**3.2. Policies = Procedures**

The second key element of a sound risk management framework is to have in place a set of policies and procedures, which are consistent with the organizational culture and clearly defined, with enough level of detail.

In a simplified view, the output of a firm's risk management strategy is determined by the balance between the firm's commercial objectives (appetite for risk) vs. its risk contention goals (risk control). In other words, organizations look for profit maximization at the lowest risk possible. (Figure 1)

Strengthening Risk Management in the Midst of Downturn Times 319

understand to what extent it is worth to incur a certain risk and can even pre-empt a

There are several risk measurement techniques which have been used for long. Some of the

The calculation of such measures often needs of many complex mathematical models. Furthermore, in some cases, their implementation at organizations is not easy. Therefore, since the late 1990s, companies have alternatively opted for another method: "Value-at-

VaR calculates the risk of loss on a specific portfolio of financial assets. For a given portfolio, probability and time horizon, VaR is defined as a threshold value such that the probability that the mark-to-market loss on the portfolio over the given time horizon exceeds this value (assuming normal markets and no trading in the portfolio) is the given probability level [13].

**Figure 2.** Histogram of daily hypothetic profits and losses over a long-term contract [14]

changes ("what-if scenarios" or "stress tests").

At this point it is worth highlighting that whilst VaR provides the quantitative perspective, it needs to be complemented by a more qualitative dimension resembling the market

It is also worth pointing out that despite VaR is used in front of other methods which are perceived less powerful and more complex and difficult to understand, it is also constrained and only valid within a set of assumptions. This is one of the reasons why it is adviced that every VaR model is backtested, validating that the actual results are aligned to the forecasts.

corporation from bankruptcy.

Size of open positions

Assets' exposures

See example in Figure 2.

Risk" (VaR).

most common ones in the banking industry are:

Degree of maturity mismatch in the net position

**Figure 1.** A company's Risk Management strategy should balance its appetite for risk over its measures for risk control.

Organizational processes are the means that a firm has to achieve its strategic goals. Therefore, firms' corporate policies should be well assembled, known by all and periodically updated not only with industry best practices, but also with the new regulation.
