Risk management lessons learned from the financial crisis: One CRO's view

This paper traces the development of risk management practices at large financial services firms before, during and after the financial crisis of 2008 and the 2012 European sovereign debt crisis. It begins by outlining how enterprise risk management provides the foundation for crisis management, leveraging quantitative and qualitative tools such as top risk assessment (TRA) and own risk and solvency assessment (ORSA). While adequate for ‘normal’ times, these practices need to be enhanced during times of crisis. In the second section, the paper discusses improvements in two specific areas: first, improving scenario and impact analysis and, secondly, achieving higher management impact through direct and contingent actions. The final section looks forward, asking critically how risk management and especially risk culture need to be developed in anticipation of future crises.