Specific and rules-based regulations, while able to lead institutions in the right direction, do not guarantee the internalisation of such values within bankers nor are they dynamic enough to catch up with new ways of breaching ethics. Therefore, the Bank will also be expanding its supervisory focus on financial institutions beyond balance sheet ratios, and incorporating organisational culture in our radar such as tone from the top, echo from below, accountability, communication, remuneration and performance management. This is a challenging but necessary task that requires creativity in exploring unconventional supervisory approaches including interviews and questionnaires for employees of financial institutions among others..  Risk management as part of business strategy Finally, risk managers must move away from merely compliance and loss prevention. Risk managers must reposition themselves to be more engaged in strategic business decisions within their respective organisations. Chief Risk Officers (CROs) must have a broad and independent view of the organisation, with an ability to anticipate potential disruptions and to influence decision-making. However, according to a global survey conducted by PwC last year, only 1/3 of risk officers view themselves as part of the business. Especially now in the age of disruption, risk managers should not view themselves as mere compliance officers or the mundane department that says ‘no’ to exciting business opportunities. Instead, risk managers need to also think in terms of finding the right risk-return trade-off. Risk management must go beyond the prevention of losses and play an active role in driving business sustainability and enhancing shareholder value.

Banks with better measures of their economic risks will be able to allocate capital more efficiently and more closely in line with their actual sensitivity to the underlying risks. By doing so, the Basel II framework encourages developments in the management of a wide range of risks on a firm-wide basis and developing a more comprehensive approach to managing those risks together. Second, to achieve those capital benefits, the more advanced approaches to credit and operational risk require banks to meet strong process control requirements. Again, the increasing focus on a bank’s control environment gives greater weight to the management disciplines of measuring, monitoring and controlling risk. As an example, by relying on banks’ own internal credit assessments, the IRB approach builds on the risk management practices that most internationally active banks are already in the process of adopting for their internal purposes. To qualify for the IRB approaches, banks will need to adhere to various specific parameters and standards that may not be fully in place as yet. Our pilot reviews of U.S. bank readiness do indicate that there are a number of areas that both banks and supervisors will need to work on to be ready for full IRB implementation. These include addressing concerns about independence of the rating process, and accumulating necessary internal default and loss data to be able to produce more reliable quantitative estimates. Enhancements in these areas will be important, not just to ensure readiness for IRB, but for further improvement in credit risk management more generally.