After the storm a new era for risk management in financial services

© The Economist Intelligence Unit Limited 2009 After the storm: a new era for risk management in financial services is an Economist Intelligence Unit report that explores the way in whi

financial services

Sponsored by SAS

© The Economist Intelligence Unit Limited 2009



After the storm: a new era for risk management in financial services is an Economist Intelligence

Unit report that explores the way in which risk management is changing at the world’s financial institutions in response to the global financial and economic crisis The report is sponsored by SAS The author was Phil Davis and the editor was Rob Mitchell

The Economist Intelligence Unit bears sole responsibility for the content of this report Our editorial team executed the online survey, conducted the interviews and wrote the report The findings and views expressed in this report do not necessarily reflect the views of the sponsor

Our research for this report drew on two main initiatives:

l We conducted an online survey of 334 executives from around the world in March 2009 The survey included companies of a variety of sizes from the financial services industry All respondents have a primary focus on risk management

l To supplement the survey results, the Economist Intelligence Unit conducted a programme of qualitative research, comprising a series of in-depth interviews with industry experts

We would like to thank the many people who helped with this research

June 2009

About this research

Almost two years since the financial crisis first emerged from the sub-prime mortgage

business in the US, the repercussions continue to be felt Despite unprecedented efforts by governments, central banks and regulators, the cost to the global economy of the failure of the financial system will be huge, and felt over an extremely long period According to the latest Financial Stability Report from the International Monetary Fund, global bank losses are likely

to exceed US$4.1 trillion In their efforts to bail out the banking system and deal with wider economic pain, public debt for the G20 countries will mushroom to more than 100% of GDP

in 2014

The way in which financial institutions identify, assess and manage risks continues to fall under intense scrutiny The crisis has exposed the shortcomings of a whole host of risk techniques, and major soul-searching is now underway to ensure that the risk and controls functions in financial institutions will be more robust, authoritative and accountable in future Regulators, too, are eyeing the risk capabilities of the industry carefully, and considering the systemic implications of certain approaches

to manage risk more thoroughly

In March 2009, the Economist Intelligence Unit conducted a global survey on behalf of SAS to assess how risk management is changing in the world’s financial institutions The survey attracted 334 participants from across the financial services industry The report that follows presents the highlights

of those survey findings along with related additional insights drawn from industry experts and commentators Key findings from this research include the following:

We are seeing an erosion of confidence and a retreat from risk The survey reveals an industry

that appears shell-shocked by the events of the past 18 months There is limited confidence in the ability of financial institutions to increase revenues or profitability over the next year, while less than one-third of respondents say that they are seeing confidence returning to their business This erosion of confidence is having a dramatic impact on the kind of business that financial institutions are willing to carry out, with a significant retreat to familiar, domestic business More than two-thirds say that they expect a greater focus on domestic business over the next year, while less than one-third are increasing their focus on overseas developed markets, and just over one-third on emerging markets

Executive summary

© The Economist Intelligence Unit Limited 2009 3

Transparency is a common theme to proposed reforms Asked about the initiatives that they thought

would be most beneficial to the financial services industry, respondents pointed to greater disclosure

of off-balance-sheet vehicles, stronger regulation of credit rating agencies, and the central clearing for over-the-counter derivatives as being three among the top four that have the greatest potential benefit Although these are wide-ranging initiatives, there seems to be a common theme across all of them – namely, the requirement for greater transparency and disclosure to facilitate the more effective management of systemic risk issues

Reforms to risk management within institutions will be far-reaching and comprehensive Just

one-third of respondents think that the principles of risk management in financial services remain sound

In response to this, more than half of respondents say that they have conducted, or plan to conduct, a thorough overhaul of their risk management Key areas of focus, according to respondents, are likely

to be improvements to data quality and availability, the strengthening of risk governance, a move towards a firm-wide approach to risk, and the deeper integration of risk within the lines of business Respondents say that the need for reform is being driven, in particular, by executive management, but regulators are also starting to apply the pressure

Culture, expertise and data are the weak points in companies’ risk management Asked about the

barriers to improving risk management in their organisation, respondents point to poor data quality, lack of expertise and a lack of risk culture among the broader business as being the most significant This theme of a lack of understanding between the risk function and the business certainly seems to be significant Asked about the areas where communication most needs improvement, respondents point

to the channels between the risk function and lines of business as requiring most attention Elsewhere, just 40% of respondents say that the importance of risk management is widely understood throughout the company, suggesting that more needs to be done to embed risk culture and risk thinking more deeply in the institution

Respondents lack confidence in the ability of supervisors to formulate the right response to the crisis Just three in ten respondents are confident that policy-makers can formulate an effective

response to the crisis Regulators, in particular, are singled out as being a potential weak spot, with less than one-third rating their handling of the financial crisis as good or excellent (a lower proportion than for either central banks or governments) In terms of specific regulatory interventions,

respondents are most confident in the ability of regulators to maintain overall stability of the financial system, with 53% expressing confidence here Far lower proportions are confident in their ability

to monitor credit ratings and prevent conflicts of interest (18%); secure the implementation of compensation policies that support long-term shareholder value (24%); or co-ordinate the work of regulators across borders (25%)

The business environment for financial services

No one working in the financial services sector will forget the near-collapse of the financial system in late 2008 Just as market participants during the oil shock of the early 1970s and the crash of 1987 were shaped by their experiences, so will be those who witnessed the stomach-turning events of last year Since those momentous times, there have been intermittent signs of recovery in the world economy and predictions of doom have become fewer and less frequent Nevertheless, confidence is a fragile creature Financial services firms are still reeling from events and are mostly gloomy over the outlook for the next 12 months In an Economist Intelligence Unit global survey of 334 financial services executives, just one third expect a positive outlook for revenues and profitability, while one quarter expect a positive outlook for their share price

One of the reasons for such pessimism is that globalisation, one of the key drivers of revenue for multinational firms, is now seen to be under pressure Amid a breakdown in global systems and trade, there will be a much greater focus on domestic business, and 68% of market participants questioned say that they expect an increased focus on business in their home market North American respondents, in particular, say they will be much more focused on domestic markets and much less on emerging markets than other regions

Alan Keir, global head of commercial banking at HSBC, notes that the lack of trust across borders has become evident in everyday business “Open accounts are working less and less well and old-fashioned letters of credit [where the bank acts as an insurer] are coming back into fashion,” he says

This, of course, raises concerns about financial isolationism Retrenchment to domestic markets is seen by many politicians and regulators as a way of containing risk, but in reality the opposite could well be true The events of the early 1930s, when the adoption of restrictive trade policies exacerbated the Great Depression, are clear indicators of the dangers

Revenue growth Profitability Share price Relations with customers Relations with investors Capital adequacy

How do you currently rate the prospects for your business in the following areas over the next year?

Rate on a scale of 1 to 5, where 1=Significantly positive and 5=Significantly negative

(% respondents)

10 9 5 13 7 15

36 35 47

32 40 32

24 25 26 11 14 15

8 7 6 1 4 3

24 24 16

43 35

36

1 Significantly positive 2 3 4 5 Significantly negative

Domestic market Overseas developed markets Overseas emerging markets

Over the next year, what change do you expect to the geographical focus of your organisation?

Please rate on a scale of 1 to 5, where 1=Significantly greater focus and 5=Significantly less focus.

(% respondents)

2 18 19

5 26 32

35

21 33

22 6

15 29

25 12

1 Significantly greater focus 2 3 4 5 Significantly less focus

© The Economist Intelligence Unit Limited 2009 5

Central bank in your country/Eurozone region Government in your country

Regulators in your country Your industry sector Your business Your management team Your risk management function

How would you rate the handling of the financial crisis by the following stakeholders?

Rate on a scale of 1 to 5, where 1=Very good and 5=Very poor

(% respondents)

9 7 7 4 10 15 13

34 28 25 24

42

46 47

31 28

30 37

33 27 30

22 27 24 26 13 9 7

4 10 14 9 2 4 2

1 Very good 2 3 4 5 Very poor

Trust in the rule-makers?

A second reason why respondents may appear pessimistic about their future prospects could be that they generally lack confidence in the ability of regulators and governments to deal with the current situation Indeed, just 29% believe that policy-makers can form an appropriate response to the crisis.Central banks are generally believed to have handled the crisis more creditably than governments or regulators Only one in five respondents thinks that industry itself has handled the situation well There is, however, very limited confidence in the ability of regulators to create a healthy, functioning rules-based system One-quarter or fewer have confidence in the ability of regulators to co-ordinate their work across borders; put in place appropriate skills and expertise to keep pace with innovation in banking; monitor risks associated with the shadow banking system; monitor credit rating agencies; or mandate implementation of long-term oriented compensation policies

Alan Greenspan, former chairman of the US Federal Reserve, says such expectations are, in any case, not realistic “The important lesson is that bank regulators cannot fully or accurately forecast whether,

Maintain overall stability of the financial system Co-ordinate work of regulatory bodies across borders Put in place sufficient skills and expertise to keep pace with innovation in the banking system Restore trust in the banking system

Monitor risks associated with shadow banking system Require implementation of compensation policies that support long-term shareholder value creation Monitor credit rating agencies and prevent conflicts of interest

Mandate greater disclosure from hedge funds Implement effective guidance on liquidity management Ensure that off-balance sheet vehicles are reflected in minimum capital requirements

How confident are you in the ability of the regulators in the country in which you are based to carry out the following initiatives?

Rate on a scale of 1 to 5, where 1=Very confident and 5=Not at all confident.

(% respondents)

14 4

4 9 5 3 3 4 7 5

39 21

26

34 23

21 16

25

35 31

28 38

33

37 32

36 32

34

35 37

15 27 25

17 28

28 35 23

19 19

4 9 12 3 12 12 14 14 4 7

1 Very confident 2 3 4 5 Not at all confident

for example, sub-prime mortgages will turn toxic, or a particular tranche of a collateralised debt obligation will default, or even if the financial system will seize up,” he says “A large fraction of such difficult forecasts will invariably be proved wrong.”

Nevertheless, financial services firms do still put a great deal of trust and faith in rule-makers More than half are confident in the ability of regulators to maintain the overall stability of the financial system, while 43% are confident in their ability to restore trust in the banking system

An over-arching faith in regulators and other government agencies should not, however, supplant

a thorough re-appraisal of the mistakes of the past few years Indeed, a great many firms are now questioning their actions and examining whether their whole approach was flawed or whether just a few key aspects of their approach to risk were founded on unsound principles

Have conventional risk measures failed?

A highly sophisticated, globalised financial system has evolved over the past decade or so, with ever more participants using a proliferation of instruments and strategies Despite the complicated nature

of the system, the core belief persisted that the market knew best and where this proved not to be so, existing risk measures would over-ride instinct

But doubts have, unsurprisingly, crept in and many market participants and stakeholders believe that existing risk measures have failed to some degree Certainly this is what the survey reveals: less than one-third thinks, for instance, that the principles of risk management in financial institutions remain sound

Peter Bernstein, founder of Peter L Bernstein Inc, an economic consultancy, says the doubts stem from the shocking events of the recent past “Does history really tell us anything about what lies ahead? Relying on the long run for investment decisions is essentially relying on trend lines But how certain can we be that trends are destiny? Trends bend Trends break Today, in fact, we have no idea where any trend lines might begin or end, or even whether any trend lines still exist.”

Harvard professor identifies six risk errors

Mr Bernstein, however, is principally referring to general market events For individual companies and markets, it may well be possible to pinpoint specific issues where risk measures failed In the March

2009 edition of Harvard Business Review, René Stulz, professor of banking and monetary economics

at Ohio State University, identifies six ways in which risk has been mismanaged First, he says, there has been an over-reliance on historical data The calamitous fall in asset prices and demand was unimaginable to anyone basing their thinking on post-war performance alone

Second, narrow daily measures, such as value at risk—probably the single most important measure

in financial services—have underestimated risks The assumption behind a daily measure of risk is that action can be taken quickly (through an asset sale) to remove that exposure But, as the current crisis has shown, this is impossible when markets seize up Significantly, in the survey, one third of respondents think that tools such as VaR have been shown to be no longer fit for purpose

Investment funds have perhaps felt the effects of the failure of such risk measures most keenly Permal, the New York-based fund of hedge funds group, with US$21bn in funds under management,

© The Economist Intelligence Unit Limited 2009 7

says that some of its underlying funds were caught out “VaR was widely estimated at 4-5% a month,” says Omar Kodmani, senior executive officer at Permal ”This rose by factors of two and three in the fall

of 2008, showing you can’t rely on absolute numbers In other words, you can’t operate in a vacuum.”Third, according to Prof Stulz, knowable risks have been overlooked Managers who work in silos may appreciate the risks to which they personally are exposed But they may not see how risks being run elsewhere in the business could affect them too

It could be argued that credit risk – the risk measure most exposed by the devastation of CDO and CLO values – is a knowable risk that has been overlooked For even though banks were buying and selling (and holding) billions of dollars of asset-backed instruments, there was little apparent will to assess the risks involved

The problem stems, in large part, from the time when banks started to sell their credit risk on to third-party investors Until the summer of 2007, most investors, bankers and policy-makers assumed that this evolution represented progress that was beneficial for the economy In April 2006, the International Monetary Fund said that the dispersion of credit risk “has helped to make the banking and overall financial system more resilient”

Bankers were happy to earn fees at almost every stage of the “slicing and dicing” chain and further benefited from regulators permitting them to make more loans By early 2007, financial officers at the UK’s Northern Rock, for instance, estimated that they could extend three times more loans, per unit of capital, than five years earlier

But many of the new products were so specialised that they were never traded freely An instrument known as “collateralised debt obligations of asset-backed securities” was a case in point Instead of being traded, most were sold to banks’ off-balance-sheet entities such as structured investment vehicles (SIVs)

or left on the books It was in this sense that credit risk was effectively overlooked by many banks

Please indicate whether you agree or disagree with the following statements

(% respondents)

9 9

37 27

19

8 15 23

37 17

25 22

16 25

12

13 30

25 25

8

5 14 33

34 13

5 16 31

36 12

2 8 17

42 31

11 18

24 30

16

5 19 28

35 12

8 12 20

34 26

29 29

20 18

4

7 11 22

36 24

Strongly agree Slightly agree Neither agree nor disagree Slightly disagree Strongly disagree

The US government should never have repealed the Glass-Steagall Act There needs to be a move away from the “originate-to-distribute” banking model and a return to old-fashioned, “buy and hold” banking Regulators should intervene directly in compensation policies

The principles of risk management in financial services remain sound The Basel II capital framework has been shown to be deficient Risk measures such as VaR have been shown to be no longer fit for purpose Not enough human judgment is being applied in risk management decisions Risk management does not have sufficient authority in our organisation Analytics have become too complex to assist in business decision making Mark-to-market practices have exacerbated the financial crisis

It is not possible adequately to manage risk in financial services

We have relied too heavily on external providers for credit ratings

Fourth, concealed risks have been overlooked Incentives have proved particularly dangerous

in this regard Some traders and lenders may have enjoyed taking risky decisions that, in the short term, appeared to be working out well for their organisations But they had no incentive to report any downside risk

Nassim Taleb, professor of risk engineering at New York University and the author of The Black Swan:

The Impact of the Highly Improbable, explains the conflict “Take two bankers The first is conservative

and produces one annual dollar of sound returns, with no risk of blow-up The second looks no less conservative, but makes US$2 by making complicated transactions that produce a steady income, but are bound to blow up on occasion, losing everything While the first banker might end up out of business, under competitive strains, the second is going to do a lot better for himself.” Prof Taleb says this mismatch between the bonus payment frequency (typically, one year) and the time to blow up (about five to 20 years) is the cause of the accumulation of positions that hide risk by betting massively against small odds

Fifth, there has been a failure to communicate effectively It is dangerous, says Prof Stulz, when risk managers are so expert in their field that they lose the ability to explain in simple terms what they are doing The board may develop a false sense of security by failing to appreciate the complexity of the risks being managed

Finally, risks have not been managed in real time Organisations have to be able to monitor changing markets and, where necessary, respond to them without delay

fast-Yet rapid and sophisticated responses are not necessarily an answer in themselves Just under half

of respondents (47%) think that analytics have become too complex to assist in decision-making, while almost seven in ten think that not enough human judgment has been applied in risk management.Charles Beach, regulation and compliance partner at PricewaterhouseCoopers, says that while quantitative risk measures remain an important part of the equation, a balanced and more forward-looking approach, including the use of scenario-based assessments, should be developed to ensure that assumptions embedded in risk measures are continually challenged “As the appetite for more aggressive risk-taking begins to return to the banking industry, those firms that have truly embedded risk management into the fabric of business decisions will garner a clear competitive advantage,”

he explains From the setting of strategy and risk appetite through to the execution and response

to the changing risk profile, the terms “risk management” and “management” should be considered synonymous, he argues

Regulators ignored key risk types

While few traditional measures have fallen completely out of favour, there is broad agreement that regulation has been highly deficient Six out of ten respondents, for instance, agree that mark-to-market accounting practices have made the crisis worse Meanwhile, just under a half of respondents (47%) think that the Basel framework has been shown to be deficient What should be taken into account, however, is that Pillar 2 of the framework, which deals with the regulatory response to the rules on capital adequacy, had yet to be fully implemented when the crisis struck Moreover, any assumption of its deficiency should be balanced against the variation in interpretation among domestic regulators of the framework

© The Economist Intelligence Unit Limited 2009 9

Robert Mark, a board member at the US-based Professional Risk Managers’ International Association and chief executive of Black Diamond Risk, agrees He says that the Basel framework ignored funding liquidity, which essentially led to the downfall of Bear Stearns “Basel looked at market, credit and operational risk, but not at the controls on funding liquidity,” says Mr Mark This encouraged many institutions to ignore this risk, or assign it a low priority

Mr Kodmani, for one, says some hedge funds “fell short” on liquidity risk management “There were

no bids for a lot of instruments and the bid-offer spreads were meaningless This meant the estimated value of portfolios did not work.”

Typically, banks have put risk into three buckets: market, credit and operational This suggests that liquidity is not generally considered to be a separate risk But other risk types have also been largely overlooked in financial services

Steve Fowler, chief executive of the Institute of Risk Management, says that traditional banking risk measures are wrong-headed “Operational risk, for a start, is an invented term,” he says “It is seen as ‘everything apart from market and credit risk’ and therefore doesn’t really matter.” He argues that strategic risk is the key issue, whatever the industry “In other industries, they look at business objectives and strategies and align risks to those objectives Bankers need to talk in those terms too Maybe there needs to be more cross-fertilisation between banks and other industries.”

Others argue that flexibility, rather than trying to identify the precise risk measure, is the critical issue BankWest, the Perth-based bank that was bought by Commonwealth Bank of Australia last year, says there are no “right” or “wrong” models “The important thing is to keep updating the models

to reflect greater understanding,” says Ed Bradley, head of strategic risk analytics “We monitor the performance of our models on a monthly basis If the model deteriorates in predictive power, we recalibrate or rebuild the model.”

Over-reliance on rating agencies

Just as regulators are condemned for their lack of foresight, so ratings agencies are singled out for criticism More than six out of ten respondents think that they have relied too heavily on external sources for ratings Some have posited that the problem lies in the fact that rating agencies were never genuinely independent, but are essentially an arm of the same government that wished to see the expansion of home ownership “Given that government-approved rating agencies were protected from free competition, they would not want to create political waves by rocking the mortgage boat, engendering a potential loss of their protected profits,” says US economist Stan Liebowitz

Given that these conflicts of interest were well publicised, perhaps market participants ought to have been more wary “Too few firms performed due diligence of their own,” says Mr Mark “There was certainly an over-reliance on them.” They should be just one of many inputs, he argues

Financial institutions acknowledge the need for risk reform

A series of influential papers from 2008 highlight areas of complacency with regard to risk management in many firms and product areas The Senior Supervisors Group, Financial Stability Forum, Institute of International Finance and Basel Committee all pointed to deficiencies in many financial institutions’ risk management practices

Market participants themselves tend to agree with the criticism Asked about the performance of their institution across risk categories, more than half think they are effective at managing regulatory risk, credit risk, liquidity risk, fraud and solvency risk But they admit that their biggest weaknesses are

in modelling risk and the ability to aggregate risks at a firm-wide level

Pressure to improve risk management comes most forcefully – by a significant margin – from executive management, which has realised that inadequate risk measures from this point onwards could be fatal to their companies Many are keen to bolster their capabilities GRS, a consultancy, forecasts that, by the end of 2009, half of financial services companies will have a risk professional on the board, compared with only 12% in July 2008

Mr Beach says that this is critical, since effective risk management starts with strategy “Although aggressive risk-taking is currently out of favour, it will remain essential to value creation,” he explains “Explicit definition of the firm’s risk appetite is a fundamental part of developing an effective strategy How risk appetite is then cascaded into risk limits and risk-adjusted performance measurement is equally important to ensure that front-office decision-making is truly linked to strategy Responsibility for risk management must lie primarily with the business, not over-relying on the risk function.”

Others argue that firms must go further than strong board representation Mr Fowler says that while bank chief executives are no longer worried about losing their jobs for not taking enough risk and not keeping up with competitors, little will change One alternative, he says, could be shareholder structures, one in which voting rights are conferred to long-term holders of equity only “This group would have more influence on policy and is likely to have a longer-term view,” he says

One thing is sure: tackling risk issues will be a high priority for the foreseeable future The aspect of risk management that is likely to attract the most investment over the next 12 months is processes and

Credit risk Market risk Operational risk Regulatory risk (eg, risk of non-compliance) Economic capital

Modelling risk (risk of bad models) Liquidity risk

Fraud Solvency risk Underwriting/actuarial risk Ability to aggregate risk at firm-wide level

How would you rate the performance of your institution over the past year across the following categories of risk management?

Rate on a scale of 1 to 5, where 1=Very effective and 5=Not at all effective.

(% respondents)

18 11 11

21 13

8

20 19 22 10

9

36 36

41

41 37

26

40 35 36 25

29

26 28

31 27 28

38

22 28 27 30

35

11 16 14 8 13 17 12 10 6 10

19

2 7 2 8 1 1 5 3 7 5 2 4 4 4 5 4 22 2

3 6

1 Very effective 2 3 4 5 Not at all effective Not applicable

© The Economist Intelligence Unit Limited 2009



policy These types of incremental investment, however, are distinct from developing new approaches, which requires a great deal of thought, research and determination to really implement change

New ideas and approaches to key risks

Given the weaknesses of some existing risk systems, there is likely to be less reliance in the future on off-the-shelf solutions, received wisdom and box-ticking behaviour in general Many institutions have signalled that they are prepared to be radical and that they are even ready to welcome a substantial increase in regulation

The survey findings reveal, for instance, that just under half of respondents think that the US should not have repealed the Glass-Steagall Act, which separated commercial from investment banking Michael Lafferty, chairman of the International Retail Banking Council, believes that they are on the right track “Politicians and regulators may come to realise that far too much attention has been given

to salvaging the failed universal bank model and not enough to finding a better retail banking model for the future,” he says “That model should be the stand-alone and highly disciplined retail bank.”Surprisingly, one-third even believes that regulators should intervene in compensation policy However, Mr Greenspan is cautious about micro-management by regulators, arguing that regulators should allow the market to work, not impede or second-guess it “In my experience, what supervision and examination can do is set and enforce capital and collateral requirements and other rules that are preventative and do not require anticipating an uncertain future.”

Regulatory body sets out key issues

The Institute of International Finance report summarises the key

elements that firms should incorporate into their risk management

practices:

l Ensure that risk management does not rely on a single risk

methodology and analyse group-wide risks on an aggregate basis

Mr Beach agrees that developing an integrated view of risk

across all risk types is essential “A major challenge is to build a

comprehensive, joined-up perspective of the bank’s risk profile

across risk classes, products, counterparties and different

dimensions of the portfolio such as geography and industry

sector Risk information flows should be improved Risk reports

provided to the board and senior management need to be capable

of focusing on the firm’s current key risk issues rather than

providing a torrent of data which cannot realistically be digested

and used as a basis for effective decision-making.” Risk reporting

should be embedded into day-to-day management reports

rather than provided as a separate stream, he argues Primary

responsibility for this should lie with the business, supported by

the risk function

l Take into account the technical limitations of risk metrics, models and techniques, such as VaR.

Mr Fowler agrees that constant attempts to measure everything are doomed to failure The logical conclusion of the process, he says, is to arrive at a single number – an exercise which would be meaningless “Not everything that has value can be measured and not everything that can be measured has value,” he explains “How can you numerically measure the long-term viability of a firm?”

l Ensure that the appropriate governance structure that has been adopted and is actually implemented in managing day-to- day business

Rating agencies are beginning to focus more on the quality of

a firm’s enterprise risk management practices For example, in

2008, Standard & Poor’s now reviews the quality of enterprise risk management as a new component in its reviews of credit ratings Performing classical siloed risk management will only qualify as

“adequate” in the new S&P model

Mr Mark says the agencies would undoubtedly have had AIG

in mind when they changed their methodology “It was the AIG Financial Products area that created significant problems for AIG,”

he says “They were the ones who wrote all the CDSs The other parts

of AIG were essentially working well.”

Indeed, there are indications that regulators and policymakers, despite the political furore and public anger, are not likely to intrude on company structures or compensation models The key issues, according

to the Financial Stability Forum of national and international financial regulators, revolve around the integration of risks, the measurement of risk (four out of ten in the survey, incidentally, say they practice insufficient stress testing) and the lack of constant challenges to accepted methods in light of changing market conditions

A new template for rating instruments?

There are signs that the existing model for rating agencies could be starting to change

Independent rating agencies, such as Egan-Jones, are starting to penetrate the market as the inherent conflict of interest in the traditional model – where issuers pay for ratings and the agencies are rewarded on volume – is called into question There are several drivers for a shift towards ratings paid for by investors rather than issuers, says Sean Egan, founding principal of Egan-Jones First, the Securities and Exchange Commission now officially sanctions independent agencies, conferring credibility to companies like Egan-Jones Second, US Congress may soon debate a bill that would hold rating agencies liable for misleading ratings due to problems with the models Next, a series of whistleblowers have claimed that they were fired or demoted after refusing to raise a rating or expressing doubts over one Finally, fiduciaries may be at risk if they rely on conflicted agents

Mr Egan points to the potential competitive edge that banks and other investors can gain from independent ratings “Our ratings on Lehman Brothers were three to four notches below the big three agencies just before it collapsed Any money market fund using our rating would have known not to hold Lehman commercial paper at that time.”

Transparency is the key to all progress

Many of the initiatives that respondents think would be most effective are related to transparency – for example, greater transparency in off-balance sheet vehicles and interventions around valuation are believed to be potentially effective

But what does transparency actually mean? For Mr Mark, transparency means a firm having easy-to-understand policies and then communicating them clearly “It is important to identify and disclose the biggest risks that the business faces,” he says “It could be the top 50 and the board focuses on the top ten of these The management committee perhaps focuses on the top 20

If something goes wrong, at least people will be smarter and wiser about the risks they are taking and can do more next time.”

Every strategy should have a projected measure of risk and return, he says, and then a firm can measure risk-adjusted performance In addition, every mathematical model that can impact financials should have an independent group reviewing it “If a strategy has been developed on the trading floor,

it should have independent eyes to sign it off,” he adds

In this sense, transparency is a prerequisite for good governance And good governance is about quality of management Perhaps the only way for an outsider or a stakeholder to distinguish between firms with good or poor risk management is by the quality of their people “If an organisation has less

© The Economist Intelligence Unit Limited 2009 13

34 31

29 28 25

24 23 23 22 20 16

10 5

Greater disclosure of off-balance-sheet vehicles Stronger regulation of credit rating agencies Caps on leverage

Central clearing for over-the-counter derivatives Expansion of regulatory oversight to other areas of financial services not currently regulated Enhanced valuation processes for complex or illiquid assets

Increases to required capital reserves Liquidity cushions

Enhanced disclosure around valuations Reform of compensation systems (eg, bonus payment structures) Greater clarity about where regulatory responsibilities lie Supervisory colleges of cross-border regulators Other, please specify

Which of the following proposed reforms do you think will be most beneficial to the financial services industry?

Select up to three

(% respondents)

qualified and less well paid people with poorer career paths in the risk function than somewhere else, then I would certainly trust it less,” says Mr Mark

The risk function demands “a voice”

For measures to be effective, the risk function must be allowed to have a significant voice in the organisation At present, just under half of respondents think that risk management does not have sufficient authority in their organisation

This is, in part, a reflection of the personality types that tend to populate risk functions Risk management recruitment consultants say that HR departments are asking them for candidates with stronger interpersonal skills who would have the courage and the influence to stand up to bullish colleagues “It’s a problem, because people are either very good at numbers or they’re very good with people and to get someone with both is not easy,” says Dean Spencer from Barclays Simpson, a recruitment consultancy

However, Mr Fowler argues that the function’s role within the business is as important as the type

of people employed to discharge it Its role should be to embed risk, he says, making sure that every individual has personal objectives linked to risk This has rarely been the case in the past “In banking, the risk function takes prime responsibility for dealing with risk, rather than for embedding risk management throughout the business and this surely can’t be a sensible approach The key is risk awareness and creating a risk culture, not letting a single function deal with it as if it were a business line in itself.”

Implementing change – the process has already begun

Some institutions have already established working groups – sometimes at board level – and have been

considering new and revitalised risk management ideas for some time Others, meanwhile, are waiting

to see how markets in general and their market in particular will evolve

More than half of respondents say that their firm has either completed or intends to complete a thorough overhaul of its risk management post-crisis Respondents from Asia-Pacific are most likely to have already conducted a thorough overhaul of risk management

Liquidity – closing the black hole

The most common initiatives being taken to strengthen liquidity risk management – the black hole that was only discovered from the middle of 2007 onwards – are increasing liquidity buffers, strengthening information systems and improving co-ordination between the treasury function and lines of business.Permal, for one, has strengthened its approach to liquidity It has upgraded liquidity risks and put them on a par with market risk It has imposed new standards and checklists, partly in response to investor demand “Requests for liquidity reports have escalated,” says Mr Kodmani “Investors want to know how quickly we can get out of hedge funds.” Permal has instituted guidelines on how much of its

Increasing liquidity buffers Strengthening information systems Improving co-ordination between treasury function and lines of business Strengthening contingency funding plans

Strengthening liquidity stress testing capabilities Conducting independent review of internal policies Strengthening management of intra-day liquidity risks Improving management of foreign currency flows Other, please specify

We are not taking any steps at present Don't know/Not applicable

48 45 44 38

37 31

26 23 3

5 8

What steps is your organisation taking to improve its management of liquidity risk? Please select all that apply

(% respondents)

32 21

27 12

5 3

We have already conducted a thorough overhaul of our risk management

We intend to conduct a thorough overhaul of our risk management, but have not yet completed it

We have made some minor changes to our risk management

We intend to make some minor changes to our risk management, but have not yet completed them

We do not intend to make any changes to our risk management

We are waiting to see how the market develops before deciding whether to review our risk management

Which of the following statements best describes your organisation’s current status with the review of its risk management in response to recent market events?

(% respondents)