Risk Management Beyond Compliance

Leading the Way is a column written by PricewaterhouseCoopers professional staff. It appears in the Business section of the Bangkok Post twice each month. The column provides specialised advice to corporate decision-makers in Thailand on global and local business trends.

This article appeared in the March 20, 2007 issue of the Bangkok Post.

By Dominic Nixon

As with their counterparts in Europe, North America and elsewhere, risk managers have been required by regulators to enact sweeping reforms to the way that they handle risk. At the same time, the market and business environment for the financial services industry in Asia is being transformed, in no small part because of the rapid development of the region's most populous nation, China. In combination, these trends have ensured that the profile of the risk function in Asia has never been higher. And yet, risk discipline is still somewhat neglected.

According to a recent survey of 100 senior executives in financial services throughout Asia, which formed part of a global survey carried out by the Economist Intelligence Unit (EIU) on behalf of PricewaterhouseCoopers, the current limitations of risk management are threefold.

First, there is too much focus on the regulators. The imminent arrival of the Basel II standard, which is being phased in across Asia from 2008, has been an important driver of the agenda in recent years. As a result, there is a tendency for banks in the region to define risk management largely in regulatory terms, rather than value creation.

Second, some organisations are losing potential to create value. Significant numbers of respondents believe that effective risk management positively enhances their reputation with shareholders, enables sustainable investment performance, delivers better management data and enables more competitive pricing.

Reputation with regulators is still seen as a key source of competitive advantage, and is considered more important than, say, the ability to free up capital for investment. This suggests that significant potential to create value for the business is being lost.

Third, there is a sense of disengagement by the business. In general, there is limited input from the risk function in a number of key business activities. Only 42% of respondents say that risk management is formally involved in budgeting and financial reporting. There continues to be a pressing need for risk managers in Asian financial institutions to become more involved in these crucial strategic decisions.

The implication of these three limitations is that Asian financial services firms will not reap maximum value from risk management unless their culture, organisation, processes and data are all properly aligned.

While Thailand did not participate in the survey, we believe that responses from Thai banks would likely be in line with the survey's main findings. All Thai banks have been driven towards a better risk management function by regulatory pressure. However, the level of enhancement to which each bank takes it to, in addition to its desire to create business value from the risk function and link it to budgeting and financial reporting, varies widely from bank to bank. Much of this is dependent on the bank's degree of sophistication and the management's strategy and vision.

There are some leading Thai banks that are striving towards a more value added risk function. While these banks have started to cultivate a risk culture, they are encountering difficulty in terms of data and processes to link up to the financial function, and in permeating risk management across all the businesses. At the other end of the spectrum, some banks are only working on being compliant to local regulatory requirements.

The survey findings suggest that institutions must concentrate on the following areas:

• Commitment from the top: Risk management must be seen as a more strategic function. For risk managers to participate fully in critical business decisions, it is essential that senior management remains committed to, and engaged with, the functions.
• Embedded risk managers: While this strategy has been employed for some time at a number of Asian companies, there is clearly still room for improvement. Only around one in six respondents believes that their organisations' business units and risk management functions are very well integrated at the moment.
• A strong central presence: A central risk management function with a strong mandate remains essential to monitor, measure, and oversee treatment of risk by individual business units, and to ensure that independence and objectivity are not sacrificed.
• Overlapping roles and responsibilities: Recognising risk assessment as a common activity across the organisation may help firms optimise their risk models.
• Quality and utility of data: Risk managers must enter into a closer dialogue with executives outside the risk function to ensure that the data they gather is accurate and useful for them to create value as well as ward off risks.
• Culture and governance: The organisational structure, processes and data must be underpinned by a culture of risk awareness and sound governance.