Risk Management in Banking
Elmer Funke Kupper *
1. Introduction
The Asian financial crisis is yet to run its full course, but
is already one of the largest crises in the post-war era.
It severely affected the performance of the region and
created an economic downturn that impacted on
financial institutions worldwide. At the same time, the
failure of Russia to deal with its deteriorating conditions
led some hedge funds and leading international banks
to announce substantial losses. Moreover, these events
occurred at a time when financial markets were still
trying to cope with the contagion effects that shook the
economies of Latin America.
Clearly, recent events have unfolded in a way that most
institutions and governments did not expect. Yet, while
the specific circumstances of the crises are certainly
unique, the reactions of financial institutions were
somewhat predictable. Immediately following the
outbreak of the Asian crisis, credit standards were
tightened and lending growth was curtailed. Some
banks seemed to withdraw to their home markets, which
looked more stable and attractive in the short term.
These measures are very similar to the ones taken
during the Latin American debt crisis in the 1980s
or the global property downturn in the early 1990s.
Banks in countries like France, Sweden and Australia
were hit hard by the latter and imposed tight credit
controls while they worked through their portfolios
of bad loans. Figure 1 presents some of the key events
that have impacted on the way financial institutions do
business. Australian GDP growth is used simply to
Figure 1: Major Events Impacting
Financial Institutions
% %
7 Brady Plan Asian
7
Year 2000
Financial
6 6
Crisis
5 5
GDP growth
4 4
Gulf
3 War Russian Crisis
3
Equities GBP out of Hedge Funds
2 'Crash' European 2
System
1 1
0 0
Commercial
-1 Real Estate -1
Crisis
-2 -2
86/87 88/89 90/91 92/93 94/95 96/97 98/99 00/01
* Previously: Group General Manager, Risk Management, ANZ.
Now: Head of International Division, ANZ.
1 EVA is discussed in Section 2.1 and Section 5.
21
Figure 2: Breaking the Vicious Cycle of Risk
Take
uneconomic
risks
Drive Incur
marketing large
aggressively losses
Lose Clamp down
market on lending/
share trading
Forego
economic
risks
highlight the cyclical nature of these occurrences.
Looking back at these events, the behaviour of banks
seems countercyclical. Banks are happy to participate
in excessive growth under the assumption that there is
no end to prosperity. Then, when the cycle turns and
the correction has taken place, they change their
processes in an attempt to ensure that the same event
will not impact them again. Unfortunately, we can be
certain that it will not be the same event that strikes
again in exactly the same way.
The measures that banks implement may provide solid
protection against events of the past, however they do
not necessarily provide any protection in the future. As
shown in Figure 2, there exists a vicious cycle of risk.
The challenge that financial institutions face is to find
a way to break through this cycle and adjust their risk
profile before the downturn takes place.
This paper describes the key building blocks that need
to be in place before the cycle can be broken. A
summary of the key risks faced by the banking sector is
followed by an explanation of ANZ’s approach to
managing them. The bank’s approach is based on three
basic elements:
i. a clear understanding of the relationship between
risk and shareholder value, using economic value
added (EVA) as the key measure; 1
ii. a stress-testing regime to assess the financial impact
of potential extreme events and a breakdown in risk
models; and
 Elmer Funke Kupper

iii. a decision making and performance management Figure 3: Three Main Types of Risk
22
framework that translates the insights acquired
from i and ii into a consistent set of business Credit Risk Market Risk
decisions. • Risk grading • Trading risk
• Single name • Balance sheet risk
2. The Risks Faced by Banks • Single transaction
• Industry/sector
When discussing the challenges faced by financial
• Country/region Operational Risk
institutions in managing risk, it is important to have
(cross border)
a consistent definition of the term ‘risk’. For the • Product • Event risk
purposes of this paper, risk is defined as the volatility • Tenor (Year 2000, Euro)
of a corporation’s market value. The definition that has • Credit skills and • Payments/settlement
been selected is as broad as possible. What is of interest training risk
• Technology/systems
is all decisions that may impact on a change in market
exposure
value. This is consistent with the view that risk • Fraud/compliance risk
management is about optimising the risk-reward trade- • Natural disaster
off – not about minimising the absolute level of risk. • Change management

In practice, banks’ exposures are asymmetric. This

is particularly true for credit risk, where the upside
consists of a small positive yield, and the downside
consists of a loss that could range from zero to
more than 100 per cent of the exposure. Given the
importance of this downside risk, banks tend to focus
their energies on understanding and managing the key
drivers that determine financial loss. In doing this, they
generally distinguish between three main types of risk:
i. credit risk – the potential financial loss resulting
from the failure of customers to honour fully the
terms of a loan or contract. Increasingly, this
definition is being expanded to include the risk
of loss in portfolio value as a result of migration
from a higher risk grade to a lower one;
ii. market risk – the risk to earnings arising from
changes in interest rates or exchange rates, or from
fluctuations in bond, equity or commodity prices.
Banks are subject to market risk in both the
management of their balance sheets and in their
trading operations; and
iii. operational risk – the potential financial loss as a
result of a breakdown in day-to-day operational
processes. Operational risk can arise from failure to
comply with policies, laws and regulations, from
fraud or forgery, or from a breakdown in the
availability or integrity of services, systems or
information.
Some of the components of these different risk
groupings are listed in Figure 3.
When it comes to risk management, banks’ investors
are unforgiving; they will translate an increase in
perceived risk or uncertainty almost immediately into
sell orders. Between July and September 1998, for
example, the US Banking Index fell 26 per cent relative
to the broader S&P 500 Index. If risk is measured by
the volatility of market value, banks have more work to
do.
2.1. Adopting EVA as the Common
Language of Risk and Reward
Over the last few years, there has been a revolution in the
way that banks think about the relationship between risk
and shareholder value. A large number of banks have
implemented new performance measures such as risk-
adjusted return on capital (RAROC) and economic value
added (EVA).2 ANZ is among these banks. Since 1996,
ANZ has been reporting the EVA of each line of business
on a monthly basis. Moreover, executive remuneration
has been tied directly to the creation of economic value.
EVA represents the total value created in dollars over and
above the required minimum return. Hence, an EVA of
zero for a particular business line implies that the
business is producing a return that is commensurate with
shareholders’ minimum expectations. In ANZ, the target
rate of return (the hurdle rate) is typically set somewhere
between 15 and 25 per cent, although for businesses that
consume little capital, targets may be set considerably
higher.
The objective of risk adjusting results is to create a
‘level playing field’ for performance evaluation and

2 For further discussion of performance measures see Matten in this Volume.

 Risk Management in Banking

resource allocation. Initiatives that do not meet the
hurdle rate of return will be scrutinised more closely,
while acquisitions and potential investments will be
evaluated on their ability to generate positive returns.
As a result, EVA tends to streamline and focus
acquisition and investment activity.
The development of a sound EVA methodology can
take years. The techniques underpinning the allocation
of capital are complex, and it takes time to understand
what drives performance. It is therefore tempting to
spend a lot of time at the outset developing the
algorithms and the tools intended to support the EVA
framework. Unfortunately, such an approach may
mean that the methodology is not fully operational,
and hence practical decisions are not made, for several
years. ANZ adopted the reverse approach. That is,
shortly after the decision was made to develop an EVA
framework, regular reporting was implemented and
executive remuneration was linked to the creation of
EVA. The main benefit of early implementation is
ownership. For this reason, most lines of business have
been actively involved in formulating the EVA
methodology from the early stages. In most cases, the
methodology has been applied across all levels within
the institution, including the front-line. Relationship
managers in Australia and parts of the international
network have a clear understanding of the economic
23
value of each customer. Additionally, all submissions to
the Executive Credit Committee require quantification
of RAROC and EVA.
A risk-adjusted performance measure establishes a
direct link between the business and the risk decisions
made. The profitability tree in Figure 4 illustrates the
link between risk and return and shows how EVA can
be broken down into the key drivers of performance.
In the profitability tree, ‘risk’ appears in two locations.
It appears in the top half as the expected loss arising from
credit risk, ie the loss on the portfolio that is expected to
be incurred over the period. Expected loss recognises
that, over time, some exposures will default, even
though it is not possible to determine which exposures
they will be. In the example, the expected loss on the
portfolio is set at 0.5 per cent of lending assets. This
amount is subtracted from revenue to create an
estimate of risk-adjusted net income. Effectively, the
expected loss amount is treated as an ‘insurance
premium’ that should be put aside at the time of the
lending decision to pay for future losses that
undoubtedly will materialise.
Risk also appears in the bottom half of the tree as
unexpected loss. This is the risk that the actual loss

Figure 4: EVA Profitability Tree

Percentage of Lending Assets
Income
Risk-adjusted
income 6.10%
Risk-adjusted
net income 5.60% Expected loss
Risk-adjusted
after-tax 2.20% Costs 0.50%
income
Risk-adjusted 1.75% 3.40%
net income Net tax

$1,750 Average 0.45%

lending assets Credit risk capital
RAROC EVA
$100,000 4.40%
22% $310 Total capital

8.00% Market risk capital

Total capital
Average 1.60%
$8,000
Capital charge lending assets

$1,440 $100,000
Cost of capital Operational risk capital

18% 2.00%
 Elmer Funke Kupper
experienced will exceed the expected loss amount.
24
Capital is required to cover those losses that exceed
expectations. Hence, the unexpected loss on the
portfolio determines the amount of capital that is
allocated to each business. Figure 5 shows the
probability distribution for declines in portfolio value.
ANZ requires all businesses to be capitalised with
sufficient equity to sustain a ‘AA’ credit rating. Using
default studies conducted by the rating agencies, it is
possible to determine that the probability of default for
AA credits is less than 0.05 per cent over a one-year
time horizon. In other words, the bank should be 99.95
per cent confident that it will not experience losses
sufficient to exhaust its capital within the next year.
3. Measuring Risk
As discussed in Section 2, financial institutions typically
distinguish between three principal classes of risk,
namely, credit, market and operational risk. For each
class, it is necessary to derive a means of estimating
expected loss (for credit risk) and unexpected losses
(for all three risk groups) such that an appropriate
amount of capital can be held and the performance of
each business assessed. As Figure 4 indicated, the output
of the risk measurement process is such that ANZ
allocates 55 per cent of total capital to credit risk, 25 per
cent to operational risk and the remaining 20 per cent
to market risk (both trading risk and balance sheet
risk).
Figure 5: Probability Distribution of
Portfolio Losses
Less than 0.05%
probability
Expected loss Unexpected loss for
which capital is held
3.1. Measuring Credit Risk
There are three factors that drive expected and
unexpected losses on a credit portfolio:
i. customer default risk – determined by the risk-grade
profile of the portfolio, the tenor of the exposures
and the degree of exposure to country risk.
Typically, the default rates are calibrated to those of
Moody’s Investors Service and Standard & Poor’s
Ratings Service;
ii. exposure – the amount that is likely to be outstanding
at the time of default. This includes current drawn
amounts as well as an allowance for contingent
liabilities and undrawn lines; and
iii. loss given default – determined by the level of security
cover, the effectiveness of the work-out process and
the credit cycle. In this regard, Figure 6 shows the
improvements achieved by ANZ in recent years.
The calculation of expected loss is based on the current
risk profile of the portfolio. Whenever possible, the
calculation of expected loss ignores historical loss rates.
Banks that rely on their average loss experience to
derive expected loss are assuming that the risk profile,
business mix and risk management processes remain
constant over time. Other than for homogeneous
consumer portfolios, ANZ has found this to be a flawed
assumption. In most cases, the existing profile is
considerably better than the one that created the losses
of the past, and penalising current business owners for
past events seems unnecessary. In addition, any absence
of past losses would be driven mostly by external
variables, such as government regulation or inflation,
rather than by a true absence of risk. Losses in Asia, for
example, were very low for many years.
The allocation of capital for credit risk is complicated
by portfolio effects. Three of these warrant explicit
consideration:
i. the shape of the loss distribution – in allocating capital it
is necessary to determine the number of standard
deviations that equates to a level of confidence of
99.95 per cent. This number depends on the shape
of each portfolio distribution. Of course, each
portfolio may have a very different distribution.
A credit card portfolio, for example, may reach
99.95 per cent at five standard deviations, while a
corporate lending portfolio may require up to
nine standard deviations;
 Risk Management in Banking

Figure 6: ANZ’s Improved Recovery Experience 25

Percentage of Debt Outstanding

100% 100%
91%
In 1990-1992, 73% was
outstanding after 1 year…
80% 80%
73% Loss Given Default
71% 1990-1992: 57%
1993-1997: 34%
60% 60%
56%

44% 38%
40% 40%

22%
20% 20%
…In the period 11%
19% 6%
1993-1997 the amount 3%
outstanding fell to 44% 8%
0% 0%

0 6 12 18 24 30 36 42 48 54 60

Months since default

ii. correlation between default risk and loss given default –
during the early 1990s, default rates were
significantly higher than they are now, while
recovery rates were lower. The correlation between
the two measures helps to explain the large losses
incurred during the property downturn of that
period; and
iii. the impact of diversification between portfolios – this
is one of the traditional dilemmas of capital
allocation. To what degree should the effects of
diversification between businesses be taken into
account?
Although progress has been made in the area of credit
risk modelling, the industry as a whole is still struggling
to find a consistent measure of credit risk.3 To
overcome the lack of consistency, several industry
initiatives are underway. The most well known are
Credit Suisse Financial Product’s CreditRisk+™,
CreditPortfolioView™ by McKinsey & Company and
JP Morgan’s CreditMetrics™.4 In addition, firms like
KMV and KPMG are actively participating in the debate
and are openly sharing many of their analytical
engines.5 These initiatives are crucial for the
development of a common language for credit risk and
the gradual establishment of a more liquid market for
credit instruments, similar to that which exists for
traded market products.
3 See Matten in this Volume.
4 See Credit Suisse Financial Products (1997), Wilson (1997a and 1997b) and JP Morgan (1997).
5 Among KPMG’s contributions is the Loan Analysis System™ (see KPMG (1998)). KMV has several products on the market,
including Credit Monitor™ and Portfolio Manager ™ (see KMV (1999a and 1999b)).
6 See JP Morgan/Reuters (1996).
3.2. Measuring Market Risk
Banks are exposed to market risk via their trading
activities and their balance sheets. The measurement of
trading risk is probably the most advanced of the three
main types of risks faced by banks. Development efforts
were spearheaded by the publication of JP Morgan’s
RiskMetrics™ in the mid 1990s, which created a much
more open exchange of risk measurement
methodologies.6
The common measure used to express market risk
is ‘value-at-risk’ (VaR). In ANZ, VaR measures the
maximum loss in portfolio value over a one-day holding
period with 97.5 per cent confidence. For example, if an
activity has a VaR of $5 million, it can be expected that in
39 out of 40 days losses will be less than $5 million.
Conversely, in 1 out of 40 days, or about 6 times a year,
losses can be expected to exceed $5 million.
The translation of VaR into a capital allocation number
requires a number of steps. These include the
annualisation of the daily risk measure and an increase in
the confidence interval from 97.5 per cent to 99.95 per cent
(in line with the required AA credit rating discussed in
Section 2). Effectively, this process makes capital a
multiple of VaR. In most commercial banks, the amount
of capital allocated to trading risk is relatively small when
compared to the other major risks. For ANZ, it represents
less than 5 per cent of total allocated capital.
 Elmer Funke Kupper
Although VaR is based on a measure of volatility, risk
26
managers cannot rely solely on this measure for
comfort. For example, VaR does not capture the very
low-probability events that are of real concern.
Moreover, it is based on assumptions that may not be
true in the real world. Two particular assumptions
should be kept in mind:
i. the shape of the loss distribution – under VaR, changes
in asset prices are commonly assumed to follow a
normal distribution. While this may be reasonable
in some cases, it is not true in general. Moreover, in
extreme circumstances the distribution of asset
prices can change shape quite significantly.
During the Russian debt crisis, for example,
price movements were mostly ‘one way’ for weeks in
a row; and
ii. the data period used – it is easy to believe that longer
data series create more reliable results when
estimating price volatility and correlations, since
they involve a greater number of data points. This
idea can be very deceptive. When predicting events
that may occur over the next day or the next week,
circumstances that existed a year ago are usually
irrelevant. By contrast, what happened in the
previous week could be very important and should
be weighted more heavily in the estimate of future
price volatility.
To overcome the shortcomings of the modelling process,
banks need to supplement the VaR-based limit structure
with other risk management tools. For example, banks
should have in place controls on the concentration of
exposures, by market or by instrument, as well as
controls on liquidity and non-linear risk. In addition,
banks need to implement a stress-testing regime that
systematically analyses the potential financial impact of a
breakdown in any risk measurement models. As will be
discussed in Section 4, these breakdowns typically occur
at the same time as markets move in unexpected ways.
The drive for improvement in market risk management
within banks recently received a boost with the
introduction of regulatory capital rules for traded
market risk. These rules provide for the use of an
‘internal models approach’, which allows banks to apply
their own risk measurement models to calculate a
regulatory capital charge for traded market risk. All
major banks in Australia received approval to use the
internal models approach.
7 PricewaterhouseCoopers (1996).
The other component of market risk is the interest rate
risk on banks’ balance sheets. This risk results from
timing differences in the repricing of assets and
liabilities, and the investment of capital. The capital
allocated to this type of risk is intended to cover the
potential loss in earnings resulting from a change in
interest rates. Essentially this capital is an estimate of
the cost of closing out the mismatches following an
extreme event. In the calculation, a separate allowance
is made for basis risk and option risk on the balance
sheet. In this context, basis risk arises because
movements in market interest rates do not translate
directly into changes in the interest rates applied to
customers, while option risk (or prepayment risk)
refers to the ability of customers to repay a loan earlier
than contractually agreed.
3.3. Measuring Operational Risk
Greater dependence on technology and centralised
operations mean that banks are becoming increasingly
exposed to operational risk. Some recent trends are:
• banks are expanding their use of the Internet to
service customers and perform basic functions;
• globalisation is creating complex linkages between
institutions and countries;
• part of the risk has been outsourced to third parties
and so cannot be directly controlled; and
• rules and regulations are expanding in an
increasingly litigious society.
Measuring operational risk requires identification of the
underlying operational drivers or risk factors. As shown in
Figure 7, PricewaterhouseCoopers provides a useful
summary as part of its Generally Accepted Risk Principles
(GARP).7 This approach decomposes operational risk into
those risks that are closely related to internal processes,
people and systems (referred to as ‘operational risks’) and
those that are more related to the external environment
(termed ‘business or event risks’).
A quick scan through the list reveals that the most
worrying events are those that are very rare, yet could
have a devastating impact on a business. Allocating
capital to these very large but very low-probability risks is
not necessarily useful. Consider settlement risk for
example. If an international systemic problem occurred
during the Year 2000 date change, the amount of capital
that is currently available to support on-going operations
is unlikely to prevent failure. In such cases, it is better to
 Risk Management in Banking

Figure 7: Sources of Operational Risk 27

Operational Risk Business/Event Risk

• Transaction risk • Execution error • Regulation risk • Breaching capital
• Product complexity requirements
• Booking error • Regulatory changes
• Settlement error
• Commodity delivery risk
• Documentation/contract risk

• Operational • Exceeding limits • Disaster risk • Natural disasters

control risk • Rogue trading • War
• Fraud • Collapse/suspension
• Money laundering of markets
• Security risk
• Key personnel risk
• Processing risk

• Systems risk • Programming error • Currency convertibility risk

• Model/methodology error • Shift in credit rating
• Mark-to-market error • Reputation risk
• Management information • Taxation risk
• IT systems failure • Legal risk
• Telecommunications failure
• Contingency planning

Source: PricewaterhouseCoopers (1996).

ensure that there are clear controls in place to minimise
the probability of the event and the impact of an
occurrence. The objective is to build a minimum level of
resilience in the organisation, not to plan for every
possible event by holding commensurate levels of
capital. In reality, the events not yet identified are the
ones likely to hurt most.
One way to increase the focus on operational risk is to
allocate it to its natural owners. In most cases, these are
the managers of the businesses and support areas who
have ultimate responsibility for the continued operation
of the organisation. If the businesses rely on services from
central areas such as information technology, they must
insist on service-level agreements that specify the amount
of back-up protection and associated costs. To avoid each
business focusing on short-term costs, the service units
need to define minimum standards that must be
complied with. Although it is accepted that, in many
cases, capital alone is insufficient to protect the business,
it is nevertheless important to make the level of risk as
visible as possible for performance management
purposes.
One of the main constraints to developing capital
allocation rules for operational risk is the information
base available to measure that risk in any meaningful
way. Some banks have attempted to overcome this
constraint by creating a reference to other companies
or industries that do not assume any credit or market
risk, and therefore derive their entire earnings volatility
from general business risk. By expressing the findings
in known measures, such as operating expenses, the
results of these companies can be made comparable
with those of the bank. Another approach is to draw on
the loss experience of a range of different industries,
including the insurance industry. While this approach
could provide a larger inventory of events, many of the
relevant events, such as technology-driven losses, may
not be published.
ANZ currently applies some basic rules to allocate
capital for operational risk. In aggregate, this leads to
an allocation that is approximately 25 per cent of total
operating expenses. The bank is in the process of
developing alternative methodologies.
4. The Need for a
Stress-Testing Regime
The advancement in risk measurement techniques
across the industry is impressive. With the
 Elmer Funke Kupper

implementation of risk-adjusted profitability, it is now
28
possible to view all the key risks in terms of a common
unit of measurement. Provided the right amount of
capital is allocated to an activity, the bank has effectively
‘accounted for’ risk. Moreover, if two activities produce
the same RAROC, the investment decision should be
neutral.
While this logic works well over a full economic cycle, it
can be deceptive at any specific point in time. In
particular, there can be circumstances that lead to
losses that are well outside of known scenarios because
the future hardly ever produces the same combination
of circumstances as the past. There are three possible
reasons for why existing risk measurement techniques
can fail under stress:
i. markets move further and faster;
ii. risks that are usually unrelated suddenly move
together (and risks that are usually related suddenly
move apart); or
iii. new risks emerge.
Risk management should therefore focus most attention
on the tail of the loss distribution. To develop an
understanding of what might happen under extreme
circumstances, banks need to adopt a stress-testing
regime that systematically analyses the impact
of different scenarios on their earnings. This involves
a number of steps. First, those variables that are most
likely to have an adverse impact on future earnings or
credit quality must be determined. Some examples
are interest rates changes or the debt structure of a
country, or discrete events such as an election or the
Olympics. The next step is to systematically design
scenarios and attach probabilities to them. The
challenge here is to define events that are well outside
‘conventional’ wisdom. Given these scenarios, the
existing portfolio must then be stress tested so as to
analyse the impact on earnings and portfolio quality.
A good example of a stress event is the contagion effect
that took hold of emerging markets. In September
1997, the correlations between the bond indices of
Eastern Europe and Latin America were relatively low.
On the surface, this meant that attractive diversification
benefits could be achieved by investing in both regions.
As Figure 8 shows, by September 1998 the same
correlations had doubled and both markets moved well
outside normal model estimates. Banks incurred losses
that easily exceeded 10 or 15 times the calculated VaR.
Typically, once an event has occurred somewhere in the
world it provides a good foundation for the
development of stress scenarios in the same market or
in other markets. Figure 9 provides two examples of
such events: the emerging markets crisis and the
property-related problems of the early 1990s. Both
these events can be translated across geographies to
generate useful stress tests.
The final stage in the formation of an effective stress-
testing framework is the development of alternative
actions that could be taken to either prevent the bank
being caught in such a scenario or to protect against

Figure 8: Correlations between Market Indices

September 1997 August 1998

Argentina Brazil Russia Philippines Argentina Brazil Russia Philippines

Argentina 1.00 Argentina 1.00

Brazil 0.83 1.00 Brazil 0.94 1.00

Russia 0.39 0.44 1.00 Russia 0.70 0.81 1.00

Philippines 0.45 0.46 0.36 1.00 Philippines 0.75 0.70 0.52 1.00

Source: JP Morgan’s Emerging Markets Bond Index.

 Risk Management in Banking

Figure 9: Formulating Scenarios from Past Events

29
Expected Default Rate Australian
JP Morgan Emerging Markets Index Listed Entities (Median – %)
180 5

170
4

160
3
150
2
140

130 1

Apr 98 Aug 98 1988 1998

• Translate experience
into other markets
• Understand cyclicality
and diversification
Source: JP Morgan’s Emerging Markets Bond Index Plus and KMV’s Credit Monitor™.

the consequences. For ANZ, a good example in this
regard is the Asian crisis of late 1997 and 1998. In the
very early stages of the crisis, ANZ conducted a stress
test on its lending portfolio to understand the impact
of a shock on loan losses. Together with a bottom-up
assessment of individual customers, the bank was able
to make early decisions on the best way to manage the
credit portfolio.
Another example is the impact of the Year 2000
Millennium Bug on the bank’s customers. The issue
is the degree to which the Year 2000 problem may
increase default risk and the financial consequences of
the potential rise in bankruptcies. ANZ’s assessment of
the effect of the Year 2000 problem on its customers
takes into account the customer’s current default
probability, the impact of technology on that customer’s
business and the level of preparedness for the date
change. This information is now being used to model
the impact of the scenario on credit quality and to
develop management strategies.
In some cases, potential consequences (or risks) can be
hedged using off-balance sheet tools, such as credit
derivatives or securitisation. The market for these
structures has been growing rapidly. This growth,
however, poses a significant risk in its own right with
most instruments not having been tested under a
severe economic downturn. Moreover, increasingly it is
becoming clear that many banks and investors have
limited insight into the levels of risk they are exposed
to. At some stage, the markets for credit derivatives and
securitisation will create surprises for a few participants.
Passing on the very significant downside risk of credit
to a third party assumes that this third party can absorb
that risk under extreme circumstances – how many
banks, investors and regulators truly understand the
ability of the market to deal with such an occurrence?
5. Making Consistent Risk
Management Decisions
Despite the growth in secondary markets and hedging
instruments, there is no market place yet for many
illiquid instruments. Once a bank decides to participate
in and assume the risks associated with any instrument,
it should be prepared to incur stress-related losses.
Taking a short-term earnings view can be dangerous; an
event that could happen once in 20 years can just as
easily happen tomorrow as it can in the year 2019. The
main challenge for banks is to be decisive with regard to
the level of risk to accept. In order to achieve this, banks
need to develop management systems that provide a
natural focus on risk as one of the drivers of
performance.
As shown in Figure 10 (over the page), there are four
components to the management process:
i. define the desired shape and risk profile of the
 Elmer Funke Kupper
30 Figure 10: Making Consistent Risk Management Decisions
• Reward based on EVA
• Align targets and
risk appetite Provide Define
incentives risk appetite
Manage at
Monitor business
performance level
• Capture in warehouse
• Conduct stress testing
• Provide flexible reporting
institution, covering the mix of businesses and
geographies;
ii. manage the risk profile at the business level,
recognising that risk management challenges
and responses can vary considerably between
businesses;
iii. establish a management information system (MIS)
that monitors performance and is tailored to the
requirements of each business; and
iv. implement a performance management system that
provides clear incentives to eliminate unacceptable
and unprofitable risks.
For this framework to be effective, it needs to be
supported by a strong and consistent risk culture.
5.1. Set ‘Top-Down’ Direction
The first stage of the risk management process is to
define the risk appetite of the institution. In deciding the
shape and risk profile of the bank, the challenge is to
differentiate clearly between activities that are of strategic
importance and those that are not. This is not easy as
business managers tend to consider all activities and
customers to be of strategic importance, particularly if
future rewards depend on them. In some cases, several
activities can be profitable on a risk-adjusted basis yet,
when the size of the institution is considered, it may not
be desirable to undertake all those activities. Figure 11
lists some of the responsibilities of management as part of
the ‘top-down’ approach to managing risk.
In late 1997, ANZ was confronted with a level of
exposure to the Asian region that left little room for the
• Define strategic and
non-strategic activities
• Take decisive action
Risk culture
• Communicate
objectives
• Maintain core
competency
• Develop a track
record
• Allocate responsibility
• Ensure independent oversight
• Take a portfolio approach
bank to support its core activities. Therefore, it was
decided to eliminate a large part of the bank’s non-
strategic assets while ensuring that there was sufficient
room for the bank’s franchise businesses, including
trade finance, network customers and international
project finance. As a result, wholesale banking and local
corporate lending to the region were curtailed
significantly. The inter-bank credit-spread business was
closed down, other than for balance sheet management
and customer-related business. Where possible, facilities
were not renewed or rolled over, material adverse
change was invoked on undrawn lines, and net
settlement was pursued in higher-risk countries within
the Asian region. These actions resulted in a reduction
of exposure to Asia of over 40 per cent, creating room
to provide continued support to the bank’s core
activities and customers. It was evident that a bank
cannot be all things to all customers.
While the Asian crisis required a rapid response, the
experience reinforced the need to maintain a sound
balance between wholesale and consumer banking,
both domestically and offshore. As a first step to
improve this balance, it was decided to exit all
proprietary trading. Although the measures
undertaken by many financial institutions in Asia
were necessary, this action does not mean that
Australian business should turn its back on the
region. On the contrary, the volatility of the market
provides attractive opportunities in trade finance and
foreign exchange, with some banks using lower
valuations to increase their coverage of the region.
From a risk perspective, a complete withdrawal to the
domestic market would be the wrong thing to do.

Figure 11: Roles in the Risk Management Process
Emphasis on risk
appetite and policy
Group
Lines of
business
Relationship
management
Emphasis on
risk and reward
trade-off
Such a move would increase domestic concentration
risk, although this would only become apparent when
the cycle in Australia turns. International diversification
reduces risk.
5.2. Manage by Line of Business
Once the desired risk profile of an institution has been
defined, individual lines of business are best placed to
manage the risk of their activities. The risk
management challenges of each business require a
specialist and integrated approach. In corporate
banking, for example, the focus is largely on credit risk
and the economic value of individual customers and
transactions. Credit risk is managed through a series of
concentration limits (for counterparties, industries and
countries) and a ‘discretions framework’ that forces the
most significant risks to be approved by an
independent credit chain. Figure 12 (over the page)
outlines the different types of risk inherent within
three lines of business: wholesale banking, personal
banking and financial markets.
Measuring the risk and reward trade-off through EVA
reinforces the need for sound risk management
practices. ANZ’s analysis indicates that the vast majority
of customers below an equivalent rating of BB– are
unprofitable on a risk-adjusted basis. This group of
customers is also the most sensitive to adverse changes
in economic conditions.
With improvements in credit risk measurement, banks
are now starting to adopt a portfolio approach to
Risk Management in Banking
31
• Define risk appetite and balance
between businesses
• Allocate resources and capital
• Optimise the portfolio; pick 'winners'
• Maintain a well-diversified portfolio
• Develop strategies to optimise EVA
• Design delivery systems
• Structure transactions
• Optimise EVA at customer level
• Exit subperforming assets
managing wholesale credit risk. In this regard, some
banks have formally separated credit origination and on-
going portfolio management. Within this framework,
credit risk is transferred to the portfolio manager either
by using a ‘risk-neutral spread’ or through an actual sale
of the assets on a mark-to-market basis. The challenge of
the portfolio manager is to enhance EVA by actively
shaping the risk profile of those assets. This can be
achieved by physically adding or removing assets, or by
transferring the risk synthetically. In personal banking,
there is a greater balance between the three main types of
risk. Next to credit risk the business is significantly
exposed to balance sheet risk and operational risk. While
balance sheet risk is largely transferred to the asset and
liability management function, operational risk remains
with the business.
5.3. Building a Management Information
System for Risk
The third stage of the process is to establish a
management information system (MIS) that is tailored
to the requirements of each business. Risk
management is highly dependent on information to
support and monitor a wide range of business issues. In
particular, banks need to:
• ensure that the assumption of risk is in line with the
articulated strategy and risk appetite of the
institution;
• develop customer segment strategies and
marketing programs that optimise EVA; and
 Elmer Funke Kupper

• understand the impact of a changing environment
32
and stress events on the risk profile of the institution.
In times of uncertainty, the MIS requirements tend to
increase significantly. For example, without knowing
what the bank’s Asian profile looks like, it becomes
difficult to differentiate actions on the basis of higher-
risk exposures versus core franchise activities.
There are two ways in which banks create an MIS to
monitor risk. The first approach involves integrating all
exposures into an information warehouse that provides
standard reporting across a range of different
dimensions. Unfortunately, building a warehouse can be
very time consuming and is usually hampered by a lack
of consistency and accuracy in data definitions and
integrity. The alternative method, referred to as
a ‘bottom-up’ approach, starts with decisions at the
transaction and customer level and gradually captures
the data centrally. This approach provides immediate
benefits for front-line staff, but does allow aggregated
risk data to be available early in the process. Most banks
end up taking a hybrid approach. In ANZ, domestic
data are captured in a central warehouse and are
supplemented by detailed data from the customer
profitability models in place offshore.
5.4. Provide Consistent Incentives
The establishment of a clear direction in risk
management will only work when the incentive systems
of the institution support the desired behaviour.
Generally, executive reward systems should be based on
a measure that adjusts for risk. If performance incentives
are tied to short-term revenue generation, they will
inevitably reward increased risk-taking behaviour,
particularly when earnings are down. This ultimately
leads to surprises.
There are different ways to link incentives to EVA. One
way is to focus entirely on the change in EVA from year
to year. This provides a clear incentive to improve
performance, but does not reward the protection of
existing EVA under competitive pressure. A different
approach is to tie incentives to a combination of absolute
EVA and changes in EVA. If the change is positive there
is significant upside to bonuses, while a reduction in EVA
erodes the available bonus pool. This approach
motivates managers to protect and grow value, but may
lead to some debate on the measurement of EVA.
Specifically, there may be debate about the way results
are risk adjusted, and the levels of costs and revenues
that are attributed to each line of business.
The focus on EVA does not mean that businesses cannot
have more specific targets in their business plans.
However, these targets need to be consistent with the
principles underlying the EVA methodology. For
example, one way to reduce exposure to higher-risk
assets is to combine a revenue growth target with a
reduction in allocated capital. This approach would

Figure 12: Differences between Three Lines of Business

Wholesale Banking Personal Banking Financial Markets

Credit Risk • Concentration risk • Centralised management • Close-out risk
• Customer profitability • Segment/product • Pure credit risk under
• Transaction approval profitability stress event

Market Risk • Basis risk • Considerable balance • Trading risk

• Indirect risk through sheet risk • Liquidity risk
customer base • Pricing and product • Concentration risk
approval • Stress and model risk

Operational Risk • Compliance, • Dependence on central • Dependence on technology

documentation risk
• Increasing technology
risk
operations and technology
• Network/change
management
• Compliance risk
• Fraud
and risk models
• Documentation risk
• New product approval
• Compliance/reputation
risk

Typical Credit
Risk Share of 80% 50% 10%
Total Capital

force the business to move along the risk curve, reducing
exposure to higher-risk assets while growing the lower-
risk, and more attractive, segments of the business.
5.5. Reinforce a Consistent Risk Culture
Stern Stewart, the consulting firm widely regarded as
one of the ‘founding fathers’ of EVA, has defined four
success factors in making the EVA methodology work:
i. measurement – determine the earnings and capital
adjustments appropriate for the company and
define the cost of capital;
ii. management – develop a framework for decision
making, including identification of EVA drivers;
iii. motivation – design a compensation system that ties
bonuses to EVA and offers substantial upside; and
iv. mindset – create training programs for staff and
communications material for shareholders and
other external stakeholders.
Frequently, the mindset is forgotten when
implementing new ways of managing risk. Developing a
consistent risk culture is the most powerful means of
ensuring that risk is well controlled at all levels. The
development of a consistent risk culture requires banks
to take three basic steps:
i. communicate the risk management objectives and
the desired shape of the institution;
ii. create and maintain a core competency in risk
management and ensure it is represented in all key
lines of business; and
iii. develop a track record for making decisions that are
consistent with the specified objectives.
When designing a risk management function, culture is
an important consideration. A strong and consistent
culture can afford greater delegation of decisions down
the line. A less coherent culture requires greater
intervention in the decision making process. Risk
management is a business responsibility and should not
be delegated entirely to a support function. Ultimately,
the chief executive is the only ‘company-wide’ risk
manager.
6. Conclusion
Banks have good reason to worry about risk
management; they continue to be caught by dramatic
turns in the economic cycle that arrive without much
Risk Management in Banking
warning. Even if these turns could be predicted in
33
advance, many activities are not yet liquid enough to
remove or hedge the risk. The recent crises in Asia
and emerging markets indicate that banks worldwide
continue to have difficulty in dealing with illiquidity.
Moreover, they appear to be caught in a vicious cycle
that moves between rapid growth in the ‘good’ times
and virtual standstill when a crisis hits home. To break
through this cycle, banks need to adopt a more
structured and top-down approach to risk
management. The challenge is to make strategic
decisions on the desired shape of the institution and
ensure that there is a sound balance between
businesses such as wholesale and consumer banking.
Typically, the decision to participate in a particular
business and allocate resources to that business
assumes a large part of the risk. Once that decision is
made, the bank should be prepared to incur stress-
related losses from time to time. As long as the risk
profile is in balance and well diversified, the
institution can absorb these as part of its normal
business.
Once the risk appetite has been defined, the focus
shifts to day-to-day decision making. To support the
lines of business and front-line staff in this process,
banks are increasingly adopting risk-adjusted
profitability measures. In ANZ, EVA has become one
of the dominant performance indicators and has been
fully integrated into the executive remuneration
scheme. EVA provides a natural incentive to focus on
risk. It provides a more constant message regarding
the risk of volatile activities, relative to other
measures, and in the best parts of the cycle serves as
a reminder that the underlying risk can still be
significant. It also supports strategies that optimise the
use of capital as a scarce resource. Conversely, during
a downturn it provides a more balanced picture of the
value of the business. This ensures that there is as
much focus on protecting the franchise as there is on
eliminating unacceptable risks.
7. References
Credit Suisse Financial Products (1997), CreditRisk+™
(http://www.csfp.csh.com), October.
Federal Reserve System Task Force on Internal Credit
Risk Models (1998), ‘Credit Risk Models at Major
US Banking Institutions: Current State of the Art and
Implications for Assessments of Capital Adequacy’,
May.
 Hoppe, R. (1998), ‘VaR and the Unreal World’, Patrick, S.C. (1998), ‘The Balanced Capital Structure’,
34
Risk Magazine, July. Journal of Applied Corporate Finance,
James, C. (1996), ‘RAROC Based Capital Budgeting Volume 11, Number 1.
and Performance Evaluation: A Case Study of Paul-Choudhury, Sumit (1998),
Bank Capital Allocation’, The Wharton School, Credit Risk Special Report, Risk Magazine, November.
University of Pennsylvania, Paper Number 96 - 40.
PricewaterhouseCoopers (1996),
JP Morgan/Reuters (1996), RiskMetrics™ – Technical Generally Accepted Risk Principles, United Kingdom.
Document, December.
Wilson, Thomas (1997a), ‘Portfolio Credit Risk (I)’,
JP Morgan (1997), CreditMetrics™ – Technical
Risk Magazine, September.
Document, April.
Wilson, Thomas (1997b), ‘Portfolio Credit Risk (II)’,
KMV (1999a), Credit Monitor™
Risk Magazine, October.
(http://www.kmv.com).
Zail, E., J. Walter, G. Kelling and C. James (1996),
KMV (1999b), Portfolio Manager™
‘RAROC at Bank of America: From Theory to
(http://www.kmv.com).
Practice’, Journal of Applied Corporate Finance,
KPMG (1998), Loan Analysis System
Volume 9, Number 2.
(http://www.kpmgconsulting.com).
Oldfield, G.S. and A.M. Santomero (1997),
‘Risk Management in Financial Institutions’,
Sloan Management Review, Fall.
Discussion
1. John Buttle*
Elmer Funke Kupper’s paper provides broad-ranging
coverage of the state of play of risk management in the
banking industry. This discussion provides some
comments, many of which accord with Funke Kupper’s,
based on what I have observed in financial institutions.
As the paper acknowledged, risk management has
undergone significant evolution over the last two
decades. Twenty years ago a bank’s risk management
function was almost non-existent. Since that time, banks
have experienced an influx of mathematicians, actuaries,
behavioural scientists and marketers which have changed
banks’ approaches to managing risk. Whilst the industry
has come a long way, there is still further to go. The
continually changing dynamics of banking activities, the
business environments in which they operate and the
volatile nature of the world economy, imply that the
nature of risk, and its measurement and management,
must also evolve over time.
Managing risk has become more difficult with the
trend towards a global financial system. Increasingly,
the Australian economy is impacted by events
occurring in other parts of the world. Not only do
risk managers need to be concerned with what is
happening in international markets, but with how
overseas risk managers are managing risk. The
potential for problems associated with the Year 2000
turnover is an excellent illustration. The need to
address more immediate concerns in the region has
resulted in varying degrees of Year 2000 readiness.
Consequently, in addition to their own Year 2000
preparations, Australian businesses have adopted
strategies to mitigate the risk arising from the failure of
other countries in the region to adequately deal with
the Year 2000 issue. Hence, effective risk managers
need to be aware of the risks that extend beyond the
boundaries of local operations.
The Importance of Stress Testing
A fundamental component of risk management is stress
testing. The experiences of the Asian crisis and
emerging markets have served to reiterate the
importance of a comprehensive stress-testing regime.
To understand the impact of extreme events, banks
must implement a stress-testing framework that
systematically analyses the impact of different scenarios
on the values of their portfolios. The difficulty is in
determining which events to stress test and/or which
* Chairman, Financial Services Industry Group, KPMG.
35
parameters to use. The paper provides some useful
starting points in this regard. Most importantly, the
stress-testing framework should be tailored to the
characteristics of the bank’s individual portfolios and
should capture all the risks associated with those
portfolios, ie market risk, credit risk and operational
risk (including liquidity risk and business risk).
The need to regularly, and rigorously, stress test trading
portfolios for market risk is now universally accepted.
Many banks, or at least those with relatively
sophisticated trading portfolios, have in place some
form of scenario analysis based on large shifts in market
prices. I think that the industry is less developed in
stress testing credit- and liquidity-related events. This
may be because these types of stress tests are more
difficult to implement. Whatever the reason, it seems
that fewer banks have developed a comprehensive set
of scenarios encompassing exposures to such risks as
counterparty risk and liquidity risk. This is an area on
which the industry should focus over the next few years.
Breaking the Vicious Cycle of Risk
The paper discussed the role of a bank’s risk
management function in the context of the ‘need to
break the vicious cycle of risk’. The cycle refers to the
process by which a bank assumes uneconomic risks
and, by definition, makes large losses. As a
consequence, the risk appetite of the bank is reduced,
lending and trading risks are foregone and the bank
loses market share. In turn, the bank adopts an
aggressive marketing strategy to regain market share
and the cycle starts over. Funke Kupper’s ‘vicious cycle’
aptly describes the risk-taking practices observed in the
industry time and time again.
Inarguably, all banks are faced with the challenge
of breaking through the vicious cycle of risk. An
appropriate framework for performance and decision
making is critical in this respect. Many banks have
adopted a performance-based strategy similar to the
economic value added methodology outlined in the
paper. It is widely recognised that such an approach
most appropriately manages the trade-off between risk
and reward. This type of approach provides suitable
incentives for management while being consistent with
shareholder objectives. Ultimately, a ‘balanced score-
card approach’ to managing the institution is required
– it is important not to allow one particular area of
 Discussion
business to dictate the strategy of the firm to the
36
detriment of other businesses.
The move to dynamic provisioning methodologies
witnessed across the industry is also important in
breaking the cycle. Dynamic provisioning refers to the
practice of setting aside reserves, or provisions, to cover
potential losses. The amounts provisioned are based on
statistical assessments of the risks inherent in exposures
and are adjusted continually as exposures change.
While dynamic provisioning techniques are still
evolving, the development of these types of approaches
to risk management is undoubtedly contributing to a
greater understanding, within individual banks, of the
risks they are exposed to and how those risks change
over time.
Definition of Risk
The risk management role described in Funke Kupper’s
paper is based on the volatility of a corporation’s market
value. Many financial institutions view the optimisation of
shareholder value as a key driver of their businesses. Of
course, this definition of risk implicitly assumes that the
bank’s risk appetite and profile are sufficiently
transparent to enable the investing public to make a
genuine assessment of the risks that the bank is exposed
to and hence make an informed decision regarding the
risk and reward trade-off. I question whether investors
have access to sufficient information to be able to make
those sorts of assessments. Further, volatility is affected by
the general state of the industry and by country issues –
the paper made reference to a situation where US bank
stocks plummeted in response to a general malaise about
the overall performance of the banking industry and
uncertainty about the risks inherent within individual
institutions.
Strategic Risk as an Additional Risk Class
As identified in the paper, institutions generally
distinguish between three types of risk: market, credit
and operational risk. While many institutions have
systems in place for quantifying market and to a lesser
extent credit risks, it is often argued that operational
risk is too difficult to measure. There is, however,
a significant amount of work being undertaken by
institutions to gain a better understanding of
operational risk. Many institutions define operational
risk as the residual risk over and above credit and
market risk. I suspect there is value in separating out
what is in fact operational risk and what is strategic risk.
1 A top-down capital allocation strategy begins with an amount of capital for the bank that is commensurate with the return expected by
the bank’s shareholders. The capital is then allocated across businesses. By contrast, a bottom-up capital-allocation methodology
employs, as a starting point, the exposures of individual business units. These are then aggregated to determine the required capital
holding for the bank as a whole.
One Australian major bank, for example, refers to
strategic risk as the risk associated with what is done
and operational risk as the risk arising from how the
bank goes about doing what is done. Since the two risks
are different, the approaches adopted to manage the
risks may also differ. Strategic risk must be considered
in the context of operational leverage, the volatility of
revenue, vulnerability of the business areas, lack of
diversification in customer markets and products,
flexibility and innovation.
Another facet of strategic risk stems from competitive
responsiveness. This refers to the ability of an
institution to reduce costs and still remain competitive
or to withdraw from activities when the outlook is not
favourable or is not consistent with the strategy of the
bank. A good example, identified in the paper, is ANZ’s
ability to reduce exposures to the Asian market and
withdraw from proprietary trading. Failure to be able to
make those decisions, and to act on them in an
effective manner, implies a lack of flexibility. Risk
management is not simply about measuring and
controlling risk, but about looking ahead, making
decisions about what is the optimal risk profile of the
bank and, most importantly, working to rein in
exposures where they are not commensurate with that
risk profile. A bank’s approach to managing risk should
be a dynamic and pro-active one.
Capital Allocation
As overall capital levels have become more important to
an institution’s performance, capital allocation has
received more attention from management. An
effective capital allocation system is one that drives
management behaviour in a direction that is consistent
with shareholder objectives. A fundamental pre-
requisite for this to occur is that the capital allocation
process is fair, reasonable and, most importantly,
credible. If management do not have faith in the system
it is likely to be ignored or else lead to behaviour that is
inconsistent with shareholder objectives. One key to
achieving ‘faith’ in the capital allocation process is
reliable information on exposures. As discussed in the
paper, ANZ approached the task using ‘top-down’ and
‘bottom-up’ methodologies simultaneously, realising
that it would take a number of years to acquire the
relevant information.1 Such an approach is likely to
achieve the desired results. More work needs to be
done to incorporate operational and strategic risk into
the capital allocation framework, although from a

global perspective, the Australian banking industry is
relatively advanced in this regard.
The Role of Regulators and
Rating Agencies
The track record of regulators is commendable.
They have come a long way over the past decade in
prescribing capital requirements that are
commensurate with banking exposures. The regulatory
framework captures credit risk, although the
methodology employed is less sophisticated than that
used by a lot of banks. Market risk is also dealt with –
and the techniques employed by regulators and banks
to measure this type of risk are more or less consistent.
While operational risk is not explicitly incorporated into
the framework, regulators, both in Australia and
internationally, are certainly encouraging banks to focus
on the development of techniques to quantify this risk.
In the future, capital requirements will need to be more
dynamic and responsive to changes in banking
exposures. Again, regulators should be, and in fact are,
encouraging industry participants to come together to
discuss how this could be achieved. On-site credit and
market risk visits have been helpful, obviously for
regulators but also for banks. While some might argue
that these visits are intrusive, I think they add significant
value in that regulators observe the risk management
practices of an array of institutions and are able to
provide banks with an indication of ‘best practice’.
There is also a need to address the lessons learned from
other jurisdictions such as the hedge fund problems in
the US. These problems give rise to the question: were
2. General Discussion
Discussion focused on banks’ risk management
achievements to date as well as some of the risk
management issues the industry is yet to address.
Particular consideration was given to the use of banks’
own risk measurement models for determining
regulatory capital and to the potential for sharing credit-
related data across the industry to hasten the pace of
development of credit risk measurement models.
It was generally agreed that the banking industry has
come a long way in relation to risk management over
the past decade. Risk management functions in
Risk Management in Banking
Australian banks not involved because they were not
37
invited to be parties to those transactions or because
the banks’ risk management systems kept them out of
trouble? Additionally, many of the problems
experienced by institutions in Asia are similar to those
incurred by Australia’s banks in the past; Australian
regulators could help to enhance the effectiveness of
their Asian counterparts.
Finally, there is concern as to whether rating agencies
have the specificity of knowledge on financial
institutions to form their ratings judgements. Many
banks aim to hold sufficient capital to sustain a AA or
AA+ rating. In many respects, therefore, rating
agencies are driving capital holdings within individual
institutions. I think that the influence of rating
agencies on absolute levels of capital is too strong. Do
rating agencies, in fact, have any accountability?
Certainly they play a vital market role, however I think
there are issues surrounding how they operate. In
addition, the tenuous links between the information
that rating agencies have regarding a particular
institution and the reality of that institution’s situation
are particularly evident in the middle market. The
default studies undertaken by rating agencies are
extremely useful for the top end of the market but less
so for the middle market. The latter is riskier because
of the lack of market understanding of this segment.
There is probably significant reward to be reaped from
institutions in this market segment. Perhaps there is an
opportunity for the industry to band together and pool
knowledge about the middle market.
Australia are very strong and are thought to be well
positioned, and perhaps on a par with, some of the
best practice around the world. The industry is
learning very fast and one of the challenges over the
next several years, as the new regulatory framework
evolves, is to move beyond banking and learn from
other industries, such as the life insurance industry.
Participants’ views were sought on whether banking
supervisors have over-emphasised value-at-risk (VaR) at
the expense of other risk monitoring techniques.
Regulators did not believe this to be the case in that
 Discussion
VaR-type concepts are applied as part of a framework
38
that demands comprehensive scenario analysis and
robust internal controls. Participants generally agreed
that Australian regulators are performing reasonably
well in terms of analysing the risk measurement models
used to generate regulatory capital. That said, some
participants held the view that, in a relative sense,
regulators are focusing too much on the models
themselves and should instead devote more resources
to understanding the desired risk profiles of financial
institutions, the activities that institutions are
undertaking and the strategies that are driving those
activities. Areas such as credit derivatives and
securitisation were of particular concern in that the
markets for these products have been growing rapidly
but have not been tested under stress. Hence, it was felt
that regulators should direct more attention to banks’
involvement in these activities.
Participants were keen to explore the potential for the
industry to move down the path towards an ‘internal
models’ approach for credit risk. There was broad
agreement that the regulatory capital required to
support banks’ credit exposures would, in the future,
be linked to more rigorous risk measurement
methodologies. Certainly, over the next few years the
industry will be substantially challenged by the move to
develop credit risk models; it was acknowledged that
the process is much less straightforward than that for
market risk with even the most basic credit risk
calculations being a good deal more complicated. As
a starting point, the industry is keen to apply market
value concepts to credit risk. It was suggested that a step
in this direction might be to report to management
information on mark-to-market losses resulting from
‘what-if’ scenario analysis, rather than information on
the actual credit losses experienced. Hopefully, this
would convey to management the message that a range
of events can lead to a significant loss in value, and that
this fact must be taken into account in the pricing of
transactions.
There was unanimous agreement that the most
significant limitation to developing comprehensive
credit risk models is the absence of historical data
on such variables as the likelihood of default and
the severity of loss in the event of default. Some
participants doubted the industry’s ability to develop
satisfactory models within the next few years because of
inadequate data. Currently, many of the credit risk
models being developed, particularly in the business
and wholesale sectors, have as their foundation rating
agencies’ data reflecting US experience, which may not
always be directly translatable to Australia. One
solution might be for institutions to share the data that
they have compiled. Certainly, the large Australian
banks are beginning to think more about the benefits
of co-operation in terms of sharing credit-related
information. While proprietary considerations might
impose some boundaries around this option, it was
thought that APRA could play an important role in
facilitating data pooling across the industry.
There was some discussion about the implementation
issues surrounding performance measurement
techniques such as economic value added (EVA).
Clearly, a framework based on a one-year horizon
effectively rewards businesses on the basis of the cash
flows generated during the year, over and above the
relevant cost of capital. Such an approach runs the risk
of depriving new businesses of capital since those
businesses will not be able to generate a positive return
in the first year of operation. In fact, it may encourage
new businesses to assume more risk. To overcome this
problem, some institutions base remuneration on a
range of factors that determine performance. Thus,
although management imputes a target EVA that the
business must aim to achieve over a certain period, the
key drivers of performance are taken into account
when determining what this target EVA should be. For
example, if customer base is thought to be the sole
driver of performance, then this variable will ultimately
drive the generation of EVA and should be factored
into an individual’s performance contract. It is
important to base performance on fundamental drivers
in order to achieve the desired investment strategy.
It was acknowledged that there are numerous
difficulties experienced when structuring an
appropriate performance measurement framework.
Moreover, irrespective of the framework chosen, there
will inevitably be debate about the EVA amount that is
determined. To overcome this problem, some
institutions have set the basic internal control
framework, verified by the audit function, as the
fundamental foundation for doing business. The basic
philosophy is that the internal control environment
must be in place before any business can be rewarded
for performance. Hence, compliance with these
controls serves as the minimum performance target;
if a business experiences more than a prescribed
number of adverse audits over the performance

measurement period, the revenue generated by that
business is irrelevant. Additionally, participants
discussed the disadvantages of pursuing an active
capital allocation strategy. Some institutions chose not
to use allocated capital as a means of influencing
business outcomes because to do so could induce
managers to reduce the size of their businesses.
Discussion surveyed the key risks faced by banks, over
and above credit risk. It was generally agreed that, in
contrast to other industries, many of the risks likely to
have the most significant impact on financial
institutions have not been clearly identified. In
particular, risks relating to settlement, people and
systems were regarded as being of most concern
because institutions will really only be aware of the full
impact of such risks after they have occurred. Some
participants argued that the development of fully
effective business continuity plans is not possible since
banks can never be certain of how a particular crisis will
evolve. The dilemma is that the institution does not
know what will go wrong until it actually does go wrong.
Attention naturally turned to the issues associated with
the Year 2000. Liquidity problems were discussed in the
context of retail and wholesale systemic crises. On the
retail side, the concern is that individuals will withdraw
transaction balances between now and the Year 2000 on
the assumption that automatic teller machines and
EFTPOS facilities may fail and funds may be
inaccessible. An important role for regulators is to
acknowledge that transaction demand will
understandably increase and to reassure the
community that there will be sufficient cash in the
system. Many participants felt that retail liquidity is not
a major concern because individuals will overcome
whatever problems arise. The wholesale side is much
more of a concern. Of course, if a wholesale systemic
crisis were to emerge the Reserve Bank would
necessarily play an important role in the provision of
liquidity. Business continuity plans are an important
factor in Year 2000 preparations, and supervisors,
institutions and the Reserve Bank are working
together to organise a joint contingency plan. There
was disagreement about the extent to which the global
industry was tackling the issue. While some
participants felt that preparations were proceeding as
planned, others were of the view that a lot more needs
to be done.
Risk Management in Banking
Participants were interested in exploring the notion of
39
reinsurance for banking risks. It was thought that for a
small market like Australia, the opportunity to use
reinsurance-type methods to diversify risk with other
countries would hold some interest. Over the last few
years, about 30 institutions, including large US
investment banks, Canadian banks, Australian banks
and a few European banks, have been discussing the
potential to establish a reinsurance arrangement in the
finance industry. Basically, the arrangement would
endeavour to insure against a range of events over and
above some pre-specified amount. The idea is that at
least one of these events will most probably occur over
time but which institution will be affected is uncertain;
hence, institutions share the burden. Discussions have
been wide ranging, canvassing such topics as what
constitutes operational risk or credit risk and which
institutions should be part of the arrangement. Of
course, the arrangement is not straightforward to
establish because the impact of an event on a financial
institution is usually very difficult to determine. One of
the positive aspects of such an arrangement is its
flexibility; there are no competitive issues and multiple
agreements can co-exist. Unfortunately, discussions
have stalled over recent months, partly owing to the
flurry of merger activity around the world.
Finally, there was some suggestion that competitive
pressures within the industry are inducing banks to
assume more risk in a bid to maintain market share.
This view was prefaced by evidence that US banks are
becoming increasingly lenient in their lending
standards. Concern about ‘excessive competition’ was
thought to be the primary factor driving this trend;
banks are lending large amounts to lower-quality
counterparties because of fears about losing market
share. It was argued that a paradox was emerging.
Specifically, while there seems to be a fairly common
perception amongst the public and consumer bodies
that there is not enough competition within the
financial services industry, for industry participants,
competition is quite intense. Many participants
questioned the view that excessive competition is
driving down credit standards in Australia. While there
is plenty of competition, it was generally agreed that
banks are reasonably cautious in their lending
strategies, particularly with regard to the middle
market where most uncertainty was thought to exist.