WASHINGTON - Despite huge investments of time and money, not to mention more than a little aggravation, a new survey shows the industry still is not managing risk on a comprehensive basis.
Enterprise-wide risk management came into vogue several years ago, with regulators urging banks to identify, measure, and manage a range of risks - including credit, market, operational, and liquidity - and then aggregate and correlate them across business lines.
But a survey conducted by the Risk Management Association, a professional organization in Philadelphia with 3,000 members, shows the industry still has plenty of work to do.
"You have a few people who are where you would hope to be, but there are quite a few with a long way to go," said Charles Taylor, the RMA's director of operational risk.
John M. Lane, the deputy director of risk management in the Federal Deposit Insurance Corp.'s division of supervision, said mergers and acquisitions have complicated adoption at some banks.
"The various approaches and the management systems that have been absorbed make it difficult to now have a uniform, automated system," he said in an interview Monday. "The money to fix that is competing with a lot of other things in the company," such as growth initiatives and further acquisitions.
But many banks are grasping the value of enterprise risk management, Mr. Lane said. "I think what the industry is coming around to realize is that by understanding and assessing and measuring and monitoring your risks in this fashion, the benefits can drop to the bottom line."
Thirty-one banks responded to the RMA's online survey, and 23 of them had more than $25 billion of assets. The 27-question survey asked banks to rank the reasons they are pursuing ERM. Regulatory pressure topped the list, followed by "business complexity" and "potential large exposure due to credit crisis."
The three biggest hurdles to implementation are a lack of data, the data's quality, and too few resources, according to the survey. Looking out 18 to 24 months, bankers told the trade group that they are most worried about enterprise risk management getting too complicated for senior management to understand.
Asked to rank the main benefits of enterprise risk management, four emerged - the ability to set a common risk culture; an improved understanding of risks and controls; the opportunity to identify and assess risk in total; and the ability to apply consistent policies and standards.
But bankers have high hopes. They told the RMA they expect enterprise risk management to improve strategic decision-making, support growth initiatives, and reduce losses over the next 18 to 24 months.
In an interview Monday, Mr. Taylor said many banks are focused on managing specific risks rather than taking a holistic approach. Bankers are still assessing ERM's benefits and the best ways to achieve them, he said.
"What does an ERM function add to managing each individual risk type well is something that the leaders in this area are working on right now. Should it all be under one roof? Is it just a coordination function? Should you bring together credit, market, and operational risk and have a big central bureaucracy? All that stuff is very fluid," he said.
"We don't yet quite know what makes good ERM, but I think we're still looking for that with a vengeance."
To that end, the RMA has formed a enterprise risk management council, which will meet for the first time Oct. 12 in Cincinnati.
"We feel we've got to help the industry extract some value from this concept - that's the goal of the council," Mr. Taylor said.
In its survey, the trade group asked banks to rate, from 1 to 7, where they are on a continuum ranging from "siloed" risk management and progressing to "aggregated," then "integrated," and finally true ERM, which the group described as "most major risk types are measured simultaneously, i.e., with correlation effects considered; with many of the processes automated and standardized."
The RMA did not provide the actual results for this question, but it summarized them by saying, "Participants indicated that they were closing in on an integrated approach."
But the results were skewed by small banks, the RMA said. According to Suzanne Wharton, a project manager at the trade group, the biggest banks all scored themselves at a 6 or a 7.
The RMA asked how bankers are learning enterprise risk management. Nearly 75% replied "on the job," and 55% said "reading" or external conferences. The response with the fewest replies: "In-house trainers."
Copies of the report are available online at www.rmahq.org/RMA/KnowledgeandTrainingCenter/StudiesandeTools.
