into 2007. 2. if one means by monetary policy the instrument of short - term interest rates, then i agree that monetary policy is not well - suited to deal with asset bubbles. but this suggests that it might be better for central bankers to examine the efficacy of other instruments in their toolbox, rather than simply ignoring the development of asset bubbles. 3. if existing tools are judged inadequate, then central banks should work on developing additional policy instruments. let ’ s take the housing bubble as an example. housing prices rose far faster than income. as a result, underwriting standards deteriorated. if regulators had forced mortgage originators to tighten up their standards or had forced the originators and securities issuers to keep “ skin in the game ”, i think the housing bubble might not have been so big. i think that this crisis has demonstrated that the cost of waiting to clean up asset bubbles after they burst can be very high. that suggests we should explore how to respond earlier. harkening back to my earlier themes, i think we can respond in a number of ways : • first, we can do a better job understanding interconnectedness. this means changing how we oversee and supervise financial intermediaries. • second, we can change the system so that it is more self - dampening. • third, we can improve incentives. • fourth, we can increase transparency. • fifth, we can develop additional policy instruments. for example, we might give a systemic risk regulator the authority to establish overall leverage limits or collateral and collateral haircut requirements across the system. this would give the financial authorities the ability to limit leverage and more directly influence risk premia and this might prove useful in limiting the size of future asset bubbles.

complete. the news at the end of the day is good : it turns out that the alert was a false positive. but, the organization lost half a day of productive activity. in a simple world, controls detect problems immediately, diagnose with perfect accuracy, and result in corrective actions that are instantly and fully effective. in the real world, detection takes time, diagnosis is not always accurate, solutions take time to implement, and they don ’ t always work. that said, we must make decisions — including ones about whether and how to execute controls — based on the information available at the time. control design and execution take place in a world in which there is uncertainty about whether 3 / 5 bis central bankers'speeches there is a problem, what the problem is, what to do about it, when to do something, and what the effects of what we do will be. we can make better decisions when we understand and manage that uncertainty. there is also uncertainty about threats. we will never be able to envision the characteristics of all future causes of disruption. even when we plan effectively, we will be surprised again. and, like any other system, the control system will exhibit performance variability. for these reasons, we can ’ t rely solely on prevention. resilience requires the ability to withstand and recover when threats make it through preventive barriers, so a strong control system must incorporate preventive, detective, and corrective controls. perhaps because we are overoptimistic about prevention, detective and corrective controls sometimes get second - class billing. for many threats, time is not on our side ; the impact grows as the detection time increases. that ’ s the case with “ dwell time ” for cyber breaches, which is the amount of time attackers are on your network before you detect them. 9 it ’ s important to decide how long you are willing to wait to find out that you have a problem, and then use that as a requirement to design detective controls. underinvesting in corrective controls is problematic too. for example, how would you feel after a ransomware attack, if you find out that your backed - up data is intact but it will take months and millions of dollars to restore? or, if your first corrective action is the wrong solution and makes the problem worse? it takes time and resources to develop the tools, procedures, and skills to accurately diagnose causes, contain the immediate threat, and implement a long - term