Moody's issued a special comment paper focusing on Basel II amendments already introduced, as well as statements from the Basel Committee on Banking Supervision (Risk.net). The paper highlights enhancements relating to a bank's trading book, securitization, and counterparty credit risk. In particular, the recommendations involve strengthening Tier I capital, introducing tougher liquidity standards, including counter-cyclical provisioning, discussing systemic risk provisions (which is becoming popular in the United States), and including leverage ratios as a supplementary measure. Moody's also believes that proposed Capital Requirement Directive changes to the quality of capital and securitization were also a positive step. In addition, the paper mentions that “One important amendment calls for stricter operational requirements for credit analysis for banks holding securitisation exposures. We believe that the increased requirement for credit analysis for banks holding securitised exposures is going to be an important element of improved risk management, and should ensure that only banks with the necessary information and analytical tools hold securitised products.” Of course, it could also mean that less securitization takes place. While this may be the intended result, the unintended consequence of reducing the efficient flow of capital, or not allowing those who want to off-load or bear risk access to the vehicles they need, will also need to be considered further - either now or later.

In their research paper "The Value of Enterprise Risk Management," Robert Hoyt and Andre Liebenberg attempt to uncover whether there is firm value in implementing Enterprise Risk Management (ERM). As the authors discuss, ERM has generated considerable interest from the media in recent years as organizations begin implemented enterprise-level risk management programs, and consulting firms and universities look for ways to offer support, guidance, courses, and services related to ERM. Rating agencies have also begun to consider ERM in the rating process, and regulators are taking notice. The ideas of enterprise and system-wide "systemic" risk are also now being given serious consideration at the economic system level.

Put simply, ERM is focused on the idea that instead of managing and examining individual and separately managed silos of risk, firms are now looking at managing risk in a more integrated, enterprise-wide fashion. It is believe that doing so will help to avoid duplication of risk management expenses by exploiting natural hedges, and allow firms to better understand the aggregate risk. ERM programs also have the benefit of allowing firms to better inform outsiders (investors, regulators) of their risk profile, compared to firms that are more operationally complex. It is expected that such added visibility has the benefit of decreasing earnings and stock price volatility, increasing capital efficiency, and increasing enterprise risk awareness - allowing for more holistic operational and strategic decision-making. But enough flowery language. Does it work, and will it increase shareholder wealth?

[Note: I have offered university-level ERM courses in the past, and will do so again in the near future. Unfortunately, up until now there has not been an empirical study regarding the impact of ERM programs on firm value. Needless to say, I was interested in the results of the research.]

First, a little research background. For the study, the authors focused their attention on U.S. insurers in order to control for regulatory and market differences across industries. Financial institutions and insurers have been some of the first industries to adopt ERM, so this focus makes sense. Without going into further specifics of their modeling and analysis (please refer to the paper), the authors found:

"ERM usage to be positively related to factors such as firm size and institutional ownership, and negatively related to reinsurance use, leverage, and asset opacity. By focusing on publicly-traded insurers we are able to estimate the effect of ERM on Tobin’s Q, a standard proxy for firm value. We find a positive relation between firm value and the use of ERM."

In fact, beyond just adding value, the ERM premium was 16.5%, and found to be both statistically and economically significant, as well as being robust to a range of alternative specifications of both the ERM and value equations. In summary, it appears that added risk management disclosures inherent in ERM add value to the firm. As a bonus, by adding additional risk management transparency, firms are likely to reduce the expected cost of regulatory review, along with the amount risk capital that is allocated for less productive/profitable uses, each of which no doubts helps to increase firm value. Certainly something the proponents of ERM believed, but now there is some initial evidence to back up the claims - at least for insurance companies.

Of course, as investors, knowing that ERM adds value to a firm is good, but now it is necessary to determine which firms are in fact using ERM. Even the authors mention that identifying firms engaging in ERM is a challenge. Nonetheless, absent official disclosures, a search of financial reports and news wires (as performed by the authors) can help to locate candidates for study. Even with relatively strict filtering of data, the researchers were able to identify 117 out of 275 insurance firms that met the requirements of being classified as firms engaging in some type of ERM. As regulators begin to require additional transparency regarding risk management activities, such identification will become easier, and hopefully profitable to investors.

An recent article in the WSJ discusses the AIG risk models developed by Gary Gordton (note, Gorton, not Gordon as originally posted), a professor at the Yale School of Management. The headline of the article boldly states "Behind AIG's Fall, Risk Models Failed to Pass Real-World Test." Yet, did the models really fail? Gordton's models were developed to gauge the risk of AIG's credit default swaps, but according to the article, "... AIG didn't anticipate how market forces and contract terms not weighted by the models would turn the swaps, over the short term, into huge financial liabilities." The quote is interesting in that it highlights what may be at the heart of AIG's problems. As a result of its ignorance on whether the short-term collateral risk needed to be considered, or its belief that such risk was not something to be worried about, AIG made a decision to not have Gordton assess these threats - even stating later that it knew his models did not consider such risk. So this begs the question once again. Did the models really fail (as approached by Gordton and approved by AIG), or was it more of a lack of understanding of the very products they were modeling? I know some will ask what's the difference - in the end the models were incomplete - but the distinction is significant.

In hindsight, it is easy to point fingers and wonder exactly what risk AIG was even trying to manage. But the real problem here seems to be less about one particular modeler getting it wrong, or developing incomplete models, and more about management ignoring to consider some risk while putting faith in the very same models that were not designed to give the level of confidence or enterprise-wide coverage that is being used to engender confidence. Even the WSJ article (in the body of the story) mentions how "Mr. Gordton's models harnessed mounds of historical data to focus on the likelihood of default, and his work may indeed prove accurate on that front. But as AIG was aware, his models didn't attempt to measure the risk of future collateral calls or write-downs, which have devastated AIG's finances." Of course, this did not keep AIG from trading as though it did, and therein lies the problem. The failure here is less about modeling, or even risk management, and more about corporate management and decision making. Yet, the perception that the problem is with modeling is widespread. Even Warren Buffett is quoted as saying "All I can say is, beware of geeks .... bearing formulas." But what is the alternative? Shall we abandon all risk modeling and simply use our gut instincts? Should we just take risk off the table completely? I don't believe so. While better risk management models should continue to be developed, maybe a little humility is a good place to start. Understanding a company's limitations is key to uncovering its strengths and protecting against its weaknesses.