First, John Quiggin poses the question: Bad models or Bad Modelers? If an underlying assumption of the model is bad is the model at fault or is the modeler at fault? After all models don't make assumptions, people do. Why should we accept what the models tell us without close examination? Every year compter rankings of college football teams are generated and these rankings are constantly being disputed. There is a healthy disrespect for models in college football that does not seem to carry over to finance and economic models.
Second, from Joe Nocera (NYT):
There were the investors who saw the VaR numbers in the annual reports but didn’t pay them the least bit of attention. There were the regulators who slept soundly in the knowledge that, thanks to VaR, they had the whole risk thing under control. There were the boards who heard a VaR number once or twice a year and thought it sounded good. There were chief executives like O’Neal and Prince. There was everyone, really, who, over time, forgot that the VaR number was only meant to describe what happened 99 percent of the time. That $50 million wasn’t just the most you could lose 99 percent of the time. It was the least you could lose 1 percent of the time. In the bubble, with easy profits being made and risk having been transformed into mathematical conceit, the real meaning of risk had been forgotten. Instead of scrutinizing VaR for signs of impending trouble, they took comfort in a number and doubled down, putting more money at risk in the expectation of bigger gains. “It has to do with the human condition,” said one former risk manager. “People like to have one number they can believe in.”
(see a critique of the article here)
There is some truth to the notion that once an unsophisticated user has been exposed to a concept long enough this notion can take become the TRUTH and in a sense this is what has happened to VAR. The more sophisticated users/modelers who understand the assumptions behind models will also be lulled into complacency if the novice user e.g. CEOs don't take the trouble to understand the models and act as though there were no limitations to the models. If my boss is not worried then why should I worry?
The incentive to worry about the 1 percent is also not present. Why devote resources to the small probability of a catastrophe when everyone else isn't doing it? After all, ‘a sound banker, alas, is not one who foresees danger and avoids it, but one who, when he is ruined, is ruined in a conventional and orthodox way with his fellows, so that no-one can really blame him.’ (Keynes)
As Nocera points out in the article many don't believe that VAR models are useless but there is an element of human judgement that needs to be used every time the numbers are scrutinized. So, should all risk models come with a warning e.g. "This model will only behave as it has been programmed to behave. Use at your own risk".
Unfortunately, disclaimers such as these are ubiquitous - almost like end user license agreements when software is installed - that I almost never read anything like Terms and Conditions or Disclaimer any more.
There is a human element to all financial crisis and it is neither stupidity nor ignorance. It is greed.