All of a sudden, now that the economies of many countries, not to mention the banking industry, is in tatters, we have dozens of articles and blogs all bemoaning the state of risk management and what we need to do to get everything right again.

All of them are pounding away on the same drum; all are documenting how badly everyone has done in managing risk and all are extolling Boards, Senior Management, Regulators and Rating Agencies to do better next time.

Where were all these authors and bloggers in the good times? Where were they in the days prior to the summer of 2007 when the banks and the rest of the financial industry was gaily acting if the only way forward was up; when the "old" economy had been declared dead and the mantra of the "new economy" was "profits", "bonuses", "innovation" and the like. Like the "old economy", "risk" in all its forms had, by the invocation of all the new hedging and derivative strategies been declared dead too.  

True there were some (all too few) who sounded dire warnings of where this was going to all end - but who wants a Jonah when there is a never-ending beach party on the go?

So, pardon me, but as a risk management practitioner and trainer I really feel aggrieved with all the soul searching and hand wringing going on at the moment. Tell me please where all these new converts have come from? Where were they when they were really needed?

Now that the party is finally over it is time to do things properly. Risk management in the first decade of the 21st century failed miserably. The tone at the top was rotten, whether in the banks or the regulatory agencies or the risk raters themselves. And this rot permeated all the way down to the bottom of the pile.

What were the failures?

The failure to measure risk - risk models were misused, misspecified and most of all misunderstood.

The failure in training - bank boards and regulators were not adequately instructed in what "risk" really meant.   Bank staff was only trained in the three P's - Product, Performance and Profit. Issues like risk concentration, scenario planning, operational failures were only concepts that made one sound intelligent.   

The failure to mitigate risk - without understanding risk it cannot truly be measured and without measurement it cannot be mitigated. These factors are interconnected. The one leads to the other.  

We all know where the blame lies. What is needed now is some courageous risk managers who need to roll up their sleeves and get the job done - properly this time.