I. INTRODUCTION

Spurred by regulators, financial institutions have

invested significant resources in risk management over

the last decade. An actuarial statistical approach to

estimates future losses based on past experiences was

used to create an illusion of control. Unfortunately,

markets are not actuarial tables. The magnitude of the

error became apparent once the crisis unfolded. For

example, Citibank is VAR, value at risk, at the end of 2007

was $190 mln. This means the maximum it could lose

over a 1 day period at the 99% confidence level was $190

mln. Citi’s actual 2008 losses exceed $40 B. Other

institutions with similar experiences include Merrill,

Wachovia and Washington Mutual. These losses triggered

massive shareholder value destruction resulting in dilutive

recapitalizations and replacement of whole managements.

Clearly, something is wrong with the current state of risk

management requiring a rethinking of the activity.

1

INTRODUCTION (continued)

  Institutions had moved further out on the curve

to maintain normal income growth. Risk was deemed

under control based on the twin illusions of liquidity and

risk distribution. In fact, rather than distribute risk, they

had concentrated risk. Liquidity evaporated once their

leveraged positions began losing value.

This article explores why this occurred and what

can be done to remedy the situation. What is needed is to

move risk management away from a hyper technical,

specialist control function with linkage to creation.

Instead, we need to move beyond risk measurement to

integrate risk into strategic planning, capital management

and governance. Enterprise risk management ERM,

provides the framework to integrate these functions.

2

II. CURRENT SITUTATION: What happened?

The financial services industry suffers from over

capacity and product commoditization. This has

pressured margins. Institutions increased risk exposure

to enhance nominal returns without increasing

shareholder value as reflected in Figure 1. They did those

on both sides of the balance sheets. Asset risk increased

by taking tall risk exposure inherent in many of the new

products with option like payoffs. For example, Merrill is

one day VAR increased by almost 5 times from 2001

through 2007. Although as previously noted, VAR has its

problems as a precise risk indicator, it directionally seems

correct in this circumstance. On the leverage side,

leverage levels increase dramatically. This was largely

accomplished by the large scale use of off balance sheet

vehicles. In fact, the large scale capital raising by banks

serves as a proxy for the undercapitalized or excessive

leverage to asset risk at banks. In Merrill’s case, that

totals almost $32B in the first half of 2008.

3

CURRENT SITUTATION: What happened? (Continued)

Flawed risk models contributed to the problem.

Overconfidence in the models created an illusion of control.

Profits were raising and the risk models failed to indicate any

concern. The models failed in several respects. First, they

failed to consider debtor behavioral changes. Ordinarily,

mortgages are reluctant to jeopardize the homes by

defaulting. Once they began viewing their real estate as an

investment, however, their behavioral changed resulting in

defaults once home prices fell below their equity in the

asset. Next, models risk is heavily dependent on data

frequency and availability. Thus, for new products with a

limited history, the models were useless. Finally, even if you

have the data, models are based on experience, not

exposures. Just because something has not occurred yet the

exposure exists. This is particularly true when dealing large

scale event risks or “Black Swans”.

4

CURRENT SITUTATION: What happened? (continued)

Perhaps, most concerning was the industry wide

governance breakdown. Directors were unaware of the

risk implications of strategic initiatives. For example, Stan

O’Neil strategy to match Goldman and become the market

share leader required assuming billions of additional risk.

Essentially, he was making a franchise bet. This involved a

large increase in risk appetite without any consideration of

negative scenarios. Next incentive arrangements

produced counterproductive behavioral changes. Strong

managers began exploring weak governance. Incentives

became short term and based on nominal income with

insufficient risk adjustments. Finally, risk monitoring was

hampered by faulty risk models, which failed to raise

concerns until it was too late.

The above factors illustrate that risk management

has lagged financial innovation. It has evolved into a

ritualistic measurement and prediction activity with little or

no power to influence behavior.

5

CURRENT SITUTATION: What happened? (continued)

Additionally, even within risk management,

organizational impediments exists. Individual risk

functions tent to operate as independent silos with

little or no strategic connection. Additionally, there is

limited consideration of business models and market

states when evaluation transaction risks. Literally, it is

failing to see the forest because of the trees. What is

needed is the integration of risk into strategic

planning, capital management and performance

measurement. This would combine business and risk

considerations into a single, whole-firm view of value

creation.

6

VALUE IMPLICATIONS OF RISK APPETITE CHANGES

Figure 1

CEfficient frontier

for business portfolio

Beta

Return

A = Current position

A B = Value destruction–Uncompensated risk

C = Target position – no value change

Zeta (value loss)

B

Risk

Alpha (value creation)

Capital requirement

7

D = True value creation

D

III. RISK STRATEGY FRAMEWORK

Financial institutions have invested heavily in risk

management. Yet, there is surprisingly little agreement

concerning the value proposition of risk management. Value is

created on the left hand side (LHS) of the balance sheet through

investment decisions. The value of risk is to ensure funding of

the investment plan by maintaining capital market access under

all conditions. This entails maintaining a total risk profile

consistent with r?????? targets. This requiring balancing LHS

asset portfolio risk with right hand side (RHS) capital structure.

Failure to do so can under mind the institutions strategic

position and independence. Examples include Citi and Lehman.

Viewed as such, risk management is a capital structure

decisions linking strategy and capital levels. Risk management

needs to support the institution’s corporate strategy, which

determines the risk universe faced by the bank organization as

outlined in Figure 2. Then, using traditional underwriting,

mitigation and transfer risk management techniques, you

determine those risks which the institution is competitively

advantaged to own and eliminate the reset. For example: local

8

III. RISK STRATEGY FRAMEWORK(continued)

institutions have an informational advantage regarding

evaluations of local clients. Thus, they should retain such

risk up to prudent concentration levels. Alternatively, risks

like interest rate risk, not be held unless the institution

possesses special information. Then, the retained risk would

be covered by capital consistent with a ratings goal, most

likely investment grade, to ensure capital market access

sufficient to fund the investment plan (see Figure 3). Viewed

in this light, risk management and capital can be seen as

interchangeable with capital being the cost of risk. In fact,

risk management is essential synthetical equity. Equally,

capital can be seen as substitute to risk management. The

key is to avoid a mismatch between the LHS and RHS of the

balance sheet.

The overall institutional risk level is dependent on

their risk appetite – the level of risk the organization is willing

to assume on both sides of their balance sheet in the pursuit

of their strategy. Risk

9

III. RISK STRATEGY FRAMEWORK(continued)

appetite is a relative term among stakeholders.

Usually aligned, there are instances when

management and stakeholder appetites differ, usually

leading to new management. Management risk

appetite is best expressed as a con???? as reflected in

Figure 4. The relevant risk constraint for most

managers is being replaced.

Unfortunately, many financial held large

amounts of risk in which they had limited competitive

advantages. This beta risk, while increasing nominal

income, failed to create shareholder value.

10

11

Need for financial flexibility

Risk management strategy

Corporate Strategy

Investment plan and opportunities

Business Model Operating cash flow forecast

volatility Frequency

US$ millions

Stakeholder(Investors,

Regulators and Rating Agencies)

perspective

Financial structure impact

And Ratings target

Cost of financial flexibility

12

3

4

Adapted from T. Oliver Leautier, Corporate Risk management for Value Creation(Risk Books, 2007)

DRIVERS OF RISK MANAGEMENT STRATEGYFigure 2

Figure 3 Connect Capital and Risk

to Investment Strategy12

Figure 3 Connect Capital and Risk to Investment Strategy

Risk and capital as inputs into strategic planning:Choice of Markets with attractive economics in which the organization enjoys a competitive advantage

Risk the organization is willing and able to accept in pursuit of its strategy

R/A level retention types capital buffer

Risks underwritten and retain comparative advantage

Capital relative to Rating Agencies, Regulators and Peers

Actual Physical Capital

Return capital to shareholders when actual capital exceeds need, or raise capital when need exceeds actual capital

Allocation to business units based on an economic capital determination

Strategy

Risk Appetite

Risk Assessment

Capital need

Capital Assessment

Capital Plan

Capital Allocation

Return on capital relative to cost of capital total risk facing firm risk appetite risk to be transferred net risk vs. capital need/level

??????

… and not just consequences

Which markets

How much risk

determines ?????

What type of risks based on

??????

How much capital do we

need vs. have?

Capital Assessment

Risk Appetite ContinuumFigure 3

13

Profit / Loss Distribution

Profit Warning – National city

Rating Watch – Fifth Third

Dividend cut – Citi

Downgrade – Morgan Stanley

Raise capital – Merrill

Management replaced – Prince, O’Neil Regulatory Action – Cease and Desist, Memorandum of Understanding

Failure – Bear, Lehman, WaMu

Risk Appetite ContinuumFigure 3

- 0 +

Probability

Profitability

14

Risk Appetite

Reconciled by Board

External Stakeholders

InternalStakeholders

CEO: Investment StrategyRegulators

Shareholders Agencies

Internal Risk AppetiteExternal Risk Appetite

CFOHow muchCapital do

I need

CROWhat Risks

Do IRetain

AssetPortfolio

CapitalManagement

CapitalRequired

CapitalAvailability

Capital Structure

RiskStructure

Value Creation

Economic Capital

(Use)

15

Risk Appetite Strategy Earnings Ratings

Business Model Strategic Objectives Annual Goals

Organizational Culture structure Shareholders

Risk Assessment

Risk Analysis

Risk Strategy

Infrastructure

Risk Identification

The ERM Funnel – Figure 7

P. Sobel, Auditor’s Risk Management Guide: Integrating Audit and ERM (CCH, 2007)

16

ExternalStakeholders

Regulators

Shareholders Rating Agencies

Assets(Return)

CapitalRequired(Risk)

CapitalAvailability/(Funding)

CapitalManagement

Value Creation

Portfolio ofEnterprise Risks

Portfolio ofCapital Resources

Capital Structure

Cost of Capital

Return onRisk

Risk Structure

Economic Capital(Use)

Match Internal/External

Risk Appetite

…You can lose money

External Risk Appetite

Not always in balance

17

Price

Time

Panic

Normal

Offer

Bid

Figure 5Asset Price Liquidity

DAR Control Framework

Asymmetric Information Behavioral Bias ControlAdverse selection-lack Optimism Internal: Board information and chose Over confident

monitoring incorrectly Illusion of control

Incentives Moral hazard-lack Sanctions

Information on Performance DAR External Regulators

Market for

corporate control

18

Figure 8.

19

EnterpriseRisk Management

Program

Value Proposition I II III

Risk management Foundation(Infrastructure – Systems)

Value Creation through RiskManagement not Minimization

ProductMarket Conditions

FinancialMarket Conditions

Regulatory developments

Economy

Figure 8

Risk Appetite Matched to Business Strategy

Risk Tolerance Matched to Risk Appetite

Captial Availability Matched to Risk Tolerance

Return on capital Matched to Cost of Capital

20

21

Environment

Regulation

Firm/ERMGovernanceRisk Appetite

Strategy

Macro Economy

IndustryConditions

Figure 7

Capital MarketConditions

Firm and Its Environment

22

Figure 8

Adaptive Risk Management

BusinessComplexity

Risk Management Maturity

Traditional Risk Management Functionally Oriented Risk Transfer and Avoidance Focus

A

B ERM Enterprise view Coordinated

C ER Adaptive mechanisms, informed by sensing capabilities Aligned with strategic imperatives

A B C