The banking sector is constantly facing uncertainty. Financial institutions can be compromised from all sides, whether in times of economic downturn, cyber security or regulatory changes, or unanticipated swings in the market. However, the banks which are left standing and prospering are not ones that do not take risks, but rather those who know measure and manage them well.
This guide takes you through what a modern bank risk management framework is, how it is applied in practice and why it is so important to be right for your institution to survive and make a profit.
What Is a Bank Risk Management Framework?
A Risk Management Framework is a bank’s comprehensive system, which is used to identify, assess, monitor and control risks throughout all aspects of the bank. It’s like the immune system of the institution: it will not stop all invaders, but it will decrease the chances of and severity of problems.
The framework is not merely policies and procedures that are codified in manuals no one reads. It’s the infrastructure that’s alive and breathing, that runs in parallel with each business decision — be it lending to a large enterprise, or investing in infrastructure. It includes:
Ownership of risk structures: Who owns what risks?
- Risk policies defining the organization’s risk tolerance for various types of risk
- Risk reduction measures that prevent or minimize damage in the event of a disaster.
- Systems that identify issues prior to disaster. The continuous monitoring mechanisms that enable tracking of risk exposure.
- Coordinated initiatives for parents and cares to provide feedback on the school’s programs and practices
The best frameworks are those that meet two conflicting requirements: growth of business and stability of the business. If it’s too rigid, then the bank is no longer competitive. If it’s too loose, it could lead to major losses.
Why Bank Risk Management Frameworks Matter
The 2008 financial meltdown was a sharp reminder of the consequences of bad risk management. A firm that had been in operation for 164 years, Lehman Brothers came to an abrupt end in days. Washington Mutual was the biggest bank to fail in the history of the United States. Global insurance giant, AIG, needed a bailout from the government.
That these institutions did not realize risk would be an issue wasn’t the problem. Instead, they were unaware of their risk-taking or the risk was not managed properly. The subprime mortgages were packaged into securities that spread out the risk in the financial system without anyone really knowing how. Until markets went against them, trading desks got darn near a lot of leverage.
The takeaway: A bank’s risk management process can make or break its sustainability and profitability.
In today’s world strong frameworks perform a number of vital roles:
Regulatory Compliance. Central banks and financial regulators have certain expectations of risk management practices. For instance, the Basel III Accord sets minimum capital ratios for banks based on the amount of risk that they assume. Failure to comply may lead to enforcement and/or fines or restrictions on operations.
Stakeholder Protection. It is necessary for the depositors to have confidence that their money is safe. Shareholders must be reassured that management isn’t taking risks with the company. Stability is a career want of employees. A sound risk management program will give that confidence.
Operational Efficiency. Risk awareness enables banks to set the correct pricing for products. Credit risk framework enables the lenders to put in the right interest rates on the basis of probability of default. Liquidity risk framework is a process that enables the bank to have liquid funds available when required.
Competitive Advantage. Effective risk management is a key way banks can survive economic storms which may sink their rivals. They’re able to continue lending when other risk-averse competitors pull back. They draw good talent due to the value of investors seeing long-term viability.
The Core Components of an Effective Framework
Governance and Oversight
The best models begin with the top. A bank’s board of directors and executive management team need to establish a risk management culture, not a risk management department culture, as an ingrained value.
This will involve a number of governance aspects:
Board-Level Risk Committee. The majority of the major banks have a board committee set up for risk oversight. This committee looks at big risks, approves risk policies and helps to make sure that management is not taking undue risks for short-term gains.
Chief Risk Officer. The second most significant position in the executive chain of command, after the CEO. The CRO reports directly to the CEO and the Board of Directors’ risk committee and is independent from the business lines that could be tempted to ignore any risk in order to increase profits.
Risk Management Function. The risk function is independent of the business units and has independent risk exposure assessments. They can question business decisions which go beyond risk appetite.
Let’s say that a commercial lending department at a bank is considering a $50 million loan to a construction company in a hot market. The arrangement seems to be a lucrative one on the face of it. The risk function, however, does more in-depth analysis and determines that the borrower is highly leveraged and relies entirely on the property sales in one geographic market. If the risk team ups the ante on the concern, the deal either is restructured with more protections or it simply isn’t approved.
Risk Appetite Statement
Risk appetite is the level and types of risk a bank is willing to take to achieve strategic objectives. If there is no statement, each executive acts with a different thought and makes decisions accordingly, resulting in inconsistencies.
A good risk appetite statement will contain the following:
Quantitative Metrics. For instance, “We will keep a common equity tier 1 ratio at least 11%,” or “The maximum loss that we will allow on any single lending will be 2% of our capital.
Qualitative Statements. As “We don’t want to be a derivatives trading front-runner” or “We’re not transaction banking, we’re relationship banking.”
Business Limits. Specific limitations such as limits on exposure to specific industries, geographies or asset classes.
Thresholds for Escalation. Identify decision-making levels (what decisions can be made at the regional level and what decisions must be made at the Executive committee level).
This appetite statement will be the North Star. It is used to appraise all business decisions. Is this new market entrance in line with our risk appetite? Is this loan concentration going to be in excess of our limits? Would we be below minimum Capital ratio in this trading position?
Identification And Assessment Of The Risks
The first step in managing a risk is to identify it. This is not as easy as it sounds, as the greatest dangers generally aren’t immediately apparent.
There are a number of approaches used by banks to identify risk:
Historical Analysis. So, what are the problems that have occurred in the past? Banks have loss databases that can show problem areas, including those that are blind spots.
Scenario Analysis. What could go wrong? The question might include another example such as, “What if the unemployment rate climbs to 8%?” or “What if the interest rate changes by .5% (500 basis points)?”
Expert Judgment. Business line managers may have an intimate knowledge of new risks. Good structures provide mechanisms for capturing this knowledge.
Stress Testing. Banks do not assume normal market conditions – they simulate the bank’s capacity to withstand the most adverse conditions. The Federal Reserve mandates stress testing every quarter and reporting it to the Fed.
After identification of risks, they should be assessed. This includes knowing the likelihood of a disaster occurring and the impact it will have. There may be a need for more mitigation for a risk that is rare but severe than for a risk that is frequent but mild.
Credit Risk Management
For most banks the highest risk is the credit risk, which is the risk of non-payment of the loan by the borrower.
A full credit risk framework has the following components:
Credit Policies. Establish clear underwriting guidelines that identify the specific types of borrowers that will qualify for financing, acceptable loan terms, and loan documentation.
Credit Scoring Models. Probability-of-default mathematical models based on borrower, financial and payment history. The models a bank could use for a borrower might vary depending on the borrower, for example, small businesses may use a line of credit model, corporations may use a syndicated loan model and individuals may use a mortgage model.
Concentration Limits. Limits on the amount of credit that a borrower, an industry or a geography may obtain at any one time. A regional bank may restrict the amount invested in any one customer to 10% of its capital, and the amount invested in any real estate investment to 300% of its capital.
Covenant Monitoring. Loans may also have covenants, conditions that the borrower must keep during the course of the loan, such as keeping other financial ratios or limiting other borrowing. Risk teams monitor borrowers’ compliance on an on-going basis.
Loan classification & provisioning. A loan becomes ‘watch’, ‘substandard’ or ‘doubtful’ as it grows older and/or as the credit quality of a borrower gets worse. Based on this classification they create their loan loss reserves (provisions).
Real-World Example. A community bank makes a $5 million loan to a manufacturing firm. The bank’s credit policy is to have a debt to equity ratio under 2.5x, a minimum current ratio of 1.2x and keeps the relationship within the bank’s single customer limit. If the borrower’s most recent financials have not improved the credit officer escalates for review. Monitoring is increased if the deterioration is temporary. If it’s structural, the bank may require more collateral or the repayment to be accelerated.
Liquidity Risk Management
Liquidity risk is the risk associated with the ability of a bank to pay out its obligations as they fall due. This had brought down Bear Stearns and Lehman Brothers, who even though they had assets which, in theory, outweighed their liabilities, were just not able to get their hands on enough cash in time.
The liquidity frameworks usually consist of:
Liquidity Coverage Ratio (LCR). Banks hold good quality liquid assets that allow them to operate for 30 days if they see a lot of cash come out of them. The minimum LCR specified in Basel III Accord is 100%.
Net Stable Funding Ratio (NSFR). The measure is a longer-term one that allows banks to ensure that they have adequate stable funding to back their assets for the 1-year time horizon.
Funding Diversification. No one source of funding should be relied upon by a bank. A good framework must be diversified in terms of deposit sources, sources of wholesale funding, and in terms of term structure.
Contingency Funding Plans. What if a large source of funding is depleted? Banks simulate various stress scenarios and prepare themselves for what they would do in the event of these.
Cash Flow Matching. Banks plan for loans that are due and deposits that may be moved out of the bank, making sure that enough cash is on hand for loans due and deposits that may be taken out.
The challenge for banks here is to meet differing goals: holding adequate liquidity to withstand stress and not holding too much cash that isn’t earning them any profit.
Market Risk Management
The potential loss in the value of the bank’s trading portfolios or economic value of loans due to changes in interest rates, currency rates, equity prices or commodity prices is considered market risk.
Market risk frameworks normally consist of:
V a R (Value at risk) Models. These determine the worst possible loss on a portfolio, under “normal market conditions”, with a given level of confidence. A bank may say, “Our daily VaR is 99 cents (or 99%).” This means that there is 1 in 100 chance that on a normal day the loss will exceed $2 million.
Stress Testing. The VaR approach is based on the assumption that markets are normal but they are not when crisis strikes. Banks use stress tests to simulate each of the scenarios, historical or hypothetical, that have occurred in the past or could in theory happen in the future.
Interest Rate Sensitivity. The ratio is the measure of interest rate sensitivity of earnings by banks. How much does net interest margin contract by if rates increase by 1%? What proportion of the borrowers do prepay mortgages?
Hedging Programs. If market risk exposures are not within the banks’ tolerance, they employ hedges (derivative contracts) that will benefit from market moves that the bank would not want to lose on its underlying position.
Also Read: Risk Management Theory
Position Limits. There are limits for traders when entering the market with various amounts of money.
Operational Risk Management
Operational risk is the risk of losing assets due to poor or insufficient processes, people, systems or events. This means fraud, cyber attacks, failed trades, outages, and regulatory breaches.
Operational risk frameworks are made up of:
Loss Database. Banks measure operational losses, whether it be a teller embezzlement, failed trade or a regulatory fine, to learn where the issues are most likely to arise.
Key Risk Indicators. Predictive metrics (predicts where the problem may lie). For instance, “Number of failed trades” or “System downtime hours” or “Average time to resolve customer complaints.
Business Continuity Planning. A bank’s critical processes are identified and contingency plans are made for the failure of such processes. Backup sites, recovery procedures, and testing schedules are all examples of items that could be included in a data center outage plan.
Third-Party Risk Management. More and more banks are outsourcing their operations, such as IT, payroll or customer service. It needs to be evaluated and tracked how risky these external providers are for frameworks.
Regulatory and Compliance. Banks have to function within rather wide-ranging frameworks of regulation. An all-encompassing operational risk program will keep you compliant with the regulations and will help you find and fix violations quickly.
Cyber Risk. Cyber risk is a growing part of the modern operational risk landscape. Strong systems are access controls, network segregation, monitoring, incident response plans, and encryption systems.
Implementing a Bank Risk Management Framework
It is easy to draw up the structure on paper. Implementing it successfully, day in and day out with thousands of staff is another. Getting it to work is another.
Begin at Governance and Tone at the Top. If your board and executive team don’t buy into risk management, then it’s compliance theater. Demonstrate a strong commitment, through top leadership and board, to risk management, and hold business leaders responsible for managing risks in their respective areas.
Build the Infrastructure. This involves recruiting risk experts, purchasing technology solutions that bring risk information together and track it, and establishing risk reporting lines that allow risk professionals to raise issues without being put under pressure.
Set clear policies & procedures. All the major business activities require documented policies. These should not be 200-page documents that no one reads. Rather, keep it simple and to the point.
Measure and Report. If the things don’t get measured, they don’t get managed. Set up important risk markers and reporting to the board and executive leadership. A monthly report should indicate if it is operating within risk appetite or not.
Test and Validate. Model and systems should be tested periodically to make sure they function as designed. Stress tests are not only to be done when there are regulatory mandates, they should be done at regular intervals.
Educate and Develop Culture. If employees aren’t aware of and accepting of risk management, it will not work. This needs to be ongoing training, particularly for new recruits and promoted staff.
Common Errors of the Banks
A few things that banks get wrong.
However even banks with good intentions can get it wrong in implementing their risk management:
Risk Management is just Compliance. The worst frameworks are in place only to meet regulatory requirements. The impact of effective frameworks on business decision making is due to their real-world positive impacts.
Relying too much on historical models. Models based on past data make the assumption that the future will be similar to the past. They tend to fail just when they are needed most—when crises occur that have never taken place before.
Too few Lines of Business Provided. If the risk professional always says ‘yes’, then they are not adding value. The best risk functions will from time to time refuse or require restructuring of business offers. This makes the tension, but healthy, right?
Siloed Risk Thinking. Risks are interconnected. A recession does increase credit losses AND operational losses (due to customer disputes). Correlations are an important part of the framework, not a risk in and of itself.
Outdated Technology. Even the risk analysis of many banks is still being done using spreadsheets. This is not scalable and a lot of errors can be made in it. Today’s systems rely on a comprehensive data warehouse and analytics suite to support integration.
Key Takeaways
- A complete risk management system is essential to the stability of banks, and is not a constraint on bank growth.
- Good governance from the top, comprising of a powerful CRO and independent risk function.
- Clear risk appetite statements bring the institution together around acceptable appetite for risk, leading decision making.
Multiple risks need to be addressed systematically – credit risks require different solutions to liquidity, market and operational risks.
Design is not as important as implementation. Good policies don’t succeed unless supported by adequate infrastructure, measurement systems, and cultural commitment.
Frequently Asked Questions
A: There is no difference between a risk management framework and a risk management policy.
A: A framework is the governance, processes, systems and culture. Policies are specific rules that have been established in that framework, for example “maximum single-customer exposure is 10% of capital.
A: Risk appetite statements should be reviewed as frequently as every month.
A: Once a year at least or as changes in major business strategies. Most banks reconsider them after significant events in the market or strategic changes in order to make sure they are relevant.
Q: Is it required or voluntary to take a stress test?
Basel III and the regulatory requirements in the US require a stress test for large banks. Large institutions are subject to an annual comprehensive capital analysis and review (CCAR) stress test by the Federal Reserve.
A: Technology is becoming an integral part of the risk management framework.
A: Today’s frameworks are driven by data. Technology provides capabilities to pull data-in real-time from multiple systems, automated monitoring of limits, scenario modeling and executive dashboards that present risk-exposure in a clear manner.
So how do smaller community banks effectively do this with limited resources?
The basic essentials of community banks should be the first place to begin: having clear governance; policies which are suitable given the bank’s size and complexity; loan review processes; basic liquidity planning; and basic operational risk controls. They do not require the complex models of big banks but they still need the good ol’ fashioned education in the basics of the discipline.
If a bank does not put in place an adequate framework, what will happen?
Formal enforcement actions can be taken, growth can be capped, capital can be raised and in extreme circumstances, the bank may be placed under receivership by the regulators. In addition to regulatory implications, proper frameworks can leave banks vulnerable to losses which not only can impact capital but also tarnish reputation.
How do frameworks evolve to address new risks such as cyber risks?
A: Operational risk sub-components have been included for cyber risk in modern frameworks, such as through regular assessments, penetration testing, employee training and incident response plans. This is continually changing in response to threat.
Conclusion
Banking itself, is a risky business. But risk doesn’t have to be reckless. A well-designed and well-executed risk management system conveys uncertainty to a manageable risk probability. It enables banks to attend to their communities and their customers, pay back their shareholders, and employ thousands, while at the same time keeping financial systems stable, which they rely on.
It’s not going to be the banks that are taking the most risk that will survive the next 10 years. They will be those who know and control their risk best and most. They will have risk frameworks which are not barriers to success, but an advantage in achieving success.
If you are developing or refining a risk management plan, take a moment to determine where you are currently. Which components exist? Which need strengthening? Have a serious discussion with your Board, Leadership Team and Risk Function about the risk appetite and culture. The structure that you develop today will shape your institution’s future survival – and success – in the face of future difficulties.