Perhaps nothing in business circles today generates more heated debate than risk and risk management—not only in financial institutions, but also in every industry, and from the lowest manager level to the boardroom.

We all know something went disastrously wrong in how risk has been managed, to the painful realization of directors, senior executives, and other employees, shareholders, bondholders, and now taxpayers. The debates rage from one end of the land to the other about what went wrong—and they often involve amazing complexity, dealing in sophisticated quantitative models, forecasts, and the like. And otherwise knowledgeable people talk at cross-purposes, using ...