Managing Risk

No longer solely about complying with regulations and protecting cost centers, risk management is being used by banks as a strategic tool to support product development and revenue-generation strategies. Collecting, storing and analyzing real-time data is the key.

JAMES WARD, Managing Consultant, PA Consulting, (New York)

KEN ABBOTT, Managing Dir., Market Risk Mgmt., N. and S. America, Bank of America (N.Y.)

DAVID M. ROWE, Group EVP, Risk Management, SunGard Trading & Risk Systems, (Wayne, Pa.)

MITALI KALITA, Manager, Pinnacle Systems, (Piscataway, N.J.)

BS&T: Do banks view risk management primarily as a cost center and regulatory requirement, or as a strategic tool and contributor to shareholder value?

Ken Abbott, Bank of America: This has changed over the past couple of years. More and more, risk management has gotten involved on the strategic side. As the methodologies have evolved, I can look at our back tests with some confidence and say, I'm providing an accurate gauge on how this business can lose on any given day. As we've proven our mettle methodologically - and this has been a long, slow evolutionary process - we've become more attuned to the real nature of risk-taking in large organizations.

Mitali Kalita, Pinnacle Systems: Banks consider risk management not only as a regulatory requirement but also as a strategic tool and contributor to shareholder value because both are interlinked. Apart from profit-making goals, risk management strategy helps banks to face other goals, such as accountability, transparency and performance, as demanded by the investors. Measuring and managing risk also makes good business sense, and banks that make this effort will find their investment rewarded.

James Ward, PA Consulting: At present, much discussion on risk management is focused on regulatory issues: Basel II, Sarbanes-Oxley, the PATRIOT Act, etc. However, this is a temporary aberration. During the 1980s and 1990s, banks increasingly came to see risk management as a strategic tool, and a key to growing shareholder value. And the trend is very much back in that direction. An increasing number of banks are framing their risk management development programs in terms of business value and seeing regulatory compliance as a positive side-effect of this work, rather than the driving force.

BS&T: With the renewed focus on growth and revenue generation in the industry, where does a risk management strategy fit in?

Abbott, Bank of America: At Bank of America, risk management is involved in the actual planning process. In general, it's become increasingly important as banks are taking more proprietary risk. We've come to live in a mark-to-model world. To the extent that this is the case, risk management has had to develop significant expertise in model building and model validation. This has been borne out through regulatory requirements.

Ward, PA Consulting: There is a temptation to see risk management as an activity focused on the downturn of the cycle. But the smarter banks know that it is the decisions they make now, on the upturn - to grow lending in certain sectors, to build new product lines, to acquire (or not to acquire) other banks - that will determine how they perform over the next few years, and in the next downturn. Therefore, a clear risk strategy, with strong policies and procedures to execute and enforce it, is essential to ensure that the opportunities to grow shareholder value are not lost by a rush to gain market share, irrespective of the risks involved.

Kalita, Pinnacle Systems: Risk management policy helps to reduce fluctuations in credit availability, saves time and effort spent in investigating lapses, reduces excessive buildup of unintended credit risks, and helps in building tighter lending standards during recessions. It enhances risk culture, reduces volatility of all risks, lowers provisions for bad debts, reduces operational losses and improves the institution's external ratings, thereby ensuring access to capital markets and raising organizational efficiency. It increases credibility and accountability, allowing greater transparency in operations to regulate the flow of returns.

David M. Rowe, SunGard: It is increasingly being recognized that excessive portfolio concentrations is an avoidable problem. Fifteen years ago, before the emergence of credit derivatives, that was much less true. Furthermore, the equity markets also are recognizing this and demanding improved portfolio management on the part of banks. This gives rise to the need for consolidated information supporting a single customer view across all products and divisions. Other pressures driving risk management strategies include cost reduction, bridging business silos, improving efficiency, reducing errors and streamlining the entire operation.

BS&T: How can banks measure operational risk? What technologies help in this effort?

Abbott, Bank of America: Operational risk is actuarial in nature, making it much tougher to estimate, whereas in market risk management, we can talk about a distribution of likely outcomes. In operational risk, we're talking about much more specific types of risk. The way we do that is by examining events which have cost institutions money in the past. If you look at different firms that have operational risk processes, behind all their technology is a database of events. So the key kind of information is what has happened in the past. When we talk about technologies, we're talking about almost insurance-type technologies involved in tracking the likelihood of loss, particularly where tail events are concerned.

Ward, PA Consulting: It used to be believed that operational risk was "too hard" to measure. The efforts of the industry over the last few years have clearly disproved that, but they have also shown that simplistic models are doomed to failure. A successful operational risk model needs to include a wide variety of data sources - internal and external loss data, scenario analysis, and indicators of the risk and control environment - and then requires tools to cleanse, combine and aggregate this data to form an integrated and comprehensive view of operational risks for senior management. Technology is required at all stages of this process: to collect, store, analyze and present the data.

Rowe, SunGard: Viewing operational risk as a simple extension of Market VaR [Value at Risk] or Credit VaR is a mistake. As regulators are increasingly making clear, the essence of operational risk is incorporating the Total Quality Management and Disciplined Process Control techniques pioneered by the Japanese in the 1950s, and adopted by the American manufacturing sector in the 1970s and '80s, to the banking sector. This involves capturing and monitoring many eclectic indicators of consistent execution in a wide variety of processes and incorporating these indicators into regular management decisions. Software for statistical process control has an important role to play in this process.

BS&T: What are the key technology developments, new tools and emerging technologies that are transforming the risk management solutions space?

Ward, PA Consulting: Operational risk systems are a key area of growth. But the package software market for operational risk is only just reaching maturity, and will develop further in the next year. Another interesting area is credit risk, where Basel has helped vendors to produce standardized packages, and many banks are looking to replace their in-house systems. Finally, we see a lot of room for banks to use innovative, and inexpensive, aggregation and presentation tools to dramatically improve the quality and accessibility of their risk management information: putting data on business managers' desktops in a real-time, flexible reporting environment that significantly improves their speed of decision-making.

Kalita, Pinnacle Systems: The key developments that will impact the risk management space are coming from the enterprise application integration (EAI) vendors. These vendors are moving to a standardization of the Enterprise Services Bus (ESB), which will be used to facilitate the distribution of data within an organization. Web technologies like .NET will also play a big role. The days are not far off when retail investors will be able to log on via PDA or mobile phone to their mutual funds and get a VaR analysis and other quantitative figures. Banks should monitor the latest developments in Web services, which is still the best bet to facilitate data aggregation for enterprise risk management.

Peggy Bresnick Kendler has been a writer for 30 years. She has worked as an editor, publicist and school district technology coordinator. During the past decade, Bresnick Kendler has worked for UBM TechWeb on special financialservices technology-centered ... View Full Bio