Remarks by

John D. Hawke, Jr.

Comptroller of the Currency

Before the

FFIEC Risk Management Planning Conference

Washington, D.C.

November 8, 1999

Three weeks ago, the OCC sponsored a conference on risk measurement here
in Washington. We had a big turnout of financial professionals,
including dozens of community bankers from cities and small towns across
America. They heard from many of the world's leading academic and
private sector authorities about developments in risk modeling and
management. They learned about the state-of-the-art in analyzing and
measuring various types of risk, the theoretical bases for these models,
and where future research and development in this area is likely to lead
us. It was a stimulating two days.

But while the conference featured enough differential equations and
standard deviations to gladden the heart of most mathematicians, there
was a lot more to the conference than numbers. We made a point of
including on the program a number of prominent end users \-- bankers
like you \-- to talk about the practical value of the new technology in
the larger context of risk management.

These bankers displayed a more tempered enthusiasm for risk models. They
agreed that models can be an important element in the overall risk
management regimes of some \-- but not necessarily all \-- banks. They
agreed on the need for potential users to look at the models critically
and cautiously, to fully understand their strengths and limitations
before adopting them. And, most of all, they agreed that even the best
of these models should be seen as a component of \-- rather than a
substitute for \-- a risk management program solidly grounded in sound
judgment.

One would most expect to find advanced risk measurement capabilities in
the largest and most diverse financial institutions. Risk modeling is
indispensable in helping to manage the risks inherent in their vast and
varied portfolios. Indeed, we as supervisors would look askance at any
institution that takes on such complex risk [without]{.underline} having
risk measurement systems of comparable power and sophistication.

So it was instructive to hear the chairman and co-CEO of one of the
nation's largest banks \-- a bank that has been on the cutting edge of
financial services for decades \-- talk to the conference not about his
own bank's advances in modeling and measuring risk but about the
fundamental principles of risk management \-- principles validated by
this one bank's own recent experience, but equally applicable to banks
of all shapes and sizes.

He discussed such fundamental concepts as the importance of capital
adequacy \-- and defined adequacy in the most expansive terms. He warned
against losing sight of the macro factors \-- political and social as
well as economic \-- that shape the risk environment. He emphasized the
importance of independent internal risk assessments and the dangers of
allowing these assessments to be performed by the operational unit
responsible for the activity. And, most of all, he stressed the need for
an overall risk management strategy \-- a strategy based on a clear
understanding of the institution's tolerance for risk \-- and the will
to see it through, even when that means foregoing short term profit.

To some members of our audience, all this may have been seen as simply
restating the obvious. But the importance of risk management solidly
grounded in the fundamentals can never be exaggerated or taken for
granted. Your bank is not Citibank. But the principles that John Reed
articulated are as vital and relevant for community banks and for our
high-tech times as they were in the days before anyone knew what a
computer model was.

You may not give a second thought to the political turmoil in Indonesia
or other distant lands because you think you have no business exposure
there. But, directly or indirectly, your customers might well be exposed
\-- and if they suffer losses as a result, you might well suffer them,
too.

You might consider your bank adequately capitalized because it meets or
exceeds all statutory standards. But how long would that capital last in
the event of a downturn in your local economy? As we know, minimum
capital and adequate capital are hardly synonymous.

You know your employees by name. You trust them implicitly. But it's
still not prudent to rely on the credit officer who
[originated]{.underline} a loan for an evaluation of how well the loan
is performing or what the prospects are for repayment. An independent
opinion from someone who does not have a reputational stake in the
transaction is essential. For financial institutions of all types and
sizes, checks and balances are essential.

The point is that while community banks face risks that are different in
degree from larger institutions, they are in many ways little different
in kind. Even the difference in degree is not always what you'd expect.
In some cases, the risks facing community banks can be compounded by the
advantages of scale they lack. For example, it's relatively easy for a
megabank to redeploy resources to augment the loan review function when
management decides it's necessary. But where does the community banker
obtain that independent second opinion when there's no second person
with the necessary skills at hand to do the job?

Similarly, it's relatively easy for an integrated megabank with an
international presence to diversify its asset base when management
decides that concentrations have reached the point of concern. But how
do you as a community banker achieve diversification greater than that
of the community you serve? For better or worse, its future and yours
may be inextricably linked.

I'm not suggesting that risk models and other advanced risk management
tools have no place in the overall business strategy of community banks.
In fact, just the opposite is true. Technology [will]{.underline} help
resolve some of the business dilemmas that I've just described. It
[can]{.underline} help compensate in some ways for the manpower
limitations that are an inescapable fact of life for most community
banks. Much of the software that is being developed today to help
measure and manage risk is targeted at the small bank market, and the
presence of so many community bankers at our conference shows that
there's a keen interest in what these products have to offer. Community
banks have long used gap models to help them measure asset-liability
mismatches, and credit-scoring models have already proved their worth in
the loan origination process in many small banks. The use of these and
related applications should increase as they improve in reliability and
user-friendliness.

But while technology can be an invaluable adjunct in the management of
risk, and will undoubtedly play an even bigger role in managing it in
the future, it can never provide the whole answer, not for a hundred
billion dollar bank and not for you. Community bankers seem to have
fewer illusions on this score than some of their large bank
counterparts. What we see \-- encouragingly \-- is that community
bankers are working hard to manage risk by educating their customers in
better ways to manage theirs. For example, some agricultural banks are
working with borrowers to help them manage the risk associated with
volatile commodity prices \-- long the farmer's bane. By encouraging
forward sale and marketing arrangements for their crops and livestock,
farmers can be assured of a more predictable income stream, in good
times and bad. In many cases, this has made the difference between a
farm loan in default and one that's current. Some big city bankers could
learn something from some of their smaller counterparts' innovative
approach to managing risk.

We see community bankers taking advantage of Small Business
Administration and other government guarantee programs to serve as a
buffer against risk. Some small banks have even established
relationships with banks in nearby communities to help mitigate the
effect of concentrations. More and more are taking advantage of
opportunities to securitize and sell parts of the loan portfolio to
access new sources of liquidity and reduce credit risk.

Such instances exemplify risk management at its best. A bank's approach
to risk must be as creative \-- and as soundly grounded in the
fundamentals \-- as its approach to any other aspect of its business. In
other words, risk management cannot be reduced to a tool or technique or
even a model; it's a philosophy \-- a consciousness \-- that must
permeate every aspect of a bank's operations. It starts with an
awareness of the forms that risk takes. You can't manage what you don't
recognize or understand, and it's the banker's job to inculcate that
awareness in the bank's decision makers and its board. It sounds simple,
but it's fundamental to effective risk management.

The fact is that a bank can have all the right mechanisms and procedures
in place and still not have an effective risk management regime if
management's heart is not truly in it. For example, a bank's audit
department can be well staffed and trained, and be dogged in pursuit of
irregularities. But if the bank's culture encourages these problems to
be resolved without addressing them at their source, it invites a
recurrence. That's not effective risk management.

If a bank's compensation plan rewards loan production and loan growth
and does not hold its people accountable for the quality and performance
of those loans, that too is not effective risk management. Again, lip
service to the principles of risk management \-- even when accompanied
by an infusion of resources \-- is not enough. Good risk managers are
true believers.

For most community banks, the loan portfolio is the largest asset and
the primary source of revenues. It's also one of the greatest sources of
risk to the bank's safety and soundness \-- and the toughest test of a
bank's risk management capabilities. When OCC examiners find that banks
have effective credit risk procedures in place, it tells them a great
deal about a bank's overall attitude toward risk.

There was a time when it was sufficient \-- from the examiner's
standpoint \-- that individual loans be properly underwritten and
administered. While we strongly believe in the fundamentals of
controlling risk at the transactional level, we also take a more
comprehensive view of the loan portfolio than ever before, recognizing
that the interrelationships among portfolio segments can be as important
in determining a bank's credit risk profile. So we look for those things
that define a sound risk management culture: clear objectives and risk
tolerance limits, management information systems capable of monitoring
loan performance, diversification policies, policies on exceptions,
stress testing procedures, and independent audit, loan review, and
control functions, [supplemented by]{.underline} the appropriate risk
measurement tools. And we look to ensure that these and other risk
management functions work in harmony with one another. The failure of
any one can render the others ineffective.

All banks need to have fundamental risk management principles in place
in some form. But the extent to which they must be formalized into
written policies depends on the size of the bank, and the complexity and
character of the risk it has assumed. In the largest and most
sophisticated banks, policies need to be formal and prescriptive.
Community banks, on the other hand, may be able to implement these
principles in a less formal, less structured manner than larger banks.

The way banks manage credit risk is a good barometer of its approach to
risk management across its business. I know of few institutions where
careful attention to the fundamentals of controlling credit risk is not
reflected in the institution's approach to controlling the other forms
of risk that banks assume.

Much has been said in recent years about change in the banking system.
Given the legislative events of recent weeks, the changes that have
occurred already will almost certainly be overshadowed by the changes
soon to come. It now seems certain that the arrival of the new
millennium will coincide with the start of an important new chapter in
the life of this industry. We don't know what the banking business will
look like ten years from now except that it will look significantly
different than it looks today.

But I know of at least one thing that won't change. The fundamentals of
risk management are timeless. Bankers who conscientiously and
effectively manage risk will be successful. Those who don't manage risk
well will eventually be overwhelmed by it. Whatever else happens in the
coming years, that much we can count on.