By Adam Ennamli, Chief Risk Officer at General Bank of Canada, former VP O&T at Thomson Reuters. Global Board advisor on strategy and risk.
Risk models at Credit Suisse had flagged the dangers before their $5.5 billion Archegos loss. Silicon Valley Bank’s risk metrics showed clear warnings before their collapse. In both cases, sophisticated risk systems functioned as designed. Yet both institutions failed. The reason? Human behavior overwhelmed risk controls.
The Paradox Of Modern Risk Management
While risk models become more powerful and more sophisticated, we risk professionals are faced with a paradox: We often place too much faith in these systems. This excessive trust makes our organizations more vulnerable to basic human biases.
FTX is a perfect example. Despite having advanced trading systems and risk controls, the company collapsed because its leaders allegedly ignored fundamental risk management principles and let overconfidence drive their decisions.
This creates a critical challenge for risk management: How do we bridge the gap between technical excellence and human psychology?
Three Fatal Patterns: Why Smart Institutions Fail
Three psychological patterns repeatedly emerge in major risk management failures:
1. Success Bias: Silicon Valley Bank’s leadership, propelled by years of growth, discounted warnings about their concentrated deposit base. Past success became their greatest vulnerability.
2. Relationship Override: Risk warnings about Archegos were available to institutions across Wall Street. Some acted on these warnings, while others let business relationships influence their risk decisions. The difference in outcomes was stark.
3. Group Think In Crisis: During Evergrande’s crisis, despite clear risk indicators, many investors maintained their positions, collectively believing China’s property sector was “too big to fail.” This group thinking amplified individual behavioral biases.
Building Behavioral Circuit Breakers And Practical Implementation Challenges
Supported by regulatory guidance, financial institutions are implementing measures to counter these psychological blind spots. These include dedicated teams to challenge prevailing views, monitoring of behavioral indicators that often predict problems before quantitative metrics show issues and recognition systems for early risk identification.
The process typically involves monitoring soft signals—such as unusual justifications for exceeding limits, changes in communication patterns or resistance to oversight. These behavioral indicators often surface before traditional metrics show technical problems.
The path to behavioral risk management varies significantly across institutions. Large Wall Street banks can invest in dedicated behavioral risk teams and sophisticated monitoring systems. However, smaller institutions need more cost-effective approaches. A mid-sized regional bank might start by simply introducing a “devil’s advocate” role in risk committee meetings or implementing basic communication monitoring without expensive technology.
Cultural and regional differences also shape how behavioral risks manifest. For example, during 2022’s market volatility, European banks generally showed different behavioral patterns than their U.S. counterparts, translating into different outcomes during the 2023 banking stress events.
Despite significant implementation challenges, emerging technologies present optimistic solutions.
The Next Frontier: AI And Human Behavior
As artificial intelligence (AI) reshapes risk management, the human factor becomes even more critical. AI can process vast amounts of data and identify patterns, but can’t yet fully account for human psychology. The danger isn’t in models being wrong, but in humans misinterpreting or overriding their outputs—or simply letting go.
Before making major risk decisions, leaders should ask:
• Are we avoiding difficult conversations about this risk—or, simply put, taking the easy way?
• What emotional biases might be affecting our judgment—are things so good that we are afraid of hearing something we don’t want to?
• Have we actively sought and seriously considered contrarian views—or would it make things too uncomfortable?
• Are relationship concerns inappropriately influencing our risk assessment—meaning, are we afraid to upset someone?
Needless to say, implementing behavioral risk controls requires significant investment—both financial and cultural. A basic behavioral monitoring system typically costs between 1%–3% of an institution’s risk management budget. However, the real investment comes in changing organizational culture and decision-making processes.
Successful institutions approach this as a gradual transformation:
1. Start with low-cost, high-impact changes (like restructuring risk committees).
2. Implement basic monitoring of communication patterns and decision justifications.
3. Gradually build more sophisticated systems based on lessons learned.
4. Invest in training and culture change programs.
Building True Risk Intelligence
The next generation of risk leaders must move beyond the false comfort of pure quantitative analysis. Organizations will eventually embrace that every risk decision passes through human filters and build systems accordingly to oversee all aspects, not just the binary ones.
This means creating:
1. Decision protocols that actively counter common biases.
2. Feedback loops that capture behavioral patterns.
3. Warning systems for psychological risk factors.
4. Cultures where challenging assumptions is rewarded.
The Future Of Risk Management
In today’s environment, the companies that succeed aren’t just the ones with the best mathematical models and computers. The real winners are those who understand how people actually behave and make decisions accordingly. When companies combine good technical tools with a deep understanding of human behavior, they make better choices than their competitors.
After all, in risk management, understanding what makes people act is just as crucial as understanding what makes markets move, and we must accept that it’s not always the same thing. The institutions that thrive in the next decade will be those that master not just the science of risk management, but its human art.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
