In Congress, corporate treasuries and regulatory agencies, smartpeople are trying to resolve the paradox of risk management. Theeconomic crisis certainly exposed excessive risk taking and theneed for better risk management, yet it was ostensibly moresophisticated risk management strategies and tools that increasedrisk and brought on the crisis.

In theory, sophisticated models reveal and can reduce risk. Inpractice, we now know that such models engendered false confidencethat risk was being micromeasured and micromanaged, making it safeto take on more risk, explains Dan Borge, a director in the NewYork office of consultancy LECG and formerly the main designer ofthe first bank enterprise risk management system.

Borge built the computerized risk-adjusted return on capital(RAROC) model while working at Bankers Trust in the 1980s. Inhindsight, he says bank risk models had two flaws. Some of thebanks' products became more complex than the models were able tomeasure. More significantly, the models relied on historical riskdata, and what happened in 2008 fell well outside historicalnorms.