Risk Management and Business Performance: Why Separating Them is Breaking the Operating Model
In Markets businesses, risk management and business performance are often discussed as if they were related but fundamentally separate domains. Performance is something to be generated. Risk is something to be controlled. The two are connected rhetorically, but rarely analysed together in a way that shapes how the business is actually run.
That separation is no longer benign.
In an environment defined by scarce capital, rising fixed costs, increasing regulatory scrutiny and accelerating complexity, divorcing risk management from business performance does not make institutions safer. It makes them more expensive, more conservative and less coherent. Most importantly, it weakens their ability to select risk intelligently rather than default to risk avoidance.
The result is an operating model that feels heavy, defensive and increasingly disconnected from how value is actually created.
This article examines the structural consequences of that separation. It follows from "Rebuilding Judgement in Markets", which explored how organisational judgement has been quietly eroded through well-intentioned change.
Here, we examine what happens when the disconnect between risk management and performance becomes embedded in the operating model itself.
The current state: fragmented perspectives
The challenge is not that risk management is weak. Many firms have strengthened their risk frameworks considerably over the past decade. The challenge is fragmentation.
When the same information is analysed repeatedly through different lenses for different audiences, risk is discussed but not integrated. Performance is reported but not fully explained. Duplication becomes embedded and confidence in decision-making erodes.
This is where the erosion of judgement, described in the companion piece, meets its structural expression. When organisations lose the capability to exercise judgement about risk, they compensate by adding process. When process replaces judgement, risk management and performance drift further apart.
A more integrated perspective
For risk management to be meaningfully integrated with performance, it must reflect how Markets businesses actually operate.
The interaction between risk management and business performance encompasses how strategy is executed through products, client activity and market positioning, including the decisions made, how they are supervised, explained and governed, and how these choices interact with financial outcomes, capital deployment and franchise value.
This explicitly includes:
Conduct and behavioural risk
Operational and resilience risk
Surveillance and supervision effectiveness
Model risk as embedded in business operations
P&L explainability and attribution
Algorithmic and technology-enabled risk
The deployment and constraint of capital and balance sheet
Crucially, this perspective is forward-looking. It treats risk management not as a record of failure, but as a live dimension of how the firm chooses to operate.
This integration requires the very capability most firms have been inadvertently weakening: judgement. The ability to distinguish good risk from bad risk, to understand which exposures serve clients and which create drag, to know when controls illuminate and when they obscure.
While traded market risk, credit risk and liquidity risk are managed through established frameworks and specialist teams, the risks that cut across strategy, change, supervision and operating model design require different treatment. They cannot be delegated entirely to second-line functions. They must be understood and managed by those leading the business, in a way that remains connected to performance outcomes.
Risk is assumed in order to generate performance
This framing forces a simple truth into the open: risk is assumed in order to generate performance.
When risk management is analysed independently of performance, the organisation loses its ability to distinguish between good risk, bad risk and pure inefficiency. Once that distinction is lost, a predictable set of outcomes follows.
Costs rise structurally as the same data is collected, analysed and reconciled multiple times by different teams for different purposes. Front office, finance, risk, compliance and audit each develop their own interpretation of the same underlying activity. Reconciliation replaces understanding. Duplication becomes permanent.
At the same time, different interpretations of the same risk proliferate. A P&L outcome is seen as volatility by the desk, a model issue by one function, a control weakness by another and a conduct concern by a third. Each may be plausible. None is definitive. Decision-making slows and escalation becomes the default.
This is the structural manifestation of weakened judgement. When organisations cannot decide which interpretation matters most, they defer to all of them. The result is not better risk management. It is paralysis dressed as prudence.
In this environment, risk selection gives way to risk elimination. Conservatism becomes the safest organisational posture. Controls are designed to avoid criticism rather than to enable informed risk-taking. Residual risk is treated as something to be minimised rather than consciously chosen and managed.
The operating model drifts out of balance. Incentives misalign. Information already available is ignored or reworked elsewhere to satisfy multiple agendas. The same tasks are performed two or three times in different parts of the organisation to create comfort for different stakeholders.
None of this improves the understanding of the risks actually being run.
Risk selection, not risk elimination, is the scarce capability
Eliminating risk is relatively easy. Limits can be tightened. Approvals added. Surveillance expanded. Permissions withdrawn.
Selecting risk well is much harder.
Risk selection requires understanding which risks are intrinsic to serving clients, rewarded by the market, aligned with strategic objectives and manageable within the firm's operational and cultural capacity. It demands judgement, context and a clear line of sight between exposure and outcome.
When risk management and performance are separated, this capability atrophies. Organisations become very good at documenting risk and very poor at deciding which risks are worth taking.
This connects directly to the erosion of judgement explored in the companion article. Decision-making has been extracted from those closest to the risk. Authority has migrated into committees. Process has substituted for experience. The predictable result is an organisation that can describe every risk in exhaustive detail but struggles to decide which ones matter.
P&L explain, capital and the cost of misunderstanding value
The consequences of this separation are most visible in P&L explain, particularly under frameworks such as FRTB.
Historically, P&L explain has often been treated as a finance hygiene exercise: a reconciliation process designed to close numbers rather than interrogate meaning. Under FRTB, that approach is no longer merely sub-optimal. It is directly value-destructive.
FRTB embeds a clear premise: capital outcomes depend on whether a firm can credibly explain how its P&L is generated. Where desks cannot demonstrate a stable and well-understood relationship between risk factors and realised outcomes, the response is loss of model approval, migration to standardised approaches and materially higher capital consumption.
This is not theoretical. It is already observable.
There is, however, a risk in treating this as an FRTB compliance problem. FRTB does not create the need for strong P&L explain. It exposes where it was already missing.
In a well-functioning Markets business, P&L explain is the natural junction between risk management and performance. It is where the organisation should be able to answer simple but demanding questions: What risk produced this outcome? Was it the risk we intended to run? Was it rewarded as expected? If not, why?
These questions require judgement. They require people who understand both the market reality and the risk framework. They require the confidence to interpret results rather than simply report them.
When this discipline is weak, risk teams focus on factor eligibility, finance teams on reconciliation tolerances and the front office on results. Each sees a partial truth. Capital efficiency deteriorates and the response is often to add process rather than insight.
The cost is not just regulatory. It is economic. Firms that cannot explain their P&L pay for it in capital. Firms that cannot integrate risk and performance pay for it in relevance.
Resilience as a performance and client proposition
Operational resilience illustrates the same dynamic.
Resilience is often discussed primarily as a regulatory requirement. For clients, it is something else. Clients care about resilience because it tells them whether the bank will remain present, credible and dependable when markets are stressed and systems are under pressure.
That is a performance question, not a compliance one.
When resilience frameworks are designed without reference to how the business actually operates under stress, firms tend to over-engineer controls while under-investing in practical continuity. Costs rise. Complexity increases. Confidence does not. Resilience that is disconnected from performance weakens the franchise rather than protecting it.
This too reflects weakened judgement. Firms that understand their operating model can design resilience that protects what matters. Firms that have lost that understanding default to comprehensive coverage, regardless of cost or relevance.
Culture follows operating model design
The separation of risk management and performance has cultural consequences, though culture is rarely the root cause.
Organisations behave according to what their operating model rewards. When risk ownership is abstracted away from those generating performance, the implicit message is clear: risk is something to be managed elsewhere. Over time, this promotes compliance over judgement, escalation over ownership and conservatism over curiosity.
Ironically, this often results in more risk, not less, because real understanding is replaced by procedural comfort.
As explored in "Rebuilding Judgement in Markets", culture is not the cause of these problems. It is the symptom of an operating model that has narrowed the space in which judgement can be exercised. Talented practitioners adapt by becoming procedural rather than thoughtful, defensive rather than curious. The result is not a collapse in competence, but a steady hollowing-out of conviction.
Reconnecting risk management and performance deliberately
The solution is not deregulation or nostalgia. It is to reconnect risk management and performance deliberately so the firm understands the risks it is taking because it understands how it makes money.
That requires leaders willing to treat risk management as inseparable from performance, to design controls that illuminate rather than obscure, to allocate talent where judgement adds the most value and to resist the instinct to preserve large central mandates for their own sake.
This is not about shrinking risk functions ideologically. It is about ensuring that every pound spent on risk management improves the ability to select, manage and price risk intelligently rather than simply reducing discomfort.
It also requires rebuilding the organisational capability that makes integration possible: judgement. As explored in the companion piece, this means:
Redesigning change so it strengthens rather than suppresses judgement
Placing authority closer to where decisions are made
Creating feedback loops that connect decisions to outcomes
Allowing discretion within understood boundaries
Because if risk management is not linked to performance, the question becomes unavoidable: Why assume it at all?
Taken together, these two pieces offer a diagnostic and a path forward. "Rebuilding Judgement in Markets" examines how organisational capability has been eroded. This article explores the structural consequences of that erosion in cost, capital, resilience and operating coherence.
The challenge for Markets leaders is not just to acknowledge these problems, but to redesign the operating model in ways that reconnect judgement with risk management, and risk management with performance. That is the work that matters most.
For further discussion and initial consultation please contact FMCR at contact@fmcr.com.