Overview of Financial Risks and Regulatory Frameworks › Objectives of Risk Management

Understanding the types of risk is necessary but not sufficient. We must also understand what risk management seeks to achieve. Risk management is not about eliminating risk, as that would eliminate returns as well. Rather, it is about taking risk deliberately, with an understanding of whether the expected return provides adequate compensation.

The fundamental objective of risk management is survival. A trading firm or fund can recover from a bad year, but it cannot recover from insolvency. The difference between a 50% loss and insolvency shapes how risk management must be approached.

Consider the mathematics of recovery. A 50% loss requires a 100% gain to recover. A 90% loss requires a 900% gain. At some point, losses become unrecoverable not because recovery is mathematically impossible but because the time required exceeds practical horizons, or the risk-taking required to generate such returns makes another catastrophic loss even more likely.

The Kelly criterion, which optimizes long-term geometric growth, provides a theoretical foundation for this perspective. Overbetting, taking more risk than the Kelly fraction, reduces long-term wealth growth despite increasing expected single-period returns. The expected utility framework reaches similar conclusions: with plausible risk aversion, avoiding catastrophic losses dominates maximizing expected returns.

Risk management must protect against tail events, the rare but extreme outcomes that lie far from normal expectations. Financial returns, as we discussed in Part III on stylized facts, exhibit fat tails: extreme events occur much more frequently than a normal distribution would suggest.

A "6-sigma" event under the normal distribution should occur roughly once every 1.5 million years. In financial markets, such moves happen every few years. Black Monday (1987), the Asian financial crisis (1997), the Russian default (1998), the dot-com crash (2000), the global financial crisis (2008), the COVID crash (2020). Each featured daily moves that should have been virtually impossible under normal assumptions.

Risk management must therefore:

• Use fat-tailed distributions or stress scenarios rather than relying solely on normal-based measures
• Implement position limits and stop-losses that prevent any single event from threatening solvency
• Maintain adequate capital buffers to absorb unexpected losses
• Plan for correlations to spike during crises (diversification fails when you need it most)

For regulated institutions, such as banks, broker-dealers, and insurance companies, risk management must satisfy regulatory requirements. These requirements serve both microprudential objectives (ensuring individual institution soundness) and macroprudential objectives (ensuring systemic stability).

Regulatory compliance typically requires:

• Maintaining minimum capital ratios based on risk-weighted assets
• Holding liquid asset buffers against potential outflows
• Reporting risk exposures to regulators
• Implementing governance structures with independent risk oversight
• Conducting stress tests under regulator-specified scenarios

Even unregulated entities like hedge funds face indirect regulatory pressure through their relationships with prime brokers and counterparties, who themselves face regulatory requirements around counterparty credit risk.

Beyond survival and compliance, risk management should help optimize risk-adjusted performance. This means:

• Allocating risk budget to strategies and positions with the highest expected Sharpe ratios
• Avoiding uncompensated risks through hedging or position adjustment
• Identifying situations where risk/reward is asymmetric in your favor
• Maintaining consistent risk levels rather than allowing risk to fluctuate with market conditions

The risk management function should not simply veto trades; it should help the firm take better trades by providing accurate risk assessment and ensuring that risk-taking is intentional rather than accidental.