In early March, the Blue Cross & Blue Shield Assn. held an ERM Summit in San Diego. This column is based on a presentation at that conference.

Any discussion about risk in 2009 can appropriately begin by reminding ourselves of Chinese curses. One example is, "May you live in interesting times." In China, this refers to events such as famine, plague, pestilence and war. Today we can add Bernie Madoff, American International Group Inc., Lehman Bros. and Bear Stearns. A second Chinese curse is, "May you come to the attention of the authorities." This could refer to the Department of Justice, attorneys general and chief prosecutors. A third Chinese curse is, "May you find what you are looking for." Homes we cannot afford. Loans we cannot repay. Destruction of our lifetime savings.

The curses remind us of the most popular approach to enterprise risk management following guidelines from the Committee of Sponsoring Organizations of the Treadway Commission. The goals are OK. ERM should be effected by the board and senior management and applied across the enterprise consistent with a specified risk appetite. As of mid-2008, the COSO approach to ERM was widely discussed, slowly implemented and most advanced in financial institutions.

Huh? Most advanced in financial institutions? Countrywide. Merrill Lynch. Bear Stearns. Citibank. Lehman Bros. Fannie Mae. Freddie Mac. What went wrong?

My suggestion is that the failure of ERM lies in our need to think we have reduced uncertainty when we are dealing with risk. We may not be able to reduce it in the real world, but we certainly can reduce it in our own minds. One of the most common techniques is to make a forecast using three scenarios: (1) likely, (2) best case and (3) worst case. Let us test the proposition using value at risk, a widely used measure of exposure and opportunity.

Suppose a company wants to minimize its exposure to fluctuations in the real, Brazil's currency. It borrowed 30 million reais at a time when it had 40 million reais as receivables. As it normally collects 90% of the receivables (36 million reais), its gross exposure is 6 million reais (36 vs. 30). If it is confident that the exchange rate between the real and the dollar will not fluctuate more than 20% in the next period, the worst-case for value at risk is 20% of 6 million, or 1.2 million reais.

Or is it? Suppose economic or political conditions cause a liquidity crisis so customers default on their obligations. The company would not collect its receivables yet it still would owe its full debt. Reverse the collection number. If 90% of customers default, the company collects only 4 million reais. The calculation quickly changes to 30 million minus 4 million, or 26 million of gross exposure. Now assume the fluctuation in currencies is 60% instead of 20%. The value at risk becomes 60% times 26 million, or 15.6 million reais. What is the worst case now?

An ERM program can fail if it relies too heavily on quantitative techniques. We are trained to look at data and estimate likely outcomes in normal times. We understand probability and the normal probability distribution curve where 95% of the possibilities are approximately within two standard deviations from a likely outcome. The statistical analysis can create an unwarranted confidence that causes us to stop watching for changes that might move us into the 2.5% extremes.

Malcolm Gladwell, in "Blink: The Power of Thinking Without Thinking," is highly critical of analytical tools even within the 95% confidence intervals. He claims a person's "gut" is often a better decisionmaker than lengthy risk analysis. It is pretty easy to show our tendency to be overconfident when we are using numbers. Earlier this year, a group of MBA candidates in an ERM course at St. Peter's College were given the following data for a public company.

In the pursuit of value at risk, they were asked to estimate the likely, high and low ending stock price for 2007 and 2008. Answers varied from $40 to $80. Even though the financial crisis was in full bloom, most individuals were confident that the estimates were solid. The company was AIG whose year-end stock price was $47 in 2007 and $1.30 in 2008.

We can even show a tendency toward undue confidence when no statistical data supports numbers. Once somebody makes an estimate, confidence tends to rise. In a different MBA class, five teams of students were given five minutes to complete a task. They were told that homeowner insurance policies covered property damage and personal injury from animals. Then, they were asked to estimate the number of animals in U.S. homes in the categories of cats, dogs, reptiles, primates and big cats. Five individuals, one from each team, moved to the front of the classroom where they were asked to reveal the team estimate of cats. All answers were in millions, specifically 200, 14, 12, 8, and 2. Then each individual was asked, "How confident was your team that you were close to the right answer?" Despite the wide range and obvious situation that most estimates had to be wrong, four teams were highly confident. One team stated that it had no clue. The actual number of cats was 65 million.

It is human nature to believe that we can make reasonable estimates, even in the absence of evidence. After the students were told the actual number of cats, they resisted revealing the team estimates for dogs. They reassessed the estimate in light of new evidence and all five individuals gave answers between 55 and 80 million. The actual number was 78 million.

Let us bring this to a focus. We live in an uncertain world. In the area of 2.5% at each tail of the distribution, we often find the greatest opportunities and the most dangerous exposures (see Figure 1). We need to be looking for a future Google or Apple at one end of the distribution and an AIG and Citibank at the other. Organizations need a central risk function that has no responsibility other than providing an early warning for risks and opportunities that might otherwise be missed by key executives. Then, it shares its findings by opening channels for collaboration to pursue opportunities and mitigate exposures.

What are the 5% risks and risk opportunities in your organization? Do you have a central risk function that is sensitive to the 5% changes in technology, the financial system, pandemics, fossil fuel shortages, pollution, environmental change and earthquakes in California? If not, why not? If not now, when?

These questions are the cutting edge of enterprise risk management in 2009.

John J. Hampton is the KPMG Professor of Business and Dean of the School of Professional and Continuing Studies and Graduate Business Programs at St. Peter's College in New Jersey.