Randall S Kroszner: The importance of fundamentals in risk
management
Speech by Mr Randall S Kroszner, Member of the Board of Governors of the US Federal
Reserve System, at the American Bankers Association Spring Summit Meeting, Washington
DC, 11 March 2008.
The original speech, which contains various links to the documents mentioned, can be found on the US Federal
Reserve System's website.
* * *
It is a pleasure to be addressing the new American Bankers Association, which has arisen
from the successful merger of America's Community Bankers and the ABA. Your association
truly represents the full range of banks in the United States. The focus of my remarks today -
the importance of fundamentals in risk management - should still resonate with all of you,
whether you are part of a large global bank or a smaller community bank. Unfortunately,
recent market events have shown us that banking institutions still face some risk
management challenges, including a need to refocus on some key fundamentals. The good
news, however, is that we also have many examples of sound risk management practices
during the recent disruptions.
Risk management challenges
Getting the fundamentals right - and being ever vigilant about their consistent application
and execution - forms the basis of any sound risk management system. I am not trying to
imply that implementing risk management fundamentals is easy; that is, just because
something is fundamental does not mean that it comes naturally. In fact, there are a number
of risk management challenges inherent in banking that require careful identification and
attention.
One of the most basic risk management challenges relates to concentration of risks. From
the beginnings of banking, bankers always have had to be cautious to guard against, as the
old adage says, "putting all their eggs in one basket." For example, Renaissance bankers
learned the lesson - some of them the hard way - that they did better by lending not just to a
few merchants active in one trade, but to a range of merchants active in a variety of trades.
As risk management techniques grew over the centuries, bankers became more adept at
identifying, measuring, and managing risk concentrations, but that does not mean the original
problem presented by concentrations - that losses could occur all at the same time - has
vanished. Indeed, some bankers occasionally forget that this challenge still exists, usually
with unfavorable consequences.
It is also important to note that concentrations in banking include not just basic lending, but
also holding securities, trading complex instruments, providing liquidity facilities, engaging in
off-balance sheet transactions, and conducting other financial activities. As banks have
extended their range of activities and involvement in new markets, they must be particularly
mindful of potential for concentrations of risk to arise for a number of reasons. First, any new
activity will be less familiar and involve less data and experience for evaluating risk
compared with long-standing activities or markets. Second, risk concentrations can be
hidden during normal times and may only manifest themselves during times of stress when
activities or instruments that might in normal times have little or negative correlation suddenly
become correlated, such as with a market-wide increase in the demand for liquidity as we
have seen recently. In other words, bankers may have far more eggs jostling around in the
same basket, and each of those eggs may be more fragile than originally thought.
Understanding the linkage between risk concentrations and capital is especially important,
since the concentration of risk of a given portfolio markedly affects the amount of capital that
should be held against it. Heavy concentrations can produce so-called fat tails in a loss
distribution, meaning that considerably higher capital levels are required to support the risk
taken. If one underestimates the amount of capital needed to be held against risk
concentrations and/or the extent of the concentrations themselves, then a banker would
realize that the initial level of capital was not sufficient and that remedial actions would need
to be taken. Naturally, both large and small banks can continue to be successful and
profitable by having some lending or other types of concentrations, but they need to be
aware of the risks involved and have the proper risk management and capital to support
those concentrations.
Risk management fundamentals
I would now like to elaborate on three key risk management fundamentals and their
relationship to concentrations of risk in banking: Governance and risk control; risk
identification and measurement; and liquidity risk management. In doing so, I will highlight
some important findings from a report released last week by a group of supervisory agencies
from France, Germany, Switzerland, the United Kingdom and the United States, known as
the Senior Supervisors Group or SSG.1 The report, "Observations on Risk Management
Practices during the Recent Market Turbulence," provides a summary and analysis of a joint
survey and review, initiated last autumn, of risk management practices to understand how
different approaches fared during the recent financial stress. Although the analysis covered a
group of the largest banking and securities firms, the lessons learned actually have
relevance for all financial institutions of all sizes and scope - even those that have thus far
not suffered from recent financial turbulence. I will also discuss a few other examples of
supervisory activities, such as our recent guidance on commercial real estate concentrations,
from which we have learned valuable lessons.
Governance and controls
I will start with perhaps one of the most fundamental aspects of risk management at banking
organizations - in fact, at any organization: governance and controls. The SSG report
highlighted solid senior management oversight and engagement as a key factor that
differentiated performance during recent events. Clearly, senior management must take on a
very active and involved role in risk management. Although this may seem somewhat
obvious, a few recent cases demonstrate, unfortunately, that senior management may not
always exercise proper oversight and may not have been as engaged as would have been
wise. As supervisors, governance and controls is a key feature we look at in assessing risk
management at an institution.
Clearly, senior managers also need to ensure that they have proper understanding of the
risks assumed by their firm, but this does not always happen. For example, we have seen
some evidence that information was kept in silos within firms and not adequately distributed
both vertically and horizontally within certain firms. This segregation prevented senior
managers from developing an enterprise-wide perspective on risks to the whole entity. It
meant that managers were not fully aware of the extent to which the risks of the different
activities undertaken by the firm could, first, become correlated in times of stress and,
second, result in high concentrations of risk exposures. To be quite specific, in particular
cases, senior management was not fully aware of the firm's latent concentrations to U.S.
subprime mortgages, because they did not realize that in addition to the subprime mortgages
on their books, they had exposure through off-balance sheet vehicles holding mortgages,
through claims on counterparties exposed to subprime, and through certain complex
securities. Adequate distribution of information allows for an enterprise-wide perspective on
risk. Information must percolate up to senior management, but top executives must, in turn,
disseminate their views and analysis back down through the business lines.
Effective risk management remains sturdy and durable only if supported by strong and
independent risk functions that produce unbiased information. Empowering independent risk
managers results in clear, dispassionate thinking about the entire firm's risk profile, with no
favoritism toward any business unit. Senior managers should encourage risk managers to
dig deep to uncover not only risks within each business unit, but also risk concentrations that
can arise from the set of activities undertaken by the firm as a whole as well as latent risks -
such as hidden risk concentrations that can arise from correlation of risk in times of stress.
Such risk management assessments should lead risk managers to point out cases in which
certain business lines are assuming too much risk.
In other words, it is good to have a few people within the institution who - to paraphrase a
former Federal Reserve Chairman - know when to take away the punch bowl. Being the
party pooper, however, can be very difficult in any organization, and that is why it is crucial
for the risk manager to be known as an independent voice who is influential with top
management and for top executives, of large or small firms, to set the appropriate "tone at
the top" with respect to the importance of independent and unbiased risk evaluation.
As I discussed in detail at a speech before the Global Association of Risk Professionals a
couple of weeks ago, any successful organization needs to develop appropriate mechanisms
to ensure adherence to, and sustainability of, its risk management.2 Incentive structures are
a key mechanism for this purpose. Appropriate incentives reward good behavior and
penalize inappropriate behavior. Of course, incentives work best when they are known well in
advance, that is, when they serve as ex ante signals of what should and should not be done.
Naturally, in very large organizations it is difficult for senior management to monitor each
individual, so incentives need to be consistent, permeate even the lowest levels of the
organization, and remind each individual that his or her risk-taking affects the whole
enterprise.
Limits and controls can be useful tools for creating the right incentives and sending
appropriate signals, but they of course need to be tailored individually to each firm. Problems
can arise when incentives are not properly structured and appropriate "risk discipline" is not
exercised - for example, when limits and controls are not set or, if they are set, when
adherence to them is not monitored or enforced. Such controls provide incentives for
business-line leaders to assume only the risks that the firm can absorb because they
penalize those who try to take on excessive risk or inadequate mitigation in the name of
maximizing short-term profit. This is just as true at large international firms as it is at
community banks.
Risk identification and measurement
The second fundamental of sound risk management relates to risk identification and
measurement. Timely and accurate information is the lifeblood of sound risk management. A
good risk-management structure must encompass risks across the entire firm, gathering and
processing information on an enterprise-wide basis in real time. In short, you cannot manage
your risks if you do not know what they are.
Aggregating information across a large, diversified financial institution is not easy and should
be done with appropriate care and with adequate resources for checking timeliness and
veracity. The SSG report, for example, noted that some firms could not easily integrate
market and counterparty risk positions across risks types, making it difficult for their
executives to identify concentrations across the entire firm. Aggregating information about
risk exposures and the concentration of risks may not be as challenging at smaller
institutions, but checking the timeliness and veracity of the data is important at institutions of
all sizes. In other words, risk managers should live by the adage "Trust but verify," being
careful not to rely on assessments or data from others without conducting proper due
diligence.
It is also worth noting that financial institutions should gather a wide range of relevant
information before they see market troubles brewing. In other words, scrambling for
information once turbulence sets in is not good practice. Understanding a firm's true risk
exposures requires examining not just risks on the balance sheet, but also off-balance-sheet
risks that are sometimes more difficult to identify and often not so easy to quantify. Latent
risks from certain complex products and certain risky activities should be properly
recognized, because they can manifest themselves when market turbulence sets in.
As the SSG report indicates, some firms had a poor understanding of the risks inherent in
certain complex products or failed to recognize that certain activities contained latent risks
that could be manifest in unexpected concentrations of risk exposures when market
turbulence arose. For example, we witnessed some lapses in credit risk identification and
measurement when, as I noted, certain institutions underestimated the actual credit risk of
subprime mortgages and the secondary or tertiary effects brought on by disruptions in
subprime markets for their broader set of activities.
Stress testing and scenario analysis are of paramount importance, since they can reveal
potential concentrations of risk that may not be apparent from using information gleaned from
normal times. The SSG report emphasizes this point, but the U.S. banking agencies have
also highlighted its importance for smaller- and medium-sized institutions, for example in the
guidance on commercial real estate (CRE) concentrations we issued at the end of 2006.
After on-the-ground supervisors reported seeing increases in CRE concentrations at many
institutions across the country, supervisors examined historical data on risks associated with
CRE concentrations to provide the basis for developing supervisory guidance. That guidance
counseled banking organizations with high CRE exposures relative to capital to engage in
stress testing to evaluate behavior of those exposures and the impact on capital in adverse
circumstances.
Some financial institutions already employ stress tests, but they should re-check their
robustness in light of recent events. For example, banking organizations might benefit from
expanding tests to include a wider set of variables to stress and to consider shocks they
might have considered much less probable one or two years ago. Banks should also
remember that past experience is not always predictive of future events, meaning that they
should be somewhat creative in designing potential shocks. In CRE, for example, banks
should move beyond considering single-name risk and include scenarios involving broader
risks to the CRE sector and how such risk may be correlated in times of stress with other
parts of the portfolio.
In addition, a number of risk-measurement and risk-quantification challenges relate to
valuation practices, particularly with new products. Firms should have greater motivation for
applying proper valuation practices as part of good risk management.3 At the center of these
practices is the ability to make appropriate judgments about the quality of information being
used for valuations. The process usually starts with an initial experimentation phase in which
market participants learn a great deal about the product's expected performance and risk
characteristics, preferably under different market conditions. Conducting due diligence about
new products can be costly and take time, but it is usually worth it. Unfortunately, in some
recent cases new products were developed very quickly and not properly "road-tested." In
observing the valuation challenges, the "Trust but verify" adage has equal application. Market
participants must ensure that they do not make valuation decisions based solely on
excessive reliance of external ratings or evaluations, but that they also undertake their own
assessment. And I would suggest that the value of independent due diligence on the part of
market participants is especially high for newer and more-complex products.
Encouragingly, we have examples of some firms recognizing the potential risks of broad
market disruptions, for example, if there were dramatic and unexpected price movements, or
if market illiquidity set in. Those firms faring better typically use a number of tools to assess
risk positions that draw on differing underlying assumptions. Such tools provide management
with more information and different perspectives on its potential risk exposures. In the best
cases, the tools are flexible enough to allow perspectives on risk to change as business
conditions change. For example, they can help identify when risk concentrations are
changing as a result of market movements or changes in counterparty positions.
Liquidity risk management
Now I wish to consider the third fundamental. Liquidity risk management. Banks, of course,
have been managing expected liquidity demands since the beginning of banking itself.4
Because of its central role in the business of banking, liquidity risk requires rigorous and
effective management. Naturally, financial institutions both large and small must pay careful
attention to liquidity risks, even if they manifest themselves in different ways.
Regarding recent events, a number of financial firms were surprised by the extent of market
disruptions and were forced to take funding actions not anticipated in their contingency
funding plans, including some decisions to support affiliates that were based on reputational
concerns rather than contractual obligations. At the same time, some institutions were able to
avoid more serious problems from these events by aligning treasury functions more closely
with risk-management processes and incorporating information from all businesses into
global liquidity planning, including actual and contingent liquidity risk. They also made
attempts to embed market liquidity premia or apply market liquidity haircuts in pricing models
and valuations.
Recent events have shown that during times of systemwide stress, liquidity shocks can
become correlated so that the same factors that can lead to liquidity problems for the bank's
assets or off-balance sheet vehicles can simultaneously put pressure on banks' own funding
liquidity. Again, we see the trouble that risk concentrations can cause if an institution has not
tried to identify them in advance and take steps to mitigate their effects. As with other risk
areas, supervisors suggest extensive use of firm-wide stress testing to ensure the
incorporation of low-probability but potentially severe liquidity events that may have the
potential to converge. Smaller banks, as well as large, global banks, should conduct liquidity
stress tests to evaluate what could happen to liquidity positions in times of stress.
We have also noticed the potential for liquidity risk to have an impact on capital adequacy.
As you are well aware, several large global banks ended up having to deal with so-called
unplanned asset expansions arising from a variety of liquidity stresses related to the asset
side of the balance sheet. In a few cases, these unexpected increases in the balance sheet
created some pressures on capital ratios, even if the level of capital remained stable.
Although bank liquidity management and capital management may be conceptually distinct,
recent events illustrate in practice how liquidity management and capital management are
intimately related, particularly in times of financial stress. Since risk concentrations have the
potential to manifest themselves during times of stress and at that time adversely affect
capital positions, it is particularly important that firms assess how liquidity events could place
pressure on capital levels. In a nutshell: liquidity problems always have the potential to affect
bank balance sheets and, in doing so, bank capital adequacy.
Conclusion
One of the most basic lessons of banking is that lending concentrations must be carefully
identified, monitored, and managed. As I noted at the outset, the current financial market
turbulence underscores the importance of getting the fundamentals of sound risk
management right and being ever vigilant about their consistent application, execution, and
improvement in light of new data and experiences. I have highlighted the importance of three
fundamentals - governance and risk control; risk identification and measurement; and
liquidity risk management - and the SSG report provides evidence that those institutions
taking care to get these fundamentals right generally performed better during recent events
than other institutions. Concentrations of risk can pose challenges to financial institutions,
and top managers must be aware of their potential and have a risk management system in
place ready to deal with them. This is true not only for large global players but also for
smalland medium-sized banks, as my discussion of the CRE concentration guidance emphasized.
As supervisors, we strive to achieve the appropriate balance, recognizing that supervision
and regulation has costs and benefits that need to be weighed against one another. For
instance, we need to be careful that lending is conducted on a prudent basis, and at the
same time, take care not to stifle the provision of credit when it is done properly.
Before concluding, I would like to mention a topic in supervision and regulation that I have
not yet touched upon in these remarks, namely, credit cards. As you know, the Federal
Reserve has proposed new rules under Regulation Z, which implements the Truth in Lending
Act, regarding open-end credit to require new, more informative, and consumer-tested
disclosures by credit card issuers and expects to propose new rules for credit cards under
the Federal Reserve's unfair and deceptive acts and practices authority. To help us better
assess the current state of the credit card market and possible challenges in credit card
markets for consumers and others involved in those markets, I have invited key credit card
market participants - card issuers and processors, consumer advocates, counseling
agencies, and other regulatory agencies - to participate in a forum hosted by the Federal
Reserve Board on April 8. The forum will allow us to collect additional information about
relevant industry trends and to identify areas that may warrant action or further study.