Risk Management Survey Analysis

Transcription

1 Risk Management Survey Analysis April

2 RISK MANAGEMENT SURVEY ANALYSIS APRIL Via Fortuna, Suite 600 Austin, Texas

3 TABLE OF CONTENTS Background and Objective...5 Examination Climate Remains Challenging...5 What Keeps Compliance Staff Awake at Night...7 Common Risk Management Challenges...8 Outsourcing More Prevalent in the Northeast...9 Identity Theft...10 Does Asset Size Have Any Impact?...10 Trends in Risk Compliance...11 Final Conclusions...11 Appendices

4 Background and Objective Sheshunoff Consulting + Technology conducts periodic surveys of the banking industry that incorporate the viewpoints of both clients and non-clients. In the first quarter of 2008, we conducted a survey of banks in the eleven states that currently comprise our Risk & Compliance Services delivery regions. A total of 269 banks responded to this survey, which was conducted by telephone between March 10 and March 28, The purpose of the survey was to identify both continuing and emerging areas of concern within the risk management area of the banking industry. A complete tabulation of the results can be found at the end of this narrative. Examination Climate Remains Challenging For years, anecdotal evidence has suggested that the regulatory climate is tougher in the Northeast as compared to the Southwest. Our survey suggests there may be some truth to this observation, but the gap, if it indeed exists, may be narrowing. Only a scant 4% of respondents in the N.E. indicate that their last Compliance Exam had gotten easier, while 17% indicated it was more stringent, and 79% saw no change. In the S.W. 10% felt their last Compliance Exam was actually easier, 12% felt it was tougher, and 78% either had no opinion (RF/DK) or felt their exam experience had not changed. The results for Safety and Soundness Exams indicate a slightly more difficult examination process. In the N.E. only 3% indicated their last exam was easier, while 22% felt is was more difficult. In the S.W. 5% said their last Safety and Soundness Exam had been easier and 16% said it was tougher. 5

5 Both of these figures were higher than what the same respondents felt was the case with their Compliance Examination experience. The most revealing evidence can be seen in the respondent s answers to the question regarding the outcome of their last exam. Whereas 62% of responses in the S.W. indicated that their compliance rating stayed the same, 5% reported that their rating dropped as compared to only 1% reporting a drop in rating in the N.E. Conversely, 14% of the S.W. respondents and 20% of the N.E. respondents indicated that their ratings had actually improved. 6

6 What Keeps Compliance Staff Awake at Night There were no great surprises here. Staying on top of BSA/AML and the rapidly emerging Information Technology environment remains the top priority, with 96% and 93% of the respondents indicating they had performed risk assessments in these two areas in the last 18 months. Regulatory Compliance had come under scrutiny for 81% of the respondents and, somewhat surprisingly, 54% of those surveyed indicated they had completed an Enterprise-wide Risk Assessment in the last 18 months. Looking forward, no one should be surprised by the fact that BSA/AML (93%), IT (88%), and Regulatory Compliance (86%) remain high on the list of the primary risk related areas in the respondent banks. However, given the heightened awareness stimulated by the sub-prime mortgage meltdown, news headlines regarding Bear Stearns and Citi Group, and inflammatory, misguided reporting around the impact of these events on Community banking, it was no surprise that Commercial Real Estate was reported by 55% of the respondents as a potential area of emphasis in the coming year. Stress testing of the CRE loan portfolio was also identified as an emerging point of emphasis in 45% of the surveyed banks. 7

7 The issue of CRE loan stress testing appears to be a regional issue at the present time. In the N.E. 48% of the respondents indicated that they have some form of CRE loan stress testing program in place, while only 32% of the banks in the S.W. are testing. However, roughly the same percentage (18% in the S.W. and 21% in the N.E.) indicated that their regulators had recommended that they begin stress testing their CRE loan portfolios. Regardless, only 13% of the S.W. and 11% of the N.E. respondents indicated that they planned to implement CRE loan stress testing in the next 12 months. Our understanding of the examination climate indicates that many banks may be underestimating the level of emphasis examiners will be placing on CRE loan stress testing in the coming months. Common Risk Management Challenges Staff recruitment remains a potential issue for many banks. The respondents were equally divided, 33% indicated that they were not having any problems finding staff, while virtually the same percentage, 30%, indicated that they were having difficulties. When it comes to staying current on the rapidly changing IT and regulatory environments, 22% of respondents indicated that it was not difficult to stay up on IT and compliance regulations. However, 42% of the survey participants indicated that staying on top of IT was becoming difficult and 45% indicated the same for compliance regulations. Finally, whereas 25% of the respondents indicated they had no problems maintaining comprehensive written policies 8

8 and procedures, 43% reported that this was becoming increasingly problematic. Outsourcing More Prevalent in the Northeast In almost every category, Internal Audit, IT Audit, Compliance, and Loan Reviews, a slightly higher percentage of respondents in the N.E. indicate that they outsource these key Risk Management functions. In the Northeast, nearly one out of every two banks outsource, while only one out of three of the respondents in the Southwest utilize outsourcing as a means to stay on top of the Risk Management environment. 9

9 For those banks that do outsource, and who responded to the survey question, the most common reason given for outsourcing is that it provides enhanced access to the broad-based experience needed to stay current and safe. Given that staying current with regulatory changes and keeping up with changes in Technology were deemed two of the more difficult areas for the respondents to manage, the growth in outsourcing is not surprising. Identity Theft All banks will be required to have some form of Identity Theft program in place by November 1, 2008 to meet the regulatory compliance requirement. Nearly 89% of the survey participants indicated that they already have a plan in place to address this issue. We were a bit surprised by this response. In the interest of keeping the survey down to a manageable length, we did not ask any follow on questions around this issue. Therefore, we do not know whether these institutions have a full-fledged program already formed, or just have a plan in mind to get a program done. Does Asset Size Have Any Impact? According to the results, asset size has little impact. There was remarkable consistency across the majority of the responses. There were a few differences, however, and the gap in these responses was significant. The first area of variance is that 62% of banks over $200 million in asset size conducted an enterprise wide risk assessment in the last 18 months as opposed to only 48% of banks under $200 million. It would appear that as the span of control increases and as banks become more departmentalized, the need to periodically make sure that all the moving parts are in sync becomes more prevalent. 10

10 The other major difference is in the area of commercial real estate lending and loan stress testing. In the coming year 63% of banks over $200 million indicated that commercial real estate would become a significant risk management issue, whereas only 47% of banks under $200 million see this as an emerging concern. Not surprisingly, 50% of banks over $200 million see CRE loan stress testing becoming a point of emphasis and, although there does not appear to be a major difference from an examiner point of view, 50% of banks over $200 million indicated that they have already implemented CRE loan stress testing in the coming year as opposed to only 29% of banks under $200 million. However, it is on the radar screen for smaller community banks, 45% of the survey respondents indicated that they plan to implement CRE loan stress testing in the coming year. Trends in Risk Compliance Final Conclusions In our Risk Management practice we have noted that institutions of all sizes are concerned with ensuring that their Identity Theft program is broad enough. Until the examination procedures are released, this remains an unknown variable. Also, we have noted that banks regulated by the OCC appear to have had more pressure to actively risk assess and manage their commercial loan portfolio according to the CRE guidance issued in late 2006 (including stress testing it periodically) than institutions that are regulated by the other agencies. However, we have seen signs that the other agencies are stepping up their emphasis on CRE portfolio management. Other issues we believe are important include: BSA; it remains a major concern with more scrutiny now being trained on smaller, high risk institutions than in the past. Flood insurance regulations, FEMA issued a new flood guidance in 2007 which is just now being interpreted; new examination procedures will likely result RESPA, HUD has issued some drastic proposals that may be more likely to become final in the current environment In the current economic climate, with sub prime lending and mortgage abuse gaining so much press, we believe more regulations are on the way. In addition, existing regulations will be reinterpreted as the examiners gain field experience. Legislative involvement in issues like identity theft, overdraft programs, and mortgage reform will continue. Because bad news sells newspapers, we can count on the press to continue to misinterpret and exaggerate issues that really have little bearing on community banking. The bottom line is the regulatory climate will continue to be challenging and management in the banking industry will continue to search for ways to avoid problems before they occur. It is important to identify emerging issues before they become problems and seek out independent, knowledgeable advice. 11

11 APPENDICES 13

12 Risk Survey Consolidated Results Sample Distribution By State State Count % KS 49 18% LA 32 12% NM 16 6% OK 43 16% TX 14 5% CT 10 4% MA 48 18% ME 12 4% NH 10 4% NY 26 10% VT 9 3% Total % Primary Regulator Answer Regulator SW % NE % Combined % A FDIC 90 58% 73 63% % B OCC 36 23% 20 17% 56 21% C FRB 19 12% 2 2% 21 8% D OTS 9 6% 20 17% 29 11% Was your last Compliance Exam: A Easier 16 10% 5 4% 21 8% B Tougher 18 12% 19 17% 37 14% C About the same as the previous % 67 58% % exam D RF/DK 18 12% 24 21% 42 16% Was your latest Safety and Soundness Exam: A Easier 8 5% 3 3% 11 4% B Tougher 25 16% 25 22% 50 19% C About the same as the previous 98 64% 66 57% % exam D RF/DK 23 15% 21 18% 44 16% Sheshunoff Consulting + Technology A1

13 As a result of your last exam, did your Compliance Rating: A Increase 22 14% 23 20% 45 17% B Decrease 8 5% 1 1% 9 3% C Stay the Same 96 62% 63 55% % D DK/RF 28 18% 28 24% 56 21% On which of the following have you performed a risk assessment in the last 18 months (circle all that apply)? A Bank Secrecy Act/ Anti-Money % % % Laundering B Information Technology % % % C Compliance % 97 84% % D Enterprise-wide 83 54% 63 55% % E None 1 1% 0 0% 1 0% F Other 0 0% 0 0% 0 0% G DK/ RF 3 2% 0 0% 3 1% Is BSA Compliance still a major concern/issue at your bank? A Yes % % % B No 19 12% 10 9% 29 11% C DK/RF 2 1% 1 1% 3 1% During the next calendar year, which of the following Risk Management areas will be the primary focus at your bank (circle all that apply)? A BSA/AML issues % % % B Commercial Real Estate 83 54% 64 56% % C Information Technology % % % D Regulatory Compliance % % % E Loan Stress Testing 70 45% 50 43% % F Other 1 1% 0 0% 1 0% G DK/RF 2 1% 2 2% 4 1% A2 Risk Survey Consolidated Results

14 On a scale of 1-5, with 5 being the most difficult, rank the following Risk Management challenges at your bank? Attracting and retaining qualified staff Scale SW % NE % Combined % % 13 11% 37 14% % 20 17% 51 19% % 49 43% % % 21 18% 47 17% % 12 10% 34 13% Keeping up with changes in Technology Scale SW % NE % Combined % 1 8 5% 3 3% 11 4% % 23 20% 48 18% % 39 34% 95 35% % 39 34% 82 30% % 11 10% 33 12% Staying current with regulatory changes Scale SW % NE % Combined % % 2 2% 15 6% % 16 14% 43 16% % 38 33% 89 33% % 36 31% 73 27% % 23 20% 49 18% Maintaining comprehensive written policies and procedures Scale SW % NE % Combined % % 7 6% 28 10% % 18 16% 41 15% % 33 29% 82 30% % 37 32% 71 26% % 20 17% 47 17% Sheshunoff Consulting + Technology A3

15 Do you currently outsource any Risk Management functions (circle all that apply)? A Internal Audit 51 33% 53 46% % B IT (Information Technology) Audit 70 45% 54 47% % C Compliance 45 29% 44 38% 89 33% D Loan Review 51 33% 50 43% % E None Skip to Q % 52 45% % F DK/RF Skip to Q11 2 1% 3 3% 5 2% If you currently outsource, why do you do so (chose most applicable reason)? A To reduce costs 4 3% 10 9% 14 5% B Can t recruit or afford experienced 9 6% 7 6% 16 6% staff C To enhance access to broad-based 44 29% 31 27% 75 28% expertise D As a result of regulatory pressure 11 7% 8 7% 19 7% E Other 10 6% 5 4% 15 6% NULL 76 49% 54 47% % If you are not currently outsourcing, are there any that you may consider outsourcing in the next 12 months (circle all that apply)? A Internal Audit 4 3% 0 0% 4 1% B IT Audit 3 2% 1 1% 4 1% C Compliance 4 3% 0 0% 4 1% D Loan Review 4 3% 0 0% 4 1% E None % % % F Undecided 18 12% 12 10% 30 11% Has your Regulator recommended stress testing of your Commercial Real Estate loan portfolio? A Yes 28 18% 24 21% 52 19% B No 98 64% 68 59% % C DK/RF 28 18% 23 20% 51 19% A4 Risk Survey Consolidated Results

16 Does your Bank currently conduct stress testing on Commercial Real Estate Loans? A Yes Skip to Q % 55 48% % B No 74 48% 37 32% % C DK/RF 30 19% 23 20% 53 20% If not, do you plan to implement stress testing in the next 12 months? A Yes 15 13% 7 11% 22 12% B No 42 37% 26 41% 68 38% C Undecided 57 50% 31 48% 88 49% Total New regulations will require all banks to have an Identity Theft prevention program in place by November 1, 2008, do you have a plan in place to address this issue? A Yes % 99 86% % B No 13 8% 14 12% 27 10% C Undecided 1 1% 2 2% 3 1% Total % % Sheshunoff Consulting + Technology A5

17 2801 Via Fortuna, Suite 600 Austin, Texas