Risk Management, Governance, Culture, and Risk taking in Banks

After completing this reading, you should be able to:

• Assess methods that banks can use to determine their optimal level of risk exposure, and explain how the optimal level of risk can differ across banks.
• Describe implications for a bank if it takes too little or too much risk compared to its optimal level.
• Explain ways in which risk management can add or destroy value for a bank.
• Describe structural challenges and limitations to effective risk management, including the use of VaR in setting limits.
• Assess the potential impact of a bank’s governance, incentive structure, and risk culture on its risk profile and its performance.

Methods Banks Can Use to Determine Their Optimal Level of Risk Exposure

1. Targeting a certain default probability or specific credit rating

   Attainment of the highest possible credit rating or the lowest probability of default may not always be the number one goal of firms. To earn the highest credit rating, say, AAA, a firm would have to forego risky projects even if they have positive net present values that could increase shareholder/company value. The pursuit for the best credit rating or the lowest probability of default can result in missed opportunities to earn profits.

   Instead, there is a need to strike a balance between risk and return. A company should target a credit rating that allows it to take on “good” measured risks that can generate positive returns while still protecting itself from potentially crippling losses should it take on projects that are too risky. A rating of AA could suffice.

2. Sensitivity analysis/scenario analysis

   Sensitivity/scenario analyses aim to establish the impact of some specified shock on the financial stability of an institution. For example, a bank may want to determine how a sudden increase in interest rates by a margin of 500 basis points would affect its asset/liability holdings. Once the bank has established the potential impact, it can then use that information to take on projects whose expected and unexpected losses it can withstand if such a shock were to materialize.

   Apart from interest rates, other shocks that may form part of scenario analysis include inflation, FOREX, GDP growth, among others.

How the Optimal Level of Risk Can Differ across Banks

A bank’s optimal level of risk will depend on the nature of its activities, or what we would core its core business. For example, a bank that’s focused on transactional activities would be less likely to target a higher credit rating than another bank focused on deposit-taking and long-term lending.

The latter would aim to attain the highest credit rating available to instill confidence among depositors and other business partners who wish to have their funds put into safe use. As such, the bank would have a lower optimal level of risk.

A bank that relies on transactional commissions would usually have less regard for reputation and confidence, especially if the transactions are one-off events with few long-term obligations. Such a bank would set a higher level of risk and target a lower credit rating.

Implications for a Bank If It Takes Too Little or Too Much Risk Compared to Its Optimal Level

Every bank must establish its optimal level of risk and adhere to it.

If a bank takes on too little risk, it will forego positive NPV (net present value) projects that would increase shareholder/company value. Such a bank would generate suboptimal returns for shareholders who might not respond in too kind a manner. For example, the top management of the bank would be put to task, sometimes losing their jobs if they fail to turn the situation around.

If a bank takes on too much risk, it will populate its investment portfolio with high-risk projects that could result in devastating losses. Such a bank may well post attractive returns, but as history suggests, the odds of crumbling under the weight of huge losses would be considerably high. If such a bank were to suffer financial distress, other banks, and partners with whom the bank has obligations would also be exposed to financial turmoil. As more and more banks fail, the threat of instability in the financial system increases.

For these reasons, banks must establish and observe an optimal level of risk while making capital investment decisions.

Ways in Which Risk Management Can Add or Destroy Value for a Bank

Risk management can add value if:

• Taking on incremental risk brings about a significant decrease in a bank’s value. In such a situation, the bank would be better off with a risk management department equipped with the resources to prevent the bank from taking excessive risks. The benefits of the risk management department would outweigh the costs.
• The bank adopts a flexible risk management process that extensively evaluates each project in isolation. Such flexibility would allow the bank to identify profitable risks and initiate investment projects that could increase its value.
• All business lines take a holistic approach to risk management. A bank will rarely fall because of the risks taken within a single department or business line. Instead, its success/failure is subject to all of the risks taken by the various business units. Requiring all business lines to take the perspective of the entire bank while making risky investment decisions will ensure that the bank adheres to its optimal level of risk.

Risk management can destroy value if:

• Taking on incremental risk brings about insignificant changes in a bank’s value. If additional changes in risk do not adversely affect the value of a bank, risk management will destroy value for the bank. In particular, the risk management department would come with fixed costs.
• The bank adopts an inflexible risk management process. Inflexible risk management policies and procedures may succeed in keeping the overall risk below a certain threshold but stop the bank from taking on any project that can add value.
• Business lines manage risks in silos. If each business line manages risk on its own without taking into account the overall risk exposure of the bank and the impact of business-level decisions on the bank as a whole, it would be difficult to manage risks effectively. Such a localized approach would destroy value for the bank.

Structural Challenges and Limitations to Effective Risk Management

Limitations of Hedging

1. Real-time hedging does not exist in most banking operations. As such, the bank may still suffer losses between initiation of a transaction and acquisition of the hedge.
2. Some risks are simply impossible to hedge, e.g., the risk of terrorism.
3. Hedging is usually imperfect, mainly due to a mismatch between the hedging instrument and the underlying asset. For example, hedging a position in a stock by taking a short position in a stock index may not work correctly because the stock and the index might not decline in lockstep. The stock could lose value even when the index is rising.

Risk-taker Incentive Limitations

Some risk-takers within the bank may increasingly take on excessive risks with an eye on better compensation, notably when remuneration is pegged on performance. Excessive risks may ultimately reduce value for the bank.

Other limitations of risk management include:

• Ideally, the risk management function should be independent of undue influence from the investment department. Risk management personnel should come in to merely assess the riskiness of a project. In practice, however, it is not possible to limit the risk function to a verification/assessment function alone. Sometimes the risk personnel also submit project proposals for review and possible approval by the top brass of a company. In such a scenario, the risk manager may suppress specific facts or even ignore some risks in a bid to have their proposals approved.
• If the risk management department is viewed as an internal watchdog, then the necessary dialogue between risk managers and business line managers will not exist. Specifically, the unit managers may withhold critical information in an attempt to paint their dockets in a good light. As a result, risk managers will not receive all the information necessary to evaluate the bank’s risk exposure.

Limitations of VaR

• It does not measure worst-case loss. For example, even at 99% confidence, we would still expect the loss to exceed the VaR amount 2-3 trading days in a year.
• It incorrectly assumes that the distributions of losses are not correlated over time. As witnessed during the 2007/09 financial crisis, huge losses on one day would trigger more considerable losses the following day.
• Different VaR methods lead to different results. For instance, the historical VaR method yields a figure that’s different from that of Monte Carlo VaR.

The Potential Impact of a Bank’s Governance, Incentive Structure and Risk Culture on Its Risk Profile and Performance

It is quite challenging to demonstrate that a bank’s governance has a significant impact on its risk profile and performance, primarily because:

• There are minimal data on exactly how the risk function operates in banks.
• Risk function characteristics are also subject to the bank’s risk appetite.
• Banks still record poor performance even in the presence of strong governance.

The incentive structure is also a vital ingredient in risk management. Incentives should not be designed to reward business unit managers merely for their risk management achievements at the business unit level. Instead, they should reward managers for taking risks that create value for the bank as a whole. At the same time, there should be penalties for taking risks that destroy value.

Several studies have been conducted to assess the impact of culture on risk management. One such study argues that when managers are perceived as honest and trustworthy, the firm is more profitable and also valued highly. Different research argues that improvements in shareholder governance would change a firm’s culture from the traditional focus on integrity and customer experience and instead emphasize results.