K C Chakrabarty: Banking sector - maintaining resilience to risk and
shock and the role of the accounting profession
Keynote address by Dr K C Chakrabarty, Deputy Governor of the Reserve Bank of India, at
the Institute of Chartered Accountants of India (ICAI) International Conference on
"Accounting Profession: Leveraging Emerging Challenges for Inclusive Growth", Chennai,
7 January 2012.
* * *
Assistance provided by Ms Dimple Bhandia in preparation of this address is gratefully acknowledged.
Shri Amarjit Chopra, past president, ICAI, Shri G. Ramaswamy, present president, ICAI, Shri
Reddy and other council members, distinguished Guests and Delegates, ladies and
gentlemen. It gives me great pleasure to address this august gathering of accounting
professionals from around the world. I must, at the very outset, laud the initiative of The
Institute of Chartered Accountants of India (ICAI) in organising this conference for
accountants to dwell on issues of topical and critical interest relating to the global economy.
The recent global crises have thrown up many lessons, including for the accounting
profession. The years ahead are also very challenging with a disturbed global environment
and all of us, in the central bank and eminent accounting professionals such as those
gathered here, have a critical role to play in guiding the financial sector through these choppy
waters.
The title of the current session "Banking Sector: Resilience to Risk and Shock" is also very
topical. Maintaining resilience to risk and shock is an integral part of bank management and
also bank regulation and supervision. However, the events of the last few years have
underscored like never before the importance of ensuring that the banking sector builds up
its ability to handle the headwinds of adverse events with relative equanimity. Over the years,
many practices have been exposed in financial institutions that point to the importance of risk
management and controls. Efforts have been ongoing, across the globe, to develop a risk
management framework to identify where the key risks lie, and set out how they are to be
managed. But, mishaps continue to surface, clearly indicating that the development of a fool
proof risk management system is still a work in progress and whatever level of sophistication
and advancement we reach, shocks are unavoidable.
The Governor, Reserve Bank of India has recently spoken on the close linkages and sharing
of professional space between the accounting profession and us in the Reserve Bank. At the
Reserve Bank, we depend on the accounting profession for at least two reasons - for the
audit of our own balance sheet and the audit of the balance sheets of commercial banks
which we regulate and supervise1. I will take this opportunity to share my thoughts on the role
that the accounting profession can play in building up the resilience of banks to risks and
shocks, as an integral part of the second aspect of their profession referred earlier.
(I) Risks and shocks
At the outset, let me first say a few words on risks and shocks. Risks are generally
understood to be the uncertainties related to the outcomes (in terms of revenue and profits,
for example). Risks, thus, represent "expected losses". Shocks, on the other hand, refer to
unanticipated adverse events and the impact of such events represents "unexpected losses".
Financial institutions, and, in particular, banks, are supposed to and must build up their
resilience to both expected and unexpected losses.
The regulatory framework for banks provides for such resilience to be built up for both risks
and shocks through a prudential framework. Provisioning requirements are aimed at
providing banks with the necessary buffers to deal with expected losses while capital buffers
provide banks with the wherewithal to cope with unexpected losses. The former requires
robust identification and measurement of risks so as to ensure that expected losses are
estimated with a fair degree of reliability. Building resilience to shocks, on the other hand,
necessitates a complex judgement as to how much capital buffers need to be maintained by
banks to deal with unexpected and potentially catastrophic events. Regulators attempts to
identify a minimum level of capital which each bank must maintain in relation to their risk
weighted assets. The actual level of capital maintained by banks over and above this
minimum is determined by banks depending upon their own estimate of the potential impact
of unexpected losses.
The role of the regulators has also been, to some extent, pedagogic in this connection. They
have been sensitising banks about the importance of risk management systems. They have
been guiding banks in their efforts to put in place a robust risk management system and have
been sharing global best practices in this regard. In the Reserve Bank too, many efforts have
been made to guide the banks in the country to put in place an effective risk management
system. The guidelines on asset-liability management and risk management systems in
banks were first issued in 1999 while Guidance Notes on Management of Credit Risk and
Market Risk were issued in October 2002 and the Guidance Note on Operational Risk
Management in 2005.
The accounting profession, both through its prescription of financial statements and through
its audit in banks, has a critical role to play in ensuring that the banks are proactive in
identifying the passage and path of risks and that the extant provision and capital buffers
make them adequately resilient to risks and shocks as envisaged in the regulatory
guidelines.
(II) Banks and risks
It is perhaps a tautology to state that banking is about risk management. Banks are in the
business of taking risks as risks are inherent in the process of maturity transformation.
Taking of risks is indeed central to the very existence of banking, in fact, of all enterprise
cutting across all segments of the nation, the society and the financial system. As John
Maynard Keynes once remarked "If human nature felt no temptation to take a chance.....
there might not be much investment merely as a result of cold calculation".
In recent years, however, risk management has emerged as a central issue especially for
financial institutions. There is increased focus on the mechanisms for the quantification and
communication of risks on multiple levels - individual risk takers within organizations,
organizational units, the institution as a whole, and more recently, the entire financial system.
Having said this, it would be incorrect to assume that financial institutions, in general, and
banks, in particular, had no risk management earlier. In fact, banks have always had a
framework for risks within an overall asset liability management (ALM) framework. A risk
management framework extends this in the context of modern financial intermediation,
attempting to include a greater "risk orientation" through measuring risks in all asset and
liability classes, including off balance sheet positions; to include all kinds of risks and not just
interest rate based risks; and to arrive at an overall risk adjusted return framework for the
financial entity.
So what has changed now? The recent increased focus on risk management can be traced
to several developments in the financial sector over the last couple of decades. First, the
deregulation of financial markets coupled with increased volatility. Second, the diversification
of activities of banks from the traditional function of lending and borrowing to activities
including, inter alia, custodial services, securities underwriting and corporate advisory. Third,
the emergence of complex global financial institutions coupled with the growing
interconnectedness of the financial system. Fourth, regulators across the world also added to the
process by increasingly requiring banks to maintain capital in accordance with their risks.
Fifth, the increasing role of securities and derivative products along with increasing growth of
complex financial products. As new complex products proliferated in the market place, their
valuation posed challenges as did their illiquidity and opacity. As noted in a 2009 report of an
Oversight Panel of the US congress, "The risks troubled assets continue to pose...depend
on how many troubled assets there are. But no one appears to know for certain.... It is
impossible to ever arrive at an exact dollar amount of troubled assets, but even the
challenges of making a reliable estimate are formidable."
The recent financial crisis provided a further fillip to the importance of risk management
frameworks for banks. It highlighted the fact that adoption of business models without taking
adequate cognizance of risks involved, did matter, especially when the chips are down. It
underscored the importance of pricing risks and the dangers of giving in to the temptation to
under-price risks in a bid to generate maximum profits, especially during the upturn of the
economic cycle. It brought to the centre stage the importance of internal controls, corporate
governance and risk management in ensuring the resilience of financial institutions to risks
and shocks.
The above developments have meant that the risk management challenge for banks has
been steadily growing more complex over the last two to three decades. These
developments have brought forth a fundamental shift in the approach to risk management.
Risk management practices earlier were primarily informal and relatively simple. They were
largely based on intuition and the techniques employed were primitive. Risk management in
recent years has transited to a different animal - one that is complex and necessitates the
use of sophisticated technology. Most importantly, risk management is now information
based relying on advanced statistical techniques.
So what does putting in place an effective risk management framework involve? And what
does it involve in particular for banks? For banks, risk management essentially involves a risk
return trade off - minimising risks for a given return or maximising returns for a given level of
risk. Critically, it requires banks to be able to price risks in a reasonably accurate manner.
The question that then arises is to what extent the risk management framework in banks,
including Indian banks, are oriented to identify risks in a manner which is able to identify the
passage and path of risks and to price such risks appropriately. A report by the Senior
Supervisory Group entitled "Lessons on risk management from the global financial crisis"
(March 2008) identified several weaknesses in the effectiveness of risk identification and
analysis in financial firms. A report of the Institute of International Finance on "Reform in the
financial services industry: strengthening practices for a more stable system" (December
2009) also highlighted substantial gaps in the risk management framework of large
international banks.
My own view is also that the basic tenets of risk management are still to take roots in banking
systems, including in the Indian banking system. While, the best way to measure, manage
and mitigate risks, will differ from bank to bank, there are some basic tenets which risk
management systems in banks need to follow and which we in the Reserve Bank and the
audience here representing the accounting profession can help facilitate. Prudential
guidelines were introduced by the Reserve Bank in 1992 and cover various areas including
provision for Credit Risk, Market Risk and Operational Risk. These guidelines have been
periodically strengthened in line with evolving risk perceptions. Banks have also developed
their risk management systems to meet the requirements of the prudential guidelines. I will
discuss these issues in greater detail shortly.
(III) Banks and shocks
I mentioned at the outset of my address today that shocks refer to the unexpected losses
and that typically capital buffers are maintained to make banks resilient to such unexpected
losses. I will speak on two critical aspects in this regard - the role of regulators and the
importance of stress testing.
Role of regulators
Regulators have played a major role in facilitating the build up of capital buffers by banks to
enable them to face the headwinds arising from unexpected events. The first major joint
international regulatory initiative to put in place a framework for banks to recognise risks and
to provide for risks was in the form of the Basel Capital Accord in 1988. The Basel Accord, as
the prescriptions came to be called, asked banks to identify the credit risk in their activities
and to provide capital to meet obligations and absorb unexpected losses arising from such
risk. The Basel I framework was later extended to cover market risks. In 2004, the first Basel
Accord was replaced by a new Accord, called Basel II, which sought to shift the focus from a
single broad brush risk measure to measures which were more risk sensitive and flexible,
provided more emphasis on banks' internal methodologies, supervisory review and market
discipline and which provided incentives for stronger and more efficient risk management by
banks. In the wake of the crisis, a package of reform measures titled Basel III was
announced. The policy package is aimed at improving both the quantity and quality of the
capital maintained by banks, strengthening liquidity standards and also its risk coverage and
will also facilitate more effective risk management by banks.
Stress testing
Let me now say a few words on the importance of stress testing in building up banks'
resilience to shocks. Stress tests typically assess the resilience of banks to shocks in an
extreme adverse scenario as compared to a baseline scenario. It also provide banks'
management with a tool to improve their internal risk managements by identifying the stress
points in their operations. The relevance of stress tests for assessing banks' resilience to
shocks lies in the fact that these tests focus on the unexpected or "tail" events going beyond
typical risk management assessments which focus on events within the "three sigma"
doubled interval.
The importance of stress testing as part of banks overall risk management framework has
been recognised under Basel II. In the wake of waning investor confidence and concerns
about the health of the banking sector, the Federal Reserve Bank and the European Banking
Authority conducted a series of stress tests to assess the resilience of the banking system as
a whole, and the capacity of individual banks to absorb potential shocks. The Dodd Frank Act
goes a step further and requires that policy makers in the US conduct annual stress tests of,
inter alia, large bank holding companies and publish a summary of the results of the stress
tests. The Act, in fact, mandates both supervisory stress tests (regulators specify the adverse
scenario and determine the resulting loss estimates on a standardized basis drawing on
information submitted by each firm) and bank-run stress tests (regulators specify the
scenario but require each bank to model the stress event itself).
In India, too, the importance of stress testing was realised well ahead of the recent global
crisis. Stress testing guidelines were issued by the Reserve Bank to banks in 2006. Of late,
the Reserve Bank has been conducting a series of top down and bottoms up stress testing to
assess the resilience of the banking system to a series of shocks in specific risk factors and
to deterioration in the overall macrofinancial environment. Various other techniques to
assess the resilience of banks to simulated distressed conditions in the banking sector and in
the larger financial sector through tools such as network analysis and modelling of the
distress dependencies between banks are also being deployed for the purpose.
Going forward, it would be critical that the stress testing results be incorporated in the
business and capital assessment and planning exercise of banks. The overall acceptable
levels of expected and unexpected loss willing to be incurred by banks should be a
management decision driven based on rigorous and analytical assessment of available
information. While it is not expected that banks provide for unexpected losses in the manner
prescribed for expected losses, the "economic capital" which the bank seeks to maintain
must be driven by considerations which encompass such losses.
(IV) Role of banks' management in building up resilience to risks and shocks
As the regulatory architecture has evolved over a little over the last couple of decades, it has
been accompanied by an increasing emphasis on internal controls and methodologies for
building up the banks' resilience to risks and shocks. First line of defence for risk
management has to come from bank managements and specially from bank boards.
Assessment and planning of capital adequacy by banks is key to ensuring that banks remain
resilient to risks and shocks. For the management of losses arising from realisation of risks
or emergence of shocks, there is no substitute for senior management and the Board asking
the right questions. Unless the bank's management is geared to internalize and
institutionalize a risk and control culture in banks, any attempts to increase the resilience of
banks can be effective only to a limited extent.
If management has to pose the right questions, it is critical that information systems in banks
are geared to respond to these questions. Banks today will be hard pressed to respond to
questions about the risk return characteristics of different activities, for example. Unless
information systems are developed to answer such questions, effective decision making,
which takes into account associated risks, will remain a casualty. I recollect in this context, a
comment made by Governor Alan Greenspan who stated that: "It has been my experience
that competency in mathematics, both in numerical manipulations and in understanding its
conceptual foundations, enhances a person's ability to handle the more ambiguous and
qualitative relationships that dominate our day-today financial decision making"2. Given that
financial decision making is becoming complex, it is up to us to design information systems
which facilitate such decision making. In the context of putting in place a risk management
framework in particular, there is a need to ensure that information systems in banks are able
to provide "information on "returns" at activity level and segmental reporting in a granular
manner"3.
Finally, management has to play a critical role to get the balance between the business units
and risk management right if banks have to develop adequate resilience. Experience has
shown, time and again, that, in good times particularly when there is a tendency for
misaligned incentives to emerge, there is a tendency to listen more to the business side.
(V) Role of the accounting profession
Let me now spend a few minutes dwelling on the role which the accounting profession plays
and can potentially play in ensuring the banks remain resilient to risks and shocks.
Role of accounting statements
Modern accounting as we know today owes its origin to a Venetian monk Luca Pacioli, who
till today, holds the distinction of being called the "Father of Accounting". In the year 1494,
Pacioli published his famous book "Summa de arithmetica, geometria, proportioni et
proportionalita" ("The Collected Knowledge of Arithmetic, Geometry, Proportion and
Proportionality"). One section in the book, "Particularis de Computis et Scripturis", was a
treatise on accounting that, for the first time, described double-entry accounting, also known
as the Venetian method.
The development of the accounting profession as we know it today owes its origin to the
emergence of the joint stock company which resulted in the separation of ownership from
management necessitating the need for an independent and informed opinion on how the
funds entrusted to the management were being used / accounted for. In India, the origin of
the profession can be traced to the enactment of the Companies Act in 1857. The profession
has since come a long way and its opinions and assessment of the accounts of companies
serve to provide assurance to a wide base of stakeholders - share holders, lenders,
investors, the banking system, regulators, the government and society itself.
What is, however, clear is that neither the origin of accounting nor that of the accounting
profession had their "raison d'etre" in risk management. Notwithstanding, considerable
reliance has been placed on accounting statements for assessing the risk management
framework of financial firms. A BIS working paper4 succinctly states the purpose of
accounting statements: "First, information about any firm - be it a financial or non-financial
firm - should concern three characteristics, namely: estimates of its current financial
condition and profitability; estimates of its risk profile; and a measure of the uncertainty
surrounding those two types of estimate".
While the accounting statements undoubtedly present estimates of the current financial
conditions, the extent to which they have been successful in estimating the risk profile of
firms is open for debate. Referring to the words of Harvard professor Eddie Riedl to his MBA
class that "Accounting= Economic truth + Measurement error + Bias", Satyajit Das, in his
recent book "Extreme Money", in fact, comments that accounting is now mainly
"measurement error" and "bias" - a remarkable progress!
The recent global financial crisis also revealed several weaknesses in accounting
statements, indeed in the accounting standards based on which the statements are
prepared. Accounting practices, or at least some of them, were criticised for either
contributing to, or at least, exacerbating the severity of the crisis. The issues identified
included the failure of accounting standards to deal with illiquid markets and distressed sales,
delayed recognition of losses associated with loans, structured credit products, off-balance
sheet financing structures, permitting certain structured/ special purpose entities and
exposure to remain off-balance sheet, lack of "visibility" in accounting statements, to name
just a few. The manner of preparation of accounting statements shared at least some of the
blame in aggravating pro-cyclicality and causing volatility in financial statements, all of which
added to systemic risks. In any case, the extraordinary complexity of accounting standards
especially those related to financial instruments came under severe criticism in the wake of
the crisis.
Consequent to the identification of these issues, the Basel Committee issued a set of
"Guiding principles for the replacement of IAS 39" which, inter alia, reflect the lessons
learned from the financial crisis and emphasize the need for earlier recognition of loan losses
to ensure robust provisions; recognise that fair value is not effective when markets become
dislocated or are illiquid; permit reclassifications from the fair value to the amortised cost
category; which should be allowed only in rare circumstances following the occurrence of
events having clearly led to a change in the business model; promote a level playing field
across jurisdictions.
Some critical accounting standards have been/are being amended to take cognisance of the
lessons of the crisis and will contribute significantly to ensuring that the capital and provisions
held by the bank are better aligned to the risks in the banks' balance sheet. The estimation of
both expected and unexpected losses is an inexact science. The attempts to better estimate,
provide for them and to present an assessment of the adequacy of buffers, therefore,
remains a continuing one.
Role of audit
Let me now turn to the role of audit in ensuring the efficacy of risk management and capital
adequacy systems in banks. Put in an extremely narrow perspective, auditors ensure that the
audited entity is adhering to the prevailing accounting standards pretty much like supervisors
are tasked with ensuring that banks are following the prescribed regulatory framework. But
expectations from supervisors and auditors - from society, from the financial system and
from ourselves - goes beyond this narrow perspective.
In the context of the current discussion, both supervisors and auditors have a vested interest
in ensuring that banks are resilient both to "known" risks and to "unknown" shocks. In
particular, both supervisors and auditors are keen to ensure that banks put in place an
effective system of risk management which ensures that risks are identified, measured,
managed and correctly priced.
It is important in this connection that the auditors ask probing questions about the adequacy
of banks' provisions and capital. This is not to suggest that auditors currently are not
focussing on these aspects at the moment. Gaps, however, remain as suggested by the
findings of the Annual Financial Inspection of banks by the Reserve Bank. There remains
thus scope for more rigorous attention to the issues of adequacy of capital and provisions by
auditors.
Going forward
Accounting standards and accounting statements were not geared to take into account the
compulsions of the risk-return trade off. To some degree, the post crisis reforms to
accounting standards are addressing this. Going forward, however, it will be critical that
accounting statements assess and present the gamut of issues related to the level of
provisions and capital maintained by banks and their adequacy in ensuring the resilience of
banks to risks and shocks.
The role of auditors will also remain key as they gear themselves to play a more effective
role as part of the control systems of banks. For the purpose, auditors need a deeper
understanding of the bank's business. Their review must transcend the ordinary to enable
them to critically analyse the operations of the banks they audit and recommend
improvements to the internal control framework. The ever increasing complexity of products
and operations, the parallel development of regulations such as the Basel Accords and the
impending migration to the International Financial Reporting Standards (IFRS) add to these
challenges and place intense demands on the technical resources and authority of auditors.
To gear up to these challenges, auditors need to take into account a system wide
understanding of markets, products and their inter connectedness, especially in times of
stress. Auditors will need to move beyond narrow transaction audit considerations to look at
the larger picture. They will need to ask pointed and relevant questions. Do decisions in the
bank take adequate cognisance of risk considerations? Is the focus on returns or income
adequate given that higher returns can only be possible with higher risks? Do banks
adequately understand the risk reward characteristics of product/market/business they are
entering into?
Against this backdrop, the recent comments of the Governor, Reserve Bank, on the need for
auditors to concentrate on the audit of head office of banks as against audit of branches
given the emergence of core banking, centralised record keeping and even centralised risk
management, are very relevant.
Concluding remarks
The recent global financial crisis underscored the fact that risks and shocks are unavoidable.
Taking risks is an inevitable part of the business of banks. Management of risks is thus, key,
to banks, but risk management practices in banks remain misaligned from some of the basic
tenets of the risk-return trade off. It is, therefore, incumbent upon us, as central banks and
the accounting profession, to ensure that these risks are managed and banks develop an
acceptable degree of resilience to risks and shocks.
In many respects the concerns of banking supervisors and auditors are complementary. The
crisis has proved that we have to learn to be more proactive and more intrusive. As the world
around us becomes more complex, we will need to gear ourselves up to the challenges.
Critical in this context will be building up of skills and expertise and continuing research and
education in these areas.
Accountants, in particular, have to move beyond the narrow considerations of accounting
standards and continuously seek answers. This is not to suggest that they should not work
within the accepted conceptual framework for risk management but that they should be
proactive to emerging risks within the parameters of the framework. Let me conclude with the
words of Sir David Tweedie5, recently retired Chairman of the International Accounting
Standard Board,
"I do believe the accountant is an artist, but he has to portray his subject faithfully.
I don't believe the accounting profession's ...........judgement should be replaced
by a search engine and most questions are answered by the standard-setter or
relevant accounting authorities. I don't, on the other hand, believe the painting
can be a personal creation. The world has moved on. The picture to be painted is
no longer a personal conception about business. How the success or failure of a
business should be measured is now determined by standards defining more
precisely a conceptual framework agreed by the global financial community".
All these notwithstanding, the mainstay of accounting profession or, for that matter,
"supervision" lies always on the concept of, as former President of USA, Ronald Reagan
believed, "Trust....but verify". To what extent should we trust and what extent we verify is a
matter of judgement. I am sure the deliberations at this conference have given some clue to
arrive at a better judgement. Thank you ladies and gentlemen for a patient hearing.