Stress tests can help. OK, so those stress tests earlier this year that the country’s banks all passed with (more or less) flying colors probably didn’t give the concept of the stress test much added credibility. But they are a great way to compensate for VaR’s shortcomings and to trigger discussion of Armageddon-level scenarios that can highlight unexpected sources of risk or risk-management flaws. “Stress tests encourage people to consider what might happen if they are wrong,” says Iyer, who says both Citigroup and Bank of America (two banks with a lot of risks to manage these days) are now putting a greater emphasis on scenario analyses and less on computing VaR.

Risk management needs to be a real function, not a bureaucracy. During the 1990s, Cree points out, regulators recognized that the amount of capital financial institutions needed to maintain could be tied to the amount of risk they were taking with that capital. “It was a fundamentally good thing to do, because that helped take some of the subjectivity out of regulation” of specific institutions, he comments. But the move had unintended consequences. Until then, the job of a risk manager had been defined in broad terms—to keep the institution from blowing itself to kingdom come by taking too much of the wrong kind of risk at the wrong time. But as quantitative tools become more ubiquitous and more sophisticated, the nature of the job changed. “A risk manager came to feel that his job was to keep regulators happy,” Cree says. It became a bureaucracy, staffed with people who checked boxes, allotted risk budgets, and computed VaR levels. “That’s dangerous,” says Iyer, not just because it can cause a risk manager to lose sight of the bigger picture, but because senior managers can end up thinking of their team of risk professionals as an costly irritant. “Risk management needs to be proactive, not about reports and controls.”

Wall Street needs to take a more macro perspective of risk. This is starting to happen, says Iyer, pointing to the greater attention paid to trying to understand the wild-card scenarios (such as a rapid evaporation of market liquidity) as one example. What still needs to happen is for Wall Street institutions to begin thinking about risk as a strategic problem. “Everyone in a company knows that the tolerance for sexual harassment is zero,” says Iyer. But how many Wall Street firms set down firm and readily understood ‘risk appetite’ policies that go beyond quantitative measurements like VaR? Leo Tilman, a strategic adviser to financial-industry firms and author of Financial Darwinism, argues that it’s time to bring risk management into top-level decisionmaking. “When thinking about risk is properly integrated into our planning, then we know better what kinds of issues we need to monitor and manage.”

Please, better communication! If risk managers haven’t been getting much respect on Wall Street, then maybe they should look at how they are going about communicating their ideas to their bosses. A good risk manager can’t be a Cassandra, weeping and wailing about the death and destruction that is certain to come. Nor should they be so upbeat—‘here’s the most we can lose!’—that the CEO gets a false sense of security. “I try to remind them that they aren’t accountants; they can’t rely on people reading all the small print,” says Iyer. “They need to think of themselves as anthropologists,” translating the arcane world of risk into terms the company’s leaders can understand and frame the discussion in a way they can accept.

The ongoing debate about the future of risk management on Wall Street needs to revolve not around the nature of quantitative risk tools being used, but rather the intelligence of the discussion surrounding the way risk is being defined and evaluated. On that front, the jury is still out. On the one hand, Iyer reports that the number of wannabe risk managers is climbing at twice the rate it did a year ago (24,000 people took the exams to earn a professional qualification in the subject last weekend, up 70 percent from 2008), while, despite all the cutbacks on Wall Street, risk professionals are actually holding on to their jobs and winning more resources.

For his part, Tilman believes only a minority of the financial institutions are really trying to learn the lessons of the last two years. Most, he argues, are simply intent on returning as quickly as possible to business as usual. “There is very little change on some key issues,” he argues, pointing to a renewed emphasis on the part of investment analysts and CFOs on maximizing short-term earnings. Once markets are closer to normal levels, the low-hanging fruit has been picked, and returns start getting harder for firms to capture, that will produce “all kinds of patterns of risk taking and leverage that may have bad outcomes.” Regulators are facilitating that; rules requiring institutions to value their assets based on the market price (so-called "mark to market" rules) are being abandoned; that, combined with other measures, make it harder for investors to understand how much risk Wall Street is really taking. “It takes genuine leadership on part of the senior-most leaders of these firms to bring about a real change in thinking about risk issues, and that’s hard to do, Tilman says. “Most won’t get there.”