Risk and Reward

Risk management officials quell suggestions they could have done more to detect accounting scams while acknowledging the system needs improvement

Risk management officials, who usually choose their words carefully, are talking in plain language about the repercussions of the corporate accounting scandals on their discipline and their organizations. As the shady accounting practices of Enron, WorldCom, Arthur Andersen and others unfold, they reject any suggestions that fraud could have been identified earlier if they'd practiced greater due diligence.

Risk managers aren't omniscient, said Bill Longbrake, vice chair, enterprise risk management at Washington Mutual. "I consider myself to be a risk solutions provider. I'm not a traffic cop."

Enterprise risk management, he noted, "is working with management to enhance business strategy in ways that minimize risk."

Only in hindsight were the warning signs of Enron apparent, he said. "It's easy to be a Monday morning quarterback."

Yet even as investigators try to piece together the Enron story, it's clear that a massive deception was perpetrated on those responsible for safeguarding the financial system-banks, the securities industry and regulators. How could it have happened?

"It's hard to know what was missed," said Don Truslow, chief risk officer at Wachovia Corp."It seems like there were things that were missed. But there was a lot of confidence placed in management."

Regulators have signaled the industry that it needs to take a much sharper tack on detecting accounting shenanigans.

"Directors should be asking the following question: Is management's accounting for material or its innovative transactions in sync with the substance of these transactions?" said Governor Mark Olson of the Federal Reserve Board in a speech earlier this year.

In retrospect, say risk managers, Citibank and JP Morgan Chase, the two biggest lenders to Enron, should have taken a closer look at debt-juggling transactions.

"A lot of what was done at Enron was off-balance sheet," said Kevin Blakely, chief risk officer at KeyCorp. "Maybe those who were lenders to Enron should have been digging deeper into the financial statements."

Yet for all their sophistication, the tools available to credit risk managers-analytics for scoring and mitigating risk, models for estimating probability of default, powerful data management technology-are ill-equipped to detect fraud. "It's often difficult to pick up fraud," said Truslow.

Nor are they reliable in assessing personal greed as a motivating factor in management decisions.

"Here were two companies Enron and WorldCom that were touted as being leaders in risk management. But it's now clear that there wasn't a solid risk management culture, a culture that drives people in doing the right thing," Truslow said.

Wachovia has been honing its own risk management culture in the year since its merger with First Union, creating a new operational risk management group, headed by Truslow, plus committees for asset/liability, market risk, credit risk, regulatory compliance risk-all overseen by the CEO. The guiding principle is that risks don't occur in a vacuum.

Only by understanding how the various types of risk fit together can an organization understand its total risk position.

"The merger gave us an opportunity to step back and think through how we want to build the risk management group for the new organization at Wachovia. How do we think about managing risk more holistically?" said Truslow.

FROM ART TO SCIENCE
Enterprise risk involves looking at risks corporate-wide, noted Angela Isaac, chief risk officer at Bank of Hawaii. "There needs to be an integration across credit, market and operational risks."

She continued, "Risks rarely occur in a singular fashion. A loss can be due not only to the default of a customer but to a failure to conduct proper due diligence and documentation."

Enron to the contrary, during the past few years the field of risk management has evolved from an art, where practitioners rely mainly on hunches and intuition, into a science.

"We're light years ahead of five years ago with new thinking about modeling, default prediction, data manipulation," said Truslow. "That trend will continue."

A fundamental development has been the introduction of economic capital (also known as risk-adjusted return on capital or RAROC), which aggregates risks across an entire enterprise and expresses them in standard units.

"The greatest strategic management tool is economic capital," said Key's Blakely. "Only through the process of economic capital allocation are you able to determine how much risk you have and how it's changing over time."

Economic capital makes it possible to compare risks in different lines of businesses. "A bond trading desk takes different types of risk than marine lending," Blakely said. "One takes credit risk, the other takes market risk."

By charging them economic capital, he said, "it doesn't matter what risk it is. What matters is they draw capital for all the risks they undertake."

In the past, the regulatory capital that banks set aside didn't adequately distinguish among the different risks.

"You could do a highly-leveraged, low-quality loan that would draw the same amount of regulatory capital as a high-quality, well-secured loan," said Blakely. "Same amount of capital, same return on equity."

Technology has allowed banks to make finer risk calculations, such as in credit scoring. "While credit scoring has been around for a long time on the consumer side, we're getting more sophisticated about credit scoring on the commercial side," said Blakely.

But, he continued, "we also have to know that once the credit defaults, how much did we lose? So you need probability of default and loss given default, and you can only do that using technology."

AGGREGATING RISK
Enterprise risk management is about providing the information that management needs to make informed risk decisions. Yet it doesn't make sense to talk about a single enterprise risk management system, according to Blakely.

"It's a collection of systems that add up to support economic capital," he said. "A VaR Value at Risk system on the trading floor, a credit scoring system on the consumer and commercial sides and an operational loss database. All are important components to build up economic capital allocation."

Not all risk managers think economic capital provides a sufficient picture of overall risk, however.

"I've been hesitant to derive a number that says here's our level of risk," said Wachovia's Truslow. "Quantitative methods are good tools, but they're only tools. Business judgment and processes are important as well."

Still, most vendors of risk analytics systems tout economic capital allocation as cornerstones of their products. ERisk, a New York-based vendor, offers a methodology that first analyzes the individual probability distributions of credit, market, interest rate and operating risks, then integrates them using the correlations between the different risk types, and finally determines the economic capital needed to support them.

"Vendors like ERisk have developed Web-enabled technology that integrates credit, market and operating risk," said Bank of Hawaii's Isaac.

Other leading risk management firms, such as KMV (acquired by Moody's earlier this year), Algorithmics, SunGard and QRM have adopted similar methodologies for credit and market risk. But such systems are intended for use by money center banks; for second-tier banks such as Bank of Hawaii, the cost of adopting an integrated enterprise risk management solution is often prohibitive.

1 of 2