CRO Outlook
Tuesday, May 2, 2023
By Clifford Rossi
How many more failures are needed before the banking industry realizes that a more proactive, hands-on approach to risk management is clearly needed? Are more fiascoes really necessary to demonstrate the importance of bank board risk committees in preventing future bank runs?
The bell for change was once again rung loud and clear this week when the FDIC sold floundering First Republic to JPMorgan, after First Republic disclosed significant hemorrhaging in its deposit base. What’s more, news of this sale came on the heels of the release of the Federal Reserve’s analysis of the failure of Silicon Valley Bank (SVB), which found that mismanagement of interest-rate risk and liquidity risk at SVB was at least partly to blame for the bank’s collapse.
The question that all bank board risk committee members must now ask themselves, and must pose to their management groups, is what risks lie ahead – both for individual banks and for the industry.
So far, 2023 has been on a rollercoaster ride that banks, along with their depositors and investors, didn’t anticipate. In advance of further sectoral turmoil, board risk committees should now engage management teams in a robust discussion of real and potential risks to their business strategies.
Board Obligations to Oversee Risk
Every bank board member, in short, has a fiduciary responsibility to vigorously challenge management teams on risk-taking; those who are either unable or unwilling to meet this responsibility should resign from their positions. This rings particularly true for board risk committee members, as they represent the vanguard of boards of directors for overseeing the risk activities and profile of the firm.
Clifford Rossi
However, time and again, on the heels of a major risk event, we’ve seen reports that boards were either unaware of or indifferent to strategies leading up to the event. What’s worse, as we saw when SVB’s management team allegedly changed the bank’s modeling assumptions for interest-rate risk, some wrongheaded strategies have even been either actively or passively endorsed by the board.
In these cases, board risk committee members clearly have not received the message that they need to be fully present at board meetings – via, for example, actively questioning key strategic decisions and their impact on risk-taking. As this requires some knowledge about how a firm’s key risks manifest – and the strategies that are currently used to measure and mitigate them – this is not an easy task for most board members.
Indeed, boards typically take a relatively passive approach to engagement, especially on risk management issues. Management teams, after all, are supported by business and risk experts, and have access to more detailed reports and data, giving them a much better understanding of the company’s risks and business strategies than board members.
Complicating matters further are necessary reviews of complex financial threats, such as interest rate and liquidity risks that helped bring down SVB and Signature Bank. But those are only a part of the web of hazards with which bank board risk committees need to concern themselves today. Credit risk management should also be high on their agenda, given the signs of a slowdown in the economy.
In this environment of multiple risks knocking on the door of banks, what questions should bank board risk committees be asking?
Extracting Unbiased Answers to Emerging Risks
To prepare themselves, the board risk committees must firstly get a grip on the nature and principles of market and interest-rate risks, as well as liquidity and credit risks. It’s not just about gaining a general understanding of the definitions of these risks: boards must become students of the fundamentals of risk management.
Secondly, boards need to leverage a key risk governance tool – the executive session with the chief risk officer. Unlike many of their colleagues, boards have the power to set up a separate session with that senior-most risk leader, who can provide them with an unfiltered view of the bank’s risks.
SVB’s CRO stepped down in April 2022, and was not officially replaced until January 2023, so the bank did not have this board/CRO meeting of the minds for much of last year. However, according to its 2023 proxy statement filing, SVB’s risk committee met 18 times in 2022 – more than double the number of its meetings in 2021.
Massive holes were ultimately found in the bank’s interest rate and liquidity risk strategies, leading to its demise. But SVB’s management did its best to paint an optimistic picture of the bank’s financial health, even when it was on the precipice of collapse. This illustrates an important point: financial statements about risk-taking are mere words on a page, unless backed up by demonstrated risk management practices.
Credit, Liquidity and Interest-Rate Risk: Review and Question
Every board member and shareholder in this environment should abide by the old adage: trust, but verify. Boards should be conducting a thorough review of risk appetite statements, questioning the tolerance and metrics used to characterize key risks across the enterprise. Moreover, they should challenge management to develop mechanisms to better link risk appetite statements to strategy and business activity.
While a review of all risks is important, drilling into interest rate, liquidity and credit risk management is paramount. Few banking executives or board members have direct experience managing banks through a period of high inflation and interest rates. We’re now seeing the fallout from this inexperience, and calls for greater scrutiny of this rare combination of macroeconomic factors have grown louder and louder.
At the highest level, boards should not only be asking how much interest rate risk the bank should be taking but how the firm’s tolerance for interest-rate risk is currently measured.
Boards should also be asking whether stress tests on the bank’s economic value of equity and net interest income are being performed. If those tests are being conducted, they must strive to understand both the nature of the bank’s assumed interest-rate-shock assumptions and the data that is being used to run those scenarios.
Likewise, questions regarding deposit runoff assumptions, deposit diversification and the overall liquidity profile of a bank – including the stability of its funding and its amount of high-quality liquid assets – should be closely examined.
Appropriate metrics must also be employed to assess the bank’s tolerance for liquidity risk. Is there, for instance, a liquidity stress testing plan in place? If so, how often is that updated? What is the bank’s contingency funding plan, moreover, in the event of an unexpected cash shortfall?
While boards are reviewing interest rate and liquidity risk management, they cannot afford to take their eyes off potential credit risk issues. Keeping this in mind, boards should attempt to (1) determine where credit risk is emerging on the balance sheet; (2) understand any material changes in credit performance; (3) make sure management teams are looking at their credit policies in the event of deteriorating conditions; (4) assess loan loss-reserve practices and estimates over the next 12 months; and (5) ask about the firm’s credit mitigation plans and capabilities.
Parting Thoughts
Nagging worries over increasing credit risk and greater exposure to interest rate and liquidity risks will likely result in a bumpy ride for banks across the remainder of 2023. Proactive board risk committees therefore need to redouble their efforts to challenge management teams regarding the effectiveness of their risk management practices, including risk governance frameworks and risk appetite statements.
What’s more, bank board members should take the Fed’s recent findings on the failure of SVB as a call to arms to take nothing for granted and second guess every aspect of risk management. Adopting this approach will not only ease the concerns of shareholders but also enable banks to be better prepared for any expected or unexpected shocks that might come their way.
Clifford Rossi (PhD) is a Professor-of-the-Practice and Executive-in-Residence at the Robert H. Smith School of Business, University of Maryland. Before joining academia, he spent 25-plus years in the financial sector, as both a C-level risk executive at several top financial institutions and a federal banking regulator. He is the former managing director and CRO of Citigroup’s Consumer Lending Group.
•Bylaws •Code of Conduct •Privacy Notice •Terms of Use © 2024 Global Association of Risk Professionals