risk management in banking beyond the credit crisis

7/30/2019 Risk Management in Banking Beyond the Credit Crisis

1/34

KPMG INTERNATIONAL

Never again?Risk management in banking beyond the credit crisis

A U D I T T A X A D V I S O R Y


2/34

Contents

Page

4 Executivesummary

6 Rethinkingbanksapproach toriskmanagement

12 Theemerginginuence otheriskunction

20 Riskexpertiseacross theorganization

24 Toolsormeasuring

andmanagingrisk

30 Conclusions:movingorward

31 Participantsandmethodology

32 Contacts

Neveragain?Riskmanagementinbankingbeyondthecreditcrisis

2009 KPMG International. KPMG International is a Swiss cooperative. Member firms of the KPMG network of independent firms are offiliated with KPMG International. KPMGInternational provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm vis--vis third party, nor does KPMGInternational have any such authority to obligate or bind any member firm. All rights reserved.


3/342

Foreword

Thecreditcrisishasorcedbanks

totakeacriticallookathowthey

manageriskandhasexposedsome

signifcantweaknessesinrisk

managementacrossthefnancial

servicesindustry.

The collapse o several high prole

banks, the emergency bail out o others,

departures o CEOs and CFOs, thehundreds o billions o dollars o write-

downs, eorts by banks to raise resh

capital were all signs that something

had gone very badly wrong.

On rst examination, the current

predicament appears to stem rom the

pursuit o revenue growth in a world

o easy credit. The reality o course

is more complex and a number o

themes emerge rom the survey

ndings: weaknesses in risk culture

and governance; gaps in risk expertise

at the non executive Board level; lacko infuence o the risk unction; lack

o responsibility and accountability

o those on the ront line; a

compensation culture too oriented

towards year on year prot increases;

business models that were overly

reliant on ample market liquidity.

Above all this has been a crisis o

judgment on the part o many banks,

with an apparently excessive ocus

on short-term gain and a lack o

healthy skepticism.

AllrisksareinterconnectedThe crisis has also driven home

the interdependencies in the global

banking system, both at a micro level

within organizations and at a macro

level across the industry. The world

has witnessed a tragedy played out

in two acts: the rst stage hit those

banks that had either lent to the US

sub prime market or took on derivatives

o these loans; the second stage has

eectively hit almost every nancial

institution, with the inter-bank lending

market drying up as condenceevaporated rom the banking system.

To some extent, banks have become

victims o their evolution. A series o

mergers and acquisitions have helped

to create more complex structures, with

a plethora o products and systems that

have oten not been integrated, making

it considerably harder to understand

the ull extent o the risks that had been

taken on across all business lines.This has not been helped by a wave

o sophisticated products that have

oten proved dicult or both buyers

and sellers to ully understand. Poor

internal circulation o inormation has

oten urther contributed to blurring

banks view o their overall risk

exposure, with certain parts o an

organization requently unaware o

activities and exposures in other areas;

a situation that may have been

exacerbated by the peripheral role

o what in some cases wereineective risk unctions.

Addressingriskgovernance

atalllevels

The shortage o risk expertise at the

Board level also highlighted in the

survey is something that is currently

being debated in the industry. In the

same way that US company Boards

require someone on the audit

committee with an accounting

background, there may one day

also be a similar requirement or risk

proessionals. A number o bank Boardmembers are rom outside the industry

and, as the survey responses show,

have varying degrees o risk

management expertise or

understanding. Many o the better

perorming institutions over the past

18 months have greater depth o risk

experience at Board level.

The skills gap is not conned to

the upper echelons. Many o those

responsible or originating transactions

seem to be out o tune with the

organizational risk appetite, not ullyaccountable and either unwilling or

unable to make measured judgments on

the level o exposure theyre taking on.

Remuneration policy undoubtedly

infuences behavior and despite many

banks operating long-term incentive

and compensation policies closely linked

to share price, many compensation

structures have arguably encouraged

the pursuit o short-term prot overlong-term shareholder value. The media

have been quick to blame incentives or

the crisis, and with a number o national

governments taking part or complete

ownership o banks, it is likely that

there will be increasing involvement

by the regulators in the setting o

reward policies.

Towardsholisticriskmanagement

The crisis has highlighted an urgent

need or improved enterprise wide

risk management procedures where,as Kevin Blakely, President and CEO

o The Risk Management Association

succinctly puts it: The right hand

knows what the let is doing.

By ollowing this path, banks should

bring greater judgment to decision

making, based on a clear understanding

o the products and the risks involved.

In the new risk culture, everyone

should consider him or hersel a risk

manager with a shared understanding

o the organizational risk appetite,

underpinned by a clear governance

structure or managing risk,incorporating three lines o deense:

the rst line being the business unit;

the second the independent risk

management unction itsel; the

third internal audit.

Such an approach oers appropriate

checks and balances and should be

supported by a compensation policy

that is rmly tied to shareholder

value over the ull period o any

transactions involved.




4/343

Qualitative judgment should also take

precedence over the recent reliance on

purely quantitative data, which should

support rather than dominate decision-

making. Models should be orward

looking and not rooted purely in historic

data. Even the most complex product

propositions ought to be presented in

a way that makes them intelligible tothe Board, external stakeholders and

indeed customers.

As the risk unction takes center

stage and gets more involved in major

strategic and product decisions, it also

needs to retain its independence in

order to oer an objective judgment

on any risks that the organization may

take on.

Aboutthissurvey

In this October 2008 survey, carried

out by the Economist Intelligence Unitand involving over 500 senior managers

involved in risk management rom

leading banks around the world,

respondents were asked to identiy the

weaknesses in risk management that

contributed to the crisis and the actions

being taken by the industry to prevent

such a catastrophe reoccurring.

Someothepressingissues

coveredinclude:

The eectiveness o risk-governance

and culture

The changing infuence o the

risk unction

The level o risk expertise rm wide

The impact o incentives and

compensation policies The way risk is measured

and reported

The results which are augmented

by comment should provide a useul

contribution to the debate on how banks

can create a well-governed risk

management inrastructure with the

fexibility to stand up to uture volatility.

We would like to thank all those that

were generous enough to take part

in this survey at a time when their

resources are stretched by the ongoingtroubles in the marketplace.

JrgHashagen

Partner and Global Head o Financial

Risk Management, KPMG Germany

NigelHarman

Partner and Head o Financial Risk

Management, KPMG UK

MichaelConover

Partner, New York Leader o

Financial Risk Management


009 KPMG International. KPMG International is a Swiss cooperative. Member firms of the KPMG network of independent firms are offiliated with KPMG International. KPMGrnational provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm vis--vis third party, nor does KPMGrnational have any such authority to obligate or bind any member firm. All rights reserved.


5/344

Executivesummary

Many o the banks participating in KPMGs global survey

acknowledge that a lack o discipline in risk management was

a contributory actor in the credit crisis. Although most are taking

steps to address any weaknesses in their management o risk,

the results suggest a potential lack o commitment to the kind

o elemental change that may be necessary to avoid a repeat

o recent events.

Despiteimprovingitsprole,the

riskunctionisstillstrugglingto

gaininfuence

Seven out o ten respondents eel that

risk departments are having a greater

inluence within banks, particularly

at a strategic level. However their

involvement in more day-to-day

business decisions may be restricted

by poor communication with the lines

o business. More worryingly, a vast

majority (76 percent) o those involved

in managing risk still eel that, despite

raising its proile, risk is stigmatized

as a support unction.

Banksarenotaddressingthelack

oriskexpertiseatseniorlevels

Under hal (45 percent) o the banks

in the survey acknowledge that their

Boards are short o risk knowledge

and experience a lower igure than

may have been expected. It is o

some concern that many are not

even planning to address this issue

particularly at the non-executive

level where the need or expertise

is most acute. With a quarter o

respondents seeing no need or a Risk

Committee, many organizations could

be lacking a rigorous, independent

challenge to the judgments beingmade in the businesses.

Tochangeriskculture,banks

shouldleadromthetop

The survey reveals the vast majority

o those responsible or managing risk

(77 percent) are dedicated to instilling

a more robust risk culture in their

organizations and eel that greater

tone rom the top, along with a more

authoritative risk unction, are two o

the keys to such a transormation.

Some respondents expressed concern

that regulators rather than non-

executive directors are driving

change. This urther supports the

perception that in certain institutions

risk may still be seen as a peripheralcompliance issue, rather than an

essential part o strategy.

Executivesummary |

76%oseniorriskmanagersstilleelrisk

isstigmatizedasasupportunction

45%othebanksinthesurveyacknowledge

thattheirBoardsareshortorisk

knowledgeandexperience



6/34

| Executivesummary

5

Ninety two percent o those surveyed have carried out or

are about to carry out a review o the way they manage risk.

Tellingly, only 42 percent have made or plan to make undamental

changes to their risk management processes, suggesting a

degree o complacency. The main areas being addressed are

risk governance, risk culture and reporting and measurement

o risk; the three key building blocks o a risk inrastructure.

Poorcommunicationwasnot

toblameorthecreditcrisis

Only a ith o respondents eel

that a silo mentality contributed

to the current turmoil in the industry,

yet a majority acknowledge that

communication between dierent

parts o the business needs to

improve. Banks are particularly

concerned about improving links

with the lines o business those

on the ront line who have to consider

the risks they take on, whether its

making trading decisions or

developing new products.

Bankswanttoprovidebetter

inormationordecisionmaking

Almost eight out o ten respondents

are seeking to improve the way that

risk is measured and reported, a

clear acknowledgement that previous

models did not suiciently measure

potential risk exposure. Their

emphasis will be on stress and

scenario testing, along with Basel II

credit models, but it remains to be

seen whether such measures will

be either lexible or sophisticated

enough to ully capture the range

o possible outcomes.

Riskmanagersappearreluctant

totackleincentiveand

compensationissues

Despite acknowledging that the

rewards culture has had a big impact

upon the current crisis, the majority

o those responding are cautious

about increasing the involvement o

either regulators or the risk unction

itsel in setting policy. This suggests

that risk managers are uncertain

o their role in this critical area.

36%orespondentseelthatregulators

shouldplayaroleinremuneration

92%othosesurveyedhavecarriedout

orareabouttocarryoutareview

otheirriskmanagement

Theriskcommitteeshouldoversee

theactiveacceptanceoriskwithin

theorganization.

Kevin Blakely, President and CEO,

The Risk Management Association



7/34

Rethinkingbanksapproach

toriskmanagement

Rethinkingbanksapproachtoriskmanagement |


8/347

Intherunuptothecreditcrisis,

banksriskgovernance,riskculture

andincentiveandremuneration

policieswerethethreeareaswhere

themanagementoriskletthem

downthemost,accordingto

KPMGs2008globalsurvey.

The majority o Chie Risk Ocers

(CROs), risk proessionals and othersenior managers taking part in the

survey acknowledge that the industry as

a whole had an inadequate ramework

or controlling risk. They also admit that

the prevailing organizational culture did

not stop excessive risk taking, uelled by

a system o prot-based rewards that

ailed to protect the needs o depositors.

However, somewhat surprisingly, a

majority (almost six out o ten) o banks

still consider their own risk governance

and culture to be eective, suggesting

that some have yet to acknowledgetheir own role in the troubles that have

embraced the sector.

Chart 1 Elements of risk management most at fault in contributing to the credit crisis

Incentives and remuneration

Respondents were allowed multiple responses. Source: 2009, KPMG International

Risk governance

Risk culture

Setting and monitoring risk appetite

Level of risk expertise at Board level

Reporting and measuring of risk

Risk systems and data quality

Lack of skills and experience

Communication acrossorganizational silos

Other

52%

50%

48%

42%

40%

39%

32%

29%

21%

9%

| Rethinkingbanksapproachtoriskmanagement

52%orespondentssayincentivesandremunerationpoliciescontributedtothecreditcrisis



9/34


toriskmanagement,continued

Arebankstakingsucientaction

toimproveriskmanagement?

The survey indicates that many banks

are taking positive steps to overcome

these weaknesses; around hal o those

participating have already reviewed the

way they manage risk, with most o

the remaining respondents either

involved in or about to start a review.However, only our out o ten have

made or intend to make undamental

changes, which is perhaps lower than

may have been expected and could

indicate an unwillingness to take specic

and decisive action in tackling the

weaknesses that led to the credit crisis.

Regardless o the degree o change

anticipated, a majority o respondent

banks are seeking to tighten up their

overall risk management. Governance

and culture are both high on the agenda

as they attempt to put in place moreeective policies, procedures and

controls and make sta more aware

o enterprise-wide risks when acing

key business decisions. There is also

considerable ocus on improving the

way that risk is reported and measured

as well as the systems and data that

underpin such analysis. This is

recognition that managers across the

business units did not have suciently

robust data when making some o the

decisions that led to the present troubles.

Chart 2 Have you reviewed risk management in your organization?

Yes, and made fundamental changes

Source: 2009, KPMG International

Yes, and made minor changes

Currently reviewing and expect to make fundamental changes

Currently reviewing and expect to make minor changes

Expect to review in future

No intention to review

23%

29%

19%

14%

7%

8%

Chart 3 How will you change your attention to the following over the next year?

Risk governance

1 Significant increase 2 3 4 5 Significant decrease

Risk culture

Incentives and remuneration

Communication acrossorganizational silos

Reporting and measuring of risk


Skills and experience

Level of risk expertise at Board level

Setting and monitoring risk appetite

34% 43% 21% 1%

30% 47% 20% 1%

13% 33% 44% 2%

24% 46% 26% 1%

19% 43% 33% 1%

27% 51% 18% 1%

20% 45% 32%

21% 44% 30 1%18% 30% 44% 1%

1%

2%

8%

3%

4%

3%

3%

4%

7%





10/349

Riskmanagementhasnotbeenclosely

alignedwithcompensationpolicy

Despite being cited in the survey

as the single biggest contributor to the

current crisis, less than hal (46 percent)

o the respondents are planning a

signicant increase in attention to

this issue. There appears to be some

uncertainty over the role o the riskmanagement unction in developing

and managing compensation policy.

This is not to say that respondents

do not support reorm to compensation:

almost six out o ten avor greater use

o long-term incentives; and a similar

proportion want to expand the practice

o risk-adjusted measures. Other

proposals, such as longer deerral o

bonuses and an increase in proportion

o remuneration paid or divisional

perormance attract less interest.

In a urther twist, the riskproessionals involved in this survey

are also cautious about any external

pressures on rewards and incentives,

with just over a third (36 percent)

agreeing that regulators should become

more involved in the setting o

remuneration in the banking industry.


Chart 4 Which of the following remuneration initiatives

would you support in your organization?

Greater use of risk-adjusted measures

Greater use of long-termperformance initiatives

Setting of risk-control remunerationseparately from remuneration ofrisk-taking areas of the business

Increase in proportion of remunerationpaid for group performance

Longer deferral of bonuses

Use of bonus clawbacks in the eventof poor performance over longer term

Increase in proportion of remunerationpaid for divisional performance

Greater proportion of remunerationpaid in stock

None of the above

57%

55%

39%

32%

31%

24%

20%

17%

5%


42%orespondentshavemadeorexpect

tomakeundamentalchangestorisk

management



11/3410


toriskmanagement,continued

KPMGcomment:

Theneedortrulyintegratedriskmanagement

Thecreditcrisisbringsmanybanksoverallriskgovernanceintoquestion,withsome

lackingtheramework,thepoliciesorthenecessarycapabilitiestoachieveaclearpicture

otheriskstheyareacingacrosstheorganization.

Ingrowingthebusiness,executiveteamsshouldtrytoensurethatallemployeesare

awareoandinvolvedinmanagingrisk,withseniormanagementsettingtheoverall

strategicdirectionandembeddingriskmanagementphilosophyacrossthebusiness,

ensuringthatriskcanbemeasured,reportedandmanaged.Theyshouldalsoprovide

clearguidancerefectedinexplicitpoliciesandproceduresandaclearexpectationo

compliancewiththese.

Strongperormerstendtohaveclearlinesocommunication,withtherisk

managementunctionintegratedintothebusiness,allowinginsightsandindustry

bestpracticetobeshared.Riskmanagementresponsibilitiesshouldbestreamlinedsothatriskcanbeownedand

managedwithinthebusinessunit,butquicklyescalatedthroughtheriskmanagement

unctionandbusinessunitstotheBoardanditsrelevantcommitteeswherenecessary.

Whentheyareworkingwell,thesethreelinesodeensegiveprimaryresponsibilityor

riskmanagementtotheclient-acingareasothebusiness;supportunctionsreviewand

checkthatrisksareacceptedinlinewiththeinstitutionspoliciesandappetite;andnally

internalauditprovidesassurancethattheinternalcontrolsandriskmanagementare

operatingasexpected.

Reliablequantitativeandqualitativeinormationshouldeedupromthebusinessunitsto

seniormanagementandtheBoardandbedeliveredtodecisionmakersinatimelyashion.




12/3411

Howshouldriskproessionalsinuencecompensationincentives?

InanOctober2008lettertoCEOsoleadingnancialcompanies,theUKFinancial

ServicesAuthority(FSA)notedthatrmspossiblyrequentlygaveincentivesto

statopursueriskypoliciestothedetrimentoshareholdersandotherstakeholders.

TheFSAwantstoseewideruseoincreaseddeerraloannualbonusesandthedelivery

oincentivesinsharesratherthancash,withperormancemeasureslinkedtorisk.Theletter

makesacaseortheriskunctiontohaveastrongandindependentroleorsetting

compensationorthebusinessareas.

AccordingtoKevinBlakely,PresidentandCEOoTheRiskManagementAssociation,

thismeansactingasanagitatorratherthananadministrator:Compensationisthe

responsibilityotheBoard,thecompensationcommitteeandtheCEO,buttheCRO

shouldhaveadirectinputintopolicytoensurethatriskistakenintoconsideration.

Inaseparatereport,theInstituteoInternationalFinanceestablishedaspecialCommittee

onMarketBestPractices(CMBP),whichalsoarguesorcompensationincentivestobe

basedonperormanceandalignedwithshareholdervalueandlongterm,organizationwideprotability.Italsosuggeststhatcompensationincentivesshouldinnowayinduce

risktakinginexcessotheorganizationsriskappetiteandthatthepayoutobonuses

shouldbecloselyrelatedtothetimingoriskadjustedprot.

Althoughsomeothecasualtiesothecurrentcrisisclaimtohaveverylong-termincentive

plansthataredirectlylinkedtoshareprice,thisdoesnotappeartobeconsistentacrossthe

industry.Withmanybanksunderpartialorcompletegovernmentownership,banksare

likelytobeunderconsiderablepoliticalpressuretoshowregulatorybodiesthattheir

compensationandincentivesystemsareriskbased.

1. Letter rom Hector Sants, Chie Executive, Financial Services Authority to CEOs o leading fnancialservicescompanies, October 13, 2008.2. Report o the Institute o International Finance (IIF) Committee on Market Best Practices (CMBP),J uly2008.




13/34

Theemerginginuence

otheriskunction

Theemerginginuenceotheriskunction |


14/3413

Thesurveysuggeststhatalthough

riskmanagementisslowlystarting

toplayamorecentralroleinbanks

decision-makingstructures,many

respondentseelthatriskhasstill

tosheditstraditionalimageasa

supportunction.

The growing importance o the risk

unction in banking is refected in ourndings. Seven out o ten taking part

believe that the risk unction holds much

greater infuence than two years ago

and eight out o ten see the way they

manage risk as a source o competitive

advantage (as opposed to merely

providing checks and balances). Yet it

seems that there is still a long way to go,

with the vast majority concerned that risk

management continues to be stigmatized

as a back room unction.

Encouragingly, two o the areas

where the CRO or equivalent is startingto exert considerably greater authority

are strategy development and capital

allocation. This is a logical development

as banks seek to integrate risk and

capital into their planning to ensure they

do not over stretch their capacity in

pursuit o prot. Six out o ten survey

participants eel that the CRO should

have even more infuence over the

development o strategy, although in

light o recent events this gure could

arguably be even higher. Overall it

appears that the desire to manage risk

at a strategic level has not ully ltered

down to more practical issues.

Although banks may be concerned

about the apparent lack o involvement

o the CRO in mergers and acquisitions,

much o this is probably due to a relative

lack o deals over the previous two

years. However, the recent increase

in activity in this area with the more

stable institutions buying out their

troubled compatriots calls or rigorous

risk assessment o purchase targets.

Chart 5 How is risk management viewed in your organization?

Compared with two years ago, our riskfunction holds much greater influencewithin the organization

1 Strongly agree 2 3 4 5 Strongly disagree


Risk management is too oftenstigmatized as a support function

Risk management is an essential sourceof competitive advantage

27% 44% 19% 2%

36% 40% 15% 2%

48% 33% 14%

8%

7%

5%0%

Chart 6 Change in degree of influence held by your

CRO/head of risk (in the past year)

New product development



Strategy development

Investments in new geographic markets

Pricing, loans, deposits etc

Setting compensation policies

Mergers and acquisitions

Assessment of businessunit performance

Investments in new technology

Capital allocation

13% 35% 42% 2%

16% 44% 32% 1%

12% 31% 42% 2%

11% 22% 46% 5%

13% 35% 40% 2%

5% 20% 54% 4%

10% 38% 39% 2%

16% 37% 36% 1%

10% 32% 43% 2%

8%

7%

13%

16%

10%

17%

11%

10%

13%

| Theemerginginuenceotheriskunction

76%orespondentsstilleelriskis

stigmatizedasasupportunction



15/3414 14


Theemerginginuence

otheriskunction,continued

Buildingastrongerriskculture

Nearly eight out o ten (77 percent)

survey participants claim they will be

striving harder to improve their risk

culture and eel that the single most

eective way to achieve this is through

clear leadership rom senior executives.

Those respondents working at the C

level (CEO, COO, CFO, CRO, etc) areparticularly keen on establishing what

is reerred to as greater tone rom

the top.

In a urther reerence to the oten-

marginalized role o risk proessionals,

hal o those we surveyed believe that

cultural change would be hastened by

giving the unction greater authority

in the organization. Despite the

act that employee rewards are not

high on the agenda o the CRO, there

is at least some acknowledgement

that the way sta are rewarded hasa big impact on culture, with our out

o ten arguing or incentives linked to

eective risk management.

Chart 7 Expected change in attention

to risk culture (over the next year)

Significant increase 30%

Slight increase 47%

Neither increase nor decrease 20%

Slight decrease 2%

Significant decrease 1%

Total 100%




16/3415

In many banks, the right hand side didnt

know what the let hand was doing.Kevin Blakely, President and CEO, The Risk Management Association

Communicatingwith

therestotheorganization

When asked to list the actors that

contributed to the current predicament

in the industry, only two in ten banks

(21percent) eel that a lack of effective

communication across organizational

silos played a part.

However the respondents do recognizethe need or improvement, with better

communication between the risk

unction and the business being seen

as one o the most important ways

to improve overall risk management,

with a majority committed to making

such changes.

A more detailed look at communication

and inormation sharing across the

business reveals a number o

inconsistencies that could aect the

management o risk. The risk unction

claims to have developed much closer

relationships with the senior executive

team and the Risk Committee,

suggesting that those involved in majorstrategic decisions are likely to consider

the wider implications or the business.

However, there is also evidence that

such high-level risk management is

not carried down to operational level;

respondents admit that there is room

or greater interaction with the lines o

business and internal audit, and also

between the risk committee and the

audit committee. Such a weakness in

communication enables business unit

managers to take on large risks without

consulting urther up the management

chain. Furthermore, with internal audit

expected to play a greater role in risk

management as the third line odeense, senior managers will want

to see acloser relationship between

the internal audit and risk functions.

Chart 8 Communication and sharing of information between the following function/teams

Independent risk functionand finance function

1 Very effective 2 3 4 5 Not at all effective


Risk function and senior executive team

Risk function and lines of business

Risk function and risk committee

Risk committee and audit committee

Risk function and internal audit function

Risk function and regulators

19% 43% 25% 1%

26% 46% 20% 2%

14% 43% 31% 3%

15% 43% 28% 3%

29% 42% 20% 3%

16% 39% 33% 5%

19% 41% 30% 3%

12%

6%

9%

11%

6%

7%

7%




17/3416


Theemerginginuence


Whereispressuretochange

comingrom?

The biggest pressure on risk

proessionals appears to be coming

rom regulators and executive

management, but not as might be

expected rom non-executive Board

members. This may be at least partly

down to the shortage o risk expertise

o Board members and reinorces

the suspicion that risk is viewed as

a regulatory rather than a business

issue, hence the lack o authority o the

risk unction. I banks are to avoid the

problems that have plagued them in the

past two years, non-executives will have

a key role in providing an independent

challenge to risk management.

Chart 9 Change in pressure exerted by stakeholders to improve risk management (over past year)

Regulators



Investors

Executive management

Customers

Ratings agencies

Non-executive Board

Analysts

Central banks

Governments

34% 39% 24 1%

17% 34% 40% 2%

21% 49% 25% 1%

14% 35% 44% 1%

9% 25% 50% 3%

14% 33% 44% 2%

12% 33% 45% 3%

16% 32% 41% 3%

25% 33% 36% 3%

2%

7%

4%

6%

13%

7%

7%

8%

3%



18/3417

KPMGcomment

Developingarobustriskculture

Banksshouldsetrealisticlimitsonrisksthattthecultureandriskappetiteoboththe

individualbusinesslinesandtheoverallinstitution.Seniormanagershavetostrikeavery

delicatebalanceinmatchingtheacceptableleveloriskexposuretothecultureinwhich

thatriskisbeingmanaged.

Insimpleterms,theyshouldhavecondenceintheirownriskcultureandthecourage

tobeabletosay:Althoughwearemakingalotomoneyhere,additionalriskwillnot

resultinadditionalvaluebeingaddedtothebusinessinthelongterm.

Thejobthenistocreateasystemogovernancewhereriskcanbemanagedand

whereeveryindividualintheorganizationunderstandstheappetiteorriskandtheir

partinmitigatingit.Thisshouldhelppreventthoseinthelinesobusinessdelegating

responsibilityorriskmanagement.ThisappetiteshouldbeagreeduponatBoardlevel

andbetheoundationorboththecultureandthesystemocontrolswithintheorganization.Oncethisappetiteisclear,potentialdecisionssuchastakingonloan

portolioscanbeassessedinthecontextowhatriskisacceptable.

TheRiskCommitteealsohasavitalroletoplay;yetaquarterorespondentsinthe

surveyhavenoplanstoevenormsuchaorum.WritingintheFinancial Timesin

October2008,EmilioBotn,Chairman,BancoSantander,notedthat:Manyaresurprised

tolearnthattheBancoSantanderBoardsRiskCommitteemeetsorhaladaytwicea

weekandthattheBoards10-personexecutivecommitteemeetseveryMondayorat

leastourhours,devotingalargeportionothattimetoreviewingrisksandapproving

transactions.Notmanybanksdothis.Itconsumesalotoourdirectorstime.Butwend

itessentialanditisnevertoomuch.


Every employee should understand

the organizations appetite or risk.



19/34


1

Theemerginginuence


Botnalsoeelsthat:Riskispartothedailyconversationandviewedroman

enterprise-wideperspectiveriskmanagementnotonlyhasaseatatthetable,

butisalsoanactiveparticipantinallkeybusinessdecisions.

KevinBlakely,PresidentandCEO,TheRiskManagementAssociation,alsoemphasizes

theimportanceotheriskcommittee,whichhebelievesshouldoverseetheactive

acceptanceoriskwithintheorganizationandmakesureitsmitigated,managedand

pricedor.

Headds:TheCROshouldbeacentralpartothestrategicplanningprocessandbe

involvedinanymajordecisionsinvolvinginitiativesromthelinesobusiness.Idont

thinkthisishappeningsucientlyandisamajorfawinenterpriseriskmanagementin

bankslargeandsmall.Hegoesontosaythat:Withsuchaweakinormationcirculatory

system,inmanybankstherighthandsidedidntknowwhatthelethandwasdoingand

seniormanagementdidnotknowitsoverallexposure.

Willriskberegulatoryorinternallydriven?

Intheabsenceoagloballycoordinatedresponseromthebankingindustry,centralbanksandtheirregulatorsaslendersolastresorthavetakentheleadinrescuingand

tosomeextentremoldingthesector.Emergingregulatorychangeswilldemandgreater

transparency,betterriskmanagementandstricterriskgovernance,withbankspossibly

havingtoaugmenttheirBoardswitharelevantriskspecialist.



20/34


Exactlyhowregulatorswillbeinvolvedinthemanagementorisksinbanksisunclear

buttheyarelikelytobemorehandson.

Governmentsinmanycountrieshavehadtostepintothebreachtorestorecondence

andcalmtotheirnancialservicesmarkets.Suchhelpcomesatapricehowever,with

numerousconditionsthatdirectlyimpactbanksandhavewiderimplicationsorthe

globaleconomy.

Sincetherecapitalizationomanybanks,theconceptotheregulatorasakeydriver

ochangehasbecomearealitywithmanyinstitutionsgenuinelyshockedatthecapital

levelstheyhavebeenobligedtohold.Banksmaynotbeabletoresistcallsothissort

unlesstheyprovetoregulators,policymakersandthepublicthattheyhavetakenthe

appropriateactiontostrengthentheirownriskmanagementprocedures.

Someriskmanagementagendasandbudgetsinrecentyearsappeartohavebeen

drivenbytheneedtomeetregulatoryexpectationssetbysuchinitiativesasBaselII,

CSE,andSarbanes-Oxley.Suchacomplianceocusmaypossiblyhavedistractedrisk

managementresourcesromaddressingwiderorganizationalrisks.3. Bankings mission must be to serve its customers Emilio Botn, Chairman o Banco Santander, Financial Times, October 16, 2008

19

...risk management not only has a seat at

the table, but is also an active participant

in all key business decisions.Emilio Botn, Chairman, Banco Santander



21/3420

Riskexpertiseacrosstheorganization |

Riskexpertiseacross

theorganization


22/3421

A signicant minority o banks has no plans

to appoint individuals with deep practical

risk experience to senior positions.

Chart 10 Our organization does

not have sufficient risk expertise

at Board level

Strongly agree 16%

Slightly agree 29%

Neither agree nor disagree 21%

Slightly disagree 20%

Strongly disagree 14%

Total 100%


Whileacknowledgingthelacko

riskexperienceandskillsamongst

seniorexecutiveandnon-executive

management,thebankstakingpart

inthesurveyappeartohavebeen

slowtoaddressthisshortage.

Only our out o ten respondents

admit that insucient risk expertise

at Board level was a contributory actorin the credit crisis, and under hal

(45 percent) believe that their own

organization lacks such know-how at

the very top. Both these gures are

considerably lower than may have been

expected, given the risks that some

banks may have taken in the lead up

to the current troubles.

When asked what would most

improve risk management, the number

one response (45 percent) was: Better

in-house skills and experience, with

over a third admitting that they need

greater risk expertise at the very top.Interestingly, respondents rom North

America and Europe are considerably

more condent in their in-house

knowledge than their counterparts

in other regions.

Chart 11 Which of the following would most improve risk management

in your organization?

Better in-house skills and experience


Better communication between riskfunction and the business

Greater level of risk expertise at thetop of the organization

Stronger organizational risk culture

Greater degree of cross-over oftalent between business lines andthe risk function

Stronger support from the management

A more strategic role for the risk function

Better industry training to developexpertise in risk management

Bigger head count in risk management

45%

40%

35%

29%

29%

27%

25%

24%

15%

| Riskexpertiseacrosstheorganization

45%orespondentsbelievethattheir

ownorganizationlacksriskexpertise

attheverytop

009 KPMG International. KPMG International is a Swiss cooperative. Member firms of the KPMG network of independent firms are offiliated with KPMG International. KPMGrnational provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm vis--vis third party, nor does KPMGnational have any such authority to obligate or bind any member firm. All rights reserved.


23/3422

Riskexpertiseacross

theorganization,continued

Arebanksllingtheskillsgap?

Despite this apparent awareness

o their shortcomings, a signicant

minority o banks has no plans to

appoint individuals with deep practical

risk experience to senior positions.

A third (33 percent) are not actively

seeking such skills or the non-executive

Board, which puts a question mark overthe extent o their commitment to truly

independent risk assessment o

strategic and commercial decisions.

Surprisingly, less than three in

ten (29 percent) o respondents eel

that lack o skills and experience was

a causative actor leading up to the

current crisis. Regardless o this,

across the organization as a whole,

people, skills and training are

considered to be by ar the single

biggest investment priority or banks.

Chart 12 Expertise of individuals or entities on your Board

Executives with deep practicalexperience in risk management


Non-executives with deep practicalexperience in risk management

Risk committee

21% 26%53%

25% 33%42%

19% 22%59%

Yes, we currently have No, but we are planning to appoint

No, and we have no plans to appoint

Chart 13 Priority areas for investment in

risk management (over the next year)

People (skills and training) 62%

Technology 20%

Data 11%

People (head count) 7%


Riskexpertiseacrosstheorganization |



24/34

| Riskexpertiseacrosstheorganization

23

KPMGcomment

Aneedorgreaterknowledgeandexperience

Theindustryasawholeisprobablyawareotheshortageoindividualswithrisk

managementskillsandpracticalexperience,particularlyataseniorlevel.Muchothisexpertiseappearstobeconcentratedincertainbanks,yetevenintheseinstitutions,

thosewithriskexperiencemaynotbeullyinvolvedinmajorstrategicdecisions.

Thoseworkingintheriskunctionmayalsoneedtoimprovetheirskillsandindeed

raisetheproleotheunctionbyinvestinginpeopleandtraining.Withriskmanagement

clearlyunderthespotlight,itisnorealsurprisethatpeoplearetobethenumberone

investmentarea.

TheSeniorSupervisorsGroup(SSG)(comprisingseniorsupervisorsomajornancial

servicesrmsromFrance,Germany,Switzerland,theUnitedKingdom,andtheUnited

States)reportromMarch20084concludesthatsomeotheexecutiveleadersatrms

thatrecordedlargerlossesdidnothavethesamedegreeoexperienceincapitalmarketsanddidnotadvocatequick,strong,anddisciplinedresponses.

Thereportgoesontoargueortheselectionoexecutiveleaderswithexpertiseinarange

orisks,giventhatitisverydiculttopredictthesourceothenextdisruptiontothemarket.

Seniormanagementteamsasawholeshouldtrytomaintainariskproleconsistentwith

theBoardandseniormanagementstoleranceorrisk.

EmilioBotn,Chairman,BancoSantander5believesthat:theBoardmustknowand

understandbankingThisisacomplexindustry,subjecttoconstantchangeandinnovation.

Whatisneededaredirectorswhoknowthebusinesswell.

Thereisalsoastrongargumentormoreexpertiseacrosstheorganization.Thethree

linesodeensemodelplacestheprimeresponsibilityorriskmanagementwiththe

clientacingareasothebusiness.Yetinanumberocasesthoseworkinginthelines

obusinesshavenothadsucientaccountabilityortheiractionsandhavelacked

awarenessotheorganizationsoverallriskappetite.Thisisprobablydowntothe

underlyingorganizationalcultureandsomethingthatcanbeaddressedthroughtraining

andimprovedcommunication.

4. Observations on Risk Management Practices during the Recent Market Turbulence Senior Supervisors Group report, March6,2008

5. Bankings mission must be to serve its customers Emilio Botn, Chairman o Banco Santander, Financial Times, October 16, 2008



25/34

Toolsormeasuring

andmanagingrisk

Toolsormeasuringandmanagingrisk|


26/3425

| Toolsormeasuringandmanagingrisk

Manybanksinthesurveyrecognize

thelimitationsinthewaythey

manageandreportdataandplan

toocusmoreonstresstestingand

scenarioanalysis.However,thereis

aquestionmarkoverwhetherany

newapproachesarefexibleenough

tomakeaccuratepredictions.

The way that risk is reported andmeasured played a signiicant part in the

credit crisis, according to those involved

in the survey. Almost eight out o ten

respondents (78 percent) are planning

to pay more attention to this issue, with

a similar proportion looking to improve

risk systems and data quality.

Whatisdrivingthechangein

approachtoriskmeasurement?

The survey shows that banks have

been employing a wide variety o

approaches to manage risk, although

the use o Basel II credit risk models

has been surprisingly low, given the

regulatory pressure to take up such

a tool.

Chart 14 Expected change in attention to the following over the next year




Reporting and measuring risk

24% 46% 26% 1%

27% 51% 18%

3%

1%3%

Chart 15 Reliance on the following approaches to measure and manage risk (up to now)

Value at risk

1 Extremely reliant 2 3 4 5 Not at all reliant


Basel II credit risk models

Stress testing

Gross limits

Leverage limits

Scenario analysis

16% 45% 22% 8%

14% 36% 23% 13%

14% 34% 32% 5%

15% 36% 32% 6%

18% 38% 32% 4%

16% 31% 33% 7%

9%

14%

15%

11%

8%

13%

61%orespondentswillbeplacing

moreemphasisonstresstesting

andscenarioanalysis



27/3426

Toolsormeasuring

andmanagingrisk,continued

Chart 16 Expected change in reliance on the following tools to measure and manage risk (over the next three years)

Value at risk

Increased reliance No change Decreased reliance Not applicable


Basel II credit risk models

Stress testing

Gross limits

Leverage limits

Scenario analysis

45% 45% 5% 5%

48% 39% 4% 9%

61% 33% 3%3%

61% 33% 3% 3%

33% 56% 5% 6%

34% 52% 5% 9%


In the uture, respondents will be

placing a stronger emphasis upon stress

testing and scenario analysis to help

measure and manage risk. This is an

acknowledgement that recent analysis

was not suiciently robust to deal with

the systemic risks in the market at

the time. Arguably this increased

ocus on measurement may also be

a precautionary move, given that

some regulators are starting to insist

on certain levels o stress testing as

a minimum requirement in order to

maintain capitalization and capital

allocation levels.



28/34


27

Willtheuseoeconomiccapital

reducerisk?

The vast majority o survey

participants uses or plans to use

economic capital to estimate capital

requirements, although in only a fifth

o cases (21 percent) is this currently

ully embedded. This trend, along with

the substantial increase in relianceon Basel II models, creates a dilemma

or banks: with a potential backlash

against quantitative approaches that

are based on static, historical data;

can risk proessionals develop more

sophisticated, fexible models?

Chart 17 Current approach

to economic capital

We do not use economic capitaland have no plans to introduce it 16%

We do not use economic capital

but plan to introduce it 22%We use economic capitalbut it is not fully embeddedin our organization 37%

We use economic capitaland it is fully embedded inour organization 21%

We are reducing our useof economic capital 4%




29/342

Toolsormeasuring

andmanagingrisk,continued

KPMGcomment:

providingatruepictureochanginglevelsorisk

Thecreditcrisishashighlightedsomespecicchallengesinhowbanksmanagerisk,

withperhapsthebiggestconcernbeingtheapparentoverrelianceonquantitativemodelsindecision-making.Eventhosethatusedmoresophisticatedmodelsandtestingwere

notalwaysabletopredictwhatwaseectivelyaonceinalietimesetocircumstances.

Thereappearstohavebeenalackoqualitativeassessmentotherisksandexposures

beingtakenon.Whilequantitativetechniquesarelikelytohaveanimportantroletoplay,

theseshouldbeaugmentedbythejudgmentothosewithextensiveriskmanagement

andwiderbusinessexperience.

Measuringriskisclearlyanintegralpartoeectiveriskmanagementandtheuse

oadaptiveratherthanstatictools(suchasValueatRisk)shouldprovidemorereliable

indicatorsoutureperormance.Intheleaduptothecurrentcrisis,manybanksscenarioplanningwasnotsucientlyrobust,leavingseniormanagementunabletoaccurately

stresstestdierentoptions.Futurescenariosshouldincorporatetheviewsoexperienced

businessandriskproessionals,aswellasthoseoregulatorsandotherpeers.

ThemandatorysurvivaltestsorcapitallevelssetbytheFederalReserve,FSAand

otherauthoritiesarelikelytoimpactprotabilityandde-leveragethebalancesheet.

Suchtestswillalmostcertainlyrequiregreateruseostressandscenarioanalysisand

consequentlywearelikelytoseeanewgenerationomodelsandanewalignmentorisk

managementtechniques.

However,amodelisonlyasgoodasitsbuilt-inassumptionsanditsinput,whichinmanybanksarrivesinvaryingormsatdierenttimesromdisparatesourcesaroundthe

organization.ThiswashighlightedintheatermathotheLehmanBrotherscollapse,

wheresomeindustryparticipantsstruggledtoidentiyalltheirrelevantexposuresto

Lehmanacrosstheirgroupstructures.Intheuture,banksshouldbeaimingtoconsolidate

theirexposuresintoasingle,consistentsourceoanalysisotheirpotentialrisks.




30/34

TheBaselIIcapitalrameworkcurrentlyusedbythemajorityobankscanbe

strengthened,encouragingmanagementtodevelopmoreorward-lookingapproachesto

measuringrisk.Thesewouldgobeyondsimplymeasuringcapitalandincorporateexpert

judgmentonexposures,limits,reserves,liquidityandcapital.Togiveitrealteeth,economic

capitalshouldbetiedintoexecutivecompensationsothatrewardsarebasedupontheeconomicvaluebroughttotheorganization.

AccordingtotheSeniorSupervisorsGroupreport6,thoseorganizationsthatperormed

wellthroughthecrisisweredistinguishedbytheorderlyandtimelyfowoinormation.

Manybanksshouldconsiderreviewingtheirinormationcirculatorysystemtoovercome

weaknessessuchas:varyingvolumesandqualityoinormationromdierentpartsothe

organization;timelinessodata;duplicationoinormationasaconsequenceohavingtoo

manydierentsources;lackounderstandingastowhatinormationisneeded,who

shouldsupplyitandwhereitshouldbesent.

6. Observations on Risk Management Practices during the Recent Market Turbulence Senior Supervisors Group report, March6,2008


29

Banks must get data rom

enough sources to provide a

true picture o changing levelso risks.

Quantitative analysis should be

augmented by the judgment

o those with extensive risk

and business experience.

009 KPMG International. KPMG International is a Swiss cooperative. Member firms of the KPMG network of independent firms are offiliated with KPMG International. KPMGrnational provides no client services. No member firm has any authority to obligate or bind KPMG International or any other member firm vis--vis third party, nor does KPMGnational have any such authority to obligate or bind any member firm. All rights reserved.


31/3430

Conclusions:movingorward |

Conclusions:

movingorwardSince the very rst credit was extended, banks have amassed

vast experience in managing risk, which makes the risk

management weaknesses exposed by this crisis all the more

surprising. These weaknesses have been compounded by the

global nature o the banking system, with ew parts o the worldeconomy immune to the impact o the crisis. Moving orward,

nancial institutions should get back to basics through a renewed

ocus on understanding the risks that they take. By strengthening

their risk governance regimes, they should help to make them

more fexible to meet changing conditions.

The ndings rom this survey point to a

number o key improvements that banks

should consider:

Improvinggovernanceand

creatingariskculture

By establishing an appropriate,

enterprise-wide ramework within

which risk can be measured, reported

and managed, banks can create a

simpler system incorporating the

three essential elements o an

eective risk regime: governance,

reporting and data, and processesand systems. Firm, visible leadership

rom the very top can help embed a

risk philosophy and culture across the

organization, with every employee

ully aware o the organizations

clearly articulated risk appetite and its

impact on decision making.

Raising the prole o risk

Those working in risk should seek to

build stronger relationships with all

levels o the organization, in particular

the lines o business, Board, audit

committee and internal audit.

Improving risk expertise

at senior levels

As a matter o urgency, banks

should be looking to acquire greater

risk know-how within their senior

executive and non-executive Boards,

helping to provide a more robust

and inormed challenge to

business decisions.

Risk models should support but

not drive decision making

Eective risk management is

essentially about good judgment supported by appropriate quantitative

data presented in a clear, simple

ormat that the Board and other

stakeholders can understand. Risk

models should be less rooted in

historic data and lexible enough to

adapt to changing market conditions.

Addressing incentives head on

Risk managers should play a role

in promoting the principles o

compensation policy (which would

be developed by the compensation

committee), with incentives based

on perormance and aligned with

shareholder interest and long-term,

organization-wide proitability. Such an

approach should also help to reduce

the intervention o the regulators.



32/3431

| Participantsandmethodology

Participants

andmethodologyAlltheresponsesweregathered

throughonlineinterviewsinOctober

2008withover500seniormanagers

involvedinriskmanagementrom

leadingbanksaroundtheworld.

Theinterviews,carriedoutbythe

EconomistIntelligenceUnit,covered

arangeoquestionsrelatingto

riskmanagement,withparticular

reerencetotheglobalcreditcrisis.

Over halfo the respondents

work directly in the risk function for

involved in organizations corporate,

retail, investment and private banking,

as well as asset management. Seven

out of ten (72 percent) have a CRO or

equivalent. Twenty percent had assets

over US $500 billion and thirty fivepercent over US $250 billion.

Chart 18 Participants main functional roles (up to three)

Risk


Strategy and business development

Research and analytics

Operations

Customer relations

General management

IT

Legal and compliance

Sales

Origination

Marketing

Trading

Other

53%

25%

22%

18%

13%

11%

10%

7%

7%

7%

6%

6%

12%

Chart 19 Global assets

of participants in US$

Less than US$250 bn 65%

Between US$250 bn

and US$500 bn 15%

Greater than US$500 bn 20%




33/3432

Contacts |

ContactsAmericas

US

Michael Conover

+1 212 872 6402

[email protected]

James Liddy

+1 212 909 5583

[email protected]

Diana Lowe

+1 416 777 [email protected]

Greg Matthews

+1 212 954 7784

[email protected]

Jitendra Sharma

+1 212 872 7604

[email protected]

Europe

Nigel Harman

+44 20 7311 5291

[email protected]

Jrg Hashagen

+49 69 9587 2787

[email protected]

Fabiano Gobbo

+39 02 676431

[email protected]

David Sayer

+44 20 7311 5404

[email protected]

Volker Thier

+49 69 9587 2679

[email protected]

AsiaPacifc

John HH Lee

+60 3 7721 3388

[email protected]

Rachael Phelan

+61 3 9288 5896

[email protected]

Chee Meng Yap

+65 6213 2888

[email protected]



34/34

The information contained herein is of a general nature and is not intended to address thecircumstances of any particular individual or entity. Although we endeavor to provide accurate andtimely information, there can be no guarantee that such information is accurate as of the date it isreceived or that it will continue to be accurate in the future. No one should act on such informationwithout appropriate professional advice after a thorough examination of the particular situation.

The views and opinions expressed herein are those of the survey respondents and do notnecessarily represent the views and opinions of KPMG International or KPMG member firms.

2009, KPMG International. KPMGInternational is a Swiss cooperative. Memberfirms of the KPMG network of independentfirms are affiliated with KPMG International.KPMG International provides no clientservices. No member firm has any authorityto obligate or bind KPMG International orany other member firm vis--vis third parties,nor does KPMG International have any suchauthority to obligate or bind any member firm.All rights reserved. Printed in the UK.

KPMG and the KPMG logo are registeredtrademarks of KPMG International, aSwiss cooperative.

Designed and produced by WardourPublication title: Never again? Risk

risk management in banking beyond the credit crisis

Documents