, do your clients have funding problems internally when it comes to building out their internal risk management infrastructure?

FL: It is true that the industry has to spend a lot in order to apply all of the new requirements - and there are many. In all the projects we work on, there is a business case to be made and it is part of our role to help our clients build a business case. For instance, we increasingly try to generate value out of risk management because risk management is the nervous system of the organisation. Financial management is dealing with information, so when you have good information somewhere you know that there is added value you can derive from it: we can leverage risk information to provide a better allocation of resources.

In general, will the risk management function have to be better funded in future?

FL: Yes, for sure. And that will happen if the risk management function can demonstrate that it contributes to the value creation of the organisation. And many are doing that.

There have been occasions in which we are hired by organisations to help them demonstrate and measure the value that the risk management function creates. It is much more productive and motivating to be in a virtuous circle where you continuously improve your capabilities - and you can demonstrate that this generates value to the firm - than to be considered as a control function that is there just to limit the exposure and prevent the accident.

What should risk managers do to prove to the management that they can provide value?

FL: The risk management committees still have the problem of being perceived as isolated. I would advise all of them to do a better job in communicating and educating people outside their function. And although this goes beyond the scope of their function, the public, the investors, need to be better educated on risk management and to have a better understanding of the importance and the role of that function.