Donald Joshua Jaganathan: Enterprise risk management harnessing disruption Opening remarks by Mr Donald Joshua Jaganathan, Assistant Governor of the Central Bank of Malaysia (Bank Negara Malaysia), at the Institute of Enterprise Risk Practitioners (IERP) Annual Conference 2017 “Enterprise Risk Management – Harnessing Disruption”, Kuala Lumpur, 23 May 2017 * * * It is my pleasure to have the honour of addressing you this morning. I would first like to take this opportunity to congratulate the organisers for successfully gathering an array of distinguished speakers to share their broad-ranging and invaluable experiences. The breadth of the programme over the next few days reflects how vast the area of Enterprise Risk Management (ERM) has evolved, and how much there is for risk managers today to discover, learn and master. In my speech this morning, please allow me to share my thoughts on risk management, amid the so-called “age of disruption”. Technology and risk management Amongst all ‘disruptions’ witnessed thus far, perhaps none have been as forceful and impactful as technological disruptions. Take the smartphone, its use has permeated almost every aspect of our daily lives and has become almost like another limb for some of us. I’m no longer woken up by an alarm clock, nor do I read the papers on “paper” or take photos on a camera. In the palm of my hand I hold a music player, internet browser, GPS navigator, torchlight, and compass, even a wallet in more and more places.
I will approach the question from the point of view of central banks and ask: what influenced their ability to raise market awareness with respect to building vulnerabilities within the financial system? And can we rely on the ESRB to repair this problem in the future? The information at the disposal of central banks and other bodies with financial stability competencies enabled them to point to growing risks and vulnerabilities, but it did not allow a deeper understanding of the interconnections in the financial system and of the potential magnitude of the detected risks. As a result, the discussion of the risks in their public communications or publications tended to be mostly of a qualitative nature, and generally did not involve a clear risk prioritisation exercise, and therefore had a potentially smaller impact on market behaviour. Another important element was that risk assessments were generally not made with the specific aim of suggesting appropriate remedial policy actions in terms of prudential policies or regulation. Recommendations, mostly formulated in broad terms, tended to target market participants’ behaviour (e.g. proposing mitigating actions), but they were more muted regarding policy measures that could be taken in the prudential and regulatory area. One reason for this is, again, the information base. The formulation of concrete policy recommendations (e.g. with respect to capital buffers or funding-related issues) would need to be backed by rigorous quantitative assessments, for which publicly available information is generally not sufficient.