Risk management failed in the financial crisis. Now, financial institutions have to win back the trust of regulators, customers – and the rest of the world. To do that, they need to demonstrate that their risk management has changed, that it works, and that it doesn’t stop the bank producing the kind of returns shareholders expect.
Getting it right means that every part of your business sticks within the risk appetite you’ve decided on. The leading financial institutions are already getting there. Their risk-management systems not only let the business comply with the rules and meet regulators’ expectations – they also allow the business to demonstrate those things.
These are some of the questions you can ask yourself:
Has your organisation consciously decided its risk capacity and appetite? How does your board know whether your organisation’s values, strategy and behaviour align to its desired risk profile? If not, you have work to do.
There are three main parts to this work. First, you need to decide how you’ll measure risk, allocate capital and evaluate your business performance. Then you need to look at the processes you use to monitor risks and performance. Finally, there’s making sure that you use your financial resources in a way that matches your risk appetite and your shareholders’ expectations. All that needs to be done in a way that supports your business, and helps senior management to make informed decisions.
A large UK bank wanted to set its risk appetite and be sure that its operations kept within it. We worked with the bank to do that. It meant building models that let us understand the bank’s risk-taking capacity, and how its current position compared to that. We set tolerances for each of the quantitative measures of risk. That meant the bank could monitor how well it was complying with the risk appetite it had set.
Then we defined the risks that the bank faces and set limits for each of them, allowing the bank to measure whether each of its business units was being consistent with the overall risk appetite. Finally, we set up governance arrangements so managers could see how their decisions would affect the bank’s risk profile. That meant the bank’s risk appetite was reflected everywhere – including reporting, personal objectives, training, business processes, compensation and benefits.
In all of this, our experience with similar organisations helped a great deal, as did our market intelligence. They meant our client could benchmark their risk appetite – and the way they measured it – against their peers.