Introduction

Events over the past 18 months have transformed the way we look at risk management and question marks have been raised over industry practices that were previously deemed to be sound. As 2009 approaches, this Executive Summary examines the prevailing risk management landscape in the wake of 18 of the most turbulent months in banking history. Consideration is given both to the nature of the crisis and to how institutions can avoid the mistakes that have led many firms to the precipice in 2008.

Key findings

• The evolution of the crisis – There is not one single point that can be marked off from when market sentiment moved from fear to abject, flailing panic. However, a key occurrence was the outright failure and descent into bankruptcy of the bulge bracket Lehman Brothers franchise.
• Counterparty risk – The collapse of Lehman brought chaos to the market place. Indeed, even confusion and rumour can cause chaos and large scale losses. To avoid any such uncertainty, dealers must ensure that their credit systems are able to compile detailed exposures to each of their large scale counterparties on an end-of-day basis by the opening of business the subsequent morning – in many instances, calculating exposure to Bear and Lehmans took weeks rather than days.
• Market risk – VaR fails to account for potential systematic risk events, fat-tails, black swans or whatever term you wish to use for unlikely but bad things happening to a portfolio. Enough has been written by Lepus and other observers for firms to be aware that it is necessary that the limitations of VaR be impressed upon senior management, and these limitations be countered through rigorous stress testing.
• Stress testing liquidity risk – There are a number of requirements for a stress test looking to examine liquidity risk issues. These tests must include both firm-specific and systemic events and their overlapping nature. Tests need to examine both extreme shocks as well as progressive events that will take their time to play out. In some way, a test needs to take into account implicit as well as explicit risks and potential damage of a firm’s actions to its franchise.
• Suitability of the ICAAP – Whilst it was acknowledged by Lepus associates that there is little need for new regulation, it was felt that current regulation certainly needs to be enforced with more rigour, particularly in relation to the ICAAP. To this end banks also certainly need to consider the relevance of their own internal regulatory processes.
• Risk culture and senior management – The degree of significance that is imparted on senior risk management to define, articulate, communicate, monitor and enforce a suitably robust risk culture should not be underestimated. It is at the CRO level, supported by heads of risk streams, that the true essence of a firm’s risk culture is dictated. At this level, if the CRO is sufficiently strong in his or her assertions, he or she has the ability to set the risk agenda and ensure that it is adhered to throughout the firm.
• Communication of risk – Communication is not just a case of parroting figures through for a rubber stamped approval. Risk management must be given sufficient independence to ensure that their inputs and decisions can be considered free of the influence of revenue generating business units and they should be heavily involved in the approval of new product lines and large scale bespoke transactions.
• Solutions – In the wake of the current crisis the foundations and basic assumptions around risk management will inevitably change and evolve, to try and prevent a similar crisis occurring in the future. Research highlighted a number of solutions such as taking a more proactive approach with regulators and looking at the risk appetite from the bottom up.

Conclusion

As the full extent of the credit crisis starts to hit home, there is a sense of inevitability that pervades the risk management function within the banking industry. The post-mortems are already underway in order to try to understand exactly what wrong from a risk perspective but whilst there is plenty of finger pointing and accusations as to who is to blame, there is little clear consensus as to how risk management will evolve out of this crisis. There is certainly an acceptance that certain things will have to change, however, there is little clarity on what will constitute best practice.

Nevertheless, what is apparent even at this early stage, is that one of the fundamentals of the future risk management organisation will be the need to establish a much more pervasive culture around risk. Whilst 18 months ago many banks were confident that they had comprehensively communicated the risk message, it is apparent now that this confidence was misplaced. The reasons for this may be many fold and certainly vary from institution to institution, however, in a number of cases traders ignored the stated appetite for risk taking, believing it to be a hindrance to their efforts to generate as much revenue for the bank as possible. This discord has resulted in a number of banks involving themselves far more in certain businesses than they would have liked, with inevitable consequences.

To receive a free copy of this report, please send your name, job title, address and phone number to marketing@lepus.com.

Tagged with: Executive Summary, risk