Risk management, governance, culture, and risk taking in banks

This article examines how governance, culture, and risk management affect risk taking in banks. It distinguishes between good risks, which are risks that have an ex ante private reward for the bank on a standalone basis, and bad risks, which do not have such a reward. A well-governed bank takes the amount of risk that maximizes shareholder wealth, subject to constraints imposed by laws and regulators. In general, this involves eliminating or mitigating all bad risks to the extent that it is cost effective to do so. The role of risk management in such a bank is not to reduce the bank?s total risk per se. It is to (1) identify and measure the risks that the bank is taking; (2) aggregate these risks in a measure of the bank?s total risk; (3) enable the bank to eliminate, mitigate, and avoid bad risks; and (4) ensure that the bank?s risk level is consistent with its risk appetite. Organizing the risk management function so that it plays that role is challenging because there are limitations in measuring risk and because, while detailed rules can prevent destructive risk taking, they also limit the flexibility of an institution to take advantage of opportunities that increase firm value. Limitations of risk measurement and the decentralized nature of risk taking imply that setting appropriate incentives for risk takers and promoting an appropriate risk culture are essential to the success of risk management in performing its function.