Deepening the foundations of risk management

by Marshall Eckblad, senior risk management specialist, Supervision and Regulation, Lamont Black, assistant professor, DePaul University, and Esther Ogunro, assistant supervision analyst, Supervision and Regulation

The ongoing recovery from the Great Recession has been accompanied by changes in the types of risks that financial institutions face and the ways in which they manage them. Even as improving labor markets and modest economic growth have strengthened balance sheets and stabilized most businesses, financial services firms remain under considerable pressure. In this context, the Federal Reserve Bank of Chicago and DePaul University hosted their eighth annual risk conference on March 31–April 1, 2015.

The conference, Reaffirming Our Foundations: Risk and Regulation, Culture and Governance, highlighted the growing need for financial institutions to develop internal risk cultures—specifically workplace environments that do more than encourage compliance with formal rules, including incentives for employees to proactively identify and address risks that threaten the firm’s welfare. Conference speakers and panelists also emphasized the need for strong boards of directors to provide credible risk review and oversight while incorporating supervisory requirements and expectations, such as stress testing, within their strategic planning. A number of macroeconomic risks are on the horizon, such as possible domestic interest rate increases and instability in the eurozone and China. In addition, technological security remains a priority as firms seek to defend themselves against increasingly sophisticated cyberattacks.

During two days of panels and keynote speakers, there was a broad consensus that the stability and long-term viability of financial institutions rest on their having a top-to-bottom ability to identify and manage risks. In this Chicago Fed Letter, we summarize discussions by attending industry executives, academics, and supervisory staff, who emphasized some key common characteristics they have observed at well-run financial institutions.

Risk culture

A culture of managing risks is a distinguishing characteristic of well-run financial institutions—and an increasing area of focus among supervisors. In this context, culture has been defined as “the implicit norms that guide behavior in the absence of regulations or compliance rules—and sometimes despite those explicit restraints… . It is how people react not only to black and white, but to all of the shades of grey.”1 These norms are often more important than the tools and even governance structures that implement risk management. Keynote speaker Wieke Scholten, senior supervision officer, De Nederlandsche Bank N.V., emphasized that formal risk-management structures are only as effective as the underlying culture of expectations. “The crisis showed us that more rules alone will not prevent the next crisis. In addition to improved rules and controls, banks need to address behaviors that pose risks to the institution’s stability,” she said.

Panelists at the risk conference described a number of strategies for establishing a workplace culture that empowers employees at any level to feel comfortable expressing their views when they encounter a risk or witness ethical conflicts. “What do others in your financial institution know about the risks facing your firm? You want to be sure you hear from them,” said Suzanne Williams, assistant director, Federal Reserve Board of Governors. Strong cultures also require the hiring and promotion of staff that can think critically about the institution’s vulnerabilities, especially those that are less visible or shift over time. “It’s the unknown unknown that’s the biggest issue. You have to put people in place who can identify those kinds of risks,” said Anthony Gibbs, regional director, Consumer Financial Protection Bureau.

Michael Scudder, president and CEO, First Midwest Bancorp, described some formal efforts to instill a strong culture across his organization and then measure its effectiveness. In one example, he explained the purpose of a regular risk-management meeting where business line leaders meet to review each other’s plans, similar to the way a bank’s loan committee reviews and approves loan applications. “It encourages business managers to take stock of the risks they’re facing, and to ask the same questions of their colleagues,” he said. The meetings challenge business managers to ask questions, such as: How do we know that? Have you consulted an independent expert? What did they say? Scudder said First Midwest Bancorp also regularly acknowledges “examples of staff members who did the right thing in challenging circumstances.” In addition, the firm uses regular surveys to measure the extent to which staff members understand the priorities set by management.

While executives and researchers continue to study specific mechanisms for developing a firm’s culture, compensation arrangements remain the most commonly cited tool. “Compensation is the key now. Maybe it shouldn’t be someone’s chief motivation, but let me tell you, it sends a message really quickly and effectively,” said Leonard Wiatr, executive managing director and chief risk officer, The PrivateBank.

Corporate governance

As institutions navigate the economic recovery, many are asking boards of directors to take a lead role in corporate governance, including shaping the institution’s risk culture, setting risk appetites, and evaluating executive performance. As the conference’s discussions demonstrated, it is increasingly common to hear financial services executives and supervisors describe efforts to strengthen board expertise, create and empower formal risk committees, and ask board directors to provide close oversight of key operations, such as cybersecurity. Elijah Brewer III, professor, DePaul University, underscored the prior research showing that effective boards of directors are essential for managing risks and protecting shareholder interests.

Boards of directors can vary widely by institution, but their effectiveness typically depends on a set of key variables—including the quality of directors’ skills, the depth and detail of board discussions, and an ability among directors to be role models for rank-and-file employees in carrying out the firm’s mission and culture. According to panelists, an additional characteristic of effective boards is accessibility to employees. Kelly King, chairman and CEO, BB&T Corp., echoed those observations in a keynote address by describing his own organization’s structure. “My reports have unfettered access to the board—they can go to the board anytime they want without checking with me first. If we want to be open and transparent, it has to be that way,” he said.

Executives also suggest that boards are more empowered when they receive briefings and board materials for meetings that are actionable, point out tough dilemmas, and do more than track a firm’s financial performance. “Board reports tend to be too focused on how we’re doing against financial objectives. Materials for the board should include more risk-based analysis that assists in evaluating performance relative to the board’s risk appetite. What are the key metrics or risk indicators?,” said Jame Sloan, director, Promontory Financial Group.

Regulatory requirements

The shifting economic landscape has coincided with efforts by U.S. and international policymakers to strengthen regulatory requirements for banks and other financial institutions—including thrifts, insurers, and what are known as financial market utilities.2 “When Dodd–Frank came along, it changed the rules of banking. This includes pretty dramatic changes to capital requirements, and governance. And these rules are likely here to stay,” said King. The most prominent of these efforts are supervised stress tests, a major component of the Comprehensive Capital Analysis and Review (CCAR), which requires bank holding companies with at least $50 billion in consolidated assets to submit annual capital plans to the Federal Reserve for review. The stress tests were introduced in 2009, with the objective of measuring and publicly disclosing the strength of the largest financial institutions that operate in the United States, including their capacity to endure a stressful event in the economy or financial markets.3

As supervised stress tests enter their sixth year,4 the Federal Reserve is placing greater emphasis on qualitative factors such as governance and controls, in addition to traditional quantitative factors such as capital and liquidity. “It is good practice for banks to sit down and ask important questions about the risks they face and the risk management needed,” said Sloan. Federal Reserve officials have devoted considerable focus to the way firms vet and test their internal models and controls, including methods for forecasting how economic or financial market events might impact the firm’s business lines and balance sheet. The conference discussion also touched on Federal Reserve requirements that firms have a forward-looking element to their assessments of capital adequacy.

Stricter rules and regulations extend beyond supervisory stress tests. The largest, most systemically important financial institutions are subject to an emerging framework of capital requirements, liquidity requirements, and enhanced prudential standards.5 A wider set of firms is subject to compliance with the Volcker rule and Basel III guidelines. All institutions must comply with Bank Secrecy Act requirements and Consumer Financial Protection Bureau rules, among others. “These new rules demand higher standards from both financial institutions and their supervisors,” said Steven Durfey, senior vice president, Federal Reserve Bank of Chicago.

Macroeconomic risks

The macroeconomic environment of weak inflation and low interest rates continues to puzzle economists and challenge bankers. Despite a regime of highly accommodative monetary policy in the U.S. over the past seven years, core inflation has consistently remained below the 2% target and long-term interest rates have remained low. There is widespread concern that this extended period of slow price growth could lead to self-fulfilling expectations. “We worry that low inflation expectations become embedded in investment plans and business decisions,” said Anna Paulson, vice president and director of financial research, Federal Reserve Bank of Chicago. Some economists see evidence of similar patterns playing out in the U.S. labor market, where wages have remained flat despite the strongest job growth numbers in more than a decade. “The polarization of income is something we have to be very worried about,” said John M. De Clue, chief investment officer, The Private Client Reserve, U.S. Bank.

In addition, trends in financial markets point to increased volatility and a continued strengthening in the U.S. dollar. U.S.-based panelists at the conference suggested these headwinds are likely to impact the U.S. economy, whose modest recovery in recent years has sometimes faltered. As one example, panelists discussed potential implications for the performance of S&P 500 member corporations, which draw nearly half of their revenues from outside the U.S. With the experience of the financial crisis still in the rearview mirror, financial industry executives said their customers are nervous. “We have clients who are talking about hedging foreign markets—be it currency, equities, debt—for the first time,” said Jim Leckinger, senior vice president, Graystone Consulting. The first half of 2015 was characterized by a rise in volatility and other broad risk measures around the globe, including sharpening debt crises in the eurozone, unrest in the Middle East and Ukraine, and decelerating growth in East Asia. In the first quarter of 2015, China’s economy expanded at an annual rate of 7%, the second-lowest figure since 2001, and potentially part of what many economists suggest is a long-term trend.

Cyberthreats

Still, the most significant emerging risk for financial institutions around the world is technological—namely, the threats they face daily in protecting their networks, infrastructure, and proprietary and client data. The sheer scale of the cyber-landscape is formidable for entire industries, let alone individual firms. According to Jason Witty, chief information security officer, U.S. Bancorp, the globe’s population of around 7.2 billion people currently uses more than 6 billion smartphone/mobile devices. He said “the internet of things” has increased the number of Internet-connected devices to nearly 15 billion. Meanwhile, cyberattackers, including state-sponsored groups, together have access to more than $400 billion in funding each year; and they produce roughly 70,000 new viruses each day. “Cyber is the one risk that makes us all uncomfortable. It’s really hard to get your arms around. The biggest challenge is the level of sophistication of attacks continues to grow exponentially, while the cost to launch an attack continues to fall,” said Alberto Paracchini, president and CEO, Byline Bank.

Unlike traditional risk types—credit, market, liquidity, interest rate, and operating error—cyberattacks’ true cost is difficult to anticipate, making it ill-suited to conventional cost–benefit analysis. For example, a bank may not experience direct material losses through a cyberattack, but it may lose customers who no longer trust the bank’s ability to safeguard their assets. “The reputation risk is every bit as costly as the financial risk—you just might not see it right away,” according to Jerry Miller, partner, Wipfli. “Cyberattacks can very quickly become liquidity events if an institution’s critical functions become compromised,” said Rebecca Chmielewski, vice president, Federal Reserve Bank of Chicago.

Threats as dynamic as cyberattacks, which leave little room for defensive error, represent a key example in which culture is a staple ingredient for effective risk management—both within and across firms. Financial institutions have begun to appreciate that they are most effective when working together through official industry groups6—and, most importantly, with government and law enforcement. This includes cooperation between firms that otherwise compete directly for customers and business. “It is a team sport these days. We shouldn’t be competing with each other in cybersecurity. The industry will only be effective if firms work together,” said Witty.

Corporate security officers at the conference urged organizations to have senior IT professionals obtain security clearance from the federal government to review classified intelligence. Panelists described the potential for chaos when an IT officer with no security clearance is barred from participating in crisis-hour investigations and conversations with law enforcement.

Conclusion

It is clear in the wake of the financial crisis that financial institutions face growing expectations to instill corporate cultures that embrace risk management and provide formal and informal firewalls against unethical or harmful behavior. Although the quality of a firm’s culture can be challenging to quantify, conference discussions suggest compensation agreements, boardroom oversight, and empowered risk managers are each a key ingredient. Without these and other elements, financial institutions are at risk of discovering threats only after they have damaged a firm’s reputation, harmed its financial performance and, in extreme cases, imperiled its viability. In the post-crisis landscape, a distinguishing feature of successful financial institutions appears to be the ability to serve as their own first—and best—line of defense.

Notes

1 See http://www.newyorkfed.org/newsevents/speeches/2014/dud141020a.html.

2 The Federal Reserve defines financial market utilities as “multilateral systems that provide the infrastructure for transferring, clearing, and settling payments, securities, and other financial transactions among financial institutions or between financial institutions and the system.” Examples include the Chicago Mercantile Exchange, the Depository Trust Co., and the Options Clearing Corp.

3 http://www.federalreserve.gov/bankinforeg/stress-tests-capital-planning.htm.

4 “Supervised stress tests” refer exclusively to the aspects of CCAR (and its antecedents) in which the Federal Reserve conducts stress tests.

5 See http://www.federalreserve.gov/newsevents/press/bcreg/20130702a.htm; http://www.federalreserve.gov/newsevents/press/bcreg/20140903a.htm; and http://www.federalreserve.gov/newsevents/press/bcreg/20140218a.htm.

6 Examples include the Financial Crimes Enforcement Network, or FinCEN (http://www.fincen.gov), and the Financial Services Information Sharing and Analysis Center (https://www.fsisac.com).

Editorial staff and copyright

Charles L. Evans, President; Daniel G. Sullivan, Executive Vice President and Director of Research; David Marshall, Senior Vice President and Associate Director of Research; Spencer Krane, Senior Vice President and Senior Research Advisor; Daniel Aaronson, Vice President, microeconomic policy research; Jonas D. M. Fisher, Vice President, macroeconomic policy research; Robert Cox, Vice President, markets team; Anna L. Paulson, Vice President, finance team; William A. Testa, Vice President, regional programs, and Economics Editor; Helen Koshy and Han Y. Choi, Editors; Julia Baker, Production Editor; Sheila A. Mangler, Editorial Assistant.

Chicago Fed Letter is published by the Economic Research Department of the Federal Reserve Bank of Chicago. The views expressed are the authors’ and do not necessarily reflect the views of the Federal Reserve Bank of Chicago or the Federal Reserve System.

© 2015 Federal Reserve Bank of Chicago

Chicago Fed Letter articles may be reproduced in whole or in part, provided the articles are not reproduced or distributed for commercial gain and provided the source is appropriately credited. Prior written permission must be obtained for any other reproduction, distribution, republication, or creation of derivative works of Chicago Fed Letter articles. To request permission, please contact Helen Koshy, senior editor, at 312-322-5830 or email Helen.Koshy@chi.frb.org. Chicago Fed Letter and other Bank publications are available at https://www.chicagofed.org.

ISSN 0895-0164

FEDERAL RESERVE BANK OF CHICAGO

Public Information Center

PO Box 834

Chicago, Illinois 60690-0834

312-322-5115