Grabbing Risk by the Tail

Risk management lies at the core of the banking business. From the way financial institutions grant and price loans, to how they monitor credit quality and interest-rate fluctuations, making informed judgments about what will happen nextu00e2u20ac”and then preparing for itu00e2u20ac”is what the industry is all about. But that doesnu00e2u20acu2122t mean banks donu00e2u20acu2122t get burned. Increasingly, it seems, thatu00e2u20acu2122s part of the business, too.

Take this summeru00e2u20acu2122s liquidity crisis. It began with a dip in housing prices and accelerated with tough news about inflation and job growth. Before long, delinquencies soared, as borrowersu00e2u20ac”especially those in the less-creditworthy subprime sectoru00e2u20ac”were unable or unwilling to keep up with their payments. In short order, wary investors started shying away from mortgage-backed securities. And voila, liquidity was squeezed in ways no one saw coming.

With their low-cost deposit funding sources, banks initially fared better than monoline mortgage companies and brokers. Eventually, those exposed to the most at-risk productsu00e2u20ac”including subprime loans, those with high loan-to-value ratios and so-called u00e2u20acu0153alt-Au00e2u20ac offerings, which require less documentation, as well as home-equity lines of creditu00e2u20ac”began feeling the pain. In September, National City Corp. of Cleveland reported that its mortgage unit would likely lose $160 million in the third quarter, E-Trade Financial Corp. CEO Mitchell Caplan warned that $95 million in unexpected chargeoffs could slash quarterly earnings by 25%, and giant Bank of America Corp. told investors to expect trading losses related to its holdings of questionable home loans.

Victoria Wagner, a credit analyst for Standard & Pooru00e2u20acu2122s, says things could get worse for banks before they get better. National housing prices are projected to decline another 9% over the next year, according to an S&P analysis. And of the 30 banks and 10 thrifts with the highest concentrations of mortgage loans on their books, 16 of those face credit losses that could exceed their quarterly incomes. u00e2u20acu0153Clearly, profits from the mortgage business will be lower for the foreseeable future,u00e2u20ac she says.

The liquidity crunch is the most-recent example of what experts like to call u00e2u20acu0153tail risku00e2u20acu00e2u20ac”one of those external jolts that can emerge from out of nowhere to catch banks and their boards by surprise. The 9/11 terrorist attacks and Hurricane Katrina were tail-risk events. So were the 1998 Asian financial crisis and the sudden bursting of the Internet stock bubble in 2000. On the local level, the surprise closing of a big manufacturing plant, the unexpected introduction of an aggressive new competitor, or revelations of insider trading by an executive or director, qualify.

Such risks are particularly vexing, because they fly in the face of whatu00e2u20acu2122s supposed to be an industry forte. Managing risk is so central to banking that trying to break it out as a separate discipline is difficult. u00e2u20acu0153Itu00e2u20acu2122s almost like air to banks,u00e2u20ac says David Baris, executive director of the American Association of Bank Directors. u00e2u20acu0153Itu00e2u20acu2122s everywhere, all the timeu00e2u20ac”an essential part of everything they do.u00e2u20ac

At its core, banks employ teams of experts and the latest technologies to predict emerging credit and interest rate trends, and position their operations and balance sheets for the future. As the term implies, the idea is to manage risks, not avoid them. Many smart bank boards and managements view superior risk-management skills as a competitive advantageu00e2u20ac”a key tool in the quest for that happy balance between generating good shareholder returns and being able to sleep at night.

Tail risk, however, is more about unexpected threats to the business, with the only certainty being that sooner or later something newu00e2u20ac”and most-likely badu00e2u20ac”will jump seemingly out of nowhere and turn the world-as-we-know-it on its ear. Unless a board is really on its toes, the whats, hows, and whens usually remain unknowns until itu00e2u20acu2122s too late to react, leading to trouble. u00e2u20acu0153Itu00e2u20acu2122s the things youu00e2u20acu2122re not expecting that can really whack you,u00e2u20ac says Eugene Ludwig, former comptroller of the currency and now CEO of Promontory Financial Group, a Washington, D.C. consulting firm that works with banks and their boards on risk-management issues.

u00e2u20acu0153These kinds of events are the hardest things to model for, and they have the potential to put you out of business,u00e2u20ac Ludwig adds. u00e2u20acu0153Figuring out how to see around the corners and anticipate a response for when the market becomes unusual is maybe the most important challenge a board confronts.u00e2u20ac

And the truth is, most boards donu00e2u20acu2122t do a very good job of it. Many donu00e2u20acu2122t even try. u00e2u20acu0153Traditionally, when boards think about risk, itu00e2u20acu2122s credit risk, and thatu00e2u20acu2122s it,u00e2u20ac says Charles Thayer, head of Chartwell Capital, Ltd., a Fort Lauderdale, Florida, board advisory firm and a former director of Republic Bancshares Inc., a St. Petersburg, Florida, company that was acquired by BB&T Corp. in 2004. u00e2u20acu0153The notion of considering liquidity risk or reputational risk or even regulatory risk is still difficult for many to wrap their arms around.u00e2u20ac

Scanning for sinkholes

In a very real sense, helping the institution navigate its way through or around tail-risk events is one of the boardu00e2u20acu2122s primary purposes. While management has plenty of technologies and methods available to tackle basic financial risks, real-world threats often require the nuanced judgments of well-connected board members to interpret.

u00e2u20acu0153Itu00e2u20acu2122s not about looking at the primary impact of a change on the market, because everybody sees that. And itu00e2u20acu2122s not even looking at the secondary effects,u00e2u20ac says Tony Plath, a banking and finance professor at the University of North Carolina-Charlotte, who also works as a bank board consultant. u00e2u20acu0153Itu00e2u20acu2122s the tertiary effects that everyone misses: Declining credit quality causes the subprime market to collapse, and that leads to a liquidity crisis. u00e2u20acu00a6 Boards need to be looking for how those dominos will fall.u00e2u20ac

Itu00e2u20acu2122s not hard to understand why financial institutions seem more vulnerable to external shocks than in the past. People and organizations are more interdependent. Bankers (and their clients) are operating across wider geographic areas, leaving them more exposed to, say, a global spike in oil prices or an earthquake on the other side of the country. Theyu00e2u20acu2122re more susceptible to the impact of a health crisis, such as a pandemic, that might originate on the other side of the world. And most now are more reliant than ever on investment markets and other outside sources for funding.

A good board counters the risks by recruiting well-rounded members from various industries and walks of life, each of whom bring their own life and business experiences to the table. Ideally, those strengths match up with the banku00e2u20acu2122s business and strategic needs, and boost the knowledge base.

u00e2u20acu0153Things are so complex today, no one person can monitor everything at the same time. But if youu00e2u20acu2122re a [real estate] developer, then you know whatu00e2u20acu2122s going on in the construction environment and can alert management to things they need to be aware of to remain competitive and stay ahead of the trends,u00e2u20ac Plath says. u00e2u20acu0153The idea is, weu00e2u20acu2122ve got 12 or 15 people in the room, and all of us know something about different parts of the business,u00e2u20ac he adds. u00e2u20acu0153Collectively, we bring wisdom to management that it can use to manage risk.u00e2u20ac

Itu00e2u20acu2122s important to note that itu00e2u20acu2122s not the boardu00e2u20acu2122s job to manage risk. As in other areas, directors are expected to ask tough questions of management about the institutionu00e2u20acu2122s mechanisms for identifying potential threats, and what its plans are if something unexpected happens. Thayer says board members should take the opportunities presented by other peopleu00e2u20acu2122s catastrophes to review their own banku00e2u20acu2122s response capabilities. u00e2u20acu0153If you see a tornado hit another community, itu00e2u20acu2122s a chance to ask if your bank is prepared to deal with something like that,u00e2u20ac he explains.

Many directors take things a step further by drawing on their expertise to act as counsel to management. A growing number of boards, for instance, engage in scenario planning exercises. At $223 billion U.S. Bancorp in Minneapolis, u00e2u20acu0153weu00e2u20acu2122ve been running what-if scenarios on everything from next yearu00e2u20acu2122s election outcome to what might happen with gas prices and the continuation of the war, to all musings about whatu00e2u20acu2122s going to happen to the consumer and small-businessperson,u00e2u20ac says CEO and director Richard Davis.

These are primarily management-led exercises. But, as Davis notes, he has the CEOs of several large companiesu00e2u20ac”Cargill, Medtronic, and Anheuser Busch among themu00e2u20ac”on his board, and would be a fool not to tap their insights. u00e2u20acu0153The board is your perfect litmus test,u00e2u20ac Davis says. u00e2u20acu0153These people arenu00e2u20acu2122t bankers, but theyu00e2u20acu2122re smart businesspeople and they ask good questions: What is our risk here? What have we done to prepare for the worst-case scenario?u00e2u20ac

In return, Davis works hard to ensure that directors arenu00e2u20acu2122t surprised. USB has a conservative credit culture and was insulated from much of the summeru00e2u20acu2122s liquidity trauma. Even so, as the crisis played out, he would send an occasional email to board members. u00e2u20acu0153It said, u00e2u20acu02dcHereu00e2u20acu2122s whatu00e2u20acu2122s going on now, hereu00e2u20acu2122s what weu00e2u20acu2122re doing and hereu00e2u20acu2122s what the analysts are saying about us,u00e2u20acu2122u00e2u20ac Davis explains. u00e2u20acu0153It was a moment-in-time snapshot, and it wasnu00e2u20acu2122t something I sent every Friday. But I would be remiss if I got to the next board meeting [and sprung unexpected news on them].u00e2u20ac

Boards also can lend supportu00e2u20ac”both moral and financialu00e2u20ac”by promoting initiatives that can help identify hidden risks early onu00e2u20ac”or that can help manage the fallout. One concern for many banks today is business continuityu00e2u20ac”how to keep the organization up and running in the aftermath of a physical disaster. At the behest of their boards, many banks today store vital information in off-site locations, far from their home markets, to keep it safe in the event of a natural disaster.

u00e2u20acu0153Weu00e2u20acu2122re making sure that management takes it seriously u00e2u20acu00a6 that appropriate resources are being devoted to disaster recovery, and that thereu00e2u20acu2122s a protocol in place if people canu00e2u20acu2122t get to work,u00e2u20ac says Robert Slezak, 49, a member of the board at $2 billion United Western Bancorp in Denver. Directors u00e2u20acu0153donu00e2u20acu2122t want to micromanage, but we do want to be sure appropriate resources and attention are being devoted to it.u00e2u20ac

Preparation is key

Planning ahead can pay big dividends, and like Boy Scouts, a growing number of bank boards are embracing u00e2u20acu0153be preparedu00e2u20ac approaches to tail-risk planning. In response to the seemingly endless list of potential threats, for instance, Bank of America recently shifted its planning from an events-based approach to one that focuses on impactsu00e2u20ac”a move that required board approval.

Amy Brinkley, BofAu00e2u20acu2122s chief risk executive, says careful modeling of scenarios involving such things as hurricanes, pandemics, earthquakes, and terror attacks showed that 80% of the impacts were the same, no matter the event. Devoting attention to those impactsu00e2u20ac”a lack of employee availability, for instance, or a breakdown in communicationsu00e2u20ac”instead of the event itself makes planning easier and more effective. u00e2u20acu0153When you have 80% in common, youu00e2u20acu2122re able to do a whole lot more in terms of building immunity, resiliency, and responsiveness,u00e2u20ac she says.

Of course, BofA boasts a 5,000-member risk-management staff. For many community banks, the lack of sophisticated staffs means itu00e2u20acu2122s up to the board, with its community connections, to serve as an informal early-warning system for risk. u00e2u20acu0153If youu00e2u20acu2122ve heard in advance from a reliable source that the General Motors plant in town is going to lay off 400 people, you want to let management know,u00e2u20ac Baris says. That could help the bank avoid making an ill-timed loan to a customer who might be losing his or her income.

Tail risks might be the most confounding of risks that bank directors confront, but theyu00e2u20acu2122re far from the only ones. Todayu00e2u20acu2122s boards are feeling greater pressure from regulators to be prudent and to help law enforcement do its job (the Bank Secrecy Act), all while meeting the internal-controls demands of the Sarbanes-Oxley Act.

The OCC lists nine general risk areas that banks must keep tabs on: price, foreign exchange, transaction, compliance, strategic and reputation risk, as well as credit and interest-rate risk, and this yearu00e2u20acu2122s favorite: liquidity risk. The Federal Reserve has its own risk categories, which essentially add operational and legal risks to the equation.

The emphasis on risk-management is growing. Everything from product offerings to business mix to how the bank interacts with customers and employees has a risk component attached. Externally, boards are getting more heat from communities and politicians to be good citizensu00e2u20ac”donu00e2u20acu2122t fund that office building near the wetlandsu00e2u20ac”and from returns-hungry shareholders. Failing to respond responsibly can lead to damaged reputations and lower profits.

The boardu00e2u20acu2122s Achilles heel

Life in a consolidating industry, meanwhile, creates the need to evaluate potential deals for risks in such areas as culture, geography, and asset quality. It also brings the threat of aggressive new competitors that would like nothing more than to steal your best customers and employees, and might be willing to take chancesu00e2u20ac”in products or pricing or hiringu00e2u20ac”that your board doesnu00e2u20acu2122t feel comfortable with.

Most board members are loath to discuss the details of their groupsu00e2u20acu2122 risk management efforts with outsiders for the record. Many fear theyu00e2u20acu2122d be giving away strategic secrets by delving into the thought processes employed to define those parameters. Others are intimidated by the subject, or worried about liability. As one director, who requests anonymity, explains, u00e2u20acu0153Iu00e2u20acu2122m a dentist. I work hard to educate myself, but Iu00e2u20acu2122m not an expert on banking risks.u00e2u20ac

The added pressures can be stimulating to some directors. Ludwig tells of one large overseas bank board that has created a separate risk committee. u00e2u20acu0153They spend multiple hours every board-meeting day talking about the big issues, and every member attends,u00e2u20ac he says. u00e2u20acu0153Itu00e2u20acu2122s the most popular and active committee, with very vigorous discussion. u00e2u20acu00a6 The board members understand that the business is all about risk, and that the institutionu00e2u20acu2122s performance depends to a great deal on how that risk is managed.u00e2u20ac

Such enthusiasm isnu00e2u20acu2122t universally shared. Just as common is the board that seems overwhelmed by the sheer weight of the oversight. Or the one lulled into complacency by the presence of bank examiners or unusually strong short-term performance. u00e2u20acu0153There are a lot of boards [where] the directors show up, look at the audit report, review their credit policies, and then go home,u00e2u20ac Plath says.

Signs are that this lack of intellectual curiosity and diligence has left some banks vulnerable to changes in the marketplace. Years of low interest rates, a robust economy and record industry profits emboldened many boards to stretch the risks theyu00e2u20acu2122re willing to takeu00e2u20ac”or allow management to do so. Some paid for it with overexposure to the subprime mortgage market. And it could be showing up in other areas, such as commercial real estate, where regulators have been publicly worrying that some banks are overexposed.

u00e2u20acu0153Bank boards have gotten more risk-friendly this decade,u00e2u20ac says Robert Inskeep Jr., a former OCC bank examiner and now president of Regulatory Risk Governance, a Charlotte, North Carolina consulting firm. u00e2u20acu0153When times are good, itu00e2u20acu2122s easy to get a little bit lax in your oversight and say, u00e2u20acu02dcWeu00e2u20acu2122re doing great. We havenu00e2u20acu2122t had any losses. So letu00e2u20acu2122s pile on some more risk.u00e2u20acu2122u00e2u20ac

No one is saying that the board should get hands-on in the day-to-day aspects of managing risku00e2u20ac”thatu00e2u20acu2122s an area best left to a banku00e2u20acu2122s executives, who have the expertise and technology to do the job right. As shareholder fiduciaries, however, directors should be active partners when it comes to establishing the big-picture parameters that govern just how much risk the organization is willing to take on.

If nothing else, as the people most likely to be left holding the legal bag if something goes amiss, board members have a duty to themselves to strike a balance that provides for the greatest shareholder returns and also allows them to sleep at night. u00e2u20acu0153The boardu00e2u20acu2122s duty isnu00e2u20acu2122t to actually manage the risk,u00e2u20ac Ludwig explains. u00e2u20acu0153Itu00e2u20acu2122s to set the risk appetite, and the global, long-term risk framework under which the institution operates.u00e2u20ac

Thereu00e2u20acu2122s no u00e2u20acu0153rightu00e2u20ac way for a board to go about the task. Many describe the risk management process as more art than science. How itu00e2u20acu2122s achieved is often determined by the banku00e2u20acu2122s size or even its culture. BofA, for instance, has forged a u00e2u20acu0153culture of accountability,u00e2u20ac Brinkley says.

Structurally, boards tackle risk in different ways. Some large banks employ special committees to oversee the banku00e2u20acu2122s risk functions. At Wachovia Corp., a seven-member risk committee is charged with overseeing the companyu00e2u20acu2122s u00e2u20acu0153policies, procedures and practices relating to liquidity risk, interest rate risk, credit risk, market risk and operational risk,u00e2u20ac according to its proxy. BofAu00e2u20acu2122s board doesnu00e2u20acu2122t have a risk committee, per se, but makes a point of assigning risk responsibilities to three separate committeesu00e2u20ac”audit, asset quality, and finance.

Smaller banks with less expansive committee structures typically make risk oversight part of the job description for a standing committee, usually audit or asset/liability. Since they donu00e2u20acu2122t have designated risk managers, the task of presenting managementu00e2u20acu2122s perspective is often handled by the chief financial officer or credit officer, backed by the internal auditor and, in many cases, a review by the external audit team.

Lassoing the beast

Large bank or small, what all boards have in common is an implicit requirement that directors digest large amounts of data to help them make informed decisions. Internal staffs are considered crucial to bringing directors up to snuff on the risk setting process. And while regulators often seem driven by a desire to simply limit risk, their pronouncements and guidance also can help focus a boardu00e2u20acu2122s thinking on key areas.

u00e2u20acu0153As a director, you need an appreciation for what the regulators are saying, because it can tell you in advance where the next round of risk might be,u00e2u20ac says Peter Weinstock, a Dallas-based financial institutions partner for law firm Hunton & Williams.

Among the most useful of the common tools is a monthly or quarterly risk report, produced by management, which provides directors with a snapshot of the companyu00e2u20acu2122s current risk profile. Typically around three to five pages in size and written in plain English, such reports touch on the risk highlights. Detailed appendices, charts, and business breakdowns often are attached, and directors have access to files if they feel a need to explore problem areas further.

A key feature of many such reports is a risk grid, or u00e2u20acu0153heat map,u00e2u20ac that allows directors to keep visual tabs on the evolution of their companyu00e2u20acu2122s risk profiles. Such grids typically list the OCCu00e2u20acu2122s risk areas across the horizontal access, and key business linesu00e2u20ac”commercial real estate, personal loans, mortgagesu00e2u20ac”and operational areas, such as information technology, vertically. Each intersection is populated with a number or coloru00e2u20ac”green, yellow, and red are most commonu00e2u20ac”indicating the present level of that type of risk in a specific business line.

Inskeep offers the example of the intersection of credit cards and credit risk. u00e2u20acu0153If it was yellow last month, and this month itu00e2u20acu2122s red, something has changed and needs to be explainedu00e2u20ac by management, he says. u00e2u20acu0153And the answer might be, u00e2u20acu02dcWeu00e2u20acu2122re seeing some deterioration in our card portfolio because thereu00e2u20acu2122s been an increase in past-due accounts due to recent layoffs, and a lot of borrowers are overextended.u00e2u20acu2122u00e2u20ac

Good boards regularly review such information, quizzing their managements and occasionally tweaking operations to hold tight to a predetermined risk profile. At United Western, for instance, the board decided two years ago to sell off a relatively large portfolio of loans to charter schools, because it carried too much risk for the boardu00e2u20acu2122s comfort.

u00e2u20acu0153It was a noncore business with a disproportionate amount of risk, and it wasnu00e2u20acu2122t getting enough attention from management and the board,u00e2u20ac Slezak recalls. u00e2u20acu0153As a board, you have to decide if you want to reach for that extra 2% of margin or if youu00e2u20acu2122re happy with a little more modest financial payoff and stay in a safer place on the risk/reward spectrum. u00e2u20acu00a6 We decided (the charter school business) was a recipe for trouble.u00e2u20ac

Employing a third party to review operations can be valuable. Ludwig, whose firm regularly conducts risk reviews of client banks, tells of a recent visit to an offsite retreat of one institution with a large risk management department. u00e2u20acu0153It had metrics for everything, it had computers and the smartest people. But if you looked at the company closely, there was one business that wasnu00e2u20acu2122t subject to the normal risk management scrutiny,u00e2u20ac he recalls. It was a trading business that happened to be a pet project of the CEO. After Ludwigu00e2u20acu2122s team called attention to it, u00e2u20acu0153they managed it down, but they didnu00e2u20acu2122t manage it out, and it blew up on them,u00e2u20ac he says.

The moral: u00e2u20acu0153No matter how good your risk management organization is, itu00e2u20acu2122s difficult to see yourself as objectively as someone outside the institution,u00e2u20ac Ludwig says.

Trust your instincts

All of these tools and processesu00e2u20ac”backed by board-mandated policiesu00e2u20ac”can play a valuable role in keeping directors apprised of the institutionu00e2u20acu2122s health. In the end, though, a banku00e2u20acu2122s risk profile usually comes down to a set of gut calls by top executives and the board. Some argue that heat maps and risk reports can be detrimental because they focus too much of the boardu00e2u20acu2122s attention on internal risk issue, at the expense of taking a broader, more expansive view that could help the institution dodge the next tail-risk incident.

Plath recommends to his director clients that they think globally about their roles. He sees more directorsu00e2u20ac”even those at smaller banksu00e2u20ac”reading international news magazines, such as the Economist, as well as business publications, with an eye for trends that could impact their institutions. u00e2u20acu0153Most directors arenu00e2u20acu2122t thinking about how economic problems in China can affect the price of cement in Peoria,u00e2u20ac he explains. u00e2u20acu0153But they really should be, because the price of cement in Peoria could put a half a dozen of the banku00e2u20acu2122s major construction customers out of business.u00e2u20ac

Thayer counters that the greatest potential for tail risk lies right under the boardu00e2u20acu2122s nose, in the form of mismanagement or things like embezzlement or insider trading, where the internal controls break down. u00e2u20acu0153Youu00e2u20acu2122ve got to have trust in your senior management, and confidence that theyu00e2u20acu2122re running the ship right and can deal with problems,u00e2u20ac he says.

Risk management for boards is u00e2u20acu0153more about asking questions than trying to figure out answers,u00e2u20ac Thayer adds. u00e2u20acu0153If management gives intelligent feedback to your questions, then youu00e2u20acu2122re probably ok. If youu00e2u20acu2122re not happy with the responses, thatu00e2u20acu2122s when you need to get worried.u00e2u20ac

Ultimately, good risk management practices are rooted in the boardu00e2u20acu2122s awareness of the outside world and its knowledge of the banku00e2u20acu2122s internal workings. It takes time and effort to reach a level of comfort, and even then, diligence might not protect your institution from getting snared by the next big tail-risk event. But it could minimize the damage. That makes the extra workload well worth the effort.