” in its broadest sense as it relates to these risk measurement and management processes is essential to the effectiveness of these processes. finally, i want to raise some issues around accounting and disclosure of risk. if there is a single theme to my remarks today, it is simply this : keep improving, refining, and innovating in risk management. although basel ii is a remarkable achievement, and the subject of this conference, don ’ t let your best practices be limited by what basel ii does or requires. indeed, one of the more desirable aspects of basel ii is that it anticipates that it can evolve with best industry practices without creating a new framework. the designers have not intended to build a straitjacket, and the policymakers have insisted on this characteristic, which my colleague vice chairman ferguson has referred to as basel ii ’ s “ evergreen ” aspect. enterprise - wide risk management within financial institutions, the better and greater focus on risk measurement has helped to bridge the gap between the perspective of the traditional credit risk officer and that of the “ quant. ” this is no small accomplishment, and a significant advance in credit culture. if you will pardon my use of stereotypes, historically the credit risk officer has been the fellow who always says “ no ” because it is the conservative thing to do, while the financial modeller has been the proponent of active - trading strategies that fulfil the promise of a data - mined efficient frontier that has been estimated to several decimal places of precision. the logic of risk and return in a competitive marketplace, as measured by return on economic capital that is founded in empirical analysis, has provided both sides with a common language and set of standards. it is not unusual anymore to hear chief credit officers describe their appetite for risk in terms of risk - adjusted return on capital ( raroc ) or monitor current spreads on credit default swaps to look for market signals on borrower credit quality. with better credit cultures and improved tools, institutions can also measure and evaluate more objectively the results of their business strategies and use that information to enhance future performance. they can decide how much risk to take, rather than letting their risk profile be the consequence of other decisions. the evolution of interest rate risk management in the united states is a great illustration of how an enterprise - wide approach can help institutions customize products that better serve customers, set prices to reflect risk exposures and attain profit targets, and ensure that corporate earnings contributions are met. thirty years ago, bankers

. as you know, once an organization gets lax in its approach to corporate governance, problems tend to follow. we have some experience in that regard. some of you may recall the time and attention that management of us banks devoted to section 112 of the federal deposit insurance corporation improvement act, which first required bank management reports on internal controls and auditor attestations in the early 1990s. then the process became routine, delegated to lower levels of management and unresponsive to changes in the way the business was being run. unfortunately, for organizations with weak governance, trying to change the culture again to meet sarbanes - oxley requirements is taking an exceptional amount of senior management and directors ’ time - time taken away from building the business. the challenge, therefore, is not only to achieve the proper control environment at one point in time, but also to maintain that discipline and, indeed, ensure that corporate governance keeps pace with the changing risks that you will face in the coming years. one weakness we have seen is the delegation by management of both the development and the assessment of the internal - control structure to the same risk - management, internal - control, or compliance group. it is important to emphasize that line management has the responsibility for identifying risks and ensuring that the mitigating controls are effective - and to leave the assessments to a group that is independent of that line organization. managers should be expected to evaluate the risks and controls within their scope of authority at least annually and to report the results of this process to the chief risk officer and the audit committee of the board of directors. an independent group, such as internal audit, should perform a separate assessment to confirm management ’ s assessment. credit risk management the evolution of a portfolio approach to credit risk management has followed a path similar to that of asset - liability management. it began in the late 1980s, in the aftermath of serious credit - quality deterioration. models and databases on defaults and credit spreads have since become more sophisticated, and loan review committees have evolved into committees that consider more broadly the various aspects of portfolio risk management. as a result, loans are priced better to reflect their varying levels of risk, they are syndicated and securitized to mitigate lenders ’ risk, and credit derivatives have been created to limit credit - risk exposures that are retained. on that last topic, i would be remiss not to draw your attention to a recent consultative paper on credit - risk transfer issued by the joint forum in october. this