Kevin Stiroh: Reform of culture in finance from multiple
perspectives
Remarks by Mr Kevin Stiroh, Executive Vice President of the Financial Institution Supervision
Group of the Federal Reserve Bank of New York, at the GARP Risk Convention, New York City,
26 February 2019.
* * *
As prepared for delivery
Introduction
I would like to begin by thanking the Global Association of Risk Professionals for the opportunity
1
to speak at this Risk Convention. As a bank supervisor, I am obviously very interested in the
topics of risk management and risk measurement. An important part of my job is to interact with
the financial industry to better understand the issues you face and how we can work
collaboratively toward our shared objective of promoting sustainable financial intermediation and
a safe, sound, and stable banking and financial system.
As risk professionals, you are all steeped in the intricacies of risk management and risk
measurement. Value-at-risk, the three-lines-of-defense model, and controls and testing
frameworks are second nature. This is particularly true when we talk about the most familiar and
well-studied financial risks such as credit, market, and liquidity risk, and even non-financial risks
such as operational, compliance, and legal risk.
We all acknowledge the critical importance of these issues, but today I will talk about misconduct
risk and the need to develop a healthy corporate culture to mitigate it. I'll focus on the importance
of addressing these issues from multiple perspectives including those of boards of directors,
senior management, industry groups, and the official sector. This topic might be less familiar to
some-the terms are newer and the assessment frameworks are less developed-but I believe
it is critically important. Both the official sector and many of your firms have put considerable
emphasis on improving corporate cultures and reducing misconduct risk, but we continue to see
striking cases of misconduct both in the U.S. and abroad. Clearly, more needs to be done.
Many of the insights I will share today are drawn from interactions with industry participants and
members of the official sector through outreach and industry conferences and workshops on the
2
topic, including events hosted by the Federal Reserve Bank of New York. I am confident that
continued commitment and collaboration will contribute to better outcomes in this vital area.
Before proceeding, I'll emphasize that I am speaking for myself and not the Federal Reserve
Bank of New York or the Federal Reserve System.
Influencing Culture from Multiple Perspectives
Prudent risk management is a fundamental aspect of the business of banking, which means it is
a critical factor in the effective oversight of banks. Supervisors focus on financial resilience by
requiring firms to maintain sufficient capital and liquidity and emphasize operational resilience by
3
promoting effective corporate governance, risk management, and recovery planning. In my
view, misconduct risk-defined as the potential for behaviors or business practices that are
illegal, unethical, or contrary to a firm's stated beliefs, values, policies, and procedures-is an
integral part of an effective risk management framework. Bad conduct threatens a firm's
resiliency by diverting management attention, harming a firm's reputation, depleting a firm's
4
capital, and affecting the composition of its workforce.
To further develop this idea, the team working on this at the New York Fed introduced the
concept of a firm's "cultural capital," which is a type of intangible asset that impacts what a firm
produces and how it operates. It is analogous to physical capital, like equipment, buildings and
property, or to human capital, like the accumulated knowledge and skills of workers, or to
reputational capital, like the franchise value or brand recognition. This is an intangible asset, so
we generally feel the impact rather than see the thing itself. Nonetheless, I believe a firm's
cultural capital can be measured, assessed, and ultimately impacted in ways that can improve
outcomes and enhance a firm's resiliency.
In a firm with a high level of cultural capital, for example, misconduct risk is low and observed
structures, processes, formal incentives, and desired business outcomes are consistent with
the firm's stated values and risk appetite. Unspoken patterns of behavior reinforce this
alignment. Problems are escalated to senior managers routinely, as employees feel empowered
to raise their hands and believe that their efforts will result in meaningful responses. And senior
leaders advance through the organization because, in addition to strong business performance,
they set a credible tone from above by modeling behaviors consistent with the firm's values.
By contrast, in firms with low levels of cultural capital, formal policies and procedures do not
reflect "the way things are really done." Misconduct results from the norms and pressures that
drive individuals to make decisions that are not aligned with the values, business strategies, and
risk appetite set by the board and senior leaders. Employees do not speak freely when they have
concerns, and directors and senior managers do not find out about improper conduct until it is
uncovered by the authorities. Rules may be followed to the letter, but not in spirit. All of this
increases misconduct risk and potentially damages the firm and the industry over time.
To be clear, I am not saying this is easy. Culture is difficult to assess because it is not a single,
point-in-time metric, but a multi-dimensional concept with different implications for different parts
of an organization. This complexity suggests that no single metric, solution, approach, or
5
template will work for every firm in every circumstance.
Consider the different roles of key players in mitigating misconduct risk and building and
sustaining a healthy culture. The board of directors, senior management, staff, investors,
industry groups, and the official sector might all see and assess aspects of a firm's culture
differently. Today, I will focus on a few of these stakeholders.
Boards of Directors
In 2017, the New York Fed hosted a culture measurement workshop that included a panel of
board members from various financial firms. There was consensus among the panelists that
board members play a critical role in a firm's governance structure and culture. Moreover,
corporate boards independently assess whether management is setting the right tone and hold
management accountable for any gaps between a firm's values and its actual business
practices. Proposed guidance from the Federal Reserve suggests that the responsibilities of an
effective board of directors include setting strategy and risk tolerance, supporting independent
risk management, managing information flows, ensuring appropriate expertise, and holding
6
senior management accountable for effective execution.
Behavioral indicators can help boards understand their firms' cultures and identify potential
trouble spots within the organization. Corporate boards use various methods to obtain
information and assess culture, such as meeting with many levels of employees, receiving
thirdparty assessments, and conducting 360 reviews of the CEO and top leaders. Organizations like
the U.K. Banking Standards Board (BSB) can provide outside benchmarking data against which
7
to measure the culture within one's own firm. Corporate boards for financial firms may also
import practices and lessons from other industries. Finally, the board members that participated
in the New York Fed's workshop agreed that a board's own culture matters; it needs independent
voices, diverse perspectives, and opportunity for debate.
Senior Management
The Federal Reserve published a proposal on corporate governance that states that senior
management is responsible for the execution of strategy and day-to-day operations consistent
with the firm's stated risk appetite, ensuring safety and soundness, overseeing business lines
and risk management, and ensuring compliance with internal policy, procedures, regulations and
8
laws. Development of a firm's cultural capital links directly to these core responsibilities and is
evidenced by behavior throughout the firm.
To address these concerns and build cultural capital, some firms have established culture and
conduct committees or groups that meet regularly to review cultural indicators and assessment
efforts. Providing these groups with sufficient stature, developing the proper infrastructure to
support them, and defining clear roles and responsibilities are essential for success. It is critical
that there is alignment between the board, senior management, and middle and lower
management on issues of conduct and culture, as employees take cues from their direct
managers even more than the tone from the top.
The performance management framework established by senior management sets powerful
9
incentives to influence conduct and culture within a firm. Financial incentives, however, are not
the only drivers of culture and conduct. Employees alter their behavior based on a variety of
formal and informal, intrinsic and extrinsic motivations. Intrinsic motivations could include growth
opportunities, independence, power, and social factors, while extrinsic motivations could include
10
pay, benefits, profit sharing, or other forms of awards. With this range of motivating factors
and the impact they have on the culture in mind, a number of firms have integrated "how" factors
into an employee's performance evaluations by assessing the methods used to achieve a
performance goal alongside the "what" components such as contributing to their group's financial
performance.
Industry Benchmarking
Another perspective is from the industry as a whole. I think we can gain important insights by
looking across the financial industry, identifying best practices, and understanding what
approaches are most effective in positively influencing conduct and culture. Conferences and
workshops like those hosted regularly by the New York Fed and others can help. In addition,
standardized metrics and indicators can provide insights when assessing changes over time
and across firms.
The BSB, for example, provides one lens on assessing culture change for a broad cross-section
11
of financial services firms operating in the U.K. Each firm participating in the survey has the
ability to see its outcomes relative to others and the industry average. This type of industry-wide
assessment gives firms insight into areas they can individually focus on, as well as areas they
may want to address as an industry.
The U.K. is not alone in this approach. In December 2017, the chief executives of the five main
retail banks in Ireland informed the Department of Finance of their intention to establish an Irish
12
Banking Standards Board.
In the U.S., the idea of industry benchmarking has been raised and discussed in the past, but no
industry action has emerged to move this idea forward. At the New York Fed's workshop on
culture measurement and assessment, several participants recommended either joining the
13
BSB's benchmarking survey or creating a similar U.S. organization. Some noted that it would
be helpful to include non-banks in the effort, and to collaborate with other corporations that have
experience building strong cultures. Participants also discussed the importance of sharing
"lessons learned" and developing best practices as an industry. In my view, these types of
industry-led initiatives can offer useful insights as firms compare and contrast their efforts and
outcomes with peers.
Official Sector
A final perspective is that of the official sector. In my view, there is a clear role that follows the
traditional focus on prudent risk management and the goal of building resilience. This reflects
both the direct impact to firms mentioned above and the potential for industry-wide spillover if
conduct and performance issues at one firm cause customers, counterparties, and investors to
lose trust in the industry as a whole. This type of spillover suggests a role for the official sector to
coordinate efforts and push the industry forward.
To be clear, it is not the role of the official sector to set the internal culture of a firm-that
responsibility lies squarely with the board of directors and senior management. Rather, the job of
the official sector is to promote standards and practices that will mitigate misconduct risk and
promote efficient and sustained financial intermediation and financial stability.
Global supervisors have taken a number of approaches when it comes to understanding,
influencing, and assessing culture at firms. In the whitepaper I mentioned earlier, my New York
Fed colleagues and I included a section describing a selection of approaches that the official
sector has employed. The Financial Stability Board Working Group on Governance Frameworks
(FSB WGGF) has published a range of tools for supervisors to use in assessing firms'
management of cultural drivers of misconduct, as well as a summary of supervisory approaches
14
and practices in supervising for culture. This variation reflects differences in mandates, tools,
and authority. Looking across jurisdictions, we see supervisory efforts such as specialized units
of behavioral experts, risk culture assessment frameworks, and supervisory guidance that
directs supervised institutions to develop and promote a sound corporate culture.
This variation in approach is a valuable feature of the official sector focus on conduct and culture
reform. As the official sector innovates, experiments, and introduces new approaches, we'll
develop a better understanding of how to best promote a healthy culture and mitigate misconduct
risk.
Measurement and Assessment
I'll now turn to the question of measurement and assessment. As all risk managers know, you
can't manage what you can't measure. This is equally true in the area of misconduct risk. At the
same time, while hard data is important, I don't believe it is sufficient to convey all of the
complexities of a firm's culture or all of the ways it can impact business outcomes.
In recent years, we have seen firms develop dashboards that seek to bring together various
metrics from across their organization. This is an important and necessary step. Data sources
that we've seen include internal quantitative information such as compliance and policy
violations, completed trainings, audit results, and risk metrics like limit breaches, policy violations
and external metrics like customer complaints, stakeholder perceptions, and client surveys.
There also are qualitative data based on employee surveys. Some firms have begun to do more
frequent pulse surveys with small cohorts of staff. Other firms have found that long-term trends
are more insightful than short term changes.
These types of data, while necessary, are not sufficient to make progress. Supplementing hard
data with interviews, focus groups, dialogue, and external benchmarking can greatly enhance an
organization's ability to manage and strengthen its culture. Measurement and metrics are best
used as a starting point to spur further analysis and probing as boards and senior management
seek to identify trouble spots and build strong cultures.
As we continue to see the impact of technology and big data in other parts of financial services,
one interesting question is how innovation and enhanced technology will support the
measurement and management of culture. The potential of big data analytics to revolutionize
approaches in many areas of business has been talked about for years, and is now beginning to
become a reality. For example, we might see firms routinely leverage broader data to make
stronger predictions about potential misconduct risk, which could be useful to help focus scarce
compliance resources.
Some may view the official sector as an impediment to the adoption of new technologies, but I
don't think that needs to be the case. In the context of compliance risk management in the U.S.,
the five federal banking agencies recently encouraged financial firms to explore innovative
approaches to meet their compliance obligations related to money laundering and further
15
strengthen the industry against illicit activity.
Similarly, in the U.K., Rob Gruppetta, head of the Financial Crime Department at the Financial
Conduct Authority, has spoken about the "balancing act" the FCA faces as a regulator trying to
encourage progress and innovation while also mitigating danger and imprudent risk-taking. He
points out that data from new technologies has also allowed the FCA to be more consistent,
16
effective, and risk-based in its supervisory approach toward conduct risk. This leads to a
question about how firms can use similar tools and techniques to mitigate misconduct risk and
promote healthy cultures.
As with any innovation and application of new technology, critical questions are emerging. For
example, reliance on complex algorithms or machine learning tools raises issues around
"explainability" and a clear audit trail. Lawyers will inevitably opine on a variety of issues,
including data protection and privacy. Beyond strictly legal issues, firms will have to wrestle with
questions about fundamental fairness and the consequences that techniques perceived as
unduly intrusive and untrusting may have on employee morale and industry retention. As new
technologies spread and their use grows in areas related to compliance and internal
assessments, we will need to confront these issues.
Conclusions
To conclude, the culture of a financial firm, and of the industry as a whole, is a complex
phenomenon that is not easy to measure or manage. Collectively, however, we must not ignore
this issue.
Looking ahead, members of the financial industry with different roles and perspectives can each
take practical steps to move this dialogue forward. Financial firms should continue to develop
and implement programs to build cultural capital, with directors, senior management, and staff
each having distinct responsibilities and perspectives. Supervisors around the globe should
remain committed to staying up-to-date on industry advances while continuing to develop and
implement innovative supervisory approaches. We should continue to collaborate with the
industry, the academic community, and other parts of the official sector. We should continue to
monitor progress on industry benchmarking as more jurisdictions take up these efforts. And,
perhaps most importantly, we should continue to engage in discussions like this one, so we work
together to identify lessons learned and best practices as we pursue our common goals of a
safe, sound, and stable banking system.
I think we should be optimistic that with the right tools and technology, the right level of
commitment, and the right people at the table, we can build cultural capital and mitigate
misconduct risk. We all have a role to play in mobilizing our organizations to advance this critical
work.
Thank you for your attention.
I would like to thank Stephanie Chaly, Robert Fitchette, Jim Hennessy, and Jackie McCormack for help preparing
these remarks.
2
Federal Reserve Bank of New York, Reforming Culture and Behavior in the Financial Services Industry:
Progress, Challenges, and the Next Generation of Leaders, June 18, 2018 and Workshop on Culture
Measurement and Assessment, June 21, 2017.
3
See SR 16-11: Supervisory Guidance for Assessing Risk Management at Supervised Institutions with Total
Consolidated Assets Less than $50 Billion, June 8, 2016 and SR 12-17 / CA 12-14: Consolidated Supervision
Framework for Large Financial Institutions, December 17, 2012 for details for small and large banks,
respectively. Board of Governors of the Federal Reserve System, Federal Reserve Board requests comment on
proposed guidance that would clarify Board's supervisory expectations related to risk management for large
financial institutions, January 4, 2018.
4
Stephanie Chaly, James Hennessy, Lev Menand, Kevin Stiroh, and Joseph Tracy, Misconduct Risk, Culture, and
Supervision, Federal Reserve Bank of New York, December 2017.
5
Stiroh, Kevin J., The Complexity of Culture Reform in Finance, October 4, 2018.
6
Board of Governors of the Federal Reserve System, Federal Reserve Board invites public comment on two
proposals; corporate governance and rating system for large financial institutions, August 3, 2017.
7
See Banking Standards Board.
8
Board of Governors of the Federal Reserve System, Federal Reserve Board requests comment on proposed
guidance that would clarify Board's supervisory expectations related to risk management for large financial
institutions, January 4, 2018.
9
Dudley, William C., Strengthening Culture for the Long-Term, June 18, 2018.
10
Lois V. Brown, Psychology of Motivation, 2007. Coon D, Mitterer JO. Introduction to Psychology: Gateways to
Mind and Behavior With Concept Maps. Belmont, CA: Wadsworth; 2010. Oudeyer, P. and Kaplan, F. What is
Intrinsic Motivation? A Typology of Computational Approaches. Front Neurorobotics, 2007.
11
See Banking Standards Board, Annual Review 2017/2018.
12
Department of Finance, Minister Donohoe Welcomes Banking Initiative That Aims to Rebuild Trust in the
Industry, December 31, 2017.
13
Federal Reserve Bank of New York, Workshop on Culture Measurement and Assessment, June 21, 2017.
14
Financial Stability Board, Strengthening Governance Frameworks to Mitigate Misconduct Risk: A Toolkit for Firms
and Supervisors, April 20, 2018.
15
Federal Reserve Board, Federal Reserve Board issues joint statement encouraging depository institutions to
explore innovative approaches to meet BSA/anti-money laundering compliance obligations and to further
strengthen the financial system against illicit financial activity, December 3, 2018.
16
Rob Gruppetta, AI and Financial Crime: Silver Bullet or Red Herring?, November 11, 2018.