Subprime crisis shows why firms need ORM

It's hard to not be a bit worried by the subprime crisis and the spin-off events that have cascaded through the financial markets over the past few weeks. And it is ironic that the crisis kicked off in the US, where regulators have made such an unholy stink about the robustness of Basel II's credit risk provisions.

Of course, the answer to that apparent paradox is that many of the firms that sparked the subprime mortgage crisis were not regulated but non-bank banks. But that doesn't excuse the US regulators, legislators and others who should have had a firmer handle on what these lenders were doing and how it was affecting the financial system. But the blame for this crisis cannot to be laid only at the door of regulators, government bodies and central banks.

Financial services firms tend to have a "stop me before I kill again" attitude to these crises. It was the world's top firms who packaged subprime loans into nifty structured products without understanding how the risks inherent in those products would behave under stress. Now they are blaming anyone but themselves.

Risk management is, above all, an exercise in knowing thyself (and thy firm). Understanding the personality of a firm, including its strengths and weaknesses, is essential to creating any kind of enterprise-wide risk management framework.

One of the most important areas where this applies is the new product approval process - an area in which operational risk managers have played a significantly greater role in recent years. So what happened? Were concerns raised about the structured products firms were churning out? Why did firms feel they would meet the "front page" test - where seeing the product on the front page of the Wall Street Journal isn't a reputation-destroying exercise? And what's gone wrong?

Structured products are an important innovation in the financial markets and subprime mortgages are also a useful product. Neither is inherently evil - but clearly transactions have been undertaken that will dent their reputations, and the reputation of the firms that engaged in them, over the short-to-medium term.

Operational risk is, once again, a fundamental component of the cause of a crisis in the financial services industry. When will the industry, in turn, acknowledge the importance of operational risk and resource the discipline proportionately?

Ellen Davis, Editor