Prior to the crisis, banks often saw their risk appetite framework as a safeguard against exactly this eventuality. It failed because of problems in both its design and its application. Design was poor because some key risks to the bank were not captured, such as the business model’s reliance on cheap wholesale funding, or exposure to the unravelling of inflated property prices. Application was often weak because, culturally, some institutions became too focused on upside opportunity and neglected downside risk - in some cases, even deliberately ignoring it when challenged.
Despite this, the concept of risk appetite remains sound. It's just a formalisation of very basic business principles - making risk-taking explicit, taking conscious decisions based on risk-reward trade-offs,
outlining and understanding the potential for different outcomes of business decisions, and deciding whether the risk to the bank’s earnings, solvency, liquidity and other factors like reputation fall inside the parameters with which management, shareholders and other stakeholders are comfortable.
Banks now need to do a better job of making this work in practice. Even institutions that are currently able to pat themselves on the back will need to extend their risk appetite frameworks to include considerations like funding risk and the liquidity risk in trading portfolios - both of which have emerged as life-threatening exposures during the last 18 months. Increasingly, regulators also see risk appetite as the organising principle around which a lot of newer requirements are
based. There should be no room for complacency. The best place to start reviewing risk appetite frameworks is with a good understanding of the shortcomings highlighted by the crisis.
Each bank will have its own framework with its own vulnerabilities, but the crisis has highlighted three key failings which have the capacity to undermine any risk appetite exercise and from which the industry as a whole can learn: first, risk measurement was incomplete because risk types and business lines tended to be looked at in isolation, and some key risks
were overlooked; second, there was a poor connection between risk information and management action; third, board members did not challenge senior management effectively enough.
Banks often look at risk types as though they exist in a vacuum. Credit risk, market risk and operational risk attract separate capital charges and this has helped to support an organisational model in which the three teams are largely separate, with risk measurement and management frameworks that drill down into the separate business lines.
In theory, connections between the risk types should become apparent at the risk committee level for each business, or higher up the reporting and governance chains. In practice, these things can be difficult to spot from 30,000 feet.
Historically, insufficient weight was given to liquidity risk and its linkages with credit and market risk. Many banks walked unknowing into severe difficulties because they didn’t anticipate the way in which rising defaults in structured products like collateralised debt obligations (CDOs) affected the market value of those assets: credit deteriorated more rapidly than investors had expected, causing a collapse in asset valuations as buyers fled the market - in other words, credit risk, market risk and liquidity risk overlapped and reinforced each other.
Banks thought they had captured the credit risk correctly. As a consequence, they were unprepared for a sudden collapse in asset values and had not considered a scenario in which they would be unable to sell their stocks of structured credit. The risk appetite they had set for the credit business was out of step with the real risks involved.
In order to address these issues, banks will need to do three things. First, the operational silos that exist between risk types and also across business lines will need to be broken down far more effectively. There’s no magic bullet here – risk and business line managers should be encouraged to think far more holistically and creatively about the range of issues that could impact their value, rather than boxing those issues away. This is not a new message - advocates of enterprise risk management (ERM) have been talking about breaking down silos of risk for years, but the crisis suggests that much more work needs to be done.
One step could be to redesign existing reporting structures, in which most information flows vertically and is only aggregated, compared and discussed when it reaches a relatively high level. At these more senior levels, management may not be aware of some of the complexities and intricacies that come into
play - for example, only the institutional salesforce would have been aware of just how reliant investors were on credit ratings, and only structured credit desks could have grasped the complex interconnections between defaults, market prices and marketability of those assets. Neither group was effectively empowered to spot and report these problems.
Second, banks will need to expand the scope of their appetite-setting exercise to consider how reliant they want to be on different funding sources. The industry has had to learn this discipline on the fly during the crisis. In future, banks are likely to face specific - and taxing - regulatory requirements in this respect. The UK’s Financial Services Authority has already released a consultation paper which would call for banks to conduct periodic stress tests of their exposure to liquidity risk, based around the notion of liquidity risk appetite.
Third, there needs to be an acceptance that risks will not always be perfectly measured. Stress tests and scenario analysis can help banks gauge their ability to cope with surprises (see box: "Shock-proof") and new, emerging risks.
Risk appetite is useless if it doesn’t shape the risk-taking behaviour of an institution. Once the overall appetite has been set, the everyday process of gathering and reporting risk information - such as the performance of loan and trading portfolios - should help the organisation keep tabs on how it is performing relative to its stated targets. Crucially, the risk appetite framework must also include mechanisms to force the risk profile back within desired parameters and include an early warning system to alert the bank to changes in the underlying risk profile. Management needs to understand the sensitivities and monitor those drivers so that they buy time to react.
Quite often, businesses will not be taking enough risk to support the bank’s earnings goals - a relatively common problem in organisations with a conservative culture, like retail banks. Conversely, it might also emerge that too much risk is accumulating in a particular business unit. What ought to happen is that ongoing review enables management to encourage more or less risk-taking as appropriate.
Banks also need to learn to take seriously the information generated by sensitivity analysis and scenarios. Many institutions were using these methods prior to the crisis but, in some cases, the scenarios involved - despite being strikingly close to the actual events of the past two years - were dismissed as unrealistic or alarmist by the business lines. In order for these exercises to be helpful, there needs to be another step - executive teams and boards of directors should discuss the organisation's contingency plans in light of the information provided.
Many banks find it difficult to operationalise these linkages between risk appetite and risk-taking behaviour. This depends, to an extent, on the points made earlier - if the information fed to the bank's decision-makers is not correctly capturing the risk then they could, in effect, be driving blind. But assuming that the information is sound, board members and senior executives need to know that when they trim or raise risk limits, it actually translates into different risk-taking behaviour within the businesses.
An important piece of the puzzle is the involvement of board members, and particularly non-executives. The board plays a vital oversight role but its ability to challenge management is severely limited if it lacks relevant expertise, and the crisis has highlighted the extent to which even experienced bankers were out of touch with practices that had huge ramifications for an organisation's overall exposure - the role played by structured investment
vehicles in funding, for example, or the liquidity puts that allowed investors to sell CDOs back to the issuing bank.
Another example - Value at Risk modelling - is worth discussing in a little more detail because it goes right to the heart of the risk appetite-setting exercise. The VaR numbers were typically used to help board members and senior executives understand the amount of risk that trading businesses were running, but those numbers are only supposed to provide a guide to the probable maximum losses during normal trading conditions (at a given level of confidence). When markets are under extreme stress, maximum losses can exceed VaR by 20%25 or 200%25 (the models provided no guidance to what happens in the tail or when the earnings distribution changes shape) but while these limitations would have been well understood in the risk function, they were not always recognised at a more senior level and came to be seen as a concrete articulation of the bank's worst-case loss. Of course, losses have far exceeded VaR on a regular basis.
There is a big overlap here with the risk identification component of the risk appetite framework - a bank's oversight functions could have all the expertise in the world, but if they are not getting timely and relevant data, they will be hamstrung.
Still, everyone involved in some form of oversight role - not just the board, but also members of the various risk committees -needs to have a more complete understanding of the bank's businesses and their underlying risks. It's unrealistic to expect everyone to be an expert, but there has to be enough knowledge to ask tough questions and to know when the answers merit further investigation. In addition, the mechanisms through which challenge occurs need to be revised and upgraded so that scrutiny is brought to bear far more consistently and regularly. It's not acceptable, as was the case at one large investment bank, for the board risk committee to meet just twice a year during a time of crisis.
Finally, it's worth noting that compensation is still the most direct lever with which a bank can influence employee behaviour. If the remuneration structure encourages excessive risk-taking, then any risk appetite exercise will be flying into a strong headwind.
Getting risk appetite right requires banks to successfully tackle a series of imperatives. Missing all or any of them will fatally undermine the framework.
Pulling all of these elements together is easier said than done - but it can be done - and banks will increasingly be expected to place this kind of framework at the heart of their business.