timothy f geithner : key challenges in risk management keynote address by mr timothy f geithner, president and chief executive officer of the federal reserve bank of new york, at the rma / risk business kri ’ s global operational risk forum, new york, 13 january 2005. * * * thank you for giving me the opportunity to speak to you today. i want to talk about the mix of forces at work on the broader macroeconomic front and what that may imply for risk and for financial stability. by many measures, the economic landscape looks reasonably good. the qualified optimism that now seems to prevail about the global expansion is reflected in low risk premia, unusually low credit spreads, low and quite stable inflation expectations, and low actual and implied volatility. but the global economy faces a set of pressing macroeconomic policy challenges. how should we think about the risks presented by these broader macroeconomic forces, and their implications for the sustainability of this recent period of stable economic performance, and low volatility and risk premia? the u. s. expansion has proven quite resilient. we enter the new year with what appears to be a pretty solid underlying pace of growth. core inflation is moderate, and various measures of inflation expectations suggest confidence in the outlook for price stability. estimates of structural productivity growth remain high, although there has been some moderation recently. the pace of global growth has moderated a bit, but most forecasts anticipate a quite strong and broad based expansion. the imf ’ s projection is just over four percent for real global gdp growth. the consensus of private forecasters sees growth in europe and japan close to estimates of potential, or in the neighborhood of two percent. growth in the major emerging markets looks impressive, reflecting not only the benefits of a positive external environment, but also the impact of better economic leadership and policies more supportive of macroeconomic stability and reduced external vulnerability. in china, officials now seem more confident that they have induced the desired moderation in growth to a more sustainable, but still high pace of growth. the global economy has weathered the oil price shock quite well. if the long term futures prices are right, we need to be prepared to live with the possibility of a sustained period of higher oil prices, and perhaps more volatility in oil prices, and the world seems to be getting itself more prepared for that prospect. in the financial markets, this broadly positive outlook has been accompanied by a dramatic reduction in

complete. the news at the end of the day is good : it turns out that the alert was a false positive. but, the organization lost half a day of productive activity. in a simple world, controls detect problems immediately, diagnose with perfect accuracy, and result in corrective actions that are instantly and fully effective. in the real world, detection takes time, diagnosis is not always accurate, solutions take time to implement, and they don ’ t always work. that said, we must make decisions — including ones about whether and how to execute controls — based on the information available at the time. control design and execution take place in a world in which there is uncertainty about whether 3 / 5 bis central bankers'speeches there is a problem, what the problem is, what to do about it, when to do something, and what the effects of what we do will be. we can make better decisions when we understand and manage that uncertainty. there is also uncertainty about threats. we will never be able to envision the characteristics of all future causes of disruption. even when we plan effectively, we will be surprised again. and, like any other system, the control system will exhibit performance variability. for these reasons, we can ’ t rely solely on prevention. resilience requires the ability to withstand and recover when threats make it through preventive barriers, so a strong control system must incorporate preventive, detective, and corrective controls. perhaps because we are overoptimistic about prevention, detective and corrective controls sometimes get second - class billing. for many threats, time is not on our side ; the impact grows as the detection time increases. that ’ s the case with “ dwell time ” for cyber breaches, which is the amount of time attackers are on your network before you detect them. 9 it ’ s important to decide how long you are willing to wait to find out that you have a problem, and then use that as a requirement to design detective controls. underinvesting in corrective controls is problematic too. for example, how would you feel after a ransomware attack, if you find out that your backed - up data is intact but it will take months and millions of dollars to restore? or, if your first corrective action is the wrong solution and makes the problem worse? it takes time and resources to develop the tools, procedures, and skills to accurately diagnose causes, contain the immediate threat, and implement a long - term