CRO interview: Brett Humphreys

What type of company is Karbone, and what does it focus on?

Karbone began as a broker in 2008 and entered principal liquidity services in 2019 – an activity that carries much more risk. Our major focus is the energy transition. We trade carbon, renewable energy and renewable energy credits, but we’re also in unrelated markets like capacity markets and ancillary services and we’ve recently expanded into more traditional power contracts on top of renewable fuels. The company has been on an exponential growth curve over the last six years and plans to double again in the next 18 months, so it’s a very exciting place to be.

How different is it working in a firm focused on the energy transition rather than one supporting fossil fuel sales?

In some ways, it’s not different at all. We take positions, look at risk, calculate value-at-risk, carry out stress tests. In other ways, it’s very different. Transition-focused firms have more regulatory risk than firms in the fossil fuel world. There are markets that could disappear if regulation changed.

Another, more intangible, difference is that people seem to be excited about working for an organisation that supports the energy transition. I didn’t get that same feeling when I was working with people who are trading oil.

What is a typical day for you as a risk manager?

We are only just starting to build the risk culture, so for me it’s about understanding the risks that each desk is taking, focusing on the markets and our positions, calculating the VAR, stress-testing and comparing the results to the desk limits to make sure everyone is within the pre-specified risk appetite.

We have weekly risk meetings with each of the desks, going through their positions asking why they’re holding them and what things they are taking into consideration.

From there, a lot of what I do will be ad hoc, based on what the positions are like. If there’s a big, structured transaction, for example, we’ll look at whether the risk is aligned with everything else we’re doing. If a desk has lost money, we’ll review that.

We also spend time trying to understand what’s driving the markets. We’re very concerned with regulatory risk and anything that might impact these various markets.

The risk we’re always most worried about is market risk, but it’s in some ways the easy risk because it’s most observable and very visible

Another major focus is our systems. Almost everything has been built from scratch here, so it’s about making sure the risk system can keep up with the pace with which we’re expanding into new products and markets. It’s always a challenge. 

Overall, it’s a pretty standard risk job, but with a start-up feel.

How do you manage the volatility and uncertainty around shifting regulation? 
In general, volatility is good for a trading organisation because it encourages buyers and sellers to hedge. The problem is when liquidity gets squeezed in certain markets as people wait for regulation and then there are big jumps when there’s some clarification, or even just rumours. This isn’t good because you can’t trade around that. Some market participants are holding off taking positions until the regulations are clear, but as there are often delays and deferrals, markets remain illiquid.

It also tends to be a binary outcome where markets go one way or the other depending on the ruling. That’s not a distribution, so it makes it a challenging environment to model.

Are most of your customers fulfilling compliance requirements or coming to the markets on a voluntary basis?

It’s a blend. We have a large number that are regulatorily obliged, but then others are operating on a voluntary basis. We try to be aware of the motivations of our clients. Players that are driven by regulation are prone to greater variability and will change behaviour if the regulation changes.

What risks are at the top of your risk register right now, and have there been any major changes over the past 12 months?

When we finished our budgeting process for 2026, I did a survey of the senior management asking which risks could impact our ability to hit our 2026 budget. They were asked to rank them for probability and severity on a scale of one to five.

The risks were market risk, credit risk and several different operational risks, including booking errors, internal and external fraud, and regulatory risk.

After they ranked them, I created a risk score, which was the product of the probability and the severity. We then had a team-wide discussion of these risks, and it led to a very interesting and helpful discussion. The risk rankings lined up with our expectations, but it was interesting to see what different members of management felt.

The risk we’re always most worried about is market risk, but it’s in some ways the easy risk because it’s most observable and very visible. Regulatory risk was the second biggest one, but it’s impact could be huge, because without certain regulations, whole markets in theory could just vanish. This would be a significant opportunity loss for us ending any ability to make money in that market in the future. From a risk management perspective, there’s not a lot I can do about a change in regulation – it’s an inevitable risk for the business we’re in – but it’s important to recognise it and monitor it. 

Exercises like this that get people to think about risk – what can we mitigate, what we can accept, and how we choose the risks we take – help to build and shape the risk culture. 

You have to challenge your own assumptions constantly and ask what would happen if you were wrong – how bad could it get?

In terms of changes to the risk register, we’re now seeing much higher volatility, bigger tails and bigger risks, and so I’m more concerned about watching our edge cases and being cautious about extremes. For example, what would happen if there’s a polar vortex or a hurricane, or more geopolitical risk? So much of the energy infrastructure is already stressed, so layering in an external shock is likely to cause extreme price movements.

What are you doing to manage the biggest risks identified on your risk register?

For small companies with relatively small capital bases, the biggest disaster would be taking on too much risk and being wiped out in the event of a market shock. One of the most important things I worked on last year was establishing a solid risk appetite for each desk, which gives them their VAR limit, but also a stress limit.

I spend a lot of time communicating to the team that the point of this is to ensure they are still around to play the game tomorrow. To that point I also focus on the tail risks to make sure there’s nothing that’s going to surprise us. You have to challenge your own assumptions constantly and ask what would happen if you were wrong – how bad could it get? If I can come up with a viable story, then I’ll start thinking about how to prevent it or looking at what protection we have against it.

In today’s world of increasing risk and unpredictability, there’s likely to be a much wider distribution of outcomes. How is this impacting your modelling?

What’s clear is you cannot live by VAR alone, and I don’t think any competent risk manager does. VAR is an incredibly useful tool. It’s a quick metric that helps us see what’s going on, but it’s not enough on its own. What matters is your stress-testing and how you manage tail risk.

However, it’s very easy to fall into the trap of thinking that the more extremes the stress test covers the better. I’ve worked for organisations where the quality of the risk manager was measured by the extremity of the stress test. So, if someone was stressing ‘X’ to 100, there would then be pressure to stress it to 120 or 150, with no statistical justification, just the supposition that the bigger the number, the better. This trap is even easier to fall into today as we encounter more things that have never happened before. For example, how many people were stress-testing their WTI crude oil portfolio with negative crude oil prices prior to it happening in 2020? Similarly, how many stress tests were prepared for the spike in European power prices that happened when Russia invaded Ukraine? We’re seeing prices we’ve never seen before, so where do you stress test?

VAR is an incredibly useful tool. It’s a quick metric that helps us see what’s going on, but it’s not enough on its own. What matters is your stress-testing and how you manage tail risk

A major question now is what will happen to European power prices if there’s a peace treaty and Russian gas starts flowing again? There are detailed fundamental models that predict how much additional gas will come into the market under various scenarios, what the elasticity is and how this will ripple into electricity markets.

Fundamental models usually work well, but they can fail at times of extremes with high-risk premiums, which no model that I use really builds in.

This is the problem with stress-testing. You’re generally dealing with areas where there’s no clear view of what correct is, and you’re probably never going to get that. So, we spend a lot of time working through various stress scenarios thinking not about all possible extremes, but justifiable extremes. 

What should the role of the risk manager be in an ideal world?

Ideally, the risk manager is an adviser to management, helping them think about risk and reward, applying it to their corporate portfolio and helping the company progress to where they want it to be.
Then, ideally, the risk manager implements management’s risk agenda. For example, I don’t set Karbone’s risk appetite, it’s set in dialogue with senior management.

But once it’s set, I can implement it by setting risk limits. The key is for the risk manager to know and understand management’s view on risk so they can implement their risk management framework based on management’s perspective and then report back anything that might be outside the ordinary, or that might help them to think more broadly about their risk factors.

How easy is it to ascertain the risk appetite of senior management?

It’s a dialogue and discussion. I’ve had discussions with people who say they want no risk. But then the risk manager needs to explain that, without risk, there’s no reward. To make money you must take risk but, at the same time, it’s important to understand what risk you are taking and why. For example, is the risk we’re taking here actually credit risk or is it market risk? Are we capturing real optionality that we might own in an asset? There are multiple ways to make money so it’s important to understand how we are doing it and where we have a business advantage.

How important is risk culture, and is it the role of the risk manager to create it?

Creating a risk culture is the key role of the risk manager. It’s helping people to think about outcomes and distributions. It’s weighing downside against upside. It’s weighing tail events and gauging how we think about them. It’s getting people to think about a distribution and about how an outcome could impact the firm. If you can do that, you’re 95% of the way there.

How do you approach potentially uncomfortable conversations with colleagues where you have to say no to something?

There’s always uncomfortable conversations, and occasionally you have to say no, but that’s rare. Usually, if you’ve done a good job of building the risk culture, then everyone understands, you’re on the same page already and it’s not a debate.

From my perspective, risk management is almost never about giving an outright no. It might be, ‘I understand what you’re trying to do but this approach won’t work right now and here’s why’. Let’s try to come up with a structure that solves this problem or creates some protection. Very rarely are you ever in a situation where someone wants to get a deal done and is totally ignoring the risk. 

To make money you must take risk but, at the same time, it’s important to understand what risk you are taking and why. For example, is the risk we’re taking here actually credit risk or is it market risk?

How do you prove the value of risk management to the board?

I think the risk manager should help their organisation make better decisions, and if they can point to those decisions and how they were made, that should show a great deal of value. I’ve seen risk managers who say no to everything, and they can then say ‘we didn’t take any risk’. I don’t think that’s the answer. I’ve also seen risk managers who say yes to everything. That’s not the answer either, as you’re not managing. I’ve built a risk culture where management has defined its risk appetite, and we take appropriately sized risks. I feel this is leading to better outcomes than when we weren’t doing it this way.

What do you see as the next big challenge for energy risk management and to tackle?

One of the biggest challenges is that risk management in general tends to be based on history, but as we move into a world that’s changing more rapidly, the question is, how appropriate is the past – even the recent past – for predicting future outcomes? For example, AI data centres are springing up. How will that change the dynamics of the US power market? 

When I started in my career, if you had natural gas exposure in the US and there was a hurricane in the Gulf Coast, you knew that would be bullish for natural gas prices as it would take out Gulf coast production and prices would spike. Now, if you have a hurricane in the Gulf Coast, it’s going to take out LNG export facilities and be bearish for gas. The same event can have a radically different impact now than it did 15 or 20 years ago. So, we need to recognise that the world we’re in now is changing so rapidly. That’s the challenge.

What use cases do you see for AI in your everyday workflow, and have you deployed it anywhere yet?

I expect significant upside to using it, but we are not actively using it yet, except for occasional help with coding. I know it can be beneficial in areas like summarising regulations, or articles, to get to the key concepts quickly, and also for credit risk analysis. These are on my agendas. However, its propensity for hallucinations scares me. I’m also uncomfortable about its ability to carry out highly complex calculations that could one day be beyond the comprehension of any analysts. I’ve spent my career trying to keep models and tools as simple as possible so that I can explain them and recognise their limitations. If I can’t understand what or how the system is calculating, that’s a big concern. A key part of the risk manager’s role is understanding the limitations of your models so you can build protections around those limitations. If I don’t understand my model, how can I do that?

What would you say are your most useful working habits?

I think probably listening and asking questions. I don’t like telling people the answer I want, I like to ask them questions and see if we arrive at the same place, which will happen if you’re right. If you’re not right, it’s usually because an assumption you made is incorrect. If you start with the assumption that everyone’s probably trying to do their job in the best way possible, there’s a justification for everything. So, it’s about asking why – why do you have that position, what was your thinking etc?

That’s going to get me a lot further than making assumptions about what the market will do next without ever asking a trader. I want them to be able to give me more information. I also believe in having these conversations in person as you get that little bit extra.