Rethinking Risk Management: Integrating ERM into Strategic Planning and Governance

1. I. INTRODUCTION Spurred by regulators, financial institutions have invested significant resources in risk management over the last decade. An actuarial statistical approach to estimates future losses based on past experiences was used to create an illusion of control. Unfortunately, markets are not actuarial tables. The magnitude of the error became apparent once the crisis unfolded. For example, Citibank is VAR, value at risk, at the end of 2007 was $190 mln. This means the maximum it could lose over a 1 day period at the 99% confidence level was $190 mln. Citi’s actual 2008 losses exceed $40 B. Other institutions with similar experiences include Merrill, Wachovia and Washington Mutual. These losses triggered massive shareholder value destruction resulting in dilutive recapitalizations and replacement of whole managements. Clearly, something is wrong with the current state of risk management requiring a rethinking of the activity.

2. INTRODUCTION (continued) Institutions had moved further out on the curve to maintain normal income growth. Risk was deemed under control based on the twin illusions of liquidity and risk distribution. In fact, rather than distribute risk, they had concentrated risk. Liquidity evaporated once their leveraged positions began losing value. This article explores why this occurred and what can be done to remedy the situation. What is needed is to move risk management away from a hyper technical, specialist control function with linkage to creation. Instead, we need to move beyond risk measurement to integrate risk into strategic planning, capital management and governance. Enterprise risk management ERM, provides the framework to integrate these functions.

3. II. CURRENT SITUTATION: What happened? The financial services industry suffers from over capacity and product commoditization. This has pressured margins. Institutions increased risk exposure to enhance nominal returns without increasing shareholder value as reflected in Figure 1. They did those on both sides of the balance sheets. Asset risk increased by taking tall risk exposure inherent in many of the new products with option like payoffs. For example, Merrill is one day VAR increased by almost 5 times from 2001 through 2007. Although as previously noted, VAR has its problems as a precise risk indicator, it directionally seems correct in this circumstance. On the leverage side, leverage levels increase dramatically. This was largely accomplished by the large scale use of off balance sheet vehicles. In fact, the large scale capital raising by banks serves as a proxy for the undercapitalized or excessive leverage to asset risk at banks. In Merrill’s case, that totals almost $32B in the first half of 2008.

4. CURRENT SITUTATION: What happened? (Continued) Flawed risk models contributed to the problem. Overconfidence in the models created an illusion of control. Profits were raising and the risk models failed to indicate any concern. The models failed in several respects. First, they failed to consider debtor behavioral changes. Ordinarily, mortgages are reluctant to jeopardize the homes by defaulting. Once they began viewing their real estate as an investment, however, their behavioral changed resulting in defaults once home prices fell below their equity in the asset. Next, models risk is heavily dependent on data frequency and availability. Thus, for new products with a limited history, the models were useless. Finally, even if you have the data, models are based on experience, not exposures. Just because something has not occurred yet the exposure exists. This is particularly true when dealing large scale event risks or “Black Swans”.

5. CURRENT SITUTATION: What happened? (continued) Perhaps, most concerning was the industry wide governance breakdown. Directors were unaware of the risk implications of strategic initiatives. For example, Stan O’Neil strategy to match Goldman and become the market share leader required assuming billions of additional risk. Essentially, he was making a franchise bet. This involved a large increase in risk appetite without any consideration of negative scenarios. Next incentive arrangements produced counterproductive behavioral changes. Strong managers began exploring weak governance. Incentives became short term and based on nominal income with insufficient risk adjustments. Finally, risk monitoring was hampered by faulty risk models, which failed to raise concerns until it was too late. The above factors illustrate that risk management has lagged financial innovation. It has evolved into a ritualistic measurement and prediction activity with little or no power to influence behavior.

6. CURRENT SITUTATION: What happened? (continued) Additionally, even within risk management, organizational impediments exists. Individual risk functions tent to operate as independent silos with little or no strategic connection. Additionally, there is limited consideration of business models and market states when evaluation transaction risks. Literally, it is failing to see the forest because of the trees. What is needed is the integration of risk into strategic planning, capital management and performance measurement. This would combine business and risk considerations into a single, whole-firm view of value creation.

7. VALUE IMPLICATIONS OF RISK APPETITE CHANGESFigure 1 Capital requirement Alpha (value creation) Efficient frontier D C for business portfolio Beta Return A = Current position B = Value destruction–Uncompensated risk A B C = Target position – no value change D = True value creation Zeta (value loss) Risk

8. III. RISK STRATEGY FRAMEWORK Financial institutions have invested heavily in risk management. Yet, there is surprisingly little agreement concerning the value proposition of risk management. Value is created on the left hand side (LHS) of the balance sheet through investment decisions. The value of risk is to ensure funding of the investment plan by maintaining capital market access under all conditions. This entails maintaining a total risk profile consistent with r?????? targets. This requiring balancing LHS asset portfolio risk with right hand side (RHS) capital structure. Failure to do so can under mind the institutions strategic position and independence. Examples include Citi and Lehman. Viewed as such, risk management is a capital structure decisions linking strategy and capital levels. Risk management needs to support the institution’s corporate strategy, which determines the risk universe faced by the bank organization as outlined in Figure 2. Then, using traditional underwriting, mitigation and transfer risk management techniques, you determine those risks which the institution is competitively advantaged to own and eliminate the reset. For example: local

9. III. RISK STRATEGY FRAMEWORK(continued) institutions have an informational advantage regarding evaluations of local clients. Thus, they should retain such risk up to prudent concentration levels. Alternatively, risks like interest rate risk, not be held unless the institution possesses special information. Then, the retained risk would be covered by capital consistent with a ratings goal, most likely investment grade, to ensure capital market access sufficient to fund the investment plan (see Figure 3). Viewed in this light, risk management and capital can be seen as interchangeable with capital being the cost of risk. In fact, risk management is essential synthetical equity. Equally, capital can be seen as substitute to risk management. The key is to avoid a mismatch between the LHS and RHS of the balance sheet. The overall institutional risk level is dependent on their risk appetite – the level of risk the organization is willing to assume on both sides of their balance sheet in the pursuit of their strategy. Risk

10. III. RISK STRATEGY FRAMEWORK(continued) appetite is a relative term among stakeholders. Usually aligned, there are instances when management and stakeholder appetites differ, usually leading to new management. Management risk appetite is best expressed as a con???? as reflected in Figure 4. The relevant risk constraint for most managers is being replaced. Unfortunately, many financial held large amounts of risk in which they had limited competitive advantages. This beta risk, while increasing nominal income, failed to create shareholder value.

11. DRIVERS OF RISK MANAGEMENT STRATEGYFigure 2 1 Need for financial flexibility 2 Business Model Operating cash flow forecast volatility Frequency US$ millions Corporate Strategy Investment plan and opportunities Risk management strategy 4 Stakeholder (Investors, Regulators and Rating Agencies) perspective 3 Financial structure impact And Ratings target Cost of financial flexibility Adapted from T. Oliver Leautier, Corporate Risk management for Value Creation (Risk Books, 2007)

12. Figure 3 Connect Capital and Risk to Investment Strategy Figure 3 Connect Capital and Risk to Investment Strategy Risk and capital as inputs into strategic planning: Choice of Markets with attractive economics in which the organization enjoys a competitive advantage Strategy Which markets Risk the organization is willing and able to accept in pursuit of its strategy Risk Appetite How much risk determines ????? R/A level retention types capital buffer Risks underwritten and retain comparative advantage Risk Assessment What type of risks based on ?????? Capital relative to Rating Agencies, Regulators and Peers Capital need How much capital do we need vs. have? Actual Physical Capital Capital Assessment Return capital to shareholders when actual capital exceeds need, or raise capital when need exceeds actual capital Capital Plan Capital Assessment Allocation to business units based on an economic capital determination Capital Allocation Return on capital relative to cost of capital total risk facing firm risk appetite risk to be transferred net risk vs. capital need/level ?????? … and not just consequences

13. Risk Appetite ContinuumFigure 3 Risk Appetite ContinuumFigure 3 Profit / Loss Distribution Probability Profit Warning – National city Rating Watch – Fifth Third Dividend cut – Citi Downgrade – Morgan Stanley Raise capital – Merrill Management replaced – Prince, O’Neil Regulatory Action – Cease and Desist, Memorandum of Understanding Failure – Bear, Lehman, WaMu - 0 + Profitability

14. Regulators CEO: Investment Strategy Internal Stakeholders CFO How much Capital do I need Risk Appetite CRO What Risks Do I Retain External Stakeholders Reconciled by Board Shareholders Agencies Internal Risk Appetite External Risk Appetite Value Creation Asset Portfolio Capital Management Risk Structure Capital Structure Capital Required Capital Availability Economic Capital (Use)

15. The ERM Funnel – Figure 7 Risk Appetite Strategy Earnings Ratings Business Model Strategic Objectives Annual Goals Organizational Culture structure Shareholders Risk Identification Risk Assessment Risk Analysis Risk Strategy Infrastructure P. Sobel, Auditor’s Risk Management Guide: Integrating Audit and ERM (CCH, 2007)

16. Regulators External Stakeholders Shareholders Rating Agencies Match Internal/External Risk Appetite Not always in balance Assets (Return) Value Creation External Risk Appetite Return on Risk Cost of Capital Portfolio of Enterprise Risks Portfolio of Capital Resources Capital Required (Risk) Capital Availability/ (Funding) Capital Management Risk Structure Capital Structure Economic Capital (Use) …You can lose money

17. Figure 5 Asset Price Liquidity Price Offer Bid Panic Normal Time

18. DAR Control Framework Asymmetric InformationBehavioral BiasControl Adverse selection-lack Optimism Internal: Board information and chose Over confident monitoring incorrectly Illusion of control Incentives Moral hazard-lack Sanctions Information on Performance DAR External Regulators Market for corporate control

19. Figure 8. Financial Market Conditions Product Market Conditions Enterprise Risk Management Program Value Proposition I II III Management Information Governance Strategic Alignment Risk management Foundation (Infrastructure – Systems) Value Creation through Risk Management not Minimization Regulatory developments Economy

20. Figure 8 Risk Appetite Matched to Business Strategy Risk Tolerance Matched to Risk Appetite Captial Availability Matched to Risk Tolerance Return on capital Matched to Cost of Capital

21. Figure 7 Firm and Its Environment Environment Regulation Macro Economy Firm/ERM Governance Risk Appetite Strategy Capital Market Conditions Industry Conditions

22. Figure 8 Adaptive Risk Management Business Complexity Traditional Risk Management Functionally Oriented Risk Transfer and Avoidance Focus A A B C ERM Enterprise view Coordinated B C ER Adaptive mechanisms, informed by sensing capabilities Aligned with strategic imperatives Risk Management Maturity