Reckless Drivers at Lehman Brothers

Today, the U.S. House Financial Services Committee will conduct a hearing to examine the failure of Lehman Brothers. One of the panelists slated to testify is the bankruptcy court appointed examiner, Anton R. Valukas.  Mr. Valukas will testify that like many financial services firms, Lehman Brothers had a robust risk management program.  However, Lehman Brothers' fatal flaw was the fact that it routinely overrode the risk controls and limits to achieve greater short-term profits.  Here is what Mr. Valukas found.

We conducted an extensive investigation to learn how Lehman managed, monitored and limited its exposure to risk. Lehman had adequate corporate governance procedures in place. It had quantitative risk models that accurately calculated risk and that accurately warned that Lehman was taking on significant levels of risk in excess of the limits generated by the models. Lehman’s procedures included reporting of the limits, and exceedances of the limits, to senior management and the Board.

But we found that Lehman was significantly and persistently in excess of its own risk limits. Lehman management decided to disregard the guidance provided by Lehman’s risk management systems. Rather than adjust business decisions to adapt to risk limit excesses, management decided to adjust the risk limits to adapt to business goals.

Much like a reckless driver who consistently exceeds speed limits and other traffic laws, Lehman Brothers eventually crashed.  In the short-term, the reckless driver may get to his/her destination quicker.  However, it is at the risk of not only his/her own life, but also the lives of everyone else in the way.

Reputation Is Everything

In last month's issue of Operational Risk & Regulation magazine, Goldman Sachs' operational risk management program and its focus on reputational risk was profiled.  The article focused on Goldman Sachs' use of scenario analysis in anticipating the magnitude of reputational risk events.  Scenario analysis exercises such as these are very useful tools to increase the risk awareness within an organization.  Here is a summary of Goldman Sachs' approach.

Goldman Sachs is using scenario analysis to study reputational risk, employing operational risk expertise within its broader risk management framework, according to its global co-heads of operational risk management, Spyro Karetsos and Mark D'Arcy.  The bank says it embraces events, even those creating more reputational risk exposure than financial risk exposure, into its framework.  "Franchise value is highly important within the organisation and managing reputational risk is a by-product of that," says Karetsos, who is based in New York. "While it is not our responsibility to quantify reputational risk, there is an internal process that measures our exposure to those risks that are difficult to quantify, one of which is reputational risk."

The timeliness of this story is ironic given the potential massive impact to the bank's reputation as a result of the fraud charges levied by the Securities and Exchange Commission on Friday.  Once the announcement was made, the bank lost close to $12.5 billion in shareholder value by the end of the trading day.  Whether that loss can be overcome remains to be seen.  However, it does prove that in business, reputation is everything.

Study Finds Most ERM Programs Still Immature

A recent study by researchers at North Carolina State University demonstrates the increasing need for more robust Enterprise Risk Management ("ERM") programs at the largest U.S. corporations.  The study points out that despite the recent financial crisis and resulting impact, most companies describe their ERM programs as "immature".  Here are a few of the study's findings.

1. Over 63% of respondents believe that the volume and complexity of risks have changed “Extensively” or “A Great Deal” in the last five years. This is relatively unchanged from the 62.2% who responded similarly in the 2009 report. Thus, most believe the world of risk is rapidly evolving in complex ways.


2. Organizations continue to experience significant operational surprises. Thirty-nine percent of respondents admit they were caught off guard by an operational surprise “Extensively” or “A Great Deal” in the last five years. Another 35% noted that they had been “Moderately” affected by an operational surprise. Together, these findings suggest that weaknesses in existing risk identification and monitoring processes may exist, given that unexpected risk events have significantly affected many organizations.


3. About half (47.5%) of respondents self describe the organization’s risk culture as one that is either “strongly risk averse” or “risk averse.” Given their admission of a highly complex and voluminous risk environment and the risk averse nature of the organization’s culture, one might expect these organizations to be moving rapidly towards more robust risk oversight processes.


4. Ironically, 48.7% of respondents describe the sophistication of their risk oversight processes as immature to minimally mature. Forty-seven percent do not have their business functions establishing or updating assessments of risk exposures on any formal basis. Almost 70% noted that management does not report the entity’s top risk exposures to the board of directors. These trends are relatively unchanged from those noted in the 2009 report.


5. Almost 57% of our respondents have no formal enterprise-wide approach to risk oversight, as compared to 61.8% in our 2009 report with no formal ERM processes in place. Only a small number (11%) of respondents believe they have a complete formal enterprise-wide risk management process in place as compared to 9% in the 2009 report. Thus, there has been only a slight movement towards an ERM approach since our 2009 report.

How mature is your company's ERM program?  Not sure?  Wheelhouse Advisors can help with a quick diagnostic review of your ERM program.  Visit us at www.WheelhouseAdvisors.com to learn more.

Out of Control

Yesterday, the U.S. Senate Subcommittee on Investigations conducted hearings to examine the largest bank failure in U.S. history and its role in the 2008 financial crisis.  The failure of Washington Mutual ("WaMu") was largely the result of years of increasing involvement in the mortgage-backed securities market.  Over a four year period, WaMu increased their securitizations of subprime mortgages from about $4.5 billion in 2003 to $29 billion in 2006.  Altogether, from 2000 to 2007, they securitized at least $77 billion in subprime loans.  At the same time, WaMu allowed its lending practices and controls to erode in the pursuit of greater loan production and short-term profits.  Here is a summary of the investigators' findings.

(1)   High Risk Lending Strategy. Washington Mutual (“WaMu”) executives embarked upon a high risk lending strategy and increased sales of high risk home loans to Wall Street, because they projected that high risk home loans, which generally charged higher rates of interest, would be more profitable for the bank than low risk home loans.

(2)   Shoddy Lending Practices. WaMu and its affiliate, Long Beach Mortgage Company (“Long Beach”), used shoddy lending practices riddled with credit, compliance, and operational deficiencies to make tens of thousands of high risk home loans that too often contained excessive risk, fraudulent information, or errors.

(3)   Steering Borrowers to High Risk Loans. WaMu and Long Beach too often steered borrowers into home loans they could not afford, allowing and encouraging them to make low initial payments that would be followed by much higher payments, and presumed that rising home prices would enable those borrowers to refinance their loans or sell their homes before the payments shot up.

(4)   Polluting the Financial System. WaMu and Long Beach securitized over $77 billion in subprime home loans and billions more in other high risk home loans, used Wall Street firms to sell the securities to investors worldwide, and polluted the financial system with mortgage backed securities which later incurred high rates of delinquency and loss.

(5)   Securitizing Delinquency-Prone and Fraudulent Loans. At times, WaMu selected and securitized loans that it had identified as likely to go delinquent, without disclosing its analysis to investors who bought the securities, and also securitized loans tainted by fraudulent information, without notifying purchasers of the fraud that was discovered.

(6)   Destructive Compensation. WaMu’s compensation system rewarded loan officers and loan processors for originating large volumes of high risk loans, paid extra to loan officers who overcharged borrowers or added stiff prepayment penalties, and gave executives millions of dollars even when its high risk lending strategy placed the bank in financial jeopardy.

These findings are not surprising in the aftermath of the financial disaster.  However, without significant oversight and change in the operations of financial institutions, a similar scenario will likely occur in the not too distant future.

What Makes a Risk Manager Effective?

An interview published in today's Wall Street Journal discusses the importance of risk management as a business discipline and the need for more formal training for professionals who dedicate themselves to the discipline. Gideon Pell, Chief Risk Officer at New York Life Insurance, provides his perspective on the increasing demand for risk management professionals.  He also offers some great insight on what makes a risk manager truly effective in an organization.  Here's what he had to say.

It's obvious that we're living in an uncertain economy. The idea of having a disciplined approach to risk management, to be able to look at risks holistically across the organization, to make sure you're not missing significant risks, is even more critical today than it was two or three years ago.

One lesson that we've learned from the last couple of years is that the institutions that failed had a lot of risk managers who were very smart and very quantitative but it didn't help them save their organizations. If you're not able to influence the organization that you're in, you're not going to be effective at your job. To be an effective risk manager, you have to have a good understanding of the business. You've got to have sound judgment and you have to be able to communicate effectively up and down the organization.

Mr. Pell is spot-on in his assessment of what makes an effective risk manager.  The challenge for many companies is developing talent to master both the quantitative and qualitative.  Risk managers must be practical and business focused in their approach to be successful.  For help designing a talent development plan, email us at NavigateSuccessfully@WheelhouseAdvisors.com.

Federal Reserve Focuses on Operational Risk

The Federal Reserve Bank ("FRB") has started to step-up its examination focus on operational risks in the nation's largest financial institutions as they seek to garner more supervisory authority through financial regulatory reform.  Not surprisingly, the FRB is looking at processes designed to support capital adequacy determinations, compliance with laws and regulations and compensation levels.  Operational Risk & Regulation Magazine provided the following report this week.

Although US regulators have not referred to the need to reform operational risk management regulation specifically, the Federal Reserve System has undertaken a series of horizontal reviews looking at op risk issues such as the Internal Capital Adequacy Assessment Process (Icaap), compliance risk and compensation. These are part of a broader programme of horizontal reviews looking at large, complex banking organisations (LCBOs).

As part of the same review, Fed supervisors are also reviewing compensation practices at regional, community and other banking organisations not classified as large and complex as part of the regular, risk-focused examination process. Ronald Stroz, assistant vice-president and head of the operational risk group at the Federal Reserve Bank of New York, commented during a panel discussion at OpRisk USA on March 24 this guidance will ensure incentives do not encourage excessive risk-taking, and that they are compatible with a sound risk management framework, supported by a strong corporate governance function with an active, effective board of directors that has risk management oversight.

Horizontal reviews of operational risk will continue in both frequency and intensity for the foreseeable future.  Are you prepared?  If not, visit www.WheelhouseAdvisors.com to learn how we can help.

Risk Management Moving to the Fore at Board Meetings

Risk management is increasingly moving to the fore in boardrooms across corporate America.  At least that is what some board members shared with finance professionals last week at a conference in Orlando, Florida.  According to a report in CFO magazine, risk management concerns among others are driving the desire for more exposure from the finance team.  Here is a summary of their report.

With board members more concerned about risk management and succession planning these days, CFOs should make sure they — and their staffs — have a strong presence in the boardroom, a group of retired CFOs-turned-board members told financial executives attending the CFO Rising conference in Orlando last Wednesday.  "The board wants to make sure they hear all opinions," said Ellen Richstone, former finance chief of several public companies, including Sonus Networks, and now on the board of Blue Shift Technologies. "They don't want to hear just the CEO." If the CFO and other members of the management team aren't available to the board, it sends up a red flag, she said.

Any red flags at your company's board meetings due to a lack of involvement by the finance team?  If so, there is no time like the present to remedy the situation.