Laurence H Meyer: Why risk management is important
for global financial institutions
Speech by Mr Laurence H Meyer, Governor of the Board of Governors of the US Federal Reserve
System, before the Bank of Thailand Symposium, Risk Management of Financial Institutions, held in
Bangkok, on 31 August 2000.
* * *
I am very pleased to have been invited to address this symposium on the timely and important topic of
risk management. Continuing increases in the scale and complexity of financial institutions and in the
pace of their financial transactions demand that they employ sophisticated risk management
techniques and monitor rapidly changing risk exposures. At the same time, fortunately, advances in
information technology have lowered the cost of acquiring, managing and analyzing data, and have
enabled considerable and ongoing advances in risk management at leading institutions worldwide. As
this symposium illustrates, banks in many emerging market countries are also increasing their focus on
risk management in an effort to build more robust and sound financial systems, to remedy weaknesses
that were exposed by recent regional problems, and to position themselves to participate more fully in
the global economy.
Why risk matters
Because taking risk is an integral part of the banking business, it is not surprising that banks have been
practicing risk management ever since there have been banks - the industry could not have survived
without it. The only real change is the degree of sophistication now required to reflect the more
complex and fast-paced environment.
Even today, however, some simple rules continue to be critical to risk management, and I cite Barings
as a negative example. By the simple act of separating front-office from back-office responsibilities,
Barings could well have prevented the enormous losses that led to its failure. In addition, Barings'
management never explored how Nick Leeson could have produced such high returns, even though
the trading he was authorized to undertake was essentially riskless and thus should not have been so
profitable. Had they questioned their "good fortune", Barings' management might have uncovered the
hidden losses before they became large enough to bankrupt the firm. A third lesson from Barings is
that the benefit of risk management is the losses it will prevent, not the additional revenues it will
generate.
The Asian financial crisis of 1997 illustrates that ignoring basic risk management can also contribute
to economy-wide difficulties. The long period of remarkable economic growth and prosperity in Asia
masked weaknesses in risk management at many financial institutions. Many Asian banks did not
assess risk or conduct a cash flow analysis before extending a loan, but rather lent on the basis of their
relationship with the borrower and the availability of collateral - despite the fact that collateral was
often hard to seize in the event of default. The result was that loans - including, I might add, loans by
foreign banks - expanded faster than the ability of the borrowers to repay. Additionally, because many
banks did not have or did not abide by limits on concentrations of lending to individual firms or
business sectors, loans to overextended borrowers were often large relative to bank capital, so that
when economic conditions worsened, these banks were weakened the most.
The Asian crisis also illustrates the potential benefit of more sophisticated risk management practices.
Many Asian banks did not adequately assess their exposures to exchange rate risk. Although some
banks matched their foreign currency liabilities with foreign currency assets, doing so merely
transformed exchange rate risk into credit risk, because their foreign currency borrowers did not have
assured sources of foreign currency revenues. Similarly, foreign banks underestimated country risk in
Asia. In both cases, institutions seemed to have assumed that stability would continue in the region
and failed to consider what might happen if that were not the case. A greater willingness and ability of
banks to subject their exposures to stress testing could have highlighted the risks and emphasized the
importance of key assumptions. Had they conducted stress tests, some lenders might have seen how
exposed they were to changes in exchange rates or to an interruption of steady economic growth.
Although avoiding failure is a principal reason for managing risk, global financial institutions also
have the broader objective of maximizing their risk-adjusted rate of return on capital, or RAROC. This
means not just avoiding excessive risk exposures, but measuring and managing risks relative to returns
and to capital. By focusing on risk-adjusted returns on capital, global institutions avoid putting too
much emphasis on activities and investments that have high expected returns but equally high or
higher risk. This has led to better management decisions and more efficient allocation of capital and
other resources. Indeed, bank shareholders and creditors expect to receive an appropriate risk-adjusted
rate of return, with the result that banks that do not focus on risk-adjusted returns will not be rewarded
by the market.
Risk management is clearly not free. In fact, as I will discuss, it's expensive in both resources and in
institutional disruption. But the cost of delaying or avoiding proper risk management can be extreme:
failure of a bank and possibly failure of a banking system.
A point too often overlooked, however, is that, by focusing on risk-adjusted returns, risk management
also contributes to the strength and efficiency of the economy. It does so by providing a mechanism
that is designed to allocate resources - initially financial resources but ultimately real resources - to
their most efficient use. Projects with the highest risk-adjusted expected profitability are the most
likely to be financed and to succeed. The result is more rapid economic growth. I want to emphasize
that point. The ultimate gain from risk management is higher economic growth. Without sound risk
management, no economy can grow to its potential.
Stability and greater economic growth, in turn, lead to greater private saving, greater retention of that
saving, greater capital imports and more real investment. All this, from sound risk management.
Without it, not only do we lose these gains, but we also incur the considerable costs of bank
disruptions and failures that follow from unexpected, undesired and unmanaged risk-taking.
Making risks matter to owners and managers
One might ask why many Asian banks made the mistake of paying little attention to risk. One answer,
to which I have already alluded, is that the many years of strong economic performance by Asian
economies lulled banks and their supervisors into complacency regarding risk. That is only part of the
answer, however. We have learned that certain prerequisites must exist before bank owners and
managers will pay attention to risk. At least some of these prerequisites were absent in many Asian
countries. One prerequisite is that there be no implicit or explicit government guarantees for bank
owners and managers. Their incentives to manage risk and avoid insolvency will be severely blunted if
insolvent banks are merged with stronger banks or simply allowed to continue operating without
owners losing their stake or managers losing their jobs. Similarly, bank creditors will exert no market
discipline if they run no risk of loss on their claims on banks. Thus, guarantees for bank creditors will
also blunt the incentive of banks to control risk. Market discipline also requires adequate accounting
and disclosure standards, to enable bank investors to judge a bank's condition accurately.
An important complement to market discipline in promoting sound risk management is effective bank
supervision. To be effective, though, bank supervisors must have the ability to assess a bank's
condition, especially the condition of the loan portfolio, and they must have the authority to require
adequate provisions for loan losses. After ensuring that loan loss reserves are adequate, supervisors
must have the authority to close banks that are insolvent, wiping out owners or shareholders and
removing management. Without such authority - and the willingness to use it - a country effectively
has a policy of forbearance, even if officially it does not.
Another prerequisite for risk to matter is that there be no government-directed lending, because
directed lending carries with it an implicit government guarantee. In Korea, for example, during many
years of directed lending to the large chaebols, banks did not develop the skills to assess the risk of
these, their largest borrowers. Even after the end of government direction and the implied guarantee,
banks still did not insist on receiving full financial information from the chaebols. Consequently,
banks could not assess the risk of these loans, even though the risk they faced had become substantial.
Prerequisites for risk management
There are also prerequisites for banks to develop the ability to measure and manage risk effectively.
First, in order to measure risk, the country must have solid accounting and disclosure standards that
provide accurate, relevant, comprehensive and timely information so that banks can assess the
condition and performance of borrowers and counterparties. To ensure accuracy, accounting systems
need to be supplemented by auditing systems and backed up by enforceable legal penalties for
providing fraudulent or misleading information to government agencies and outsiders. Banks also
need reliable information on the credit history of potential borrowers and on macroeconomic and
financial variables that can affect credit and other risks. Additionally, banks need a staff with sufficient
expertise in risk management to identify and evaluate risk.
Implicit in most methods of evaluating credit risk is the assumption that the probability of repayment
depends on the ability of the borrower to repay, in other words, that willingness to repay is not the
issue. If repayment depends on whim, then its probability is difficult if not impossible to assess. Thus,
an adequate legal system and "credit culture", in which borrowers are expected to repay and are
penalized if they do not, are yet further prerequisites for sound and accurate risk management. The
ability to seize the collateral of borrowers in default is essential if banks are to have the incentives and
ability to mitigate risk. Without the legal infrastructure - the laws, courts and impartial judges
necessary to enforce financial contracts in a timely manner, much of risk management would be for
nothing, once the initial decision to extend credit was made.
Finally, the potential for conflicts of interest in risk management must be limited. In particular,
regulations are needed that restrict and require disclosure of connected lending to bank owners,
shareholders or management. Without such regulations, the desire for personal gain may distort the
incentives of bank owners and managers to manage risk appropriately.
Sound practices in risk management
At this juncture, it might be useful if I shared with you developments and practices in one country. Of
course, I am most familiar with my own. Throughout the past decade, the Federal Reserve has devoted
increased attention to understanding the risk management practices of US banks and has redirected its
supervisory efforts to focus on management processes and areas of (perceived) greatest risk. The sheer
complexity, volume and pace of transactions in our largest institutions today demand that we evaluate
their risks by reviewing the structure and effectiveness of their policies, procedures and controls.
While a certain level of "transaction testing" remains important to ensure that internal systems work
and that controls are real, we can no longer take comfort in the safety of large, complex banks by
independently assessing their overall condition at a specific point in time. Given the financial products
on the market today, risk profiles of complex institutions can change too easily and quickly. We need
the assurance that the practices that have kept an institution sound so far are likely to keep it sound in
the foreseeable future.
US bank managers had earlier come to the same conclusion regarding their own abilities to control
individual transactions and positions in their worldwide operations. As a result, they have invested
steadily in developing prudent and understandable policies and in improving methods for measuring
and managing risks, firm-wide. As their institutions and activities grew, they needed a common
measure to compare alternative uses of capital and to evaluate the performance of an expanding range
of business lines. The now familiar concept of RAROC helped greatly to fill that need. They also
required a better process for maintaining quality results, providing management and employees with
proper incentives, and detecting problems at an early stage. Along with their size and complexity, their
demand for stronger and more objective methods of risk management increased. The financial
institutions in the vanguard of risk management have tended to be those most active in international
capital markets and derivative activities, where participants are most informed, transactions are most
efficient and data are most readily available. They were the ones that, most typically, had not only the
expertise and resources to develop sophisticated systems for measuring and evaluating risks, but also
the need to do so, given the complexity of their transactions and products. They needed to identify the
key factors driving market volatility and to quantify the underlying risks in order to manage their
positions and product lines.
For trading activities, the value-at-risk measure was an important breakthrough. It gives banks a
measure of a portfolio's largest expected loss during a particular time period for a given level of
probability. It provided a statistically sound and easily understood basis for managing market risk and,
as you know, also served as the foundation for new regulatory capital requirements for internationally
active banks. At most banks, though, market risk is relatively small. Measuring and controlling credit
risk is typically far more important and, unfortunately, a much more difficult task.
In managing risk, banks must decide which risks to take, which to transfer and which to avoid
altogether. Market risks are easily transferred, often through swaps and other derivative products.
Unless the institution believes it has a comparative advantage in accepting a particular risk, it is
typically sold. During the past decade, the fivefold increase in the notional volume of derivative
transactions, to nearly USD 35 trillion for US banks alone, reflects the demand for risk-mitigating
products in this area. Certain other risks, such as operating risks and the chance of various
idiosyncratic losses, can be reduced through insurance, diversification and internal controls.
Accepting credit risk, though, is fundamentally the business of banking and is the activity which most
banks see as their principal competitive advantage. Typically, financial market participants have far
less information than banks do about the credit quality of individual borrowers, and the terms and
conditions of the borrowing arrangements are often complex and structured case-by-case. Credit card
loans and certain other retail credits are a notable exception.
In recent years, leading banks have devoted increased attention to measuring credit risk and have made
important gains, both by employing innovative and sophisticated risk modeling techniques and also by
strengthening their more traditional practices. For example, a popular vendor model measures default
risk by applying option theory to the market value of a borrower's equity share price and calculates the
probability of a negative net worth. That approach has the important feature of incorporating market
assessments of risk into the analysis and is often used to validate a bank's independent view.
Other models, including most internal models of banks, take a more direct approach to calculating the
fundamental elements of credit risk. They estimate the based on
probability a borrower will default,
numerous measures of its stated financial strength; the bank's exposure given a default, reflecting any
unused commitments of the bank to lend; and the expected loss given default, taking into account any
collateral or other loss-mitigating features of the credit agreement.
Combined, these measures reveal the expected loss, which a bank must know to underwrite and price a
credit correctly, as well as to establish adequate loss reserves. However, it is the volatility of this loss
and the contribution of the credit to the volatility of the bank's cash flow on a firm-wide, portfolio
basis that is crucial to evaluating capital adequacy. As you can imagine, the process of modeling credit
risk is still as much art as science for most banks, requiring many assumptions and subjective
judgments as well as substantial amounts of data. Testing the sensitivity of a model's results to these
decisions and maintaining the integrity of the process from start to finish will be a constant challenge.
Nevertheless, leading institutions around the world have made substantial progress in measuring risk
in recent years, and we expect much more progress in the years ahead as both the regulatory and
banking communities devote more attention and resources to the topic. The continually declining cost
of technology for storing and analyzing data will help greatly to encourage firms to create the
databases necessary to understand credit risk better. This decade may see a watershed for risk
management as institutions make far greater use of information. Indeed, I fully anticipate that the
revised Basel capital accord now under development will link capital requirements more closely to a
bank's own internal evaluation of risk.
For most institutions, though, success in risk management does not require sophisticated models, nor
will models alone suffice. Clearly, all banks must take advantage of new technologies and keep pace
with market innovations to remain competitive and to survive. That need points to ever more
sophisticated risk measurement and management practices. Nevertheless, adhering to the fundamental
principles of risk management and adapting sound practices to one's own situation will remain key. As
I indicated earlier, the experience throughout the world with bank failures and other financial crises
demonstrates time and again that violations of traditional and long-known management principles
produce the largest losses. I gave some examples of this earlier. Technology and financial innovation
facilitate risk management and accommodate more sophisticated risk exposures. Financial models are
tools and the environment around them must still be properly managed and controlled. I cannot
overstate that point. The most sophisticated risk management techniques are useless if the operating
environment and management incentives are deficient or if fundamental risk management principles
are ignored.
Fundamental elements of sound risk management
The fundamental elements of sound risk management are easy to describe in the abstract but are far
more difficult to apply case-by-case. Each situation is unique, built around the roles and capabilities of
individuals and the structure, activities and objectives of the institution. What works for one firm may,
of course, be unsatisfactory for another. Moreover, in the context of a particular firm, the definition of
a sound or adequate risk management system is ever changing, as new technology accommodates
innovation and better information and as market efficiency grows. To remain competitive, institutions
must adapt and constantly improve their process. That fact becomes clearer every day.
Apart from those contingencies, however, certain basics apply quite generally. In any institution,
support for crucial programs must come from the top. Each entity's senior management and governing
board must set the institution's risk appetite by establishing appropriate policies, limits and standards,
and by ensuring that they are followed and enforced. Throughout the institution, risks must then be
measured, monitored and reported to key decision-makers.
While the complexity and formality may vary widely among institutions, each firm should have clear
procedures for assessing risk and evaluating performance over time. There must also be adequate
accountability, clear lines of authority and separation of duties between business functions and those
involved in risk management and internal control. These elements, and others, are time-tested
fundamentals of risk management that do not entail high technology or complex risk measurement
techniques.
Getting there
I very much fear that institutions throughout the world view risk management - often "sophisticated
risk management" - as a Holy Grail, without having a real understanding of its fundamental elements
and how difficult it can be to impose them. This, I believe, is particularly true in developing countries
with traditions or cultures that emphasize relationships more than legally enforceable obligations.
Moreover, even for organizations that operate in a culture - such as the United States - that is more
risk-oriented, risk management techniques can threaten traditional ways and thoughts. Managers who
are already in important decision-making posts and staff who do not yet have the technical skills
necessary for risk management are especially likely to find change disruptive, mechanical and lacking
in the all-important qualities of judgment and experience that they, of course, already have in
considerable abundance. Do not misunderstand me. I am not an opponent of experience and judgment,
and I do believe that building a risk management system that is designed to be automatic is foolhardy.
My point is that change is difficult at any institution or set of institutions. It is even more difficult if
the change is not consistent with the cultural and institutional environment and/or the skills of the
management and staff.
Difficulty with staff expertise is why the first steps for effective risk management probably should be
the least technical and the ones with the best chance for payoff in the short run. I am thinking of
accountability, clear lines of authority and responsibility, and - to avoid conflicts of interest - the
crucial separation of business line management from risk management and internal control. As I noted
earlier, the latter alone could have saved Barings.
The next step, I suggest, is to begin thinking about returns in terms of the risk-return nexus, the
RAROC I noted earlier. Just that simple way of thinking about an investment decision goes a long way
in improving risk management. The best deal - especially for leveraged institutions like banks - is
hardly ever the one with the best rate of return. Rates of return are provided to compensate for risk. If
rates of return are high, it is because they are compensating for a high level of risk. Risk means
variability, and leveraged institutions like banks have little tolerance for loss. That is why banking
institutions must reduce and manage risk exposures, think of yields on a risk-adjusted basis, and
realize that financial leverage can magnify the impact of losses as well as gains.
A critical concern in developing a basic risk management process involves developing or attracting
personnel with the skills necessary to apply risk management tools in meaningful ways. In the 18th
and 19th centuries, bankers used to send their sons to work for competitors in financial centers in order
to learn the latest techniques and then bring them home. Some of that still goes on - although not so
much for relatives any more - with time often spent at the organization's own foreign branch or at a
business school rather than at competitors. Expertise was also transferred in the past by local branches
of foreign banks training local residents. In the 21st century these are all still excellent ways to import
skills in banking in general and risk management in particular. Limiting foreign presence may be the
worst thing for local banks - insulating them from competition and making the import of valuable
human capital and expertise more costly.
Risk management implies significant limits on the ability of highly leveraged financial institutions
such as banks to provide badly needed venture capital; it implies that financial systems need more than
banks. They need non-bank financial institutions that are less leveraged than banks and have much
longer term liabilities. They also need functioning capital markets, including foreign providers of
long-term and equity capital. These other elements may constrain local banks, but they bring
blessings, too. They create instruments and institutions that are stronger, more diversified and easier to
manage during periods of financial stress. They also provide greater stability to financial systems and
alternative funding sources for borrowers.
Summing up
Indeed, this may be a lot to load onto such a seemingly small concept as risk management, but the
concept is not really so small. It is fundamental to sound banking and requires, I am afraid, a
revolution in many of the world's banking systems. Risk exists and banks must accept risk if they are
to thrive and meet an economy's needs. But they must manage the risks and recognize them as real.
Risk matters. Whether or not it is temporarily ignored, it will eventually come out. Recognizing that
fact and dealing with it will benefit lending institutions and the economies in which they operate.
Indeed, given globalization, we must all adopt increasingly sophisticated risk management practices in
the years ahead.