Banks take risks. They lend money that might not be repaid. They trade securities that might fall in value. They rely on computer systems that might fail. Risk management is the discipline of identifying those risks, measuring them, and mitigating them. It is not about eliminating risk. It is about understanding it and ensuring the bank can survive it.

Banks face several types of risk. Credit risk is the risk that borrowers default. Market risk is the risk that prices move against the bank's positions. Liquidity risk is the risk that the bank cannot meet its obligations. Operational risk is the risk of fraud, cyberattacks, or process failures. Compliance risk is the risk of violating laws and regulations. Reputational risk is the risk of damage to the bank's image. Each requires different tools.

The tools include diversification, collateral, hedging, insurance, and capital. A bank diversifies its loan portfolio across industries and geographies. It takes collateral to recover losses. It uses derivatives to hedge interest rate and currency risk. It holds capital to absorb unexpected losses. It buys insurance for operational risks like fraud. It runs stress tests to see how it would fare in a severe recession.

Risk management is not a profit center. It is a cost center. But banks that neglect it do not survive. The 2008 crisis was, at its core, a failure of risk management. Banks underestimated the risk of mortgage-backed securities and overestimated their ability to sell them. The result was the worst financial crisis since the Great Depression.