The global financial crisis had many causes, but failures in risk management were clearly a contributory factor. Although there were technical shortcomings, especially related to the use of risk models and metrics, a more widespread problem was a failure of governance, which meant that the legitimate warnings of risk managers went either unheeded or unnoticed. In the euphoria of the credit bubble preceding the crash, a culture in banking and insurance that prioritized short-term gains over prudence all too often rode roughshod over the concerns of risk managers. Many senior executives were more concerned with outperforming revenue and profit targets than paying heed to growing risk concentrations.
The crisis has changed that. Across the financial services industry in Asia, risk management has moved to the centre of strategic decision-making, and many institutions are revamping their entire approach to understanding and mitigating the risks that they face. For instance, many within the Asian financial services industry are looking for ways to lessen the burden on taxpayers. These taxpayers have, historically, have been hit hardest by the financial fallout from mismanagement and infrastructure failures in the banking industry.
Earlier this year, the Economist Intelligence Unit conducted a global survey on behalf of SAS to track the progress of financial institutions in strengthening their risk management since the crisis. The survey attracted 346 respondents from across the banking and insurance industries.
The following outlines highlights of those survey findings along with related additional insights drawn across insurance, investment banking and retail banking sectors. These insights should serve as a baseline of key learning for Asia’s business leaders across all industries, not just financial services. With the framework for improvement in place, the region’s leaders can better incorporate risk management in their strategies to ensure continued growth and effective business strategies.
- Insurance. Insurers have mostly weathered the financial crisis well and the majority are optimistic about the future. Although there have been notable exceptions, most insurers have come through the crisis with no need for state support, and their business models and risk management processes have proven to be quite robust.
Compared to the banking sector, the financial crisis has inflicted only limited damage on the insurance industry. Although there were high-profile insurance victims of the financial crisis, the main chink in the armour of insurers, in hindsight, was their foray into quasi-banking activities that left them exposed to new and unfamiliar risks. Risk management processes held up reasonably well, while the peculiarities of the industry’s business model meant that it did not suffer the prospect of sudden death that crippled the banks.
While the industry can deservedly breathe a small sigh of relief, this is no time for complacency. Regulators are poised for action and have insurers in their sights. Data quality and availability remain a challenge, while the understandable emphasis on improving risk management is straining financial, technological and human resources. Insurers escaped the brunt of the financial crisis owing to a combination of factors, but addressing the shortfalls in risk management remains essential to their long-term health.
- Investment Banking. Investment banks enjoyed a strong year in 2009, thanks to the actions of policy-makers, such as stimulus packages. But the risk of complacency remains. After the turmoil of the global financial crisis, investment banks enjoyed a spectacular rebound in the second half of last year.
The darkest days of the financial crisis may be behind them but investment banks face stiff challenges ahead. The withdrawal of fiscal stimulus packages, the sluggish economic recovery, the imposition of stricter capital and liquidity buffers and a slew of regulatory interventions in the pipeline are likely to make the business environment more challenging.
Over the past 18 months, investment banks have earmarked a huge amount of effort and resources to address shortcomings in risk management. Governance has been strengthened, risk management has grown in authority, and there is now a stronger focus on formal risk management processes than ever before. Banks that suffered most from the crisis recognize the need for root-and-branch reform of risk management, while those that came through with only minor damage are also re-examining their risk architecture, processes, models, data and infrastructure.
Still, weaknesses in risk management are still a major concern for the industry. Some institutions have not yet done enough to strengthen governance, while data quality and availability remain a challenge, particularly for firms that have grown by acquisition. Perhaps most importantly, risk expertise and awareness are not being disseminated broadly across the institution. For some investment banks, there is some way to go before risk management principles become embedded.
- Retail Banking. Between October 2009 and April 2010, the health of the banking system improved markedly. Falling loan default rates, improving margins and a slowly recovering economy have ensured that even some banks that were badly hit by the crisishave returned to profitability.
The worst of the financial crisis may now be over but retail banks face a dramatically changed environment. Entire business models, such as those that were dependent on securitization and wholesale funding, have become obsolete. Capital and liquidity constraints continue to restrict supply of new lending, while an uncertain economic environment continues to dampen demand.
Against this uncertain backdrop, retail banks have been making substantial investments in strengthening risk management processes and governance. Many weaknesses have been addressed and risk management now wields considerable authority over business decision making. Boards and executive management teams have been sanctioning substantial investment, and trying to drive change in behaviour across the institution.
Yet weaknesses and challenges undoubtedly remain. Relationships with regulators have become fractious and demanding for many institutions, while ongoing problems with data and IT infrastructure continue to impede the rapid decision-making that retail banks now expect. Cultural challenges also remain, particularly with building greater understanding and awareness of risk across the business.
These challenges highlight a necessary change in the perception of risk management, and the skills and capabilities required. Prior to the crisis, there may have been too much focus on the quantitative aspects of the role. Now, however, there is a greater understanding that risk management is as much about soft skills and communication with a wide variety of stakeholders, as it is about numbers and models.
Understanding the challenges faced by CFOs and other decision makers within key financial services sectors like insurance, investment banking and retail banking can be applied across the board for Asia’s business community. For instance, the Asian Shadow Financial Regulatory Committee (ASFCR), a group of independent experts on regional economic policy issues, has called for the creation of risk management committees, led by an independent risk officer to eliminate management misconduct. It’s evident that risk management across Asia’s leading industries, such as manufacturing and technology, will play a crucial role in leading the global recovery. With this in mind, recent developments of risk management in Asia’s financial services industry offers several key takeaways for the region’s CFOs.
- Setting the tone. There is an emerging consensus that good risk management starts at the top of the organization. Board members need to have sufficient knowledge and information to be able to challenge and question executive management, and they need to devote an appropriate amount of time to understanding the business.
Many institutions are addressing these shortcomings by forming board-level risk committees. More important than the existence of a risk committee is the content of the board’s discussions and their interaction with executive management and the risk function. Boards across the industry are facing a significant increase in their workload and responsibilities. Key among these is the need to set and monitor the overall risk appetite, which should articulate the institution’s willingness to take risk in order to pursue business objectives.
- War for talent. Greater expectations from boards, combined with sustained pressure from regulators and other stakeholders, are placing significant pressure on risk functions. With many financial institutions actively recruiting and embarking on major risk projects, risk expertise is becoming a scarce and expensive commodity.
But beyond the technical capabilities required by risk professionals, there is also a growing emphasis on softer skills, such as communication and effective management.
- Breaking down silos. Within the risk function itself, there is a recognition that not enough has been done to encourage communication across risk silos. In many institutions, market and credit risk were managed by different teams using separate systems, which made it difficult to gain an overall aggregate view of risk exposures, and meant that some problems inevitably fell through the cracks. Recognizing these shortcomings, some banks are seeking to combine or improve co-ordination between risk departments.
Although financial institutions are making progress on aggregating risk exposures at the enterprise level, a firm-wide view of risk remains a work in progress for the vast majority of them.
- The devil is in the data. Accurate and reliable data are the cornerstones of good risk management, yet continue to be an area of considerable weakness. The problem is especially acute at multinational banks and insurers that have grown through acquisitions.
An important challenge for many firms is that they have multiple or disparate legacy systems that have built up over a period of years. Reconciling these disparate systems across multiple borders and currencies requires a significant amount of manual intervention. This time-consuming and resource-intensive process creates a time delay in the availability of data—a major problem when an institution is trying to formulate a response to an unexpected event, such as the collapse of a counterparty.
Safeguarding the Future
Risk management is viewed as one of the culprits of the financial crisis but it should also be seen as one of the main instruments for safeguarding the future. Although actions taken now should not be expected to prevent every future crisis, some lessons have been learned and many organizations are moving towards a more sustainable approach to the balance between risk and reward. There is still significant progress to be made, not least in building a firm-wide risk culture and ensuring that there is sufficient, timely information available to make appropriate decisions.
The risk function has now attained an unprecedented level of authority. With regulators, boards and executive management desperate to ensure that the mistakes of the past are not repeated, risk management has become central to the strategic agenda and few major decisions will now be taken without involving senior members of the risk function. Chief risk officers have a seat at the top table and the ear of the board, and the regulatory process points to a deeper role for risk management at every level of the organization.
But this new mantle of authority needs to be used wisely. Although risk must retain its controls and enforcement responsibilities, both CFOs and CROs in Asia should be careful to strike a balance between the prevention of excessive risk-taking and a more constructive role in helping the business to achieve its broader objectives. Across all industries in the region, it may be tempting to err on the side of prevention, but the risk function must also build a more trusting, positive relationship with the revenue-generating departments while still preserving its objectivity and independence.
Moreover, it should be recognized that the level of authority in Asia currently enjoyed by the risk function led by the financial services sector could be fleeting. Although risk management is at the top of the agenda now across the region, and is attracting investment and stakeholder attention, the key question is whether this situation will endure when market conditions turn the corner and the pressure to improve financial performance returns. Efforts and investments made now in Asia will determine whether risk has a seat at the top table, causing a ripple effect across global markets, through the good times as well as the bad.
About the Author
Don Cooper-Williams is executive director at SAS Asia Pacific.