Defining Success in Risk Management [RMA Journal, The]

Financial services leaders addressed two questions during an RMA chapter panel discussion this spring:

What do you mean by success at your enterprise and how does risk management contribute to that success?

Risk management is not purely about financial intelligence. In the future, perhaps in 40 years, risk management will be about "fused intelligence." It will consider risk systemically, recognizing that risk does not reside in one organization or one department of an organization. These predictions by Andrew Freeman, executive director of Deloitte Center for Financial Services, set the tone for the New York Chapter's senior leadership panel this past spring.

While the risk management journey has advanced considerably in the past 40 years, it's still far from Freeman's vision of the future. Three chief risk officers and the head of risk for banking supervision at the Federal Reserve Bank of New York joined Freeman in a discussion moderated by New York Chapter president Carl Adams, who asked the panel: How do you know when you're successful, and do your institutions understand Risk's contribution to the bottom line?

Hillary Ackerman, CRO, Goldman Sachs Bank, said shareholder satisfaction certainly is part of that definition. Running the business with a level of safety and soundness Managementthat makes the regulators and rating agencies comfortable is important, she noted, emphasizing, "The root of Goldman's success results from an embedded risk control mind-set that runs throughout our firm."

Goldman's enterprise view of risk management is all-encompassing and includes viewing macro events on a geopolitical level, an industry level, and a counterparty level. It includes a view of markets and their psychology as well as an understanding of the dynamics of all Goldman's businesses and making sure it has the infrastructure to assess the risks and monitor them. "Our enterprise view also requires that we understand the variables that can impact our businesses and that we change our views related to them," said Ackerman.

Martha Cummings, head of Risk, Banco Santander, said Risk and the businesses would describe success differently. "To Risk Management, success means we don't lose money and we make money. The businesses would say success means we make money and we don't lose money."

Those transposed definitions reflect the natural tensions that exist between the two groups, and it can be healthy tension, she said. "The goals are not necessarily different, but the order of success and priority is somewhat different at different times."

Risk management is part of the DNA of Santander, said Cummings, noting that Risk reports to the vice chairman and is completely separate from the business. "When I first 17joined Santander, I heard cheers erupting from an office, so I asked if someone had just scored a major deal. 'No,' I was told. 'We just got Risk's approval.' That was a cause for celebration. Winning the client was easy compared to getting Risk's approval."

Charles M. Trunz III, chief risk officer Americas, Bank of Tokyo-Mitsubishi, said his organization's success is linked to the vibrancy of Japan's economy. "My institution measures success on its ability to earn a return and service clients, but we also measure success in terms of our reputation, capital base, and liquidity base," he said. "If something happens to the safety and soundness in any one of those areas, it will negatively impact the country of Japan and its people."

Trunz explained that Risk Management at Bank of Tokyo-Mitsubishi approaches business as an advocate. "It's not a question of saying no, it's a question of saying how," he said. "We are in the business of taking risk. We need to measure, evaluate, and create a common denominator for risk so that we can measure it across the enterprise and against our economic capital."

Offering the regulatory perspective on success, Michael J. Alix, head of risk for banking supervision at the Federal Reserve Bank of New York, said, "Even if we are successful, we will be deemed by many to have been wrong because we will have pulled the punchbowl away before the party got out of control. Failure is pretty clear. Many in the public and private sectors believe we could have done a better job in the run up to the financial crisis.

"Success for institutions results from a sound business model and an effective strategy to execute it," Alix continued. "It means having the controls, analysis, assessment, and judgment to ensure that the risks are consistent with what the governing structure of the organization believes should be taken. It's not about minimizing risk; it's about having a clearly articulated risk appetite and being able to manage the institution within that appetite."

Underwriting Standards

The three banking panelists said a loosening of underwriting standards in the competitive loan market may be under way, but their firms are guarding against it.

Safer, perhaps, but the tremendous amount of liquidity in the marketplace is causing banks to chase after the same credits. "We're starting to see the spreads on those credits get a bit heady, particularly as we move below investment grade," said Trunz. "We have to be careful in how we price credit relative to economic capital."

Compliance and transaction-cycle control worry Trunz. 18Training around processes and procedures is costly but needed because of the regulators' zero tolerance for compliance violations. As institutions continue to expand products and locations, sound transaction-cycle controls become especially important.

"We have a little bit of a hiatus because management is focused on soundness, liquidity, and capital," said Trunz. "Our balance sheets are clean in terms of criticized assets, loan loss reserves, and stress tests. But going forward, we have to be careful about how we price credits, and how we invest in transaction systems. We have to think about the whole area of compliance because it's increasing in importance."

Risk Management Competency

The panelists from the New York Fed and Deloitte said institutions still have a long way to go in managing risk across the enterprise because their information technology does not support risk assessment. The risk infrastructure and data quality need to be at a higher level so regulators can make proper assessments.

"Certainly there are pockets inside of firms where there's good risk information and assessment," said Alix. "But understanding how those risks roll up across the enterprise is spotty."

Freeman believes the industry is entering a period of fundamental change, driven by the need to pull data quickly, easily, and regularly. He believes that regulatory-driven exercises such as stress tests, living wills, and resolution programs will transform the value of risk management within organizations, giving regulators a greater insight into how risk plays out systemically.

Bank of Tokyo-Mitsubishi has started a management training program within the risk management function. "We recognize that it takes years for people to get comfortable and understand the businesses," said Trunz. "You can't be an effective risk manager until you understand business strategy, business performance, and the aspects of each and every product. A background in operations or technology or accounting is also helpful."

Freeman agreed. "One of the things that will change profoundly is that people will realize how much risk lies in the operations and in the connections between transactions as they pass through the organization, and in the processes associated with the people around them," he said. "Ten or 15 years from now, we'll be thinking through the risks associated with transaction flows and their velocities. It will be a different way of thinking about risk and the collective ownership of that risk in the organization."

Ackerman said her organization thinks about risk on an integrated basis now. "Decisions have to be executed and managed properly so the infrastructure has to be in place," she said. "An understanding of the risks has to be articulated through documentation. The businesses have to understand the risk reports. Compliance plays a role; operational infrastructure plays a role. We all need at least a working understanding of the risk-decision process. It doesn't mean you need to be an expert, but you need to be conversant enough to ask the right questions."

The first challenge is to commit resources for staff development and then find the right mix of internal and external training, added Cummings. "Internal training has increased dramatically at Santander. We have the ability to take high-potential people and make them better at what they do." She noted that her organization is intensifying cross training of risk professionals within the various risk areas and in the businesses.

"It takes a pretty strong organizational commitment to build that kind of structure for organizational development," noted Cummings. "It's not for everybody. Not every real star in market risk will be capable of making the transformation to credit risk, but it's important to find those individuals who can."</p>

Cummings also recommended finding the time to be outwardly focused in nontraditional ways: "What is the chatter? What are the things that we should be looking at? What are the trends?"

Freeman agreed. "Some of the structures that we've created around the risk function actually stop us from doing precisely what risk management should be about-making decisions based on thinking and insights."

He also pointed out that, in the past few years, risk management has presented boards with reports that clearly communicate the institution's risk profile. "We're past the point where you take a 900-page report stuffed full of numbers and tell the board that's risk management. Today, the information we provide enables the board to have informed discussions about the institution's risk appetite and risk monitoring. That's a fundamental change in a very short period of time."

Current Gaps in Risk Management

Despite the advances, risk management remains an aspiration at many banks, a journey without an end. "The systems 19are never good enough. The data is flawed. And we don't have enough resources to do what we need to do" is a frequent lament, said Cummings. "Those problems have been with banks forever. We just have to do our best."

Illustrating her point, Cummings said that a new system, two years in development, can be obsolete by the time it's put in place. "The data is old the minute that it's put in," she said. "Information is more available than it has ever been, but the ability to know what is pertinent and what is true is more challenging today."

Reputation risk represents a gap because information travels quickly through social media, and it can ruin the reputation of a firm in a matter of seconds, regardless of whether it's true. "There are no easy answers," said Cummings. "You develop tactical solutions for these situations, but they are simply facts of life. It's an ongoing challenge."

Trunz said he continually worries about risk management gaps in five areas:

1. Accountability. It's critical that each function understands its accountability for each transaction.

2. Simplicity and dialogue. Risk officers must create a simplicity of dialogue and reporting so that everyone can understand the risk, or raise their hands and say, "We don't understand it."

3. Common denominators of risk. Whether it be economic capital or risk appetite, common denominators are needed as a basis for measuring risk.

4. Financial management. Client reporting or market risk financial reporting must include the cost of executing transactions. Gross revenues as well as at the total cost of a transaction should be considered.

5. Financial performance and compensation. These two items must be linked. Everything should be considered-from data quality and transaction-cycle control to the amount of credit risk, market risk, and operational risk the bank is taking.

Finally, Alix noted the challenges for risk managers in the new environment and pointed to banks' increasing investment in both people and information technology. "While the regulators will certainly be looking carefully at how efficiently and effectively institutions manage those investments, we don't want to measure an institution by how much it spends on IT and how many people it has in risk management," he said. "We want those investments to ensure that risk taking is well understood up and down the organization." v

Comments by the panelists reflect their views and are not necessarily the views of their organizations.

"One of the things that will change pr ofoundly is that people will realize how much risk lies in the operations and in the connections between transactions as they pass through the organization, and in the processes associated with the people around them."

-Andrew Freeman

Kathleen M. Beans is editor of The RMA Journal. She can be reached at [email protected].