Source of the Risk
U have to start with managers,they could have numerous behavior problems like hubris, over optimistic, or loss averse. There could also agency risk. Which means whatever the objective of managers could different form shareholders. Managers could take more or less risk compared what shareholder holders or bond holders want. This risk could be hedged with contracts, which could regulate their behaviors and so on. Must give their some positive incentive.
Next you should do two things, gather information in order to figure out what kind of risk ur taking on, what source of the risk,. And there where u model risk. How much going to hedge, and how much capital do I have to hold in order to hedge internally to avoid bankruptcy. The example is VAR. Or when it comes to operational risk, u have to decide how much capital u have to hold in order to deal with it. Just do a computation like that.
The problem is u could have risk ignorance. In other words, there are certain kind of risk which exact exist in ur business model, but which u may not be aware of. That is why the process of gather information is important.
However, the model may not always be accurate, and u don’t know the exact probability of different risks are, just making a guess on the basis of historical data. Then u do stress testing to see what if the reality deviate the historical data tell u. For example u could say , interest rate will not change more than 100bps 1% a year, then u could do stress testing to see what would happen if the interest rate change 200bps. How would my VAR or capital needed change.