Never mind what went wrong in the financial crisis, what went right?

A lot has been written about all the things that have gone wrong leading up to and during the financial crisis, and for good reason. After all, a lot did go wrong, and we are still reeling from it. Over the same period, though, many things - largely unnoticed - went right. Let's remember that not everyone who considered Madoff actually invested with him, not every bank or mortgage broker made undocumented loans, and not every fund lost terrible sums of money. It's worth taking a look at what these people and institutions did to prevent catastrophic loss, especially because their tactics turn out to be both practical and widely applicable.

Until about 1970, risk management was simple: "don't put your eggs in one basket" was about all anyone ever needed to know. It has been implemented through guidelines that limited investment managers to how much of the portfolio could be invested in any one firm. The maths was easy (for example, no more than, say, 3%, in any one name), the concept was well understood and it was highly successful. Importantly, every investment manager knew the limitations of this approach and no one believed it to be foolproof.

It was about 40 years ago that financial securities and risk management techniques began to become more sophisticated. Fisher Black and Myron Scholes published their seminal paper on options pricing in 1973, opening the floodgates of financial modelling. Over the coming years, investment managers were given plenty of new procedures with which to understand the risks they were taking: delta, gamma, duration, convexity, leverage, volatility, correlation, beta, VaR and a list of related measures appeared on risk reports. Nothing about these new steps in any way contradicted the diversification heuristic - just because you could now measure your beta to five decimal places didn't suddenly make it safe to invest in only a handful of securities. In fact, these new measurements and models supported the old adage and even helped explain it in mathematical terms: investing in uncorrelated assets results in a lower VaR than investing in more highly correlated assets. And, by investing in a large number of securities, you naturally pick up more of those low or non-correlated assets, without even trying. People quickly developed more confidence in these models and in the outputs they produced. But along the way, what was once widely understood - that models are not reality and that they have material limitations - somehow became a dirty little secret. People stopped talking about when the models were applicable and about the accuracy of their output.

This brings me to the first thing that went right: investment managers who successfully navigated the crisis understood their risk tools. They remembered that models are not reality, that they have built-in assumptions, that they are applicable in certain circumstances and not in others, that they require real expertise in interpreting their results, and that they have limitations that can only be ignored at great peril. Even today, many have not learned these lessons and, like the poor craftsman, continue to blame their tools. As a vendor of risk management services, my firm has always taken seriously our obligation to inform the risk manager of our modelling assumptions and more importantly, provide him or her with diagnostic tools to dynamically determine if a given output was trustworthy or not. ‘Risk tools' in other industries such as engineering, medicine, manufacturing or air travel have done this for a long time.

The second thing that went right is that successful investment managers used both quantitative and qualitative means of managing risk. Having a risk analytics capability is without doubt necessary in today's markets. But it is hardly sufficient. Having an experienced risk manager who understands the risk analytics and who has good judgment is also necessary. A good risk manager is similar to a good physician - knowing which tests or measures should be used to diagnose which kind of problem, and knowing when a particular result is meaningful and when it is not. Imagine a physician relying on only one particular measure to determine if a patient is healthy - say, weight, or blood pressure, or cholesterol level. No matter which measure the physician picks, there is no way accurately to assess the health of the patient without measuring many other indicators. Now imagine a financial risk manager who relies on only one particular measure to determine if the fund is at risk - say, number of securities, or leverage, or correlation. Ridiculous! Good physicians, like good risk managers, don't only know which numbers to examine, they also know how to interpret the results and when to question them because they know what can go wrong with the measurements. Knowledge like this only comes with years of training and practice.

A third thing that went right was the authority of the risk manager. Following the medical analogy, you really can't blame the doctor if the patient chooses to ignore his advice. Similarly, those firms that listened to their risk manager's warnings fared much better than those where the risk manager was overruled. The 2010 Greenwich Roundtable's document on best practices says: "The combination of authority, reporting lines, and compensation incentives for the risk manager bear the closest scrutiny. Having a risk manager who cannot effectively police risk limits is often worse than having none at all because of the false sense of security." It is precisely when things aren't going well that the guidelines and recommendations of the risk manager matter most. The firms that adhered to their risk guidelines and listened to their risk managers are the ones that got it right.

Compensation of the risk manager is another area where some got it right. Traditionally, if a fund had a risk manager, he or she reported to the head trader, or to the COO or CEO. In each of these cases, the risk manager's boss has a financial incentive to overrule any risk advice if it interferes with potential profits. The firms that got it right had the risk manager reporting to the board of directors, and his or her compensation was not tied to profit.

Another thing that's gone right is some of the updated financial regulation. For example, the US now requires money market funds to adopt advanced stress testing as part of their normal procedures. Because money market funds are such an essential component of the overall financial system, their soundness is imperative. Money market funds are now required to perform stress tests in three key areas: interest rate stresses, credit spread stresses, and redemption stresses. Importantly, they must also perform combination stresses that carry out all three simultaneously.

The regulators made a significant point in that these funds are not just required to stress "to the point that someone thinks is reasonable"; nor are they required to stress "to the worst historical levels"; rather, they are required to stress "until the fund breaks the buck". By making it a requirement to actually break the buck, the fund is forced to see just how far away from that they really are. Only then can they properly assess their risk. And by requiring the funds to perform the three stresses simultaneously, the regulators added a very important dose of reality: markets move in concert with one another, and it's this dynamic nature that must be taken into account for quality risk assessment. You would think this was obvious, but it took a regulation to put it into effect.

As we all struggle to emerge from this financial crisis, it's helpful to think about the many things that actually did go right. And it's important to learn from them how to improve the risk management function. As a risk analytics provider, we have always looked upon what we do as just one component of the risk management process. Today, we are taking the lessons we've learned from the crisis - by examining the success stories - and incorporating them into our service. The industry seems to be doing the same: more and more firms are adding a serious risk management function to their operations, with experienced professionals who are treated more like trusted physicians. My hope is that we adopt these good practices across the board and that we continue to practice good risk management even after we fully recover, so that we're more prepared to manage the markets' future gyrations.