The Greater Fool Theory: Managing and Modeling Risk
Click to Print This Page
The most dramatic financial meltdown since the Great Depression occurred despite recent advances in risk management techniques. Because of a fervent but unfounded belief in some quarters that VaR (value at risk) measures worst-case scenarios, financial institutions were exposed to crippling losses when VaR models failed to anticipate the extent of potential price movements, in some cases by whole orders of magnitude.
Regulators, bank executives, and risk managers may now be tempted to reject the VaR construct as a theory that has, at best, a tenuous connection to reality. But they need to examine whether the methodology was really unsound, or just improperly calibrated. Still, even if the technology passes muster, the question remains: In an international financial system whose components are so intertwined that subprime mortgage credit losses in the US triggered a global catastrophe, and in which everyone uses risk models based on the same underlying assumptions about volatility and correlation, who will take the other side of the trade when models indicate that the time to cut back has come?
NOBODY HAD A CLUE
While VaR never was a magic bullet, it represented a huge improvement over the regime it replaced, according to David Rowe, executive vice president of risk management at SunGard, a supplier of software and services to most of the world’s leading financial institutions. Rowe recalls that when he got into risk management in 1986, after an earlier career in macroeconomic forecasting, banks and securities firms used dollar limits on net open positions, grouped by maturity, and an aggregate limit on exposure across all maturities, each tempered by separate limits on delta, negative gamma, and vega on the various option elements. Without fail, business unit heads showed up year after year at the risk policy committee to seek an increase in their position limits.
“It was an incredible mesh of micro limits, all of which had to be adhered to,” says Rowe, who sat on Bank of America’s risk committee at the time. “But nobody had a clue how much risk was implicit in what they already had, let alone the higher limits people asked for.”
VaR changed all that. For the first time, traders and senior management communicated in a language both could understand—at least in principle. In practice, though, VaR morphed into an end rather than a means. Senior management at some companies began to feel that as long as they had a number for VaR they had a handle on firm-wide risk.
Rowe ascribes some blame to the risk management industry for describing VaR as the worst-case loss on a single trading day. Everyone in risk knew this was sloppy shorthand for what VaR really represents: the size of loss a firm can expect to occur no more than two or three times a year under normal market conditions. Senior management didn’t always translate the shorthand, however.
Rowe prefers an alternative description of VaR: the minimum twice-a-year loss. “It begs the right question,” says Rowe: “On those two days, how big could the loss be?” That description also invites increased emphasis on stress tests and disaster scenarios, a topic he says has received far too little attention. Before the recent crisis, Rowe estimates that firms devoted up to 95% of their efforts to compiling an accurate VaR number, leaving precious little time for analysis of tail risk. “It’s an enormous misallocation of people and resources,” he says. “It should be more like 50–50.”
Tail risk became even more important once firms set trading limits based on VaR. It wasn’t long before traders figured out which positions offered the maximum potential return per unit of VaR. One popular trade, the sale of out-of-the-money options at (for example) three standard deviations from the market price, had little impact on VaR despite a big increase in risk at the extremes. “We created incentives for people to take these tail risks,” says Rowe.
VaR isn’t the only measure of risk, of course, although it’s widely used because regulators require banks and other firms that take risk using their own capital to calculate it. Dan diBartolomeo, president of Northfield Information Services, a Boston- based firm that provides risk management tools to the financial services industry, says, “VaR and tail risk address the potential failure of the firm. They are appropriate for entities like banks and highly leveraged hedge funds where their liabilities are at call.”
At asset management companies that handle other people’s money and don’t use leverage, however, the underlying investors decide how much asset-class risk they are willing to accept, and firm capital is not invested in the market. Hired to beat a benchmark, asset managers strive to earn the highest incremental return for the least risk. “Tracking error is a better measure than VaR of relative performance by an asset manager on behalf of an investor,” says diBartolomeo.
DIFFERENT FLAVORS OF THE SAME ICE CREAM
To Gregg Berman, cohead of risk business at New York’s RiskMetrics Group, a provider of risk management software and services, the various risk measures all express the effects of volatility and correlation, the underlying drivers of market risk. If a portfolio contains more than one asset class, volatility comes into play because, for example, equities bounce around much more than currencies. When traders go short as well as long, correlation assumes critical importance.
Berman notes that a 20% error in estimated correlation may only clip the performance of a long-only portfolio, but it could put a leveraged long–short manager out of business. Add derivatives to the mix, and managers need measures that combine volatility and correlation in order to understand the risk they assume.
“Once you have those fundamentals you can produce a lot of statistics,” says Berman. “Stress tests, VaR, tracking error—they’re just different flavors of the same ice cream.” He argues that the financial crisis was primarily a failure of management rather than risk management. No matter what went into the models and how they were used, compensation structures left traders with little incentive to focus on risk.
People ignored critical risk factors, too. For years, Berman says, players in the mortgage-backed securities market spent all their time worrying about interest rate and prepayment risk but gave no thought to defaults, which had never been important. As the default rate began to creep up, the models did show that firms could suffer severe losses if defaults continued to rise. “At that point, it became a management issue,” Berman says. “Could you convince management it was possible, and, if so, that it required serious attention?”
Berman alleges that some firms took short cuts. For example, under normal market conditions, the super senior tranche of a CDO (collateralized debt obligation) behaves like a bond with a bullet maturity. That proxy does not capture the tranche’s optionality and structural features, however. “When spreads widen and defaults go up, this instrument behaves nothing at all like a bullet bond,” says Berman. “It wasn’t that the models were wrong, but people were not applying the correct model.”
He also faults firms for excessive reliance on history to determine volatility inputs. RiskMetrics software can calculate volatility from either historical data or Monte Carlo simulations, but Berman says firms often used only historical volatility, and measured it over relatively long periods. He notes that the output from a model based on rolling three-year historical data won’t change if volatility spikes up for a week. “What are five days compared to the 750 trading days that are in your database?” Berman asks. “The number is going to move at the second decimal place.”
Some mathematics wizard may one day shoehorn liquidity risk into new and improved models, but no matter how sophisticated, models will never be more than imperfect tools in the risk manager’s kit—sometimes useful, but always flawed.
The model becomes far more sensitive to changes in market conditions if moving average historical volatility is calculated with a decay that lends greater weight to recent data points. Using simple historical volatility, an event may appear to be a five-standard-deviation tail risk (also called a five-sigma tail risk). In a more responsive model, however, the event may be only two sigma from the mean. Berman dismisses talk of 10- or 20-sigma events altogether. “They don’t happen, ever,” he says. “If you see a 10-sigma event, all it means is that you measured sigma wrong or you assumed the wrong distribution.”
Firms can derive volatility from multiple Monte Carlo simulations, but the method is not as widely used as historical volatility. Steven Allen, the former head of risk methodology at JPMorgan Chase and an associate professor of mathematics at New York University, says stress tests are controversial because risk managers set the test parameters. Business unit leaders can challenge the assumptions, but risk management has the final word—and far more influence, as a result. Nevertheless, Allen says that even before the meltdown JPMorgan Chase relied almost exclusively on stress tests for internal risk management, and used VaR primarily to satisfy the regulators.
He notes that JPMorgan Chase and other firms apply different stress tests to liquid and illiquid assets, too. Equities and index options may go through brief periods when the markets dry up, but for the most part they trade freely and firms can sell positions at will. For assets like those, models can estimate what it may cost to get out during a rough patch. Other assets, such as super senior tranches of CDOs, never trade; the buyer has to assume it will hold the position to final maturity.
The stress analysis for illiquid assets depends less on models than on macroeconomic analysis of shifts in the economy through the life of the instrument. Risk managers at JPMorgan Chase concluded that although the probability of super senior CDO tranches taking losses was very low, the credit conditions under which that could occur would also cause trouble in the loan portfolio. “You can’t allow assets to grow beyond a certain level if you can’t get somebody else to take them off your books,” warns Allen.
A BROKEN CLOCK IS RIGHT TWICE A DAY
Scott Aguais, a director and global head of credit risk methodology at Barclays Capital in London, suggests that the real problem with risk models is miscalibration, rather than unsound methodology. He points in particular to inadequate stress tests applied to mortgages across the entire credit quality spectrum. From a theoretical standpoint, he says, the current crisis will provide reams of data that modelers can apply to future simulations. But the prospect that risk managers will do better next time offers little consolation to firms laid low in the past year.
Risk models can always be improved, and Barclays has altered its own credit rating system to incorporate not only the one-year probability of default based on average credit conditions through the cycle, as required under Basel II, but also a point-in-time measure that varies over the cycle. Aguais says conventional credit models assume that systematic factors follow a random walk and cannot be predicted, which means they do not recognize a credit cycle. After extensive research, his team concluded that in fact about 25% of the variation in systematic factors can be measured.
That is enough to incorporate a cyclical element when calculating probability of default, providing a more reliable picture. “Like a broken clock, which is right twice a day, your real risk only equals the average measure twice in a cycle,” says Aguais.
Tweaking the models does improve risk management, but it’s like rearranging deck chairs on the Titanic if the input data is bad. For example, the surge in subprime mortgage origination occurred in a period when home prices were rising—until 2006, at least. Ever-increasing prices reduced the incidence of default and bolstered the recovery of principal when borrowers did default.
In this benign environment, market participants began to believe that home prices could never decline. Ravi Gautham, director of risk management at Northern Trust Global Advisors, the asset management arm of the Chicago-based custodian bank, says a toxic combination of inadequate data and flawed beliefs led to the assumption that lenders could never lose money on mortgages. “People have to rethink their assumptions even before they get to building the model,” he says. “It’s hard to get your arms around tail risk.”
It’s no secret that volatility spikes up in stressed markets, and risk models do capture that to some extent. Robert Engle, a Nobel Prize winner in economics and professor of finance at New York University’s Stern School of Business, advocates a switch to more dynamic risk models that would better reflect changes in the economy over time.
For instance, correlations are assumed to be static, and while that may be true for extended periods in normal markets, they break down under stress. In one recent example, Engle notes, financial and energy stocks were negatively correlated through the summer, but the relationship inverted in September and October. Hedge funds that bet long on energy and short on financials suffered painful losses as a result. “We need a dynamic approach to correlations,” Engle says.
Just ask money managers who run mortgage-backed securities portfolios. They often try to isolate prepayment risk by selling Treasury bond futures short to hedge out interest rate risk because mortgage-backed securities typically trade at a spread over the yield on Treasuries of equivalent duration, and the interest rates on both securities move up and down in tandem.
Over the last 18 months, many players have learned, to their cost, that a flight to quality can turn this dream hedge into a nightmare when panicked investors dump risky assets—including mortgage-backed securities—indiscriminately, putting all their money into Treasuries, no matter how low the yield. In this situation, a correlation coefficient close to one didn’t just go to zero—it flipped over to minus one: the kiss of death in a leveraged portfolio.
“Tail risk analysis has to explore correlations going to one or even minus one on instruments that should not behave that way,” says Northern Trust’s Gautham. “Hedges don’t work for lack of liquidity. Nobody wants to take the other side of the trade.”
All too often, risk management models assume infinite liquidity, a dubious proposition at best. “Frictionless markets that trade in continuous time?” muses Maureen Miskovic, chief risk officer at the Boston-based State Street Corporation. “Hmm. Haven’t seen one of those recently.” Current models cannot cope with the complete absence of a price. They typically require a series of prices from which standard deviations and correlations can be calculated. In that context, “no bid” has no meaning.
Some mathematics wizard may one day shoehorn liquidity risk into new and improved models, but no matter how sophisticated, models will never be more than imperfect tools in the risk manager’s kit—sometimes useful, but always flawed. “Models are a starting point,” Miskovic says. “Risk management is both an art and a science: qualitative as well as quantitative. You need a lot of experience, common sense, and judgment as well.”
A BREAKDOWN OF THE CULTURE
Risk managers also need the full attention of senior executives, who must be open to unwelcome news. Miskovic points out that if risk managers had proposed a tail risk scenario two years ago tracking the events of September and October 2008, senior management would have dismissed it as too draconian. It would have required firms to raise enormous amounts of capital to guard against circumstances they thought could never happen. “Nothing anyone would have modeled could have prepared them for the seismic transformation the financial markets are going through,” says Miskovic.
She believes effective risk management starts with basic questions that the board of directors must address. How much risk is the firm willing to take? How much capital is available? How much leverage can the firm tolerate? How quickly can the firm liquidate assets if it has to sell in a sour market?
In isolation, every firm will have different answers. But in a competitive marketplace, management comes under intense pressure to conform. If one firm levers up to make a 20% return on equity, managers at another firm may find it hard to resist the temptation to follow suit, even if they prefer to operate with more prudent (lower) leverage and would otherwise have been content with only a 14% return.
“How can people say no? The company’s share price will get slammed into the dirt if its returns are lower than those of its peer group,” says Miskovic.
Politicians fanned the flames that fueled the subprime lending binge, of course, but the private sector bears its share of the blame, too. In a misguided if well-intentioned effort to expand home ownership, Congress pushed Fannie Mae and Freddie Mac to increase loan and guarantee quotas to people with less than pristine credit. Private-label mortgage-backed security issuers joined the party, and the surge in subprime mortgage lending took off.
As firms elbowed each other aside in a race to build loan volume and reap the fees from securitization, risk management discipline was chucked overboard. Nobody gave a thought to the economic reality behind the underlying loans. “Were conversations taking place at the board or the senior management level, asking, ‘Do we think it’s a good idea to give mortgages to people who don’t have jobs, assets, or income?’” says Miskovic.
Conversations like that did take place not so many years ago. One senior risk manager remembers a credit committee discussing a potential public offering for a company in the rent-to-buy furniture business. It’s a gritty game in which customers, by the time they own an item, end up paying perhaps three times as much as a cash buyer would pay. Notwithstanding the prospect of substantial fees, the firm rejected the deal. A business that preyed on low-income households seemed immoral to the committee and exposed the prospective underwriter to a high level of reputational risk.
Miskovic sees no sign that similar ethical considerations played any part in deliberations about subprime mortgages at the major securitization shops. “The crisis is not primarily about what broke down in the models,” she argues, “it’s about what broke down in the firm cultures.”
Flawed compensation incentives contributed to the erosion of risk discipline, a problem compounded by the ability to transfer risk in time through derivatives. Northfield’s diBartolomeo explains that while a cash trade represents an immediate exchange of risk for potential reward, derivatives like credit default swaps generate income up front while the related risk may not come home to roost for years, if ever.
“With people switching jobs frequently,” he says, “it’s easy to construct strategies that make money for the current jobholder right away, in exchange for risks that will arise in the future, when they will be somebody else’s problem.”
A credit default swap is no different from an insurance company that writes policies to cover catastrophes like earthquakes and floods. That company can appear highly profitable if it does not set aside adequate reserves to pay the infrequent claims. Insurers are highly regulated, however, while derivatives are not. The collapse of AIG underscored the distinction; its financial derivatives unit brought the house down, while the regulated insurance subsidiaries remain profitable.
DEVIL TAKE THE HINDMOST
Changes in financial regulation are inevitable now that the government has stepped in to rescue AIG and support other financial institutions. Russ Hovanec, senior vice president of business development at Northfield Information Services, says regulators ought to have a complete picture of the risk embedded in the financial system, which would require financial services companies to deliver consolidated risk reporting to a central authority. Banks and brokerage firms already have the information—or should have—so this would not constitute a crippling incremental burden. Hovanec argues for consolidation among US regulators, so that firms can no longer play their competitors off against each other. He also calls for international cooperation to eliminate regulatory arbitrage on a global scale.
A central regulator does not imply one-size-fits-all regulation, however; the rules must recognize that market participants have different risk profiles. “You can have a run on the bank,” Hovanec says, “but nobody is going to commit suicide to try to collect an early payout from a weak life insurer.” Regulators have to strike a balance that protects the financial system against another meltdown, but does not stifle either conventional business or innovation.
No matter how clever the regulations are, better risk management has to start at the regulated entities. Gautham notes that some firms used to treat risk management as a staff function rather like compliance, a necessary nuisance that interfered with the primary objective of making money. Risk reports circulated, but nobody paid much attention or asked the hard questions.
Now the financial crisis has vaulted risk management to the fore at every firm. Gautham expects risk’s new prominence to have a profound effect, as people begin to think about returns on a risk-adjusted basis and risk managers assume a role in strategic planning. “Risk didn’t really have a seat at the table at the highest level of management. It wasn’t a driving factor in whether a firm should pursue a particular line of business,” Gautham explains.
The change in attitude extends beyond governance to a renewed focus on counterparty risk. While banks and broker–dealers have long monitored their customers’ creditworthiness, buy-side institutions seldom returned the scrutiny. The near death of Bear Stearns was a wake-up call, and many who did not heed the warning got caught out when Lehman Brothers went bankrupt.
Gautham recalls, “Very few people ever thought about a counterparty like Lehman failing. All of a sudden, Goldman Sachs and Morgan Stanley—gold-plated names with high credit ratings— were questionable counterparties. That was almost unthinkable a year ago.”
In addition, the financial woes of monoline bond insurers and AIG revealed that credit default swaps do not offer reliable insurance unless the counterparty can still pay in hard times. Credit protection turned out to be an unsecured obligation when insurers couldn’t meet demands for collateral; in effect, the buyers had merely substituted one counterparty risk for another.
Risk managers do try to track counterparty credit risk, but NYU Stern’s Engle points out that the information they need is not readily available. He suggests that parties to over-the-counter transactions should have to disclose far more about their exposures, enough to enable each side to assess the risk that its counterparty may fail. Firms would surely object to disclosures that might reveal proprietary information, but Engle says delayed reporting, perhaps by a month or so, would protect commercial interests.
Furthermore, a disclosure requirement for over-the-counter transactions might spur a move toward exchange trading, which dealers have resisted even though it eliminates counterparty risk altogether. “If they had to reveal a lot more information when they trade over the counter than on an exchange, it might overcome their reluctance,” Engle observes.
Although risk has grabbed the limelight for the moment, memories will soon fade when the markets calm down, as they surely will at some point. Volatility will decline and the pressure to assume more risk will emerge once again, and not only at banks. Asset managers like Northern Trust have to beat a benchmark, and portfolio managers cannot outperform unless they take risk. The opportunities to eke out excess returns dwindle as volatility seeps away, but clients still expect managers to add value net of fees.
“After a while, when you have declining volatility and a benign period, risk becomes just one more thing to get done,” Gautham says. “People don’t pay attention to the real downside even though it may be on a risk report.”
It may fall to the board of directors to sound a note of caution. If risk managers have the ear of the audit committee, the board may be able to restrain senior management from overstepping the bounds of reason. The threshold will vary according to an individual firm’s appetite for risk, but even if every institution were to manage its own risk in a prudent manner, another financial crisis could still occur.
All the risk assessments are based on similar models, after all. If the models capture a sharp increase in volatility and risk managers persuade senior management that a firm needs to scale back its exposure, every other firm that uses a similar model—that is, each major player—gets the same message at the same time. Different firms have different portfolios, of course, but if one firm starts to cut back its exposure it all too often creates a self-reinforcing cycle that culminates in a stampede for the exits.
Engle notes that Spanish bank regulators may have hit upon a way to mitigate the problem. Instead of keeping leverage limits and capital requirements constant, Spain forces banks to build up rainy day reserves while the sun is shining, in order to provide an umbrella when the storm breaks. In effect, the system keeps a lid on leverage in times of easy credit and loosens capital requirements when credit tightens. Engle explains, “It sounds counterintuitive, but it’s designed specifically for this situation, to provide liquidity on the other side when it otherwise would not be there.”
Without a solution to the network risk, markets may be doomed to lurch every few years from one crisis to the next. In a world like that, risk management—no matter how sophisticated—amounts to little more than the “greater fool theory”: The first one out the door wins, and the devil take the hindmost.
–Neil A. O’Hara brings 29 years of experience in the financial services industry in London and New York to his second career as a freelance writer. His work has appeared in Institutional Investor, Alpha, FTSE Global Markets, and the New York Times, among other publications.
Illustration by Mark Andresen.