Seven Tenets of Risk Management in Banking

7/23/2019 Seven Tenets of Risk Management in Banking

1/71Seven Tenets of Risk Management in the Banking Industry

Seven Tenets ofRisk Management inthe Banking Industry

If a bank is serious about risk management, then it willbe serious from the top down. Before discussing this

statement, it is important to understand the events

that precipitated it.



The chain of events that led to the global economic crisis are outlined in figure . The resulting

global economic downturn led to a vicious cycle of companies failing or downsizing, thus

leading to unemployment, which further reduced demand for goods and services. In addition,

banks across the globe retrenched and in place of the liberal lending practices credit

tightened across the board. Governments stepped in with fiscal supportthe likes of

which has never been seen in modern recorded history. And now, everyone waits to see

what will happen with this never-before-tried experiment of flooding the world markets

with government money.

Rates on home

mortgages increase;reinancing becomesdiicult

Market mortgage

bonds increase

More banks dispose

of assets, reduce

liquidity

Major inancial

institutions ilefor bankruptcy;a crisis of

conidence ensues

Interest rates rise

Major Europeancommercial banks

feel the pain

Production and

consumption indevelopedcountries decline

Commodityprices fall

Source: A.T. Kearney analysis

Figure

Economic crisis: The timeline and chain of events

Mortgage

bubble in U.S.

real estate

market

Mortgage

crisis

Financial

sector crisis

Liquidity crisis Recession

in developed

markets

U.S. mortgagemarket bubblebursts

U.S. home pricescontinue to decline,affecting constructionsegment

Fed raises interest

rates to cool theU.S. economy

July JulyAugust AugustSeptember September October

Interest rates rise;borrowers areunable to reinancedebt

Borrowers defaulton mortgage loans

Banks stuck inmarket with

declining collateral

Mortgage assetsare re-evaluated,causing majorbankruptcies(Lehman Brothers,

Merrill Lynch,Wachovia)

Stock marketcollapses

Internationalcapital marketshit by liquiditycrisis

Loan rates increase

Financial instit-utions and corpor-ate borrowers

cannot reinancedebt

Funding diicultiesforce many comp-anies to reducecosts

Companies cutproduction and

workers

The real economy

falls

What happened? Why did everything turn so bad so fast when it looked like the good times

would go on unabated and it appeared that the very predictable five- and -year recession

cycle had been overcome?

Different people like to point fingers at different culprits. Some experts put the blame on creditdefault swap instruments that were sold worldwide with promises of high returns and low risk.

Others blame those who promoted mortgage access to people who normally would not qualify

for a housing loan. But we believe that the issue is more fundamental: The worlds financiers lost

sight of the requirement to manage risk effectively and, in many cases, it is questionable if the

basics of risk management were ever put in place.



A Banks BusinessThe core business of a bank is to manage risk and provide a return to shareholders in line with

the accepted risk profile. The credit crisis and ensuing global recession seem to indicate that

the banking sector has failed to tend to its core business. If it had done so effectively, then

credit default swaps would not have been bought up with so much eagerness. If the banks had

attended to risk management, then there would not have been the flood on the U.S. market of

cheap short-term interest rate mortgages that led to the so-called housing bubble and the

ultimate wave of personal bankruptcies and home foreclosures.

A.T. Kearney believes that the framework for risk management in a bank is fundamentally no

different today than it was prior to the credit crunch and recession. Indeed, the risk function

lacks a certain business acumen, and continues to be considered a handbrake on growth.

Chief economists and their macro perspectives are still divorced from the banks own strategy

function. We believe that a return to managing risksnot ignoring them or believing they can

be passed offis the cure for the ailment that has hit the economy so hard. Let us therefore

review what we call The Seven Tenets of Risk Management to see why the paradigm has

neither been altered nor fundamentally changed in this new world order:

. Establish a Language System to Discuss and Categorize Risk

A risk manager is overheard at a recent intra-departmental meeting: The Basel II second pillar

requires that we focus on the ICAAP, and it is inherent that the board of the bank fulfill their

obligations in this respect and that sufficient oversight is provided by the SREP at which point

many of the participants have no idea what the risk manager is talking about, but they are tooafraid to ask questions so they nod their heads in polite agreement and hope no one will ask

them for their personal opinion.

This scene is played out all too frequently at many banks. Each function within a bank has its own

lingo and acronyms that are useful in the right format and context. Take them out of their natural

environment and they cause untold confusion and misunderstandings. It is incumbent upon risk

experts to translate risk issues into a language and terms that all interested parties can under-

stand, and it is the responsibility of the other functions to make the effort to understand.

. Develop a Big Picture View of Risk Exposure and Focus on the Most Important

Not all risks are created or end equally. Banks need to be mindful of credit, market, and operational

risks. Within the three main areas of risk, further stratification is embedded to allow for a compre-

hensive overall view of risk. Tools such as VaR (Value at Risk), Monte Carlo simulations, CFaR (Cash

Flow at Risk), stress testing, and others are applied to judge the level of risk and subsequently the

actions required to contain the risks. Yet within banks there is often a lack of tools and sophisti-

cation to keep pace with a rapidly changing set of products. At any point in time, one or more

risk elements may be more relevant than others, but the bank needs to know its risk framework

and monitor developments in real time to provide the right level of attention and action.

As a whole, Canadian banks seem to have fared better than banks in other countries. Canadian

banks in general steered away from the credit derivative craze, adopting a more conservative

approach as other banks were ambitiously buying the risky instruments. By taking the big

picture view, Canadian banks avoided a major melt down. According to a report by TD Bank:

There appears to be a more risk-averse culture in Canada running through government, the

public and banks. Canadian banks benefited from prudent and disciplined risk-management



practices, and higher capital ratios pre-crisis. The fact that Canadas major investment banks

were part of a large diversified financial services institution also played a role.

. Centralize Ownership of Process and Decentralize Decision Making

Risk management can be most effective when it is applied consistently across the banking

organization with policies and procedures developed by risk experts who have the training and

experience for their specific country, area, and client mix. It is incumbent upon front-line officers

to use the tools and processes to guide their daily inter-actions with customers. Interactions are

clear. Answers are given in a timely manner and the responses leave no ambiguity about what the

bank is able to do for its customer.

A good example can be drawn from banks in Central Europe pre- and post-privatization. Prior to

privatization and modernization, many banks had a decentralized business model and it was a

public secret that the branch managers made up the rules and profited handsomely from insuffi-ciently transparent business practices. This led to the failure of many banks in Central Europe. Post

privatization, the banks focused on centralizing key processes around risk and then decentralizing

decision making down to the branch level, with the knowledge that decisions would be made

within the centrally developed framework; this provided safeguards against unwanted risk.

. Drive the Process from the Top and Clearly Define Roles and Responsibilities

In the lead-up to the big bustthe credit crunchbanks were reporting record profits and the

leaders were receiving bonuses for relatively short-term results. It seemed that everybody wanted

in on the big profits and pay days, and little heed was given to people calling for curbing thegrowing risk profiles. The clear lesson: what the leaders in the organization do, not so much what

they say, is what defines an organizations behavior. Risk management in a bank is everyones

responsibility, not just the risk departments. Leadership must not only espouse a vision but also

behave in a manner consistent with it and demonstrate to employees that prudent risk

management is a cornerstone to success.

. Quantify Risk Exposure and the Costs and Benefits of Managing Risks

The warnings were everywhere, renowned financial experts were quoted almost every day: The

risks of credit derivatives are not quantified and nobody really knows how much is out there

and what will happen when contracts come due. We know now at least to this point what has

happened. Had individual organizations been looking appropriately at the risks of purchasing the

seemingly too-good-to-be-true derivative instruments, perhaps they would not have taken them

on with such zeal and the problem would have been more contained at the original source, which

was the overheated mortgage market in the United States. Consistent and rigorous assessment of

risk and quantification of the net benefits of appropriately dealing with the risk cannot be replaced

with promises of above-average returns with no knowledge of the potential downsides.

A recent article in Fortune may have said it best when describing Blackrock, the large money

management company.When instruments get complicated, do your homework. In fact, at

BlackRock, executives are constantly refining their models to stay one step ahead of the latest

funky financial product from Wall Streets wizards. The firms that design securitized products

are always conspiring against us with new, increasingly complex instruments, explains Rob

Goldstein, who oversees BlackRock Solutions, which leases an ultrasophisticated technology

1 TD Economics, Economic Notes, February , .

Inside the Trillionaires Club, Fortune, August , .



platform to clients and has a team that helps companies analyze and run their portfolios. Its our

mission to make sure they dont win. On behalf of the Federal Reserve, BlackRock Solutions is

managing troubled assets from AIG and Bear Stearns.

Even the most sophisticated models will not make an organization percent foolproof asBlackRock found when it misjudged the market for commercial mortgage-backed securities.

Regardless, strong and rigorous analytical capabilities will lessen the chance of failure.

. Embed IT Systems to Facilitate the Risk-Management Process

The value of IT appears to be increasing over time to banking organizations as the environment

grows ever more complexso there is no change in this variable in troubled times. However, the

IT value will be realized only if IT systems development is driven by user needs and not vice

versa. IT systems, if properly developed and used, can assist the company in risk management

by providing control and compliance monitoring technology, databases, market and industryresearch and analysis tools, and communication tools. These are all critical tools that assist in

the delivery of the required information to decision makers in the bank. This can happen if the IT

systems are developed with the users needs in mind.

. Embed a Risk-Management Culture

If a bank is serious about risk management, then it will be serious from the top down.

Leadership will espouse a culture of responsible risk management through its behaviors and

through the systems and programs it puts into place. In the run up to the financial crisis,

organizations talked about good risk management; however, few in leadership positionsespoused effective risk management, which is evident in the dismal failures in the financial

sector. A risk-management culture can be embedded in the organization through training,

communications and incentives (see figure ).

Source: A.T. Kearney analysis

Figure

Elements of a risk-management culture

Training

Develop formal training sessions.Corporate risk managementfacilitates training sessions with

representatives from business unitsand functions

Embed risk management thinking.Representatives share informationwith their colleagues in their ownareas via:

Online systems: representatives circulate training documents,

examples and lessons learnedCross-functional working

sessions: subject matter expertsdiscuss risk management ideas

and techniques

Communications

Discuss risk management status inmanagement review meetings

Involve all decision makers (from theBoard to individual business levels)in evaluating and monitoring risks

What risks do we face given our new initiatives?

What are the risk-beneittrade-offs?

How has our risk exposurechanged?

What actions do we need to take?

Ensure that risk-related discussionstake place regularly across business

units and the central riskmanagement function

Incentives andperformance guidelines

Increase accountability by deiningexplicit incentives and performancemetrics around risk management

Identify clear consequences ofcompliance and non-compliance

(pre- and post- event)

Incorporate speciic risk management

goals into performance evaluations,both for variable remuneration andpromotions



Goldman Sachs, although not currently popular among the general populace, nevertheless has

embedded a rich culture as noted in a Forbesarticle:

Still, the special moxie of Goldmans culture is to respond boldly and brilliantly to crises that

threaten the franchise, and move through them to higher ground, more resolute and innerdirected. This is a paean to its leadership This is due to the GS culture; the risk control officers

are treated as equal in authority to the risk takers. There is now a comprehensive effort to bolster

what GS calls the federationthe empowering of the firms support staff, those less glamorous

individuals once called back-office types. That description is banned under the new culture.

Recruitment, training, and compensation are conceived to create a band of brothers and sisters

honored for their contribution as much as some whiz kid trader or M&A banker. Smart. Very smart.

Putting a Ribbon and Bow around Risk ManagementBanks around the globe should review their risk-management practices with an eye toward

assessing whether or not they fulfill these seven tenets. A structured review of the banks

risk-management practices against these tenets will certainly provide a clear starting point

for improving risk management in areas that are found to be wanting. The regulators will

certainly impose new demands on the banking sector. A clear analysis can be the guiding

light and a pre-emptive initiative for implementation of sustainable improvements to risk

management that will secure shareholder returns over the short, medium, and long term and

appease regulators demands.

Above all, a firms leadership should behave the way it wants its organization to behave. Or, aswe stated at the outset of this article: if a bank is serious about risk management, then it will be

serious from the top down.

Authors

Ettore Pastore,partner, Milan

[email protected]

John Winkler,partner alum

Johan Kestens,partner, Brussels

[email protected]

3In Goldman Sachs We Trust, Forbes, July , .


7/7

A.T. Kearney is a global team of forward-thinking partners that delivers immediate

impact and growing advantage for its clients. We are passionate problem solvers

who excel in collaborating across borders to co-create and realize elegantly simple,

practical, and sustainable results. Since , we have been trusted advisors on the

most mission-critical issues to the worlds leading organizations across all major

industries and service sectors. A.T. Kearney has oices located in major businesscenters across countries.

Americas

Asia Paciic

Europe

Middle East

and Africa

Atlanta

Bogot

Calgary

Chicago

Dallas

Detroit

Houston

Mexico City

New York

San Francisco

So Paulo

Toronto

Washington, D.C.

Bangkok

Beijing

Hong KongJakarta

Kuala Lumpur

Melbourne

Mumbai

New DelhiSeoul

Shanghai

Singapore

Sydney

Tokyo

Abu Dhabi

Dubai

Johannesburg

Manama

Riyadh

A.T. Kearney Korea LLC is a separate and

independent legal entity operating under

the A.T. Kearney name in Korea.

, A.T. Kearney, Inc. All rights reserved.

The signature of our namesake and founder, Andrew Thomas Kearney, on the cover of this

document represents our pledge to live the values he instilled in our irm and uphold his

commitment to ensuring essential rightness in all that we do.

For more information, permission to reprint or translate this work, and all other correspondence,

please email: [email protected].

Amsterdam

Berlin

Brussels

Bucharest

Budapest

Copenhagen

Dsseldorf

FrankfurtHelsinki

Istanbul

Kiev

Lisbon

Ljubljana

London

Madrid

Milan

MoscowMunich

Oslo

Paris

Prague

Rome

Stockholm

Stuttgart

Vienna

WarsawZurich

Documents

Seven Tenets of Risk Management in Banking