Enterprise Risk Management: From Incentives to Controls, 2nd Edition

CHAPTER 10

Data and Technology

As discussed in earlier chapters, organizations of all types—both financial and non-financial—have, in recent years, become much more appreciative of the importance of risk in all its various incarnations. Quite apart from the arguments for risk management as a good thing in its own right, it is becoming increasingly rare to find an organization of any size whose stakeholders are not demanding that its management exhibit risk awareness.

Faced with this pressure, but also with a discipline whose successes are frequently intangible and non-intuitive—for example, reduced probability of a significant loss—management often turns to one of the few aspects of risk management that is easily measured in dollars and cents: investment in risk management technology. Chairmen hailing the benefits of such investments have for some years been a staple feature of financial institutions' annual reports; the trend is now repeating in the non-financial sectors.

This heavy investment is at least partially justified. We noted in Chapter 2 that it is critical to balance the yin and yang—soft and hard issues—if risk management is to be truly effective, and the hard side of risk management is inextricably intertwined with technology: for carrying out the analytics described in the last chapter, for gathering the data required as inputs to the analytics, and for reporting the data produced as their outputs.

But it is also easy for investment in technology to become an end ...