Journal of Financial Econometrics, 2005, Vol. 3, No.

1, 2636

New Directions in Risk Management

John Drzik Mercer Oliver Wyman

abstract
Following the 1991 recession, financial institutions invested heavily in risk management capabilities. These investments targeted financial (credit, interest rate, and market) risk management. I will show that these investments helped reduce earnings and loss volatility during the 2001 recession, particularly by reducing name and industry-level credit concentrations. I also suggest that the industry now faces major risk challenges (better treatment of operational, strategic, and reputational risks and better integration of risk in planning, human capital management, and external reporting) that are not addressed by recent investments and that will require development of significant new risk disciplines.

keywords: credit cycle, financial institutions, risk management

Risk management has been an area of explosive development over the last decade in both business and academia. Financial services has been the business sector in which risk management has made the most rapid progress, and the single most significant change in practice has been the approach to credit risk management taken by commercial banks. In the early 1990s, pioneering banks started to migrate from the traditional judgmental buy and hold approach to credit to a more quantitative, market disciplined approach to credit underwriting, pricing, and portfolio management. The new credit paradigm began to spread, taking hold first among large North American banks and a few European leaders, then spreading to others. There are many new directions for the development of risk management, which builds on the foundation built in the last decade. Potential new directions will be explored toward the end of this article. Before looking forward, though, we will look back at the last decade, both at general developments and at results. Specifically we will examine whether banks in the United States, where risk management developments were earliest, performed better through the recent recession (versus their

Address correspondence to John P. Drzik, Chairman, Mercer Oliver Wyman, 99 Park Ave., 5th Floor, New York, NY 10016, or e-mail: jdrzik@mow.com.

doi:10.1093/jjfinec/nbi007 Journal of Financial Econometrics, Vol. 3, No. 1, Oxford University Press 2005; all rights reserved.

Drzik | New Directions in Risk Management

27

performance in the recession of the early 1990s). In short, did advances in risk management tangibly improve bank performance when times got tough?

DEVELOPMENTS DURING THE LAST DECADE

Banks invested heavily in risk capabilities during the 1990s and early 2000s. Their ability to measure and quantify risks improved tremendously during those years, as new methodologies were developed to cover first market risk, then credit risk, and now operational risk. A common language of risk, rooted in economic capital, emerged to allow the aggregation and comparison of unlike risks. Risk management practices also improved significantly during this period. Risk limits and limit monitoring practices became more prevalent and moresophisticated, with banks increasingly setting limits at multiple levels (individual counterparty limits, for instance, complemented by aggregate risk grade and industry limits). Most banks introduced portfolio management disciplines, as they increasingly recognized the risk impact of geographic and industry concentrations and began to move away from the traditional buy and hold approach to credit origination and ownership. Organizationally the risk function also assumed greater prominence in banks management structures. Ten years ago the most senior risk professional at most banks was the chief credit officer (CCO), who spent most of her time reviewing individual loans. Today, most banks chief risk officers (CRO) have vastly expanded responsibilities and influence. CROs are typically responsible for virtually all types of risks that banks face, are frequently key participants in their institutions strategic planning process, and often report directly to the president, chief executive officer (CEO), or even the board. Banks have also placed greater emphasis on risk and risk management in their reporting to the outside world, with information on risk levels, riskadjusted performance, and risk management processes featured prominently in annual reports, analyst presentations, and the like. As banks were deepening their risk management capabilities, other market participants were also evolving. Regulators and rating agencies necessarily deepened their understanding of risk measurement and management approaches to keep pace with developments at leading financial institutions. More generally, the financial markets also continued to develop; previously illiquid asset classes have become more liquid as new trading markets have developed and as new risk transfer vehicles, such as securitizations and credit derivatives, have been created.

REAL PROGRESS?
A key question, though, in reviewing this impressive set of developments, is whether they really made a difference. To test how a decades worth of investments in risk management have performed in practice, we examined two tests for U.S. commercial banks: the 1990 and 2001 recessions. To be fair, the two recessions were somewhat different in nature and severity. As seen in Figure 1, the 2001 recession was somewhat shallower and briefer than the 1990

28

Percent Change (Real Dollars)

2.00%

1.50%

Journal of Financial Econometrics

1.00%

0.50%

0.00%

-0.50%

-1.00% 1993 1994 1996 1988 1989 1990 1991 1992 1986 1987 2000 2002 2003 1995 1997 1998 1999 2001
2001 Recession

1990 Recession

Quarter

Figure 1 Quarterly change in GDP. Source of data: National Bureau of Economic Research.

Drzik | New Directions in Risk Management

29

recession (and than the average postwar recession). Neither real gross domestic product (GDP) nor industrial production fell as steeply as in other recessions. At the same time, the postrecession recovery was also shallower than the recoveries that followed the 1990 recession and other preceding recessions. Payroll employment figures failed to grow at all following the official end of the 2001 recession, and growth in real personal income has been relatively anemicboth phenomena that probably exerted some continuing postrecession pressure on bank credit performance. Banks were also somewhat better positioned going into the 2001 recession than they had been going into the 1990 recession. Capital:asset ratios for the banking industry as a whole were roughly 56% in 1989, but had climbed to about 78% in 2000. The extra capital cushion that was present in 2000 had the effect of allowing banks greater flexibility and resources with which to weather the recession. While the two recessions were clearly not identical, and bank starting points were different, our sense is that they do still provide a basis for judging whether changes in bank risk management had a tangible impact over the last decade. So, setting aside for now differences between the recessions, we can turn to the central question: Did banks perform better in the more recent recession? The data overwhelmingly support the conclusion that banks performed, not a little better, but much better during the 2001 recession than during the 1990 recession. As shown in Figure 2, credit quality was substantially better. Although nonaccruing loans rose in each recession, the peak in 2001 was nowhere near

% Non-Accruing Loans 3.5% 3.0% 2.5% 2.0% 1.5% 1.0% 0.5% 0.0%

Non-Accruing Loans/Leases as a % of Total Loans/Leases for Commercial Banks and Savings Institutions

1986 1988 1990 1992 1994 1996 1998

Figure 2 Credit quality. Source of data: SNL Securities.

2000 2002

30

Journal of Financial Econometrics

the peak in 1990 and the degree of increase from the prerecession years was much more moderate. Figure 3 demonstrates that loan charge-offs followed a similar pattern, peaking in each recession, but with 2001 levels substantially lower than 1990 levels. Why did banks enjoy superior credit performance in the most recent recession? Our hypothesis is that the performance differential reflects a combination of better risk-taking decisions and more efficient redistribution of risks. Banks ability to gauge the creditworthiness of borrowers increased substantially during the 1990s, and underwriting processes were retooled to take advantage of these improvements. As a consequence, banks were able to do a better job picking and choosing which credit risks they wished to underwrite. Of importance is that banks after 1990 also developed a healthy respect for concentration riskthe impact of having too many highly correlated risks. Concentration limits put in place during the 1990s helped ensure that in 2000, most banks had reasonably diversified portfolios, and hence were not as badly hurt by exposures to particular industry sectors or geographies. Banks were also able to pass through risks to the capital markets more effectively as loan markets became more liquid and as credit risk transfer vehicles such as

Net ChargeOff Rate

2.0% 1.8% 1.6% 1.4% 1.2% 1.0% 0.8% 0.6% 0.4% 0.2% 0.0% Net Charge-Offs

Q1 1995

Q1 1996

Q1 1997

Q1 2002

Q1 1994

Q1 1998

Q1 1999

Q1 2000

Q1 1988

Q1 1989

Q1 1990

Q1 1991

Q1 1992

Figure 3 Credit losses. Source of data: SNL Securities.

Q1 1993

Q1 2001

Q1 2003

Drzik | New Directions in Risk Management

31

derivatives and securitizations became more prevalent. As a result, credit risks (and ultimately credit losses) were increasingly likely to be borne not by the highly leveraged banks that structured and originated loans, but by less-leveraged investors who acquired these risks from the originating banks. As such, the relatively moderate loss experience for banks in the last recession understates the losses by investors as a wholewhich has sharpened the focus on credit risk management at insurers, pension funds, and other end-investor segments that were hit with these losses. U.S. banks were also judged by the analyst community to weather the recent recession well. As shown in Figure 4, between 1989 and 1991, ratings agencies hit U.S. banks with a significant number of downgrades and very few upgrades. During the 19992001 period, in contrast, downgrades increased only slightly, and were in fact outnumbered by upgrades. Evidence also suggests that banks didnt just learn how to avoid losses during the 1990s, they also learned how to be more appropriately compensated for risks taken. We analyzed credit pricing relative to underlying risk at dozens of financial institutions during the 1990s and found a very consistent pattern. In the early 1990s, credit pricing was relatively flat. Less creditworthy corporations frequently did

40

20 + 0 20

40

60

80

100 1986 1990 1995 2000 1987 1988 1989 1991 1992 1993 1994 1996 1997 1998 1999 2001 2002 2003

Figure 4 U.S. bank upgrades/downgrades, 19862003. Source of data: Moodys Investor Services.

32

Journal of Financial Econometrics

Spread
Required Economic Pricing

Illustrative 2001 Pricing

Illustrative 1990 Pricing

Credit Quality
Figure 5 Economic versus actual pricing, 1990 versus 2001. Source of data: Mercer Oliver Wyman.

not pay banks much more for credit than did their more creditworthy peers. By the end of the 1990s, this pattern had changed substantially. While it remained true that many banks still underpriced high-risk credits and overpriced low-risk credits, market pricing displayed much greater sensitivity to underlying risk than it had at the beginning of the decade. This sea change in pricing practices has had a major impact on bank performance and should ultimately make banks much more attractive businesses from an investors perspective. The performance of bank equity during the last recession suggests that investors may in fact be beginning to take note. Bank equities underperformed the broader market in 1990, reflecting investors beliefs that banks were recession sensitive and prone to substantial earnings surprises in a down credit cycle. During the period around the 2001 recession, in contrast, banks actually outperformed the broader market. By late 2003, banks had basically regained their peak prerecession valuations; the broader S&P 500, while recovering, was still substantially below its most recent highs.

Drzik | New Directions in Risk Management

33

Index
600

500

S&P 500 Financials Index

400

300

200

S&P 500 Index

100

0 Sep-89 Sep-94 Sep-95 Sep-96 Sep-00 Sep-02 Sep-90 Sep-91 Sep-92 Sep-97 Sep-98 Sep-03 Sep-93 Sep-99 Sep-01

Figure 6 S&P 500 versus S&P financial index, 19892003. Source of data: Standard & Poors.

Our conclusion: risk management made a difference. While the 2000 recession was admittedly a less severe test for banks than was the 1991 recession, the substantial improvement in bank performance has to be at least partly attributable to better risk management practices. An improved ability to measure risk, improved decision-making processes about which risks to take, improved diversification of bank credit portfolios, improved pricing, and an improved ability to pass risk through to the capital markets all added up to real progress: fewer losses and better risk-adjusted returns. Banks still have many ways in which they can further improve their risk management, but the performance in the recent recession suggests some, if not most, of the investments over the last decade paid off, and therefore looking for future new development directions makes sense.

WHATS NEXT?
While progress in the last decade was substantial, there are several major new challenges to be addressed. We have highlighted four below:

Conquering the Unknown in Risk Measurement

Investment in risk measurement technologies over the last decade has concentrated on credit risks and market risks. These can be described as known risks, since their frequencies, severities, and loss probabilities can be measured, or at least reasonably estimated. This category of risk would also include the traditional mortality and hazard risks measured by the insurance actuarial community.

34

Journal of Financial Econometrics

Many major risks, though, are virtually untouched by these new measurement techniques. Operating risks, for instance fraud, suitability, or legal risks, have generally not been modeled and quantified by most banks. However, banks are well aware of these risks and generally have some processes in place to mitigate damage from them. However, the risks are unknown in the sense that they are not yet well measured and the cost/benefit analysis of proposed changes to practices in these areas is hard to evaluate. Over the next decade, a key direction for risk management will be to convert unknown risks to known risks by developing measurement techniques that are suitable and effective for the new challenges.

Connecting Risk Management to Business Strategy

Arguably risk managements greatest value to banks comes from helping to shape business decisions. Which growth strategies offer the best risk-adjusted returns, and ultimately the greatest shareholder value creation? Which new customer segments should be pursued? What new products and services are required? Which risks are worth taking, and which are not? The challenge for risk management is to develop a way of partnering with business management to answer these questions, while continuing to play an independent, objective control function. Mercer Oliver Wyman recently surveyed the CROs of more than 40 large financial institutions to discuss their roles in driving the strategic directions of their institutions. We also asked these CROs [as well as chief financial officers (CFOs) from the same institutions] whether they were satisfied with their investment in risk measurement tools and whether they felt that the institution was deriving real business benefit from those tools. The results showed an interesting correlation. Institutions that reported deriving real business benefit from risk measurement investments were overwhelmingly the same institutions that reported that the CRO was a major participant in the strategic planning and strategic capital allocation processes. Where the CRO was not involved, or was only weakly involved, in these planning processes, we heard a different story: at such institutions, advanced risk measures were used primarily for control purposes, and there was a general sense that real business decisions were not much improved. Given that generating attractive organic growth levels is a core strategic thrust for most banks, a critical new direction for risk management practitioners will be to help line executives channel their growth ambition into areas where the overall risk level is considerable, and strong risk-adjusted returns can be achieved.

Achieving Greater Transparency

The current business environment, with its pointed emphasis on corporate governance, is making it critical for banks to explain their risk profiles publicly with greater clarity and detail than ever before. Risk is still a complex and technical subject, so achieving transparency will not be easy. Internal constituents, analysts, ratings agencies, investors, and regulators all have varying levels of understanding

Drzik | New Directions in Risk Management

35

of advanced risk measurement techniques. All will require continuing education before the market as a whole reaches a common understanding of risk. The benefits of achieving this common understanding, though, will be considerable and will extend far beyond the Sarbanes-Oxley compliance motive that is driving much of the current effort to increase transparency. For one thing, it is worth noting that, despite their strong relative performance in recent years, banks valuations remain depressed relative to nonbank peers. The price/earnings (P/E) ratio for the global financial services sector as a whole, for example, averages about 35% lower than the same ratio for the nonfinancial sector. An explanation for part of the discount is the opacity in the risks of financial institutions (banks are described by some as blind pools of risk). Investors simply dont believe that they have a clear enough or complete enough picture, and hence they worry about the potential for unexpected earnings surprises in the future (skeletons in the closet). Transparent, understandable, and consistent reporting on risk is one way for banks to win over investors and help to mitigate this 35% P/E discount. If opacity explains any significant part of the 35% discount, this new direction could have a very material effect for bank executives and shareholders.

Changing the Way Human Capital is Managed and Rewarded

Human capital management is a major challenge for the risk management function of most large financial institutions. A decade ago, the risk management function, if it existed at all, was likely small, and was populated almost entirely with technical experts. Today, risk management is typically a major unit; at some institutions, literally thousands of employees report up to the CRO. Among the consequences of this explosive growth are

CROs can no longer be technical experts only, they must increasingly be strong leaders and general managers as well. The risk management function must develop the capacity to attract and retain large numbers of staff from a wide range of backgrounds: Some with technical qualifications, others with more general business skill sets. Some internally grown in the risk function, others transferred/seconded from the line, others hired from outside. The risk function leadership must be able to manage a complex mix of talented professionals, define career paths for them, and help them manage their careers in the organization.
The risk management function is also increasingly impacting how human capital is managed elsewhere in the institution. Most institutions articulate a desire

36

Journal of Financial Econometrics

to create a firmwide risk culture in which all employees constantly think about risk-reward trade-offs. However, relatively few firms, even financial institutions, provide the risk management function with a significant voice in deciding how incentives are determined for line risk takers and line executives in the organization. Making risk management a strong participant in setting compensation policy and levels will be a controversial, but probably necessary step toward creating the much-desired organization-wide risk culture. These four areas alone are a challenging agenda for risk professionals to tackle in the coming years, and it is far from an exhaustive agenda. Risk management will continue to be an area of investment in the financial services sector, and a growing discipline in nonfinancial corporations as well. As the tangible successes of risk management developments in this last decade are increasingly recognized, these trends will only accelerate.

Reproduced with permission of the copyright owner. Further reproduction prohibited without permission.