Book Review: Behavioral Risk Management

Behavioral Risk Management: Managing the Psychology That Drives Decisions and Influences Operational Risk. 2016. Hersh Shefrin.

In Behavioral Risk Management: Managing the Psychology That Drives Decisions and Influences Operational Risk, Hersh Shefrin seeks to improve the practice of risk management by helping risk managers develop psychological skills to complement their quantitative skills. Shefrin is the Mario L. Belotti Professor of Finance at Santa Clara University and a faculty member in the Master of Science in Risk Management program at New York University’s Stern School of Business. His book Beyond Greed and Fear: Understanding Behavioral Finance and the Psychology of Investing (Harvard Business School Press), published in 2000, provided one of the first comprehensive treatments of behavioral finance and was intended for practitioners and academics alike.

Risk is generally categorized into one of three spheres: market, credit, or operational risk. Operational risk can be summarized as the risk of business operations failing due to human error, and it includes risks resulting from breakdowns involving internal procedures, people, and systems. The author analyzes the relationship between behavioral psychology and operational risk, which garners the least focus by risk management academics and practitioners.

Although market and credit risk are the spheres that attract the most attention by academics and practitioners, some of the most devastating risk management failures in history resulted primarily from operational risk. An example detailed in the book is the excessively high aspirations — in combination with groupthink, excessive optimism, and overconfidence — that affected Fannie Mae, Freddie Mac, and AIG in the global financial crisis. These psychological pitfalls (biases) at the highest levels of management have the potential to put chief executive officers and chief investment officers in conflict with chief risk officers.

Shefrin references a large number of biases discussed in the literature but focuses on only a handful of them. He expounds at length on groupthink, which is the human tendency not to upset the status quo despite an obviously inaccurate consensus. Bayesian avoidance, defined as not updating the probabilistic judgments of risk as new information arrives, is another bias that receives significant attention.

Shefrin provides tips on improving risk management that build on understanding, recognizing, and countering such biases. Debiasing techniques can reduce the frequency with which risk management failures occur. They can be implemented on an incremental, continuous improvement basis. As support for the importance of using debiasing strategies, the author documents several major risk management failures, most occurring after 2000, and predicts that serious failures will continue to occur in the future. Organizational leaders should think long term by developing strong organizational cultures emphasizing risk management processes and behaviors.

Shefrin favors using a process-pitfall framework that builds on a concept known as open book management (OBM) to minimize groupthink. The major processes central to OBM are standards, planning, incentives, information sharing, and operations. Devil’s advocacy during the planning process is encouraged to challenge assumptions. This cultural mindset begins with senior executives actively supporting debate within the company and group leaders refraining from expressing their ideas until most group members have had an opportunity to express opinions. Groups are especially vulnerable to groupthink when they rely on consensus and do not have preset rules and processes for decision making. OBM companies also recognize that there is a natural tendency for group members to refrain from sharing information. When groups are large, OBM companies use breakout sessions with subgroups to engage in brainstorming before the whole group convenes to discuss a complex issue.

The author also describes RMP, which is a synthesis approach to characterizing an organization’s “risk management profile.” RMP was developed to measure the cultural strength of an organization. As with OBM, applying a risk management process to an organization involves asking direct and specific questions. Organizational culture is a medium through which risk drivers are transformed into outcomes. Active devil’s advocacy is an important aspect of RMP as well and serves to mitigate groupthink. It induces group members to share information that they might be reluctant to disclose for fear of not appearing to be supportive. Devil’s advocacy also mitigates polarization, whereby group dynamics amplify individual members’ individual risk tolerance profiles. Polarization occurs because in the course of attempting to support other group members, some members set off a chain reaction that generates magnification.

In summary, Behavioral Risk Management is a thought-provoking book that advances the behavioral finance literature by moving beyond the historical focus on asset pricing to examine operational risk within a number of institutions. The book effectively demonstrates that investment managers need to understand not only the quantitative tools, such as conditional value at risk, but also the psychology of risk management.

If you liked this post, don’t forget to subscribe to the Enterprising Investor.

All posts are the opinion of the author. As such, they should not be construed as investment advice, nor do the opinions expressed necessarily reflect the views of CFA Institute or the author’s employer.