Anand Sinha: Perspectives on risk and governance
Address by Mr Anand Sinha, Deputy Governor of the Reserve Bank of India, at the Risk &
Governance Summit, organized by the Indian School of Business, Hyderabad and Deloitte,
Mumbai, 23 August 2012.
* * *
Inputs provided by Ms. Ranjana Sahajwala, Ms. Anupam Sonal and Jayakumar Yarasi are gratefully
acknowledged.
Mr. P R Ramesh, Chairman, Deloitte, Dr. Vikram Kuriyan, Director of the Investment Centre,
Indian School of Business, Ms. Usha Thorat and Mr. V S Das, my erstwhile colleagues from
Reserve Bank and other delegates. It is a pleasure for me to interact with you all, today at
this Summit.
The theme of the Summit revolves around risk and governance, the two terms which are
being looked at by policy makers with renewed interest and a fresh perspective in the
aftermath of the global financial crisis. I intend to talk briefly on both risk and governance
from a conceptual perspective before deliberating on the regulatory changes (Basel III) and
conclude with a brief overview of the Indian perspective.
Risk is almost God like in qualities. It is omnipresent. You find risk everywhere ranging from
simple things such as walking (you run the risk of tripping and falling) or talking (you run a
risk of saying something inappropriate or getting misquoted) to more serious things such as
flying airplanes, launching satellites or conducting surgeries. Unmanaged risk can prove
disastrous and the recent global crisis is a continuing testimony of this fact.
Risk has a long history, perhaps as long as human history, and so does risk management.
Reflecting on risks and risk management as it would have prevailed in the early ages, I am
reminded of a beautiful quote which goes this way: "Every day in Africa a gazelle wakes up.
It knows it must run faster than the fastest lion or it will be killed. Every morning a lion wakes
up. It knows that it must outrun the slowest gazelle or it will starve to death. It does not matter
whether you are a lion or a gazelle. When the sun comes up, you better be running."
Understanding the risks and learning to manage them has been the mantra for survival in
any age or in any realm of life. In fact, managing risks, I would say, is one of the critical
attributes of human beings which differentiated them from the others and helped in their
survival and development.
While risk is prevalent everywhere, I would focus my discussion on the financial world where
there have been many attempts to quantify and manage risks in a major way. And there have
also been major disasters.
II. Risk & risk management in financial world
Many times in the past, financial risks have resulted in major blowouts wiping out billions of
dollars of wealth from the system and pushing people and economies into bankruptcy. Stock
market crash of 1987, Asian crisis of 1997, dotcom bust of 2000 and the latest and still fresh
crisis of 2007 are some of the notable examples of risks going out of control and are
reminders of the potential impact of mis-management of risk.
Several factors, both macroeconomic and regulatory and supervisory have led to the crisis of
2007, of such large dimensions. However, in the ultimate analysis, risk measurement and
management tools and methodologies have proved to be grossly inadequate despite
tremendous development and sophistication brought about in risk modelling.
The gross under-estimation of risk resulted in high leverage during the period of great
moderation. This, combined with over-reliance on short term wholesale funding, resulted in a
downward spiral in asset prices once stress developed in the sub-prime mortgage market in
the US, dragging down the economies of the US and the rest of the world. The effect of the
crisis has been severe and prolonged and it is difficult even to estimate when the world
economy would likely be back to "normal". Clearly there was failure of corporate governance
in not putting in place adequate systems to mitigate risk.
The crisis triggered an intense interest in the nature of quantitative financial models and their
inability to predict the disasters. It is obvious that the risk models in use were highly
inadequate. Most of the losses occurred in the trading books where the crystallized losses
during the crisis were several times more than what the Value at Risk (VaR) models
predicted. Moreover, there was a serious flaw in the conceptual framework, inasmuch as risk
management was focussed almost exclusively on individual banks and financial institutions
under the misplaced notion that individually strong financial entities would ensure a sound
and strong financial system. This misplaced notion is known as the fallacy of composition
and it resulted in the systemic risks not being accorded the much needed serious
consideration. There was thus no framework to address systemic risk i.e., issues of
procyclicality and inter-connectedness in the financial system.
It is, therefore, important to analyse the limitations of the quantitative models. For market risk
the VaR model is widely used as it is simple and its mathematics is tractable. VaR models
have regulatory approval from the Basel Committee on Banking Supervision (BCBS) and
therefore from national regulators. This model works on two primary assumptions.
i. Normality - that is, asset values are assumed to follow a normal distribution. This is
supposed to be an approximation to reality as indeed models are by definition
abstractions from reality. However, in certain periods, particularly periods of high
stress, the normality assumption is an unsustainable abstraction from reality.
ii. VaR models are not causal but statistical in nature and, therefore, they use the past
data to predict the asset values in future.
Even for credit risk, the Vasicek model is typically used to determine the capital requirements
under the Internal Ratings Based (IRB) Basel framework. In this model too, it is assumed that
the underlying risk factors and, hence, portfolio losses are normally distributed.
Under the normal distribution, the probability of occurrence of events farther removed from
the mean outcome (more than 3 standard deviations or sigma) fall rapidly. For example, the
probability of a 5-sigma loss on any given day would mean that such an occurrence should
happen once in about 14,000 years (assuming 250 trading days in a year) that is much
longer than the period of time that has elapsed since civilisation evolved.1 During the crisis
however, the Wall Street Journal (2007) reported that events that models predicted would
happen only once in 10,000 years, happened everyday for 3 days. David Viniyar, Goldman
Sachs' Chief Financial Officer was quoted in Financial Times (2007) saying "We were seeing
things that were 25-standard deviation moves, several days in a row. There have been
issues in some of the other quantitative space. But nothing like what we saw last week."2
Such large sigma movements have happened earlier also. During the European Exchange
Rate Mechanism debacle in 1992, 50 sigma moves in interest rates were witnessed, while
1987's Black Monday was a 20 sigma event. During summer 1998 upheavals that eventually
brought down the Long Term Capital Management (LTCM), 15-plus sigma deviations
became the norm.3 It is thus clear that the assumption of normality in the probability
distribution does not correspond to reality, particularly, in highly stressed situations.
The underlying assumption behind normal distribution is that it represents a collective view of
markets by a large number of participants who act rationally and largely independently, and
their behavior is stable across time zones, which enables the past data to predict the future.
On a closer examination, this assumption is highly inaccurate because the economic agents
react to news and information and suffer irrational behavior bias when the news is either very
good or very pessimistic. In fact, their behavior is conditioned by "disaster myopia" and,
hence, when pessimism takes a grip, they act in a herd, driving down the asset prices very
sharply resulting in fat tails in the distribution: that is, the losses are much higher than what
the VaR model would predict. In a financial crisis it is the large swings in correlation that are
of key importance and using a model that does not allow for such changes is of limited use.
CDOs are the classic example of the failure of risk modelling during the crisis as the models
failed to take into account the correlated defaults once the stress in the subprime mortgage
segment set in. It is due to this psychology and the burden of debt carried from the boom
period that growth has not picked up in the advanced economies despite all the stimulus. It
has been our experience too that after the onset of the crisis when the monetary and macro
prudential measures were eased sharply, it did not lead to any significant credit offtake.
As regards the past being a good indicator of the future, the assumption is highly flawed.
With the rapid development of technology, increased integration of markets and entry of
sophisticated players, the present and the future are much different from the past and it
would be very naïve to predict the future based on the past data. Pablo Triana in his book
"Lecturing Birds on Flying" very succinctly argues that when LTCM tried predicting the future
with its sophisticated models, it went awfully wrong in not realizing that a LTCM-less past
could not be a reliable guide to an LTCM-dominated present.
Besides the above two issues with VaR models, the data horizon is also an issue. As regards
market risk for which high frequency data is available, reliance on a short time horizon from
the past becomes misleading as it may fail to capture the stress period data. Even if such
data could be captured as is now required to be done under the modified market risk
framework of BCBS in the aftermath of the crisis, it is unlikely that the future would be
predictable with significantly enhanced accuracy because it is very difficult to predict and
model the human behavior. In credit risk modelling, there is an additional issue of paucity of
enough default data.
Too much faith and undue reliance on risk models, despite all the inherent weaknesses
which have been in evidence, has been the undoing in risk management. The recent episode
of JP Morgan derivative losses in their Chief Investment Office (CIO) is another reminder of
the fallibility of the risk models, and of their inability to accurately estimate the risks
associated with the complex derivative products as well as of the failure of risk governance. It
is an irony that the trades undertaken to hedge the bank's risks and protect it from losses,
themselves led to losses. Reportedly, the new VaR model employed by the firm, which had
been able to navigate the crisis quite well, was at least partially responsible for the mishap. It
is clear that we have been dazzled by the sophisticated mathematics and made the mistake
of equating sophistication with quality. The mistake has been in elevating quantitative finance
to the status of physics - it is stated that economists suffer from physics envy. There are very
fundamental differences between physics and quantitative finance. Physics deals with the
laws of nature governing the universe. The objects have unique physical attributes (i.e.
position, velocity, temperature, etc.) and the universe evolves according to the immutable
laws of nature. Any observation or measurement of physical attributes does not change them
or even if it does, it does so in a predictable way so that the true value of the attribute before
measurement can be known with complete accuracy. The physics of the microscopic world
(quantum mechanics) is far too complex and there are no settled views on the nature of
reality. Even then, the microscopic world evolves according to defined laws in a deterministic
way. However, during measurement interactions the results are not deterministic but follow a
probability distribution which, however, is stable. On the other hand, in finance, there is no
such law of financial markets. The "values" of assets are not inherent attributes of the
financial instruments and the economic agents are not outside observers of the financial
system. In fact, it is the human mind, its ambitions, drive, competitiveness, caprice and greed
which drive the actions of the economic agents and it is these actions which determine the
value of the financial instruments. Thus, unlike in physics, in finance, it is the observers who
provide value to the financial instruments. There is no unique value: it is determined by the
collective psychology of economic agents and hence such valuations tend to be on the
extreme when there is a collective feeling of euphoria or pessimism. Financial risk modelling,
therefore, is far more complex than modelling in physics. As Pablo Triana mentions in his
are no immutable laws when it comes to the values of financial assets... In
book,4 "There
finance there is no truth. A new reality is created every minute through the unpredictability of
utility seeking humans."
The above discussions point to the need for a paradigm change in risk modelling. There has
been rightly an increasing emphasis on stress testing and scenario analysis to supplement
the risk model outputs so as to factor in the risks arising from rare but plausible events and
prepare the financial institutions to survive these. While this is an improvement from the
"micro" perspective, modelling systemic risk is that much harder because these are created
endogenously within the system as a result of the responses of participating economic
agents. This gap could potentially be filled up by the systemic regulators set up in the
aftermath of the crisis: Financial Stability and Development Council (FSDC) in India,
Financial System Oversight Council (FSOC) in the USA, Financial Policy Committee (FPC) in
the UK and European Systemic Risk Board (ESRB) in Europe etc. International efforts are on
to widen and deepen the financial data available to systemic risk regulators. These data can
possibly be combined using behavioural rules of economic and financial system and balance
sheet constraints to build models of systemic risk.5 These are very early days for systemic
risk modelling and with time considerable improvement would happen. In the meantime, from
a regulatory perspective, additional capital requirements and resolution mechanisms to deal
with Systemically Important Financial Institutions (SIFIs) and countercyclical capital
requirements to deal with procyclicality issues have been devised. The move for the
migration of Over the Counter (OTC) derivatives to Central Counter Party (CCP) set up is
designed for reducing the systemic risk arising out of interconnectedness in the financial
markets.
Despite all the criticisms and deficiencies, quantitative models still have a very important role
to play in risk management. They provide a very good starting point but should be treated as
a supplement to decision making. Primarily, qualitative judgement, experience and common
sense should be the guiding factors in dealing with risk. This becomes all the more important
if it is realised that there are risks beyond those that are measured by risk models. These
are: uncertainties (i.e. unknown risks which can be identified but cannot be measured, such
as reputation risk) and unknowable risk (the existence of the risk is not predictable, such
as 9/11). While it is hard to devise defences against unknowable risks, the best way to deal
with uncertainty is to be aware of its existence and of the inability to quantify it and act
accordingly - may be take preventive action. The Senior Supervisors' Group's Report
"Observations on Risk Management Practices during the Recent Market Turbulence" (March
2008) confirms that the financial institutions which survived the crisis better were those who
had, among others, informative and responsive risk measurement and management
reporting and practices. The blend of qualitative and quantitative analysis provided a high
level of insight and consistent communication to management of evolving conditions enabling
the firm to respond effectively to emerging opportunities and risks. It is clear that such firms
did not rely exclusively on the quantitative risk models.
This brings us to the question of the role of regulators/ supervisors in ensuring sound risk
management systems. It is apparent that they have to ensure that the risk models used by
banks are robust. The implementation of Advanced Approaches to Basel II casts this
responsibility on regulators before approving use of internal models by banks. Inevitably, this
means that regulators set minimum standards for risk modelling and in a way become "risk
modellors of the last
resort".6 This brings about uniformity in risk management while,
arguably, heterogeneity would be more desirable because uniform approach to risk
management can accentuate market movements by increasing correlation in the financial
system which may result in larger systemic risk. At the moment, however, there does not
seem to be any solution to this dilemma.
Regulators also have a significant role to play in containing the downside of competitive
pressures. With sharp focus on short term performance i.e. quarterly, half yearly or annual,
there is intense competitive pressure on banks which leads to their indulging in risky
behavior (may be even by manipulating the risk models) despite being fully aware of the risks
they are undertaking and it is as if the banks secretly wish that the regulators step-in and
prohibit overtly risky activities. I quote from the book "On the Brink" by Paulson who was the
Treasury Secretary in US when the crisis erupted. The setting is a dinner on June 26, 2007
(just before the beginning of the financial storm), attended by Mr Paulson himself and the
heads of some of Wall Street's biggest firms:
"All (i.e. all the CEOs) were concerned with excessive risk taking in the markets and appalled
by the erosion of underwriting standards. The bankers complained about all the covenant-lite
and bridge loans they felt compelled by competitive pressure to make. I remember Jamie
Dimon, the JPMorgan Chairman and CEO, saying that such loans did not make sense. Steve
Schwarzman, the CEO of Blackstone, a dominant private-equity firm, acknowledged he had
been getting attractive terms and added that he was not in the business of turning down
attractive money.
Chuck Prince, the Citigroup CEO, asked whether, given the competitive pressures, there
wasn't a role for regulators to tamp down some of the riskier practices. Basically he asked:
Isn't there something you can do to order us not to take all these risks?"
Not long after, I remember, Prince was quoted as saying: "As long as the music is playing,
you have to get up and dance."
The recent LIBOR scandal is a case in point. The realisation that LIBOR, the mother of all
indexes, which was held sacrosanct till the other day and was used for pricing of about
$ 800 trillion worth of financial instruments (reportedly 11 times the GDPs of all nations on
earth), could be rigged is a shock to many. The episode highlights the ill effects of excessive
competition and the need for regulatory oversight (i.e. oversight of the rate setting process in
this case).
Now let me focus on governance issues in the context of risk management
III. Corporate and risk governance issues
History is replete with instances to prove that poor corporate governance, especially weak
risk governance systems, have been the major causes of financial crises over and over
again. The global financial crisis and the attendant lessons from the excessive risk taking by
banks and other financial institutions, poor Board and senior management oversight,
inadequate understanding of the risk build-up and irrational compensation packages have
once again catapulted the corporate and risk governance issues to the forefront.
Risk governance can be explainedas a component within the overall corporate governance
framework and defined as an integrated framework laid out to provide guidance for
comprehensive assessment and management of risks. An effective risk governance
framework ensures that the firm is able to achieve its stated goals within the chosen risk
appetite framework.
IV. Why risk governance is important in banks
Banks are very special. In their role as intermediaries, they perform a very critical function of
risk transformation which results in warehousing of risks by banks. Further, banks' business
model of accepting deposits for lending, leads to significant leverage (a leverage of about
18 times of banks, during 1995-2010, against the leverage of 3 times of non-financial firms7).
Liquidity risks can be very critical even for well capitalised banks, a lesson the global crisis
has emphatically demonstrated.
The banking business has become far more sophisticated and complex. Risk too, has
increased in proportion to this sophistication and complexity. The risk taking behaviour of
banks has high potential for contributing to and amplifying systemic risk and consequent
contagion. This can have severe repercussions for financial and economic fragility as
witnessed during and in the aftermath of the global financial crisis.
Given their unique business model and also the special role played in the financial system,
sound internal governance for banks is essential, requiring Boards to focus even more on
assessing, managing, and mitigating risk. Banks operate on the foundation of public
confidence and any small breach in that confidence can lead a run on the bank and to an
eventual failure.
V. Lessons from the global financial crisis in governance failure
The global crisis has taught that no financial institution can be resistant to all possible crises
and no quantitative model can fully capture all the risks. This realisation has prompted the
focus to shift to strengthening of the risk governance by strengthening the risk culture, risk
awareness and appreciation. Governance has been brought to the centre stage and there
are many initiatives under way to plug the gaps and loop-holes in the governance framework
that presumably amplified the financial crisis. The Senior Supervisors' Report, Group of
30 Report, Walker's Report etc., are some of the initiatives in this direction. The Basel
Committee has also issued a revised framework for corporate governance in banks in 2010.
Highlighting the role played by gaps in governance framework in precipitating the global
crisis, the Senior Supervisors' Group in its report - "Risk Management Lessons from the
Global Banking Crisis of 2008" observed that "despite firms' recent progress in improving risk
management practices, underlying weaknesses in governance, incentive structures,
information technology infrastructure and internal controls require substantial work to
address". The Report brings out that the Board of Directors and the Top Management in the
affected institutions failed to recognise and initiate corrective action on both the excessive
build-up of risks in the individual institutions or their contribution to the risk, and the
disproportionate level of leverage in the system. There was a general disconnect between
the risks being taken by the banks / other financial institutions and those that their Boards of
directors perceived them to be taking.
Robust governance systems differentiated successful firms from others during the crisis.
Organisations with good risk governance systems were able to respond with more flexibility8
and tide over the crisis. While no financial institution appears to have fully anticipated the
magnitude of the crisis, the way in which institutions were able to respond - and to influence
their outcomes - depended, in large part, on the strength and configuration of their internal
risk governance structure. The Boards of the institutions better able to weather the storm,
generally received timelier, more complete, and enterprise-wide risk information, enabling
them to make critical decisions to curtail risk earlier - before asset values plummeted and
market-based sources of funding became inaccessible.9
The Group of Thirty (G30) report "Toward Effective Governance of Financial Institutions", too
brings out that management teams, boards of directors, regulators and supervisors, and
shareholders all failed, in their respective roles, to prudently govern and oversee systemically
important financial institutions.
Governance failures leading to the global financial crisis are largely being explained to the
weaknesses in board level oversight. The Boards were not actively involved in setting of the
risk appetite for the firms. Incomplete risk information to the Boards hampered both the
complete understanding / appreciation of the firm wide risk profile of the institution and the
effective decision making in this regard at the board level leading to a sense of complacency
regarding the risk management frameworks in place. Also, there was a fundamental lack of
expertise among the directors, especially the independent directors, to understand or
respond to the risks in the desired manner.
Governance practices suffered from similar weaknesses at the senior management level.
Senior management failed to adopt and integrate the necessary systems to identify, manage,
and report risk.10 There were lacunae observed also in the MIS in capturing the level and
nature of aggregate risk arising in rapidly evolving balance sheets. Further, risks were not
properly priced which resulted in improper allocation of capital, inadequate preparation for tail
risk events eventually leading to the precipitation of the crisis.
Another area of imbalance was the risk reward and remuneration framework. The
compensation packages encouraged risk taking behaviour with short term profit objective as
the immediate goal at the expense of the long-term financial health of the organization. The
compensation structures did not factor in appropriate safeguards to check or mitigate the
adverse consequences or losses that could materialise in the long run from the imprudent or
excessive risk taking and jeopardize the safety and soundness of the organization.
The crisis also highlighted the absence of enterprise wide risk decision making process. The
risk management framework was based on silos rather than the enterprise level, thus
missing on the comprehensive enterprise wide picture including an understanding of the
interplay of risks across the organisation. As the overall picture of the risks was not available
with the Boards or the Top Management, the consequent controls and mitigating measures
also turned out to be inadequate and ineffective which hindered effective risk management.
VI. Building a robust risk governance framework - the way forward
There is an enhanced realisation that the risk governance demands a holistic approach and
that risk appreciation should start at the top. A strengthened management information
system (MIS) supported by robust information technology platform is a necessary
precondition for enhancing Board efficiency in oversight and decision making. Similarly,
augmented skill sets and experience at the level of independent directors would go a long
way in enhancing the Board capacity. Strong MIS facilitate risk reporting to the boards in an
effective and comprehensive manner, which in turn enhances transparency and causes
informed decision taking. Robust information technology systems are a necessary condition
for supporting the MIS framework as the quality of risk information that the Boards and the
top management receive depends largely on the quality and robustness of the information
technology systems.11
In addition to prescribing the risk appetite for the institution, the board also needs to lay down
appropriate risk strategy and ensure that this is institutionalised throughout the organization.
This would entail, aligning risk management processes with the overall business strategy,
clearly defining the roles and responsibilities down the hierarchy, establishing accountability
and reinforcing change with communication and training. The Board and the senior
management oversight must be supplemented with effective leadership by the Chairman and
the chief executive officer (CEO), and informed non-executive directors. The Boards must
get much more intimately involved in risk matters and have a firmer understanding of the key
risks faced by the business.
Effective risk governance also demands that each director is aware of the breadth of risks
faced by the bank. Directors add value to the Board when they have financial expertise, are
aware of risk fundamentals and techniques, and are able to manage dynamics with
executives.
Board level risk committees have an important role to play in the overall risk governance
framework. Apart from monitoring the firm's strategic-risk profile on an on-going basis, such
committees would also be responsible for defining the firm's overall risk appetite; approving
major transactions above a firm's risk threshold, and; establishing limit structures and risk
policies for use within individual businesses.
Presence of a Chief Risk Officer (CRO) is expected to strengthen the risk management
framework. However, independence of the CRO, with necessary stature to influence
decisions, would be a critical element in ensuring the effectiveness of the post in risk
management process as also the strategic risk management related decisions. The CRO
must report directly to the CEO and the Board and be responsible for all risks, risk
management and control functions. Another important requirement is integrating risk with
business strategy and compensation. Risk - and return on risk - need to be core component
of any performance measure, and should be explicitly factored into incentive and
compensation schemes. Compensation must be formally aligned with actual performance,
such as through adding more rigorous risk-based measures to scorecards. This would also
involve moving to longer vesting periods, and increasing deferred compensation.
The fragmented organisation of risk data into separate silos slows down risk management
process and hinders the capability to respond to new regulatory requirements. The financial
crisis has pushed both supervisors and market players to move towards an integrated
approach to risk data that brings down the silos in organisation. Only by integrating data
models, processes and methodologies can a bank achieve higher performance in terms of
data quality.
The risk management systems must take into account technical limitations of risk models,
such as Value at Risk (VaR). Stress testing and scenario analysis need to be established as
truly effective management tools and should be integrated and standardized across business
lines, types of risk and asset classes.
VII. Redesigning of regulations impact
A large scale overhaul of the regulatory framework has been undertaken to plug the gaps in
regulation observed during the crisis and also to make the financial system more resilient.
The new set of regulations, popularly called Basel III, seeks to address both firm specific and
broader systemic risk. The measures relate to enhancing the quality and quantity of capital,
liquidity risk management, valuation practices, dealing with procyclicality issues and with
systemically important banks including enhanced resolution mechanism for systemically
important banking groups. It also covers compensation policy, stress testing, disclosures to
enhance transparency, and reducing systemic risk in the financial markets by encouraging
OTC derivatives to move to central clearing and settlement mechanism, etc.
The new regulations enhance the requirement of equity capital substantially. Compared to
the requirement of a minimum of 2 per cent equity capital as percentage of risk weighted
assets, the new dispensation under Basel III stipulates 7 per cent equity capital, inclusive of
capital conservation buffer of 2.5 per cent. In addition there is a requirement of
countercyclical capital buffers which will be required to be built up under certain conditions as
also of additional capital requirement for Global Systemically Important Financial Institutions
(GSIFIs). Higher equity capital is envisaged to contain risks in the financial system and make
it more resilient. Along with the higher capital requirements, the new regulatory framework
also widened the risk coverage especially those related to capital market activities; trading
book, securitisation products, counterparty credit risk on OTC d