Rather than being a crisis, a change in the competitive landscape was one of the reasons for a change in emphasis for the chief risk officer role at ASX Ltd. Former CFO Alan Bardwell moved from finance chief into the expanded role last year. Competitors like Chi-X were coming into the local market and late last year the Singapore Exchange made a bid for the ASX itself.
Bardwell says you need to be aware of the limitations of the numbers you rely on. "We spend a lot of time producing lots of numbers," he says. "The reality is that judgment is probably back in vogue." However, that doesn't mean the figures should be ignored. "The key thing about numbers is that they are not a waste of time - they are important for us to understand our risk profile, but what is fundamentally important is that we understand the data and understand the assumptions underlying the data and the outcome."
As well as factoring in the extreme events that are readily apparent from history, risk controls need to be checked against present trends. Dunn says any modelling needs to have a "commonsense" check. "I know at times at AMP there has been a sort of acceptance that the model is always right, but that, frankly, commonsense would cause you to think of twice," he says
Many now talk about factoring in the outliers into those assumptions. But how far out do you go? Bardwell makes a case for looking at historical data as well as whether the assumptions are valid. You just need to look far enough back. He points out that when anyone using data from the 1987 crash stress-tested for possible losses they would have been well prepared for the GFC. In the 1987 crash the All Ordinaries fell about 25 per cent in one day at its worst, compared with about 7 per cent at the worst of the GFC in November 2008.
Like many large organisations, Bardwell uses the traditional impact/probability matrices, but to this needs to be added a third dimension: speed. "Risk managers talked for many years about the probability of a loss and the loss given that probability occurring," he says. "So we have probability and impact [but] we need to start adding the speed of the onset of a risk."
You might have a high severity and a high likelihood of risk but it might be employee attrition, and the impact of that is only going to materialise over, say, an 18-month period. "[But] a competitor coming into the market ... if successful they are going to take a lot of your market [and] it is going to be quick. So ... you need to be far more agile."
Sign up for CIO Asia eNewsletters.