Convergence Point

gray haired man signing the papers
,

POST 11: Risk Management Processes: From Theory to Corporate Governance

Effective risk management in energy trading combines metrics, people, processes, and culture to minimize losses and maximize profits.

Amalie Berg
9–14 minutes

Introduction: From Metrics to Management

Calculating VaR is the easy part. The hard part is building an organizational system that prevents catastrophic losses while enabling profitable trading.

Risk management isn’t just spreadsheets and models—it’s people, processes, governance, and culture. It’s the 50-100 page Risk Manual that nobody reads but everyone depends on. It’s the daily 7:15 AM meeting where traders justify their positions. It’s the Risk Committee that can override the CEO.

Let’s explore how professional energy trading firms implement risk management that actually works.

The 8-Phase Implementation Roadmap

Building enterprise risk management from scratch follows a structured path:

Phase 1: Risk Identification (Months 1-2)

Objective: Catalog all material risks the company faces

Activities:

  1. Workshop with stakeholders:
    • Traders: “What keeps you up at night?”
    • Finance: “What could bankrupt us?”
    • Operations: “What could fail?”
  2. Risk taxonomy creation:
    • Price risk (by product, tenor, geography)
    • Credit risk (by counterparty type)
    • Volume risk (generation, demand)
    • Operational risks
    • Legal/regulatory risks
  3. Materiality assessment:
    • Potential impact (€)
    • Probability (%)
    • Priority ranking

Deliverable: Risk Register (50+ identified risks, prioritized)

Example Entry:

Risk ID: PR-001
Description: Price spike in Q1 when portfolio is short
Potential Impact: €20M loss
Probability: 15% (winter scarcity)
Mitigation: Position limits, weather hedging
Owner: Head of Trading

Phase 2: Risk Measurement Framework (Months 2-4)

Objective: Define metrics and calculation methodologies

Key Decisions:

1. VaR Parameters:

  • Confidence level: 95% or 99%?
  • Time horizon: 1-day or 10-day?
  • Methodology: Historical simulation, parametric, Monte Carlo?
  • Lookback period: 250 days, 500 days, 1,000 days?

2. Stress Scenarios:

  • Historical stresses (2008 crisis, 2022 gas shock)
  • Hypothetical stresses (nuclear fleet shutdown, heatwave)
  • Reverse stresses (what breaks us?)

3. Credit Metrics:

  • Potential Future Exposure (PFE)
  • Current Exposure
  • Credit VaR

4. Operational Metrics:

  • System uptime (99.9% target)
  • Trade error rate (< 0.1% target)
  • Failed trades (< 1% target)

Deliverable: Risk Measurement Policy (30-page document)

Phase 3: Risk Limits Setting (Months 3-5)

Objective: Translate risk appetite into actionable limits

Process:

1. Board defines risk appetite:

  • “Maximum tolerable loss: €50M annually”
  • “No single event should exceed €10M loss”
  • “Maintain investment-grade credit rating”

2. Allocate risk capital to business units:

Total Risk Capital: €50M

  • Proprietary trading: €15M (high risk/return)
  • Retail procurement: €20M (moderate risk)
  • Generation optimization: €10M (low risk)
  • Reserve: €5M (contingency)

3. Translate to operational limits:

Proprietary Trading (€15M risk capital):

  • 95% VaR limit: €1.5M daily
  • Stress value limit: €8M
  • Position limit: Max 500 MW any single tenor
  • Stop-loss: €5M cumulative loss triggers review

Retail Procurement (€20M risk capital):

  • Maximum open position: Long/Short 200 MW per quarter
  • Unhedged volume limit: 15% of forecast consumption
  • Counterparty concentration: Max 20% volume with any single supplier

4. Cascade to individual traders:

Trader A (Proprietary Desk):

  • Daily VaR limit: €500k
  • Gross position limit: €10M notional
  • Single trade max: €2M
  • Loss trigger: €1M cumulative → position review

Deliverable: Risk Limits Framework (20 pages, limits by unit/trader/product)

Phase 4: Systems and Tools (Months 4-8)

Objective: Implement technology to measure and monitor risk

System Requirements:

1. Position Management System:

  • Real-time position aggregation
  • Integration with all trading platforms
  • Hourly granularity (8,760 prices)
  • Mark-to-market valuation

2. Risk Calculation Engine:

  • VaR calculation (daily)
  • Stress testing (daily)
  • Scenario analysis (on-demand)
  • Credit exposure (real-time)

3. Limit Monitoring:

  • Pre-trade limit checks
  • Post-trade breach alerts
  • Dashboard for real-time status

4. Reporting:

  • Daily risk reports (automated, 7:00 AM)
  • Weekly management summary
  • Monthly board report

Vendors:

  • Allegro (ETRM: Energy Trading and Risk Management)
  • SAP Commodity Management
  • OpenLink Endur
  • Custom builds (for unique needs)

Costs:

  • Software licenses: €500k – €2M/year
  • Implementation: €1M – €5M one-time
  • Ongoing support: €200k/year

Deliverable: Live risk management system

Phase 5: Policies and Procedures (Months 5-9)

Objective: Document how risk management works

The Risk Manual: Core Sections

Section 1: Governance (10 pages)

  • Risk Committee charter
  • Escalation procedures
  • Override authority

Section 2: Risk Identification (15 pages)

  • Risk taxonomy
  • Materiality assessment process
  • Annual review cycle

Section 3: Risk Measurement (30 pages)

  • VaR methodology (step-by-step)
  • Stress testing approach
  • Credit metrics
  • Model validation

Section 4: Risk Limits (20 pages)

  • Limit framework
  • Limit-setting process
  • Breach procedures

Section 5: Reporting (10 pages)

  • Daily reports (content, distribution)
  • Escalation triggers
  • Board reporting

Section 6: Controls (15 pages)

  • Front/Middle/Back office segregation
  • Trade approval workflow
  • Exception handling

Total: 100+ pages

Approval:

  • Risk Committee review
  • Board approval
  • Annual updates mandatory

Deliverable: Approved Risk Manual

Phase 6: Organizational Structure (Months 6-10)

Objective: Define roles, responsibilities, and reporting lines

Three Lines of Defense:

First Line: Business Units (Traders, Portfolio Managers)

  • Own the risks they take
  • Execute within approved limits
  • Report positions daily

Second Line: Risk Management (Independent)

  • Monitor limits and exposures
  • Challenge business decisions
  • Escalate breaches
  • Report to Risk Committee (not trading)

Third Line: Internal Audit

  • Audit compliance with policies
  • Test control effectiveness
  • Report to Audit Committee

Organizational Chart:

Board of Directors
    |
    +-- Audit Committee (3rd line oversight)
    |
    +-- Risk Committee (2nd line oversight)
    |
    +-- CEO
         |
         +-- CFO
         |    |
         |    +-- Risk Management (2nd line)
         |         |
         |         +-- Risk Manager
         |         +-- Credit Officer
         |         +-- Compliance Officer
         |
         +-- Head of Trading (1st line)
              |
              +-- Proprietary Trading Desk
              +-- Retail Procurement
              +-- Generation Optimization

Key Principle: Risk Management reports to CFO/Risk Committee, NOT to Head of Trading (independence).

Phase 7: Training and Culture (Months 8-12)

Objective: Embed risk awareness across organization

Training Programs:

1. Onboarding (All New Hires):

  • Risk Manual overview (2 hours)
  • Limit framework (1 hour)
  • Reporting tools (hands-on, 2 hours)

2. Annual Certification (All Traders):

  • VaR and stress testing concepts
  • Limit compliance
  • Escalation procedures
  • Exam required (must pass)

3. Scenario Workshops (Quarterly):

  • “What if Russian gas stops flowing?” (2022 became real)
  • “What if heatwave shuts French nuclear?” (happened 2003, 2022)
  • Role-play: Margin call crisis

Cultural Elements:

Positive Risk Culture:

  • Risks discussed openly (no blame for raising concerns)
  • Breaches reported immediately (no hiding)
  • “Near misses” analyzed (what almost went wrong?)

Red Flags (Toxic Culture):

  • “Don’t tell risk management” attitude
  • Breaches hidden or downplayed
  • Risk seen as “compliance burden” not value protection

Deliverable: Trained workforce, embedded risk culture

Phase 8: Continuous Improvement (Ongoing)

Objective: Adapt to changing markets and lessons learned

Activities:

1. Back-Testing (Monthly):

  • Compare actual daily P&L to VaR predictions
  • VaR breaches should occur ~5% of days (95% VaR)
  • If more frequent: Model needs recalibration

Example:

  • September: VaR breached 8 out of 20 trading days (40%!)
  • Expected: 1 day (5%)
  • Action: Increase VaR lookback period, add recent volatility regime

2. Model Validation (Annually):

  • Independent review of all risk models
  • Test assumptions (still valid?)
  • Benchmark against industry practice

3. Post-Mortem Reviews (After Major Events):

  • What happened?
  • Did risk management work?
  • What would we do differently?

Example: 2022 Gas Crisis Post-Mortem

  • Finding: VaR model failed (underestimated tail risk)
  • Root cause: No historical precedent for supply shock
  • Fix: Add geopolitical stress scenarios (not history-based)

4. Regulatory Updates:

  • REMIT (European energy market regulation)
  • MAR (Market Abuse Regulation)
  • MiFID (if trading derivatives)

Deliverable: Annual Risk Management Improvement Plan

Risk Capital Allocation Wars: Everyone Wants More

The Problem: Risk capital is scarce. Every business unit wants more.

Example Company: €50M Total Risk Capital

Business Unit Requests:

  • Proprietary Trading: “Give us €30M, we can earn 20% ROC”
  • Retail: “We need €25M for customer growth”
  • Generation: “€15M for optimization”

Total requests: €70M (exceeds available €50M)

Allocation Decision Factors:

1. Return on Risk Capital (RORC):

RORC = Expected Profit / Risk Capital Allocated

Example:

  • Prop Trading: €6M profit / €15M capital = 40% RORC
  • Retail: €3M profit / €20M capital = 15% RORC
  • Generation: €2M profit / €10M capital = 20% RORC

Pure RORC ranking: Prop > Generation > Retail

2. Strategic Importance:

  • Retail: Customer base is defensive (sticky revenue)
  • Prop: High risk, high return (volatile)
  • Generation: Asset optimization (core competency)

3. Diversification:

  • Retail and generation risks are negatively correlated (natural hedge)
  • Allocating to both reduces total portfolio risk

Final Allocation:

  • Proprietary Trading: €15M (30%, high RORC)
  • Retail: €20M (40%, strategic)
  • Generation: €10M (20%, diversification)
  • Reserve: €5M (10%, contingency)

Why This Matters:

  • Prop trading desk wanted €30M, got €15M
  • They’re constrained (VaR limit = €1.5M daily instead of €3M they wanted)
  • They’ll earn less profit (but company risk is managed)

Annual Review:

  • If prop desk proves RORC consistently > 40%, maybe allocate more next year
  • If retail underperforms, reallocate capital

The Risk Manual: 50-100 Pages That Save Companies

Why It Matters:

  • Legal protection (demonstrates governance)
  • Operational playbook (what to do when…)
  • Continuity (survives personnel changes)

Real Sections (Expanded):

Section 1: Governance and Oversight

1.1 Risk Committee:

  • Composition: CFO (chair), Head of Trading, Risk Manager, 1 independent director
  • Frequency: Monthly (more if needed)
  • Authority: Can override trading decisions, set limits, approve new products

1.2 Escalation Procedures:

  • Yellow breach (limit 70-90%): Notify Risk Manager within 2 hours
  • Red breach (limit > 90%): Immediate notification, Risk Committee meeting within 24 hours
  • Material loss (> €5M single event): Emergency board call

Section 2: Risk Appetite Statement

Board-Approved Risk Appetite:

“The Company will take calculated risks in energy trading to generate returns, subject to the following constraints:

  • Maximum annual loss: €50M (= 10% of equity)
  • No single event loss > €10M
  • Maintain investment-grade credit rating (BBB- minimum)
  • Liquidity: Minimum €100M cash + undrawn credit lines”

Section 3: Limit Framework

Limit Types:

3.1 Market Risk Limits:

  • VaR limit: €2M daily (company-wide)
  • Stress limit: €10M (company-wide)
  • Position limits: By tenor, product, geography

3.2 Credit Risk Limits:

  • Counterparty limits: By rating (AAA: unlimited, BBB: €20M, etc.)
  • Total credit exposure: €500M maximum
  • Single counterparty: Max 10% of total exposure

3.3 Operational Limits:

  • Single trader max loss: €1M (triggers review)
  • Department max loss: €5M (triggers review)

3.4 Liquidity Limits:

  • Minimum cash: €50M (operational buffer)
  • Undrawn credit lines: €100M minimum

Section 4: Reporting

4.1 Daily Risk Report (7:15 AM):

  • Distributed to: All traders, Risk Manager, CFO, Head of Trading
  • Content:
    • Current positions (by trader, product, tenor)
    • VaR and stress values
    • Limit utilization (% of limit used)
    • Counterparty exposure
    • Yesterday’s P&L vs. VaR (back-test)

4.2 Weekly Summary (Monday 9 AM):

  • Distributed to: Risk Committee
  • Content:
    • Week’s P&L attribution
    • Limit breaches and resolutions
    • New trades > €5M
    • Credit watch list updates

4.3 Monthly Board Report:

  • Distributed to: Board of Directors
  • Content:
    • Risk metrics vs. appetite
    • Material breaches
    • Model performance (back-testing)
    • Market outlook and risk scenarios

Section 5: New Product Approval

Process:

  1. Trader submits proposal (description, rationale, expected volume)
  2. Risk Manager assesses:
    • Can we measure risk accurately?
    • Do we have systems to book/value?
    • Are there liquidity concerns?
  3. Legal reviews contracts (EFET vs. custom)
  4. CFO/Risk Committee approval required before first trade

Example:

  • Proposed product: Weather derivatives (heating degree day options)
  • Risk assessment: Requires new pricing model (Monte Carlo simulation)
  • System impact: IT must build HDD data feed
  • Approval: Conditional on model validation (3 months)

Daily Risk Reporting: What Traders See at 7:15 AM

Sample Daily Risk Report:

===== DAILY RISK REPORT: 2026-01-15 07:15 AM =====
PORTFOLIO SUMMARY:
- Net Position: Long 320 MW Q1-2026, Short 150 MW Q2-2026
- Mark-to-Market Value: €12.3M gain (since quarter start)
- Yesterday's P&L: +€450k
RISK METRICS:
┌──────────────────┬──────────┬─────────┬──────────┬────────┐
│ Metric           │ Current  │ Limit   │ % Used   │ Status │
├──────────────────┼──────────┼─────────┼──────────┼────────┤
│ 95% VaR          │ €1.2M    │ €2.0M   │ 60%      │ 🟢     │
│ Stress Value     │ €5.8M    │ €10.0M  │ 58%      │ 🟢     │
│ CVaR (99%)       │ €3.1M    │ €5.0M   │ 62%      │ 🟢     │
│ Credit Exposure  │ €85M     │ €100M   │ 85%      │ 🟡     │
└──────────────────┴──────────┴─────────┴──────────┴────────┘
POSITION BREAKDOWN (TOP 5):
1. Long 200 MW Q1-2026 Peak: €95/MWh entry, now €98 (+€3)
2. Short 150 MW Q2-2026 Base: €82/MWh entry, now €80 (+€2)
3. Long 120 MW Jan-2026 Base: €100/MWh entry, now €102 (+€2)
4. Short 80 MW Feb-2026 Peak: €110/MWh entry, now €108 (+€2)
5. Long 50 MW Mar-2026 Base: €88/MWh entry, now €90 (+€2)
COUNTERPARTY EXPOSURE (TOP 5):
1. Company A (AA-): €18M exposure, €50M limit (36%) 🟢
2. Company B (A-): €15M exposure, €30M limit (50%) 🟢
3. Company C (BBB+): €12M exposure, €15M limit (80%) 🟡
4. Company D (BBB): €10M exposure, €10M limit (100%) 🔴 ← ACTION REQUIRED
5. Company E (A): €8M exposure, €30M limit (27%) 🟢
ALERTS:
⚠️ Company D credit limit BREACHED (100% utilization)
   Action: Do not execute new trades with Company D until exposure reduced
   
⚠️ Credit exposure at 85% (Yellow status)
   Action: Monitor closely, consider diversification
BACK-TESTING:
- Yesterday's actual loss: €0 (gain of €450k)
- Predicted VaR: €1.1M
- VaR breach: NO ✓
- Year-to-date VaR breaches: 2 out of 10 days (20%, target 5%)
   → Model may need recalibration
==================================================

Trader Response:

  • Sees Company D at 100% limit → Won’t trade more with them today
  • Credit exposure at 85% → Will prioritize trades with lower-exposure counterparties
  • VaR breach rate high (20% vs. 5%) → Discuss with Risk Manager (model issue?)

Risk Committee Structure and Authority

Purpose: Independent oversight of risk-taking activities

Composition (Typical):

  • Chair: CFO (independent from trading)
  • Members:
    • Head of Trading (business perspective)
    • Risk Manager (technical expert)
    • Independent Director (governance/challenge)
    • Legal Counsel (regulatory/contracts)

Meeting Frequency:

  • Regular: Monthly
  • Emergency: As needed (limit breaches, market crises)

Authority:

  • Approve/reject new trading products
  • Set and modify risk limits
  • Override trading positions (force liquidation)
  • Approve Risk Manual updates
  • Escalate to Board (material issues)

Example Meeting Agenda (January 2026):

  1. Approve minutes (5 min)
  2. Risk metrics review (15 min)
    • VaR, stress, credit trends
    • Limit breaches (if any)
  3. Back-testing results (10 min)
    • Model performance
    • Calibration needs
  4. New product approval: Weather derivatives (20 min)
    • Proposal review
    • Risk assessment
    • Decision: Approve/Defer/Reject
  5. Credit review: Company X downgrade (15 min)
    • Rating agency downgraded X from A to BBB
    • Current exposure: €25M
    • New limit (BBB): €20M
    • Decision: Require €5M collateral or reduce exposure
  6. Market outlook and scenarios (15 min)
    • Summer 2026 price forecasts
    • Stress scenarios (heatwave, nuclear outages)
  7. AOB (5 min)

Decision Record:

  • Weather derivatives: Approved (subject to model validation)
  • Company X: Collateral required (€5M by February 1, or close positions)

Back-Testing: Did Our Models Actually Work?

Purpose: Validate that risk models are accurate

Process:

Daily Back-Test:

  1. Yesterday’s 95% VaR prediction: €1.1M
  2. Yesterday’s actual P&L: +€450k (no loss)
  3. Outcome: VaR not breached ✓ (Good)

Aggregate Back-Test (Quarterly):

  • Last 60 trading days
  • VaR breached 7 times
  • Expected: 5% of 60 = 3 breaches
  • Actual: 7 breaches (11.7%)
  • Conclusion: Model underestimating risk (too optimistic)

Action:

  • Investigate: Why more breaches than expected?
    • Market volatility increased (need shorter lookback)
    • Fat tails (need extreme value theory, not normal distribution)
  • Fix: Recalibrate model parameters
  • Re-test: Back-test with new parameters

Regulatory Requirement:

  • REMIT/MAR require annual model validation
  • Independent auditor reviews back-testing
  • Findings reported to regulator

Example Finding (2025 Audit):

“The Company’s VaR model uses 500-day historical data, which includes low-volatility periods from 2019-2020. This results in understating current risk (2025 higher volatility). Recommendation: Reduce lookback to 250 days or use exponential weighting (recent data more important).”

Management Response:

  • Accepted recommendation
  • Implemented 250-day lookback (January 2026)
  • Result: VaR increased from €1.2M to €1.8M (more conservative)

Key Takeaways

✓ 8-phase implementation: Risk ID → Measurement → Limits → Systems → Policies → Structure → Training → Improvement
✓ Risk capital allocation wars: Every unit wants more; RORC drives decisions
✓ Risk Manual (50-100 pages): Governance, limits, reporting, controls—legal/operational necessity
✓ Daily 7:15 AM reports: Traders see positions, VaR, limits, alerts before market opens
✓ Risk Committee: Independent oversight, authority to override trading decisions
✓ Back-testing validates models: VaR should be breached ~5% of days (95% confidence)
✓ Three lines of defense: Business (1st) → Risk Mgmt (2nd) → Internal Audit (3rd)

Next in Series: Post 12: Integrated Portfolio Management: When You Have Everything

Leave a Reply

Trending

Discover more from Convergence Point

Subscribe now to keep reading and get access to the full archive.

Continue reading