I. INTRODUCTION
1
Spurred by regulators, financial institutions have invested
significant resources in risk management over the last decade. An
actuarial statistical approach to estimates future losses based on past
experiences was used to create an illusion of control. Unfortunately,
markets are not actuarial tables. The magnitude of the error became
apparent once the crisis unfolded. For example, Citibank is VAR,
value at risk, at the end of 2007 was $190 mln. This means the
maximum it could lose over a 1 day period at the 99% confidence
level was $190 mln. Citi’s actual 2008 losses exceed $40 B. Other
institutions with similar experiences include Merrill, Wachovia and
Washington Mutual. These losses triggered massive shareholder value
destruction resulting in dilutive recapitalizations and replacement of
whole managements. Clearly, something is wrong with the current
state of risk management requiring a rethinking of the activity.
INTRODUCTION (continued)
2
Institutions had moved further out on the curve to maintain
normal income growth. Risk was deemed under control based on
the twin illusions of liquidity and risk distribution. In fact, rather than
distribute risk, they had concentrated risk. Liquidity evaporated
once their leveraged positions began losing value.
This article explores why this occurred and what can be
done to remedy the situation.
What is needed is to move risk
management away from a hyper technical, specialist control function
with linkage to creation. Instead, we need to move beyond risk
measurement to integrate risk into strategic planning, capital
management and governance. Enterprise risk management ERM,
provides the framework to integrate these functions.
II. CURRENT SITUTATION:
What happened?
3
The financial services industry suffers from over capacity and
product commoditization. This has pressured margins. Institutions
increased risk exposure to enhance nominal returns without increasing
shareholder value as reflected in Figure 1. They did those on both
sides of the balance sheets. Asset risk increased by taking tall risk
exposure inherent in many of the new products with option like
payoffs. For example, Merrill is one day VAR increased by almost 5
times from 2001 through 2007. Although as previously noted, VAR
has its problems as a precise risk indicator, it directionally seems
correct in this circumstance. On the leverage side, leverage levels
increase dramatically. This was largely accomplished by the large
scale use of off balance sheet vehicles.
In fact, the large scale
capital raising by banks serves as a proxy for the undercapitalized
or excessive leverage to asset risk at banks. In Merrill’s case, that
totals almost $32B in the first half of 2008.
CURRENT SITUTATION: What happened?
(Continued)
4
Flawed
risk
models
contributed
to
the
problem.
Overconfidence in the models created an illusion of control. Profits
were raising and the risk models failed to indicate any concern. The
models failed in several respects. First, they failed to consider debtor
behavioral changes.
Ordinarily, mortgages are reluctant to
jeopardize the homes by defaulting. Once they began viewing their
real estate as an investment, however, their behavioral changed
resulting in defaults once home prices fell below their equity in the
asset. Next, models risk is heavily dependent on data frequency and
availability. Thus, for new products with a limited history, the models
were useless. Finally, even if you have the data, models are based on
experience, not exposures. Just because something has not occurred
yet the exposure exists. This is particularly true when dealing large
scale event risks or “Black Swans”.
CURRENT SITUTATION: What happened?
(continued)
5
Perhaps, most concerning was the industry wide governance
breakdown. Directors were unaware of the risk implications of strategic
initiatives. For example, Stan O’Neil strategy to match Goldman and
become the market share leader required assuming billions of
additional risk. Essentially, he was making a franchise bet. This involved
a large increase in risk appetite without any consideration of negative
scenarios. Next incentive arrangements produced counterproductive
behavioral changes. Strong managers began exploring weak
governance. Incentives became short term and based on nominal
income with insufficient risk adjustments. Finally, risk monitoring was
hampered by faulty risk models, which failed to raise concerns until it
was too late.
The above factors illustrate that risk management has lagged
financial innovation. It has evolved into a ritualistic measurement and
prediction activity with little or no power to influence behavior.
CURRENT SITUTATION: What happened?
(continued)
6
Additionally, even within risk management, organizational
impediments exists. Individual risk functions tent to operate as
independent silos with little or no strategic connection. Additionally,
there is limited consideration of business models and market states
when evaluation transaction risks. Literally, it is failing to see the
forest because of the trees. What is needed is the integration of risk
into strategic planning, capital management and performance
measurement. This would combine business and risk considerations
into a single, whole-firm view of value creation.
VALUE IMPLICATIONS OF RISK
APPETITE CHANGES
Figure 1
7
Capital requirement
Alpha (value creation)
Efficient frontier
D
C
for business portfolio
Beta
Return
A = Current position
A
B = Value destruction–Uncompensated risk
B
C = Target position – no value change
D = True value creation
Zeta (value loss)
Risk
III. RISK STRATEGY FRAMEWORK
8
Financial institutions have invested heavily in risk management.
Yet, there is surprisingly little agreement concerning the value
proposition of risk management. Value is created on the left hand side
(LHS) of the balance sheet through investment decisions. The value of
risk is to ensure funding of the investment plan by maintaining capital
market access under all conditions. This entails maintaining a total risk
profile consistent with r?????? targets. This requiring balancing LHS asset
portfolio risk with right hand side (RHS) capital structure. Failure to do
so can under mind the institutions strategic position and independence.
Examples include Citi and Lehman.
Viewed as such, risk management is a capital structure decisions
linking strategy and capital levels. Risk management needs to support
the institution’s corporate strategy, which determines the risk universe
faced by the bank organization as outlined in Figure 2. Then, using
traditional underwriting, mitigation and transfer risk management
techniques, you determine those risks which the institution is competitively
advantaged to own and eliminate the reset. For example: local
III. RISK STRATEGY FRAMEWORK
(continued)
9
institutions have an informational advantage regarding evaluations
of local clients. Thus, they should retain such risk up to prudent
concentration levels. Alternatively, risks like interest rate risk, not be
held unless the institution possesses special information. Then, the
retained risk would be covered by capital consistent with a ratings
goal, most likely investment grade, to ensure capital market access
sufficient to fund the investment plan (see Figure 3). Viewed in this
light, risk management and capital can be seen as interchangeable
with capital being the cost of risk. In fact, risk management is
essential synthetical equity. Equally, capital can be seen as substitute
to risk management. The key is to avoid a mismatch between the LHS
and RHS of the balance sheet.
The overall institutional risk level is dependent on their risk
appetite – the level of risk the organization is willing to assume on
both sides of their balance sheet in the pursuit of their strategy. Risk
III. RISK STRATEGY FRAMEWORK
(continued)
10
appetite is a relative term among stakeholders. Usually aligned,
there are instances when management and stakeholder appetites
differ, usually leading to new management. Management risk
appetite is best expressed as a con???? as reflected in Figure 4. The
relevant risk constraint for most managers is being replaced.
Unfortunately, many financial held large amounts of risk in
which they had limited competitive advantages. This beta risk, while
increasing nominal income, failed to create shareholder value.
11
DRIVERS OF RISK MANAGEMENT STRATEGY
Figure 2
1
Business Model
Operating cash
flow forecast
volatility
Need for
financial
flexibility
Frequency
2
Corporate Strategy
Investment plan and
opportunities
Risk
management
strategy
US$
millions
4
Stakeholder
(Investors, Regulators
and Rating Agencies)
perspective
3
Financial structure impact
And Ratings target
Cost of financial flexibility
Adapted from T. Oliver Leautier, Corporate Risk management for Value Creation
(Risk Books, 2007)
Figure 3 Connect Capital and Risk
to Investment Strategy
12
Figure 3 Connect Capital and Risk to Investment Strategy
Risk and capital as inputs into strategic planning:
Choice of Markets with attractive economics in which
the organization enjoys a competitive advantage
Strategy
Which markets
Risk the organization is willing and able to accept in
pursuit of its strategy
Risk Appetite
How much risk
determines ?????
Risk Assessment
What type of
risks based on
??????
R/A level retention types capital buffer
Risks underwritten and retain comparative
advantage
Capital relative to Rating Agencies, Regulators and
Peers
Actual Physical Capital
Return capital to shareholders when actual capital
exceeds need, or raise capital when need exceeds
actual capital
Allocation to business units based on an economic
capital determination
Return on capital relative to cost of capital
total risk facing firm
risk appetite
risk to be transferred
net risk vs. capital need/level
Capital need
Capital Assessment
How much capital
do we need vs.
have?
Capital Plan
Capital
Assessment
Capital Allocation
??????
… and not just consequences
Risk Appetite Continuum
Figure 3
13
Risk Appetite Continuum
Figure 3
Profit / Loss Distribution
Probability
Profit Warning – National city
Rating Watch – Fifth Third
Dividend cut – Citi
Downgrade – Morgan Stanley
Raise capital – Merrill
Management replaced – Prince, O’Neil
Regulatory Action – Cease and Desist,
Memorandum of Understanding
Failure – Bear, Lehman, WaMu
-
0
+
Profitability
14
Regulators
CEO: Investment Strategy
Internal
Stakeholders
CFO
How much
Capital do
I need
Risk Appetite
External
Stakeholders
Reconciled by Board
Shareholders
CRO
What Risks
Do I
Retain
Agencies
Internal Risk Appetite
External Risk Appetite
Value
Creation
Asset
Portfolio
Capital
Management
Risk
Structure
Capital
Required
Capital
Structure
Capital
Availability
Economic
Capital
(Use)
15
The ERM Funnel – Figure 7
Risk Appetite
Strategy
Earnings
Ratings
Business Model
Strategic
Objectives
Annual Goals
Organizational
Culture
structure
Shareholders
Risk Identification
Risk Assessment
Risk Analysis
Risk Strategy
Infrastructure
P. Sobel, Auditor’s Risk Management Guide:
Integrating Audit and ERM (CCH, 2007)
16
Match Internal/External
Regulators
Risk Appetite
Not always in balance
olders
External
Stakeholders
Rating Agencies
External Risk Appetite
Return on
Risk
Value
Creation
Cost of
Capital
Assets
(Return)
Portfolio of
Enterprise
Risks
Risk
Structure
Capital
Required
(Risk)
Portfolio of
Capital
Resources
Capital
Management
Economic
Capital
(Use)
…You can lose money
Capital
Availability/
(Funding)
Capita
Struct
17
Figure 5
Asset Price Liquidity
Price
Time
18
DAR Control Framework
Asymmetric Information
Adverse selection-lack
information and chose
incorrectly
Moral hazard-lack
Information on Performance
Behavioral Bias
Optimism
Over confident
Illusion of control
DAR
Control
Internal: Board
monitoring
Incentives
Sanctions
External
Regulators
Market for
corporate control
19
Figure 8.
Product
Market
Conditions
Financial
Market
Conditions
Enterprise
Risk Management Program
II
III
Strategic Alignment
Management
Information
I
Governance
Value Proposition
Risk management Foundation
(Infrastructure – Systems)
Value Creation through Risk
Management not Minimization
Regulatory
developments
Economy
20
Figure 8
Risk Appetite Matched to Business Strategy
Risk Tolerance Matched to Risk Appetite
Captial Availability Matched to Risk Tolerance
Return on capital Matched to Cost of Capital
Figure 7
21
Firm and Its Environment
Environment
Regulation
Capital Market
Conditions
Firm/ERM
Governance
Risk Appetite
Strategy
Macro
Economy
Industry
Conditions
22
Figure 8
Adaptive Risk Management
Business
Complexity
A
A
B
C
B
C
Risk Management Maturity
Traditional Risk Management
Functionally Oriented
Risk Transfer and Avoidance Focus
ERM
Enterprise view
Coordinated
ER
Adaptive mechanisms, informed
by sensing capabilities
Aligned with strategic imperatives