What Actually Happens When Risk Models Break Down
I spent years watching portfolios get slaughtered because risk managers trusted their models instead of understanding what the models were actually measuring. The Scott Hamner Paradox How A Wall Street Veteran Redefined Risk In Modern Finance isn't some academic curiosity. It's the gap between what VaR tells you and what your portfolio can actually lose in a single day when correlations go to 1.0 overnight. Hamner's background at Goldman Sachs and his subsequent work on structured products gave him a particular vantage point. He saw institutional investors using Gaussian copulas to price CDOs while the underlying collateral was essentially uncorrelated garbage. The paradox, roughly stated, is that the more sophisticated your risk model becomes, the more dangerous it is, because it creates a false sense of precision that masks tail risk. Simple models expose their assumptions. Complex models hide them.
The Scott Hamner Paradox How A Wall Street Veteran Redefined Risk In Modern Finance
At its core, the paradox challenges Value at Risk as the primary risk metric. VaR gives you a single number. "We could lose $12 million with 99% confidence over one day." That's useful for capital allocation. It's useless when you need to know what happens in that remaining 1%. I've seen traders who ran VaR-based limits blow up accounts in stressed markets because the correlation structure embedded in their historical data simply didn't exist during the actual stress event. In normal markets, corporate bond spreads and equity indices move somewhat independently. During March 2020, they both went down together. Your model predicted $8 million in potential losses. The actual drawdown was $47 million. The workaround isn't to abandon VaR entirely. It's to run multiple metrics simultaneously and treat any single number as insufficient. I use a combination of VaR, expected shortfall, stress scenario analysis, and historical worst-case drawdown tracking. When these four numbers disagree significantly, that disagreement itself is a risk signal worth investigating.
How to Actually Implement Better Risk Practices
Most firms have a risk team and a trading team that speak different languages. The risk team produces reports. The trading team ignores reports. This has been my observation across roughly ten different organizations over fifteen years. The fix is structural, not methodological. Start by making risk metrics part of the PnL discussion, not a separate compliance exercise. When the morning meeting reviews yesterday's trades, the risk team should be explaining what happened to their VaR numbers in plain language. "Our VaR dropped from $12 million to $9 million because we reduced our EM bond exposure" is useful. "Risk is within parameters" is not. I've found that implementing proper backtesting protocols is where most firms fall short. The Basel framework requires backtesting, but most banks treat it as a checkbox. Run your own backtests using a rolling window of at least two years. Compare your VaR predictions against actual daily PnL. If your model predicted a $12 million loss at the 99% level and you had three or more days where the actual loss exceeded that over a two-year period, your model is broken regardless of what the regulators say.
Get the Full Details
One specific edge case I dealt with involved commodity trading desks. Their VaR models were built on daily price data. Commodity prices can gap significantly overnight due to geopolitical events or storage disruptions. The daily VaR framework simply cannot capture this. I recommended switching to a scenario-based approach for those positions, with explicit stress tests for storage constraints, weather events, and OPEC decisions. This cut our reported VaR by about 40% on those positions but gave us far more useful information about what we were actually exposed to.
Common Pitfalls That Beginners Miss
Here is something people who aren't actually doing this work tend to overlook. Model selection bias is real and it destroys portfolios. When you have access to multiple risk models, there is a strong incentive to choose the one that produces the most favorable capital requirements. This is especially problematic with options portfolios, where different volatility surface models can produce dramatically different Greeks and therefore different risk numbers for the same position. Another issue is the treatment of liquidity. Standard VaR assumes you can exit positions at the mid-market price at any time. In reality, wide spreads and thin order books exist, particularly in emerging market debt, niche credit tranches, and less-traded equities. I once worked with a fund that reported a VaR of $3 million on a concentrated position in small-cap stocks. When they tried to reduce exposure during a market drawdown, the bid-ask spread widened to 8% and they were forced to sell at prices that made their risk models look absurd. The VaR calculation assumed liquidity that didn't exist. Correlation stability is another area where models consistently understate risk. Financial correlations tend to converge toward one during downturns. This is documented extensively in the literature and has been my practical experience as well. Your risk model probably estimates correlations based on the last two years of data. Two years of data is not enough to estimate stable correlations in any meaningful sense, particularly during regimes where those correlations are shifting.
When These Methods Completely Fail
I want to be blunt about the limitations. Risk modeling cannot predict black swan events by definition. If an event is truly unprecedented, no historical model will capture it. The 2008 financial crisis, the March 2020 selloff, and the Swiss franc depeg in 2015 were all events where risk models failed because the assumptions embedded in those models were wrong, not because the mathematics were incorrect. If you are relying solely on quantitative risk metrics, you are going to be caught off guard. The alternative that works better for me is a combination of quantitative analysis with qualitative scenario planning. Dedicate at least 20% of your risk review process to asking "what if something fundamentally changes?" rather than "what does history tell us?" Another honest limitation is data quality. Garbage in, garbage out. I've seen risk systems fed with stale price data, incorrect corporate action adjustments, and mismatched timestamps between different data providers. The model outputs look professional but are essentially meaningless. Invest in data validation before you invest in model sophistication. This usually takes less time and produces better results than building more complex risk formulas.
The practical takeaway is straightforward. Use VaR as one input among many. Question every assumption your models make. Track your model performance continuously. And never, ever let a single risk number become the final word on whether a position is acceptable or not. The markets don't care about your confidence intervals.
