Aligning Risk Management, Finance, and Operations

Senior executives on governance, uncertainty, and performance amid a global banking crisis

A report prepared by CFO Research Services in collaboration with Ernst & Young

Aligning Risk Management, Finance, and Operations
Senior executives on governance, uncertainty, and performance amid a global banking crisis

A report prepared by CFO Research Services in collaboration with Ernst & Young

uncertainty.. Boston. which is solely responsible for its content. Gary Hwa and JB King at Ernst & Young for their contributions and support.com.. and Christopher Watts. CFO Publishing is part of The Economist Group. Tom Campanile. Ernst & Young funded the research and publication of our findings. which produces CFO magazine in the United States. Celina Rogers directed the research and wrote the report. without written permission. Finance. .Aligning Risk Management. Hank Prybylski. 253 Summer Street. No part of this report may be reproduced. Greg Derderian. December 2008 Copyright © 2008 CFO Publishing Corp.. with contributions from Elizabeth Fry. At CFO Research Services. and Operations: Senior executives on governance. 211. All rights reserved. or janecoulter@cfo. Please direct inquiries to Jane Coulter at 617-345-9700. by any means. and China. stored in a retrieval system. We would like to acknowledge TJ Letarte. CFO Research Services is the sponsored research group within CFO Publishing Corp. Alison Rea. David Gittleson. MA 02210. and performance amid a global banking crisis is published by CFO Publishing Corp. or transmitted in any form. Asia. Europe. Jill Robinson. ext.

and regulators Risk management. ascendant Going back to basics Sponsor’s perspective 2 5 8 8 9 10 11 13 14 15 17 . and the business units Establishing a risk management culture Bringing risk management and finance into closer alignment Increasing integration between financial and risk management as risk-weighted capital gains prominence Improving both qualitative and quantitative analyses Communicating risk to external stakeholders: investors. and governance Solutions—improving alignment among risk management. analysts.1 Contents Euphoria gives way to reality—crisis in the financial markets Problems with information. finance. organization.

Savings and Loan Crisis in the late 1980s and early 1990s and the Asian Financial Crisis in 1997. Since the current financial turmoil began. buoyed by high housing prices. But just a few days after the bailout was announced. the current financial crisis. and relatively scarce credit have taken a serious toll on national economies. promised to eliminate risk and guarantee returns. were extraordinarily liquid—and that liquidity was finding a home in cutting-edge securities that.” has yet to find a name—or an end. As this report goes to press. many of the world’s largest and most prestigious financial institutions have taken large write-downs. DECEMBER 2008 . The same week. U. the firm filed for bankruptcy. Despite a massive injection of capital. financial institutions. and the U. it has become clear that this crisis is by far the most serious challenge to the European central banking system in decades.S. This move will allow the banks to shore up their balance sheets by taking deposits. Although it is widely hoped that the bailout— the largest in U. In late September. banks and their investors suffer. to the detriment of the financial system and the larger economy: in recent months. the United States remains in the throes of a banking crisis weeks after its passage. Financial markets around the world have been in turmoil for over a year: investors have taken heavy losses. Financial markets rallied as investors signaled relief and support for the Fannie/ Freddie bailout. As a result. But it wasn’t long ago that the financial markets. at least on the surface. After an urgent weekend of negotiations among top bankers and government officials failed to secure a buyer for Lehman Brothers. but it will also force them to submit to far greater regulatory oversight. government has enacted a massive rescue plan for the nation’s financial institutions that may cost taxpayers US$700 billion or more. sparked by a collapse in residential housing prices and rising defaults in the category of high-risk loans known as “subprime. global credit markets remain virtually frozen.S. At this printing. Finance.’s Royal Bank of Scotland).S. In Asia. mortgage giants Fannie Mae and Freddie Mac went © 2008 CFO PUBLISHING CORP. Most industry observers say this shift will mark the end of an era on Wall Street. financial markets plunged again when Lehman Brothers announced that its intensive efforts to obtain a much-needed capital infusion had failed.K. are only a few of the most prominent. many have also been forced to raise billions of dollars in fresh capital to continue operating. In early September. it was the sudden failure in April of investment bank Bear Stearns that signaled—and perhaps exacerbated— the seriousness of the current crisis. The destruction of economic value is even more pronounced. access to credit is highly constricted (despite relatively low interest rates).S. have received permission from regulators to establish commercial banking divisions. Even when those efforts are successful. widespread volatility in the financial markets. and Operations: Euphoria gives way to reality—crisis in the financial markets The world financial system has weathered several major financial crises in the past several decades: the U.S. and financial markets are highly illiquid. of course. Asia’s previously robust economic growth has moderated substantially in the wake of the financial crisis. Japanese compa- How did it come to this? Several sources allude to the tendency for firms and investors to become complacent in times of economic and business expansion. European banks— which had invested heavily in mortgage-backed securities originated on Wall Street in recent years—are threatened by the same credit and liquidity problems that have plagued U. Merrill Lynch was sold and insurance giant AIG was rescued from the brink of failure by a US$85 billion government bailout. Indeed.S. Belgium-based Fortis. Washington Mutual—the largest thrift in the United States—was seized by federal regulators in the biggest bank failure in U. the U. Goldman Sachs and Morgan Stanley. followed in short order by the Russian Financial Crisis in 1998. into government conservatorship. As Iceland’s financial system collapsed and European governments worked in the aftermath of the Lehman Brothers collapse to arrange bailouts of some of Europe’s largest financial institutions (including German lender Hypo Real Estate. and it continues to slow. many banks have been forced to sell valuable assets at fire-sale prices and dilute the value of their shares to raise capital. history—will stabilize global capital markets and loosen credit constriction.10 2 Aligning Risk Management. history. when efforts to raise capital fail and banks collapse. The United States’s last two major investment banks. plummeting demand.

“When they’re in the upswing of a cycle. Europe. and so they tend to forget about how to mitigate against those risks and how to protect themselves from whatever the next downturn is going to be. regulatory agencies. the findings presented here are based on a variety of qualitative sources and should not be taken to represent the views.” This growing sense of complacency can only have been enhanced by the apparent promise of new. and performance amid a global banking crisis 3 About this report In the summer of 2008. problem. with little historical data to reveal how they would behave under a wide range of market conditions. revealed about risk management practices at banks and other financial institutions? And where will firms go next? This study is the second in the CFO/E&Y Bank Executive Series. We interviewed senior finance and risk executives at global banks in North America. and Australia for this study. and rating agencies. economy. and the currencies of developing countries to seek shelter in the yen and the U. As even the brightest lights of world economic growth begin to dim. firm-issued public statements. which seemed to allow banks to reap rewards with little or no risk to their own balance sheets. say our sources. and biggest. in particular. But these highly complex instruments were largely untested. Our goal was to learn how global financial services companies view risk management practices in their industry: How did the financial system get to this point? Is this financial storm different from those we’ve weathered in the past? What has this financial crisis. “I think that complexity—taking. dollar. people forget what the depths of the most recent downturn looked like. for example. CFO Research Services (a unit of CFO Publishing Corp. people tend to forget that economies and businesses tend to go in cycles. merging them together.S. nies have been hit especially hard. or statements of named participants in the interview program. How did it come to this? Several of our sources allude to the well-documented tendency for firms and investors to become complacent during periods of economic and business expansion. chief risk officer at JPMorgan Chase. a pool of mortgages and creating a CDO [collateralized debt obligation]. and then taking a number of CDOs.Senior executives on governance. unless specifically attributed. as anxious investors fled the euro. which was fueled by vigorous growth in the financial sector. practices.” says Barry Zubrow. It builds on a key finding in our prior study.) conducted a series of interviews with top finance and risk executives at some of the world’s largest banks. credit-derived securities and other investment vehicles. the British pound. uncertainty. The Finance Operating Model Matters—that leading banks and their finance organizations have room to improve the way they integrate risk assessment. financial performance management. perceptions. We supplemented material gathered through interviews with extensive secondary research to develop our conclusions. we also conducted background interviews with other knowledgeable individuals at banks. and media reports—and background interviews. This has made Japanese exports more expensive on world markets and has effectively ended the so-called “yen-carry trade”—the widespread practice of borrowing money inexpensively in Japan and investing it elsewhere—causing Japanese capital markets to plunge. Asia. This phenomenon may have been particularly acute in the last growth cycle in the U. . I think that’s the first. and communication. and reslicing that into yet another set of obligations DECEMBER 2008 © 2008 CFO PUBLISHING CORP. Given the sensitivity of the topic. the global economic outlook is likely to remain grim for months to come.S. We interviewed executives at the following companies: • • • • • • • • • • • • • • • • Allianz Bank of America DBS Group Holdings Limited Halifax Bank of Scotland (HBOS) ING Group JPMorgan Chase KeyCorp National Australia Bank National Bank of Canada Royal Bank of Scotland (RBS) Shinsei Bank Standard & Poor’s Standard Chartered Bank UniCredit Wachovia Westpac Banking Corporation Because this report is based in part on desk research—including reports from regulatory bodies. “Unfortunately.

and preparing to move forward into the next new world. The last thing we want to do is eliminate risk. measure. with different characteristics without having a lot of real data underlying those original CDOs in terms of default history—is really what has led to a lot of the subprime crisis. Finance. adjusting and improving their risk management practices substantially.10 4 Aligning Risk Management. because then we would eliminate reward. because then we would eliminate reward. “But it goes without saying that as bankers we live in risk at all times.” says Rahul Gupta. DECEMBER 2008 . Complacency and complexity seem to have combined to create a volatile and destructive situation that raises the question: “Do banks truly understand their risk positions?” The turmoil of the past months has been a forceful reminder that financial order. CFO of Japanese commercial bank Shinsei. and liquidity can’t be taken for granted.” After all. because their businesses are fundamentally based on putting capital at risk. stability. we found that many financial institutions are taking stock of where they’ve been.” says one bank CFO. it is critical for banks and other financial institutions to understand.” says Charles Hyle. And even in the midst of the current financial crisis. and manage risk well. At the same time. “Some people started to believe they lived in a riskless market. what role would financial institutions play in a world in which risk were truly eliminated from the market? Business fundamentals have not changed: risk and reward still go hand-in-hand. chief risk officer at KeyCorp. The last thing we want to do is eliminate risk. and Operations: “It goes without saying that as bankers we live in risk at all times. © 2008 CFO PUBLISHING CORP.

executive general manager of the business and private banking group at National Australia Bank. and we basically found four common denominators: credit concentration. but far from all of them. liquidity.—who 1 co-chaired the CRMPG III). issued by the Senior Supervisors Group (March 6.” Financial institutions stood exposed to risks that extended well beyond credit risk to encompass market. was generally not well understood or accounted for. and industry authorities that have made substantial strides toward identifying the causes of the disruption and proposing improvements. ‘That just doesn’t look right. that took financial institutions by surprise. recalls that before the financial crisis took hold he saw a study documenting a dramatic leap in the number of transactions in the financial system between the mid-1990S and the mid-2000s: “I thought. Gerald Corrigan— former president of the Federal Reserve Bank of New York.1 The Counterparty Risk Management Policy Group III (CRMPG III) prepared one of these reports. however.” Barry Zubrow.” The risk manager also points out that many in the industry were discussing the possibility of a market unraveling well before it took place. serves as co-chairman of the Enhanced Credit Market Resiliency working group of the CRMPG III. because a lot of this risk was so distributed and interrelated. . The interplay and overlap among these risks have often been relatively poorly understood and. organization. Containing Systemic Risk: The Road to Reform. A raft of reports has already been issued by government agencies. issued by the Counterparty Risk Management Policy Group III (August 6. regulatory bodies.. “I think the thing that surprised people in the industry—and what was different about this situation— was the speed and breadth of the contagion. for example. What we found in the Corrigan Report is that. the highly regarded Containing Systemic Risk: The Road to Reform (commonly referred to in the business media as the Corrigan Report after E. biggest problem” that led to the current crisis. “We spent a lot of time talking about what led up to this market disruption. It was the swiftness of the cascade of negative effects throughout the financial system. even in the midst of an apparently benign risk climate. but complex financial innovations—rather than eliminating risk—actually magnified exposure by creating unexpected overlaps among risk categories. and even reputational risks. chief risk officer at JPMorgan Chase. excessive leverage. and the illusion that the market liquidity that exists today would always exist. and performance amid a global banking crisis 5 Problems with information. That was one thing that caused me to think that’s something very odd here. although the euphoria that tends to develop during an “up” period in the business cycle—resulting in complacency regarding preparation for the next downturn—was the “first. Not only did relaxed underwriting standards allow exposure to a rapidly increasing number of defaults. according to our sources. as it rippled through the financial system with largely unexpected and devastating speed. cannot yet afford us 20/20 hindsight. DECEMBER 2008 © 2008 CFO PUBLISHING CORP. 2008) and Observations on Risk Management Practices During the Recent Market Turbulence. This ripple effect exposed financial institutions to risks that extended well beyond credit risk to encompass market.. and nearly all of our sources refer to the phenomenon. other factors also came into play. He continues: “I think the second contributing factor was the fact that we had.’ If you go back to basic economics and basic finance. can be very difficult to predict. the speed to contagion was even greater than we would have expected. 2008). He notes that. uncertainty. Several sources recall an unsettling sense that the markets were on the verge of spinning out of control. however. also known as the Corrigan Report. broad-based mismatches of maturity. and governance Could financial services companies have predicted the current financial crisis? Could they have mitigated against it more effectively? Or was the confluence of events that led us to this point an extremely rare occurrence that no model or manager could have predicted? Our sources are quick to point out that our current vantage point. they agree that the severity of the collapse of the residential real estate bubble in the United States may have taken a few financial institutions entirely by surprise.Senior executives on governance. and reputational risks. in fairness. liquidity. in a number of these See. The fallout from that collapse. In general.. Several of our sources have adopted the term “systemic risk” to discuss this set of risks and the interactions among them. and we need to increase our level of alertness regarding the risks that are emerging. Joseph Healy. the number of transactions in the financial system should be highly correlated to the level of economic activity—so what had actually taken place was that the financial system had taken on a life of its own. Goldman Sachs & Co. and now managing director. in the midst of the crisis. rather than any discrete risk or set of risks. According to one risk manager who sat on a subcommittee of the CRMPG III.

well before the consequences of these shifts began to take hold in the financial markets. While several of the executives we spoke with say they worry that regulatory issues may have contributed to the crisis. Zubrow points out. “I think a lot of © 2008 CFO PUBLISHING CORP. even banks that had no contractual obligation to do so have elected to fund these vehicles.S. Finance. exposures when the market for short-term commercial paper became illiquid. some cashstrapped homeowners have chosen to pay credit-card or other unsecured debt before satisfying their mortgage obligations. A similar dynamic has unfolded in the market for auction-rate securities. faced with the prospect of substantial reputational damage. nor did they always take into account the full range of exposures created by certain activities. Rather than paying their monthly mortgage payments first. customer behavior. could have obscured the underlying value of those assets and ultimately added more pain for some struggling financial services companies. that having to mark certain assets to market. and other observers will no doubt discuss the role of fair-value accounting requirements in the current crisis for some time to come. he says. Tanya Azarchs. The broad-based migration away from traditional underwriting standards that require a substantial equity stake in real property certainly helped remove historical safeguards against these consumer behaviors. DECEMBER 2008 . even now. The relative newness of these investments also means that historical data documenting their behavior under a variety of market circumstances is scarce. a banking analyst and criteria officer in the banking group at Standard & Poor’s. loan default rates. Organizational issues—in particular. While our sources consistently describe financial and risk modeling—scenario analyses. changes in customer and market behavior that seem to run contrary to many of the assumptions banks use to model risk. and ultimately costly. For at least some multiline banks that have been severely tested by the current crisis. a lack of communication between risk managers and line-of-business risk takers—likely prevented some banks from taking advantage of the abundant information that was available to them internally. various accounting rules and reactions in the marketplace made the cycle accelerate and become even deeper. in the absence of a functioning market against which to measure the value of those assets. The situation was also exacerbated. and so on—as very useful tools in making financial and risk management decisions. effectively (and unexpectedly) bringing them onto their balance sheets. housing prices has created incentives for homeowners to behave in ways that run counter to wellestablished patterns. and Operations: businesses. Numerous media outlets have reported that the steep decline in U.” Mr.10 6 Aligning Risk Management. credit-derived securities and credit-protection instruments had become exceptionally complex. in turn. For at least some financial institutions that have been affected by the financial crisis. and more. Risk models and analytics were not always calibrated to focus on the effect of highly unlikely “tail” events (such as a sudden disappearance of market liquidity) on the markets for these instruments. For example. regulators. while some risk categories have always been more difficult to model than others even under ordinary circumstances. they also allude to what appears to have been an over-reliance on problematic models in the financial sector. organizational issues—particularly weak communication between risk managers and risk takers—likely prevented them from taking advantage of information that could have provided critical insights. Uncertainty related to these behavioral shifts is. for example. Industry authorities.S. for example. a pro-cyclical impact—when things started to turn down. by regulations that prohibit banks from setting aside extra loan-loss reserves when times are good. they also express concern about other external forces—in particular. stress testing. And this uncertainty. housing market. is contributing to the lack of liquidity in the financial markets. But our sources also point out that. the irony is that their organizations probably had access to information that would have provided critical insights into changes in the U. some banks sponsoring and/ or funding lucrative structured investment vehicles and other conduits discovered hidden. describes some of the risk management improvement efforts banks plan to undertake in light of recent problems. spreading beyond subprime borrowers to include prime borrowers—customers with solid credit histories and more substantial equity investments in their houses. financial and risk models for the most complicated.

[One major global bank indicated in a recent statement to analysts that it] is trying to do this. Systematic deregulation in the financial services sector also likely played a role. and business unit management haven’t worked well. because it had been years. uncertainty. . risk management.” Bank executives also acknowledge that intense pressure to produce revenue growth helped to create circumstances at many banks in which risks were systematically downplayed. but access to useful information is imperfect. So I spend a lot of my time saying.. formerly senior vice president of risk management at National Bank of Canada. because of the market forces of supply and demand. We’ve looked at a lot of the worst-case scenarios that have unfolded at other banks and asked ourselves. Information and sophisticated modeling is abundant in the industry.” With highly complex investments trading in an untested market. indeed. according to several sources. This may well have had the unintended effect of removing the first line of risk management defense at many banks. One high-ranking officer in a bank that has taken large subprime-related write-downs says he believes that senior managers—who. and relationships. are the people charged with approving deals—were often ill-equipped to understand the complex arrangements they were approving. and models alone have proven to be insufficient. but there were no governance mechanisms in place to force the business lines to submit transactions for approval before decisions were taken. would we have gotten caught up in it?’ What’s interesting is when the answer ends up being ‘No. it’s partly because your front-office employees are the ones that are doing the best job at managing the risks. relationships among the finance function. Some sources report that they observed situations in which senior managers not only did not understand the products their firms were selling or the markets for those products. But what really happened is that the value of AAA-grade tranches dropped more than the value of non-investment-grade tranches. functional alignment. Some of the most serious internal breakdowns leading to the current crisis appear to have been organizational—in governance. Could some of these institutions not have benefited from the advance knowledge that things were going badly off the rail in the mortgage market?. they would be fine. and performance amid a global banking crisis 7 institutions now are trying to facilitate better communication [between various silos of risk takers]. “If you have very good risk management in any firm. ‘Everybody owns risk. The investment bankers who help create mortgage-backed securities probably could have benefited from the knowledge of the lenders. we wouldn’t have done that. since many of them had last worked on deals themselves. by creating communication between the expertise that resides in the mortgage banking unit—[with] loan officers and so on. ‘Could something like this have happened [at National Bank]? If something like this had come through our door.’ it’s often because our front-line personnel are smart enough to turn down the deal or forgo a trade— without ever coming to risk management—because they have good judgment. incentive compensation schemes for line-of-business personnel at many banks have tended to reward revenue generation—even if the risks taken to attain that revenue growth were excessive. who have day-to-day knowledge of conditions in the mortgage market—and the investment bankers. by definition. even in low-risk investments. For example. who deal with mortgage-backed securities.Senior executives on governance.… Banks thought that as long as they divested non-investment-grade securities from their portfolios at times while retaining AAA tranches. “One could rarely have imagined multinotch [ratings] downgrades overnight. A common theme emerges through many of our conversations with senior bank executives: when financial institutions have done especially poorly at managing risk. “A lot of people make the mistake of thinking that risk management owns risk.” Several of the executives we spoke with referred us to sobering media reports discussing faulty governance practices at very troubled institutions in the United States and elsewhere. But now that the contours of the problem have emerged in the midst of financial turmoil. CFO of Shinsei Bank. “One lesson learned concerns the reliance on ratings agencies.. high ratings for senior and super-senior tranches of credit-derived securities helped some banks justify high concentrations in those investments—positions that may in fact have compromised basic risk management principles that caution against overconcentration of exposures. it is perhaps no surprise that financial institutions placed a great deal of faith in ratings agency assessments.’” says Laura Dottori-Attanasio. an even more urgent question remains: What can firms do to rehabilitate risk management and begin to recover? DECEMBER 2008 © 2008 CFO PUBLISHING CORP.” says Rahul Gupta. or even decades.

” says Ms. citing the advantage of operating experience for risk managers. I support that mindset change. the percentage is not very big. which should take up the task of setting the firm’s overall risk appetite and communicating it throughout the organization. Citigroup chief risk officer Brian Leach’s recent remarks to analysts: “…[B]usiness. and the business units—is one important part of the solution to the informational. Striking the right balance between risk and reward is indeed much more challenging when risk managers and line-of-business personnel fail to appreciate each other’s positions. one has to understand when making a credit decision that not all the information one needs is available when credit is first granted. ‘I need to grow revenues.” she says. chief risk officer at Milan-based banking giant UniCredit. Doing each of these things requires a mindset change on the part of risk management and on the part of business management. Finance.” says Arrington Mixon. enterprise credit risk executive at Bank of America. and about their plans for improvement. and information sharing among functional groups are widely held aspirations for good reason: they create value. organizational.’” Genuine respect. and product areas to achieve optimal results for Citi. But if you look at how many people have gone from the business side to the risk side and vice versa. our chief risk officer. So I think [operational experience] helps very much. we think about it from a risk and reward perspective. and risk. but let’s make sure that we understand the underlying cost of that revenue growth from a risk perspective. need to more rigorously assess risk-return trade-offs and incorporate such analysis into the business decision process in a disciplined manner.” As Mr. I was not a risk manager. and the business units Our sources nearly universally agree that fostering better communication and greater alignment among functional areas—particularly among the finance function. Some sources suggest that the ideal risk manager for a business unit should have such extensive knowledge of that business that he or she would be able to step into managing it at any moment. but you have also to rely on a feeling. “Of course. “When we think about our integrated business planning process. “Our chief financial officer.” says Henning Giesecke. We will be successful in fostering a risk-taking culture that creates a competitive advantage for Citi and long-term value for our shareholders. and Operations: Solutions—improving alignment among risk management.8 10 Aligning Risk Management. “For the first eight or nine years of my career. risk management. © 2008 CFO PUBLISHING CORP. Leach’s remarks suggest. working in concert. DECEMBER 2008 . Establishing a risk management culture Several sources note that embedding a risk management culture across functional areas and business lines begins with top management. It has to be something that’s deeply embedded in the culture.… It’s not easy to get everything on the table at the first moment. for example. and governance problems that have led to the current crisis. You must be comfortable with the data you have.’ we’re also saying. Others agree with this idea in principle but are more circumspect. so they all come together on a regular basis to discuss business trends. finance. risk. but acknowledging its rarity. collaboration. so as a line of business head is saying. I know that we have [CEO Vikram Pandit’s] full support on this change as well. Consider. and vice versa. simple organizational mechanisms such as regular meetings help to promote collaboration and assure that business arrangements reflect the desired balance between risk and return. finance. risk management. Dottori-Attanasio. We talked at length with finance and risk executives about the modes of alignment that have served them best through the current crisis. I’m confident with the willingness of our entire senior management team to lead by example. and I fully expect my risk management team to look across the business. and our line of business heads are all peers. Collaboration and close communication among finance. bringing finance. and business units into greater alignment can be a major undertaking. One antidote to this is to ensure that risk management personnel have experience in operations. I view the evaluation of risk-reward trade-offs as part of my job. and the business units are critical to striking the appropriate balance between risk and reward. ‘We want to support that. “I think to best protect an organization is really all about culture—tone at the top. I was on the business side. “The whole concept of managing and understanding your risk has to be instilled in front-office personnel. region. For many of the executives we spoke with.

” she says.” says Mr. [as a CFO. the work of the finance function requires a neutral and independent orientation.” “There are two schools of thought. “I think there is an absolute similarity between the two positions—finance and risk. At Shinsei. “and that’s a very important role. “To my mind. but CFOs need to get up field—to partner with the businesses and help them score goals in the first place. you should have no pride— you should feel free to ask the most basic questions.” He continues. this affinity has led the risk function to be incorporated into the finance function at some financial institutions.” he says.” Mr. Gupta of Shinsei Bank. and at the same time provide value to the businesses. in such a way that the businesses will listen to you.” says Mr. Even where the risk function is separate— reporting to the CEO.” The risk and finance functions “have to be fiercely independent and neutral. as well as a shared affinity for analytical decision making. “A business unit should not measure its own performance. A chief risk officer needs to be fully empowered to say ‘No’ and have people respect that decision.” says Mr. requiring hard skills and.” says Shinsei Bank’s CFO. but I can say very objectively that the two [functions] work very closely together. and performance amid a global banking crisis 9 to be honest. many of our sources emphasize the importance of open communication across risk.” Just like the risk function. So. “Obviously finance and risk have to have a very close. excellent soft skills. two sides of the same coin—and some organizations have modeled their finance and risk functions on that basis. and sometimes I think business unit management or senior management may not ask a question because they worry that it will sound silly. and encouraging risk people to communicate effectively with the finance people. . intimate relationship. Mr. DECEMBER 2008 © 2008 CFO PUBLISHING CORP. “You need to instill the perception that. “The two functions that clearly need to be independent and neutral—the two that have to be fiercely independent and neutral. Gupta.” says the executive. more importantly. But one senior bank executive we spoke with points out that managers outside of the risk function should also take more responsibility for understanding risk. due in part to their common position of organizational support for line-of-business activities. Gupta suggests that companies are best served when the risk function. But to have some people in risk management who have seen the other [side of the] business can be very helpful. While cross-functional experience between risk management and operations may be relatively rare.” Jeanette Wong. and at the same time provide value to the businesses—are finance and risk. This common ground can form the foundation of a close relationship between the risk and finance functions. Gupta. A few of the finance and risk executives we spoke with suggest that risk managers in the industry could be doing more to communicate the basis for their recommendations to other company constituencies in terms that they can easily understand.] you have to maintain the credibility of independence and neutrality and still be a partner to the business. finance. “You need a good financial controller to do the goal keeping. Gupta continues. and between risk and the businesses. takes on an expanded organizational mandate that includes a wide-ranging partnership with the businesses—with the ultimate goal of creating value for shareholders. “Risk managers are very smart people. Bringing risk management and finance into closer alignment Several of the finance executives we spoke with allude to a deep affinity between risk management and the finance function. in a manner of speaking. It’s a very difficult relationship to negotiate. “[Bringing finance and risk closer together] is about finance people having a very strong understanding of risk. [the finance and risk functions] are separate. uncertainty. The two functions also share the same broad objective—adding value to the business. as a bank.Senior executives on governance. Organizationally. CFO of DBS Group Holdings Limited (the holding company for DBS Bank). and operations. “One says that risk is an integral part of finance—that finance and risk are. But actually asking those basic questions is very important.” Mr. nor can it evaluate its own risk. “I am a firm believer that risk should be neutral and independent. says that bringing finance and risk into closer alignment involves open communication and mutual understanding. but the need for communication extends to communication between finance and the businesses. Gupta explains. so that you can partner with businesses and also say ‘No’ quite comfortably. like finance. or in some cases directly to the board of directors (in order to promote the risk function’s independence)—many of our sources note that close collaboration between risk and finance is highly desirable. which is fine.

let’s say.. alone. [With these new requirements]. We have a four-eyes principle: only if the two sides—the business division and the risk division—are fine with the decision is the deal done.” says the company’s chief risk officer. “Suddenly our risk calculations appeared in the annual accounts and formed part of our capital adequacy.” CFO Phil Coffey of Westpac Banking Corporation notes that the use of risk-weighted capital under Basel II has helped business units understand the riskiness of their activities at his firm. And that is something that’s not really natural [for risk managers]. relations between finance and risk management became strained when the company began reporting under International Financial Reporting Standards (particularly IFRS 7. “The main idea is that we have a check and balance. [The two groups] work together. where the CRO can really create value for the divisions. you are creating value because you expect that customer to go bust in five months. six months. While few would argue that these practices. “The risk function in the past was relatively good at discounting and modeling cash flows. and non-lending activities obviously have a lower weighting than lending activities. you don’t need to know how much money you’ve lent per client. And if you create value for the divisions. Making sure that the aggregations and consolidations are correct requires good controls and continual dialogue between the finance and risk functions. Finance. business units may call on risk and finance’s expertise to help them optimize their portfolios. “One always can say that if you [in risk management] are not agreeing to a credit request.” he explains. because we have been responsible on the project—we can leverage. could have averted the current crisis.” one senior bank executive says drily. but we were never that great at ensuring the accuracy and completeness of our calculations. Giesecke continues. one year’s time. “Risky loans will obviously carry a higher capital weighting than less-risky loans. let’s put it this way: we’re happy that we had an economic value added (EVA) system in place. or let the divisions leverage. which takes account of the cost of the capital they’re carrying Increasing integration between financial and risk management as risk-weighted capital gains prominence A consistent refrain in our conversations with bank executives centers on the risk-weighted capital allocation and economic profit models that more and more banks are adopting on their own or under Basel II. our knowhow to optimize their portfolios. Mr. But then again.” Mr. How can we create value outside.” Good communication between the finance and risk functions can also help financial institutions manage some of the tensions that naturally arise under certain circumstances.’. “The business knows the riskiness of its activities based on the amount of capital it is looking to generate a return against. risk managers had to prove that these calculations were complete. but I think this is not the right way of discussing it. That’s the sort of thing we do [at DBS]: the head of group risk doesn’t report to the CFO. “Our senior businesspeople are measured on economic profit. more than one source mentions that economic profit measures had proved themselves useful in the current crisis: “In what is probably one of the biggest series of events and changes in the banking business in 75 years. and not before.” As risk-weighted capital allocation becomes an important way for risk management and finance to help business units create value. for example. “All the business heads are very keen on [optimizing riskweighted assets] because this increases their return on equity. finance is a bit thinner on data [than the risk function]: in order to create an annual report. then you also create value for the group.” In practice. and we’ve found that it’s very critical that some of these things are done. At one large financial services company. Coffey says.. ‘Is this accurate?’ the first natural answer [a risk manager] gives is ‘I don’t know. “We [in risk management] can do optimization knowing Basel II quite well. risk-weighted capital allocation is becoming an important way for risk management and finance to help the business units create value. DECEMBER 2008 .10 Aligning Risk Management. the accounting standard governing financial instrument disclosures) and making disclosures under Basel II. and Operations: we’ll be stronger as a team if we work closely together and share some of our concerns. This is something that is perceived by the divisions as a very clear and helpful instrument.” Westpac reinforces the incentives implied by this risk weighting by measuring performance based on economic profit. and an accountant asks you. © 2008 CFO PUBLISHING CORP. a single decision? Basel II gives the [chief risk officer] a strong instrument to optimize risk-weighted assets. Giesecke of UniCredit. When you make an assessment of what could go wrong.” says Mr. and the CFO doesn’t report to risk—but risk and finance collaborate on certain issues.

The question is much deeper than ‘Does risk report in to the CFO?’ And. which I chair. and their remuneration reflects how well they’re performing against the riskadjusted capital. The [risk function] has been driving the change.” Mr. But. and incentive compensation plans.” Many financial institutions seem to be anticipating—and preparing for—similarly close connections among economic capital measurements. judgment. so that financial institutions are all looking at these things the same way. the CFO. Goulding. This was agreed at the group risk committee. When we put together business plans now. “What you’ve got to be looking at is the points where [finance and risk management] need to be integrating and managing together.” together. Goulding points out that organizational change doesn’t necessarily create meaningful alignment between risk management and finance. capital allocation. since both have prominent roles to play in its adoption. Dottori-Attanasio makes a prediction echoed by several of our sources: “What I expect we’re going to see—especially with Basel II and with what we’re living through in the industry right now—is a lot more evolution of economic capital and how institutions use it to manage their business. if all you do is change one reporting line. that’s essential. “[Risk management and finance] clearly both had key roles to play in Basel. to be honest. But I think what needs to happen is that. and where sophisticated models and analytics reach their limits—judgment. accordingly. backed up by a balance sheet. in fact. Few would dispute the value of qualitative analysis. I work perfectly closely with the finance director as it is. then nothing would have changed. then you’ve achieved nothing. it goes to their P&L. Mr.. we haven’t had to do a single organizational change to pull that off. “Take this year’s budgets.” This integrated financial planning process has elevated the issue of risk appetite at Standard Chartered—and. the investment and work done to gain IRB approach approval under Basel II have actually helped to set the stage for bringing risk management and finance activities together in a meaningful way. DECEMBER 2008 © 2008 CFO PUBLISHING CORP. notes the chief risk officer at one global bank. group chief risk officer at Standard Chartered Bank. We just had to agree that it was a good direction to go down. we actually have to put together a revenue forecast. .” says Richard Goulding. “If tomorrow [the risk function] were to report to the finance director and that was the sum total of the change. “One of the things that I’ve driven.” he says. I think increasing levels of disclosure will probably help drive some form of convergence format. that takes into account the risk appetite we need in order to be comfortable with a balance sheet that generates those revenues. and experience: particularly in the gray areas of risk management— where information is incomplete. uncertainty.Senior executives on governance. “To me.” The risk function’s profile can be raised through an integrated approach to financial planning and risk appetite that brings finance and risk activities together. the interaction between the risk and finance functions is also likely to increase.” says Mr. but the chief executive.” At Standard Chartered Bank. as financial institutions. [we’ve implemented] an integrated financial planning or financial management process. starting about a year ago. although I have long been an advocate of it all coming Improving both qualitative and quantitative analyses Nearly everyone we interviewed emphasizes the importance of applying qualitative judgment in addition to quantitative analysis to risk decisions. and the group business heads also sit on it.. Goulding explains. It’s about whether you get on the same page with the agenda and simply implement it—and I’ve not had any difficulty in that regard at all. is an integrated approach to risk appetite which absolutely brings finance and risk activities together. “[Risk appetite] is going to be part of our actual detailed budgeting and planning process.. and I’ve certainly not encountered any resistance with anyone. As risk-weighted capital gains importance. “The overall project of getting the IRB [Internal Ratings-Based] approach waiver to Basel II lay with risk [management]. In other words. for example. and it was enabled by the fact that we had invested in the whole infrastructure necessary to get IRB approach approval under Basel II. we all need to use it more as a real business planning tool.” he says. But when it came to Basel Pillar 2—the whole internal capital adequacy assessment process—that was ultimately owned by the treasury function under the finance director. That will be the first time [we’ve done this] at Standard Chartered—and certainly the first time I’ve seen it in my career. and performance amid a global banking crisis 11 in the business. Ms. has raised the risk function’s profile at the firm.

as always. for example..” Finance executives note the importance of applying qualitative judgment. This challenge has been highlighted by the firm’s 2005 merger with HVB Group of Germany. so that we have as good an outlook as we can on what could happen to our business as it relates to things like running our models and stress testing. in a country. traditional.. Our challenge within our organization is probably more in that area— beefing up ourselves on the technology side in order to make sure we’ve got very accurate and timely information.. to anticipate where issues might come from. binary decisions. confirms to us that gathering high-quality data is one of the biggest challenges in managing risk. “We try to transform risk management into a partner working with a line of business. ‘This is the way we define exposure. “A lot of risk management tools and techniques tend to be historically looking through the rearview mirror. but an exposure in the definition of one country is not an exposure in another country.10 12 Aligning Risk Management. One of the things we spend a lot of time on here is trying to figure out how to look through the windshield. and timely—is critical to managing risk well. accurate. I’ve been a great believer in the use of models. DECEMBER 2008 .” But our sources are equally quick to point out that just because models aren’t sufficient for effective risk management doesn’t mean they aren’t necessary. this is the way we define expected losses. Very often you have an exposure. and certainly not the most recent market turmoil. The continuing importance of sophisticated quantitative modeling and analysis means that high-quality information—that is. But gathering such information is also a serious challenge. but you need to overlay that with judgment to better frame those issues. as banking operations become increasingly far-flung and consolidation in the financial sector forces firms to reconcile disparate IT systems and processes. Risk is both an art and a science. Mixon of Bank of America.” © 2008 CFO PUBLISHING CORP. Hyle suggests that a forward-looking approach to risk management can help prevent risk managers from reducing complex situations to simple. Models are critically important.” He continues. Our sources also note that a shift in emphasis can help quantitative models lend themselves to sound qualitative judgments.” says Mr. can make the difference between riches and ruin. Turning risk management much more into a forward-looking risk anticipation mechanism. or whatever it is. ‘Here’s a deal—yes or no?’ kind of binary decision is a very important philosophical difference on how we’re trying to run [our] businesses. clear set of guidelines that say. Dottori-Attanasio. to risk decisions: “‘What have we learned from [the most recent market turmoil]?’. focusing on what may happen in the future. but realistically evaluating where issues might come from so that we’re able to react quickly?” Mr. ‘What have we learned from this?’ we would say first of all that models are critically important. for the risk management function to have data available—and of course you don’t want to compare apples with pears. Finance. how do we have early-warning systems that work. and to make sure that it’s actually good information and that it’s timely. How do we anticipate. he says. information that is reliable. and quantitative inputs can provide great insights around a range of possibilities. “I think that the most complicated thing of all in integration is.” says Ms. “‘Forward looking rather than backward looking’ is kind of a mantra of mine. in a product.” “You have to have the right processes and so forth in place. Giesecke of UniCredit.’ and all the other things as well.. but they have to be overlaid with expert judgment. as well as quantitative analysis. because models really make you clarify your thinking about the dynamics of risk. Charles Hyle of KeyCorp explains that he emphasizes a more forward-looking view.” says Ms. “As we sit back and say.. and Operations: informed by experience. so that we’re not just getting a lot of false positives and scaring ourselves into the bomb shelter. “For 20 years. You have to align that [data] very quickly so that you have a complete understanding of your position in a single name. “and that involves having the information technology that allows you to actually collect your data. Goulding of Standard Chartered Bank. but they have to be overlaid with expert judgment. rather than a standard. over the more traditional risk management perspective that concentrates on historical events.” says a risk manager from Bank of America. I think the most important thing is that the holding company should provide a single. “I don’t think that any model would be able to resolve what has happened in the markets in the past. Mr.

“I think that’s the ‘art’ part of the job. as opposed to the ‘science’ part of it. analysts deserve. everyone would know what was going on. and performance amid a global banking crisis 13 Communicating risk to external stakeholders: investors. It’s a change in attitude [across the industry] as compared with one or two years ago.’ Escalating the right issue at the right time is usually about trust. not equity instruments. transparently—and calmly. Clearly explaining how a bank is managing and thinking about risk can help reassure nervous investors. Goulding at Standard Chartered. sharpening their queries and placing new demands on risk management’s reporting capabilities. “We [at Standard Chartered] are going to disclose more information. We have our own way of reporting this data. notes Ms. I think it might result in a lot of head scratching. “This crisis has been very. some suggest that investors. very challenging for communication with external investors.” The financial crisis has caused many analysts to take a more activist posture. Wong of DBS. chief risk officer at ING Group. as regulatory authorities require further disclosure (under Basel II. So we go a long way in trying to make sure that we can facilitate that. “I think where you see changes is in the relationship with the analysts. analysts.” she says. but these 3 are more important than these 5. however. for example). absolutely well-intentioned attitude that if only banks would disclose more information. none of them earth-shattering. She suggests that the difficulty of explaining a wide variety of highly complex financial instruments is contributing to investor uncertainty and heightening the current financial crisis. “I think it’s good news that analysts are more active. quarterly— and we do it over certain segments of the portfolio. The challenge for banks is to try to communicate that to the market. analysts.” says Koos Timmermans. and probably in a year’s time. and they want the information quickly. and regulators The ongoing turmoil in the financial markets has no doubt placed financial firms under pressure to communicate information about risk exposure clearly. Whether more disclosure under Basel II or other regulatory regimes will lead to greater transparency across institutions is more of an open question.” Personal relationships—knowing people and trusting their judgment—can help risk managers to both judge credibility and establish it with others. and other observers could find themselves challenged to understand fully the abundance of information about bank risk that’s finding its way to the market. they’re requiring more disclosures. . As they become more activist on the risk management side. Wong continues: “The truth is that not all of these products are generic in nature. He continues. and they want the information quickly.” says Mr. and the credibility that people have when they see regulators. “I think there’s a genuine. So that gives [the risk function] a bit more of a challenge in terms of making sure that we can provide the data and the transparency—which. but it’s not yet clear that [disclosure across the industry] will result in everyone knowing what’s going on.” Mr. and as banks voluntarily provide more information about their risk positions. and there is a certain amount of risk aversion that arises when people don’t understand highly complex instruments. and they want it to be relevant to the present—not just required regulatory reporting.… [Analysts] will ask questions in the right directions. “Obviously [banks] have an obligation [to make these disclosures]. by the way. many market equity investors were struggling to understand what these instruments are.Senior executives on governance. Ms. uncertainty.” says the chief risk officer of a global bank. accurately. ‘OK.” says the CRO of one major global bank. and it’s more in a standard format. “[Analysts] will ask questions in the right directions.” Mark-to-market accounting requirements probably contribute to the downward spiral. They want to know today about subprime [exposure]. But [analysts’ queries] are highly topical. Goulding notes that increased disclosure requirements will provide external stakeholders with valuable trend information for individual institutions. I’m worried about 25 things.” While the executives we spoke with praise efforts to improve communication and bring greater transparency to the industry. When the crisis hit. they’ll want to know something else. “A lot of the products in the current crisis are fixed-income instruments. but I have a feeling that if the belief is it’s going to lead to some fantastic transparency that suddenly allows everyone to understand what banks DECEMBER 2008 © 2008 CFO PUBLISHING CORP. our sources say. and they want it to be relevant to the present—not just required regulatory reporting. “That’s the human part of the job—the judgment to say. Normally in the risk function we report risk at regular intervals—monthly. the CRO adds. The interesting thing about that is that their demands are not necessarily what we’ve been geared to do in the past.

Our interviews at global financial institutions suggest a renewed. “When it comes to corporate positioning. but must explain its reasoning in detail to senior managers in order to receive approval. But I fear I won’t be. which looks at the completeness and the accuracy of the framework.. and Operations: are doing on the risk front. While our sources in this interview program universally describe organizational structures and cross-functional relationships that are both positive and functional. Finance. Other sources say that risk managers at their firms have the organizational stature and authority to veto transactions outright. They are the risk takers. they indirectly invoked one of the core principles of risk governance—that the business unit managers who take risks should ultimately be accountable for their outcomes.” Risk management. firms are becoming more risk averse—and the risk management function is gaining in stature and influence. risk managers across the industry can look forward to a new level of deference and respect from their colleagues in the months ahead.” says Mr. a “comply or explain” system in which business unit management may override a risk management recommendation.” What role should risk managers play in day-to-day business decision making? We have already seen that some banks require approval from both risk and business unit managers before a deal can be done. I’ll be delighted if I am proved wrong on that. “We basically say we have in an organization three lines of defense. an Economist Group business. Many of the executives we spoke with underlined the importance of cooperation among business constituencies. and other observers in the months and years ahead. and incentive compensation structures translated into an embedded bias in favor of doing deals and ignoring potential downsides. several of the executives we spoke with told us they were moved by the account of one risk manager’s difficulties in “Confessions of a risk manager. As they outlined a set of complementary roles for these constituencies. You have the business. And then we have a third line of defense. ascendant Our sources observe that as financial services firms retrench in the wake of the crisis. and legal. Traders regarded risk managers as “obstructive and a hindrance to their ability to earn higher bonuses. But they work within a framework and they work within a control structure which is organized by the second line of defense—finance. Gupta.10 14 Aligning Risk Management. “The knowledge and skill sets of a risk professional should be equal to a person who can run the business. or credit risk—the key issue could be a structural issue. the responsibility for risk managers to understand lines of business as well as operating managers. risk. [These] units create a framework within which the businesses can operate.) In that article. industrywide commitment to sound risk management practice. Explains ING Group’s chief risk officer Koos Timmermans. regulators.” It appears safe to conclude that as many banks work to strengthen risk management practices in light of recent events. at least in the short term.” an article published in an August 2008 issue of the Economist newspaper. then the payoff may be much less than everyone desires. The current turmoil in the financial markets and the painful exposure of risk management failings in the industry seem to have renewed financial institutions’ commitment to sound risk management practice—a commitment that will only be reinforced by increased scrutiny from investors. (CFO Research Services is part of CFO Publishing Corp. according to some sources. and that’s what we call the first line of defense. The key issue might not be market risk. looking for new business. Other executives describe to us slightly different systems of checks and balances between risk management and the business when evaluating deals— for example.” says Shinsei Bank CFO Mr. Gupta. an anonymous risk manager at a large global bank describes a situation in which growth pressure. DECEMBER 2008 . the seniority of a risk professional should be equal to. But with influence comes responsibility—for example. © 2008 CFO PUBLISHING CORP. the business heads. liquidity risk. enforced separations between risk management and the business units (intended to promote objectivity). internal audit. or perhaps even greater than.

2 The term refers to The Black Swan: The Impact of the Highly Improbable. DECEMBER 2008 © 2008 CFO PUBLISHING CORP. like black swans (a reference to a seventeenth century philosophical thought experiment in which thinkers tried to determine the chance of seeing a black swan. when the only swans that had been observed were white). but they don’t seem to have done anything about minimizing [exposure]—of having a business that was outsized for its capital base if. we made sure that we had some good old-fashioned concentration limits that precluded us from getting into excessive trouble. While our attempts to generalize. may help create greater transparency into bank risk in the months and years to come. we didn’t. Several of our sources express concern over the market’s ability to digest and understand the large amounts of data and information that will come to light under new disclosure regimens. understanding. Taleb writes. “One of the principles that every investment manager understands from day one—but that a lot of banks seem to have ignored—is asset allocation.Senior executives on governance. rationalize.” says Standard Chartered Bank’s group chief risk officer. Thus events such as stock market crashes don’t adhere to bell-curve expectations. and explain them through narrative may be satisfying on an emotional level. basically.” Executives at financial services companies say they’ll complement their renewed commitment to risk management efforts with greater alignment between risk management and finance. . “That kept us out of trouble. This closer collaboration between finance and risk management will not only help banks navigate challenging economic times ahead. Did we question the rating agencies’ ratings any more than anyone else? No. But by having an overall US$2 billion nominal cap. But it just wasn’t that material in the end. according to our sources. One of our individual instruments was a AAA-rated senior tranche that ultimately defaulted without recovery. But several of the executives we spoke with also observe that greater transparency of risk to the market will help promote circumspection—and enforce a sense of broader responsibility—which the business media and other observers claim has been sorely lacking at many banks. improving communication. and collaboration between the two functions in order to create value for shareholders. indeed. understanding. improving communication. something were to go wrong. we didn’t have a single clever risk management technique. analysts. That’s a basic principle of asset allocation. these narratives have little predictive value. but the executives we interviewed note that renewed efforts to make complex risk positions and practices transparent to the market are already under way at many banks. In The Black Swan. Notes the chief risk officer of a large North American financial services company. Important events are rare and unpredictable.” Other executives we talked to also anticipate a renewed commitment to basic risk management principles. and other stakeholders about risk exposures and risk management practices has become extremely challenging in light of the current crisis. Executives at financial services companies say they’ll complement their renewed commitent to risk management efforts with greater alignment between risk management and finance. Communicating effectively with investors. uncertainty. Mr. Taleb argues that people are psychologically “hardwired” to place too much weight on the odds that past events will happen again. Taleb argues. it did very well. Richard Goulding. “I think we have to make sure we get back to many of those first principles: [to assure] that we have the adequate systems to measure what we’re doing—which we certainly believe we have—and that we maintain the discipline through the cycle.” says Barry Zubrow of JPMorgan Chase. and collaboration between the two functions in order to create value for shareholders. by Nassim Nicholas Taleb (2007). Mr. and have been for some time. particularly in the United States. but will also help assure finance and risk management’s status as respected partners with the business. “To be quite honest. And when the mortgage business was going great five years ago. Consider a very good regional bank. perhaps they did. and performance amid a global banking crisis 15 Going back to basics Even as they acknowledge the profound crisis in the financial markets (some alluding to the “black-swan”-like quality of the disruption2). several of the executives we interviewed note that well-established risk management principles and practices had served them very well under difficult circumstances. but rather are as unpredictable as they are disruptive. save one: we had an overall portfolio cap of US$2 billion. Heightened government oversight of the financial services industry. The term “old-fashioned” came up in conversation more than once—and it was never used as a pejorative. Mr. particularly under Basel II. in contrast with some other institutions. But [its managers] didn’t think about the implications—well. and are better understood as a form of self-deception. which doubled and then doubled again its involvement in the mortgage business.

” says Laura Dottori-Attanasio. Indeed. employees. and other immediate stakeholders.10 16 Aligning Risk Management. ‘Do unto others as you would have them do unto you’? That concept of responsibility is something I think we in the industry need to take back—in contrast to making a quick return because somebody else decided to buy something you’d never buy and hold yourself. As Bank of America’s Arrington Mixon puts it. As countries around the world reel in the midst of the current financial crisis.” © 2008 CFO PUBLISHING CORP. Finance. financial institutions have an even broader responsibility to provide the credit that lubricates the gears of economic activity. and Operations In the months ahead. Increased transparency may help promote a sense of broader responsibility that the business media claims has been lacking at many banks. greater government oversight of the financial services industry may help create greater transparency into bank risk. “A major challenge for the industry is figuring out how we’re going to grow out of this crisis. “You know the saying. In addition to their responsibilities to their investors. every participant in the global economy has some stake in these organizations’ risk management efforts. the idea of an industry-wide return to responsibility resonates strongly with several of the executives we spoke with. It is a good time to build market share. We can’t all pull back. DECEMBER 2008 . This is critical for our economy.

communication. information. rather than on costly and often unnecessary integration initiatives among organizational units. under the intense scrutiny of investors. through risk-based forecasting—should be firmly established and maintained through the entire chain. to performance measurement. Finance. This implies modification to certain processes. and technology. it has also become clear that the same shifts that have helped fuel global prosperity have created extremely serious vulnerabilities at individual financial institutions and in the global banking system as a whole. and Operations appears at an important moment in the financial services industry. Instead. and operations Aligning Risk Management. and other observers. this report highlights that the world’s largest banks recognize that improving alignment among risk management. regulators. The spread of contagion from the U. financial institutions should link processes. finance. from regulators (which are likely to seek to oversee bank risk policies much more strictly). The critical question then becomes how can financial institutions improve alignment between risk and finance? Our view is that it starts by focusing on processes. While global banking and the high-speed flow of capital have been a boon to global economic growth in recent years. While improving alignment can be challenging. banks should develop a blended set of both risk-based and financial performance indicators that take into account both historical (or “lagging”) factors and forward-looking (or “leading”) factors. financial markets to those in Europe and Asia underscores the interconnectedness of financial institutions around the world. from a risk perspective and an economic perspective? How should economic and risk indicators be blended. These vulnerabilities have placed banks under tremendous pressure from their most aggressive peers (which seek to acquire them). (Please see the figure for an illustration of a suggested model. migrating from a traditional rolling forecast to a forward-looking.) Connections among all areas—from business planning. But to gain the maximum benefits from an alignment initiative. analysts. . and metrics across the operating model—from enterprise (and business unit) strategic planning through operational execution (and the performance assessment and re-planning processes). but also from a forward-looking perspective.S. and from customers and investors (whose demands will include new levels of performance and risk transparency as well as executive compensation that is more closely linked to risk and return). this work will take place at many banks in a highly challenging (and swiftly changing) economic and regulatory context. What are those indicators.Sponsor’s Perspective Emerging from crisis: Improving alignment among risk. The financial management model that is currently standard in the industry should be revised to include risk management processes and information. for example. (See Figure. To begin. It is also an important step toward creating and administering incentive compensation structures that take a well-balanced approach to performance and risk. information. Banks should move away from relying on historical indicators focused on financial performance. next page. Aligning these functional areas will be a dynamic process—not a static one. banks should consider the leading and lagging indicators they need in order to understand their businesses. Achieving a high degree of informational alignment provides a more complete picture of overall performance—not just from an historical perspective. so 17 DECEMBER 2008 © 2008 CFO PUBLISHING CORP.) Based on this research and our experience in working with clients. risk-based forecasting process. and metrics used for risk and financial management activities. we have observed that financial institutions reap multiple business benefits from doing so. information content. we’ve identified three primary steps financial institutions should take to link risk and financial management processes and information effectively: 1. Banks that take on the challenge of achieving greater integration among key functional areas will find themselves better-equipped to respond to these new internal and external mandates. but in the financial markets and in the regulatory schemes that govern them. The current financial crisis has exposed weaknesses not just in banks’ risk management practices. including deeper and more relevant insights into the daily operations of their business. finance. Indeed. and lines-of-business is one important part of their answer to the current crisis. At this pivotal moment in the financial services industry. The finance and risk executives who participated in this research cite the importance of integrating the data.

DECEMBER 2008 . with few connections between new financial information systems and those intended for risk management. including data definitions. But even in this challenging risk environment. investors. diversity of lines-of-business. and can create the need for costly and potentially error-prone manual reconciliation. liquidity. among other factors. single-source environment to promote efficiency. improve data quality. it is just as important for banks to consider whether they are underexposed to risk—that is. technology systems. whether they are failing to make the optimum use of the capital at their disposal. and analytical tools and systems. banks that have adopted Basel II typically separate performance reporting from Basel II reporting. and technology systems. under the watchful eye of regulators. and counterparty risks. and analysts. and Operations: Financial Management Model Business Strategy Top-Down Planning Budgeting Performance Management Base Data/ Application General Ledger Risk Based Forecasting Risk Based Performance Reporting Regulatory Reporting The financial management model that is currently standard in the industry should be revised to include risk management processes and information. Banks are now working to assess where and how they are overexposed to risk. A better approach is for banks to develop an integrated. grievously—underestimated their exposure to systemic risk. banks will continue to do this work in extraordinary circumstances. Banks should develop a common set of data— © 2008 CFO PUBLISHING CORP. a position few banks can afford to maintain. But analysis of these separate reporting environments indicates that there can be as much as an 80% overlap of data and attributes between the two. Failing to optimize the use of capital would essentially sacrifice future revenues to serve short-term expediency. Banks should integrate and standardize information systems. most organizations have made investments in a variety of technologies to deliver financial and risk management information. In the coming months. For example. and as ratings agencies and internal risk managers adjust to a changed risk landscape. As they do so. including credit. information reporting.10 18 Sponsor’s perspective Aligning Risk Management. Sponsor’s Perspective Finance. that performance indicators are genuinely adjusted for risk exposures? They should consider their business portfolios: What are the performance implications of their current mix of businesses? Is it the right mix? The events of the past year have made it clear that many banks have seriously—in some cases. they are identifying and addressing the full range of risks to which they are exposed. The creation of these separate environments can lead to inconsistencies in information and misalignment of data. In recent years. They are also reevaluating broader enterprise risks that stem from their decisions about market segments and geographic reach. and take advantage of the commonalities that already exist between risk and financial data. Unfortunately. 2. these investments have often been made separately.

000 people are united by our shared values and an unwavering commitment to quality. into account will likely find that they must redefine responsibilities across the organization. Financial institutions that follow these steps and change their structures and processes from the ground up will emerge from the current financial crisis with lasting benefits. and then carry that same data through risk management to disclosure. many financial institutions are already reviewing their incentive compensation structures to ensure that they encourage risk-appropriate behavior among lineof-business personnel. investments. incorporating risk-adjusted financial data in decisionmaking can help connect individual credit decisions to the creation and distribution of securitized products in a way that independently verifies the price of those products. operate more efficiently. as well as financial performance. many of the risk measures and disclosures that were once solely for internal use now must be disclosed under IFRS 7 or FAS 157—and therefore must meet auditable standards. and performance amid a global banking crisis Sponsor’s Perspective 10 19 fully attributed for financial and risk purposes—to support both external and internal information needs. As part of this effort. and other stakeholders to improve their ability to manage financial risk. accuracy. Greater informational alignment between risk and finance can substantially improve business decision-making at financial institutions. 3. make better product and pricing decisions. A good place to start the integration process is to standardize data definitions across the risk and finance functions. our 130. tax. with effort. We make a difference by helping our people. banks can not only eliminate risky behavior. into account. and auditability required by these disclosure requirements mean that the forwardlooking trend is to establish product control processes that extract data from trading systems.Senior executives on governance. From a compliance perspective. incentive compensation plans should support a balanced view of performance that takes top-line performance. our clients. manage. transaction and advisory services. each of which is a separate legal entity. as well as risk exposure.com Ernst & Young refers to the global organization of member firms of Ernst & Young Global Limited. and report to investors and regulators with greater confidence. banks certainly will be called upon by shareholders. By incorporating the review and revision of incentive compensation plans into a larger effort to ensure that operational activities take full advantage of risk and financial information. The current financial crisis calls for fundamental changes in the way banks identify. In the wake of the most serious financial crisis since the Great Depression. banks can become better able to manage value—and may. a UK company limited by guarantee. does not provide services to clients. Banks that choose to adopt forecasting methods that take risk. Ernst & Young Global Limited. emerge from this crisis healthier than before. they will be better equipped to generate value from their risk assessment functions. About Ernst & Young Ernst & Young is a global leader in assurance. and positions. Banks that integrate risk and finance both in their processes and in their cultures— reaching deeply into their information management infrastructures to do so—have the opportunity to develop a risk-and-return-oriented view from one end of the business to the other. Rather than institutionalizing simple risk aversion. DECEMBER 2008 © 2008 CFO PUBLISHING CORP. uncertainty. The use of risk-adjusted financial data in making front-office transactional decisions can help link the front-end of the customer chain to the back-end process in the operational model. they will be able to select customers more effectively. assess. and our wider communities achieve potential. The transparency. and communicate financial performance.ey. however. In addition to being better able to measure the prospective downside of strategies. Banks should incorporate risk and financial management information into their daily activities to support a more complete view of business decisions and expected versus actual performance. With such a view. Worldwide. . but also improve business decision-making— which ultimately will help create shareholder value. For example. regulators. In light of the recent financial crisis. For more information please visit www.

Sign up to vote on this title
UsefulNot useful