By Marilyn Harris

It's 2015. The subprime mortgage crisis, credit crunch, liquidity drought, and plunging stock market that began in 2007 are all bad memories. Wall Street recovered its appetite for risk a few years back. The latest fad: an innovative Chinese bank has packaged the debt of grassroots alternative energy collectives around the world and is marketing it aggressively. But the leading investment banks politely decline to partake. They've beefed up their risk management functions after losing billions in the last big crisis and kept them that way, and their CROs, or chief risk officers — they of the long memories and even longer statistical models — say nix.

Realistic? Perhaps. The right decision? Perhaps not.

If the past is any indication, it seems unlikely that civilization will proceed in a measured, cadenced manner. Boom and bust go together like yin and yang. So if you need a boom to move ahead, then you have to accept the risk that you may instead get a bust. How to manage that risk has, in the wake of the past 18 months, become topic A in the financial community. NYU Stern's valuation expert Aswath Damodaran, professor of finance and David Margolis Teaching Fellow, put it bluntly: "It's time for new thinking on risk."

Both Damodaran and Stern's Vice Dean of Faculty Ingo Walter, Seymour Milstein Professor of Finance, Corporate Governance and Ethics, have been pondering these questions, and each has produced results that move the discussion ahead. Walter has designed one of the first Executive MBA programs designed to produce a new breed of empowered risk management professionals, launching in April 2009, in partnership with the Amsterdam Institute of Finance. Damodaran has written a book, Strategic Risk Taking: A Framework for Risk Management, published in August 2007.

Both professors agree: Traditionally, the way to manage risk has been to hedge it. Risk management products, such as options and derivatives, are risk hedging products — defensive moves to cover the downside. The dangers fall into six interrelated categories: country risk, or the exposure that comes with investing in and lending to sovereign or business entities abroad; credit and counterparty risk, whether retail or wholesale; market risk, associated with the movement of prices; liquidity risk, commonly measured in the world of finance by the spread between bid and offer prices; operational risk, the possibility that transactions or operations will break down; and reputational risk, whether a particular event has done serious damage to the franchise and enterprise value of a firm. Key dimensions of these risk domains derive from the specific strategies and tactics of business firms, and they are interlinked in ways that are resistant to modeling and often very difficult to understand. As current events show, nobody has all the answers, but some seem to do better than others.

Managing risk is traditionally a backward-looking operation involving the creation of models of statistical probability based on the steadily accumulating data that history provides. However, said Walter, "Once you have a reasonably workable risk management infrastructure in place, it still doesn't mean you do the right thing. After all, the business of business is taking risk. The objective is not to eliminate risk, but to get appropriately rewarded for assuming risk exposures."

Finding risk exposures that will produce an attractive reward is, of course, the rub. For some time prior to the current debacle, risk management professionals at the investment banks, mortgage giants, and hedge funds that got clobbered almost certainly had been uneasy, and to the extent they warned management about their unease, most seem to have been ignored or rolled over by highly compensated revenue-producers — much as the chief of Freddie Mac reportedly dismissed the explicit warning of his chief risk officer, according to The New York Times. When things are going swimmingly, cautionary notes are rarely welcome. After the full extent of the losses in subprime became known, several leading banks even sent their risk management guys packing. But it's not unlikely, said Damodoran and Walter, that the investment decisions were made prior to any thorough assessment of the associated risk, with the prospect of great gains driving the deals — with certain exceptions, such as at Goldman Sachs, where risk management advice was apparently taken on board in a much more balanced way than at some of the firm's competitors, resulting in appropriate (albeit expensive) hedging mechanisms being put in place.

More generally, the promise — and even the initial realization — of great gain had certainly not justified the billions invested in collateralized debt obligations (CDOs) and related structured instruments, according to Damodaran, because they represented the wrong type of risk and, ultimately, were not priced appropriately for the amount of risk they presented. Furthermore, the expertise for understanding these particular investments at the ground level — a sine qua non, in Damodaran's view — was lacking. "What did investment banks bring to the table that would have enabled them to take advantage of default risk at the household level?" he said. "The biggest weakness of the current risk management system is that it rewards trading success even if that success is the result of poor risk taking. You must reward those who take the right kinds of risk even if they lose money, and punish those who take the wrong type, even if it makes money."

That is a provocative notion. Damodaran has nothing against risk taking, believing it a cornerstone of human nature: "It doesn't matter whether it's tulip bulbs or CDOs based on subprime mortgages, people will take risks. The key is that they are exposed to the right kinds of risk."

What is needed, according to Damodaran, is a more balanced approach than he believes is currently being practiced. "The more complete view of risk management encompasses both risk hedging at one end and strategic risk taking on the other," he said. Identifying the exposure should go hand in hand with identifying the opportunities an enterprise might pursue. Accomplishing this would require flexible organizations with better information and quicker decision making, small teams of people with greater freedom to make decisions, and a flatter structure that includes a generalist who can manage the portfolio of teams. It is a vision distinctly at odds with silo-ing. "The sequence now is that the strategy guys and revenue producers select an opportunity, the operations guys determine how to execute, and after that, the finance guys are asked to measure the risk," Damodaran said. "These activities should be concurrent."

Along those lines, Walter points out that Goldman's "strong traditional partnership mentality" may — even though it has been a public company since 1999 — have enabled a concurrence of decision making by the firm's various constituencies on how to prudently and profitably manage CDO-related business opportunities. This meant originating, structuring, and selling the various instruments to "sophisticated" investors to whom the firm had limited fiduciary responsibility, while avoiding warehousing those same instruments and hedging any residual risk exposure. In contrast, the rule at most banks seems to have been a structure that has systematically favored the offense over the defense, as against a more balanced approach to risks and returns. "I am trying to be optimistic that we will see a lasting change in the strategic role of risk officers, toward greater integration into key decision processes," he said. "Risk doesn't come in neat buckets, and sometimes the buckets we think we understand pretty well are tied together in ways that are really hard to predict."

Change often germinates in the ferment of universities. At NYU Stern, a re-evaluation of the study of risk is already starting (see box below), albeit in an evolutionary, rather than revolutionary, way. Many of the traditional risk management tools are taught within the various finance courses, but a number of new risk-related electives are being offered, and the faculty expects student interest in these electives to grow, based on recent events. More new course design is being considered, focusing on what Walter would like to see as a "holistic" risk course that is driven by a shareholders' perspective — after all, not every risk needs to be managed when shareholders can use portfolio adjustments to do it themselves better and cheaper. An intensive mini-course aimed at alumni was offered in May, and will be expanded in both content and enrollment in May 2009. Integrating case-oriented teaching, along with lectures and technical exercises, the mini-course is intended to balance the appropriate use of risk modeling with a good dose of common sense. And the executive risk management masters program that Walter helped design for the European market could move the dial a little closer to a new vision of what risk really means, with its aim of creating a career track for bright young professionals and encouraging a new generation of senior management with a broad understanding of risk exposure and its core role in building the value of the business franchise.

If Professors Damodaran and Walter are right, the discipline of risk management looks to be in for a sea change, with a new generation of risk managers compensated as well for things that don't happen as the revenue producers are compensated for things that do happen. As any good football coach knows, this is a winning formula that requires consistent and persistent attention. So come 2015, it's entirely possible that the debt of the worldwide alternative energy collectives could well be judged a worthwhile investment. And civilization could lurch ahead a bit, fueled by visionaries who took the right kind of risks.