Amando M Tetangco: The importance of risk profession and sound risk
management practices
Speech by Mr Amando M Tetangco, Deputy Governor of the Central Bank of the Philippines, at the
2004 Convention of the Professional Risk Managers' International Association Philippine Chapter, at
the Asian Institute of Management, Manila, 13 September 2004.
* * *
Ladies and Gentlemen,
I am pleased to speak today at this important event - the 2004 Philippine Risk Convention. I wish to
congratulate AIM-JBF (Asian Institute of Management-Jose B. Fernandez) Center for Banking and
Finance and the Professional Risk Managers' International Association for organizing and sponsoring
this gathering; the number of participants speaks well of the great interest in risk management and the
risk profession.
My topic is the importance of the risk profession and sound risk management practices in the
Philippines. The risk profession is an area that has become a growth industry; and it is the one that is
particularly relevant to banks given their fiduciary functions, the complexity of risks inherent in their
working environment, and the stability and efficiency of the payments and settlement system which
greatly rest on them.
Allow me to tackle this presentation from the perspective of the BSP, both as a regulator of the
Philippine financial institutions and an institution which in itself is an end-user and a staunch promoter
of risk management.
The BSP performs a dual role. First, as the county's monetary authority, the BSP sees to it that the
monetary policy is supportive of its mandate of maintaining price stability conducive to balanced and
sustainable economic growth. Second, as the regulator of financial institutions, the BSP seeks to
promote the soundness of the financial system, which in turn, would support overall macroeconomic
stability and growth.
I would first focus on the current and future thrusts of the BSP in line with the second role as they
relate to risk management and then proceed to the importance of risk management, risk profession
and risk management practices.
The need to change regulatory approach
A crucial moment in the development of risk management occurred in February 1995 when it was
announced that the Barings PLC, the oldest bank in England had lost over GBP600 million and was
insolvent as a result of the derivative trading activities of a single trader in Singapore. At the time of its
collapse, Barings was known to be very conservative, well capitalized and historically profitable.
The Barings case brought to light that the real issue was not derivatives per se, but the quality of
management and control required in modern financial environment. The collapse called into question
the strength of existing internal controls in the investment industry and the aptness and adequacy of
external monitoring done by the exchanges and regulators. The event demonstrated very clearly that
their existing regulatory frameworks were no longer appropriate for the continuously changing and
complex market environment. This led to a critical reassessment of the regulatory approach and
brought changes in the banking supervision approaches by the Bank of England and other regulators
around the world.
Financial regulatory initiatives in Philippines on internal risk management
The BSP, for its part, in its role as bank supervisor has taken a number of initiatives to improve internal
risk management among banks by adopting the Basel framework.
In March 2001, the BSP adopted the original Basel I through Circular No. 280. This Circular provided
the guidelines for the computation of risk-based capital for credit risk. This was further enhanced by
the issuance of Circular No. 360 in December 2002 incorporating market risk into the risk-based
capital framework. We also issued Circular No. 400 in September 2003, extending the risk-based
capital adequacy requirement to Quasi-Banks.
The BSP's focus on supervision is ultimately intended to give banks greater flexibility to respond to
challenges and changing opportunities under a more deregulated and globalized environment and
amidst rapid technological advances. Traditional bank supervision tended to instruct banks to avoid
risks that seem too high. The new approach to supervision favors assessment of the quality of risk
management practices, and generally allows banks to take risks so long as they demonstrate the
ability to assess, measure and manage them.
We believe that a good first step to good risk management is good corporate governance. We have
thus issued a number of guidelines instituting good corporate governance. These include laying down
the guidelines to govern the responsibilities and duties of the board of directors (Circular No. 130,
June 1997); requiring banks to develop and implement a compliance system and appoint/designate a
compliance officer to oversee implementation (Circular No. 145, October 1997); implementing the fit
and proper standards for directors and officers of banks and non-banks including the requirement for a
mandatory orientation program on corporate governance (Circular No. 296, September 2001).
This year, the BSP issued anew a number of guidelines that aimed to further enhance the risk
management practices in banks. In January, the BSP issued the guidelines for managing large
exposures and credit risk concentrations of banks (Circular No. 414). Also in the same month, the BSP
issued the guidelines for the capital treatment of banks' investment in credit-linked notes (CLNs) and
similar credit derivative products (Circular No. 417). In April 2004, the BSP issued guidelines for the
treatment of compliance risk and to further strengthen banks' compliance function (Circular No. 429).
And more recently, in June 2004, the BSP issued the guidelines for the development and
implementation of banks' internal risk rating systems(Circular No. 439).
Journey to Basel II
The simplified approach of Basel I has been successful in boosting capital levels in the global banking
system from what were considered uncomfortably low levels throughout the late 1970s and early
1980s. Its major shortcoming, however, is that the "risk weights" poorly represent the likelihood of
sustaining losses and such lack of risk sensitivity can lead to misallocation of scarce financial
resources and hamper long-term economic growth.
The New Capital Accord otherwise known as Basel II, formally unveiled last June 26, is seen to make
capital requirements to be more risk sensitive than Basel I. It allows greater reliance on the banks'
internal systems for setting the capital requirements. More importantly, it provides incentives for banks
to continuously improve their risk management practices.
However, Basel II poses challenges to Philippine Banks and the BSP. Banks will have to develop a
more disciplined, rigorous, and auditable approach to risk assessment. This challenge has many
dimensions and technology will only address some of them. For the BSP, our challenge is to build up
technical knowledge and supervisory resources to validate bank's risk management systems. We will
also need to examine our existing charter to see to it that we have the necessary powers to implement
Basel II, particularly Pillar 2.
The risk management standards and practices embodied in Basel II are real and are drawn from the
best practices of large internationally active banks. It reflects the many insights gathered through
practical experience, including both successes and failures in risk management. It contains many
useful lessons and can serve as a good roadmap on how to improve internal risk management.
However, we acknowledge that not all aspects of Basel II will be of use to every bank. For example,
some of the quantification tools used in large complex institutions may not be necessary for the
smaller and less sophisticated institutions. And some risks inherent in the activities of banks which are
internationally active may be remote to those which are merely active domestically.
This is the reason for modifying the Philippine framework by taking into account, the local banks' state
of readiness, local conditions and practices consistent with the nature, complexity and materiality of
the local institution's activities. This is also the reason for providing a breathing space for thrift and
rural banks in implementing Basel II.
The BSP has lined up certain projects which involve the study of the applicability of certain Basel II
requirements to local conditions. These projects are expected to culminate in a set of comprehensive
guidelines for banks which we plan to release not later than end-2006, for implementation in 2007.
As you may be aware, Pillar 1 of Basel II proposes standard and advance approaches to credit and
operational risks. Universal/commercial banks are expected to implement the standardized
approaches to Basel II by 2007. However, implementation of the more advanced approaches is not
expected to occur until perhaps 2010 to allow banks time to build-up reliable historical database to
estimate default probabilities and other variables as important inputs to the advanced models. Foreign
banks whose head offices are using the advanced approaches, will be allowed to use them provided
that they can show that their models are suited to domestic conditions.
With regard to Pillar 2, we will continue to push banks to improve their risk management practices and
risk assessment capabilities and corporate governance. With respect to Pillar 3, the appropriate
disclosure requirements under Basel 2 are targeted by 2007.
BSP's view of the importance of risk management and sound risk management practices
On the topic of the importance of the risk profession and risk management practices in the Philippines,
I believe this could be best approached by presenting our views on the significance of risk
management and our expectations from risk managers.
• Risk management is more than a regulatory reporting and compliance exercise; it is a
necessary risk-reducing tool to promote long-term profitability and stability of the firm and
enhance the competitive advantage of firms.
We encourage banks to have the flexibility to use their internalmodels not merely for
computing the level of capital needed to absorb possible losses inherent in their activities,
but to encourage them to make rational decisions on the basis of risk and return
considerations. Good internal models provide timely information on how much risk the bank
is taking in order to achieve specific business objectives. Internal models must also allow
banks to compare and select, on a timely basis, from among the alternative business
opportunities or strategies not solely from the profit angle but also from a risk standpoint.
The Philippine adoption of Basel II will certainly obligate banks to cover more types of risks
and on the basis of our calculations, the banks' capital requirements will surely increase with
said adoption. However, if a bank has right risk management systems that can effectively
capture the risk exposures, there is an opportunity for them to lower their capital charges.
As financial markets progress towards the market transparency mechanism that is promoted
under Pillar 3, risk management will be seen as a potential differentiator and a source of
competitive advantage. Ultimately, it will reward banks that manage their risks effectively,
and penalize those that do not. Good risk management practice is thus even more essential
for banks to maintain competitiveness over the long run.
• Corporate governance is not a mere risk compliance measure; It is vital to the institution's
health.
As far as the banking industry is concerned, corporate governance relates to the manner in
which businesses and affairs of the individual banks are directed and managed by the board
of directors and senior management. It provides the structure though which the objectives of
the institutions are set, the strategy of attaining those objectives is determined and the
performance of the institution is monitored.
Corporate governance is essential to the institution's health. It seeks to meet legal
requirements and uphold fiduciary responsibilities to investors, creditors and depositors. It
attracts and retains good senior management, officers and employees. It also makes the
organization attractive to investors, clients and business partners.
Equally important, corporate governance reduces exposure to reputational risks or the
potential that a negative publicity regarding an institution's business practices will cause a
decline in the customer base or lead to costly litigation.
•
Risk management matters are necessary parts and parcel of sound strategic planning.
The need to include risk management in strategic planning cannot be overemphasized as we
have seen a number of banks getting into trouble where the root cause can be traced to
inconsistencies between the bank's strategic goals and risk management objectives or
simply the lack of risk management objectives.
Sound strategic planning should involve not only setting targets such as revenue, assets
under management, and the number of new accounts, but also include the establishment of
control and risk management systems.
Specifically strategic planning should lead to an objective assessment of the institution's risk
profile and highlight areas of strengths and weaknesses. It should help the firm determine
the risks it wants exposure to, the risk it cannot avoid, risks that the firm is not prepared to
face and the risks it can reduce.
Strategic planning should involve the use of internal risk assessment as such could uncover
natural hedges, or countercyclicalities, that exist across different businesses of a firm. Such
knowledge helps the firm focus on its net exposures and more effectively allocate resources.
Risk assessment often results in a better understanding of the internal and external
environment, which can be a source of competitive advantage by the uncovering of business
opportunities or the early assessment of threats which in turn allow the firm to have
competitive lead over less informed competitors.
•
Stress testing enhances management of risks.
Many of us here today may wish that we have the ability to predict with certainty when the
next crisis will strike. Regrettably there appears to be no existing technology that would allow
us to predict it with accuracy. However, we can prepare for it well in advance it if we know
how it would impact on us, if and when it comes, and plan in advance the right level of
resources to withstand it. We can do this if we have the capability to perform on a regular
basis, the suitable stress testing and scenario analyses.
•
A proactive risk culture must exist in an institution to ensure effective risk management
A proactive risk culture means there is awareness of risk within an institution which
permeates the actions and words of all the members of the firm. This can be done through
regular risk awareness activities, education, open communication lines among units/groups
concerned, and continuous interaction with senior management.
When considering the importance of risk culture, it may be asked why some firms fared
better than others at risk management. Nick Leeson's actions at Barings would have been
less likely if a meaningful "risk culture" had been in place which institutionalized management
oversight, upheld segregation of duties, and permitted closer monitoring of the trading in
books that appeared to be profitable. Risk culture is important today because the complexity
of modern financial instruments makes it possible for even a single, unsupervised trader to
gamble and lose, the entire capital of a firm.
A good example of recent failure of risk culture is that of the National Australia Bank. In
January of 2004, the National Australia Bank(NAB), Australia's largest bank and second
biggest company was reported to have lost $360 million in foreign currency trading. A report
released by the Australian Prudential Regulation Authority attributes the losses to the four
currency options traders who, possessed of an abundance of self confidence, positioned the
NAB's foreign currency options portfolio in the expectation that the fall in the US dollar that
occurred mid last year would reverse and that volatility would eventually stabilize. Rather
than closing their positions as the market moved against them, the traders chose to conceal
their true positions - allowing those positions to deteriorate unchecked over a period of three
months before they were finally discovered. The traders were able to paint a rosy picture of
P&L and masked losses by amending trades and using fictitious trades. By the time they
were discovered, the positions held were totally out of control.
The report highlighted that the risk control failures have more to do with poor implementation
than poor design. On paper, NAB's existing control framework should have been able to
identify and contain risk positions of the traders. There are many layers to NAB's internal
control framework, the risk management group and the board included, but they failed at
every level to detect and shut-down the irregular currency options trading activity. The NAB's
internal governance model, which should have enabled timely identification and effective and
quick escalation of serious risk issues on the currency options desk, simply did not function.
Had the risk control framework been implemented effectively, the losses would certainly
have been substantially less, or quite possibly, averted altogether.
Expectations from risk managers
•
Risk management team requires diverse set of skills and knowledge.
The many complex risks across an organization are too varied for any one discipline to claim
mastery over. As the role of risk management is complex and comprehensive, the ideal risk
management team must be made up of multiple individuals, with different sets of skills and
knowledge to effectively address the risks confronting the institution.
Integrating staff from such areas as trading, research or financial control and legal, can
enhance the group's understanding of the business implications of risks, and its ability to
interact with other areas that either feed the risk analysis process or are affected by its
results.
•
Risk management team must be independent of business units but needs to interact and
communicate with other parts of the firm.
Risk management needs to be performed as an independent function, sponsored and
supported by senior management. The group in particular needs to be separate from the
business units such as front office, otherwise there would be conflicts of interest and firm's
risk would not be independently measured. However, this independence is a delicate
balancing act because the risk management group needs to communicate with the business
and operations groups to have a clear understanding of their views on the markets, products,
positions, strategies and operational procedures before it can accurately assess risks.
In addition to business units, the risk management group would also have to interact with
other internal and external entities, typically, the senior management, financial control,
operations, legal/compliance units, regulators, auditors, rating agencies, investors and
clients.
To illustrate some of these interactions, risk management and financial control (accounting)
must have a close relationship since performance evaluation is no longer confined to simply
reporting returns and total profit figures, but has increasingly incorporated the measure of
risks taken. And since financial control maintains the books and records with respect to P&L
while the risk control group has responsibility for risk data, the two departments must
invariably work together. Further, public and supervisory reports used to require disclosure
on the traditional financial accounting information only; however under Pillar 3, banks may be
required to make public certain material risks information such as tier capital. In order to
ensure consistency in providing regulatory and public reports, the financial control and risk
group must necessarily share the same database.
External auditors in other countries now frequently include an assessment of risk
management in the annual audit, in part because of the trend to include risk management
information in the annual report and to comply with the regulatory approach of ensuring the
soundness of the financial institution. With the adoption of the Basel II Framework, we
expect this trend to grow globally, including in the Philippines. The risk management group
must hence work closely with the auditors to demonstrate clearly the measurement
methodology used, as well as the completeness of the supporting procedures.
•
Risk managers must look beyond organization's boundaries.
The corporate demises of Enron and WorldCom have shown the need to achieve the
organization's vision, mission and objectives under any stress or extreme events. The
proactive risk manager must therefore look beyond the organization's boundaries and
assess the impact of its action on the wider environment where the firm operates, including
those of its stakeholders, i.e., customers, employees, retirees, suppliers, communities,
borrowers, creditors and regulators.
Speaking of regulators, internationally active banks need to take into account regulations in
the various jurisdictions in which they operate, and the fact that regulatory standards may
shift over time.
• Risk managers must be effective communicators and leaders in the organization.
The risk manager must be well versed in the risk management process and be able to
effectively communicate and lead the processes within the organization to mitigate exposure
to business risks. In support of this he must have a good understanding of the environment
and community served by the organization, the operations of different units and relationship
between different levels of the organization.
•
Risk managers must address corporate governance issues and contribute to improved
corporate governance.
The increased anxiety among shareholders due to the celebrated cases of accounting
scandals and corporate bankruptcies have highlighted the need for good corporate
governance. Corporate governance has become an issue for a growing number of risk
managers who are now given an active role in managing corporate governance standards.
Risk managers are therefore expected to address corporate governance issues and
contribute to improved corporate governance to prevent losses and enhance long-term
sustainability of the organization.
•
Risk profession must embrace good business ethics.
Allow me to tackle this subject by way of Enron's experience with risk management. Enron
maintained a risk management function with capable employees. Lines of reporting were
reasonably independent in theory, but less so in practice. The group's mark-to-market
valuations were subject to adjustment by management and in this context, the
mark-to-market accounting became a mark-to-model accounting. The traders who were
performing the trades, too, had considerable influence on how the deals were
marked-to-model. With their bonuses depending upon the profitability of the deals, there was
an unaddressed conflict of interest. Trading businesses were generating considerable
profits, but much of these were dubious mark-to-model profits.
Enron maintained a fluid workforce. Employees were constantly on the lookout for their
internal transfer. Those who rotated through risk management were no different. A trader or
structurer whose deal a manager scrutinized one day might be in a position to offer that risk
manager a new position the next. Astute risk managers were careful not to burn bridges.
Risk managers knew that they would suffer if they blocked deals or did not support the
favorable management-approved mark-to-model valuations. Even worse, risk managers
were subject to Enron' "rank and yank" system of performance review. Under that system,
anyone could contribute feedback on anyone, and the consequences of a bad review were
high. Risk managers who blocked deals could expect to suffer in "rank and yank". Risk
management, thus, became little more than a rubber stamp and a stepping stone for
employees moving around the company.
The Enron's case clearly describes the importance of ethics in risk management profession
and the consequences of the lack of it. A code of ethics which sets forth a discipline of moral
duty and conduct in support of the demanding standards of risk management profession
must necessarily be in place. At the minimum, the code of ethics should cover the standards
for integrity and dignity, trust, confidentiality, competence and professional practice.
Conclusion
To conclude, in the longer term, the power of computers to create and analyze huge databases will
change the very nature of risk management. Real time, on-line risk analysis and reporting, scenario
analysis and stress testing will become more and more standard tools for day- to- day operations.
But more important than these sophisticated systems is the development andadherence of institutions
to good corporate governance ? one that permeates a proactive risk culture. We believe that this is the
first step to good risk management which an institution can implement even in the absence of
sophisticated systems. If one has a good risk management process that it follows strictly, then the
institution has a better chance of preventing the occurrence of losses even during extreme events.
The requirements of Basel II are amazing even for the sophisticated risk professional. Not only does
he need new set of improved risk techniques and technology, he also needs to unlearn old traditional
techniques that have now became obsolete or unreliable. He needs to be constantly aware of new
market developments, good or bad, and learn from the experiences and mistakes of others. Not only
that, the Basel world would require vast amount of data inputs, analysis and reporting that would place
pressure on the risk professional to do a better job.
Our views on risk management and our high expectations from risk practitioners as presented, point to
the varied and difficult roles that the risk professional must play. It is incumbent upon him to be
prepared for them and accept the challenge. The lessons learned from the financial disasters, some
them I mentioned here, and the challenging tasks on the road to Basel II, the need to integrate risk
management in strategic planning to maintain competitive advantage and ensure company long-term
survival, - all these highlight the growing importance and broadening application of risk management
and consequent increased challenges for risk management practitioners.
In playing these increasingly challenging roles, risk practitioners, in whatever capacity he/she is in ? as
an in-house risk manager or risk specialist or an external risk management adviser-- may be faced
with key issues as lack of independence, lack of competence in specific areas, unclear scope of
responsibility, unclear legal or contractual liability, conflict of interest, inconsistency of treatment and
approaches, inadequate or inappropriate risk management tools and processes, and uncertainty of the
results of advise or recommendation.
Therefore, in order to face these issues squarely, it would be ideal to have a professional approach to
risk management by instituting a system of guidance as to the appropriate and standard behavior,
work practices and ethics to observe in the provision of risk management services, and a framework or
benchmark for a professional risk management service. It is also important to have a system of
qualification, training and education as well as a forum to share experiences and ideas to improve
competency among risks management practitioners.
These are our views on the importance of risk profession and sound risk practices employed in the
Philippines. May I clarify, nonetheless that most suggestions here also apply to non-bank entities. Let
me re-emphasize that risk management is not merely for compliance, but is a vital aspect of protecting
and enhancing an institution's corporate image, gaining competitive advantage and ensuring its
longterm viability.
Thank you.