Interview by Joe Kolman

In terms of background and experience, Richard Breeden deserves to be known as the country's senior risk management consultant. As the chairman of the worldwide financial services practice of Coopers & Lybrand, he advises financial institutions on a wide range of issues.

As chairman of the Securities and Exchange Commission from 1989 to 1993, he oversaw the liquidation of Drexel Burnham Lambert, the Salomon Brothers bond scandal and the settlement of the SEC's case against Michael Milken. Towards the end of his watch, he spoke frequently about the necessity for improved disclosure and controls in the derivatives market.

He talked recently about the role of directors in risk management with editor Joe Kolman.

Q: Many risk management consultants believe that board members still have a long way to go to improve derivatives policies and controls. How adequate are the controls in place now in corporate America?

A: The most accurate generalization you can make is that risk management practices have improved immensely. Sensitivity to risk has skyrocketed, and a large number of companies have moved up the learning curve regarding both the availability of instruments and the imperative to establish good controls. There have also been real gains in using instruments to control specific industry-related types of risks and to enhance profitability. That whole area has been one of immense development with better methodologies, better systems and more knowledgeable people.

Q: How many of the Fortune 500 have appropriate policies and controls in place?

A: I wish all of the Fortune 500 were my clients so I could give you a good number. Certainly the direction has been strongly positive. More audit committees are looking at control policies and systems, more CEOs and CFOs support making the necessary investments, and more companies have directors who are comfortable talking about risk management practices. I can't be sure that 317 of the 500 are doing it at an appropriate level, but the general trend has been strong.

Q: What's the most common mistake end-users make in setting derivatives policy?

A: There are many companies that still have extremely general mandates from the board level. It's still too common to hear people tell you, for instance, that "Our policy limits the use of instruments for hedging and never for speculation." Well, that is not an adequate mandate from a board of directors, because that gives far too much discretion to an individual or other employees to decide when are they hedging or speculating. Those words are not sufficient to correlate into an effective system of procedures and limits that will set an acceptable boundary on the level of earnings or net worth that are at risk at any given time.

Q: You'd like to see board members demand much more detail...

A: Absolutely. Boards should ask management to propose levels of maximum exposure-with specificity. Directors should review the levels that management proposes and come to an explicit understanding with management of the magnitude of risk that will be incurred through these financial operations. What is the company's overall appetite for risk? How much risk is it willing to incur either from not using the instruments or from using them? How much is the company willing to pay (using these instruments is not free) in order to protect itself from certain types of risk? Once the board and senior management reach a clear understanding on these issues, they can then be embedded in written policies and procedures and in systems that can enforced and for which management can have accountability. There are far too many cases where people have thought about these issues but the applicable guidance is still quite fuzzy.

Q: Are dealers further ahead of end-users when it comes to risk management?

A: Certainly dealers are more sophisticated about the instruments and pricing in the market than most end-users would ever expect to be-and for obvious reasons. It's a full-time business for the dealer, but it's only an adjunct to the user's real business. So not surprisingly, the end-user is typically at a disadvantage to the dealer in terms of systems and methodologies.

However, I wouldn't want to give the impression that end-users use these instruments casually, or without expertise. The fact that XYZ Corp. has a more limited capacity to operate than a major bank or securities house doesn't mean it's not well-equipped to operate within the scope of what it wants to do. On a narrow range of products or types of risk, an end-user may be highly sophisticated. Indeed, it shouldn't take on a major exposure without first establishing the necessary analytical infrastructure and control mechanisms.

Q: What are the most typical problems you see on the sell-side?

A: At least in theory, dealers know the issues and how to deal with them. But building a good control system in a particular company-given the personalities and nationalities of its people and the locations in which it operates-is a very difficult job and has to be worked at very hard and regularly evaluated. I think it's one of the toughest jobs out there. It's much easier to come up with the latest mathematical models for computing value-at-risk than it is to know how you are really going to make sure your traders aren't cheating you or your customers, or aren't creating phony books.

There's a lot of lip service paid to the fact that people ought to have good control systems. But the budgets people are given to solve these problems can vary quite significantly. Also a firm's product mix may change quite substantially in a relatively short time. This may create both costs and gaps in controls if the firm's procedures and technology are not adaptable.

Q: Why aren't some dealers spending enough money in this area?

A: There's a fundamental contradiction on the dealer side that can lead to some unpleasant surprises. When people go through business school, they're trained to promote the income-generating side of the firm. If there is a new system or technology or new people that can help earnings per share, you can get the attention of the CEO very quickly. People are willing to spend money in order to make money. You can measure it, the analysts can applaud it, the stock price will respond because of it, and it's generally a positive thing.

Equally, managers are trained from birth to fight overhead, to go out in the morning planning to find some area of overhead that can be slashed. Independent risk committees, redundancy in valuation, portfolio checking, internal audit-most of these protections against the trader-run-amok look remarkably like they fall squarely in the general category of overhead. Those types of activities don't generate a profit. You don't find internal audit divisions that are profit centers. You don't find people paying $10 million bonuses to internal audit or compliance personnel. Unfortunately, from a shareholder perspective, those may be the best dollars you can spend.

So there is an ongoing risk that companies will spend first to expand the risk-taking capacity, and that there will be a lag before they spend on risk-controlling activity. The end result for some companies is the equivalent of creating a car with a powerful engine and no brakes.

This is particularly true in remote locations. There are quite a few companies that place excessive reliance on key people because they are trying to economize on the size of their staff in a small office. The company may have done the right things in New York...

Q: ...or London...

A: ...and then out in Kuala Lumpur they've asked one person to do two different things. One company could say, "We'll go into Buenos Aires but we'll do it with the trader controlling back-office settlement." But a well-disciplined company would say, "If we don't think the business in a particular location would be sufficiently profitable to warrant putting in place a minimally acceptable control structure, then we simply won't go into that market."

Q: A lot of times, senior managers think they know their people very well and think they don't need to put all these fancy controls in place.

A: It's a hard thing to operate on the assumption that key employees may lie to you. But it is a fact of human nature. When a trader gets in trouble, it is rational for them to think that they have nothing to lose by doubling up their bets and trying to recoup a major loss before the firm finds out about it.

People will lie to themselves and to their colleagues-and often without any motive of cheating the company. Rather, they want to help the company and themselves by restoring a loss-living to trade again another day. They will utilize their maximum degree of creativity and ingenuity to defeat your systems in the hopes of retrieving a situation that has gone bad. You'd like to say, "I can have great faith in human nature, I trust all my people," and so on. In most cases that is true, but human history suggests that there will always be a certain number of people that will give in to what is a perfectly rational calculation.

Q: What other problems do you see on the dealer side?

A: People can often be mesmerized by models. But the firm has to succeed in the real world, not simply in a model.

I remember a discussion several years ago with a very senior risk manager at a very large financial institution. This individual was saying that their firm couldn't incur significant losses because they managed their risk to two standard deviations, and various other statistical pressures of historical risk. I remember thinking at the time, "Boy, are those guys in trouble." In my opinion, the systems he developed placed excessive faith in statistical observation of the markets in a given time period that had fairly low levels of variation. With two standard deviations, you can go bankrupt once every 40 years. If I were a shareholder, I wouldn't think that was an adequate level of protection.

The iceberg that sank the Titanic was not there at two standard deviations of normal iceberg distributions. At four standard deviations, that iceberg might or might not have been there. The fact is that in the real world, it was there.

It's the unexpected that people have to respect. That's not always adequately considered by people who in their entire professional career have only lived through bull markets, or people who have not lived through chaotic markets or liquidity crises. The unexpected can and regularly does happen.

Q: A lot of board members find this area too complicated for their tastes.

A: Derivatives is not the only area where people may have an aversion to dealing with something they don't fully understand. A director of a chemical company may not understand all the chemistry that goes into producing a particular compound. The chief scientist out at the refinery should know an awful lot more about molecules than any individual member of the board. That doesn't prevent the director from being able to help guide the company's overall objectives and to evaluate management. There's nothing about the fact that people in the company understand these issues better than board members that should cause people to say, "Well, we won't ask the question."

Directors have a vital role to play, and they can play that role without speaking a word of Greek. The questions that need to be asked are business questions that can be put in plain English. They don't get answered through silence or through guessing at it. Where directors are more active, they actually perform a great service to companies by asking for a thorough presentation on management plans and policies. It actually can be a great help to key people in management to get risk management issues raised higher on the visibility scale by a board that is inquisitive. A discussion of those issues is almost always very helpful, unless it turns into an exercise in mutual self-delusion, which can also happen.

Derivatives are like any other tool that can help a company solve a problem. It is important that people recognize that these instruments can be highly leveraged, and that if you do not have a thorough and effective control structure in place, people can very quickly create large exposure. If a company is going to allow activities in a particular area they should understand the ground rules in advance. The company also has to be willing to invest in systems that are capable of giving risk managers and senior management comprehensive and timely information.

It's like talking to your teenagers. It can be a frightening experience, but ultimately successful parents have to learn how to do it. And successful directors of good boards have to learn how to talk about risk in detail.

Q: One danger, I suppose, is that companies that have put good policies in place may become complacent about the work they've done.

A: With buy-side industrial users of derivatives, you can't ever say, "We did a great job of using these products prudently last year." Or with dealer institutions: "We used these instruments wisely, we traded and sold them profitably, and our employees acted with ethical behavior last year. Do we have any remaining concerns?"

Yes, you do. And the concerns are: "Will we do this as well tomorrow?" You have to make sure that as risks in the real world change, portfolio managers adjust their instruments to reflect that they are successful in making sure an institution lives within its governing parameters. The ongoing job also includes understanding new instruments as they appear and making sure systems and methodologies are updated as they become inadequate to the volume and complexity of what a company might do. It involves making sure personnel receive the training and guidance they need, and that there's a good strong system of accountability of results.

Q: So the problems we've been seeing are not going to go away.

A: When you look at each new problem that hits the news, it never ceases to amaze me how the simplest embezzlement continues to go on. I ask myself, "With so many sophisticated tools available, how is it that these kinds of things can happen?" Regrettably, I think they will continue to happen in a certain percentage of companies.

Some companies have read too many of their press clippings and think, "It can't happen to me, it can't happen here." The sad fact is that it can, and if you think that it can't, it probably will.