-
For a company with such a good risk management reputation, JPMorgan Chase appears to have made some fairly fundamental mistakes regarding risk in its chief investment office, notes editor-at-large Barbara A. Rehm.
June 20
WASHINGTON — Banks hurt by the fallout from the financial crisis have made strides in addressing weaknesses in their risk management practices, but more work still needs to be done, according to a recent survey of global firms by Ernst & Young.
Over the last several years, institutions have taken steps to reassess their capital structure across businesses, used stress testing and put into place new models to spot potential risks and impacts on the entire organization. Boards have strengthened their influence on risk management practices at the firms, and the role of the chief risk officer has continued to expand.
But the survey, which involved 75 banks spanning 38 countries, including U.S. institutions like Bank of America, Wells Fargo and Citigroup, says that despite "impressive progress, there is still much to be done to change and fully embed new methodologies and processes."
"Risk appetite, which postcrisis emerged as a critical foundation of the risk management process, remains a key challenge for many firms," the report says.
Ernst & Young surveyed members of the Institute of International Finance through an online quantitative questionnaire and interviewed CROs and other senior risk executives from the largest global firms.
Firms greatly affected by the 2008 financial crisis said they now put more emphasis on risk culture. More than half said there was a "significant increase" of attention to the issue over the past year.
"Those of us who were the most seriously threatened by the 2008 meltdown have, of course, been highly motivated to rethink and improve our risk governance philosophy, processes and methodologies," said one CRO whose firm was hit hard. "As a consequence, we might be further along the curve with improvements than banks that were not impacted."
Rick Waugh, the vice chairman of the institute and president of Scotiabank, said it's clear that "strong risk management is not a choice, but a requirement."
"I do not know anyone in the industry who underestimates the challenges or who is complacent about these crucial matters," he said in a statement. "Many firms have learned lessons from the financial crisis and have introduced and will continue to introduce significant improvements. We believe that a considerable amount of progress has been achieved, but more [is] to come."
Still, such institutional changes, especially a change in culture at a firm, is often a difficult, long-term process, as one executive suggested. "I don't think any type of cultural journey in a company is every finished."
Most firms (57%) said they were making progress toward a strong risk culture, but the distance each institution must travel still varied. For example, only 21% of firms that were severely affected by the crisis believed they were close to achieving a strong risk culture.
Executives in the survey agreed on a number methods that could be used to improve progress on the risk culture at firms, including a commitment for a cultural change at the top of the organization; well-defined risk ownership roles and responsibilities; constant reinforcement of risk values and expectations; and reinforcing accountability.
"You have to make certain that there is 'consequence management' and that everyone knows he or she will be held accountable in their compensation and ongoing employment. If people breach the rules, they pay a heavy price," one CRO said.
Firms were also asked about how their risk appetite has changed over the past year. Risk management has become a top priority, but while many companies have made progress, significant flaws remain. Many firms continue to struggle to embed risk appetite throughout the business.
For some, risk appetite is a one-page high-level guidance system, for others it can be hundred-plus-page document outlining the limits for all types of risk. "Risk appetite has become central to how we run the institution," one executive said. "It takes time for people to buy into, but once you've gone over that hump, it is a very powerful tool."
Most bankers agreed that developing and implementing risk appetite guidelines is in effect a never-ending project.
The problem, some said, is that there is still not a clear, generally accepted methodology for the process. Others warned, however, that there shouldn't be a one-size-fits-all approach either.
Only 26% of firms indicated they had made good progress embedding risk appetite into the businesses. Even so, none of the firms felt confident they had achieved a "fully operational, fully integrated risk appetite framework across the firm."
A good 75% of firms said "effectively cascading the risk appetite throughout the organization and embedding it into its decision making" was the No. 1 challenge.
Executives reiterated that setting the tone at the top through the CRO is essential in governing risk appetite. "The business leaders must believe in what is on the piece of paper, and be able to articulate to their teams why it's on a piece of paper. Otherwise it doesn't work," one executive said.
Other critical factors included defining risk appetite and expectations; incorporating such efforts into business planning so that it's not viewed as a stand-alone effort; and tracking and reporting progress regularly. Only 37% of firms said risk appetite is largely incorporated into their day-to-day business decisions.
"How do you take a document which is by definition general, and practically apply it to the derivatives business or the trading or asset servicing businesses? It is not easy to do," one CRO said.
One of the positive changes that have taken place postcrisis has been increased involvement of boards in risk management and oversight. Fifty-seven percent of firms reported that the focus on risk has elevated and continues to remain high.
While 74% of those firms who were interviewed listed risk appetite as an area where the board was influential, only a little over half said their board was also involved in other key areas like liquidity, risk culture, compensation and reputational risk.
More than half of the CROs report directly to the firm's CEO; 24% report to both the CEO and the firm's risk committee.
Still, executives were cautious about the burdens of increased responsibility on the boards and the risk management committee.
"What a board member is asked to do today, and understand today, and goes through today with the management team is at a much more detailed level," one executive said. "The accountability of board members is much greater."
Such influence, executives suggested, could muddle the role of management and boards. "In extreme cases, you could create a shadow management team within the board, which would be a disaster," said one executive.
The survey also touched on banks' views on corporate governance, stress testing, capital management and Basel III. Executives said new regulations under Basel III, combined with the European debt crisis and continued market, macroeconomic and geopolitical volatility and instability, have created uncertainty.
"Basically, the business model is certainly being challenged by what is happening in the market, the regulatory environment and the political sphere," one executive said. "We are facing a significant challenge just to achieve technical compliance with the new rules and ratios, let alone reorient the institution for success."
Sixty-seven percent of firms in North America predict that new liquidity requirements under Basel III will have a significant effect on the cost of doing business.
Top management also argued there could be potential consequences as a result of the rules, including a decline in returns on equity, costs and leverage would have to be reduced, margins would have to increase and business models change.
"Basel III is taking a huge amount of board and senior management time to figure out what to do, and an enormous amount of employee time and money to implement," said one executive.
The top concern among the new requirements is compliance with the liquidity requirements, which pool funds for short- and long-term needs during a potential crisis.
As a result, institutions have undertaken several initiatives to review and adjust their business models. Part of that strategy for firms is deleveraging. About a third of firms said they were selling portions of their business or leaving businesses to minimize the impact of new capital and liquidity rules.
"How do you figure out how to comply with the liquidity coverage ratio? How do you deal with the net stable funding ratio? What are the changes we need to make to our business to manage all this appropriately? How can we do this on a cost-effective basis? These are the questions that are keeping us all awake at night," one executive said.
