Risk, risk exposure and what risk management is

Three meanings of 'risk'

In everyday speech, risk is the chance of a loss. In finance it is broader: exposure to uncertainty, or the whole set of uncertain variables that make outcomes vary. Risk is not something to run from. Return without risk is usually a false hope, so the job is to choose risks carefully, understand them and manage them.

The word is used for three related things. The risk driver is the underlying uncertain factor, such as an exchange rate that might move 1.5% either way. The risk position is the amount you hold that is sensitive to that driver, such as EUR 2 million of assets priced in Swiss francs. The risk exposure is the possible change in your value that results: here ±EUR 30,000. In this simplified case, exposure is simply position multiplied by the driver's move.

Risk exposure comes from choices. A business with no assets or liabilities tied to the franc has zero franc exposure, however volatile the franc is. The moment it decides to hold franc assets or owe franc debts, it takes on exposure. That is why exposure, unlike the driver, is something the organisation can manage.

The definition, and what it rules out

Risk management is the process by which an organisation or individual defines the level of risk to be taken, measures the level of risk being taken, and adjusts the latter toward the former, with the goal of maximising the company's or portfolio's value or the individual's utility. Put differently, it covers all the decisions needed to reach objectives while bearing a tolerable level of risk.

Notice what is missing. Risk management is not about minimising risk: a company that refused all risk could not operate, just as a sensible diet does not mean eating no calories. Nor is it about predicting risk events. Decision makers often obsess over return, which they cannot control, when the thing they can actually control is how much risk they take.

The Doctrine of No Surprises captures the goal. Nobody expects a risk manager to forecast a property crash. But if one happens, its impact on the organisation should already have been estimated, discussed at board level against the organisation's appetite, and partly mitigated if it was too large. The only surprise should be the shock itself, not its consequences.

Risk management is also an offensive tool. Management rarely gets to choose outcomes such as profit or share price, but it does choose which risks to take in pursuit of them. Choosing well is how value is added.

Good versus poor process, and why it pays

In a good process, most of the work happens before an adverse event: exposures are measured through stress tests and scenarios, reported continuously, and decisions reflect them. In a poor process just as much work may be done, but all of it after the damage. Because risks and exposures keep changing, risk management is a continuous cycle, not a one-off project.

Good risk management raises the ex ante value of decisions and helps managers act faster in a crisis. It cannot stop a portfolio from losing money in a crash or a company's profit from falling in a recession. Losses that fall within the agreed tolerance are not a failure of risk management.

The same logic applies to individuals, who mostly manage risk informally and often only after something goes wrong. For them the aim is to maximise utility while bearing a tolerable level of risk, not to avoid risk.

• Fewer surprises, and a clearer idea of the damage if one occurs.
• More decision discipline: better weighing of trade-offs and better risk-return relationships.
• Faster response and mitigation, which trims the worst losses.
• Better efficiency and fewer operational errors through policies, transparency and awareness.
• More trust between the governing body and management, so delegation works better.
• A better reputation with analysts and investors, who see a prudent, value-focused company.