A Cybernetic Critique of Enterprise Risk Management

Enterprise risk management refers to the loose collection of data management and mathematical techniques which evolved over the last twenty years to enable financial institutions to determine theoretical values for their investment portfolios in hypothetical market environments. A fundamental problem with risk management systems and the pricing models embedded in them is that key factors affecting the value of a portfolio are left out of the models. Of the generally acknowledged sources of risk, namely, market risk, currency risk, volatility risk, credit risk, liquidity risk, operational risk, and regulatory risk, only the first three have sufficiently deep and unambiguous data histories to support the simulations which are the basis for most risk analyses today. Factors which do not lend themselves readily to standard statistical methods are left out of the picture completely. The differences between raw input data, normalized data, hypothetical data, the output of models, interpretive structures defined by the risk manager, and summary results reported to upper management are largely subsumed in the operation of massively complex computational systems. A cybernetic critique of risk management should start with an examination of the unacknowledged role of feedback and proceed to confront the methodological rigidity of most