Acknowledging risk

It takes a certain confidence among managers to acknowledge risks. Doing so—especially to the point of discussing them internally, as well as with shareholders or even regulators—requires that managers rely on their own policies and procedures to work through issues that could lead to crisis, embarrassment, or loss.

The cultural differences between companies that acknowledge risk and those that do not are quite stark. Consider, for example, two global financial institutions that take similar risks and share a similar appetite for risk. The first has built a culture, at all levels of the organization, that prizes staying ahead of the trend. This might mean convening a group of executive peers to discuss issues faced by the entire industry or responding to regulatory trends early—for example, on capital and liquidity requirements or compensation practices. The stance it takes is, “If we see it, identify it, and size it, then even if it’s horrible, we’ll be able to manage it.” Where risks cannot be sized, they are at least discussed in qualitative terms. The institution’s candor and its plans to rectify cultural issues in response to a number of risk incidents has won it the respect of regulators and built credibility with investors.

The second institution, in contrast, has a reactive and back-footed culture—one focused more on staying out of trouble, ensuring regulatory compliance, and making sure all the boxes are ticked. Its managers are generally content to move with the pack on risk issues, preferring to wait for regulatory criticism or reprimand before upgrading subpar practices. They are afraid of knowing what they don’t know, and they fear the reaction of the board, regulators, and investors. Many would rather ignore undesirable behaviors because they don’t know how to manage them and because managing them would demand time and might affect their cost base. This organization’s stance is, “Let’s wait until we really need to deal with these unpleasant things, because they’re anomalies that may turn out to be nothing at all.”

A separate institution had such a mind-set during the mortgage crisis. Managers did not trust their own models, which accurately predicted the severity of the issues to come. They knew that if the models were correct, they would be in more trouble than they knew how to handle, and so they found it easier to assume that the models were wrong—or to hope that the risk would crest and fall before the model’s estimates came true. Whether from fear or hubris, managers convinced themselves that they were safer than they really were. Even as the crisis developed, they were confident that they would not experience the mishaps befalling similar companies. In the end, the company’s refusal to acknowledge and address risk left it far more vulnerable than managers expected, and it was hit particularly hard.