Taleb is right when he talks about risk management failing so dramatically in part because of its reliance on statistics, but the problem is neither statistics nor statisticians. That’s a lot like blaming car manufacturers because people have auto accidents. They might be the cause sometimes, but most of the time they are the fault of someone who bought the car and misused it. Statisticians know the difference between ninety-nine and one hudred percent; non-statisticians muddy the line between four to one and a sure thing.
Most of the real problem was really that common sense was not applied. Basic risk management is almost all common sense. It begins with asking what can go wrong. Next, list each risk clearly and completely. Third, develop a plan to prevent or at least mitigate each risk.
I can’t believe that this is new information to anyone, but it is apparent that this process was either skipped or sabotaged in case after case. This failure was most spectacular in banking and insurance, i.e., risk management professions. Since it is hard to believe that they skipped the process entirely, we need to understand where they sabotaged it.
I think statistics was used to sabotage the process. Many people looked at statistics that said that a bet would win ninety or even ninety-nine percent of the time, and said “That will never happen.” I heard it myself dozens of times, and what may be most surprising, that same people who were burned by that leap of faith continue to be the same people who are still uttering those words.
If you are a risk manager of any kind and ever say that something will never happen, you are not the guy for the job. If you can imagine it happening, it almost certainly can happen. That doesn’t mean that the the fantasized disaster can or will happen, or that you can do anything to prevent the disaster or mitigate the effects. However, it is certain that you cannot come up with a plan ot deal with the disaster unless you treat it as a real threat and make a plan.
Note that you can recognize a catostrophic risk and still do nothing about it. At some level that is okay. For example, if you sell property insurance in Florida, you should recognize that it is a possibility that one hurricane could wipe out Florida — take it right off the map. Obviously, that would oxer-extend the resources of all of the insurance companies in Florida, and they would almost certainly fail without stunning balance sheets and geographical diversification.
You can’t stop such a hurricane, at least with our present technology. If the hurricane cuts a wide enough swath through your customer base, geograhic diversification will help a little. The insurance industry has withstood some major blows, but so far the hurricanes have remained small enough so that only a few companies actually failed. If the U.S. got hit with a 250 knot storm that hit the country for ten days, insurance companies wouldn’t be the only organizations to fail.
Has it ever happened? To the best of our knowledge, it has not happened on this planet. However, similar events do occur constantly on both Venus and Jupiter so that we know that physics isn’t standing in the way. There is a non-zero chance of it happening here, but when the chances are small enough and the possible remedies are so ineffectual that you simply have to accept that risk. A financial disaster at that point would probably be insignificant given the scope of the natural disaster.
Many people recognize risk know how to mitigate that risk, and do nothing about it. People who drive without insurance and people who do not back up the work they’ve done on a computer are two examples that spring immediately to mind. The issue here is cost. They don’t want to spend either the money or the time.
Again, deciding not to spend the money or the time to mitigate any risk may still be a valid decision, but if you are a risk manager, you need to document the risk as well as the reason why the mitigation plan was too expensive. You should review each risk categorized this way regularly because conditions change.
An obvious example of this is buying stocks on margin. If you buy stocks on margin at ten bucks a share, it is very expensive to buy ten dollar puts to cover them. Prohibitively expensive, in fact. However, if the stock moves fifty dollars a share, puts with strikes of twenty dollars or less will be extremely cheap. If I was forced into a position where I had no practical option but to buy stocks on margin (usually a good position, I would review the cost of puts on a monthly and maybe even weekly basis. But I digress …
Risk management is almost never about statistics. Statististics are used to justify risk management decisions, but no risk management plan should need statistics as a defense. Ask the question: What can go wrong? Answer the question. Deal with the answers. That’s all it takes.