Enterprise Risk Institutions Need to Better Understand Their Risk Appetite Jointly with Oliver Wyman, RMA recently completed research on institutional practices in determining risk appetite. Surveys of large and global banks in North America and Europe were conducted via interviews. The recent financial crisis highlighted, among other things, what happens when the amount and types of risk taken are not understood, communicated, or governed appropriately. An individual institution may be looked at as a microcosm of the system, and the effects are amplified when the system moves in unison. Therefore, it s necessary to have an appropriate risk framework in place at both the institutional level and across the system to help avoid at best and mitigate at worst the magnitude of future events. Sean Gladwell/ShutterStock Risk Appetite Workbook - Appendix - 39
Figure 1 Number of Institutions European View of Risk Appetite 25 20 15 10 5 0 Global U.S. Europe Region Both Wholesale Retail/ Consumer Focus * Role total is higher than the number of institutions surveyed due to multiple interviews at some institutions. Other Risk Exec Role* Proposed remedies are being discussed by regulators, lawmakers, industry consultants, and banks themselves. Many of these remedies are a function of a well-articulated risk appetite. The remedies most typically mentioned address: Increased capital levels and stronger liquidity positions. More disclosure and transparency of risk exposures and valuation of assets. Cultural reinforcement of what is an acceptable risk or way of doing business (and what is not). Compensation reform to avoid excessive risk taking. Oliver Wyman and The Risk Management Association recently completed industry-wide research on the state of expressing and using risk appetite in the banking industry. We conducted interviews with 19 large and global financial institutions to understand where they are in terms of defining risk appetite and implementing pragmatic risk-appetitedriven processes. Figure 1 provides further details on the institutions that participated in our research. According to Ken Chalk, interim RMA president and CEO, Oliver Wyman and RMA partnered in this important industry research to provide a framework and understanding of what risk appetite is and how it is being used. As the financial services industry recovers from the current economic crisis, senior management and board members must focus on their tolerances for risk taking. The results of this study will help institutions shape risk culture and governance structure for the future. Definition of Risk Appetite Risk appetite is the amount and type of risk that an institution is willing to undertake in pursuit of a desired financial performance. It should be grounded in an open and candid dialogue CCO CRO CFO at The heart of risk appetite is an understanding of how much risk is too much. Institutions with European headquarters take a much more analytical view of institutional risk a view aided by Basel initiatives and the common language of risk-weighted assets. It s also informed by the experience of several institutions that recall previous credit downturns with outcomes ranging from mild distress to near-death. European institutions face challenges similar to those of all financial institutions: specifically, how to implement a decision-making structure using imperfect information. However, they put much greater focus on defining the metrics to measure risk, building on the understanding that, if they wait for perfect data, many opportunities will be missed. Key Variables A strong risk framework must employ three key variables: 1. Leadership. 2. Culture. 3. Systems. Leadership is evident in setting the risk appetite of the institution. Tough decisions need to be made in regard to the level and types of risk the institution is willing to tolerate both on and off balance sheet. The board of directors and senior management must articulate to the various stakeholders and regulators the institution s risk expectations. A risk culture is vital to ensure that the decisions approved at the senior level are carried out in an appropriate manner. Senior line and risk officers who have managed through previous credit downturns can help remind everyone that the decisions made in good economic times must be able to withstand the downturns. A risk infrastructure that allows for the continuous monitoring of decision outcomes provides the metrics that management needs to report on application of the risk appetite. If a product seems to be straying from the approved risk profile, decisions must be made proactively. Institutions are in varying stages of approving and embracing a risk appetite framework. Regardless of the implementation stage they are in, institutions tend to have a common thread of underlying enterprise risk analytics, underpinned by an involved and engaged set of risk committees that benefit from senior business participation. Continued on page 41 40 - Risk Appetite Workbook - Appendix
Figure 2 Survey Results The survey results identified significant differences in actions regarding risk appetite across the capabilities/application grid Capabilities: What we have in place Holistic Fragmented Aggregation of all risk types across organization Full coverage businessunits and risk types Data constraints leading to credit focus Detailed RA statement Cascading risk metrics High-level RA definition Reactive Ivory tower Laggards Focus on monitoring/reporting of risk Little respect for risk at senior levels Evolving Basic stress-testing capability reported Active participation of Board Risk Committee Leaders Culture-driven Risk appetite defines behavior (comp, limits, policy controls ) Risk has cross-business strategic input Prospective Application: What we do with risk appetite Source: RMA and Oliver Wyman between the board of directors and senior management that revolves around such factors as business model aspirations, institutional principles, shareholder expectations, and core competencies. A comprehensive framework is required to effectively transmit board-level risk and return expectations deep into the institution. The tenets of risk appetite conveniently connect with many traditional activities: Credit origination and decision making. Risk-adjusted pricing. Limits and portfolio management. New-product introduction. Capital allocation. Compensation and incentives. To understand how institutions are faring in regard to defining and using risk appetite to manage their risk and business profile, a yardstick needs to be in place to determine where individual institutions fall in regard to implementation. One way to look at risk appetite is by using two dimensions: capabilities and application. The capabilities of an institution are measured by its investment in the infrastructure, analytics, and data that are required to accurately understand, measure, monitor, and act on risk-appetite-influenced strategies. The other consideration involves the application of risk appetite throughout the organization or, stated another way, the degree to which the views of risk appetite are embedded into the fiber of the organization. This assessment ranges from the relatively simplistic monitoring and reporting of risk all the way to the other side of the continuum, where one would find an integrated risk management approach that guides the behavior of the organization through a comprehensive array of control levers (for example, limits setting and risk-adjusted pricing) with a high degree of cross-functional communication and participation in aspects such as strategic planning, resource allocation, and targets setting. An institution s place on the risk appetite journey can be plotted along two dimensions (see Figure 2). Research Findings Two primary themes resonate from our research with large banks: There was a chronic under-investment in data, analytics, and resources dedicated to an integrated view of the businesses, aggregated enterprise-wide. There was a general lack of personal leadership on risk appetite, especially prior to the crisis. Full engagement of management, while improving, still requires a great deal Risk Appetite Workbook - Appendix - 41
of effort, especially as it relates to transforming expressions of risk appetite into a tangible direction for the organization. Despite the universal existence of some form of risk appetite statement and related procedures in place, a number of institutions failed to execute on their framework. Examples include: The inability to effectively manage down or out of concentrated risk exposures. Straying outside of acceptable geographic or product bounds. A diminished or compromised role for risk management. The transmission of risk appetite into key decisions remains a major challenge. Those at the top of the house must set high-level expressions of risk and see them percolate throughout the organization, influencing day-to-day decisions. Limits for credit risk and market risk are the most utilized metrics for communicating risk appetite. Stress testing and scenario analysis are emerging as pillars in expressing risk appetite, especially for liquidity management. Ultimately, the goal is to blend the corporate expression of risk appetite with a set of values, resulting in a strong and widespread risk culture. Most institutions appreciate that risk culture is vital to the effective deployment of risk appetite; in many respects, it is the catalyst that elevates risk appetite from a set of words and measures into something that is actionable. To effect this desirable outcome, it is critical for institutions to change the traditional line-of-business view of the risk function that is, as an adversary and/or as a compliance function to that of a shared view of risk (and return) as a key driver of strategy and decision making. While no one would claim to be perfect, there are some institutions that are well on their way and, in some cases, their investment translated into an advantage during the recent crisis. Those with a pragmatic cultural approach to risk appetite, driven by top management and acted upon by the line in concert with the risk function, seem to have performed better during the recent crisis. Those that were able to couple this type of approach with strong data and analytics also appear to have had a relatively stronger financial performance during the crisis. Those who were relatively poor at applying risk appetite fared the worst. Despite the increased focus on risk, resources to measure, monitor, and manage it are relatively scarce. The requirements for analysis and management within risk organizations are being increasingly and rapidly driven by: Greater sophistication of models and analytics. Increased need for quality communication between areas for example, risk and business, the board, and regulators. A holistic view of risk, typically via a dashboard or some Continued from page 39 Central to many of the institutions interviewed in Europe is a strong risk culture supported by senior business participation in committee structures. Cascade Methodology Focusing on global institutions having operations in many geographies, we found recognition of the need to improve upon a cascade methodology for global risk capacity (for example, ECap) into limits for lines of business (such as name, sector, etc.). Institutions are implementing this approach, but the allocation contains a fair amount of judgment and cannot be optimized and/or reallocated easily. Any efforts involving cascading metrics must be supported by both group risk management as well as the business units. One overarching view came from participants regardless of size, headquarters, or institutional focus: A strong governance structure and risk culture are necessary for the long-term viability of an organization. In summary, the following factors are necessary for a strong risk culture: Senior management involvement and accountability. Continuous monitoring. Knowledge of clients, products, and markets. Underwriting only the risks that are well understood (both average and tail risk). Integration of the risk philosophy into day-to-day business decisions. v other tool that allows for an aggregated and timely view of risk. Talent, within organizations and across the industry, remains critical, and people risk is viewed as an emerging concern for many institutions. Even with regard to basic credit training, institutions see a void in talent, and they plan to allocate resources to engage, retain, and train people. Where Do We Go from Here? To move forward, an institution might consider some of the following suggestions. All of the institutions in our survey, to varying degrees, do these things. Remember, it s a journey! 1. Seek board-level review of the current statement on risk appetite and scenario planning to explore conditions that might cause indigestion. If your institution doesn t have one, start the drafting process. 2. Determine where your institution is located on the capabilities and application chart and plot your course for moving to the upper-right leaders position. 3. Review mechanisms for transmission of risk appetite into 42 - Risk Appetite Workbook - Appendix
institutional behavior using top-down mechanisms with the limits framework as a starting point. 4. Integrate risk-adjusted metrics into bottom-up decision making via processes like performance assessment, compensation, target setting, and loan origination. 5. Concentrate on the data, but don t wait for perfection to use it. 6. Review risk reporting to ensure a balance between comprehensiveness and actionability. The pendulum today is shifting toward actionability through aggregating exposure to underlying risk drivers, George Morris, Oliver Wyman hedgeable risks, early warnings of changes in potential loss, and recently taken positions. 7. Integrate risk more comprehensively into the strategic planning process to promote an objective view of returns relative to risks, performance during an economic One of the lessons of the recent crisis is that CEOs and CROs who effectively transmitted their bank s risk appetite to those taking and managing risks outperformed the competition. downturn, potential business-model breakdowns, and infrastructure, cultural, and skills readiness to manage the risks. George Morris, a partner at Oliver Wyman, noted that a robust risk appetite can positively influence institutional performance. One of the lessons of the recent crisis is that CEOs and CROs who effectively transmitted their bank s risk appetite to those taking and managing risks outperformed the competition, he said. Our research into risk appetite practices provides practical guidance on what capabilities to build and how to apply them. It s not a cookbook, but there are valuable takeaways for board members, senior executives, and regulators as the industry works to improve credit, market, operational, and liquidity risk management. v For more information about the study results, please contact following partners at Oliver Wyman Financial Services: in North America, George Morris (george.morris@oliverwyman. com) or Melinda Sulewski (melinda.sulewski@oliverwyman.com), or in Europe, Middle East & Africa, Thomas Garside (thomas.garside@oliverwyman.com) or Simon Cooper (simon.cooper@oliverwyman.com). At RMA, please contact Mark Zmiewski, director at mzmiewski@r,ahq.org or Sue Wharton, associate director at swharton@rmahq.org. Risk Appetite Workbook - Appendix - 43