The 2008 global financial crisis, the collapse of Barings Bank in 1995 and the theft of pension scheme assets by Robert Maxwell are just a few examples that highlight failures in risk management. The lessons learned from these events influence how financial institutions operate today, and good risk management has many benefits. Describing enterprise risk management (ERM) as a process that manages all risks on a holistic basis, Sweeting guides the reader through the qualitative and quantitative techniques that can be used to identify, model and measure risk. Aimed at risk practitioners in the financial industry, it also forms part of the core reading for the Institute and Faculty of Actuaries’ ERM examination.
1. Context
The first few chapters introduce ERM and provide context for the rest of the book. After an easy-to-read introduction to ERM, the types of financial institution, stakeholders, and the internal and external environment are discussed. The book focusses on banks, insurance companies and pension schemes as well as offering some information on foundations and endowments. However, there is an awkward tendency to hop between institutions within sections. Historical information is presented and while interesting, can be a distraction from the current situation. Furthermore, while there seems to be a focus on the United Kingdom, examples from other countries are scattered somewhat randomly throughout. These structural issues make it more difficult to assimilate the information. Nevertheless, the chapters provide a good grounding for the rest of the book.
A short but useful overview of the ERM process follows. Sweeting explains that ERM is implemented as a control cycle consisting of identification, assessment, management, monitoring and modification.
2. Risk identification and analysis
Before risks are identified, a risk taxonomy is needed. Acknowledging that risks can be categorised in different ways, Sweeting presents a set of risk definitions and points the reader to alternatives. A range of risk definitions are covered in some detail, but the book lacks a concise summary of each risk.
Various risk identification tools and techniques are discussed along with the documentation of risks in a risk register.
There is a reminder of some useful statistics which mark the start of the quantitative section of the book. This is followed by a chapter on statistical distributions, which is one of the best in the book. It is very mathematical, in sharp contrast to the earlier chapters, but the equations are laid out clearly, and the inclusion of the probability density functions and cumulative distribution functions in graphical format is invaluable. The characteristics of the distributions are discussed, and the boxed examples provide practical applications. The chapter ends with a comprehensive section on copulas with diagrams and worked examples supporting understanding.
Sweeting explains that one of the most common ways in which risks can be quantified is by using models. Over the course of a few mathematical chapters, the book covers various modelling techniques. There is a good section on Bayesian networks containing useful diagrams and worked examples. The chapter on stochastic modelling is quite theoretical, but this is balanced by the following chapter which discusses practically how to quantify some specific risks such as market risk, interest rate risk, credit risk, liquidity risk and demographic risk. There is good signposting to other chapters and some worked examples.
Having discussed how to identify and quantify risks to understand risk profile, Sweeting explains that it must be compared to an organisation’s risk appetite – a combination of risk tolerance and risk capacity. These are considered, as are risk and return measures which can be optimised using various approaches.
Sweeting explains that the next stage is to respond to risks which are generally either reduced, removed, transferred or accepted. These approaches are discussed in turn with some practical applications by risk type.
There is a short but pertinent chapter on the importance of documentation and communication as well as considerations of internal and external audit, then the book brings together many of the principles already discussed with a chapter on economic capital.
3. Risk frameworks
Explaining that risk frameworks look at financial institutions, or even systems, as a whole and try to manage all of these risks in a consistent manner, Sweeting discusses a number of risk frameworks. Regulatory frameworks including the Basel Accords and Solvency II are covered as well as advisory ones such as the international standard ISO 31000:2009. There is also a section on proprietary frameworks such as the approaches used by various credit rating agencies.
The book concludes with some case studies. Although most relate to financial institutions, some examples from the non-financial sector are also included. Sweeting observes that several contributing factors occur repeatedly. The first relates to the maxim if something looks too good to be true, it probably is. The second relates to the culture of an organisation, and the third the importance of incentives.
4. Summary
Although the book would benefit from restructuring in places to improve clarity, the diagrams support understanding of the technical concepts and the questions at the end of each chapter help to reinforce points and encourage active, rather than passive, reading. This is ideal for anyone using the book as a study aid. The book is well-suited to an actuarial audience, both as a text book and as a reference guide. The sections on further reading are helpful for those who wish to explore the topics further, and the importance of risk management is brought to life through various case studies.
