Mechanism instead of magic Many say: boards do not understand quantitative risk analyses. I believe: often they simply do not trust them. And in many cases that is rational. Because a large part of “quantitative” analyses is based on something quite different from what the term suggests: → compressed expert estimates Someone says: “The risk is X.” Then this gets aggregated mathematically. The result looks precise, but how it came about remains opaque. That is not a robust quantification. That is magic dressed up as numbers. The alternative is a mechanistic approach. Not: how big is the risk? But: how does it arise? A model describes: • the relevant risk drivers • their ranges • distributions • dependencies and interactions The result is then no longer a claim, but a consequence. The crucial difference: every single assumption can be examined and discussed. • Is the driver even relevant? • Are the ranges realistic? • Does the distribution fit the data? • Are the dependencies plausible? Uncertainty does not disappear, but it becomes visible and can be broken down. The mechanism replaces the magic. But even the best model does not solve the problem on its own. Because models do not arise in a vacuum. They can just as easily be “dressed up”: • by selecting or omitting drivers • through favorable parametrization • through weakened dependencies That is why the real key question is not only methodological, but organizational: What governance underlies the model? Governance is not an add-on, it is a prior decision. Before any calculation is done, the following has already been determined: • who makes the assumptions • how they must be derived • who reviews them • what transparency requirements apply Weak governance means that even good models become arbitrary. Strong governance makes even complex models traceable and trustworthy. What does that mean in practice? • Every material risk needs a traceable model • Every assumption must be justified and documented • Building the model and reviewing the model should be kept separate • Sensitivities must be disclosed • Regular validation is mandatory, not optional Conclusion The problem in risk management is often not a lack of communication. It is a lack of trust in how the numbers came about. Trust is not created by “better visualization,” but by traceable mechanisms and a governance that makes manipulation harder. Or put differently: It is not only the mathematics that convinces, but also how traceably it is applied.
This post was originally published on LinkedIn. View and join the discussion there