FinPod

[00:00:00:02 - 00:19:12:23]
So picture this. It's a Tuesday afternoon, brightly lit conference room. Oh, I know this room. Right. And there's this beautifully formatted color coded spreadsheet projected on the screen. The risk register. Exactly. Everyone around the table is nodding thoughtfully. Maybe a few of the red boxes get a quick, very serious discussion. Very serious. Yeah. And then the file gets saved to a shared drive and everyone goes back to their real jobs. Right. It's the ultimate modern corporate ritual. A ritual, yeah. I guarantee half the people listening to this deep dive right now have a tab open with a dashboard that looks exactly like that. Oh, absolutely. You gather, review the threats, assure each other you're monitoring them. And well, you feel a collective sense of safety. Until, you know, 18 months later, disaster strikes. Right. A multi-billion dollar crater just opens up in the balance sheet or an entire supply chain just evaporates overnight. Everyone is shocked. And completely caught off guard, even though the very thing that destroyed them was sitting right there on that Tuesday spreadsheet. Yeah, probably just tucked away in a nice, safe little amber box. With a little comment that just said monitoring. Exactly. And that massive gap, the gap between having a document that lists your risks and actually physically managing those risks. That's what we are unpacking today. That is the mission. We've got a ton of source material here pulling from corporate finance research and some pretty wild postmortem case studies on ERM. Enterprise risk management. Right. And we're trying to figure out the difference between ERM as a completely useless compliance artifact, the Tuesday paperwork. Yeah, the theater of it. Yeah, versus ERM as a living, breathing, operating discipline that actually keeps companies from going bankrupt. But, you know, before we jump into the massive corporate failures, we really should clarify what we're actually talking about here. That's a good point, because I always used to think the word enterprise in ERM just meant like a really big company. A lot of people think that it sounds like pure corporate jargon. It really does. But going through this material, it's not about the size of the company at all. It's more about breaking down the walls between different departments. You've hit on the absolute core philosophy there. Historically, risk management was strictly siloed. Like everyone in their own lane. Right. The Treasury Department managed currency stuff. Operations worried about factory safety. We just worried about getting sued. But the real world doesn't care about your org chart. It really doesn't. A supply chain failure in Asia that creates a massive liquidity crisis for the Treasury team in New York. Yeah. So the enterprise part is the strategic integration of all those uncertainties. You have to view the whole portfolio holistically. Measuring how a threat over here correlates with a completely different threat over there. Exactly. So to understand how companies fatally mess this up, we need to look at the tools they use to try and manage that holistic view. Let's start with the foundational one. The risk appetite statement. Yes. Because when I read a few examples of these in the material, well, I couldn't help but compare them to terrible New Year's resolutions. How so? Like the vague ones. Yeah. A typical statement says something like, "We seek to balance aggressive market growth with prudent financial controls." Which means nothing. Nothing at all. It's the corporate equivalent of waking up on January 1st and resolving to eat better. Right. It sounds great, but it never actually forces you to say no to the donut in the break room. It doesn't trigger any action. That is a perfectly accurate assessment. If a policy doesn't force a difficult decision, it's just PR. Yeah. A functional risk appetite statement has to be heavily quantified. You can't use words like "prudent." What should it look like instead? It needs to be explicit. Something like, "We will not allow exposure to any single counterparty to exceed 5% of total capital." Or, "We won't pursue growth that pushes our leverage above a three to one ratio." Precisely. Let's just pause and translate that really quickly for anyone who isn't, you know, structuring derivatives all day. Good idea. So, "counterparty" just means the institution on the other side of your deal. If they go bankrupt, you lose. Right. And "leverage above a three to one ratio" basically means borrowing $3 for every $1 of your own money. Exactly. The statement has to grow a hard mathematical line in the sand. So, it's only real test is whether it can step in and stop a highly profitable deal. Yes. If you've never looked at a massive potential payday and said, "No, we have to walk away because it violates our appetite statement," then you don't have a risk appetite. You just have a decoration. A very expensive decoration. Which brings us to the dynamic duo of middle management tools, the risk register and the heat map. Right. So, the register is that living inventory of risks. It's supposed to have an assigned human owner and a mitigation plan. And the heat map is just the visual grid of that register. Likelihood on one axis, impact on the other. But the psychology behind this is where the whole system just starts to break down. The subjective theater. Exactly. These maps use red, amber and green color coding. And nobody, I mean, absolutely no executive wants to stand in front of a board and explain a glowing red box next to their name. So, human nature takes the wheel. It does. People consciously or even unconsciously just massage the data. They do mental gymnastics to slide those terrifying risks down into the safe green or at least amber corners. But you know, the problem actually goes way deeper than human psychology. It's a profound mathematical failure built into the tool itself. Wait, really. The math is wrong. Yeah. Heat maps systematically demote catastrophic company ending events. How so? Well, think about the arithmetic. You plot likelihood against impact. A terminal event, a true black swan that bankrupts the firm is an extreme edge case. Right. So it has a very low probability of happening on any given Tuesday. Exactly. It gets a rock bottom score for likelihood. Oh, I see. So even if you give it the absolute maximum score for impact, when you multiply a tiny fraction by a massive impact, the dot lands squarely in the middle of the map. In the amber zone. Yes. The tool systematically classifies a company ending threat as a medium tier priority. Just because the timeline is uncertain. It essentially creates institutional blindness to tail risks. Precisely. OK, so let's look at what happens when an organization navigates by a broken map like that. Let's get into the actual anatomy of corporate ruin. The AIG collapse in 2008 is the textbook example here. And we have to remember AIG wasn't some fly by night casino. They were this brawling, highly sophisticated global insurer. They had risk management teams everywhere, the registers, the heat maps, all of it. But buried inside that massive footprint was one specific unit in London. AIG financial products. Right. And what that single unit was doing was writing hundreds of billions of dollars in credit default swaps. Basically selling insurance policies that paid out if mortgage backed securities went bust. And the fatal flaw there was entirely rooted in that heat map math we just talked about. Because their model said a nationwide housing collapse was impossible. Exactly. It was an extreme tail risk. The model said the likelihood was near zero. So the firm didn't hold back any meaningful capital and reserve. Which is where that enterprise definition completely failed. The corporate parent had no idea this tiny subsidiary was holding a grenade that could level the whole global conglomerate. The discipline failed at its core directive aggregation. The risk accumulating in London was never rolled up into a unified enterprise wide view. So when the impossible happened and mortgages started defaulting everywhere AIG got hit with collateral calls. Right. Let's unpack that really quick. A collateral call is the actual mechanism of the death style. It is. When you sell a credit default swap the contract usually says if the underlying asset starts dropping in value you have to post cash collateral. To prove you can still afford the payout. Basically a margin call. Yeah. So as the housing market tanked all of AIG's counterparties demanded billions in cash simultaneously. Cash that AIG just didn't have because the heat map said they'd never need it. And that single subsidiary triggered a liquidity crisis that destroyed the parent company. It took a roughly one hundred and eighty billion dollar government bailout to fix it. Just staggering. It really is. But you know you'd think 2008 would have forced Wall Street to fix the mass forever. Let's fast forward to 2021. Ah. Arcego's. Yeah. Even when the math works perfectly human hierarchy still overrides it. Credit Suisse ended up losing roughly five point five billion dollars on Arcego's. Which was a family investment office run by Bill Hwang. Right. And the report say it was a 20 billion dollar notional exposure. Yes. Meaning Hwang was controlling 20 billion dollars worth of assets using the bank's money even though he only put down a tiny fraction in cash. The leverage is just astronomical. The overall damage across Wall Street was around 10 billion dollars and Credit Suisse took the heaviest blow. But how does a highly regulated post 2008 bank let one client hold a gun to their head like that. Didn't the floors of risk managers notice. That's the chilling part of the credit Suisse case. The risk managers absolutely noticed. Wait. They knew. Yes. The technical systems functioned perfectly. The risk team looked at these massive concentrated positions saw the extreme danger and demanded more margin. They formally requested Wang post more collateral. They did. They wanted to de risk. So the smoke alarms were blaring deafening really. Then what happened. The risk team was organizationally castrated. They were understaffed. They'd lost about 40 percent of their risk managing directors over the previous years. Wow. But more critically they had zero institutional independence. Because the relationship managers the ones making tens of millions in fees off Wang just explicitly overruled them. Exactly. And let's explore that friction because it's the heart of corporate incentive structures. Right. The relationship manager gets a huge bonus today for the fee revenue. While the risk manager just gets hostility for trying to slow things down. The financial incentive is completely misaligned with the bank's survival. And at Credit Suisse those relationship managers had the authority to say the margin calls weren't in the bank's commercial interest. They just vetoed the safety measures. The guardrail was fully installed but the revenue side just drove right through it. Because there were no consequences. That is the ultimate paper. You have a beautiful document proving you knew how you die and you just let it happen anyway. It's a fascinating contrast. AIG was a failure of visibility. The risk wasn't aggregated. Credit Suisse was a failure of authority. The risk was totally visible but no one had the power to say no. Exactly. So if identifying a risk is useless when greed takes the wheel we need an example of a company that actually turns risk data into a physical reality. Toyota's response to the 2011 earthquake and tsunami is the master class here. That disaster completely severed their supply chains. It did. It took them roughly six months to fully recover production. Now the standard corporate response to that is a polite lessons learned memo. Right. Add a new road to the risk register maybe colored amber and move on. But Toyota physically rebuilt their entire operating model. They wired the risk directly into their manufacturing reality. They spent years mapping their suppliers down multiple tiers right. Yes. Not just the direct suppliers but the suppliers of the suppliers. They dug deep to find hidden single points of failure. And they found roughly fifteen hundred critical parts that needed alternative sourcing or stockpiles. Which is incredibly ironic when you think about it. Because Toyota literally invented just in time lean manufacturing. Exactly. Their whole philosophy is about eliminating waste and never holding excess inventory. Yet for these critical parts like semiconductors they built continuity requirements into the contracts. They required their network to hold two to six months of inventory. It's like a hardcore minimalist consciously renting a massive cluttered storage unit just to hoard emergency supplies. That's a perfect analogy. They overrode their own foundational philosophy because the quantified risk demanded it. That's what it looks like when a risk appetite becomes actual physical inventory dollars and the payoff was undeniable. Right. The 2021 global semiconductor shortage. While the rest of the auto industry was crippled almost instantly Toyota weathered the early stages far better than any peer. I mean they weren't totally immune as it dragged on for years. No of course not. But shifting from a six month recovery in 2011 to a targeted two week recovery in 2021 was a massive competitive advantage. Because the risk didn't live in a spreadsheet. It lived in a warehouse. Exactly. Let's look at one more example of resilience going back to the financial sector. J.P. Morgan in 2008. Right. Going into that crisis Jamie Dimon famously maintained a fortress balance sheet. They had strict discipline around pricing risk so they didn't just survive 2008. They were robust enough to absorb collapsing competitors like Bear Stearns. They maintained massive capital buffers even during the boom years when everyone else was taking on immense leverage for short term profits. But I've got to play devil's advocate for a second. Go for it. J.P. Morgan's record isn't flawless. What about the 2012 London whale disaster. Yes. A trading desk built this enormous poorly controlled derivatives position and they lost roughly six billion dollars. Didn't ERM totally fail there. That is a vital challenge and it forces us to redefine what corporate resilience actually means. How so. The London whale was unequivocally a massive risk failure. It proves ERM is never a finished project. Complacency is the largest threat. Right. But the aftermath is what matters. Resilience doesn't mean avoiding all losses. It means the hits you inevitably take do not kill you. So because of that fortress balance sheet they could take a six billion dollar punch to the face and not collapse. Exactly. They were robust enough to absorb it as a painful but survivable event. They investigated the failure fired the responsible people tightened controls and moved on. If that same hit landed on a weaker firm it would have been an extinction level event without a doubt. So resilience is just survivability. It's having the shock absorbers installed before you hit the pothole. That's a great way to put it. OK. So how does a listener actually apply all this. If you're managing a mid-sized logistics company or you're the CFO of a startup how do you bridge the gap. The source material actually outlines a specific toolkit for this connecting abstract risks to operational dollars. And the first step is moving to probability weighted modeling. Yes. This is where finance and ERM have to physically integrate. Most companies build financial plans on a single highly optimistic base case. They budget for the future. They desperately want to happen. Exactly. But risk aware planning models a distribution of outcomes. You force the finance team to map out severe downside events and calculate the probability weighted value. So instead of a vague threat on a register that just says supply chain issues it becomes a quantified mathematical downside in the budget. And the CFO actually has to hold capital against it. The risk enters the financial machinery. This is the second tool. Key risk indicators or KRIs. And it's crucial to understand the difference between a KRI and a standard KPI a key performance indicator. The best way I make sense of it is a KPI tells you the house is already burned down. It measures past performance like last month's churn rate. A KRI is the smoke detector telling you the wiring of the wall is getting dangerously hot. It's predictive. That is an excellent framing. A KRI is an early warning radar. It alerts leadership if a specific risk is building pressure. Like tracking counterparty concentration or leverage ratios or exactly how many days of critical inventory are left. Exactly. But the real magic of a KRI isn't just sounding an alarm because an alarm can be ignored. Like your credit Suisse. Right. The material stresses that a true KRI must be tied to a hard trigger. A hard automatic non-overrideable trigger. Yes. If credit exposure crosses a threshold margin requirements increase automatically. If leverage hits a specific ratio stock buybacks are paused. No debate. That connects directly back to our Chagos. If credit Suisse had a hard KRI embedded in their software instead of relying on a human judgment call. The relationship managers literally wouldn't have been able to veto the risk team. The software would have just locked them out. You have to mathematically take the discretion away from the people whose financial incentives are screaming at them to ignore the danger. That is the ultimate lesson of operationalizing risk management. Architecting guardrails. The business is physically forced to obey. We have covered a massive amount of ground today. Let's distill this into a rapid fire mental checklist for the listener to take to their next committee meeting. I'd post five vital questions to test if your E.R.M. is real or just theater. Let's hear them. One. Does your risk appetite statement ever actually force the business to say no to a profitable opportunity. Good one. Two. Is your risk register a living document tied to human accountability or just a quarterly archive. Three. Are catastrophic tail risk mathematically respected or does your heat map automatically demote them. Right. The Amber Zone. Four. Does your risk function have the authority and independence to overrule your highest revenue generators. The Ersha Ghost test. And five. Are your risks genuinely aggregated across silos so leadership can view the true enterprise wide exposure. If the answer to any of those is no you are probably operating under paper. Most likely yes. The core takeaway here is that E.R.M. is not a document. It's not a committee and it's certainly not a color coded grid. No it's not. True E.R.M. is whether the knowledge of what could go wrong actually changes the physical contracts enforces the limits arms the hard triggers and builds the capital buffers. Confusing the paperwork for the discipline is exactly how highly intelligent people perfectly document their own demise. A list of threats is not a shield. Exactly. I want to leave you with one final provocative thought to mull over. Oh great. It builds on that point about complacency being a massive risk. Think back to that perfectly calm Tuesday afternoon meeting with the spreadsheet. Yeah. Consider this if your company's risk management system is running perfectly smoothly right now with absolutely zero internal friction and no one from sales is complaining about being told no. Does that mean you're safe. Right. Does that mean your company is perfectly safe or does it mean your risk system is completely broken entirely toothless and just telling everyone exactly what they want to hear until the tail risk hits. Wow. That is the most important question a leader can ask themselves. Until next time stay curious and maybe take a very hard second look at those safe green boxes on your dashboard.