Risk limits

Published: 22nd February 2010 by William Webster

You may be thinking about reviewing or changing your risk limits. But before you jump straight in it's worth taking stock. After all badly designed risk limits and poor operational processes will just add to your problems. Let's look at some of the issues you need to consider.

What is the purpose of risk limits?

Many will tell you they are there to stop you losing too much money. But your idea of too much could differ from mine. So just how much is too much? Let's explore this in terms of risk. At one end of the spectrum risk is eliminated and at the other end it's openly sought. There's a lot of space in between. How much risk do you want to take? Or perhaps we should ask how much risk does the board want to take? After all this is a fundamental business decision. It's likely you'll get the answer "we are conservative so not much" that's not going to get us very far so let's rephrase our question and dig a bit deeper. How much can you afford to lose?

What about a maximum loss over a year of $5m? $5m may be chicken feed to one firm and more than the entire annual income to another. Let's add a refinement.

How much can you afford to lose in relation to your profit and your capital? The larger your profit and the greater your capital the more able you are to withstand losses. So at the extreme what is the maximum you can lose and still stay in business with a franchise that's able to recover from the damage incurred? This provides you with a ceiling. But it's highly unlikely your limits go near this sum. That's because you need to ask a related question. How much are you prepared to lose?

It's likely this will be a proportion of what you can afford to lose. That proportion will depends on a fine balance between risk and reward. If the board is not prepared to lose money, the risk limits should be set at nil. If the board is prepared to lose a proportion of profit or capital the limits should be set to accommodate this. Suppose the board is more freewheeling and their risk appetite is greater than the firm can sustain. You have to ask whether the board's interests are aligned with those of the shareholder. Furthermore boards that do not align themselves with the regulator's risk appetite may end up having to hold even more capital and liquidity because of the systemic risk they are creating.

Setting the risk limit

The Board has determined its appetite to take risk so how do you design the limit?

Pre 2007 many assumed markets were liquid and "fat tail" events were highly unlikely. Limits often reflected this. They looked sensible on a normal day but gave huge losses in extreme conditions. Things have changed. Stress testing is now used to identify these risks. This leads to an obvious question. Do you set your risk limits to take into account the stresses or not?

For regulated institutions the answer is clear. The 2007 experience tells us that limits should take into account the stress tests you carry out. If they don’t you run the risk that the firm will be irreparably damaged by extreme events. No wonder that regulators are focusing on stress testing to confirm that capital and liquidity thresholds are sufficient. Expect this to be extended to other risks too.

The corollary of this is that firms will not be able to operate with such a high degree of leverage that was once usual.

Limit structures

Different risks require a variety of measures, here are four risks and some of the methods used:

1. Interest rate risk: Gap, basis point value, value at risk, stress testing
2. Foreign exchange risk: Currency equivalent, value at risk, stress testing
3. Credit risk: Fundamental analysis, ratings, time bands, credit value at risk, stress testing
4. Liquidity risk: Liquid asset ratios, stress testing, days until liquidity fails

These methodologies have their own strengths and weaknesses However there are some questions that apply to all limits and you need to consider them.

Do you have "hard" and "soft" limits? Hard limits, typically regulatory limits, are cast in stone. Break these and you get in trouble. That’s why many firms have lower softer limits. These can be broken but need to be escalated to management for action. In this respect soft limits act as warning indicators and something needs to be actioned to resolve the flagged issue. Is there a place for them in your limit structure?

Are there limits you don't get near to? If the reported risk never goes near the sanctioned limit you have to ask questions.  Why is the board's appetite so at odds with that of senior managers running the business? Could complacency set in leading to a breach not being escalated? Do you need to reconsider the limit structure?

How frequently do you review your limits? Annual reviews are traditional but should there be more flexibility? Perhaps we can learn from credit limits. In most firms they are the subject of frequent review. This may be as a result of credit downgrades, credit analysis or just cold feet on counterparty risk. It's strange that in many cases market risk limits are much less dynamic. Is it time you changed things?

Do you evaluate the methods you use? Many firms rely on the risk measures their systems are capable of producing. This may be practical but risk systems can remain in place for years and inertia may set in. Are you still looking at risk the same way you did five years ago? Are there better alternatives?

Limits and losses

Limits have been around for years so why do firms still break those limits and end up losing a lot more money than they anticipated? Adverse market conditions are not the only reason. Sometimes your risk reports can be wrong and you are sitting on a lot more risk than you think and here are nine reasons why:

1. The limits don’t cover your risks
2. Weak stress testing parameters
3. Weak escalation processes
4. Intra day risk goes unreported
5. Infrequent risk reporting
6. Risks in complex products are unreported
7. Inaccurate static or trade data
8. A break down in segregation of duties
9. Fraud (rogue trading)

Not everyone's a risk expert so what can you do about this? Make sure risk management is robust. Board risk committees and an independent risk functions are considered good practice. To avoid accidents you need an inclusive view of risk. That means more reports that you can understand and cross reference.

Displaying 1 to 6 of 6 results in total.