Rebuilding Trust Through Better Risk Monitoring

A recent op-ed article in the Financial Times by noted author and professor, Frank Portnoy, raises the question about the need to hold corporate managers personally accountable for gross negligence when they do not monitor risks. Mr. Portnoy proposes having senior executives at major banks certify that they are actively monitoring the risks taken in areas such as trading desks that have resulted in recent losses due to rogue trading activities. He summarizes his view in the following way.

Current rules permit directors and officers to avoid personal liability for gross negligence. That is a wise rule for most business decisions: courts are generally not skilled at assessing business judgment. But risk is different. Why should a bank manager who is grossly negligent in supervising risk avoid liability?

Shareholders might never be able to understand the risks of modern banks, and current regulatory approaches will not give them much confidence. But if they knew that senior managers had agreed to be personally liable for gross negligence in monitoring risk, they might trust the banks more. Without trust, it is hard to see how banks can recover.

Mr. Portnoy is correct to promote the notion of greater accountability for monitoring risk. However, attaching personal liability to executives may not necessarily be the best method. It would be very difficult to define what is an adequate level of risk monitoring since it really differs for every institution. That is why the industry is so heavily regulated. However, Mr. Portnoy is certainly on point in the fact that stronger risk monitoring is needed to rebuild trust in banks.

Now Is Not The Time to Reduce Investment in Risk Management

As we head into the second half of 2011, the economic recovery here in the US and abroad is taking hold much more slowly than most expected. Given the modest recovery, some executives may be looking to slash expenses to boost profitability and achieve their near-term goals. However, while tempting, cutting staff and investment in the wrong areas may prove to be a company’s undoing. For financial services companies, this is particularly true in the area of risk management because they are still mending their practices in the wake of the recent financial crisis.

According to the Financial Times, US regulators are keenly aware of what may be on the minds of bank executives and are issuing warnings to avoid cutting risk management budgets. According to Michael Alix, a senior vice-president at the Federal Reserve Bank of New York who heads the risk-management function within the regulator’s financial-institutions supervision group, the regulators are paying close attention to any plans to lower investment in risk management programs. “We haven’t seen it yet, but we’re vigilant,” says Alix.

Sacrificing the progress made in strengthening risk management programs at this precarious stage of recovery is certainly short-sighted and could lead to even greater problems for companies looking to weather the next storm.

FDIC Calls for Risk Management Improvements

This week, the Federal Deposit Insurance Corporation (”FDIC”) released a special edition of its Supervisory Insights publication focusing on the recent foreclosure crisis in mortgage banking. In the report, the FDIC provides additional perspective on the deficiencies in internal processes, staffing and control that resulted in a foreclosure moratorium by several of the largest mortgage servicing institutions in late 2010. The FDIC worked with the lead regulatory agencies of the fourteen largest mortgage servicers in the United States to conduct extensive reviews of current foreclosure practices.

The reviews uncovered many common issues among the mortgage servicers. The FDIC noted the following, “concerns included lax foreclosure documentation, ineffective controls over foreclosure procedures, and deficient loss mitigation procedures and controls. Many institutions failed to commit resources sufficient to manage responsibly the rapidly growing volume of mortgage loans in default or at risk of default. Weak governance and controls increased legal, reputational, operational, and financial risks while creating unnecessary confusion for borrowers.”

While the report focuses specifically on the foreclosure shortcomings, it can also serve as a reminder of the value of strong internal controls and risk management practices. As our business processes grow to be more complex and interconnected, the risks inherent in the processes grow exponentially. Unchecked, these risks can quickly propel a business into a full-blown crisis.

Viewing Risk in a Different Way

Several previous blog entries have explored the notion of approaching Risk Management in a new way. Rather than simply focusing on mitigating risk through various methods, companies and individuals alike should strive to seek a greater understanding of risk to improve their decision-making and maximize value to the organization. By doing so, an ever-present view of risk and opportunity will propel an organization from focusing purely on Risk Management to a new state of Risk Mindfulness.

David Spiegelhalter, leading risk expert and professor at Cambridge University, supports this view in a recent video (see below) that is both enlightening and humorous. Through his real-life examples, Professor Spiegelhalter provides a unique view of how we as humans typically view risk. His lessons are particularly relevant as we continue our struggle to emerge from the financial crisis of 2008. As he concludes, "One of the biggest risks is being too cautious."

CNBC Profiles Internal Audit & Risk Management Practices

Earlier this week, the Institute of Internal Auditors' Richard Chambers was interviewed by CNBC on the evolving nature of risk management practices in light of the recent financial crisis. Mr. Chambers emphasized the need for corporate boards to set the risk appetite and work with management as well as the internal auditors to monitor the level of risks. In addition, he noted that compensation programs still need to be improved such that risk metrics are included in pay determination.  To view the entire interview, click below.

Wheelhouse Advisors Joins the Business Finance Expert Network

Business Finance Magazine recently invited John A. Wheeler, Managing Principal at Wheelhouse Advisors, to join its Expert Network as a regular columnist for their online publication called the Big Fat Finance Blog. John will be contributing articles and thought leadership on issues in Finance & Risk Management in his own blog called the Risk Vortex. Along with the other columnists, the blog is intended to arm finance professionals with innovative ideas and best practices that help finance organizations create value. For up to date information on the events and trends that may impact your Finance & Risk Management organizations, be sure to subscribe to the Risk Vortex by clicking here.

The Human Element of Risk Management

Over the past decade, risk management became more about quantitative models and less about behavioral models. Unfortunately, as we discovered during the recent financial crisis, even the best quantitative models cannot predict the result of misguided behavior. In this week's edition, Bloomberg Businessweek magazine provides a special focus on risk management with interesting viewpoints such as this:

As business has grown more complex, we have developed elaborate protocols, systems, frameworks, and approaches to manage risk. A consequence of putting science at the forefront of these risk management systems has been a stripping of human behavior out of the risk model.

The future of risk management lies in an ability to incorporate and inspire more of the behaviors we want, finding new models to map, monitor, intervene, support, and react to the behaviors of individuals and groups—both the behaviors we want to encourage and those we'd like to avoid. Critically, this taking account of behavior means we need a much sharper comprehensive strategy for corporate culture, so that our models are founded on the way "things really happen around this place."

Examining the human element of risk management is a key part of Wheelhouse Advisors' upcoming workshop, Navigating Risk: From Crisis to Innovation. To learn more about the workshop and enroll for this groundbreaking event, please visit www.oldedwardsinn.com/navigatingrisk.

More Change is on the Way

More change regarding how U.S. public companies disclose details about their risk management programs is on the way. The Wall Street Journal recently reported that the Securities and Exchange Commission is re-evaluating disclosure requirements on the heels of financial regulatory reform. Here is what they had to say.

The Securities and Exchange Commission will act quickly to revise corporate risk disclosure requirements and also consider more sweeping recommendations on executive compensation disclosures and easy-to-read corporate filings, SEC Chairman Mary Schapiro said Friday. The SEC also is looking at trading activities such as hedging, shorting, arbitrage and certain types of market orders, to ensure that all investors have access to a highly complex and technologically sophisticated trading market, Ms. Schapiro said in the text of prepared remarks.

SEC staffers now are re-evaluating all corporate filing forms and disclosure requirements, asking whether the information that is being sought is "still relevant," Ms. Schapiro said. "After this review, I expect the staff will present individual recommendations that we can act on quickly, such as revising the risk disclosure requirements," Ms. Schapiro said in the text of her speech to the Society of Corporate Secretaries and Governance Professionals.

Companies should be prepared to provide more substantive information regarding their risk programs. Wheelhouse Advisors can help your company with a complimentary risk program diagnostic review. For more information, email us at NavigateSuccessfully@WheelhouseAdvisors.com.

Federal Reserve Issues Final Guidance on Risks & Incentive Pay

Yesterday, the U.S. Federal Reserve along with the Office of the Comptroller of the Currency, the Federal Deposit Insurance Corporation and the Office of Thrift Supervision issued their final guidance on incentive compensation for financial institutions. This final guidance is based on proposed guidance issued in October 2009 and a series of incentive compensation reviews by the Federal Reserve and the other supervisory agencies. The agencies will conduct a second round of reviews later this year to evaluate the financial institutions compliance with the new guidance. Here is what the Federal Reserve had to say about their next steps.

"Many large banking organizations have already implemented some changes in their incentive compensation policies, but more work clearly needs to be done," Federal Reserve Governor Daniel K. Tarullo said. "The Federal Reserve expects firms to make material progress this year on the matters identified as we work toward the ultimate goal of ensuring that incentive compensation programs are risk appropriate and are supported by strong corporate governance."

During the next stage, the banking agencies will be conducting additional cross-firm, horizontal reviews of incentive compensation practices at the large, complex banking organizations for employees in certain business lines, such as mortgage originators. The agencies will also be following up on specific areas that were found to be deficient at many firms, such as:

• Many firms need better ways to identify which employees, either individually or as a group, can expose banking organizations to material risk;


• While many firms are using or are considering various methods to make incentive compensation more risk sensitive, many are not fully capturing the risks involved and are not applying such methods to enough employees;


• Many firms are using deferral arrangements to adjust for risk, but they are taking a "one-size-fits-all" approach and are not tailoring these deferral arrangements according to the type or duration of risk; and


• Many firms do not have adequate mechanisms to evaluate whether established practices are successful in balancing risk.

In addition to the work with the large, complex banking organizations, the agencies are also working to incorporate oversight of incentive compensation arrangements into the regular examination process for smaller firms. These reviews are being tailored to take account of the size, complexity, and other characteristics of these banking organizations.

Having a solid understanding of your risk profile and the resulting impact of incentive programs is now critical for financial institutions as well as companies in other industries. Wheelhouse Advisors can help you develop stronger incentive programs with a thorough analysis of your risks.  To learn more, visit www.WheelhouseAdvisors.com.

Risk Blindness at BP

In the pursuit of profit, sometimes a company becomes blind to risk.  This is most evident in the latest debacle of British Petroleum ("BP") with the oil spill in the Gulf of Mexico. While their recent offshore deepwater drilling posed great environmental risk, BP experienced the results of poor risk management onshore as well.  According to the New York Times, BP's current CEO faced similar challenges in 2007.  Here is what happened back then:

In 2007, when Mr. Hayward first took over as chief executive, BP settled a series of criminal charges, including some related to the explosion of BP's Texas City, Tex., refinery, and agreed to pay $370 million in fines. Admitting that the company's operations had failed to meet its own safety standards and requirements of the law, Mr. Hayward pledged to improve BP's risk management. Following the Deepwater Horizon explosion, Mr. Hayward conceded that the company had problems when he took over in 2007. But he said he had instituted broad changes to improve safety, including setting up a common management system with precise safety rules and training for all facilities.

Some analysts say the safety problems indicate that BP has not yet reined in the culture of risk that prevailed under Mr. Hayward's predecessor, who transformed BP from a sleepy British oil producer into one of the world's top explorers through the acquisitions of Amoco and Atlantic Richfield.

A strong culture dedicated to risk management is essential for companies who are looking to succeed in the long run. BP's current crisis is a prime example of the perils of ignoring the importance of strong risk management practices.

Growing Web of Risks in Today's Business World

As many companies look to better understand the complex risks within their organization, recent events are pointing to the increasing need to understand the even more complex risks posed by partner organizations. Richard Thaler, professor of economics and behavioral science at the University of Chicago, provided his view in the New York Times this week.

AS the oil spill in the Gulf of Mexico follows on the heels of the financial crisis, we can discern a toxic recipe for catastrophe. The ingredients include risks that are erroneously thought to be vanishingly small, complex technology that isn’t fully grasped by either top management or regulators, and tricky relationships among companies that are not sure how much they can count on their partners.

For the financial crisis, it has become clear that many chief executives and corporate directors were not aware of the risks taken by their trading desks and partners. Recent accusations against Goldman Sachs suggest the potential for conflicts of interest among banks, investors, hedge funds and rating agencies. And it is clear that regulators like the Securities and Exchange Commission, an agency staffed primarily with lawyers, are not well positioned to monitor the arcane trading strategies that helped produce the crisis.

The story of the oil crisis is still being written, but it seems clear that BP underestimated the risk of an accident. Tony Hayward, its C.E.O., called this kind of event a “one-in-a-million chance.” And while there is no way to know for sure, of course, whether BP was just extraordinarily unlucky, there is much evidence that people in general are not good at estimating the true chances of rare events, especially when human error may be involved. There was another major blow-out in the gulf 31 years ago by the Mexican rig Ixtoc I. So was this really a one-in-a-million risk?

In the current spill, the problems of assessing risk were complicated by the teamwork required among BP; Transocean, which owned the rig; and Halliburton, which had provided services like concrete work. “Of the 126 people present on the day of the explosion, only eight were employees of BP,”reported Ian Urbina in The New York Times. “The interests of the workers did not always align.”

Certainly, before a company can fully understand the growing web of internal and external risks inherent in their business activities, the company must have a disciplined approach to risk management. A strong enterprise risk management program can help in this regard. If your company is looking to implement or improve its enterprise risk management program, Wheelhouse Advisors can help. Visit www.WheelhouseAdvisors.com to learn more.

Who Can Afford Not to Have an ERM Program?

Many people in the corporate world routinely argue that Enterprise Risk Management is simply a cost that few companies can afford to implement. However, time and again, it seems as though exactly the opposite is true. Companies can't afford not having a robust ERM program. In reading today's Wall Street Journal, one might find the following story on the off-shore oil drilling disaster to be eerily similar to the recent financial crisis. To make the case, financial terms have been included in parentheses to illustrate the point.

Without adequately planning for trouble, the oil business (financial services industry) has focused on developing experimental equipment (complex derivatives) and techniques (synthetic asset backed securities) to drill (operate) in ever deeper waters (more opaque markets), according to a Wall Street Journal examination of previous deepwater accidents (financial meltdowns). As drillers (bankers) pushed the boundaries, regulators didn't always mandate preparation for disaster recovery or perform independent monitoring.

The Minerals Management Service (Federal Reserve, OCC, OTS, FDIC, etc.), the government agency that oversees offshore drilling (financial services), in recent years moved away from requiring specific safety measures (capital requirements) in offshore drilling (trading activities) and instead set broad performance goals (guidance for internal risk modeling) that it was up to the industry to meet. In joint MMS-Coast Guard (Federal Reserve, OCC, OTS, FDIC, etc.) hearings into the Deepwater Horizon accident (Bear Stearns, Lehman Brothers, AIG insolvency), Michael Saucier, an MMS official, testified that the agency "highly encouraged," but didn't require, companies to have back-up systems (specified risk limits) to trigger blowout preventers (increases in capital) in case of an emergency.

While there are many estimates of the cost to British Petroleum to deal with the Deepwater Horizon oil spill, the minimum consensus estimate right now is around $12-13 billion. Add to that estimate the recent market capitalization loss of nearly $50 billion and the case for having a robust ERM program seems fairly straightforward.

Diagnosing ERM Problems

As we emerge from the financial crisis and global economic downturn, many companies are beginning to realize the need for a comprehensive review of their Enterprise Risk Management (“ERM”) programs.  While some executives may think that their program is sufficient, they simply may have a false sense of security because they have just survived the recent crisis.

In reality, most organizations have been focused purely on survival and have allowed their more forward-looking risk management practices to take a back seat.  In addition, in order to weather the financial storm, some companies looked to risk management organizations for cost savings and scaled back their infrastructure and resources.  Ironically, it is the companies that have survived the crisis relatively unscathed that may be the least prepared and the most at risk for a future loss event.

So, how do you know how healthy your ERM program is today?  The best and most reliable way is to conduct an independent, diagnostic review of the program.  A diagnostic review should focus on two main components of the ERM program – the level of desired maturity and the core foundational elements.  First, a company needs to determine what level of maturity they are seeking to achieve.  This is based on a number of factors including the size of the company, the nature and complexity of the business, and the external environment in which the business operates.

After determining the desired maturity, the company should examine the core foundational elements that form the ERM program itself.  A comprehensive review of these elements will help the company understand both the progress toward the desired maturity level as well as the major gaps that may exist in the foundational elements.

Much like an annual physical check-up exam, it is a good idea to perform a diagnostic review of your ERM program on a periodic basis to ensure that it is providing the expected level of risk management discipline within your organization.  Wheelhouse Advisors has designed a quick and effective review to provide companies an independent view at a reasonable cost.  For more information, feel free to email us at navigatesuccessfully@wheelhouseadvisors.com.

How Mature is Your Risk & Control Program?

During the past decade, many significant events occurred that placed greater demands on how companies manage their risks.  At the beginning of the decade, we experienced the financial downturn associated with the bursting of the high tech/internet bubble.  Then, we had the after effects of the September 11th terrorist attacks.  Corporate accounting scandals at Enron and WorldCom created new financial reporting challenges in the form of the Sarbanes-Oxley Act of 2002.  Now, we are finally beginning to emerge from one of the greatest financial meltdowns in American history.  All the while, companies have been trying to keep pace with ever increasing levels of risk and regulation.

Much of the fallout from the financial crisis of 2008 can be attributed to the lack of coordination and integration of risk management practices at individual firms as well as across entire industries.  To be successful at managing risk going forward, companies must begin to examine how they are currently focusing their efforts and how they need to evolve their overall risk and control program.

The evolution path for most risk and control programs can be broken into four distinct stages – Developing, Implementing, Improving and Integrating (see figure below).   As companies begin to take a more focused approach to managing risk, they usually begin by simply reacting to regulatory demands or recent negative events that have occurred.   In this initial “Developing” stage, companies may create ad hoc task forces or assign individual teams to address the risks.

However, most companies begin to see the need for a more formal, enterprise-wide approach and enter the “Implementing” stage.  Here, a risk champion is typically named, standards are created and the various teams begin to align and share information.  Once the sharing of information begins, both horizontally and vertically through the company, inefficiencies and gaps become apparent.

Companies then move to the “Improving” stage in order to streamline processes and adopt best practices.  Finally, once the program has matured into an efficient mechanism on its own, it should be fully integrated into the business itself – at all levels.  It is this “Integrating” stage of evolution that is the holy grail of Enterprise Risk Management.

Where is your company on the evolution path?  What obstacles are you facing as you look to progress from one stage to another? Wheelhouse Advisors can provide both unique insight and practical solutions to help you reach the desired level of maturity.  To learn more, visit www.WheelhouseAdvisors.com.

Risk Management Moving to the Fore at Board Meetings

Risk management is increasingly moving to the fore in boardrooms across corporate America.  At least that is what some board members shared with finance professionals last week at a conference in Orlando, Florida.  According to a report in CFO magazine, risk management concerns among others are driving the desire for more exposure from the finance team.  Here is a summary of their report.

With board members more concerned about risk management and succession planning these days, CFOs should make sure they — and their staffs — have a strong presence in the boardroom, a group of retired CFOs-turned-board members told financial executives attending the CFO Rising conference in Orlando last Wednesday.  "The board wants to make sure they hear all opinions," said Ellen Richstone, former finance chief of several public companies, including Sonus Networks, and now on the board of Blue Shift Technologies. "They don't want to hear just the CEO." If the CFO and other members of the management team aren't available to the board, it sends up a red flag, she said.

Any red flags at your company's board meetings due to a lack of involvement by the finance team?  If so, there is no time like the present to remedy the situation.

Back to the Future for Banks

The anticipated financial regulatory reform from the Obama administration may be surfacing on the heels of a dramatic defeat of the Democratic candidate in the race for the Massachusetts Senate Seat vacated by the late Ted Kennedy.  The defeat results in a loss of the Democratic super-majority in the U.S. Senate and a potential defeat of the much heralded health care reform bill.  The Wall Street Journal announced the President's next move.

President Barack Obama on Thursday is expected to propose new limits on the size and risk taken by the country's biggest banks, marking the administration's latest assault on Wall Street in what could mark a return – at least in spirit – to some of the curbs on finance put in place during the Great Depression, according to congressional sources and administration officials.

The proposal represents a sharply different philosophical shift from the view of banking over the last decade, which saw widespread consolidation among large financial institutions to create huge banking titans. If Congress approves the proposal, the White House plan could permanently impose government constraints on the size and nature of banking.

With this move, the President is certainly looking to overcome his health care disappointment by garnering public support for a return to tighter restrictions on the nation's banks.  Given the current mood among the electorate, his probability for success in this arena is high.

Getting Ahead of the Risk Curve

In an acknowledgement that the problems that led to the financial crisis of 2008 have not been fully resolved, the Bank for International Settlements ("BIS") in Basel, Switzerland is seeking to address a return of excessive risk-taking in meetings this weekend with top financial leaders from around the world.  The Financial Times reported yesterday that the current low rate environment coupled with ample liquidity has set the stage for another potential crisis.  Here is what they had to say.

The Bank for International Settlements will gather top central bankers and financiers for a meeting in Basel this weekend amid rising concern about a resurgence of the “excessive risk-taking” that sparked the financial crisis.  In its invitation, the BIS cited concerns that “financial firms are returning to the aggressive behaviour that prevailed during the pre-crisis period”.  The meeting comes at a moment of intense uncertainty, with the global economy’s tentative recovery shadowed by “the overhang of private-sector debt and rapidly rising public debt”, and high unemployment.

It is a good sign that the BIS and others are looking to get ahead of the risk curve.  What remains to be seen is the reaction from the leadership of major financial institutions and the resulting behavior within the markets.

Rude Lesson in Risk Management

A leading risk management expert and chief risk officer at a major U.S. financial institution offered his insight on risk management practices last week in the Columbus Business First Journal.  His views are candid and becoming more common as the dust begins to settle from the recent financial crisis.  Here is what he had to say.

Kevin Blakely, senior executive vice president of Huntington Bancshares Inc. in Columbus and its chief risk officer said years ago, things were relatively simple. “Most of our risk was centered in credit risk – lending to individuals and companies, and gauging our ability to get that money back,” he said. Until this past summer, Blakely had been president of the Philadelphia-based Risk Management Association. But as companies got bigger and financial products got more complex, financial institutions developed mathematical models to measure risk. They worked well, he said, but by the mid-1990s banks were depending on them too much. “We began to view them as the answer, rather than as one more input before you get to the answer,” Blakely said. “That was one of the rude lessons we learned over the last couple of years. As an industry, we weren’t as smart in the business of risk management as we thought we were.”

The false sense of security placed in risk management was certainly a rude lesson for many companies as they focused on quantitative models that told them what they wanted to believe.  A balanced view of both quantitative and qualitative factors is critical to an effective enterprise risk management program.

JP Morgan Chase CEO Discusses Risk Management

Yesterday, JP Morgan Chase CEO Jamie Dimon shared his views on the financial crisis with Charlie Rose at the Securities Industry and Financial Markets Association annual meeting in New York.  In the interview, Mr. Dimon reflected on risk management approaches taken by many financial institutions leading up to the crisis.  He stated, "You should never rely solely on VaR, Basel I or Basel II for risk management practices.  If you did, it was a mistake."   He went on to explain that sound risk management practices require both quantitative analysis and management judgment to be effective.  He also noted that there are legitimate failures in the application of the Basel II Capital Accord that left many institutions with insufficient capital positions.   His full remarks can be viewed in the video web link below.

Jamie Dimon speaks with Charlie Rose at SIFMA Annual Meeting

Back to the Drawing Board on Derivatives Regulation

U.S. House Financial Services Committee Chairman Barney Frank (D-MA) distributed a proposal for derivatives regulation this week and it was the subject of a hearing by the committee yesterday.  A major part of the discussion centered on a potential loophole that would allow many corporations, if not all, to avoid the new regulation altogether. Here is what Bloomberg.com reported about the hearing and draft legislation prepared by Chairman Frank.

A plan offered by the Obama administration would subject all swaps dealers and “major market participants” to new regulations for capital, business conduct, record-keeping and reporting. Frank’s version would exempt corporations from that definition if they use derivatives for “risk management” purposes.

While Frank’s proposal is a “step in the right direction,” its “ambiguous” definition of risk management may leave a large number of corporations unregulated, Henry T.C. Hu, director of the SEC’s new division of risk, strategy and financial innovation, told the committee.

“As just about all swaps could be defined as being used for risk management purposes, we’re concerned that unintentionally the category of ‘major swap participant’ could have been narrowed so significantly, or even to a null set,” CFTC Chairman Gary Gensler told reporters after the hearing.

“Major hedge funds” may be excluded from oversight, as may the mortgage-finance companies Fannie Mae and Freddie Mac “because of course the government-supported enterprises use swaps for risk management purposes,” Gensler said.

It looks like Chairman Frank may need to re-educate himself on the use of derivatives and go back to the drawing board on this proposal.