Supervision and the Illusion of Optimal Risk

Supervision is a complex and essential task, and the supervisors, fortunately, by most measures, have been highly successful.

Yet certain issues give me cause for concern.

Recently, I have been to several events on financial supervision, and noted a recurrent framing: if banks are given too much freedom, they will take excessive risks and exploit their clients. If supervision is too strict, banks will not support economic activity as society expects. Actually, the problem of too much risk is frequently mentioned, while that of too little risk is more grudgingly acknowledged.

From that vantage point, one might then conclude that supervision is about fine-tuning risk. Start by curbing the most egregious risk-taking, then progressively suppress lesser risks until an acceptable level of safety has been achieved. It is a very financy way of thinking — certainly how one is supposed to do portfolio management. One might even describe it as a supervisory interpretation of Markowitz’s risk–return model, seeking the optimal combination of risk and reward for the financial system as a whole.

That logic, however common, is not really appropriate for supervision, except with some qualifications. The reason is that it is premised on the supervisors being able to identify the appropriate risks. That is true in most cases, but only for certain types of risk.

Measuring risk in what is effectively an infinitely complex financial system is hard, to the point of impossible. While it is easy to measure day-to-day risk, the risks that matter — the probability of bank failure, the likelihood of a financial crisis, the chance of a systemic breakdown — cannot be estimated with any reliability.

It is almost axiomatic that crises happen where supervisors are not looking, especially when they do their job well. These supervisors can only patrol a tiny part of the infinitely complex financial system, and while risk may be effectively controlled where they are looking, it simply emerges elsewhere. One can do worse than seeing risk as a balloon: squeeze it in one place, and it expands elsewhere.

That means the data necessary for this optimal risk-based supervision exist only for certain categories of risk, usually the most innocuous. Oftentimes, this is addressed by a statistical sleight of hand. Model the risk of day-to-day outcomes in the system and project them onto the risk of disasters. While very common, the accuracy of this rests on a whole host of assumptions that are violated in practice. See The risk you measure is probably not the risk you care about for more on this.

When we translate uncertainty about the likelihood of disasters into metrics displayed on a risk dashboard, it does not remove the uncertainty or give us clarity on it. It merely redirects attention.

The more those risk methodologies become embedded in rules and enforcement, the more institutions adapt to them, and the less meaningful they become — as predicted by Goodhart’s law.

The result is an Illusion of Control. As the regulatory framework shapes behaviour, it creates patterns of response that may look stable but, under stress, amplify instability.

Consequently, I think the common view of the supervisor’s task — finding the optimal level of risk in the system, where the obstacles are a lack of authority and funding — is flawed. It would be better to reorient supervision towards resiliency by borrowing another principle from finance: diversification.