Business — Banking — Management — Marketing & Sales

Beyond the basic four financial risks, viz., credit, interest rate, foreign exchange and liquidity risk, banks have a host of other concerns as was indicated above. Some of these, like operating risk, and/or system failure, are a natural outgrowth of their business and banks employ standard risk avoidance techniques to mitigate them. Standard business judgment is used in this area to measure the costs and benefits of both risk reduction expenditures and system design, as well as operational redundancy. While generally referred to as risk management, this activity is substantially different from the management of financial risk addressed here.

Yet, there are still other risks, somewhat more amorphous, but no less important. In this latter category are legal, regulatory, suitability, reputational and environmental risk. In each of these risk areas, substantial time and resources are devoted to protecting the firm’s franchise value from erosion. As these risks are less financially measurable, they are generally not addressed in any formal, structured way. Yet, they are not ignored at the senior management level of the bank.

Risk Aggregation and the Knowledge of Total Exposure

Thus far, the techniques used to measure, report, limit, and manage the risks of various types have been presented. In each of these cases, a process has been developed, or at least has evolved, to measure the risk considered, and techniques have been deployed to control each of them. The extent of the differences across risks of different types is quite striking. The credit risk process is a qualitative review of the performance potential of different borrowers. It results in a rating, periodic re-evaluation at reasonable intervals through time, and on-going monitoring of various types or measures of exposure. Interest rate risk is measured, usually weekly, using on- and off-balance sheet exposure. The position is reported in repricing terms, using gap, as well as effective duration, but the real analysis is conducted with the benefit of simulation techniques. Limits are established and synthetic hedges are taken on the basis of these cash flow earnings forecasts. Foreign exchange or general trading risk is monitored in real time with strict limits and accountability. Here again, the effects of adverse rate movements are analyzed by simulation using ad hoc exchange rate variations, and/or distributions constructed from historical outcomes. Liquidity risk, on the other hand, more often than not, is dealt with as a planning exercise, although some reasonable work is done to analyze the funding effect of adverse news.

The analytical approaches that are subsumed in each of these analyses are complex, difficult and not easily communicated to non-specialists in the risk considered. The bank, however, must select appropriate levels for each risk and select or, at least articulate, an appropriate level of risk for the organization as a whole. How is this being done?

The simple answer is «not very well.» Senior management often is presented with a myriad of reports on individual exposures, such as specific credits, and complex summaries of the individual risks, as outlined above. The risks are not dimensioned in similar ways, and management’s technical expertise to appreciate the true nature of both the risks themselves and the analyses conducted to illustrate the bank’s exposure is limited. Accordingly, over time, the managers of specific risks have gained increased authority and autonomy. In light of recent losses, however, things are beginning to change.

As the organizational level, overall risk management is being centralized into a Risk Management Committee, headed by someone designated as the Senior Risk Manager. The purpose of this institutional response is to empower one individual or group with the responsibility to evaluate overall firm-level risk, and determine the best interest of the bank as a whole. At the same time, this group is holding line  officers more accountable for the risks under their control, and the performance of the institution in that risk area. Activity and sales incentives are being replaced by performance compensation, which is based not on business volume, but on overall profitability.

At the analytical level, aggregate risk exposure is receiving increased scrutiny. To do so, however, requires the summation of the different types of risks outlined above. This is accomplished in two distinct, but related ways. The first of these, pioneered by Bankers Trust, is the RAROC system of risk analysis. In this approach, risk is measured in terms of variability of outcome. Where possible, a frequency distribution of returns is estimated, from historical data, and the standard deviation of this distribution is estimated. Capital is allocated to activities as a function of this risk or volatility measure. Then, the risky position is required to carry an expected rate of return on allocated capital which compensates the firm for the associated incremental risk. By dimensioning all risk in terms of loss distributions, and allocating capital by the volatility of the proposed activity, risk is aggregated and priced in one and the same exercise.

A second approach is similar to the RAROC, but depends less on a capital allocation scheme and more on cash flow or earnings effects of the implied risky position. This was referred to as the Earnings At Risk methodology above, when employed to analyze interest rate risk. When market values are used, the approach becomes identical to the VaR methodology employed for trading exposure. This method can be used to analyze total firm-level risk in a similar manner to the RAROC system. Again, a frequency distribution of returns for any one type of risk can be estimated from historical data. Extreme outcomes can then be estimated from the tail of the distribution. Either a worst-case historical example is used for this purpose, or a one- or two standard deviation outcome is considered. Given the downside outcome associated with any risk position, the firm restricts its exposure so that, in the worst-case scenario, the bank does not lose more than a certain percentage of current income or market value. Therefore, rather than moving from volatility of value through capital, this approach goes directly to the current earnings implications from a risky position.

The approach, however, has two very obvious shortcomings. If EaR is used, it is cash flow based, rather than market value driven. And, in any case, it does not directly measure the total variability of potential outcomes through an a priori distribution specification. Rather it depends upon a subjectively prespecified range of the risky environments to drive the worst-case scenario.

Both measures, however, attempt to treat the issue of trade-offs among risks, using a common methodology to transform the specific risks to firm-level exposure. In addition, both can examine the correlation of different risks and the extent to which they can, or should be viewed as, offsetting. As a practical matter, however, most, if not all, of these models do not view this array of risks as a standard portfolio problem. Rather, they separately evaluate each risk and aggregate total exposure by simple addition. As a result, much is lost in the aggregation. Perhaps over time this issue will be addressed.