On seeing several criminals led to the scaffold in the 16th century, English Protestant martyr John Bradford remarked, “There but for the grace of God, goes John Bradford.” His words, without his name, are still very common utterances today, used for expressing one’s blessings compared to the fate of others. This was especially poignant for Bradford himself, because he ultimately was burned at the stake as a heretic.* The recent sub-prime crisis offers corporate risk managers inexpensive, yet critical, lessons on what to avoid so that when history decides to repeat itself in other industries, risk managers will be better able to contain or prevent the damage we’re already witnessing and are about to witness.

The current sub-prime mortgage fiasco will ultimately engender losses between $600 billion and $1 trillion to banks and other financial institutions. By entertaining unrealistic risk-reward assumptions, unduly relying on models instead of common sense, and failing to address—or at least acknowledge—the existence of conflicts of interest, a number of financial institutions now face a costly butcher’s bill. While many companies and firms are thankful—as John Bradford was—that they are uninvolved in this particular crisis, they shouldn’t overlook the fact that examining what happened, and focusing on lessons to be learned, can help all financial institutions avoid the fate of those who are wallowing in this current mess.

The root cause of the sub-prime fiasco was the irrational belief that it’s possible to generate above-average returns with little risk indefinitely. In the '90's, banks formed special purpose investment vehicles called “conduits,” and investment bankers started fixed income hedge funds, on the mistaken belief that investment-rated structured debt was consistently mispriced in the marketplace. This belief was predicated on the assumption that traditional fixed income investors, such as insurance companies, didn’t understand new debt obligations backed by credit cards, home-equity loans, and bank debt.

In order to exploit this mispricing, investors established conduits or hedge funds, borrowed money on margin or in the commercial paper market, and used their equity investment and borrowed funds to purchase the mispriced debt. Initially, the strategy seemed to work, and investors were rewarded with consistent double-digit returns. Soon, however, virtually all banks formed conduits and wealthy investors looked for fixed income hedge funds offering this strategy. It’s a fundamental rule of nature that no financial instrument can remain mispriced in the face of that much demand. The arbitrage opportunity disappeared. These opportunities don’t typically disappear gradually. They disappear when formerly cheap instruments, like sub-prime debt, are discovered to be too rich—that is, yielding too little return for the risk. Investors finally realized that this summer.

Many investors allowed mathematics and computers to triumph over common sense. It is, of course, true that when dealing with large volumes of consumer mortgages or credit card bills, computers are essential to handle the accounting and operational aspects of ensuring that consumer payments actually reach investors. Computers also play an important role in establishing the terms of debt instruments through credit rating agencies.

Credit rating agencies are essential to issuers of structured debt instruments. These issuers have no credit history or assets, so investors depend upon cash flows from mortgages or credit cards. The rating agencies provide investors with the comfort that they will, in fact, be paid. Credit rating agencies developed sophisticated mathematical models that analyzed whether the probability of expected losses for a given debt security would be less than certain rating agency thresholds. As long as these thresholds were met, the resultant security was rated investment grade. Rating agencies’ opinions were critical for both investors and issuers in the structured credit market.

Securities based upon sub-prime mortgages presented rating agencies with an unforeseen problem. The sophisticated rating agencies’ models relied on the fact that the mortgages or assets that underlie the structured debt are not unduly linked or correlated with each other. This means, in essence, that should one mortgage default or fail to pay, others won’t necessarily default as well. Unfortunately, from 2005 to 2007, over $600 billion of structured credit securities were issued, backed 100% by sub-prime mortgages. Most of these securities were rated investment grade. Given the high concentration of sub-prime mortgages that are in these securities, the rating agencies’ models were useless in assessing the credit-worthiness of the securities. It was a classic case of “garbage-in, garbage-out.” Using a model that’s inappropriate yields unreliable answers. This simple fact is the cause of the extraordinary dyspepsia rating agencies are feeling these days.

Conflicts of interest abounded in the creation and sale of sub-prime mortgage-related securities. Rating agencies provide essential information to investors, but they’re paid by issuers. As already noted, issuers’ profits depend upon the very rating agency they pay. In addition, many financial institutions originated sub-prime mortgages, used those mortgages to create structured credit investments, sold those structured credit investments to conduits or hedge funds that they sponsored, and then provided financing to the conduits or hedge funds that enabled them to purchase structured credit investments that were never owned or priced by any independent entity.

A final concern that will become more illuminated when pending regulatory inquiries are completed, is the existence of troublesome valuation policies. The instruments that were purchased and sold were synthetic securities for which there was no ordinary and organized market. That meant that valuation policies had to be particularly circumspect, something that did not occur. Indeed, some firms had multiple values of the same instruments for different purposes. While that isn’t necessarily improper, it does require great care and meticulous recordkeeping to ensure that the rationale for different valuations is noted and preserved.

Although these problems seem evident in the clear hindsight of history, there are, nonetheless, important lessons to be learned to avoid similar problems in the future. As Mark Twain explained, “History doesn’t necessarily repeat itself, but it does rhyme.” Most companies and executives don’t want to hear the next stanza in such a rhyme. In order to avoid that situation, there are several simple approaches that institutions can take to strengthen their risk-management systems.

It’s critical to have a separate board level committee that examines risk. Risk Committees should be charged with assessing and managing all the risks each company/institution faces: financial, operational, and reputational. Audit Committees are too busy to address this vital issue, but one member of a firm’s Audit Committee should also serve on the Risk Committee, along with a management member.

There’s no such thing as a free lunch. If someone describes something as too good to be true, it probably is. Risk and reward are inextricably linked. If you perceive a competitive advantage, the next logical question that should be asked is how long you can maintain it. If you can’t address that question, you probably shouldn’t proceed.

Follow the “Sally Pitt” rule religiously. As regular readers know, Sally is my teen-age daughter and possesses incredible skill at finding ambiguity where none is intended. As a result, any strategy you pursue, or decision you make, should be clear enough to prevent anyone, including clever teenagers, from creating ambiguities. It surely took a lot of technical babble or lipstick to make purchasing sub-prime mortgages and levering them 25-to-1 an attractive investment proposition!

If everyone’s copying you, it’s probably time to do something else. High-return, low-risk strategies only exist if you have proprietary skills or knowledge. If everyone else is capable of doing the same thing, you probably have neither. Eventually, everyone will come to the same realization at the same time and rush for the exits. Companies need to examine their competitive edges and the actions that must be taken in order to preserve them.

Avoid flying on autopilot. Every enterprise relies on models to inform its decisions. Models allow tests of sensitivities, examination of options, and optimization of processes. But, it’s crucial to understand the assumptions on which models are based and the limitations that flow from those assumptions. Original assumptions don’t necessarily retain their validity over time. Assumptions that aren’t reviewed periodically—the trap into which the rating agencies, in rating structured sub-prime securities, fell—invalidates the utility of the models on which they are based. Similarly, if SOX 404 compliance is based on a risk-based model, the model’s assumptions of what the risks are must be accurate. Having to declare “I can’t believe I overlooked that,” is never a terribly helpful observation to have to make.

Think first, model later. Many people model first and think later. But, the opposite approach is clearly preferable. It’s essential to first think through a problem, develop a crude but simple model that includes most of the issues, and then see if there’s a model available that refines the analysis. Everyone’s problems are different, so following this approach can avoid expensive purchases of useless software.

Expect the unexpected. “Once-in-a-lifetime” events, like the current sub-prime debacle, the fall of Long Term Capital, and the 1987 market crash, seem to occur with alarming frequency. In undertaking any risk analysis, it’s important to ask what the worst thing is that could occur, and then make sure preparations have been made to deal with that possibility. The thought of a total shutdown in the commercial paper market would have caused many conduit and hedge fund investors to pause.

Unexpected success is just as disconcerting as unexpected failure. If something is going unbelievably well, it’s important to ensure that the reasons are understood and plausible. Drexel Burnham’s junk bond desk was on the West Coast, while its compliance and similar functions were on the East Coast. That meant that those on the East Coast didn’t know first hand why Michael Milken was making so much money.

When it comes to valuing unique instruments, take pains to ensure that values are subject to independent scrutiny and review. Particularly for financial institutions, the ability to value unique or different instruments carries with it a degree of subjectivity. Avoid after-the-fact recriminations by creating an independent valuation process that includes persons with no financial incentives riding on the values assigned.

To thine own self, and to those you serve, be true. Conflicts of interest are unavoidable, but they must be carefully managed. Advisors that are paid by entities that profit from their advice are more likely to have problems. Rating agency ratings give investors comfort, but the rating agencies are paid not by the investors, but by the issuers. Risk committees should identify potential conflicts of interest and address them before they arise.

Good reputations are hard to develop but easy to lose. When the losses from the sub-prime mess are finally tallied, there will be many people and institutions who would eagerly give back all the money they made in order to reclaim their reputations. One important risk that needs to be addressed constantly is the risk to an enterprise’s reputation for ethical behavior. This needs to be reinforced on a regular basis, so that short-term needs don’t overwhelm long-term goals of ethical companies.

There’s no substitute for a sense of humor and optimism. A good risk management program is necessary, but not sufficient. A sense of humor and perseverance will enable companies and boards to weather unexpected potholes in the road.

When misfortune strikes, it’s entirely understandable for any of us to revert to John Bradford’s sage observation that “there but for the grace of God, go I.” But, it’s also appropriate to learn the lessons of those who wind up where most of us would rather not follow. Otherwise, comfort taken from not being included in the original group of tortured individuals may be very short-lived indeed.

*Robert Hendrickson, Encyclopedia of Word and Phrase Origins, Facts on File, New York, 1997.