How to Identify and Mitigate Hidden Risk Concentrations

Both financial institutions and their regulators must deal with risk concentrations. They come in two types: observable and hidden.

Alla Gil

To manage these concentrations, banks set risk limits on various types of exposures, such as by borrower, industry or maturity. Larger institutions tend to be more diversified, but still need to (1) aggregate their exposures to identify significant risks; and (2) establish boundaries to mitigate them.

For both large and small institutions, the most critical threats often arise from hidden risk concentrations – those that only surface in stress scenarios when correlations between risk drivers sharply increase. Flagging and mitigating these obfuscated pools of risk is a big challenge.

A Three-Step Plan of Action

Three steps are needed to identify hidden exposure concentrations. The first step requires automatically generating scenarios to account for various shocks. The idea is to capture previously unprecedented scenarios, which result from the snowball effects of the initial shocks.

The second step calls for institution-specific drivers underlying the exposures to be linked to these generated scenarios. This can be achieved with ML-based regressions that realistically project behavioral patterns of a firm’s’ segments – like loan demands, deposit outflows and stress scenarios that significantly deviate from trends. (Keep in mind that standard regression techniques, which require stationarity to avoid overfitting, often perform poorly during unprecedented shocks and need management overlays.)

The third and final step entails properly capturing surges in correlations between exposures in the tails of risk distributions.

To illustrate this final point, let’s consider two credit exposures belonging to companies in the same industry, with the same high-grade rating. Assuming the same probability of default (PD) of half of a percent and correlation between the two credit spreads of 60%, the copula correlation between these two potential default events would be quite low: 14%.

Even with a high correlation between the credit spreads, the joint PD is low and the correlation between the joint defaults is also quite low. But if the outside shock increases their individual PDs to, say, 5% (as happens during major natural or human-made disasters), with the same 60% correlation between the credit spreads, the copula correlation doubles to 28%. Under a scenario where there is a substantial jump in PDs, the correlations between default events also increase.

The reason for such a dynamic is highlighted in Figure 1. The joint probability of defaults Q_1,2 can be expressed as bivariate normal distribution of two default boundaries Φ^-1(q₁) and Φ^-1(q₂), where q₁ and q₂ are respective default probabilities and ρ is the correlation between the two credit spreads.

The same joint probability of defaults Q_1,2 can be calculated for binary events with the copula correlation θ between default events. Figure 1 (below) shows the connection between credit spread correlation, ρ, and correlation between the defaults, θ. While the former one is fairly stable, the latter one depends on the level of the spreads – and the PD.

Figure 1: Joint Distribution of Defaults

Such a surge in correlations is typical during crises. It can happen between different asset classes as well. As shown in Figure 2, credit spreads and equity indices have an average historical correlation around negative 30% – but in crises it could jump to more than negative 90%.

Figure 2: Historical Performance of the S&P 500 Index and a BBB-rated Credit Spread

Source: FRED and Yahoo Finance

Hidden risk concentrations can be revealed through reverse scenario analysis, which can identify early warning signals for concentration increases.

Reverse scenario analysis, moreover, enables banks to proactively adjust their established internal limits to manage exposure to sectors, asset classes or geographies that pose higher risk.

The Evolution of Concealed Risks: Pre- and Post-GFC

Hidden risk concentrations, of course, are not new. Indeed, over the past 25 years, we’ve seen plenty of examples of these concealed risks – as well as evidence of the damage they can cause.

The most famous example of hidden concentration risk in the early 2000s occurred during the dotcom bubble, when many investment managers claimed they had no clue how much exposure they had to WorldCom. After WorldCom defaulted, it was revealed that this AAA-rated company was not only in every equity index but also in the CDO tranches of nearly all investment managers’ portfolios; the ripple effect of this collapse, moreover, impacted all other tech names, too.

WorldCom, of course, unraveled before the 2008 global financial crisis (GFC), when the financial focus still was on the obvious large exposures: setting limits on the size of loans or investments to single borrowers or sectors to prevent concentrated risk from a few large defaults.

While these measures addressed major risks, they largely overlooked more complex and interconnected factors that contributed to the GFC, such as systemic vulnerabilities and interdependencies between financial institutions.

The GFC demonstrated how hidden risks — those masked by financial complexity and interconnections — could pose a far greater threat to financial stability than obvious risks. (One example of observable concentration risk is a bank’s lending practices, which are typically aligned with its areas of expertise.) Amid the GFC, seemingly well-diversified portfolios became concentrated during periods of stress, especially due to correlation spikes across asset classes and individual exposures.

Undoubtedly, the crisis made regulators reconsider the way financial institutions should treat concealed concentration risk. The Basel Committee on Banking Supervision’s Risk Concentrations Principles of 1999 never even mention the word “hidden” – that document, instead, was all about the integration of observable risk concentrations.

Right after the GFC, however, the BCBS issued its principles for sound stress testing practices and supervision, which highlighted the necessity to uncover hidden risk concentrations (via, e.g., reverse stress testing) as part of an effort to reveal vulnerabilities and inconsistencies in hedging strategies or other behavioral reactions.

Following the GFC, regulators encouraged banks to focus on identifying and mitigating these less visible dangers, recognizing that an external shock could trigger a cascade of failures elsewhere.

Parting Thoughts

Focusing only on the largest and most obvious risk concentrations is insufficient. Risk managers should not confuse integration of risk exposures with revealing hidden risks. The latter arise from systemic interconnections and increased correlated exposures, and present significant threats to the health of financial institutions.

Through enhanced reverse stress testing, proactive capital management, and liquidity provisions, both banks and their regulators should aim to detect and mitigate these concealed vulnerabilities before they can trigger another crisis.

Alla Gil is co-founder and CEO of Straterix, which provides unique scenario tools for strategic planning and risk management. Prior to forming Straterix, Gil was the global head of Strategic Advisory at Goldman Sachs, Citigroup, and Nomura, where she advised financial institutions and corporations on stress testing, economic capital, ALM, long-term risk projections and optimal capital allocation.