Since the global crisis the authorities have been focusing on how to make banks safer, with changes to capital and liquidity requirements. Corporate governance of banks and the wider risk culture are also in the frame. Laeven and Ratnovski (2014) look at governance and raise three aspects: better risk management, regulation of pay, and enhanced market discipline.
Another lens is to consider the effectiveness of the board and in particular its independence. However, several papers (e.g. Erkens et al. 2012 and Adams 2012) have found that this is negatively related to outcomes in the crisis. Other mechanisms need to be sought to enhance board governance over risk-taking.
The focus should shift to the tools the board can use to control management risk-taking. Mehran et al. (2011) highlight opacity as a distinguishing feature of financial institutions, and this is indeed the case. The product of a bank is risk, and even for a relatively straightforward banking business the residual risk is affected by a myriad of controls and hedging structures.
This creates a major challenge for boards. How do they hold management to account when they cannot see all the risk being taken? It is here that tools like an explicit risk appetite set by the board, against which the business and business decisions can be tested, become important.
Bailey and Sutherland (2014) make clear that regulators see a clear pre-set risk appetite acting as an important break against excessive risk-taking. This was not happening pre-crisis. Although some banks were setting risk appetites, they were often in such general and subjective terms that management could not be held to account against them, or had so many metrics that again accountability was difficult.
This is changing now in part because of pressure from regulators. A recent EY survey in cooperation with the Institute of International Finance (EY 2014) shows that of the 53 banks across 27 countries surveyed, 76% are using some form of forward tail loss as a core risk-appetite metric: stress test results, loss in extreme events, or earnings at risk.
There was a considerable amount of interest in the late 1990s, led by the Federal Reserve Board, on the possible use of pre-commitment approaches to align incentives with regard to risk-taking. Kupiec and O’Brien (1997) suggested that banks should pre-commit to a maximum loss exposure, which would form the capital requirement, and would face penalties if losses rose above this level.
This approach was not pursued, to a significant extent because a bank that failed because of risk-taking above the pre-committed level could not be given credible penalties. However, a tight risk-appetite framework in effect delivers a pre-commitment of the business heads to the board, the entity heads to the board, and so on. And if regulators police the appetite set at the highest level for the bank as a whole (i.e. it has to be reported to them and boards have to justify changing it), then this would also act as a pre-commitment by the board.
For this to work as a tight framework, it requires a clear cascade in terms of the appetite statements. If a bank has capacity to absorb no more than, say, £20bn in loss and remain viable in an extreme environment (e.g. a repeat of the crisis), and the board decides that the appetite should be set at losses of no more than £10bn, that figure can be cascaded to entities, to business lines and to risk types.
This does take a careful assessment that the different appetites for risk types, business lines and entities are consistent. Clearly a decision would have to be taken about any allowance for diversification benefit to be built in, and the definition of loss for different risk types and business lines. Stress testing, modelling and judgement could be used to assess risks relative to the appetite. A business-line head would be responsible for ensuring that the limit structure and controls delivered risk no higher than the appetite – i.e. forward-looking risk of loss not just actual loss. The risk function would be responsible for ensuring that the limits and controls across the bank in aggregate were consistent with the appetite. Other elements are needed in the risk-appetite statement, including qualitative, but this would provide the spine.
For this to provide a tight framework, the risk culture in the organisation would have to be sound. But here accountability of the front office for the risk is an important component (see Jackson 2014), and the clarity of the risk-appetite statements at business-line level would help to give structure to this accountability. This could then be linked to compensation and promotion.
In conlusion, the opacity of banks – given that the business consists of ranges of risks, controls, and hedging – creates particular challenges for corporate governance. Boards cannot see all the risk, which enhances reliance on managers of the business. Risk-appetite frameworks can provide a pre-commitment mechanism that tightens risk governance, but a focus on the wider risk culture is also important.
Published in collaboration with VoxEu.
Author: Patricia Jackson, Financial Services Risk Management, EY, based in London, is a member of the EY Global Regulatory Network in the Financial Services Risk Management Group and provides advice on regulatory issues and risk management across EMEIA and globally.
Image: The Raiffeisen Bank International logo is pictured behind traffic lights at an office building in Vienna September 29, 2014. REUTERS/Heinz-Peter Bader.