Thread by @SAH16928046

Which are some stylized failures of Risk Management?

It is the only subject when turned into a profession, which fails to deliver in SVA terms in most of the cases, as witnessed now outside the Insurance Sector
Insurance is a different game because the profession is led by well-trained quantitative professionals such as Actuaries

Why it has not worked well outside the Insurance Sector/s?
The multiple reasons for the failure of Risk Management and Auditing Departments at firms could be the following =>

1.The maturity level of each organization is different and not naturally adapted to act, by giving a timely response to risk flags and control violations, as required.
#CGMA #IRM #ISO31000 #COSO #ERM #FRM #QRM #FBRA #FEMA #HACCOP #Hazard #Incident #Risk #Basel #SCR

2.Auditing & Risk Management continues to be dominated by Accountants, who are poor at understanding numerate disciplines such as mathematics and statistics/ econometrics, & so on etc.
Hence, a Risk Gap, to them is strictly a process gap, which can be filled by inserting controls

Accounting drove #Auditing lingua franca which uses financial auditing lexicons, terminologies and taxonomies to understand firm-wide risks confining all risks within one branch of specialism across the boardroom.
Not going beyond Materiality Misstatement Risks!

Some examples of ignorance of certain underserved areas are IT /MIS /Cyber, Financial Crime, AML/KYC, Economic Predicate #Crimes, Quantitative Model Governance and Fraud Risks, and design of appropriate controls and monitoring of the same by both the Audit and the Risk Department

3.Developing Risk Departments without undertaking GAP Studies.
4.Not updating risk registers.
5.Not understanding the difference among risk registers, RCSA Forms and templates, and Risk GAP Studies,

6.Using #KRIs to develop #RCSAs(when it should be the other way around) and update the timeline on given risk exposure, with the wrong information.

7.Delay in processing and flagging key operational and financial risks control violations

8.Lack of actionable #BI and Retrievable Information to further solidify the risk registers and the risk reporting frameworks in place.
9.Reactive risk management is auditing.
Risk Management should not be reactive but pro-active.
But how?
This requires extensive discussion.

10.Lack of Risk Culture.

Easy to hire a CRO and risk professionals.

Will other members of the organization equally well know and comprehend their standards, processes, policy nuances, conceptions, sophisticated terminologies, jargon, symbols, and heuristics, and signals, etc?

11.Confusion across the three lines of defence.

The 3 -LOD Model is neither well understood nor well entrenched to prevent risks from cascading across an organization.

12.Firms willing to implement some form of risk taxonomy and methodology using a CBOK(Common Body of Knowledge), do not have adequate human capital or well-trained or utilized BI - Business Intelligence Automated Systems to effectively implement escalation procedures in real-time

13.Risk Theory never equal to what we observe and deal with in reality.

What we learn in risk management or quantitative finance or financial engineering degree program does not apply in the real-world scenarios.

A common fallacy of assumption is the reliance on using the #Gaussian distribution to model operational and financial risks.

14.Poorly coordinated #GRC Activities.

15.Lack of Oversight from the #BODs.

16.Lack of qualified director-level appointment within the Boardrooms.

17.Risk of #Silo culture!
Working in Silos across an organization and no integration of risk strategies as per policies.

QRM Quantitative Risk Management has deeply disappointed, both the shareholders and the regulators, especially in the Non-Insurance Field, such as banking and asset management.

To overwrite this history of failures of Internal Auditing, Risk Management, Internal Controls and now the last in line to follow is ERM /IRM, in the corporate world, both as a process and methodology, we need to make risk management more practical, testable, and verifiable.

But, unfortunately, the academic mafia and the regulators, including overzealous practitioners have seemingly not learned their methodological lessons post-GFC.
Its a sign of insanity that we do the same experiments and expect different results.
For that, we need another thread.

@threadreaderapp unroll