Much of what managers need to know about modern risk management falls under four general headings: general risk management, the use of derivatives, value at risk and related issues, and dealing with taxation and regulation.

1. On General Risk Management

   1. Make sure you know the business and the risks it entails.

   2. Remember that you are the risk manager. You should have a clear corporate policy on risk that is understood by everyone concerned. You should also have some idea of the risks your firm is taking and why.

   3. The objective of risk management is not to eliminate or even minimise risks, but to manage them appropriately, considering the potential benefits from risk-taking.

   4. Risk management is a form of engineering: it uses science, but ultimately depends on judgement.

   5. The ultimate protection against risk is good judgement and alertness.

   6. Observe what goes on elsewhere and learn from the mistakes of others. If similar problems occur in your firm, prevent them.

   7. It is particularly important to learn from others when they lose huge amounts of money or go bankrupt. See that your firm is covered.

   8. When firms get into major difficulties, the problems involved are usually ones that management thought they had taken care of.

   9. It is the operational risks that usually bring institutions down. Remember Barings.

   10. The best defences against operational risks are sound systems of management control and vigilant managers.

   11. Be on the look-out for the obvious - business units that are apparently earning very large profits for no clear reason, figures in reports that are clearly suspicious, sudden deteriorations in performance, other managers under severe stress, very high turnover of staff, and that sort of thing

   12. If you are tempted to regard risk management as expensive, think of the alternative. Don't regard risk management as a drain on profits.

   13. Get good people you can trust, pay them well and back their judgement. Good people are far more valuable than good systems.

   14. Talk to your risk management people and be aware of their concerns.

   15. Take some interest in stress testing and contingency planning exercises.

   16. Never think that a fancy risk management system takes care of your risks for you and thereby relieves you of the need to stay alert.

   17. Understand the limitations of your risk management systems. Be clear about the risks your systems do not cover well, especially operational ones. Ask what could go wrong, ask yourself if the results seem right, and so forth.

   18. Have your risk management systems occasionally checked over by outside experts, and listen to their advice. Listen to your auditors as well.

   19. Remember that risk management is not an exact science, so do not be fooled by spuriously precise answers or be impressed by people who talk in such terms.

   20. Policy statements should give substantial objectives and policy guidelines, as opposed to the meaningless platitudes that abound in modern corporate life.

2. Dealing with Derivatives

   1. Do not be put off by the use of derivatives in recent problems. Derivatives are very useful tools, when used properly.

   2. Remember that derivatives have one or more of three uses: to take a position (i.e., to speculate), to hedge, or to reduce funding costs. If you are thinking about using derivatives, be clear why.

   3. Derivatives can therefore increase or decrease the overall risks, depending on how they are used

   4. Be aware of the leverage (i.e., the potential for gains or losses) in your derivatives positions, particularly leverage that might be hidden in complex derivativespositions.

   5. If you are using derivatives to reduce funding costs, make sure you understand why/how the contract gives you lower funding costs. In particular, make sure that you have not agreed to hidden options or other contingent payoff clauses that could lead to large losses later on.

   6. When dealing with derivatives providers, recognise that they always know more than you do.

   7. When considering contracts with derivatives providers, satisfy yourself that you broadly understand the risks you are thinking of taking on.

   8. When considering any derivatives contract, satisfy yourself that you want to take on the risks involved.

   9. Don't forget that people sometimes make very silly mistakes, especially when dealing with derivatives.

   10. In assessing a derivatives contract, particularly a complex one, have the contract reverse-engineered into its basic building block components - this helps in understanding the risks involved - and consider whether you would be better off taking on the building blocks instead.

   11. Shop around for quotes from different derivatives providers before agreeing to a particular contract.

   12. Protect yourself against unscrupulous providers by seeking qualified second opinions.

   13. You can also protect yourself by asking questions and insisting on full written answers. Questions should focus on prospective losses for different realisations of the underlying risk variable(s) (i.e., scenario analyses)

   14. If the answers you get are incomplete, unclear or otherwise unsatisfactory, don't get involved in long-drawn out negotiations. Just assume the worst and take your business elsewhere

   15. If you are not sure what questions to ask, seek guidance from your own risk managers or outside consultants. Always check with them anyway before signing anything.

   16. Know your exit costs. When negotiating with providers, try to nail down your likely liquidation costs in advance by asking for written quotes that specify the terms on which they would unwind your derivatives positions later.

   17. Before finally agreeing to any contract, decide on your stop loss position, so you know in advance the maximum loss you will tolerate before bailing out. Ensure that everyone else involved also knows the stop loss position.

   18. Having established your stop loss strategy, keep to it.

   19. When dealing with outside consultants, deal with people you can trust. As a general rule, employ consultants who have no axe to grind because they are not trying to sell you their own systems.

3. Dealing with VaR and Associated Systems

   1. Do not regard the VaR movement as just another management fad that will go away if you ignore it. VaR is not like business process re-engineering. It is here to stay and you may as well get used to it.

   2. There are some very good reasons to take the VaR movement seriously. It has a lot to offer.

   3. Understand clearly what the terms VaR, ERM, CFaR and the like actually mean. More important still, understand what they don't mean (i.e., understand that VaR does not give the maximum possible loss, and so on).

   4. Try to get some feel for what these VaR, ERM and other systems involve - their strengths, their potential uses, their limitations and weaknesses, and the like. This does not mean that you have to become an expert on them.

   5. You should investigate what benefits these various systems - VaR systems, ERM systems, CFaR systems, etc. - could bring to your particular firm. However, also recognise that the benefits can vary a lot from one firm to another, depending on each firm's particular business and circumstances.

   6. If you decide to adopt any of these systems, be clear why. There is only one good reason: you should adopt them if and because they fit your business needs, as you have identified them.

   7. Don't adopt VaR and associated systems just because your competitors are doing so. Resist the temptation to behave like a lemming.

   8. Don't adopt them just because you have some vague idea that they will help you steal a march on the competition. You are unlikely steal a march on the competition if you don't know what you are doing.

   9. Don't adopt them in response to pressure from shareholders or systems providers. Shareholders pay you to make these decisions for them and systems providers are looking for business.

   10. Pay attention to what other firms are doing, and learn from them.

   11. Don't be hurried, and remember that there is always the option of wait and see. Waiting allows you to see what mistakes other firms make so you can avoid them. Waiting till later will also be cheaper, because costs will fall over time.

   12. Think carefully (and seek advice) about the level of technology that is adequate for you.

   13. Establish the level of technology that is adequate to your needs - historical simulation, variance-covariance, or Monte Carlo simulation.

   14. The systems with the lowest level of technology are historical simulation ones, the highest tech ones are Monte Carlo systems, and variance-covariance systems are somewhere between.

   15. As a general rule, you are best off adopting the system with the lowest adequate level of technology. The higher the level of technology, the greater the expense, the more difficult the system is to use, and the greater the chances of something going badly wrong.

   16. Don't ever buy a complex system without satisfying yourself that you really need it - don't buy an expensive Monte Carlo system, say, when a simple historical simulation system would do.

   17. Be discriminating - systems must suit your particular business needs. Remember that there is even more variety (and potential variety) among CFaR and ERM systems than among VaR systems proper.

   18. As a general rule, large firms need systems fitted for them, as opposed to systems just bought off the shelf and imported without much thought. This is particularly so when it comes to ERM and CFaR systems.

   19. Be wary of buying expensive systems off the shelf, and be very wary of providers who would sell you very complex systems that only rocket scientists can understand.

   20. Shop around for systems and service providers, and don't confuse expense with quality. It is very easy to spend a lot of money on a poor or inappropriate system.

   21. Never, ever, buy complex systems that no-one in your firm is comfortable with. Either the systems are unnecessarily complex or else you need to hire people who can work with them.

   22. Make sure you have access to advice from people who understand the area. Work closely with your risk management and treasury people, and don't go against their advice unless you have good reason to.

   23. When setting up VaR and related systems, ensure that you also develop good stress testing capability. Make sure that you use these systems in conjunction with regular and detailed stress tests.

   24. Take some interest in stress testing exercises, if only to inform the broader planning process.

   25. You should insist that your VaR, CFaR, stress test and other reports be informative, but not unnecessarily so. They should be short and to the point, and written in plain language. Besides reporting key numbers, they should also warn you of important problems or qualifications that you should be aware of.

   26. Insist on periodic longer reports that go into more detail and keep you warned of medium to longer term problems and other issues that would not make it into your more regular VaR reports.

   27. Keep in mind that no systems ever give guaranteed results. Remember the more general risk management rules set out earlier. Never think that you have some foolproof system that allows you to go to sleep. Never be complacent.

4. Dealing with Taxation and Regulation

   4.1. Dealing with Taxation

   1. Be clear about the difference between avoidance (which is legal) and evasion (which is not). Remember: evasion is what you must avoid.

   2. The interests of your stakeholders require you to avoid (as opposed to evade) taxation as best you can. To do anything else is to give their money away.

   3. Remember that your primary and, indeed, overriding, responsibilities are to your stakeholders, not to the regulators, the tax authorities or their political masters. It is your duty to avoid taxation.

   4. You should insist that your firm puts some serious effort into avoidance.

   5. Avoidance is often best done discretely.

   6. The more complex the tax system, the more loopholes it has, and the more opportunities there are for avoidance. Remember also that there are all sorts of differences between tax systems across different countries and sectors. Exploit these to the full.

   7. In avoiding tax, you need people who understand the rules, and the people who usually understand them best are tax officials themselves. You should therefore consider hiring some of the game-keepers to poach for you.

   8. Tax specialists can save you a lot of money. You should therefore be willing to pay them well. This also helps give you the edge over the tax authorities, since they can seldom match private-sector salaries.

   4.2. Dealing with Financial Regulation

   9. Work from the premise that regulation as such is a nuisance. You either follow a particular regulatory rule because it embodies good practice for your firm, which you would therefore want follow anyway, or else you want to avoid it.

   10. You therefore need to distinguish between 'good' rules that you want to follow and 'bad' ones that you don't.

   11. A good rule is one that is compatible with or promotes your firm's interest, broadly defined. The firm's interest is not just the maximisation of profits, but also encompasses the firm's (and your) various statutory, ethical and other obligations to the people you are dealing with.

   12. Examples of good rules would be rules of good business practice, useful disclosure rules in financial statements, certain rules specifying your obligations to employees and customers, and the like.

   13. You have to make the distinction between good and bad rules. You do so by deciding which rules are good. The rest can then be regarded as bad.

   14. You should regard the bad rules as a form of taxation. They are therefore to be avoided.

   15. Avoidance of bad regulatory rules is similar in many respects to tax avoidance. The same points therefore apply - you have a duty to avoid them, you should hire specialists, exploit loopholes, be discrete, and so forth.

   16. Keep in mind that regulation by and large does not work. If a regulation stops you doing what you want to do, you can usually find some way to get round it or at least to mitigate its impact."

The next chapter introduces the types of risks faced by a commercial bank or financial institution