Banks Must Aggregate Risk Management Efforts

No matter your opinion on the government's $700 billion bailout plan, there's no denying that senior management at most Wall Street firms relied on weak risk management strategies to inform critical decisions involving opaque and complex structured products at the heart of the subprime meltdown.

A growing image of information silos continues to emerge as financial institutions conduct their postmortems. Senior executives in many firms appear to have been caught off guard when trading positions had to be written down. Indeed, some issues were out of everyone's hands; consider that eight of the biggest Wall Street banking institutions lost roughly $1 trillion in combined market capitalization over the past year.

Below the executive ranks, risk managers may have thought they understood the size of their firms' mortgage exposures, but they struggled to understand how liquidity risk would make it challenging to unwind subprime positions. What many firms needed was more-robust information in aggregated firmwide risk reports -- information that could have captured the comprehensive risk attributes required to truly understand their exposures to the mortgage business.

Indeed, firms that have best insulated themselves thus far in the crisis are the few that have been addressing the need for stronger data collection and risk assessment processes for more than a decade. These institutions consistently viewed risk management as a core strategic principle and a source of enduring competitive advantage, long before risks reached a tipping point. Unfortunately, we've seen the results of a reactionary approach to risk management.

What we've learned is that successful firms elevate risk management responsibilities to the highest ranks -- generally on par with CFO-level positions. They align aggregated risk with corporate investment policies and objectives, and take a long-term, iterative view of infrastructure improvements. They address not only the consistency and timeliness of risk information, but also the breadth and comprehensiveness of this information.

Hindsight being what it is, most financial institutions now understand they missed an opportunity to reassess existing risk and control capabilities. Now banks and investment houses have no choice but to raise their ability to capture, analyze and act on risk information across the organization.

Risk Management Best Practices

But firmwide risk management is not a one-time event. Firms that position themselves best for the future will build these capabilities as part of an ongoing program consisting of short-, medium- and long-term initiatives. These strategies require consistent, ongoing investment in the people, information architecture, data and models required to reach an unparalleled understanding of all the dimensions that contribute to a firm's risk profile. This includes market, credit, operational, liquidity and reputation risk.

Data ownership and accountability will be just as important as the simulations firms use to evaluate risk. That means it is critical that the CIO has proper oversight of technology and the vital role it plays. Institutions that are best positioned to survive this crisis have CEOs who are the champions of their firms' technology direction.

Altering an institution's culture to make risk management a core strategic principle and a source of enduring competitive advantage is a tough task. But, as we've seen, it may very well be a matter of survival.

Rachel Parker and Daniel Pitchenik are partners in Diamond Management & Technology Consultants' financial services practice.