In the banks, risk is effectively a corporate governance function, not a business function. One reason for this is that risk is seen as an impediment to short-term profits (and hence bonuses). But it's also the case that people don't trust risk statistics. A lot of money goes into producing risk statistics, but people don't actually make decisions based on them... and when they do, their accuracy is so poor that they're hardly better predictors of financial gain than flinging a dart at a newspaper stuck to the wall.
Most risk measurement is based on normal distributions that simply don't exist in the stock market. A normal distribution can be assumed when you have a lot of small movement without a lot of outliers (meaning that severe market events would occur only once every few hundred years). In reality, we have severe market events every five years or so. Real distributions are not normal; they're skewed in various ways.
In addition, most measures of risk are measures of volatility around the mean. This assumes that upside volatility is as bad as downside volatility - hardly true! Plus, they assume that volatility and the correlations between assets are not affected by extreme market conditions, even though it has been shown that after extreme market shocks the volatility and correlations go haywire for a while.
But even if you use stable (non-normal) distributions, measure downside risk, and account for volatility clustering, there are basic limitations to fundamental analysis: how far can you go basing risk on historical market data? For example, you're not measuring the exposure of an asset to exchange rates: you're measuring the way the asset responded to exchange rate fluctuations in a particular historical period. You don't know why it fluctuated, so you can't predict it will follow the same pattern in the future. It's the fundamental problem of econometrics: correlation does not imply causation.
Even if the statistics were at all accurate, there are problems with how to use them. We need a more sophisticated vocabulary and set of statistics based on the purpose of the measurement, and we need a better understanding of how to apply the statistics to the real world. Regulators, corporations, risk managers and individual investors all have different needs for assessing risk and should in many cases use different statistics.
More to come in subsequent posts.
Risk Part 1: Issues
Risk Part 2: The Mess
Risk Part 3: Case Study - How Poor Risk Management Caused the Crisis
Risk Part 4: Regulatory Revision
Risk Part 5: Capitalism 2.0
Risk Part 6: Moral Hazard
Risk Part 7: Some Basic Accounting Problems