Financial institutions need systems to identify, assess, and manage risks to their operations from internal and external sources. These risk management systems are critical to responding to rapid and unanticipated changes in financial markets. Risk management depends, in part, on an effective corporate governance system that addresses risk across the institution and also within specific areas of risk, including credit, market, liquidity, operational, and legal risk. The board of directors, senior management (and its designated risk-monitoring unit), the audit committee, internal auditors, and external auditors, and others have important roles to play in an effectively operating risk-management system. The different roles that each of these groups play represent critical checks and balances in the overall risk-management system. Since 1991, the Congress has passed several laws that emphasize the importance of internal controls including risk management at financial institutions and the Committee of Sponsoring Organizations of the Treadway Commission (COSO) has issued guidance that management of financial institutions could use to assess and evaluate its internal controls and enterprisewide risk management. Following the savings and loan crisis in the 1980s, the Federal Deposit Insurance Corporation Improvement Act of 1991 (FDICIA) strengthened corporate governance in large U.S. banks and thrifts. FDICIA required management to annually assess its system of internal control over financial reporting and the external auditors to attest to management’s assertions. The corporate governance model established under FDICIA emphasized strong internal control systems, proactive boards of directors, and independent, knowledgeable audit committees. During 1992, and with a subsequent revision in 1994 COSO issued its Internal Control – Integrated Framework. The COSO Framework set out criteria for establishing key elements of corporate governance, especially the “tone at the top.” The framework also set forth the five components of an effective system of internal control: control environment, risk assessment, control activities, information and communication, and monitoring. With the failures of Enron and WorldCom, Congress passed the Sarbanes- Oxley Act of 2002 (SOX) which required managements of public companies to assess their systems of internal control with external auditor attestations, though the implementation for smaller public companies has been gradual and is not yet complete. Under section 404 of SOX, the SEC required that management identify what framework it used to assess the system of internal control over financial reporting. Though it did not mandate any particular framework, the SEC recognized that the COSO Framework satisfied the SEC’s own criteria and allowed its use as an evaluation framework. In 2004, COSO issued Enterprise Risk Management – Integrated Framework (ERM Framework), though it is not a binding framework for any particular entity or industry. The ERM Framework, which encompasses the previous internal control framework, establishes best practices and expands the criteria and tools that management can use to assess whether it has an effective risk management system. The framework encourages the board of directors and senior management, in their corporate governance roles, to set the risk appetite of the entity, which is the amount of risk the entity is willing to accept in its overall strategy. Management further sets risk objectives to achieve the entity’s goals and sets risk tolerances to ensure that the risk appetite is not exceeded. Regulators also have a role in assessing risk management at financial institutions. In particular, oversight of risk management at large financial institutions is divided among a number of regulatory agencies. The Federal Reserve oversees risk management at bank holding companies and state member banks that are members of the Federal Reserve System; OTS oversees thrift holding companies and thrifts; SEC and FINRA oversee risk management at SEC-registered U.S. broker-dealers; and OCC oversees risk management at national banks. The Federal Reserve and OTS have long had authority to supervise holding companies. The Federal Reserve’s authority is set forth primarily in the Bank Holding Company Act of 1956, which contains the supervisory framework for holding companies that control commercial banks. OTS’s supervisory authority over thrift holding companies is set forth in the Home Owners Loan Act. In the Gramm-Leach-Bliley Act of 1999 (GLBA), Congress expanded the range of permissible holding company activities and affiliations and also set forth restrictions and guidance on how those companies should be supervised. However, Congress did not clearly express the aims of holding company supervision. GLBA authorizes the Federal Reserve and OTS to examine the holding company and each subsidiary in order to: (a) inform the regulator of “the nature of the operations and financial condition” of the holding company and its subsidiaries; and (b) inform the regulator of the financial and operational risks within the holding company system that may threaten the safety and soundness of the holding company’s bank subsidiaries and the systems for monitoring and controlling such risks; and (c) monitor compliance with applicable federal laws. On the other hand, GLBA specifies that the focus and scope of examinations of holding companies and any of their subsidiaries shall “to the fullest extent possible” be limited to the holding company and “any subsidiary that could have a materially adverse effect on the safety and soundness of a depository institution subsidiary” due to the size, condition or activities of the nonbank subsidiary or the nature or size of transactions between that subsidiary and the banking subsidiary. In our work over the years, we have encountered a range of perspectives on the focus of holding company examinations, some of which emphasize the health of the depository institution as the primary examination focus and some of which look more expansively to the holding company enterprise under certain conditions. In addition to the provisions generally applicable to holding company supervision, GLBA also limits the circumstances under which both holding company regulators and depository institution regulators may examine functionally regulated subsidiaries of bank holding companies, such as broker-dealers. Gramm-Leach-Bliley permits holding company regulators to examine functionally regulated subsidiaries only under certain conditions, such as where the regulator has reasonable cause to believe that the subsidiary is engaged in activities that pose a material risk to an affiliated bank or that an examination is necessary to obtain information on financial and operational risks within the holding company system that may threaten an affiliated bank’s safety and soundness. The examination authority of depository institution regulators permits the examination of bank affiliates to disclose fully an affiliate’s relations with the bank and the effect of those relations on the bank. However, with respect to functionally regulated affiliates of depository institutions, Gramm-Leach- Bliley imposes the same restraint on the use of examination authority that applies to OTS and the Federal Reserve with respect to holding companies. That is, Gramm-Leach-Bliley instructs that bank and holding company supervisors generally are to limit the focus of their examinations of functionally regulated affiliates and, to the extent possible, are to reply on the work of primary bank and functional regulators that supervise holding company subsidiaries. An example of this situation would be where a holding company has a national bank or thrift subsidiary and a broker-dealer subsidiary. Under GLBA, the holding company regulator is to rely “to the fullest extent possible” on the work of primary bank and functional regulators for information on the respective entities. Also under GLBA, bank supervisors are similarly limited with respect to affiliates of the institutions they supervise. SEC’s authority to examine U.S. broker-dealers is set forth in the Securities and Exchange Act of 1934. Under the 1934 act, SEC’s examination authority over broker-dealers does not permit SEC to require examination reports on affiliated depository institutions, and if SEC seeks non-routine information about a broker-dealer affiliate that is subject to examination by a bank regulator, SEC must notify and generally must consult with the regulator regarding the information sought. Oversight of U.S. broker-dealers is performed by SEC’s Division of Trading and Markets (Trading and Markets) and Office of Compliance, Inspections, and Examinations (OCIE). In addition, SEC delegates some of its authority to oversee U.S. broker-dealers to FINRA, a self-regulatory organization that was established in 2007 through the consolidation of NASD and the member regulation, enforcement and arbitration functions of the New York Stock Exchange. Under the alternative net capital rule for broker-dealers, from 2005-2008, SEC conducted a voluntary consolidated-supervised entity program under which five investment bank holding companies voluntarily consented to having SEC oversee them on a consolidated basis. Today, no institutions are subject to SEC oversight at the consolidated level, but several broker- dealers within bank holding companies are still subject to the alternative net capital rule on a voluntary basis. The Federal Reserve, FINRA, OCC, OTS, and SEC each identify areas of risk relating to the large, complex financial institutions they oversee and examine risk management systems at regulated institutions. However, the banking and securities regulators take different approaches. The banking regulators (Federal Reserve, OCC, and OTS) use a combination of supervisory activities, including informal tools and examination-related activities to assess the quality of institutional risk management systems and assign each institution an annual rating. SEC and FINRA aggregate information from officials and staff of the supervised institutions throughout the year to identify areas of concern across all broker-dealers. For those broker-dealers covered by the alternative net capital rule, SEC and FINRA emphasize compliance with that rule during target examinations. Under the CSE program, SEC continuously supervised and monitored the institutions in the program. Banking regulators carry out a number of supervisory activities in overseeing risk management of large, complex financial institutions. To conduct on-site continuous supervision, banking regulators often station examiners at specific institutions. This practice allows examiners to continuously analyze information provided by the financial institution, such as board meeting minutes, institution risk reports/management information system reports, and for holding company supervisors supervisory reports provided to other regulators, among other things. This type of supervision allows for timely adjustments to the supervisory strategy of the examiners as conditions change within the institution. Bank examiners do not conduct a single annual full-scope examination of the institution. Rather, they conduct ongoing examinations that target specific areas at the institutions (target examinations) and annually issue an overall rating on the quality of risk management. Each regulator had a process to assess risk management systems. While each included certain core components, such as developing a supervisory plan and monitoring, the approach used and level of detail varied. The Federal Reserve’s guidance consisted of a detailed risk assessment program that included an analytic framework for developing a risk management rating for holding companies. Unlike most bank regulatory examination guidance, this guidance is not yet publicly available. According to Federal Reserve officials, the primary purpose of the framework is to help ensure a consistent regulatory approach for assessing inherent risk and risk management practices of large financial institutions (the holding company) and make informed supervisory assessments. The Federal Reserve program for large complex banking organizations is based on a “continuous supervision” model that assigns a dedicated team to each institution. Those teams are responsible for completing risk assessments, supervisory plans, and annual assessments. The risk assessment includes an evaluation of inherent risk (credit, market, operational, liquidity, and legal and compliance) and related risk management and internal controls. The risk assessment is often the starting point for the supervisory plan as well as a supporting document for the annual assessment. The annual assessment requires the dedicated team to evaluate and rate the firm’s risk management, its financial condition, and the potential impact of its non-depository operations on the depository institution. To apply the risk or “R” rating, the examiner must consider (1) board of director and senior management oversight; (2) policies, procedures, and limits; (3) risk monitoring and management information system; and (4) internal controls for each of the risk areas. The examiners then provide an overall “R” rating for the institution. OCC’s onsite examiners assess the risks and risk management functions at large national banks using a detailed approach that is similar to that used by the Federal Reserve’s examiners. The core assessment is OCC’s primary assessment tool at the institutional level. According to OCC’s guidance, its examiners are required to assess the quality, quantity, and overall direction of risks in nine categories (strategic, reputation, credit, interest rate, liquidity, price, foreign currency translation, transaction, and compliance). To determine the quality of risk management, OCC examiners assess policies, processes, personnel, and control systems in each category. This risk assessment is included in the examination report that is sent to the bank’s board of directors. OCC also provides a rating based on the bank’s capital, asset quality, management, earnings, liquidity, and sensitivity to market risk (the CAMELS rating), all of which can be impacted by the quality of a risk management system. OCC’s supervisory strategy or plan for targeted examinations is developed from this Risk Assessment System. Examiners can change a bank’s ratings at any time if the bank’s conditions warrant that change. Targeted examinations are a key component of OCC’s oversight. Based on the materials we reviewed covering the last 2 years, OCC conducted 23 targeted examinations in 2007 and 45 in 2008 at a large national bank. These examinations focused on specific areas of risk management, such as governance, credit, and compliance. Recently revised OTS guidance requires its examiners to review large and complex holding companies to determine whether they have a comprehensive system to measure, monitor, and manage risk concentrations, determine the major risk-taking entities within the overall institution, and evaluate the control mechanisms in place to establish and monitor risk limits. OTS’s recently revised guidance on assessing risk management includes a risk management rating framework that is similar to the Federal Reserve’s. It includes the same risk management rating subcomponents—governance/board and senior management oversight; policies, procedures, and limits; risk monitoring and management information systems, and internal controls—and criteria that the Federal Reserve applies to bank holding companies. However, OTS considers additional risk areas, such as concentration or systemic risk. Starting in 2007, OTS used a risk matrix to document the level of 13 inherent risks by business unit. The matrix also includes an assessment of each unit’s risk mitigation or risk management activities, including internal controls, risk monitoring systems, policies/procedures/limits, and governance. OTS began using the risk matrix to develop its supervisory plan. Based on our review of examination materials, OTS conducted targeted examinations on risk management in such areas as consumer lending and mortgage-backed securities. In the last few years, the banking regulators have also conducted examinations that covered several large complex financial institutions on specific issues such as risk management (horizontal examinations). According to the Federal Reserve, horizontal examinations focus on a single area or issue and are designed to (1) identify the range of practices in use in the industry, (2) evaluate the safety and soundness of specific activities across business lines or across systemically important institutions, (3) provide better insight into the Federal Reserve’s understanding of how a firm’s operations compare with a range of industry practices, and (4) consider revisions to the formulation of supervisory policy. During the period of our review, the Federal Reserve completed several horizontal examinations on large, complex banking organizations, including stress testing and collateral management. According to Federal Reserve officials, examiners generally provide institutions with feedback that tells them generally how they are doing relative to their peers, and if any serious weaknesses were identified, these would be conveyed as well. With the Federal Reserve, OCC conducted a horizontal examination on advanced credit risk practices and OTS conducted a review across institutions for nontraditional mortgages and used the findings to issue supplemental guidance. According to an OCC official, the regulator uses the findings in horizontal reviews as a supervisory tool and to require corrective actions, as well as a means to discover information on bank practices to issue supplemental guidance. SEC and FINRA generally assess risk management systems of large broker-dealers using discrete, but risk-focused examinations. The focus of SEC and FINRA oversight is on compliance with their rules and the Securities and Exchange Act of 1934. Although SEC and FINRA are in continuous contact with large, complex institutions, neither SEC nor FINRA staff conduct continuous onsite monitoring of broker-dealers that involves an assessment of risks. FINRA’s coordinator program is continuous supervision, albeit not on site. According to SEC and FINRA, however, they receive financial and risk area information on a regular basis from the largest firms and those of financial concern through the OCIE compliance monitoring program, the FINRA capital alert program, and regular meetings with the firms. To identify risks, they aggregate information from their officials and staff throughout the year to identify areas that may require special attention across all broker-dealers. SEC and FINRA conduct regularly scheduled target examinations that focus on the risk areas identified in their risk assessment and on compliance with relevant capital rules and customer protection rules. SEC’s internal controls risk management examinations, which started in 1995, cover the top 15 wholesale and top 15 retail broker-dealers as well as a number of mid-sized broker-dealers with a large number of customer accounts. At the largest institutions, SEC conducts examinations every three years, while FINRA conducts annual examinations of all broker-dealers. According to Trading and Markets, the CSE program was modeled on the Federal Reserve’s holding company supervision program, but continuous supervision was usually conducted off site by a small number of examiners, SEC did not rate risk management systems, nor use a detailed risk assessment processes to determine areas of highest risk. During the CSE program, Trading and Markets staff concentrated their efforts on market and liquidity risks because the alternative net capital rule focused on these risks and on operational risk because of the need to protect investors. According to OCIE, their examiners focused on market, credit, operational, legal and compliance risks, as well as senior management, internal audit and new products. Because only five investment banks were subject to consolidated supervision by SEC, SEC staff believed it did not need to develop an overall supervisory strategy or written plans for individual institutions it supervised; however, OCIE drafted detailed scope memorandums for their target examinations. While no institutions are subject to consolidated supervision by SEC at this time, a number of broker-dealers are subject to the alternative net capital rule. SEC and FINRA conduct horizontal or “sweep” examinations and, for example, have completed one for subprime mortgages. OCIE officials said that it had increased the number of these types of examinations since the current financial crisis began. Under the consolidated supervised entity program, Trading and Markets conducted several horizontal examinations aimed at discovering the range of industry practice in areas such as leveraged lending. The banking regulators have developed guidance on how they should communicate their examination findings to help ensure that financial institutions take corrective actions. Bank regulators generally issue findings or cite weaknesses in supervisory letters or an annual examination report addressed to senior management of the financial institution. However, regulators also meet with institution management to address identified risk management weaknesses. Examples include: After a target examination, the Federal Reserve, OCC, OTS each prepare supervisory letters or reports of examination identifying weaknesses that financial institutions are expected to address in a timely manner. In addition to issues or findings, the Federal Reserve and OCC supervisory letters provided a specific timeframe for the institution to send a written response to the bank regulator articulating how the institution planned to address the findings. In these instances, for the files we reviewed, the institutions complied with the timeframes noted in the supervisory letter. These letters may be addressed to the board of directors or the CEO or as we found, the senior managers responsible for the program. For example, a Federal Reserve Bank addressed a recent targeted examination on a holding company’s internal audit function to the chief auditor of the holding company. Similarly, OCC addressed an examination of advanced risk management processes to a bank’s chief credit officer. OTS also addressed some reports of target examinations to senior managers responsible for specific programs. In their supervisory letters, OCC sometimes identifies “Matters Requiring Attention,” which instruct the bank to explain how it will address the matter in a timely manner. In its supervisory guidance, matters requiring attention include practices that deviate from sound governance, internal control and risk management principles that may adversely impact the bank’s earning or capital, risk profile, or reputation if not addressed. According to its guidance, OCC tracks matters requiring attention until they are resolved and maintains a record when these matters are resolved and closed out. OCC also includes recommendations to national banks in their supervisory letters. In addition, OCC will insert recommendations in their letters which are suggestions relating to how a bank can operate a specific program or business line more effectively. After the beginning of the financial crisis, the Federal Reserve issued revised examination guidance in July 2008 that established three types of findings: matters requiring immediate attention, matters requiring attention, and observations. Previously, each of the individual Federal Reserve Banks had its own approach to defining findings. Matters requiring attention and observations are similar to related practices followed by OCC. For matters requiring immediate attention, the matter is considered more urgent. According to their guidance, matters requiring immediate attention encompass the highest priority concerns and include matters that have the potential to pose significant risk to the organization’s safety and soundness or that represent significant instances of noncompliance with laws and regulations. OTS examiners may list recommendations in the report, findings, and conclusions, but in the materials we reviewed examiners did not report these in a standard way. While members of the Board of Directors are required to sign the report of annual examination indicating that they have read the report, they are not required to submit a written response. The OTS Handbook Section 060 Examination Administration provides guidance on the use of “matters requiring board attention” or other lesser supervisory corrective actions that should be addressed in the examination correspondence. According to OTS, matters requiring board attention and corrective actions are also tracked in its regulatory action system for follow up. For 2008, we reviewed one regulator’s tracking report of matters requiring attention at one institution and found that only a small number of the 64 matters requiring attention relating to risk management and internal controls had been closed out or considered addressed by the end of January 2009. The examiners explained that some matters, such as institutions making adjustments to their technology framework can be time consuming. Another regulator told us that it does not track when institutions have implemented remedial actions. Because the banking regulators are generally on site and continuously monitoring large, complex institutions, examiners told us that a significant part of their efforts to improve risk management systems were undertaken through regularly scheduled meetings with senior management. According to Federal Reserve and OCC officials, these meetings allow opportunities for examiners to followup with management concerning actions that they expect the financial institutions to implement. A Federal Reserve examiner explained that several meetings were held with officials at a holding company concerning an internal control matter in order to help ensure that the institution was addressing the issue. For its complex and international organizations program, OTS directs its examiners to use regular meetings with senior management and periodic meetings with boards of directors and any relevant committees to effect change. OTS guidance indicates that examiners’ regular meetings with senior management are designed to communicate and address any changes in risk profile and corrective actions. OTS also views annual meetings with the Board of Directors as a forum for discussing significant findings and management’s approach for addressing them. In addition to these tools, bank regulators’ approval authorities related to mergers and acquisitions could be used to persuade institutions to address risk management weaknesses. For example, the Federal Reserve, OCC, and OTS are required to consider risk management when they approve bank or thrift acquisitions or mergers and could use identified weaknesses in this area to deny approvals. In addition, bank regulators have to approve the acquisition of bank charters and must assess management’s ability to manage the bank or thrift charter being acquired. If SEC’s OCIE or FINRA examiners discover a violation of SEC or FINRA rules, the institution is required to resolve the deficiency in a timely manner. OCIE developed guidance on deficiency letters for examinations. According to SEC and FINRA staff, because SEC or FINRA rules do not contain specific requirements for internal controls, problems with internal controls generally are not cited as deficiencies. However, weaknesses in internal controls can rise to such a level as to violate other FINRA rules, such as supervision rules. Deficiencies and weaknesses are followed up on in subsequent examinations. OCIE’s compliance audits require institutions to correct deficiencies and address weaknesses. OCIE staff told us that if the institutions do not address deficiencies in a timely manner, they may be forwarded to the enforcement division. For example, OCIE staff was able to discuss limit violations with one firm and required the firm to change their risk limit system to significantly reduce their limit violations—indicating senior management was taking steps to better oversee and manage their risks. Under the consolidated supervised entity program, SEC’s Trading and Markets relied on discussions with management to effect change. For example, Trading and Market staff told us that they had discussions with senior management that led to changes in personnel. In the years leading up the financial crisis, some regulators identified weaknesses in the risk management systems of large, complex financial institutions. Regulators told us that despite these identified weaknesses, they did not take forceful action—such as changing their assessments— until the crisis occurred because the institutions reported a strong financial position and senior management had presented the regulators with plans for change. Moreover, regulators acknowledged that in some cases they had not fully appreciated the extent of these weaknesses until the financial crisis occurred and risk management systems were tested by events. Regulators also acknowledged they had relied heavily on management representations of risks. In several instances, regulators identified shortcomings in institutions’ oversight of risk management at the limited number of large, complex institutions we reviewed but did not change their overall assessments of the institutions until the crisis began in the summer of 2007. For example, before the crisis one regulator found significant weaknesses in an institution’s enterprisewide risk management system stemming from a lack of oversight by senior management. In 2006, the regulator notified the institution’s board of directors that the 2005 examination had concluded that the board and senior management had failed to adequately oversee financial reporting, risk appetite, and internal audit functions. The regulator made several recommendations to the board to address these weaknesses. We found that the regulator continued to find some of the same weaknesses in subsequent examination reports, yet examiners did not take forceful action to require the institution to address these shortcomings until the liquidity crisis occurred and the severity of the risk management weaknesses became apparent. When asked about the regulator’s assessment of the holding company in general and risk management in particular given the identified weaknesses, examiners told us that they had concluded that the institution’s conditions were adequate, in part, because it was deemed to have sufficient capital and the ability to raise more. Moreover, the examiners said that senior management had presented them with plans to address the risk management weaknesses. In another example, other regulators found weaknesses related to an institution’s oversight of risk management before the crisis. One regulator issued a letter to the institution’s senior management in 2005 requiring that the institution respond, within a specified time period, to weaknesses uncovered in an examination. The weaknesses included the following: The lack of an enterprisewide framework for overseeing risk, as specified in the COSO framework. The institution assessed risks (such as market or credit risks) on an individual operating unit basis, and was not able to effectively assess risks institutionwide. A lack of common definitions of risk types and of corporate policy for approving new products, which could ensure that management had reviewed and understood any potential risks. An institutional tendency to give earnings and profitability growth precedence over risk management. In addition, the regulator recommended that senior management restructure the institution’s risk management system to develop corporate standards for assessing risk. However, the regulator’s assessment of the institution’s risk management remained satisfactory during this period because senior management reported that they planned to address these weaknesses and, according to examiners, appeared to be doing so. Moreover, the examiners believed that senior management could address these weaknesses in the prevailing business environment of strong earnings and adequate liquidity. After earnings and liquidity declined during the financial crisis that began in 2007, the examiners changed their assessment, citing many of the same shortcomings in risk management that they had identified in 2005. At one institution, a regulator noted in a 2005 examination report that management had addressed previously identified issues for one type of risk and that the institution had taken steps to improve various processes, such as clarifying the roles and responsibilities of risk assessment staff, and shortening internal audit cycles of high-risk entities in this area. Later in 2007, the regulator identified additional weaknesses related to credit and market risk management. Regulatory officials told us that weaknesses in oversight of credit and market risk management were not of the same magnitude prior to the crisis as they were in late 2007 and 2008. Moreover, examiners told us that it was difficult to identify all of the potential weaknesses in risk management oversight until the system was stressed by the financial crisis. Some regulators told us that they had relied on management representation of risk, especially in emerging areas. For example, one regulator’s targeted review risk relied heavily on management’s representations about the risk related to subprime mortgages— representations that had been based on the lack of historical losses and the geographic diversification of the complex product issuers. However, once the credit markets started tightening in late 2007, the examiners reported that they were less comfortable with management’s representations about the level of risk related to certain complex investments. Examiners said that, in hindsight, the risks posed by parts of an institution do not necessarily correspond with their size on the balance sheet and that relatively small parts of the institution had taken on risks that the regulator had not fully understood. Another regulator conducted a horizontal examination of securitized mortgage products in 2006 but relied on information provided by the institutions. While the report noted that these products were experiencing rapid growth and that underwriting standards were important, it focused on the major risks identified by the firms and their actions to manage those risks as well as on how institutions were calculating their capital requirements. Regulators also identified weaknesses in the oversight and testing of risk models that financial institutions used, including those used to calculate the amount of capital needed to protect against their risk exposures and determine the valuation of complex products. Regulators require institutions to test their models so that the institutions have a better sense of where their weaknesses lie, and OCC developed guidance in 2000 related to model validation that other regulators consider to be the standard. OCC’s guidance states that institutions should validate their models to increase reliability and improve their understanding of the models’ strengths and weaknesses. The guidance calls for independent reviews by staff who have not helped to develop the models, instituting controls to ensure that the models are validated before they are used, ongoing testing, and audit oversight. The process of model validation should look not only at the accuracy of the data being entered into the model, but also at the model’s assumptions, such as loan default rates. Institutions use capital models as tools to inform their management activities, including measuring risk-adjusted performance, setting prices and limits on loans and other products, and allocating capital among various business lines and risks. Certain large banking organizations have used models since the mid-1990s to calculate regulatory capital for market risk, and the rules issued by U.S. regulators for Basel II require that banks use models to estimate capital for credit and operational risks. The SEC’s consolidated supervised entity program allowed broker-dealers that were part of consolidated supervised entities to compute capital requirements using models to estimate market and credit risk. In addition, institutions use models to estimate the value of complex instruments such as collateralized debt obligations (CDOs). Regulators identified several weaknesses related to financial institutions’ oversight and use of risk models: One regulator found several weaknesses involving the use of models that had not been properly tested to measure credit risks, an important input into institutions’ determinations of capital needed, but did not aggressively take steps to ensure that the firm corrected these weaknesses. In a 2006 letter addressed to the head of the institution’s risk management division, the examiners reported deficiencies in models used to estimate credit risk, including lack of testing, a lack of review of the assumptions used in the models, and concerns about the independence of staff testing the models. The regulator issued a letter requiring management to address these weaknesses, but continued to allow the institution to use the models and did not change its overall assessment. Although the institution showed improvement in its processes, over time, in late 2007, examiners found that some of the weaknesses persisted. In late 2008, examiners closed the matter in a letter to management but continued to note concerns about internal controls associated with risk management. A horizontal review of credit risk models by the Federal Reserve and OCC in 2008 found a similar lack of controls surrounding model validation practices for assessing credit risks, leading to questions about the ability of large, complex institutions to understand and manage these risks and provide adequate capital to cushion against potential losses. For example, the review found that some institutions lacked requirements for model testing, clearly defined roles and responsibilities for testing, adequate detail for the scope or frequency of validation, and a specific process for correcting problems identified during validation. Before the crisis, another regulator found that an institution’s model control group did not keep a complete inventory of its models and did not have an audit trail for models prior to 2000. The examiners said that they did not find these issues to be significant concerns. However, they were subsequently criticized for not aggressively requiring another institution to take action on weaknesses they had identified that were related to risk models, including lack of timely review, understaffing, lack of independence of risk managers, and an inability or unwillingness to update models to reflect the changing environment. Other regulators noted concerns about pricing models for illiquid instruments, but made these findings only as the crisis was unfolding. For example, in a 2007 horizontal review of 10 broker-dealers’ exposure to subprime mortgage-related products, SEC and FINRA examiners found weaknesses in pricing assumptions in valuation models for complex financial products. They found that several of these firms relied on outdated pricing information or traders’ valuations for complex financial transactions, such as CDOs. In some cases, firms could not demonstrate that they had assessed the reasonableness of prices for CDOs. Another regulator noted in a 2007 targeted examination that although management had stated that the risk of loss exposure from highly rated CDOs was remote, the downturn in the subprime mortgage market could mean that they would not perform as well as similarly rated instruments performed historically. Because of the inherent limitations of modeling, such as the accuracy of model assumptions, financial institutions also use stress tests to determine how much capital and liquidity might be needed to absorb losses in the event of a large shock to the system or a significant underestimation of the probability of large losses. According to the Basel Committee on Banking Supervision, institutions should test not only for events that could lower their profitability, but also for rare but extreme scenarios that could threaten their solvency. In its January 2009 report, the Basel Committee emphasized the importance of stress testing, noting that it could (1) alert senior management to adverse unexpected losses, (2) provide forward- looking assessments of risk, (3) support enterprisewide communication about the firm’s risk tolerance, (4) support capital and liquidity planning procedures, and (5) facilitate the development of risk mitigation or contingency plans across a range of stressed conditions. Moreover, the report noted that stress testing was particularly important after long periods of relative economic and financial calm when companies might become complacent and begin underpricing risk. We found that regulators had identified numerous weaknesses in stress testing at large institutions before the financial crisis. However, our limited review did not identify any instances in which an institution’s lack of worst-case scenario testing prompted regulators to push forcefully for institutional actions to better understand and manage risks. A 2006 Federal Reserve horizontal review of stress testing practices at several large, complex banking institutions revealed that none of the institutions had an integrated stress testing program that incorporated all major financial risks enterprisewide, nor did they test for scenarios that would render them insolvent.. The review found that institutions were stress testing the impact of adverse events on individual products and business lines rather than on the institution as a whole. By testing the response of only part of the institution’s portfolio to a stress such as declining home prices, the institution could not see the effect of such a risk on other parts of its portfolio that could also be affected. The review was particularly critical of institutions’ inability to quantify the extent to which credit exposure to counterparties might increase in the event of a stressed market risk movement. It stated that institutions relied on “intuition” to determine their vulnerability to this type of risk. It also found that institutions’ senior managers were confident in their current practices and questioned the need for additional stress testing, particularly for worst- case scenarios that they thought were implausible.. The 2006 review included some recommendations for examiners to address with individual institutions, and Federal Reserve officials told us that they met with institutions’ chief risk officers to discuss the seriousness of the findings just before the crisis began. However, officials told us that the purpose of the review was primarily to facilitate the regulator’s understanding of the full range of stress testing practices, as there was neither a well-developed set of best practices nor supervisory guidance in this area at the time. The regulatory officials also told us that these findings were used to inform guidance issued by the President’s Working Group on assessing exposure from private pools of capital, including hedge funds. However, this guidance focuses on testing the exposure to counterparty risks, such as from hedge funds, and not on testing the impact of solvency-threatening, worst-case scenarios. In hindsight, officials told us that the current crisis had gone beyond what they had contemplated for a worst-case scenario, and they said that they would probably have faced significant resistance had they tried to require the institutions to do stress tests for scenarios such as downgrades in counterparties’ credit ratings because such scenarios appeared unlikely. Other regulators raised concerns about stress testing at individual institutions, but we did not find evidence that they had effectively changed the firms’ stress testing practices. In the materials we reviewed, one regulator recommended that the institution include worst-case scenarios in its testing. In a 2005 examination report, examiners noted a concern about the level of senior management oversight of risk tolerances. This concern primarily stemmed from lack of documentation, stress testing, and communication of firm risk tolerances and the extent to which these were reflected in stress tests. While the firm later took steps to document formal risk tolerances and communicate this throughout the firm, the recommendation related to stress testing remained open through 2008. Another regulator required institutions to show that they conducted stress tests of the institution’s ability to have enough funding and liquidity in response to certain events, including a credit downgrade or the inability to obtain unsecured, short-term financing. In addition, institutions were required to document that they had contingency plans to respond to these events. The regulator said that it specifically required institutions to conduct stress tests such as those based on historical events including the collapse of Long-Term Capital Management or the stock market decline of 1987. However, regulatory staff told us that the liquidity crisis of 2008 was greater than they had expected. In this and other work, we identified two specific shortcomings of the current regulatory system that impact the oversight of risk management at large, complex financial institutions. First, no regulator has a clear responsibility to look across institutions to identify risks to overall financial stability. As a result, both banking and securities regulators continue to assess risk management primarily at an individual institutional level. Even when regulators perform horizontal examinations across institutions, they generally do not use the results to identify potential systemic risks. Although for some period, the Federal Reserve analyzed financial stability issues for systemically important institutions it supervises, it did not assess the risks on an integrated basis or identify many of the issues that just a few months later led to the near failure of some of these institutions and to severe instability in the overall financial system. Second, although financial institutions manage risks on an enterprisewide basis or by business lines that cut across legal entities, primary bank and functional regulators may oversee risk management at the level of a legal entity within a holding company. As a result, their view of risk management is limited or their activities overlap or duplicate those of other regulators including the holding company regulator. In previous work, we have noted that no single regulator or group of regulators systematically assesses risks to the financial stability of the United States by assessing activities across institutions and industry sectors. In our current analysis of risk management oversight of large, complex institutions, we found that, for the period of the review (2006- 2008), the regulators had not used effectively a systematic process that assessed threats that large financial institutions posed to the financial system or that market events posed to those institutions. While the regulators periodically conducted horizontal examinations in areas such as stress testing, credit risk practices, and risk management for securitized mortgage products, these efforts did not focus on the stability of the financial system, nor were they used as a way to assess future threats to that system. The reports summarizing the results of these horizontal examinations show that the purpose of these reviews was primarily to understand the range of industry practices or to compare institutions rather than to determine whether several institutions were engaged in similar practices that might have a destabilizing effect on certain markets and leave the institutions vulnerable to those and other market changes, and that these conditions ultimately could affect the stability of the financial system. Beginning in 2005 until the summer of 2007, the Federal Reserve made efforts to implement a systematic review of financial stability issues for certain large financial institutions it oversees and issued internal reports called Large Financial Institutions’ Perspectives on Risk. With the advent of the financial crisis in the summer of 2007, the report was suspended; however, at a later time the Federal Reserve began to issue risk committee reports that addressed risks across more institutions. While we commend the Federal Reserve for making an effort to look systematically across a group of institutions to evaluate risks to the broader financial system, the Perspectives of Risk report for the second half of 2006 issued in April 2007 illustrates some of the shortcomings in the process. The report reviewed risk areas including credit, market, operational, and legal and compliance risk but did not provide an integrated risk analysis that looked across these risk areas—a shortcoming of risk management systems identified in reviews of the current crisis. In addition, with hindsight, we can see that the report did not identify effectively the severity and importance of a number of factors. For example, it stated that: There are no substantial issues of supervisory concern for these large financial institutions. Asset quality across the systemically important institutions remains strong. In spite of predictions of a market crash, the housing market correction has been relatively mild, and while price appreciation and home sales have slowed and inventories remain high, most analysts expect the housing market to bottom out in mid-2007. The overall impact on a national level will likely be moderate; however, in certain areas housing prices have dropped significantly. The volume of mortgages being held by institutions—warehouse pipelines—has grown rapidly to support collateralized mortgage- backed securities and CDOs. Surging investor demand for high-yield bonds and leveraged loans, largely through structured products such as CDOs, provided continuing strong liquidity that resulted in continued access to funding for lower- rated firms at relatively modest borrowing costs. Counterparty exposures, particularly to hedge funds, continue to expand rapidly. With regard to the last point, a Federal Reserve examiner stated that the Federal Reserve had taken action to limit bank holding company exposures to hedge funds. The examiner noted that although in hindsight it was possible to see some risks that the regulators had not addressed, it was difficult to see the impact of issues they had worked to resolve. When asked for examples of how the Federal Reserve had used supervisory information in conjunction with its role to maintain financial stability, a Federal Reserve official provided two examples that he believed illustrated how the Federal Reserve’s supervisory role had influenced financial stability before the current financial crisis. First, the official said that the Federal Reserve had used supervisory information to improve the resilience of the private sector clearing and settlement infrastructure after the attacks on the World Trade Center on September 11, 2001. Second, it had worked through the supervisory system to strengthen the infrastructure for processing certain over-the-counter derivative transactions. Federal Reserve officials noted that financial stability is not the sole focus of safety and soundness supervision and that several mechanisms exist in which regulation plays a significant role with other areas of the Federal Reserve in assessing and monitoring financial stability. Federal Reserve regulators indicated that other Federal Reserve functions often consulted with them and that they provided information to these functions and contributed to financial stability discussions, working groups, and decisions both prior to and during the current crisis. In October 2008, the Federal Reserve issued new guidance for consolidated supervision suggesting that in the future the agency would be more mindful of the impact of market developments on the safety and soundness of bank holding companies. The new guidance says, for instance, that the enhanced approach to consolidated supervision emphasizes several elements that should further the objectives of fostering financial stability and deterring or managing financial crises and help make the financial system more resilient. The guidance says that two areas of primary focus would be: activities in which the financial institutions play a significant role in critical or key financial markets that have the potential to transmit a collective adverse impact across multiple firms and financial markets, including the related risk management and internal controls for these activities, and areas of emerging interest that could have consequences for financial markets, including, for example, the operational infrastructure that underpins the credit derivatives market and counterparty credit risk management practices. Some regulators have noted that the current practice of assessing risk management at the level of a depository institution or broker-dealer did not reflect the way most large, complex institutions manage their risks. Regulators noted that financial institutions manage some risks enterprisewide or by business lines that cross legal entity boundaries. The scope of regulators’ supervisory authorities does not clearly reflect this reality, however. As set forth in the Gramm-Leach-Bliley Act, various regulators can have separate responsibilities for individual components of a large, complex financial institution. In addition, GLBA generally restricts the focus of holding company examinations to the holding company and any subsidiary that could have a materially adverse effect on the safety and soundness of an affiliated bank. OCC examiners told us that it was difficult for them to assess a bank’s market risk management because OCC focused on the national bank’s activities, while the financial institution was managing risk across the bank and the broker-dealer. The examiners said that in some cases the same traders booked wholesale trades in the bank and in the broker-dealer and that the same risk governance process applied to both. Thus, both the primary bank regulator and the functional regulator were duplicating each other’s supervisory activities. In addition, if initial transactions were booked in one entity, and transactions designed to mitigate the risks in that transaction were booked in another legal entity, neither regulator could fully understand the risks involved. While effective communication among the functional and primary bank regulators could address this limitation, securities regulators told us that they shared information with the Federal Reserve but generally did not share information with OCC. OCC examination materials show that examiners sometimes assessed risks and risk management by looking at the entire enterprise. In addition, OCC examiners often met with holding company executives. In previous work, we noted the likelihood that OCC’s responsibilities and activities as the national bank regulator overlap with the responsibilities and activities of the Federal Reserve in its role as the holding company regulator. We found in this review that this overlap continued to exist; however, we also continued to observe that OCC and the Federal Reserve share information and coordinate activities to minimize the burden to the institution. Securities regulators face similar challenges in assessing risk management at broker-dealers. In a number of past reports, we have highlighted the challenges associated with SEC’s lack of authority over certain broker- dealer affiliates and holding companies. FINRA officials also cited two examples of limitations on their efforts to oversee risk management within broker-dealers. First, they noted that FINRA’s regulatory authority extended only to U.S. broker-dealers and that related transactions generally are booked in other legal entities. FINRA noted that the riskiest transactions were usually booked in legal entities located offshore. FINRA also noted that often inventory positions booked in the U.S. broker-dealer might hedge the risk in another affiliated legal entities. From time to time, FINRA has requested that the U.S. broker-dealer move the hedge into the broker-dealer to reduce the amount of the losses and protect the capital base of the broker-dealer. An SEC official noted that to take advantage of certain capital treatment the transaction and the hedge would both need to be booked in the broker-dealer. Second, FINRA officials noted that their view was limited because market risk policy is set at the holding company level. In closing, I would like to reiterate a number of central themes that have appeared often in our recent work. While an institution’s management, directors, and auditors all have key roles to play in effective corporate governance, regulators—as outside assessors of the overall adequacy of the system of risk management—also have an important role in assessing risk management. The current financial crisis has revealed that many institutions had not adequately identified, measured, and managed all core components of sound risk management. We also found that for the limited number of large, complex institutions we reviewed, the regulators failed to identify the magnitude of these weaknesses and that when weaknesses were identified, they generally did not take forceful action to prompt these institutions to address them. As we have witnessed, the failure of a risk management system at a single large financial institution can have implications for the entire financial system. Second, while our recent work is based on a limited number of institutions, examples from the oversight of these institutions highlight the significant challenges regulators face in assessing risk management systems at large, complex institutions. While the painful lessons learned during the past year should bolster market discipline and regulatory authority in the short term, history has shown that as the memories of this crisis begin to fade, the hard lessons we have learned are destined to be repeated unless regulators are vigilant in good times as well as bad. Responsible regulation requires that regulators critically assess their regulatory approaches, especially during good times, to ensure that they are aware of potential regulatory blind spots. This means constantly reevaluating regulatory and supervisory approaches and understanding inherent biases and regulatory assumptions. For example, the regulators have begun to issue new and revised guidance that reflects the lessons learned from the current crisis. However, the guidance we have seen tends to focus on the issues specific to this crisis rather than on broader lessons learned about the need for more forward-looking assessments and on the reasons that regulation failed. Finally, I would like to briefly discuss how our current regulatory framework has potentially contributed to some of the regulatory failures associated with risk management oversight. The current institution-centric approach has resulted in regulators all too often focusing on the risks of individual institutions. This has resulted and in regulators looking at how institutions were managing individual risks, but missing the implications of the collective strategy that was premised on the institution’s having little liquidity risk and adequate capital. Whether the failures of some institutions ultimately came about because of a failure to manage a particular risk, such as liquidity or credit risks, these institutions often lacked some of the basic components of good risk management—for example, having the board of directors and senior management set the tone for proper risk management practices across the enterprise. The regulators were not able to connect the dots, in some cases because of the fragmented regulatory structure. While regulators promoted the benefits of enterprisewide risk management, we found that they failed to ensure that all of the large, complex financial institutions in our review had risk management systems commensurate with their size and complexity so that these institutions and their regulators could better understand and address related risk exposures. This concludes my prepared statement. I would be pleased to answer any questions that you may have at the appropriate time. For further information about this testimony, please contact Orice M. Williams on (202) 512-8678 or at williamso@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this testimony include Barbara Keller, Assistant Director; Nancy Barry, Emily Chalmers, Clayton Clark, Nancy Eibeck, Kate Bittinger Eikel, Paul Thompson, and John Treanor. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: Financial regulators have an important role in assessing risk management systems at financial institutions. Analyses have identified inadequate risk management at large, complex financial institutions as one of the causes of the current financial crisis. The failure of the institutions to appropriately identify, measure, and manage their risks has raised questions not only about corporate governance but also about the adequacy of regulatory oversight of risk management systems. GAO's objectives were to review (1) how regulators oversee risk management at these institutions, (2) the extent to which regulators identified shortcomings in risk management at certain institutions prior to the summer of 2007, and (3) how some aspects of the regulatory system may have contributed to or hindered the oversight of risk management. GAO built upon its existing body of work, evaluated the examination guidance used by examiners at U.S. banking and securities regulators, and reviewed examination reports and work papers from 2006-2008 for a selected sample of large institutions, and horizontal exams that included additional institutions. In January 2009, GAO designated the need to modernize the financial regulatory system as a high risk area needing congressional attention. Regulatory oversight of risk management at large, financial institutions, particularly at the holding company level, should be considered part of that effort. The banking and securities regulators use a variety of tools to identify areas of risk and assess how large, complex financial institutions manage their risks. The banking regulators--Federal Reserve, Office of the Comptroller of the Currency (OCC), and the Office of Thrift Supervision (OTS)--and securities regulators--Securities and Exchange Commission (SEC) and the Financial Industry Regulatory Authority (FINRA)--use somewhat different approaches to oversee risk management practices. Banking examiners are assigned to continuously monitor a single institution, where they engage in targeted and horizontal examinations and assess risks and the quality of institutions' risk management systems. SEC and FINRA identify areas of high risk by aggregating information from examiners and officials on areas of concern across broker-dealers and by monitoring institutions. SEC and FINRA conduct discrete targeted and horizontal examinations. The banking regulators focused on safety and soundness, while SEC and FINRA tended to focus on compliance with securities rules and laws. All regulators have specific tools for effecting change when they identify weaknesses in risk management at institutions they oversee. In the examination materials GAO reviewed for a limited number of institutions, GAO found that regulators had identified numerous weaknesses in the institutions' risk management systems before the financial crisis began. For example, regulators identified inadequate oversight of institutions' risks by senior management. However, the regulators said that they did not take forceful actions to address these weaknesses, such as changing their assessments, until the crisis occurred because the institutions had strong financial positions and senior management had presented the regulators with plans for change. Regulators also identified weaknesses in models used to measure and manage risk but may not have taken action to resolve these weaknesses. Finally, regulators identified numerous stress testing weaknesses at several large institutions, but GAO's limited review did not identify any instances in which weaknesses prompted regulators to take aggressive steps to push institutions to better understand and manage risks. Some aspects of the regulatory system may have hindered regulators' oversight of risk management. First, no regulator systematically looks across institutions to identify factors that could affect the overall financial system. While regulators periodically conducted horizontal examinations on stress testing, credit risk practices, and risk management for securitized mortgage products, they did not consistently use the results to identify potential systemic risks. Second, primary bank and functional regulators' oversee risk management at the level of the legal entity within a holding company while large entities manage risk on an enterprisewide basis or by business lines that cut across legal entities. As a result, these regulators may have only a limited view of institutions' risk management or their responsibilities and activities may overlap with those of holding company regulators.