What to Do After Risk Aggregation

After risk aggregation, the step before committing resources is to check whether shared dependencies or common drivers could make several exposures worsen together and invalidate the consolidated result. The consolidated report arrives in the approval pack with one total and several business-unit breakdowns. Before anyone uses it to release funds or approve a program, trace the exposures that depend on the same supplier, market or source of cash.

That check belongs in the approval paper. It should identify which apparent offsets are supported by evidence and which depend on conditions that could fail together.

Risk aggregation combines individual exposures into an overall view, accounting for relationships between them and identifying concentrations across an organisation.

UBS’s mortgage exposure disappeared from the net figures

UBS entered 2007 with established portfolio measures and approval processes. Its group strategy used earnings-at-risk to assess aggregate exposure across businesses and risk types. Value-at-risk, or VaR, and stress-loss limits governed market exposure. The bank's April 2008 shareholder report describes those controls alongside USD 18.7 billion in net losses from US residential mortgage exposures for 2007.

The CDO desk retained highly rated securities from mortgage-backed structures. A collateralised debt obligation bundles debt exposures into securities with different claims on the proceeds. The highest-rated portions appeared to offer income above the bank's funding cost. Their AAA ratings fed into VaR calculations using historical series that showed little volatility. Even unhedged holdings therefore used little of the measured limit.

The shareholder report also records gaps in the limits. There was no umbrella operational limit covering the investment bank's overall subprime exposure. Risk control generally did not examine the underlying collateral of retained CDO positions in detail. The data lacked important characteristics of the mortgages. A position could occupy little of the reported risk limit while adding substantial exposure to the same mortgage market.

The Swiss Federal Banking Commission's investigation found that senior management lacked a concise overview of total subprime positions. Reports showed net exposures. Positions treated as hedged could disappear from the overall figures, including some whose protection covered only the first 2–4% of losses.

Netting has a legitimate purpose: it accounts for protection against an exposure. Here, the presentation made limited protection look sufficient to remove the position from view. The question for someone reading such a report is concrete. What loss does the protection cover, and what remains once that protection is exhausted? The gross exposure still matters when the assumed offset covers only part of the loss.

The regulator also found that the scale of holdings created exposure to a common US housing and consumer-market driver. Different instruments and business lines had not removed that dependence. Stress scenarios were too optimistic, and assumptions about selling positions quickly proved unrealistic. Management understood the extent and nature of its exposure only in August 2007.

This was a failure of coverage and interpretation as well as calculation. The investigation identified several contributing failures; aggregation alone does not explain the losses. The relevant lesson after risk analysis is narrower: examine the conditions that make the consolidated result look acceptable before authorising more exposure. A report can contain genuine calculations and still omit the connection that would change the decision.

Before acting on an aggregate, check what has been left out or cancelled against an assumed protection. That question applies to operational programs and supplier portfolios as directly as it does to financial holdings.

Pick the exposure your next funding decision depends on and check what happens when its reported offset fails. Start the Walk →

What can the consolidated result justify?

Aggregation makes exposures across an organisation visible to the people who allocate resources. A board can examine concentrations that no individual project owner controls. Finance can compare possible demands on available cash. Operations can identify several activities relying on one facility. These are useful inputs to a wider risk assessment, especially when separate teams describe the same dependency differently.

In cybersecurity, NIST's guidance on enterprise risk reporting explains how information from individual registers supports an enterprise risk profile and enterprise objectives. The value comes from connecting local information to the organisation's purpose. A consolidated profile can help decide where a response needs funding and where a local manager lacks authority to address a shared exposure.

For banks, the Basel principles for risk data aggregation require accurate, complete and timely information, including material exposures across the group. Those are banking standards, but the practical questions travel: is anything material missing, are the inputs comparable, and is the information current enough for this commitment? Aggregation earns its place when it reveals a concentration that separate reports would conceal.

The next step might be allocating a contingency budget, changing project priorities or setting exposure limits. Each uses the aggregate differently. A total expected loss can inform budgeting; it cannot, by itself, show how much cash would be needed if losses arrived together. A ranking can guide attention while leaving the organisation unable to absorb simultaneous disruption.

This illustrative dependency belongs in the supporting schedule. It must be checked during risk identification and preserved when reports are combined. Different owners and report categories do not establish that exposures are independent.

Where the inputs are ratings, avoid presenting added scores as a measured enterprise loss. A risk matrix expresses judgements in categories; moving them into one spreadsheet does not supply missing probabilities or dependency evidence. The decision paper should state what the aggregate measures and what it cannot establish.

Test the shared drivers before approving the commitment

Attach a dependency-and-offset schedule to the consolidated report before the funding or program approval. Start with the exposures that could change the proposed commitment. For each, name the underlying driver and the other entries that rely on it. Record the evidence for treating any pair as independent. Do not let different departmental names stand in for that evidence.

Then examine every material offset. A backup supplier, insurance policy or financial hedge may reduce an exposure, but only under particular conditions. Check what it covers and the limits on that coverage. Confirm whether the organisation could still use it when the same disruption affects other activities. This turns vague assumptions into claims that someone can verify.

Ask the affected owners to work through one credible common-driver scenario together. An illustrative supplier outage should include every dependent program, rather than separate scenarios that each assume access to the whole recovery team. Compare the combined demand with available capacity. Test the aggregate against the shared constraint before deciding that the organisation can absorb the exposure.

These illustrative readings require different checks. Put the unresolved ones beside the recommendation in the decision record, with an owner and the evidence needed before approval. If the common driver could overturn the recommendation, reduce the commitment or resolve that uncertainty first. A reversible pilot may justify less evidence than a long contract or a capital investment.

Record how the recommendation changes if a claimed offset fails. If approval depends on recovery capacity, require confirmation from the person who allocates it. If it depends on contractual protection, check the operative terms rather than the label in the summary.

The Universal Decision-Making Method connects that work to the decision's purpose and the certainty needed to proceed. The completed schedule should show whether the proposed commitment survives the shared-driver scenario and which protections have been checked. Approve resources only after the assumptions making the consolidated exposure acceptable have been tested to the level the commitment requires.

Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.