With all the attention in Washington being given to executive compensation, the credit cardholders' bill of rights, student loans, and the concept of a single banking regulator, the issue of risk management reform seems firmly stuck on the political back burner. Maybe it's just too complex. Certainly it doesn't fit comfortably into a sound bite. But unless regulators ensure that risk management becomes an integral part of banks' corporate culture, from the trading floor to the boardroom, the goal of preventing systemic failure may prove much harder to achieve.

While many large institutions are taking steps to strengthen their risk management protocols, few seem close to adopting the improvements recommended in the Group of 30's "Framework for Financial Stability" as a key to financial reform. These steps include: coordinating board oversight of compensation and risk management efforts, with a focus on balancing prudence and long-term returns with risk; board-level reviews to set risk policy; making sure risk management and auditing are fully resourced and independent, with the risk management component reporting directly to the CEO; and continually monitoring major counterparty risk exposures and reporting the results to senior managers, regulators, and the central bank.

Even if banks were to adopt them, adhering to the Group of 30's proposals would only partly mitigate the "effects of moral hazard risks in financial markets," says Charles S. Tapiero, director of the Gerstein-Fisher Research Center for Risk Engineering at NYU/Polytechnic Institute. Timothy A. Canova, professor of international economic law at Chapman University School of Law, says the reform of internal corporate processes would help, but do little to control overleveraging and asset market speculation without the regulation of "standards at the margin of lending markets." Tapiero and Canova believe risk management must also focus on long-term macro factors and be guided by regulators.

This approach is already working...in Canada. Long before the meltdown of the subprime mortgage and securitization markets, Canadian regulators drew some bright lines for the financial sector. They require minimum down payments for borrowers, and banned loans with balloon payments, negative amortization, and subprime Alt-A mortgages, for example. The Office of the Superintendent of Financial Institutions restricts banks to 23-to-1 assets-to-capital leverage, no matter how high their Tier 1 capital ratio.

For their part, Canada's banks have used stress testing to prove whether products meet their risk appetites. New products have to run a gauntlet of operational risk tests in the finance, compliance, processing, tax, reputational, and legal areas. Once they pass the vetting process and are marketed, new products get post-approval reviews to make sure they're performing according to expectations. Make no mistake; Canadian banks augment their risk management regimen with technical modeling. But they've also taken a qualitative approach.

Many institutions elsewhere relied too heavily on value-at-risk models, or VaRs, which variously mis-priced or ignored the risk inherent in securitized investments. The damage was magnified by the blurring of the line between the risk and revenue sides of the business.

International regulators encouraged overdependence on these models. The world's major banks turned to VaRs under the guidance of the 1996 Basel Market Risk Amendment. By the late 1990s, the VaR approach became the industry standard for evaluating risk — just in time for the surge in mortgage-backed securities. Basel I recommended VaR for measurement of market risk; and Basel II extended its use to analyzing institutional operating risk.

VaRs were sleek, fast, and data-driven, so how could they have been so wrong? The models miss too much, according to a report from the Deloitte Center for Banking Solutions, painting "an overly sanguine picture" during extended booms. And when it came to the financial derivatives the models were supposed to be analyzing, data points usually showed only an upward bias. Without a stress-testing dark cloud in the actuary formulas, the data was blind to the cyclicality of housing valuation.

There has been a discernable shift toward a more qualitative paradigm in the past 12 months, according to Kevin M. Blakely, president and CEO of the Risk Management Association. Some banks are starting to add financial risk expertise to the board level; some are making risk and revenue managers "equal partners on the front line." But many banks have not yet made risk appetite inseparable from the revenue side: "They need to able to increase pricing, reduce risk, or walk away" when products are out of bounds, says Blakely. Judicious guidance from the regulators might help pick up the pace.

Subscribe Now

Access to authoritative analysis and perspective and our data-driven report series.

14-Day Free Trial

No credit card required. Complete access to articles, breaking news and industry data.