The future lies in risk management, but keep it simple
Risk management is back in vogue. The collapse of Lehman Brothers, government bailouts and the unchecked greed of hedge fund manipulation has reawakened concepts of risk that had lain dormant during the boom years. Liquidity risk is now self-evident as central banks, even in the Gulf, pool resources to keep the lifeblood of banking circulating through the system. Operational risk is a key area for institutions.
One common failing is the inaccessibility of risk information. Too often, it is buried deep within banks, in specialist risk functions. There is abundant information that is isolated from both the boardroom and the business lines, manifesting itself only through systems of limits and in annual business planning exercises. The recent financial fiascos and seeming lack of risk management controls means that this approach is dead and buried for a long time to come. Banks need to bring this wealth of information to the surface through improved reporting frameworks, but in a way that is understood by many and not just by risk management specialists. Financial institutions also need to find better ways to use this information, for in the final analysis, what is the use of having this information if it cannot be used effectively?
Although the analytical tools that are most commonly used to inform business and strategic decisions - such as economic capital and value at risk - seem to provide appealingly simple numbers, they come with a lot of caveats that are tough for non-specialists to grasp. It makes them poor management tools. Rather than using these complex, aggregate risk indicators to make decisions, banks should try to build a more fundamental understanding of the risk factors to which each of their businesses is exposed. In simple terms, which lines make most money and what level of risk do they take?
The culture of risk management has to be changed, however, starting at the highest levels of institutions. Board directors, chairmen and chief executives have to accept that risk management is as important as earnings growth and insist that the rest of the organisation shares that view. Tackling these challenges has to be the risk management agenda for the next few years. If they do not do this voluntarily, then their regulators will now insist that they do so compulsorily. Banks need to bring risk information to bear on every decision they take. To achieve this transformation, risk needs to be demystified and made accessible. People at all levels of the organisation need to be shown how to make decisions in a more disciplined, rigorous way, taking into account the relative likelihood of different outcomes and the extent to which those outcomes can be supported by the organisation.
Basic questions will have to be asked. Why are we in these lines of business? What risks do we take? How do we evaluate counterparty risk? Is the risk taken commensurate with the levels of profit earned? That, fundamentally, is what risk management has always been about, but getting the whole organisation to play a part will mean finding simpler tools than the complex multi-factor models and cumbersome methodologies that currently exist in the risk function.
Factoring risk into an organisation's decision-making process will not magically guarantee that every decision works, nor that every course of action a company takes will result in more profit than all of the alternatives. There is still much that remains out of a bank's control, as the international financial contagion has shown, even in the Gulf, which was in a state of denial at the beginning of the world financial crises.
There are other benefits, too; organisations which adopt a more rigorous approach to decision making are leaving behind a map for other employees to follow in the future. One reason for the current crises is that we seem to lose part of our collective memories of earlier crashes, as older and experienced players leave the profession. By institutionalising knowledge, institutions know why one course of action was chosen over another, and on what assumptions or considerations the decision was made. This fosters transparency and accountability, while also making it easier for an organisation to learn from its past mistakes.
The implementation of Basel II had already prompted the largest banks to analyse credit and market risk more closely. Many practitioners suggest that the third Basel category, operational risk, has been the poor relation of the Basel approach - until now. The financial crisis has now focused minds. Institutions are more aware of how losses can affect the solidity of the bank. It is not that operational losses could cause the bank to go under, but the bank incurring those losses in turn affects how counterparties perceive the bank, and their access to long-term funding.
This is what the interbank credit crunch is all about. Whatever the final outcome of the credit and financial crises, risk management is definitely back at the top of the agenda. Dr Mohamed A Ramady is a former banker and currently visiting associate professor, finance and economics, at King Fahd University of Petroleum and Minerals in Dhahran, Saudi Arabia