Jason Voss is writing a multi-part series on real risk management. This post, the first in the series, aims at pointing out the tremendous importance of context in getting risk management correctly done.
My view of risk management stands in stark contrast to how most investment professionals tend to think of risk management: volatility, covariance, value-at-risk, et al. One of my favorite analogies helps to understand why I do not like the preceding methods. Namely, the old Chinese saying of:
A wise person points a finger at the moon. The fool stares at the finger.
Said another way, volatility, covariance, value-at-risk are all fingers that point at the moon. In this case, the moon is the company or security whose activity generates the traditional measures used to evaluate investment risk. Each of the articles in this series looks to identify actual risks faced by companies or securities.
How not to think of experience
Years ago my wife and I were on vacation in Peru when we received much belated news about a terrible event in my step-daughter’s life. Her high school annually went on a week-long spring season river rafting and camping trip. The previous winter had especially heavy snow fall and so the river was exceptionally high, and with fast rapids. Worse, the weather for that week was to feature more heavy snowfall and freezing temperatures. Then disaster struck.
Within the first hour each of the rafts capsized in the river. Each student was in danger of suffering from hypothermia. Worse still, most of the food and medical supplies were lost to the river and thus were in extremely short supply. A student broke his leg, and one of the instructors/guides essentially had a mental breakdown and was crying and quivering in the snow.
You would think that the instructor in charge would have called off the entire exercise. But instead he persevered through the rest of the week. The result was that several students had to be hospitalized, with half of them becoming critically ill, too. You can imagine that the parents were in an uproar with the school. We each challenged the administration to explain why they wantonly had endangered our kids. The response?
“Ralph [name changed], our instructor, is extremely experienced and led these expeditions for over a decade without incident.” Do you see what is wrong here, and the point of my article? This is the incorrect way to think of Ralph’s experience. Why?
Context is key to risk management
My step-daughter’s administration engaged in an incorrect risk analysis of Ralph’s experience. They did this because the relevant experience for the situation was not how many years of expeditions Ralph had led. This is the wrong context, and an example of representativeness bias. Instead, the correct context was how many expeditions he had led where everything went wrong, and from the very beginning? This is the correct and relevant experience. The school’s administration admitted that they did not know how much experience Ralph had in those circumstances. It turned out, he had never really come anywhere close to experiencing these difficulties.
Context is everything in risk management. Said another way, those analyzing risks have to anticipate possible risks faced by businesses or securities. Has a prospective investment’s management also identified these same risks? Does management have plans in place to address those risks? How much experience do they have managing those specific risks?
At the security level you have to ask if the assumptions for volatility, covariance, value-at-risk and so on are all appropriate and price in relevant risks. Famously in the grand real estate bubble of the mid-00s securities all assumed rising home values. Why? Because asset backed securities had never led an expedition in which the winter of home prices was so very cold.
How to improve your risk management of contexts
1. Independently identify the key risks qualitatively.
Research analysts and portfolio managers need to identify key risks as if they are a business person operating in the same industry. That is, ask yourself if you were running a business what would be the risks you would need to have a grasp of in order to ensure success? Said differently, what are the contexts in which a business or security finds itself, and what can go wrong? Does management of a business also consider these risks as important [hint: look in the annual report and 10-K]? If not, then it is an indication that there is hidden risk in the business. It is also likely, based on my experience that analysts and investors are also therefore not considering these risks.
2. Choose your data very, very carefully.
If the data you want to utilize as the basis for your decision-making were not collected in deference to the qualitative risks you identify above, then they do not measure these risks. Duh! Likewise, if the risks you identified did not occur during the time horizon of your data, it also does not measure the risks. Double duh! That is, does the context of the data match the context of the risk? Triple duh!
3. Contingency plans.
Does management have contingency plans in place in case of unforeseen risks? These could include catastrophe insurance, for example. These could include having multiple ways of manufacturing or delivering their goods and services in case of an extreme event. If you are an investor it behooves you to assess whether or not management even thinks this way.
In reports or press releases, or on conference calls do they engage in hypothetical conversations about risk? A simple sign would be an answer to an analyst question that sounds like, “Well, if something goes wrong, then we would anticipate earnings would…” This is ok, but not great evidence of contingency thinking. Better would be if they named specific things that could go completely wrong. This is best expressed as, “By definition, the greatest risk is the one for which you have no planning.”
This post initially appeared on Jason Voss' blog.
