after the storm a new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after...

31
After the storm A new era for risk management in financial services Sponsored by SAS

Upload: phunglien

Post on 08-Mar-2018

216 views

Category:

Documents


3 download

TRANSCRIPT

Page 1: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the stormA new era for risk management in financial services

Sponsored by SAS

Page 2: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 2009�

A fter the storm: a new era for risk management in financial services is an Economist Intelligence Unit report that explores the way in which risk management is changing at the world’s financial

institutions in response to the global financial and economic crisis. The report is sponsored by SAS. The author was Phil Davis and the editor was Rob Mitchell.

The Economist Intelligence Unit bears sole responsibility for the content of this report. Our editorial team executed the online survey, conducted the interviews and wrote the report. The findings and views expressed in this report do not necessarily reflect the views of the sponsor.

Our research for this report drew on two main initiatives:

l We conducted an online survey of 334 executives from around the world in March 2009. The survey included companies of a variety of sizes from the financial services industry. All respondents have a primary focus on risk management.

l To supplement the survey results, the Economist Intelligence Unit conducted a programme of qualitative research, comprising a series of in-depth interviews with industry experts.

We would like to thank the many people who helped with this research.

June 2009

About this research

Page 3: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 20092

A lmost two years since the financial crisis first emerged from the sub-prime mortgage business in the US, the repercussions continue to be felt. Despite unprecedented efforts by

governments, central banks and regulators, the cost to the global economy of the failure of the financial system will be huge, and felt over an extremely long period. According to the latest Financial Stability Report from the International Monetary Fund, global bank losses are likely to exceed US$4.1 trillion. In their efforts to bail out the banking system and deal with wider economic pain, public debt for the G20 countries will mushroom to more than 100% of GDP in 2014.

The way in which financial institutions identify, assess and manage risks continues to fall under intense scrutiny. The crisis has exposed the shortcomings of a whole host of risk techniques, and major soul-searching is now underway to ensure that the risk and controls functions in financial institutions will be more robust, authoritative and accountable in future. Regulators, too, are eyeing the risk capabilities of the industry carefully, and considering the systemic implications of certain approaches to manage risk more thoroughly.

In March 2009, the Economist Intelligence Unit conducted a global survey on behalf of SAS to assess how risk management is changing in the world’s financial institutions. The survey attracted 334 participants from across the financial services industry. The report that follows presents the highlights of those survey findings along with related additional insights drawn from industry experts and commentators. Key findings from this research include the following:

We are seeing an erosion of confidence and a retreat from risk. The survey reveals an industry that appears shell-shocked by the events of the past 18 months. There is limited confidence in the ability of financial institutions to increase revenues or profitability over the next year, while less than one-third of respondents say that they are seeing confidence returning to their business. This erosion of confidence is having a dramatic impact on the kind of business that financial institutions are willing to carry out, with a significant retreat to familiar, domestic business. More than two-thirds say that they expect a greater focus on domestic business over the next year, while less than one-third are increasing their focus on overseas developed markets, and just over one-third on emerging markets.

Executive summary

Page 4: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 20093

Transparency is a common theme to proposed reforms. Asked about the initiatives that they thought would be most beneficial to the financial services industry, respondents pointed to greater disclosure of off-balance-sheet vehicles, stronger regulation of credit rating agencies, and the central clearing for over-the-counter derivatives as being three among the top four that have the greatest potential benefit. Although these are wide-ranging initiatives, there seems to be a common theme across all of them – namely, the requirement for greater transparency and disclosure to facilitate the more effective management of systemic risk issues.

Reforms to risk management within institutions will be far-reaching and comprehensive. Just one-third of respondents think that the principles of risk management in financial services remain sound. In response to this, more than half of respondents say that they have conducted, or plan to conduct, a thorough overhaul of their risk management. Key areas of focus, according to respondents, are likely to be improvements to data quality and availability, the strengthening of risk governance, a move towards a firm-wide approach to risk, and the deeper integration of risk within the lines of business. Respondents say that the need for reform is being driven, in particular, by executive management, but regulators are also starting to apply the pressure.

Culture, expertise and data are the weak points in companies’ risk management. Asked about the barriers to improving risk management in their organisation, respondents point to poor data quality, lack of expertise and a lack of risk culture among the broader business as being the most significant. This theme of a lack of understanding between the risk function and the business certainly seems to be significant. Asked about the areas where communication most needs improvement, respondents point to the channels between the risk function and lines of business as requiring most attention. Elsewhere, just 40% of respondents say that the importance of risk management is widely understood throughout the company, suggesting that more needs to be done to embed risk culture and risk thinking more deeply in the institution.

Respondents lack confidence in the ability of supervisors to formulate the right response to the crisis. Just three in ten respondents are confident that policy-makers can formulate an effective response to the crisis. Regulators, in particular, are singled out as being a potential weak spot, with less than one-third rating their handling of the financial crisis as good or excellent (a lower proportion than for either central banks or governments). In terms of specific regulatory interventions, respondents are most confident in the ability of regulators to maintain overall stability of the financial system, with 53% expressing confidence here. Far lower proportions are confident in their ability to monitor credit ratings and prevent conflicts of interest (18%); secure the implementation of compensation policies that support long-term shareholder value (24%); or co-ordinate the work of regulators across borders (25%).

Page 5: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 20094

The business environment for financial servicesNo one working in the financial services sector will forget the near-collapse of the financial system in late 2008. Just as market participants during the oil shock of the early 1970s and the crash of 1987 were shaped by their experiences, so will be those who witnessed the stomach-turning events of last year.

Since those momentous times, there have been intermittent signs of recovery in the world economy and predictions of doom have become fewer and less frequent. Nevertheless, confidence is a fragile creature. Financial services firms are still reeling from events and are mostly gloomy over the outlook for the next 12 months. In an Economist Intelligence Unit global survey of 334 financial services executives, just one third expect a positive outlook for revenues and profitability, while one quarter expect a positive outlook for their share price.

One of the reasons for such pessimism is that globalisation, one of the key drivers of revenue for multinational firms, is now seen to be under pressure. Amid a breakdown in global systems and trade, there will be a much greater focus on domestic business, and 68% of market participants questioned say that they expect an increased focus on business in their home market. North American respondents, in particular, say they will be much more focused on domestic markets and much less on emerging markets than other regions.

Alan Keir, global head of commercial banking at HSBC, notes that the lack of trust across borders has become evident in everyday business. “Open accounts are working less and less well and old-fashioned letters of credit [where the bank acts as an insurer] are coming back into fashion,” he says.

This, of course, raises concerns about financial isolationism. Retrenchment to domestic markets is seen by many politicians and regulators as a way of containing risk, but in reality the opposite could well be true. The events of the early 1930s, when the adoption of restrictive trade policies exacerbated the Great Depression, are clear indicators of the dangers.

Revenue growth

Profitability

Share price

Relations with customers

Relations with investors

Capital adequacy

How do you currently rate the prospects for your business in the following areas over the next year?Rate on a scale of 1 to 5, where 1=Significantly positive and 5=Significantly negative. (% respondents)

10

9

5

13

7

15

36

35

47

32

40

32

24

25

26

11

14

15

8

7

6

1

4

3

24

24

16

43

35

36

1 Significantly positive 2 3 4 5 Significantly negative

Domestic market

Overseas developed markets

Overseas emerging markets

Over the next year, what change do you expect to the geographical focus of your organisation?Please rate on a scale of 1 to 5, where 1=Significantly greater focus and 5=Significantly less focus. (% respondents)

2

18

19

5263235

2133226

15292512

1 Significantly greater focus 2 3 4 5 Significantly less focus

Page 6: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 20095

Central bank in your country/Eurozone region

Government in your country

Regulators in your country

Your industry sector

Your business

Your management team

Your risk management function

How would you rate the handling of the financial crisis by the following stakeholders?Rate on a scale of 1 to 5, where 1=Very good and 5=Very poor. (% respondents)

9

7

7

4

10

15

13

34

28

25

24

42

46

47

31

28

30

37

33

27

30

22

27

24

26

13

9

7

4

10

14

9

2

4

2

1 Very good 2 3 4 5 Very poor

Trust in the rule-makers?A second reason why respondents may appear pessimistic about their future prospects could be that they generally lack confidence in the ability of regulators and governments to deal with the current situation. Indeed, just 29% believe that policy-makers can form an appropriate response to the crisis.

Central banks are generally believed to have handled the crisis more creditably than governments or regulators. Only one in five respondents thinks that industry itself has handled the situation well.

There is, however, very limited confidence in the ability of regulators to create a healthy, functioning rules-based system. One-quarter or fewer have confidence in the ability of regulators to co-ordinate their work across borders; put in place appropriate skills and expertise to keep pace with innovation in banking; monitor risks associated with the shadow banking system; monitor credit rating agencies; or mandate implementation of long-term oriented compensation policies.

Alan Greenspan, former chairman of the US Federal Reserve, says such expectations are, in any case, not realistic. “The important lesson is that bank regulators cannot fully or accurately forecast whether,

Maintain overall stability of the financial system

Co-ordinate work of regulatory bodies across borders

Put in place sufficient skills and expertise to keep pace with innovation in the banking system

Restore trust in the banking system

Monitor risks associated with shadow banking system

Require implementation of compensation policies that support long-term shareholder value creation

Monitor credit rating agencies and prevent conflicts of interest

Mandate greater disclosure from hedge funds

Implement effective guidance on liquidity management

Ensure that off-balance sheet vehicles are reflected in minimum capital requirements

How confident are you in the ability of the regulators in the country in which you are based to carry out the following initiatives?Rate on a scale of 1 to 5, where 1=Very confident and 5=Not at all confident.(% respondents)

14

4

4

9

5

3

3

4

7

5

39

21

26

34

23

21

16

25

35

31

28

38

33

37

32

36

32

34

35

37

15

27

25

17

28

28

35

23

19

19

4

9

12

3

12

12

14

14

4

7

1 Very confident 2 3 4 5 Not at all confident

Page 7: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 20096

for example, sub-prime mortgages will turn toxic, or a particular tranche of a collateralised debt obligation will default, or even if the financial system will seize up,” he says. “A large fraction of such difficult forecasts will invariably be proved wrong.”

Nevertheless, financial services firms do still put a great deal of trust and faith in rule-makers. More than half are confident in the ability of regulators to maintain the overall stability of the financial system, while 43% are confident in their ability to restore trust in the banking system.

An over-arching faith in regulators and other government agencies should not, however, supplant a thorough re-appraisal of the mistakes of the past few years. Indeed, a great many firms are now questioning their actions and examining whether their whole approach was flawed or whether just a few key aspects of their approach to risk were founded on unsound principles.

Have conventional risk measures failed?A highly sophisticated, globalised financial system has evolved over the past decade or so, with ever more participants using a proliferation of instruments and strategies. Despite the complicated nature of the system, the core belief persisted that the market knew best and where this proved not to be so, existing risk measures would over-ride instinct.

But doubts have, unsurprisingly, crept in and many market participants and stakeholders believe that existing risk measures have failed to some degree. Certainly this is what the survey reveals: less than one-third thinks, for instance, that the principles of risk management in financial institutions remain sound.

Peter Bernstein, founder of Peter L Bernstein Inc, an economic consultancy, says the doubts stem from the shocking events of the recent past. “Does history really tell us anything about what lies ahead? Relying on the long run for investment decisions is essentially relying on trend lines. But how certain can we be that trends are destiny? Trends bend. Trends break. Today, in fact, we have no idea where any trend lines might begin or end, or even whether any trend lines still exist.”

Harvard professor identifies six risk errorsMr Bernstein, however, is principally referring to general market events. For individual companies and markets, it may well be possible to pinpoint specific issues where risk measures failed. In the March 2009 edition of Harvard Business Review, René Stulz, professor of banking and monetary economics at Ohio State University, identifies six ways in which risk has been mismanaged. First, he says, there has been an over-reliance on historical data. The calamitous fall in asset prices and demand was unimaginable to anyone basing their thinking on post-war performance alone.

Second, narrow daily measures, such as value at risk—probably the single most important measure in financial services—have underestimated risks. The assumption behind a daily measure of risk is that action can be taken quickly (through an asset sale) to remove that exposure. But, as the current crisis has shown, this is impossible when markets seize up. Significantly, in the survey, one third of respondents think that tools such as VaR have been shown to be no longer fit for purpose.

Investment funds have perhaps felt the effects of the failure of such risk measures most keenly. Permal, the New York-based fund of hedge funds group, with US$21bn in funds under management,

Page 8: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 20097

says that some of its underlying funds were caught out. “VaR was widely estimated at 4-5% a month,” says Omar Kodmani, senior executive officer at Permal. ”This rose by factors of two and three in the fall of 2008, showing you can’t rely on absolute numbers. In other words, you can’t operate in a vacuum.”

Third, according to Prof Stulz, knowable risks have been overlooked. Managers who work in silos may appreciate the risks to which they personally are exposed. But they may not see how risks being run elsewhere in the business could affect them too.

It could be argued that credit risk – the risk measure most exposed by the devastation of CDO and CLO values – is a knowable risk that has been overlooked. For even though banks were buying and selling (and holding) billions of dollars of asset-backed instruments, there was little apparent will to assess the risks involved.

The problem stems, in large part, from the time when banks started to sell their credit risk on to third-party investors. Until the summer of 2007, most investors, bankers and policy-makers assumed that this evolution represented progress that was beneficial for the economy. In April 2006, the International Monetary Fund said that the dispersion of credit risk “has helped to make the banking and overall financial system more resilient”.

Bankers were happy to earn fees at almost every stage of the “slicing and dicing” chain and further benefited from regulators permitting them to make more loans. By early 2007, financial officers at the UK’s Northern Rock, for instance, estimated that they could extend three times more loans, per unit of capital, than five years earlier.

But many of the new products were so specialised that they were never traded freely. An instrument known as “collateralised debt obligations of asset-backed securities” was a case in point. Instead of being traded, most were sold to banks’ off-balance-sheet entities such as structured investment vehicles (SIVs) or left on the books. It was in this sense that credit risk was effectively overlooked by many banks.

Please indicate whether you agree or disagree with the following statements. (% respondents)

99372719

815233717

2522162512

133025258

514333413

516313612

28174231

1118243016

519283512

812203426

292920184

711223624

Strongly agree Slightly agree Neither agree nor disagree Slightly disagree Strongly disagree

The US government should never have repealed the Glass-Steagall Act

There needs to be a move away from the “originate-to-distribute” banking model and a return to old-fashioned, “buy and hold” banking

Regulators should intervene directly in compensation policies

The principles of risk management in financial services remain sound

The Basel II capital framework has been shown to be deficient

Risk measures such as VaR have been shown to be no longer fit for purpose

Not enough human judgment is being applied in risk management decisions

Risk management does not have sufficient authority in our organisation

Analytics have become too complex to assist in business decision making

Mark-to-market practices have exacerbated the financial crisis

It is not possible adequately to manage risk in financial services

We have relied too heavily on external providers for credit ratings

Page 9: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 20098

Fourth, concealed risks have been overlooked. Incentives have proved particularly dangerous in this regard. Some traders and lenders may have enjoyed taking risky decisions that, in the short term, appeared to be working out well for their organisations. But they had no incentive to report any downside risk.

Nassim Taleb, professor of risk engineering at New York University and the author of The Black Swan: The Impact of the Highly Improbable, explains the conflict. “Take two bankers. The first is conservative and produces one annual dollar of sound returns, with no risk of blow-up. The second looks no less conservative, but makes US$2 by making complicated transactions that produce a steady income, but are bound to blow up on occasion, losing everything. While the first banker might end up out of business, under competitive strains, the second is going to do a lot better for himself.” Prof Taleb says this mismatch between the bonus payment frequency (typically, one year) and the time to blow up (about five to 20 years) is the cause of the accumulation of positions that hide risk by betting massively against small odds.

Fifth, there has been a failure to communicate effectively. It is dangerous, says Prof Stulz, when risk managers are so expert in their field that they lose the ability to explain in simple terms what they are doing. The board may develop a false sense of security by failing to appreciate the complexity of the risks being managed.

Finally, risks have not been managed in real time. Organisations have to be able to monitor fast-changing markets and, where necessary, respond to them without delay.

Yet rapid and sophisticated responses are not necessarily an answer in themselves. Just under half of respondents (47%) think that analytics have become too complex to assist in decision-making, while almost seven in ten think that not enough human judgment has been applied in risk management.

Charles Beach, regulation and compliance partner at PricewaterhouseCoopers, says that while quantitative risk measures remain an important part of the equation, a balanced and more forward-looking approach, including the use of scenario-based assessments, should be developed to ensure that assumptions embedded in risk measures are continually challenged. “As the appetite for more aggressive risk-taking begins to return to the banking industry, those firms that have truly embedded risk management into the fabric of business decisions will garner a clear competitive advantage,” he explains. From the setting of strategy and risk appetite through to the execution and response to the changing risk profile, the terms “risk management” and “management” should be considered synonymous, he argues.

Regulators ignored key risk typesWhile few traditional measures have fallen completely out of favour, there is broad agreement that regulation has been highly deficient. Six out of ten respondents, for instance, agree that mark-to-market accounting practices have made the crisis worse. Meanwhile, just under a half of respondents (47%) think that the Basel framework has been shown to be deficient. What should be taken into account, however, is that Pillar 2 of the framework, which deals with the regulatory response to the rules on capital adequacy, had yet to be fully implemented when the crisis struck. Moreover, any assumption of its deficiency should be balanced against the variation in interpretation among domestic regulators of the framework.

Page 10: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 20099

Robert Mark, a board member at the US-based Professional Risk Managers’ International Association and chief executive of Black Diamond Risk, agrees. He says that the Basel framework ignored funding liquidity, which essentially led to the downfall of Bear Stearns. “Basel looked at market, credit and operational risk, but not at the controls on funding liquidity,” says Mr Mark. This encouraged many institutions to ignore this risk, or assign it a low priority.

Mr Kodmani, for one, says some hedge funds “fell short” on liquidity risk management. “There were no bids for a lot of instruments and the bid-offer spreads were meaningless. This meant the estimated value of portfolios did not work.”

Typically, banks have put risk into three buckets: market, credit and operational. This suggests that liquidity is not generally considered to be a separate risk. But other risk types have also been largely overlooked in financial services.

Steve Fowler, chief executive of the Institute of Risk Management, says that traditional banking risk measures are wrong-headed. “Operational risk, for a start, is an invented term,” he says. “It is seen as ‘everything apart from market and credit risk’ and therefore doesn’t really matter.” He argues that strategic risk is the key issue, whatever the industry. “In other industries, they look at business objectives and strategies and align risks to those objectives. Bankers need to talk in those terms too. Maybe there needs to be more cross-fertilisation between banks and other industries.”

Others argue that flexibility, rather than trying to identify the precise risk measure, is the critical issue. BankWest, the Perth-based bank that was bought by Commonwealth Bank of Australia last year, says there are no “right” or “wrong” models. “The important thing is to keep updating the models to reflect greater understanding,” says Ed Bradley, head of strategic risk analytics. “We monitor the performance of our models on a monthly basis. If the model deteriorates in predictive power, we recalibrate or rebuild the model.”

Over-reliance on rating agenciesJust as regulators are condemned for their lack of foresight, so ratings agencies are singled out for criticism. More than six out of ten respondents think that they have relied too heavily on external sources for ratings. Some have posited that the problem lies in the fact that rating agencies were never genuinely independent, but are essentially an arm of the same government that wished to see the expansion of home ownership. “Given that government-approved rating agencies were protected from free competition, they would not want to create political waves by rocking the mortgage boat, engendering a potential loss of their protected profits,” says US economist Stan Liebowitz.

Given that these conflicts of interest were well publicised, perhaps market participants ought to have been more wary. “Too few firms performed due diligence of their own,” says Mr Mark. “There was certainly an over-reliance on them.” They should be just one of many inputs, he argues.

Financial institutions acknowledge the need for risk reformA series of influential papers from 2008 highlight areas of complacency with regard to risk management in many firms and product areas. The Senior Supervisors Group, Financial Stability Forum, Institute of International Finance and Basel Committee all pointed to deficiencies in many financial institutions’ risk management practices.

Page 11: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 200910

Market participants themselves tend to agree with the criticism. Asked about the performance of their institution across risk categories, more than half think they are effective at managing regulatory risk, credit risk, liquidity risk, fraud and solvency risk. But they admit that their biggest weaknesses are in modelling risk and the ability to aggregate risks at a firm-wide level.

Pressure to improve risk management comes most forcefully – by a significant margin – from executive management, which has realised that inadequate risk measures from this point onwards could be fatal to their companies. Many are keen to bolster their capabilities. GRS, a consultancy, forecasts that, by the end of 2009, half of financial services companies will have a risk professional on the board, compared with only 12% in July 2008.

Mr Beach says that this is critical, since effective risk management starts with strategy. “Although aggressive risk-taking is currently out of favour, it will remain essential to value creation,” he explains. “Explicit definition of the firm’s risk appetite is a fundamental part of developing an effective strategy. How risk appetite is then cascaded into risk limits and risk-adjusted performance measurement is equally important to ensure that front-office decision-making is truly linked to strategy. Responsibility for risk management must lie primarily with the business, not over-relying on the risk function.”

Others argue that firms must go further than strong board representation. Mr Fowler says that while bank chief executives are no longer worried about losing their jobs for not taking enough risk and not keeping up with competitors, little will change. One alternative, he says, could be shareholder structures, one in which voting rights are conferred to long-term holders of equity only. “This group would have more influence on policy and is likely to have a longer-term view,” he says.

One thing is sure: tackling risk issues will be a high priority for the foreseeable future. The aspect of risk management that is likely to attract the most investment over the next 12 months is processes and

Credit risk

Market risk

Operational risk

Regulatory risk (eg, risk of non-compliance)

Economic capital

Modelling risk (risk of bad models)

Liquidity risk

Fraud

Solvency risk

Underwriting/actuarial risk

Ability to aggregate risk at firm-wide level

How would you rate the performance of your institution over the past year across the following categories of risk management?Rate on a scale of 1 to 5, where 1=Very effective and 5=Not at all effective.(% respondents)

18

11

11

21

13

8

20

19

22

10

9

36

36

41

41

37

26

40

35

36

25

29

26

28

31

27

28

38

22

28

27

30

35

11

16

14

8

13

17

12

10

6

10

19

27

28

12

12

53

75

24

44

54

222

36

1 Very effective 3 42 5 Not at all effective Not applicable

Page 12: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 2009��

policy. These types of incremental investment, however, are distinct from developing new approaches, which requires a great deal of thought, research and determination to really implement change.

New ideas and approaches to key risksGiven the weaknesses of some existing risk systems, there is likely to be less reliance in the future on off-the-shelf solutions, received wisdom and box-ticking behaviour in general. Many institutions have signalled that they are prepared to be radical and that they are even ready to welcome a substantial increase in regulation.

The survey findings reveal, for instance, that just under half of respondents think that the US should not have repealed the Glass-Steagall Act, which separated commercial from investment banking.

Michael Lafferty, chairman of the International Retail Banking Council, believes that they are on the right track. “Politicians and regulators may come to realise that far too much attention has been given to salvaging the failed universal bank model and not enough to finding a better retail banking model for the future,” he says. “That model should be the stand-alone and highly disciplined retail bank.”

Surprisingly, one-third even believes that regulators should intervene in compensation policy. However, Mr Greenspan is cautious about micro-management by regulators, arguing that regulators should allow the market to work, not impede or second-guess it. “In my experience, what supervision and examination can do is set and enforce capital and collateral requirements and other rules that are preventative and do not require anticipating an uncertain future.”

Regulatory body sets out key issues

The Institute of International Finance report summarises the key elements that firms should incorporate into their risk management practices:l Ensure that risk management does not rely on a single risk methodology and analyse group-wide risks on an aggregate basis.

Mr Beach agrees that developing an integrated view of risk across all risk types is essential. “A major challenge is to build a comprehensive, joined-up perspective of the bank’s risk profile across risk classes, products, counterparties and different dimensions of the portfolio such as geography and industry sector. Risk information flows should be improved. Risk reports provided to the board and senior management need to be capable of focusing on the firm’s current key risk issues rather than providing a torrent of data which cannot realistically be digested and used as a basis for effective decision-making.” Risk reporting should be embedded into day-to-day management reports rather than provided as a separate stream, he argues. Primary responsibility for this should lie with the business, supported by the risk function.

l Take into account the technical limitations of risk metrics, models and techniques, such as VaR.

Mr Fowler agrees that constant attempts to measure everything are doomed to failure. The logical conclusion of the process, he says, is to arrive at a single number – an exercise which would be meaningless. “Not everything that has value can be measured and not everything that can be measured has value,” he explains. “How can you numerically measure the long-term viability of a firm?”l Ensure that the appropriate governance structure that has been adopted and is actually implemented in managing day-to-day business.

Rating agencies are beginning to focus more on the quality of a firm’s enterprise risk management practices. For example, in 2008, Standard & Poor’s now reviews the quality of enterprise risk management as a new component in its reviews of credit ratings. Performing classical siloed risk management will only qualify as “adequate” in the new S&P model.

Mr Mark says the agencies would undoubtedly have had AIG in mind when they changed their methodology. “It was the AIG Financial Products area that created significant problems for AIG,” he says. “They were the ones who wrote all the CDSs. The other parts of AIG were essentially working well.”

Page 13: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 200912

Indeed, there are indications that regulators and policymakers, despite the political furore and public anger, are not likely to intrude on company structures or compensation models. The key issues, according to the Financial Stability Forum of national and international financial regulators, revolve around the integration of risks, the measurement of risk (four out of ten in the survey, incidentally, say they practice insufficient stress testing) and the lack of constant challenges to accepted methods in light of changing market conditions.

A new template for rating instruments?There are signs that the existing model for rating agencies could be starting to change. Independent rating agencies, such as Egan-Jones, are starting to penetrate the market as the inherent conflict of interest in the traditional model – where issuers pay for ratings and the agencies are rewarded on volume – is called into question. There are several drivers for a shift towards ratings paid for by investors rather than issuers, says Sean Egan, founding principal of Egan-Jones. First, the Securities and Exchange Commission now officially sanctions independent agencies, conferring credibility to companies like Egan-Jones. Second, US Congress may soon debate a bill that would hold rating agencies liable for misleading ratings due to problems with the models. Next, a series of whistleblowers have claimed that they were fired or demoted after refusing to raise a rating or expressing doubts over one. Finally, fiduciaries may be at risk if they rely on conflicted agents.

Mr Egan points to the potential competitive edge that banks and other investors can gain from independent ratings. “Our ratings on Lehman Brothers were three to four notches below the big three agencies just before it collapsed. Any money market fund using our rating would have known not to hold Lehman commercial paper at that time.”

Transparency is the key to all progressMany of the initiatives that respondents think would be most effective are related to transparency – for example, greater transparency in off-balance sheet vehicles and interventions around valuation are believed to be potentially effective.

But what does transparency actually mean? For Mr Mark, transparency means a firm having easy-to-understand policies and then communicating them clearly. “It is important to identify and disclose the biggest risks that the business faces,” he says. “It could be the top 50 and the board focuses on the top ten of these. The management committee perhaps focuses on the top 20. If something goes wrong, at least people will be smarter and wiser about the risks they are taking and can do more next time.”

Every strategy should have a projected measure of risk and return, he says, and then a firm can measure risk-adjusted performance. In addition, every mathematical model that can impact financials should have an independent group reviewing it. “If a strategy has been developed on the trading floor, it should have independent eyes to sign it off,” he adds.

In this sense, transparency is a prerequisite for good governance. And good governance is about quality of management. Perhaps the only way for an outsider or a stakeholder to distinguish between firms with good or poor risk management is by the quality of their people. “If an organisation has less

Page 14: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 200913

34

31

29

28

25

24

23

23

22

20

16

10

5

Greater disclosure of off-balance-sheet vehicles

Stronger regulation of credit rating agencies

Caps on leverage

Central clearing for over-the-counter derivatives

Expansion of regulatory oversight to other areas of financial services not currently regulated

Enhanced valuation processes for complex or illiquid assets

Increases to required capital reserves

Liquidity cushions

Enhanced disclosure around valuations

Reform of compensation systems (eg, bonus payment structures)

Greater clarity about where regulatory responsibilities lie

Supervisory colleges of cross-border regulators

Other, please specify

Which of the following proposed reforms do you think will be most beneficial to the financial services industry?Select up to three. (% respondents)

qualified and less well paid people with poorer career paths in the risk function than somewhere else, then I would certainly trust it less,” says Mr Mark.

The risk function demands “a voice”For measures to be effective, the risk function must be allowed to have a significant voice in the organisation. At present, just under half of respondents think that risk management does not have sufficient authority in their organisation.

This is, in part, a reflection of the personality types that tend to populate risk functions. Risk management recruitment consultants say that HR departments are asking them for candidates with stronger interpersonal skills who would have the courage and the influence to stand up to bullish colleagues. “It’s a problem, because people are either very good at numbers or they’re very good with people and to get someone with both is not easy,” says Dean Spencer from Barclays Simpson, a recruitment consultancy.

However, Mr Fowler argues that the function’s role within the business is as important as the type of people employed to discharge it. Its role should be to embed risk, he says, making sure that every individual has personal objectives linked to risk. This has rarely been the case in the past. “In banking, the risk function takes prime responsibility for dealing with risk, rather than for embedding risk management throughout the business and this surely can’t be a sensible approach. The key is risk awareness and creating a risk culture, not letting a single function deal with it as if it were a business line in itself.”

Implementing change – the process has already begunSome institutions have already established working groups – sometimes at board level – and have been

Page 15: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 200914

considering new and revitalised risk management ideas for some time. Others, meanwhile, are waiting to see how markets in general and their market in particular will evolve.

More than half of respondents say that their firm has either completed or intends to complete a thorough overhaul of its risk management post-crisis. Respondents from Asia-Pacific are most likely to have already conducted a thorough overhaul of risk management.

Liquidity – closing the black holeThe most common initiatives being taken to strengthen liquidity risk management – the black hole that was only discovered from the middle of 2007 onwards – are increasing liquidity buffers, strengthening information systems and improving co-ordination between the treasury function and lines of business.

Permal, for one, has strengthened its approach to liquidity. It has upgraded liquidity risks and put them on a par with market risk. It has imposed new standards and checklists, partly in response to investor demand. “Requests for liquidity reports have escalated,” says Mr Kodmani. “Investors want to know how quickly we can get out of hedge funds.” Permal has instituted guidelines on how much of its

Increasing liquidity buffers

Strengthening information systems

Improving co-ordination between treasury function and lines of business

Strengthening contingency funding plans

Strengthening liquidity stress testing capabilities

Conducting independent review of internal policies

Strengthening management of intra-day liquidity risks

Improving management of foreign currency flows

Other, please specify

We are not taking any steps at present

Don't know/Not applicable

48

45

44

38

37

31

26

23

3

5

8

What steps is your organisation taking to improve its management of liquidity risk? Please select all that apply. (% respondents)

32

21

27

12

5

3

We have already conducted a thorough overhaul of our risk management

We intend to conduct a thorough overhaul of our risk management, but have not yet completed it

We have made some minor changes to our risk management

We intend to make some minor changes to our risk management, but have not yet completed them

We do not intend to make any changes to our risk management

We are waiting to see how the market develops before deciding whether to review our risk management

Which of the following statements best describes your organisation’s current status with the review of its risk management in response to recent market events? (% respondents)

Page 16: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 200915

portfolio it can liquidate over one, three, six and 12 months. On the other hand, Permal is not adjusting its market models. It says that drawdowns in the last

quarter of 2008 were in line with expectations posited by its head of risk and within tolerance levels, given strong performance over the long term.

It is, though, looking more carefully at the operations and infrastructure of its underlying portfolio funds. “We always had requirements regarding operational monitoring of managers, who their counterparties are, the number of counterparties, the custodian and so on,” says Mr Kodmani. However, the checklist has been extended to all managers following the collapse of Lehman Brothers and the disintegration of the Madoff empire. “We are now both comprehensive and proactive, updating all files regularly.”

Firms get stressed – and target more stringent testingRespondents to the survey pointed to stress-testing as a particular area of weakness in their processes. The solutions that they are working on to improve in this area include increasing the severity of scenarios used, greater involvement of senior management and strengthening the link with decision-making.

Mr Mark says stress-testing is a common area of failure. “Superficial stress testing is not sufficient. It really has to be done in a smart way.” He typically runs eight stress tests when working with clients. Some are hypothetical and some are based on known scenarios. “In the hypothetical tests, I create a group of individuals from a company and they meet every two weeks. They consider what happens if energy prices rises, if interest rates fall, if forex moves. We look at the possible effects on strategic reserves, assets, strategies and so on.

BankWest, on the other hand, says that meaningful stress testing was always a facet of the risk process but only in the past few months has it received more visibility. “In an extended benign environment, to go to senior executives and ask them to consider a scenario where the property

48

39

36

36

35

27

25

19

1

10

12

Increasing severity of scenarios used

Increasing involvement of senior management in stress testing

Introducing or increasing frequency of ad hoc stress testing

Strengthening link between stress testing and decision-making

Increasing use of hypothetical scenarios

Increasing investment in data and IT infrastructure to enhance risk information

Introducing or increasing use of scenarios that take a firm-wide perspective

Introducing or increasing frequency of reverse stress testing (ie, working back from a plausible outcome)

Other, please specify

We are not taking any steps at present

Don’t know/Not applicable

Which of the following steps is your organisation taking to strengthen stress testing? Please select all that apply. (% respondents)

Page 17: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 200916

market drops 25% is a tough ask,” says Mr Bradley. “Now everyone is interested.” So for BankWest, overhauling risk management has applied less to systems and more to communication and integration of the systems into the strategic framework.

Data quality and availability are also being addressed by a large number of respondents to the survey. Some have seen that this is a key issue for many years, although few can have known that they were preparing for a financial downturn where data quality suddenly became a precious commodity. BankWest, for instance, has been investing heavily to improve its data quality since 2001, when meeting Basel requirements was recognised as a key performance indicator. At that time, it established a committee to monitor and improve data. “The impacts of this initiative are simple, yet critical from a risk perspective,” says Mr Bradley. The bank is rolling out a project, for example, to input data just once and have it populate the whole system, while the system also rejects illogical inputs stemming from human error.

Sometimes, meaningful change is little more than tightening up existing risk measures. BankWest says that it always discouraged 100% mortgage lending to retail customers, but occasionally waived requirements. This is now proscribed.

Obstacles to the new risk environmentRespondents to the survey consider the biggest barriers to improving risk management to be insufficient quality of data, lack of risk culture in the organisation and a lack of risk expertise.

Paul Strebel, the Sandoz Family Foundation Professor, says that lack of expertise is a recurring issue. “Boards dominated by professional board members, CEOs and former CEOs of other companies have failed dismally. They bring no industry expertise to the table, have little of their own wealth at stake,

41

33

29

28

27

24

24

22

19

11

8

8

2

Improving data quality and availability

Improving governance of risk

Developing “firm-wide” approach to risk

Embedding risk management within lines of business

Better and more sophisticated analytics

Improving communication and understanding between risk function and lines of business

Strengthening technology infrastructure

Linking risk management more closely with corporate performance

Building risk expertise at management level

Regulatory compliance (eg, with Basel II or Solvency II)

Recruiting experienced risk professionals

Training of existing risk professionals

Other, please specify

Over the next year, what do you expect to be the three key areas of focus in the management of risk in your organisation? Select up to three. (% respondents)

Page 18: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 200917

40

32

31

30

30

20

17

16

14

11

7

2

Insufficient quality of data

Lack of expertise

Lack of risk culture among broader business

Inadequate systems

Poor communication across organisational silos

Lack of investment

Insufficient data

Lack of authority for risk management

Lack of support among senior executives

Insufficient risk representation at senior management level

Insufficient risk representation at non-executive board level

Other, please specify

What are the three main barriers to improving risk management in your organisation? Select up to three. (% respondents)

are too easily identify with the CEO/chairperson and go along with an increasing concentration of power at the top. At the financial institutions with the biggest losses, the lack of industry expertise on the board was almost always associated with a dominant CEO and/or chairperson.”

Meanwhile, John Legrand, managing director of Europe, Middle East and Asia Pacific at Eagle Investment Systems, says that data, or lack of it, is the over-riding reason why risk systems fail to fulfil their purpose. “One of the significant reasons for executives’ lack of insight into their business, and their failure to understand the risks to which they were exposed, is the absence of a cohesive data management strategy.” He notes that when Lehman Brothers filed for bankruptcy in September, it took some buy-side firms weeks to establish their exposure. “But those firms with a centralised data management system integrated with their accounting system(s) were able to determine their exposure in a matter of hours.” He argues that there is a tendency for firms to think that, just by implementing a risk or performance system, they are gaining control and visibility. However, this is not the case if they fail to have control over the data that feeds these systems.

One reason for this gap is that data management does not always make it to the top of the pile in terms of funding for new technology. “Unfortunately, it is typically a crisis situation that causes firms to reassess their current strategies and look for ways to improve quality and prepare for other unforeseen obstacles,” says Mr Legrand.

Page 19: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

After the storm:A new era for risk management in financial services

© The Economist Intelligence Unit Limited 200918

I t is often only in times of crisis that genuine change does occur. Change is not merely desirable now, it is critical to firms’ survival and their ability to compete in a marketplace that will inevitably

become more rules-based and hence more complicated.The best firms with the brightest people embrace change. They will adapt and prosper in the new

environment. As we have noted in this report, confidence is currently low, and a lack of trust exists alongside a lack of self-confidence. There is a great deal of hand-wringing currently taking place in the industry, and soul-searching questions are now being asked. It is clear that some firms are asking themselves whether everything that they previously believed to be right, is actually wrong.

On closer examination it is evident that many of their risk processes were sensible, and even sophisticated, but sometimes poorly executed. At the same time, there have been some inexcusable omissions, such as the lack of focus on liquidity and a dearth of processes around compensation.

But those who argue that we are fighting a losing battle and that it is impossible to adequately measure risk are probably not going to prosper in the years to come. The truth is, firms need to improve what they do, not abandon their principles.

They are increasingly recognising the need for new ideas and approaches. They should strike while the iron is hot, and before old and inadequate ways become embedded again. Many firms have started the long haul already and are revamping, replacing and recalibrating systems and processes, despite the difficulties that cultural change confers.

Successful firms know that the answer to the big question of the past several months is not to take risk off the table. Without taking clever, calculated, controlled risks, no firm can be successful. Risk, in the final analysis, is not a function within a firm, it is the firm.

Conclusion

After the storm:A new era for risk management in financial services

Page 20: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

19 © The Economist Intelligence Unit Limited 2009

AppendixSurvey results

After the storm:A new era for risk management in financial services

Appendix: Survey resultsIn spring 2009, the Economist Intelligence Unit conducted a survey of 334 senior risk professionals from the financial services industry. Our sincere thanks go to all who took part in the survey. Please note that not all answers add up to 100%, because of rounding or because respondents were able to provide multiple answers to some questions.

Revenue growth

Profitability

Share price

Relations with customers

Relations with investors

Capital adequacy

How do you currently rate the prospects for your business in the following areas over the next year?Rate on a scale of 1 to 5, where 1=Significantly positive and 5=Significantly negative. (% respondents)

10

9

5

13

7

15

36

35

47

32

40

32

24

25

26

11

14

15

8

7

6

1

4

3

24

24

16

43

35

36

1 Significantly positive 2 3 4 5 Significantly negative

Domestic market

Overseas developed markets

Overseas emerging markets

Over the next year, what change do you expect to the geographical focus of your organisation?Please rate on a scale of 1 to 5, where 1=Significantly greater focus and 5=Significantly less focus. (% respondents)

2

18

19

5263235

2133226

15292512

1 Significantly greater focus 2 3 4 5 Significantly less focus

We expect business conditions to improve within the next 12 months

We have outperformed our peers during the financial crisis

We are seeing confidence returning within our business

We are seeing confidence returning to our investor base

We are seeing confidence returning to our customer base

We are confident that policy-makers can formulate an appropriate response to the credit crisis

Please indicate whether you agree or disagree with the following statements. (% respondents)

1221184010

714232927

82931247

102936215

93130265

123029236

Strongly agree Slightly agree Neither agree nor disagree Slightly disagree Strongly disagree

Page 21: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

20 © The Economist Intelligence Unit Limited 2009

AppendixSurvey results

After the storm:A new era for risk management in financial services

34

31

29

28

25

24

23

23

22

20

16

10

5

Greater disclosure of off-balance-sheet vehicles

Stronger regulation of credit rating agencies

Caps on leverage

Central clearing for over-the-counter derivatives

Expansion of regulatory oversight to other areas of financial services not currently regulated

Enhanced valuation processes for complex or illiquid assets

Increases to required capital reserves

Liquidity cushions

Enhanced disclosure around valuations

Reform of compensation systems (eg, bonus payment structures)

Greater clarity about where regulatory responsibilities lie

Supervisory colleges of cross-border regulators

Other, please specify

Which of the following proposed reforms do you think will be most beneficial to the financial services industry?Select up to three. (% respondents)

Central bank in your country/Eurozone region

Government in your country

Regulators in your country

Your industry sector

Your business

Your management team

Your risk management function

How would you rate the handling of the financial crisis by the following stakeholders?Rate on a scale of 1 to 5, where 1=Very good and 5=Very poor. (% respondents)

9

7

7

4

10

15

13

34

28

25

24

42

46

47

31

28

30

37

33

27

30

22

27

24

26

13

9

7

4

10

14

9

2

4

2

1 Very good 2 3 4 5 Very poor

Page 22: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

21 © The Economist Intelligence Unit Limited 2009

AppendixSurvey results

After the storm:A new era for risk management in financial services

Maintain overall stability of the financial system

Co-ordinate work of regulatory bodies across borders

Put in place sufficient skills and expertise to keep pace with innovation in the banking system

Restore trust in the banking system

Monitor risks associated with shadow banking system

Require implementation of compensation policies that support long-term shareholder value creation

Monitor credit rating agencies and prevent conflicts of interest

Mandate greater disclosure from hedge funds

Implement effective guidance on liquidity management

Ensure that off-balance sheet vehicles are reflected in minimum capital requirements

How confident are you in the ability of the regulators in the country in which you are based to carry out the following initiatives?Rate on a scale of 1 to 5, where 1=Very confident and 5=Not at all confident.(% respondents)

14

4

4

9

5

3

3

4

7

5

39

21

26

34

23

21

16

25

35

31

28

38

33

37

32

36

32

34

35

37

15

27

25

17

28

28

35

23

19

19

4

9

12

3

12

12

14

14

4

7

1 Very confident 2 3 4 5 Not at all confident

32

21

27

12

5

3

We have already conducted a thorough overhaul of our risk management

We intend to conduct a thorough overhaul of our risk management, but have not yet completed it

We have made some minor changes to our risk management

We intend to make some minor changes to our risk management, but have not yet completed them

We do not intend to make any changes to our risk management

We are waiting to see how the market develops before deciding whether to review our risk management

Which of the following statements best describes your organisation’s current status with the review of its risk management in response to recent market events? (% respondents)

Page 23: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

22 © The Economist Intelligence Unit Limited 2009

AppendixSurvey results

After the storm:A new era for risk management in financial services

Credit risk

Market risk

Operational risk

Regulatory risk (eg, risk of non-compliance)

Economic capital

Modelling risk (risk of bad models)

Liquidity risk

Fraud

Solvency risk

Underwriting/actuarial risk

Ability to aggregate risk at firm-wide level

Please rate the following issues in terms of the challenge they pose to your business.Please rate on a scale of 1 to 5, where 1=Significant challenge and 5=Not a significant challenge. (% respondents)

3105173135

158193928

815352814

11322292312

41017332510

8920292212

21214242821

3192822217

5272122178

21162218149

21221252911

1 Significant challenge 2 3 4 5 Not a significant challenge Not applicable

Credit risk

Market risk

Operational risk

Regulatory risk (eg, risk of non-compliance)

Economic capital

Modelling risk (risk of bad models)

Liquidity risk

Fraud

Solvency risk

Underwriting/actuarial risk

Ability to aggregate risk at firm-wide level

How would you rate the performance of your institution over the past year across the following categories of risk management?Rate on a scale of 1 to 5, where 1=Very effective and 5=Not at all effective.(% respondents)

18

11

11

21

13

8

20

19

22

10

9

36

36

41

41

37

26

40

35

36

25

29

26

28

31

27

28

38

22

28

27

30

35

11

16

14

8

13

17

12

10

6

10

19

27

28

12

12

53

75

24

44

54

222

36

1 Very effective 3 42 5 Not at all effective Not applicable

Page 24: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

23 © The Economist Intelligence Unit Limited 2009

AppendixSurvey results

After the storm:A new era for risk management in financial services

Increasing liquidity buffers

Strengthening information systems

Improving co-ordination between treasury function and lines of business

Strengthening contingency funding plans

Strengthening liquidity stress testing capabilities

Conducting independent review of internal policies

Strengthening management of intra-day liquidity risks

Improving management of foreign currency flows

Other, please specify

We are not taking any steps at present

Don't know/Not applicable

48

45

44

38

37

31

26

23

3

5

8

What steps is your organisation taking to improve its management of liquidity risk? Please select all that apply. (% respondents)

48

39

36

36

35

27

25

19

1

10

12

Increasing severity of scenarios used

Increasing involvement of senior management in stress testing

Introducing or increasing frequency of ad hoc stress testing

Strengthening link between stress testing and decision-making

Increasing use of hypothetical scenarios

Increasing investment in data and IT infrastructure to enhance risk information

Introducing or increasing use of scenarios that take a firm-wide perspective

Introducing or increasing frequency of reverse stress testing (ie, working back from a plausible outcome)

Other, please specify

We are not taking any steps at present

Don’t know/Not applicable

Which of the following steps is your organisation taking to strengthen stress testing? Please select all that apply. (% respondents)

Page 25: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

24 © The Economist Intelligence Unit Limited 2009

AppendixSurvey results

After the storm:A new era for risk management in financial services

41

33

29

28

27

24

24

22

19

11

8

8

2

Improving data quality and availability

Improving governance of risk

Developing “firm-wide” approach to risk

Embedding risk management within lines of business

Better and more sophisticated analytics

Improving communication and understanding between risk function and lines of business

Strengthening technology infrastructure

Linking risk management more closely with corporate performance

Building risk expertise at management level

Regulatory compliance (eg, with Basel II or Solvency II)

Recruiting experienced risk professionals

Training of existing risk professionals

Other, please specify

Over the next year, what do you expect to be the three key areas of focus in the management of risk in your organisation? Select up to three. (% respondents)

40

32

31

30

30

20

17

16

14

11

7

2

Insufficient quality of data

Lack of expertise

Lack of risk culture among broader business

Inadequate systems

Poor communication across organisational silos

Lack of investment

Insufficient data

Lack of authority for risk management

Lack of support among senior executives

Insufficient risk representation at senior management level

Insufficient risk representation at non-executive board level

Other, please specify

What are the three main barriers to improving risk management in your organisation? Select up to three. (% respondents)

Page 26: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

25 © The Economist Intelligence Unit Limited 2009

AppendixSurvey results

After the storm:A new era for risk management in financial services

47

21

8

5

5

12

2

Risk function and lines of business

Risk function and executive management

Risk function and finance function

Risk function and non-executive board

Risk function and treasury function

Within risk function (ie, between credit risk managers, market risk managers and operational risk managers)

Other, please specify

Between which of the following functions do you think that communication most needs improvement in your organisation? (% respondents)

We have not done enough to manage risk across organisational silos

We have not carried out sufficient stress testing

We have not done enough to aggregate risk at a firm-wide level

We have lacked technical risk expertise at a senior level in organisation

We have relied too heavily on external ratings

We have relied too heavily on risk models

We have relied too heavily on risk measures such as VaR

We have lacked technical expertise in the risk function

We have not used credit scoring and other models in the past

41

40

33

31

23

22

20

17

13

Which of the following statements applies to your organisation’s risk management over the past year?Please select all that apply. (% respondents)

Executive management

Regulators

Investors

Non-executive directors

Governments

Customers

Central banks

Rating agencies

Other, please specify

No one is currently exerting pressure

38

20

9

6

6

5

4

3

2

8

Which one of the following stakeholders is currently exerting greatest pressure on your organisation to improve risk management? (% respondents)

16

12

26

18

11

8

10

We have an ERM strategy that is well-formulated across the business and fully implemented

We have an ERM strategy that is well-formulated across the business, with a clear timetable for implementation

We have an ERM strategy in place but it is not well communicated across the business or between departments

We have an ERM strategy in place but it is not a fully developed concept and there is no clear timetable for implementation

We don’t have an ERM strategy in place but we plan to introduce one in the short-term

We have no plans to introduce an ERM strategy

Don't know/Not applicable

Which one of the following statements best describes your company’s approach to enterprise risk management (ERM)? (% respondents)

Page 27: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

26 © The Economist Intelligence Unit Limited 2009

AppendixSurvey results

After the storm:A new era for risk management in financial services

Internal risk management, methodology, processes, policy and organisation

Credit risk management

Operational risk management

Integrated risk management

Risk data infrastructure

Liquidity risk management

Asset and liability management

Business intelligence

Market risk management

Underwriting/actuarial risk

Anti money-laundering

Fraud

Other, please specify

19

1

16

13

10

9

9

6

6

5

2

1

1

In which one area of risk will your business invest the most in the next 12 months? (% respondents)

40

35

25

The importance of risk management is widely understood throughout the company

There is limited understanding but we are providing training to all employees to improve this

There is little understanding of risk management among employees other than those whose primary function is risk management

Which one of the following best describes the level of understanding of risk management within your business? (% respondents)

Page 28: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

27 © The Economist Intelligence Unit Limited 2009

AppendixSurvey results

After the storm:A new era for risk management in financial services

Please indicate whether you agree or disagree with the following statements. (% respondents)

99372719

815233717

2522162512

133025258

514333413

516313612

28174231

1118243016

519283512

812203426

292920184

711223624

Strongly agree Slightly agree Neither agree nor disagree Slightly disagree Strongly disagree

The US government should never have repealed the Glass-Steagall Act

There needs to be a move away from the “originate-to-distribute” banking model and a return to old-fashioned, “buy and hold” banking

Regulators should intervene directly in compensation policies

The principles of risk management in financial services remain sound

The Basel II capital framework has been shown to be deficient

Risk measures such as VaR have been shown to be no longer fit for purpose

Not enough human judgment is being applied in risk management decisions

Risk management does not have sufficient authority in our organisation

Analytics have become too complex to assist in business decision making

Mark-to-market practices have exacerbated the financial crisis

It is not possible adequately to manage risk in financial services

We have relied too heavily on external providers for credit ratings

26

26

24

11

8

5

North America

Asia-Pacific

Western Europe

Middle East and Africa

Eastern Europe

Latin America

In which region are you personally based? (% respondents)

Board member

CEO/President/Managing director

CFO/Treasurer/Comptroller

CIO/Technology director

Other C-level executive

SVP/VP/Director

Head of Business Unit

Head of Department

Manager

Other

5

16

8

3

10

25

6

11

12

5

Which of the following best describes your title? (% respondents)

About the respondents

Page 29: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

28 © The Economist Intelligence Unit Limited 2009

AppendixSurvey results

After the storm:A new era for risk management in financial services

Under $1bn

$1bn to $9.9bn

$10bn to $24.9bn

$25bn to $49.9bn

$50bn to $99.9bn

$100bn to $149.9bn

$150bn to $199.9bn

$200bn to $249.9bn

Over $250bn

21

17

10

7

7

5

4

4

26

What are your organisation's global assets in US dollars? (% respondents)

Business line

Group risk management

Finance

Credit risk management

Operational risk management

Market risk management

Compliance

Internal audit

Treasury

Other, please specify

18

16

16

12

8

7

4

4

2

11

What is your main functional role? (% respondents)

Retail banking

Corporate banking

Asset management/custodian

Investment banking

Private banking/wealth management

Capital markets

Broker/dealer

Trading

Life insurance

Mutual fund

Investment consulting

Private equity/venture capital

Real estate/leasing

Property and casualty insurance

Hedge fund

Pension fund trustee

Reinsurance

Stock exchange/trading system

Other, please specify

26

26

22

21

21

20

16

8

7

6

6

6

4

9

14

13

10

9

9

In which sub sector of financial services does your organisation operate? Select all that apply. (% respondents)

Page 30: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

Whilst every effort has been taken to verify the accuracy of this information, neither The Economist Intelligence Unit Ltd. nor the sponsor of this report can accept any responsibility or liability for reliance by any person on this white paper or any of the information, opinions or conclusions set out in the white paper.

Cover image - © Photodisc/Getty Images

Page 31: After the storm A new era for risk management in financial ...graphics.eiu.com/marketing/pdf/after the storm.pdf · After the storm: a new era for risk management in financial services

LONDON26 Red Lion SquareLondon WC1R 4HQUnited KingdomTel: (44.20) 7576 8000Fax: (44.20) 7576 8476E-mail: [email protected]

NEW YORK111 West 57th StreetNew York NY 10019United StatesTel: (1.212) 554 0600Fax: (1.212) 586 1181/2E-mail: [email protected]

HONG KONG6001, Central Plaza18 Harbour RoadWanchai Hong KongTel: (852) 2585 3888Fax: (852) 2802 7638E-mail: [email protected]