With Security Analysis, Graham and Dodd laid out a superb analysis that has stood the test of time. But their prescription for risk management was to say, “Buy bonds.” In their time, when they looked at the overall economic environment and at risk properly defined, bonds were where they saw methods and opportunities to control risk. Today, value investors think about managing risks in more sophisticated ways.

One of the real lessons of Graham and Dodd is that you had better understand the determinants of cash flows, you had better understand companies and industries, rather than just taking a historical average and slapping a multiple on it. And you had better understand when a company’s superior returns are going to be sustainable in the face of the relentless force of competition.

Graham and Dodd were aware of that, but in their world they didn’t see any chance of resisting that relentless force of competition — that if a company produced 20–30 percent returns on capital, five or 10 years later those returns were going to be gone. We have a more sophisticated view of which business models are likely to survive, of why it is that Coke produced superior returns for more than 100 years whereas other firms have produced those returns for short periods of time (notably the Internet-based industries).

So the first lesson we can take from today’s value investors: understanding sources of competitive advantage in a sophisticated way is a discipline that has advanced far beyond what Graham and Dodd envisioned. That means you can look at cash flows in ways that you never could before and think about risks you are exposing yourself to when you pay eight or nine times those cash flows, which could evaporate. Understanding the business models that fell apart and those that didn’t is very much a lesson in risk management.

The second lesson is something I’ve learned more recently by listening to other value investors: be good at buying insurance and formal risk management. As we’ve experienced in the past year, there are always events that can come out of left field. Begin to do active risk management so that you have a portfolio of good companies at good prices and are protected from the fallout.

This doesn’t mean trying to outguess people in forecasting the economy. What risk management means is having a sense of when there are macro vulnerabilities and when there are vulnerabilities in the market because of people’s bizarre attitudes toward risk. About a year before the LTCM bailout in 1998, I was offered a job by one of LTCM’s senior people. He proclaimed that risk was just going away, that it ultimately was going to disappear. This was during an enormous bubble, and it was a crazy thing to believe. I declined the offer. When the market starts to sound crazy like that, that’s when you want to buy insurance, and you want to learn to buy it in a way that’s most cost-efficient. Ironically, insurance is cheapest when you need it the most, because it’s precisely at that point when things are most overvalued.

More recently, it’s not just mortgages where people went crazy: you could get credit default swaps in summer 2007 on almost any debt at ridiculous prices. At its most ridiculous, you could get a contract that would pay full face value of Dubai’s sovereign debt if Dubai defaulted at four basis points. The market was saying that this country — with a short history, living in the most dangerous part of the world, subject to the greatest possible variation in economic and social conditions — had one chance in 2,500 years of defaulting on its debt. If you had bought those credit default swaps at those four basis points, then you would have made 21 times your money and protected yourself against potential losses. Earlier this year, the same credit default swaps were at 86 basis points simply because of the change in the psychological atmosphere.

You ought to have the sense that this is an opportunity to buy cheap general insurance because what is driving that situation is a perception about risk broadly in the economy that is pervasive.

Finally, such an approach rigorously exercised would have gone a long way toward avoiding losses in the recent mortgage meltdown. Meanwhile, the bailouts today have not even begun to address risk attitudes. We should remember that however new the risk management methods of today’s value investors are, they are based on the extraordinarily durable principles of Security Analysis.

This piece is drawn from remarks made by Professor Greenwald at October’s “Celebrating 75 Years of Security Analysis” symposium in honor of the new sixth edition, which was published on the 75th anniversary of the first edition. These remarks were also published in Ideas at Work.