After the storm A new era for risk management in financial services Sponsored by SAS After the storm: A new era for risk management in financial services About this research A fter the storm: a new era for risk management in financial services is an Economist Intelligence Unit report that explores the way in which risk management is changing at the world’s financial institutions in response to the global financial and economic crisis The report is sponsored by SAS The author was Phil Davis and the editor was Rob Mitchell The Economist Intelligence Unit bears sole responsibility for the content of this report Our editorial team executed the online survey, conducted the interviews and wrote the report The findings and views expressed in this report not necessarily reflect the views of the sponsor Our research for this report drew on two main initiatives: l We conducted an online survey of 334 executives from around the world in March 2009 The survey included companies of a variety of sizes from the financial services industry All respondents have a primary focus on risk management l To supplement the survey results, the Economist Intelligence Unit conducted a programme of qualitative research, comprising a series of in-depth interviews with industry experts We would like to thank the many people who helped with this research June 2009  © The Economist Intelligence Unit Limited 2009 After the storm: A new era for risk management in financial services Executive summary A lmost two years since the financial crisis first emerged from the sub-prime mortgage business in the US, the repercussions continue to be felt Despite unprecedented efforts by governments, central banks and regulators, the cost to the global economy of the failure of the financial system will be huge, and felt over an extremely long period According to the latest Financial Stability Report from the International Monetary Fund, global bank losses are likely to exceed US$4.1 trillion In their efforts to bail out the banking system and deal with wider economic pain, public debt for the G20 countries will mushroom to more than 100% of GDP in 2014 The way in which financial institutions identify, assess and manage risks continues to fall under intense scrutiny The crisis has exposed the shortcomings of a whole host of risk techniques, and major soul-searching is now underway to ensure that the risk and controls functions in financial institutions will be more robust, authoritative and accountable in future Regulators, too, are eyeing the risk capabilities of the industry carefully, and considering the systemic implications of certain approaches to manage risk more thoroughly In March 2009, the Economist Intelligence Unit conducted a global survey on behalf of SAS to assess how risk management is changing in the world’s financial institutions The survey attracted 334 participants from across the financial services industry The report that follows presents the highlights of those survey findings along with related additional insights drawn from industry experts and commentators Key findings from this research include the following: We are seeing an erosion of confidence and a retreat from risk The survey reveals an industry that appears shell-shocked by the events of the past 18 months There is limited confidence in the ability of financial institutions to increase revenues or profitability over the next year, while less than one-third of respondents say that they are seeing confidence returning to their business This erosion of confidence is having a dramatic impact on the kind of business that financial institutions are willing to carry out, with a significant retreat to familiar, domestic business More than two-thirds say that they expect a greater focus on domestic business over the next year, while less than one-third are increasing their focus on overseas developed markets, and just over one-third on emerging markets  © The Economist Intelligence Unit Limited 2009 After the storm: A new era for risk management in financial services Transparency is a common theme to proposed reforms Asked about the initiatives that they thought would be most beneficial to the financial services industry, respondents pointed to greater disclosure of off-balance-sheet vehicles, stronger regulation of credit rating agencies, and the central clearing for over-the-counter derivatives as being three among the top four that have the greatest potential benefit Although these are wide-ranging initiatives, there seems to be a common theme across all of them – namely, the requirement for greater transparency and disclosure to facilitate the more effective management of systemic risk issues Reforms to risk management within institutions will be far-reaching and comprehensive Just onethird of respondents think that the principles of risk management in financial services remain sound In response to this, more than half of respondents say that they have conducted, or plan to conduct, a thorough overhaul of their risk management Key areas of focus, according to respondents, are likely to be improvements to data quality and availability, the strengthening of risk governance, a move towards a firm-wide approach to risk, and the deeper integration of risk within the lines of business Respondents say that the need for reform is being driven, in particular, by executive management, but regulators are also starting to apply the pressure Culture, expertise and data are the weak points in companies’ risk management Asked about the barriers to improving risk management in their organisation, respondents point to poor data quality, lack of expertise and a lack of risk culture among the broader business as being the most significant This theme of a lack of understanding between the risk function and the business certainly seems to be significant Asked about the areas where communication most needs improvement, respondents point to the channels between the risk function and lines of business as requiring most attention Elsewhere, just 40% of respondents say that the importance of risk management is widely understood throughout the company, suggesting that more needs to be done to embed risk culture and risk thinking more deeply in the institution Respondents lack confidence in the ability of supervisors to formulate the right response to the crisis Just three in ten respondents are confident that policy-makers can formulate an effective response to the crisis Regulators, in particular, are singled out as being a potential weak spot, with less than one-third rating their handling of the financial crisis as good or excellent (a lower proportion than for either central banks or governments) In terms of specific regulatory interventions, respondents are most confident in the ability of regulators to maintain overall stability of the financial system, with 53% expressing confidence here Far lower proportions are confident in their ability to monitor credit ratings and prevent conflicts of interest (18%); secure the implementation of compensation policies that support long-term shareholder value (24%); or co-ordinate the work of regulators across borders (25%)  © The Economist Intelligence Unit Limited 2009 After the storm: A new era for risk management in financial services How you currently rate the prospects for your business in the following areas over the next year? Rate on a scale of to 5, where 1=Significantly positive and 5=Significantly negative (% respondents) Significantly positive Significantly negative Revenue growth 10 24 36 24 Profitability 24 35 25 Share price 16 47 26 Relations with customers 13 43 32 11 Relations with investors 35 40 14 Capital adequacy 15 36 32 15 The business environment for financial services No one working in the financial services sector will forget the near-collapse of the financial system in late 2008 Just as market participants during the oil shock of the early 1970s and the crash of 1987 were shaped by their experiences, so will be those who witnessed the stomach-turning events of last year Since those momentous times, there have been intermittent signs of recovery in the world economy and predictions of doom have become fewer and less frequent Nevertheless, confidence is a fragile creature Financial services firms are still reeling from events and are mostly gloomy over the outlook for the next 12 months In an Economist Intelligence Unit global survey of 334 financial services executives, just one third expect a positive outlook for revenues and profitability, while one quarter expect a positive outlook for their share price One of the reasons for such pessimism is that globalisation, one of the key drivers of revenue for multinational firms, is now seen to be under pressure Amid a breakdown in global systems and trade, there will be a much greater focus on domestic business, and 68% of market participants questioned say that they expect an increased focus on business in their home market North American respondents, in particular, say they will be much more focused on domestic markets and much less on emerging markets than other regions Alan Keir, global head of commercial banking at HSBC, notes that the lack of trust across borders has become evident in everyday business “Open accounts are working less and less well and old-fashioned letters of credit [where the bank acts as an insurer] are coming back into fashion,” he says This, of course, raises concerns about financial isolationism Retrenchment to domestic markets is seen by many politicians and regulators as a way of containing risk, but in reality the opposite could well be true The events of the early 1930s, when the adoption of restrictive trade policies exacerbated the Great Depression, are clear indicators of the dangers Over the next year, what change you expect to the geographical focus of your organisation? Please rate on a scale of to 5, where 1=Significantly greater focus and 5=Significantly less focus (% respondents) Significantly greater focus Significantly less focus Domestic market 35 32 26 Overseas developed markets 22 33 21 18 Overseas emerging markets 12  25 29 15 © The Economist Intelligence Unit Limited 2009 19 After the storm: A new era for risk management in financial services Trust in the rule-makers? A second reason why respondents may appear pessimistic about their future prospects could be that they generally lack confidence in the ability of regulators and governments to deal with the current situation Indeed, just 29% believe that policy-makers can form an appropriate response to the crisis Central banks are generally believed to have handled the crisis more creditably than governments or regulators Only one in five respondents thinks that industry itself has handled the situation well There is, however, very limited confidence in the ability of regulators to create a healthy, functioning rules-based system One-quarter or fewer have confidence in the ability of regulators to co-ordinate their work across borders; put in place appropriate skills and expertise to keep pace with innovation in banking; monitor risks associated with the shadow banking system; monitor credit rating agencies; or mandate implementation of long-term oriented compensation policies Alan Greenspan, former chairman of the US Federal Reserve, says such expectations are, in any case, not realistic “The important lesson is that bank regulators cannot fully or accurately forecast whether, How would you rate the handling of the financial crisis by the following stakeholders? Rate on a scale of to 5, where 1=Very good and 5=Very poor (% respondents) Very good Very poor Central bank in your country/Eurozone region 34 31 22 Government in your country 28 28 27 10 Regulators in your country 25 30 24 14 Your industry sector 24 37 26 Your business 10 42 33 13 Your management team 15 46 27 Your risk management function 13 47 30 How confident are you in the ability of the regulators in the country in which you are based to carry out the following initiatives? Rate on a scale of to 5, where 1=Very confident and 5=Not at all confident (% respondents) Very confident Not at all confident Maintain overall stability of the financial system 14 39 28 15 Co-ordinate work of regulatory bodies across borders 21 38 27 Put in place sufficient skills and expertise to keep pace with innovation in the banking system 26 33 25 12 Restore trust in the banking system 34 37 17 Monitor risks associated with shadow banking system 23 32 28 12 28 12 Require implementation of compensation policies that support long-term shareholder value creation 21 36 Monitor credit rating agencies and prevent conflicts of interest 16 32 35 14 23 14 Mandate greater disclosure from hedge funds 25 34 Implement effective guidance on liquidity management 35 35 19 Ensure that off-balance sheet vehicles are reflected in minimum capital requirements  31 37 19 © The Economist Intelligence Unit Limited 2009 After the storm: A new era for risk management in financial services for example, sub-prime mortgages will turn toxic, or a particular tranche of a collateralised debt obligation will default, or even if the financial system will seize up,” he says “A large fraction of such difficult forecasts will invariably be proved wrong.” Nevertheless, financial services firms still put a great deal of trust and faith in rule-makers More than half are confident in the ability of regulators to maintain the overall stability of the financial system, while 43% are confident in their ability to restore trust in the banking system An over-arching faith in regulators and other government agencies should not, however, supplant a thorough re-appraisal of the mistakes of the past few years Indeed, a great many firms are now questioning their actions and examining whether their whole approach was flawed or whether just a few key aspects of their approach to risk were founded on unsound principles Have conventional risk measures failed? A highly sophisticated, globalised financial system has evolved over the past decade or so, with ever more participants using a proliferation of instruments and strategies Despite the complicated nature of the system, the core belief persisted that the market knew best and where this proved not to be so, existing risk measures would over-ride instinct But doubts have, unsurprisingly, crept in and many market participants and stakeholders believe that existing risk measures have failed to some degree Certainly this is what the survey reveals: less than one-third thinks, for instance, that the principles of risk management in financial institutions remain sound Peter Bernstein, founder of Peter L Bernstein Inc, an economic consultancy, says the doubts stem from the shocking events of the recent past “Does history really tell us anything about what lies ahead? Relying on the long run for investment decisions is essentially relying on trend lines But how certain can we be that trends are destiny? Trends bend Trends break Today, in fact, we have no idea where any trend lines might begin or end, or even whether any trend lines still exist.” Harvard professor identifies six risk errors Mr Bernstein, however, is principally referring to general market events For individual companies and markets, it may well be possible to pinpoint specific issues where risk measures failed In the March 2009 edition of Harvard Business Review, René Stulz, professor of banking and monetary economics at Ohio State University, identifies six ways in which risk has been mismanaged First, he says, there has been an over-reliance on historical data The calamitous fall in asset prices and demand was unimaginable to anyone basing their thinking on post-war performance alone Second, narrow daily measures, such as value at risk—probably the single most important measure in financial services—have underestimated risks The assumption behind a daily measure of risk is that action can be taken quickly (through an asset sale) to remove that exposure But, as the current crisis has shown, this is impossible when markets seize up Significantly, in the survey, one third of respondents think that tools such as VaR have been shown to be no longer fit for purpose Investment funds have perhaps felt the effects of the failure of such risk measures most keenly Permal, the New York-based fund of hedge funds group, with US$21bn in funds under management,  © The Economist Intelligence Unit Limited 2009 After the storm: A new era for risk management in financial services says that some of its underlying funds were caught out “VaR was widely estimated at 4-5% a month,” says Omar Kodmani, senior executive officer at Permal ”This rose by factors of two and three in the fall of 2008, showing you can’t rely on absolute numbers In other words, you can’t operate in a vacuum.” Third, according to Prof Stulz, knowable risks have been overlooked Managers who work in silos may appreciate the risks to which they personally are exposed But they may not see how risks being run elsewhere in the business could affect them too It could be argued that credit risk – the risk measure most exposed by the devastation of CDO and CLO values – is a knowable risk that has been overlooked For even though banks were buying and selling (and holding) billions of dollars of asset-backed instruments, there was little apparent will to assess the risks involved The problem stems, in large part, from the time when banks started to sell their credit risk on to third-party investors Until the summer of 2007, most investors, bankers and policy-makers assumed that this evolution represented progress that was beneficial for the economy In April 2006, the International Monetary Fund said that the dispersion of credit risk “has helped to make the banking and overall financial system more resilient” Bankers were happy to earn fees at almost every stage of the “slicing and dicing” chain and further benefited from regulators permitting them to make more loans By early 2007, financial officers at the UK’s Northern Rock, for instance, estimated that they could extend three times more loans, per unit of capital, than five years earlier But many of the new products were so specialised that they were never traded freely An instrument known as “collateralised debt obligations of asset-backed securities” was a case in point Instead of being traded, most were sold to banks’ off-balance-sheet entities such as structured investment vehicles (SIVs) or left on the books It was in this sense that credit risk was effectively overlooked by many banks Please indicate whether you agree or disagree with the following statements (% respondents) Strongly agree Slightly agree Neither agree nor disagree Slightly disagree Strongly disagree The US government should never have repealed the Glass-Steagall Act 19 27 37 9 15 There needs to be a move away from the “originate-to-distribute” banking model and a return to old-fashioned, “buy and hold” banking 17 37 23 Regulators should intervene directly in compensation policies 12 25 16 22 25 The principles of risk management in financial services remain sound 25 25 30 13 The Basel II capital framework has been shown to be deficient 13 34 33 14 16 Risk measures such as VaR have been shown to be no longer fit for purpose 12 36 31 Not enough human judgment is being applied in risk management decisions 31 42 17 Risk management does not have sufficient authority in our organisation 16 30 24 18 11 Analytics have become too complex to assist in business decision making 12 35 28 19 Mark-to-market practices have exacerbated the financial crisis 26 34 20 12 It is not possible adequately to manage risk in financial services 18 20 29 29 We have relied too heavily on external providers for credit ratings 24  36 22 11 © The Economist Intelligence Unit Limited 2009 After the storm: A new era for risk management in financial services Fourth, concealed risks have been overlooked Incentives have proved particularly dangerous in this regard Some traders and lenders may have enjoyed taking risky decisions that, in the short term, appeared to be working out well for their organisations But they had no incentive to report any downside risk Nassim Taleb, professor of risk engineering at New York University and the author of The Black Swan: The Impact of the Highly Improbable, explains the conflict “Take two bankers The first is conservative and produces one annual dollar of sound returns, with no risk of blow-up The second looks no less conservative, but makes US$2 by making complicated transactions that produce a steady income, but are bound to blow up on occasion, losing everything While the first banker might end up out of business, under competitive strains, the second is going to a lot better for himself.” Prof Taleb says this mismatch between the bonus payment frequency (typically, one year) and the time to blow up (about five to 20 years) is the cause of the accumulation of positions that hide risk by betting massively against small odds Fifth, there has been a failure to communicate effectively It is dangerous, says Prof Stulz, when risk managers are so expert in their field that they lose the ability to explain in simple terms what they are doing The board may develop a false sense of security by failing to appreciate the complexity of the risks being managed Finally, risks have not been managed in real time Organisations have to be able to monitor fastchanging markets and, where necessary, respond to them without delay Yet rapid and sophisticated responses are not necessarily an answer in themselves Just under half of respondents (47%) think that analytics have become too complex to assist in decision-making, while almost seven in ten think that not enough human judgment has been applied in risk management Charles Beach, regulation and compliance partner at PricewaterhouseCoopers, says that while quantitative risk measures remain an important part of the equation, a balanced and more forwardlooking approach, including the use of scenario-based assessments, should be developed to ensure that assumptions embedded in risk measures are continually challenged “As the appetite for more aggressive risk-taking begins to return to the banking industry, those firms that have truly embedded risk management into the fabric of business decisions will garner a clear competitive advantage,” he explains From the setting of strategy and risk appetite through to the execution and response to the changing risk profile, the terms “risk management” and “management” should be considered synonymous, he argues Regulators ignored key risk types While few traditional measures have fallen completely out of favour, there is broad agreement that regulation has been highly deficient Six out of ten respondents, for instance, agree that mark-tomarket accounting practices have made the crisis worse Meanwhile, just under a half of respondents (47%) think that the Basel framework has been shown to be deficient What should be taken into account, however, is that Pillar of the framework, which deals with the regulatory response to the rules on capital adequacy, had yet to be fully implemented when the crisis struck Moreover, any assumption of its deficiency should be balanced against the variation in interpretation among domestic regulators of the framework  © The Economist Intelligence Unit Limited 2009 After the storm: A new era for risk management in financial services Robert Mark, a board member at the US-based Professional Risk Managers’ International Association and chief executive of Black Diamond Risk, agrees He says that the Basel framework ignored funding liquidity, which essentially led to the downfall of Bear Stearns “Basel looked at market, credit and operational risk, but not at the controls on funding liquidity,” says Mr Mark This encouraged many institutions to ignore this risk, or assign it a low priority Mr Kodmani, for one, says some hedge funds “fell short” on liquidity risk management “There were no bids for a lot of instruments and the bid-offer spreads were meaningless This meant the estimated value of portfolios did not work.” Typically, banks have put risk into three buckets: market, credit and operational This suggests that liquidity is not generally considered to be a separate risk But other risk types have also been largely overlooked in financial services Steve Fowler, chief executive of the Institute of Risk Management, says that traditional banking risk measures are wrong-headed “Operational risk, for a start, is an invented term,” he says “It is seen as ‘everything apart from market and credit risk’ and therefore doesn’t really matter.” He argues that strategic risk is the key issue, whatever the industry “In other industries, they look at business objectives and strategies and align risks to those objectives Bankers need to talk in those terms too Maybe there needs to be more cross-fertilisation between banks and other industries.” Others argue that flexibility, rather than trying to identify the precise risk measure, is the critical issue BankWest, the Perth-based bank that was bought by Commonwealth Bank of Australia last year, says there are no “right” or “wrong” models “The important thing is to keep updating the models to reflect greater understanding,” says Ed Bradley, head of strategic risk analytics “We monitor the performance of our models on a monthly basis If the model deteriorates in predictive power, we recalibrate or rebuild the model.” Over-reliance on rating agencies Just as regulators are condemned for their lack of foresight, so ratings agencies are singled out for criticism More than six out of ten respondents think that they have relied too heavily on external sources for ratings Some have posited that the problem lies in the fact that rating agencies were never genuinely independent, but are essentially an arm of the same government that wished to see the expansion of home ownership “Given that government-approved rating agencies were protected from free competition, they would not want to create political waves by rocking the mortgage boat, engendering a potential loss of their protected profits,” says US economist Stan Liebowitz Given that these conflicts of interest were well publicised, perhaps market participants ought to have been more wary “Too few firms performed due diligence of their own,” says Mr Mark “There was certainly an over-reliance on them.” They should be just one of many inputs, he argues Financial institutions acknowledge the need for risk reform A series of influential papers from 2008 highlight areas of complacency with regard to risk management in many firms and product areas The Senior Supervisors Group, Financial Stability Forum, Institute of International Finance and Basel Committee all pointed to deficiencies in many financial institutions’ risk management practices  © The Economist Intelligence Unit Limited 2009 After the storm: A new era for risk management in financial services Over the next year, what you expect to be the three key areas of focus in the management of risk in your organisation? Select up to three (% respondents) Improving data quality and availability 41 Improving governance of risk 33 Developing “firm-wide” approach to risk 29 Embedding risk management within lines of business 28 Better and more sophisticated analytics 27 Improving communication and understanding between risk function and lines of business 24 Strengthening technology infrastructure 24 Linking risk management more closely with corporate performance 22 Building risk expertise at management level 19 Regulatory compliance (eg, with Basel II or Solvency II) 11 Recruiting experienced risk professionals Training of existing risk professionals Other, please specify market drops 25% is a tough ask,” says Mr Bradley “Now everyone is interested.” So for BankWest, overhauling risk management has applied less to systems and more to communication and integration of the systems into the strategic framework Data quality and availability are also being addressed by a large number of respondents to the survey Some have seen that this is a key issue for many years, although few can have known that they were preparing for a financial downturn where data quality suddenly became a precious commodity BankWest, for instance, has been investing heavily to improve its data quality since 2001, when meeting Basel requirements was recognised as a key performance indicator At that time, it established a committee to monitor and improve data “The impacts of this initiative are simple, yet critical from a risk perspective,” says Mr Bradley The bank is rolling out a project, for example, to input data just once and have it populate the whole system, while the system also rejects illogical inputs stemming from human error Sometimes, meaningful change is little more than tightening up existing risk measures BankWest says that it always discouraged 100% mortgage lending to retail customers, but occasionally waived requirements This is now proscribed Obstacles to the new risk environment Respondents to the survey consider the biggest barriers to improving risk management to be insufficient quality of data, lack of risk culture in the organisation and a lack of risk expertise Paul Strebel, the Sandoz Family Foundation Professor, says that lack of expertise is a recurring issue “Boards dominated by professional board members, CEOs and former CEOs of other companies have failed dismally They bring no industry expertise to the table, have little of their own wealth at stake, 16 © The Economist Intelligence Unit Limited 2009 After the storm: A new era for risk management in financial services What are the three main barriers to improving risk management in your organisation? Select up to three (% respondents) Insufficient quality of data 40 Lack of expertise 32 Lack of risk culture among broader business 31 Inadequate systems 30 Poor communication across organisational silos 30 Lack of investment 20 Insufficient data 17 Lack of authority for risk management 16 Lack of support among senior executives 14 Insufficient risk representation at senior management level 11 Insufficient risk representation at non-executive board level Other, please specify are too easily identify with the CEO/chairperson and go along with an increasing concentration of power at the top At the financial institutions with the biggest losses, the lack of industry expertise on the board was almost always associated with a dominant CEO and/or chairperson.” Meanwhile, John Legrand, managing director of Europe, Middle East and Asia Pacific at Eagle Investment Systems, says that data, or lack of it, is the over-riding reason why risk systems fail to fulfil their purpose “One of the significant reasons for executives’ lack of insight into their business, and their failure to understand the risks to which they were exposed, is the absence of a cohesive data management strategy.” He notes that when Lehman Brothers filed for bankruptcy in September, it took some buy-side firms weeks to establish their exposure. “But those firms with a centralised data management system integrated with their accounting system(s) were able to determine their exposure in a matter of hours.” He argues that there is a tendency for firms to think that, just by implementing a risk or performance system, they are gaining control and visibility However, this is not the case if they fail to have control over the data that feeds these systems One reason for this gap is that data management does not always make it to the top of the pile in terms of funding for new technology “Unfortunately, it is typically a crisis situation that causes firms to reassess their current strategies and look for ways to improve quality and prepare for other unforeseen obstacles,” says Mr Legrand 17 © The Economist Intelligence Unit Limited 2009 After the storm: A new era for risk management in financial services Conclusion I t is often only in times of crisis that genuine change does occur Change is not merely desirable now, it is critical to firms’ survival and their ability to compete in a marketplace that will inevitably become more rules-based and hence more complicated The best firms with the brightest people embrace change They will adapt and prosper in the new environment As we have noted in this report, confidence is currently low, and a lack of trust exists alongside a lack of self-confidence There is a great deal of hand-wringing currently taking place in the industry, and soul-searching questions are now being asked It is clear that some firms are asking themselves whether everything that they previously believed to be right, is actually wrong On closer examination it is evident that many of their risk processes were sensible, and even sophisticated, but sometimes poorly executed At the same time, there have been some inexcusable omissions, such as the lack of focus on liquidity and a dearth of processes around compensation But those who argue that we are fighting a losing battle and that it is impossible to adequately measure risk are probably not going to prosper in the years to come The truth is, firms need to improve what they do, not abandon their principles They are increasingly recognising the need for new ideas and approaches They should strike while the iron is hot, and before old and inadequate ways become embedded again Many firms have started the long haul already and are revamping, replacing and recalibrating systems and processes, despite the difficulties that cultural change confers Successful firms know that the answer to the big question of the past several months is not to take risk off the table Without taking clever, calculated, controlled risks, no firm can be successful Risk, in the final analysis, is not a function within a firm, it is the firm 18 © The Economist Intelligence Unit Limited 2009 Appendix Survey results After the storm: A new era for risk management in financial services Appendix: Survey results In spring 2009, the Economist Intelligence Unit conducted a survey of 334 senior risk professionals from the financial services industry Our sincere thanks go to all who took part in the survey Please note that not all answers add up to 100%, because of rounding or because respondents were able to provide multiple answers to some questions How you currently rate the prospects for your business in the following areas over the next year? Rate on a scale of to 5, where 1=Significantly positive and 5=Significantly negative (% respondents) Significantly positive Significantly negative Revenue growth 10 24 36 24 Profitability 24 35 25 Share price 16 47 26 Relations with customers 13 43 32 11 Relations with investors 35 40 14 Capital adequacy 15 36 32 15 Over the next year, what change you expect to the geographical focus of your organisation? Please rate on a scale of to 5, where 1=Significantly greater focus and 5=Significantly less focus (% respondents) Significantly greater focus Significantly less focus Domestic market 35 32 26 Overseas developed markets 22 33 21 18 Overseas emerging markets 12 25 29 15 19 Please indicate whether you agree or disagree with the following statements (% respondents) Strongly agree Slightly agree Neither agree nor disagree Slightly disagree Strongly disagree We expect business conditions to improve within the next 12 months 10 40 18 21 12 We have outperformed our peers during the financial crisis 27 29 23 14 We are seeing confidence returning within our business 24 31 29 We are seeing confidence returning to our investor base 21 36 29 10 We are seeing confidence returning to our customer base 26 30 31 We are confident that policy-makers can formulate an appropriate response to the credit crisis 19 23 29 30 © The Economist Intelligence Unit Limited 2009 12 Appendix Survey results After the storm: A new era for risk management in financial services How would you rate the handling of the financial crisis by the following stakeholders? Rate on a scale of to 5, where 1=Very good and 5=Very poor (% respondents) Very good Very poor Central bank in your country/Eurozone region 34 31 22 Government in your country 28 28 27 10 Regulators in your country 25 30 24 14 Your industry sector 24 37 26 Your business 10 42 33 13 Your management team 15 46 27 Your risk management function 13 47 30 Which of the following proposed reforms you think will be most beneficial to the financial services industry? Select up to three (% respondents) Greater disclosure of off-balance-sheet vehicles 34 Stronger regulation of credit rating agencies 31 Caps on leverage 29 Central clearing for over-the-counter derivatives 28 Expansion of regulatory oversight to other areas of financial services not currently regulated 25 Enhanced valuation processes for complex or illiquid assets 24 Increases to required capital reserves 23 Liquidity cushions 23 Enhanced disclosure around valuations 22 Reform of compensation systems (eg, bonus payment structures) 20 Greater clarity about where regulatory responsibilities lie 16 Supervisory colleges of cross-border regulators 10 Other, please specify 20 © The Economist Intelligence Unit Limited 2009 Appendix Survey results After the storm: A new era for risk management in financial services How confident are you in the ability of the regulators in the country in which you are based to carry out the following initiatives? Rate on a scale of to 5, where 1=Very confident and 5=Not at all confident (% respondents) Very confident Not at all confident Maintain overall stability of the financial system 14 39 28 15 Co-ordinate work of regulatory bodies across borders 21 38 27 Put in place sufficient skills and expertise to keep pace with innovation in the banking system 26 33 25 12 Restore trust in the banking system 34 37 17 Monitor risks associated with shadow banking system 23 32 28 12 28 12 Require implementation of compensation policies that support long-term shareholder value creation 21 36 Monitor credit rating agencies and prevent conflicts of interest 16 32 35 14 23 14 Mandate greater disclosure from hedge funds 25 34 Implement effective guidance on liquidity management 35 35 19 Ensure that off-balance sheet vehicles are reflected in minimum capital requirements 31 37 19 Which of the following statements best describes your organisation’s current status with the review of its risk management in response to recent market events? (% respondents) We have already conducted a thorough overhaul of our risk management 32 We intend to conduct a thorough overhaul of our risk management, but have not yet completed it 21 We have made some minor changes to our risk management 27 We intend to make some minor changes to our risk management, but have not yet completed them 12 We not intend to make any changes to our risk management We are waiting to see how the market develops before deciding whether to review our risk management 21 © The Economist Intelligence Unit Limited 2009 Appendix Survey results After the storm: A new era for risk management in financial services Please rate the following issues in terms of the challenge they pose to your business Please rate on a scale of to 5, where 1=Significant challenge and 5=Not a significant challenge (% respondents) Significant challenge Not a significant challenge Not applicable Credit risk 35 31 17 10 Market risk 28 39 19 51 Operational risk 14 28 35 15 Regulatory risk (eg, risk of non-compliance) 12 23 29 22 13 Economic capital 10 25 33 17 10 Modelling risk (risk of bad models) 12 22 29 20 Liquidity risk 21 28 24 14 12 Fraud 21 22 28 19 Solvency risk 17 22 21 27 Underwriting/actuarial risk 14 18 22 16 21 Ability to aggregate risk at firm-wide level 11 29 25 21 12 How would you rate the performance of your institution over the past year across the following categories of risk management? Rate on a scale of to 5, where 1=Very effective and 5=Not at all effective (% respondents) Very effective Not at all effective Not applicable Credit risk 18 36 26 11 Market risk 11 36 28 16 Operational risk 11 41 31 14 Regulatory risk (eg, risk of non-compliance) 21 41 27 21 Economic capital 13 37 28 13 Modelling risk (risk of bad models) 26 38 17 Liquidity risk 20 40 22 12 Fraud 19 35 28 10 4 Solvency risk 22 36 27 Underwriting/actuarial risk 10 25 30 10 22 Ability to aggregate risk at firm-wide level 22 29 35 19 © The Economist Intelligence Unit Limited 2009 Appendix Survey results After the storm: A new era for risk management in financial services What steps is your organisation taking to improve its management of liquidity risk? Please select all that apply (% respondents) Increasing liquidity buffers 48 Strengthening information systems 45 Improving co-ordination between treasury function and lines of business 44 Strengthening contingency funding plans 38 Strengthening liquidity stress testing capabilities 37 Conducting independent review of internal policies 31 Strengthening management of intra-day liquidity risks 26 Improving management of foreign currency flows 23 Other, please specify We are not taking any steps at present Don't know/Not applicable Which of the following steps is your organisation taking to strengthen stress testing? Please select all that apply (% respondents) Increasing severity of scenarios used 48 Increasing involvement of senior management in stress testing 39 Introducing or increasing frequency of ad hoc stress testing 36 Strengthening link between stress testing and decision-making 36 Increasing use of hypothetical scenarios 35 Increasing investment in data and IT infrastructure to enhance risk information 27 Introducing or increasing use of scenarios that take a firm-wide perspective 25 Introducing or increasing frequency of reverse stress testing (ie, working back from a plausible outcome) 19 Other, please specify We are not taking any steps at present 10 Don’t know/Not applicable 12 23 © The Economist Intelligence Unit Limited 2009 Appendix Survey results After the storm: A new era for risk management in financial services Over the next year, what you expect to be the three key areas of focus in the management of risk in your organisation? Select up to three (% respondents) Improving data quality and availability 41 Improving governance of risk 33 Developing “firm-wide” approach to risk 29 Embedding risk management within lines of business 28 Better and more sophisticated analytics 27 Improving communication and understanding between risk function and lines of business 24 Strengthening technology infrastructure 24 Linking risk management more closely with corporate performance 22 Building risk expertise at management level 19 Regulatory compliance (eg, with Basel II or Solvency II) 11 Recruiting experienced risk professionals Training of existing risk professionals Other, please specify What are the three main barriers to improving risk management in your organisation? Select up to three (% respondents) Insufficient quality of data 40 Lack of expertise 32 Lack of risk culture among broader business 31 Inadequate systems 30 Poor communication across organisational silos 30 Lack of investment 20 Insufficient data 17 Lack of authority for risk management 16 Lack of support among senior executives 14 Insufficient risk representation at senior management level 11 Insufficient risk representation at non-executive board level Other, please specify 24 © The Economist Intelligence Unit Limited 2009 Appendix Survey results After the storm: A new era for risk management in financial services Between which of the following functions you think that communication most needs improvement in your organisation? (% respondents) Risk function and lines of business 47 Risk function and executive management 21 Risk function and finance function Risk function and non-executive board Risk function and treasury function Within risk function (ie, between credit risk managers, market risk managers and operational risk managers) 12 Other, please specify Which of the following statements applies to your organisation’s risk management over the past year? Please select all that apply Which one of the following stakeholders is currently exerting greatest pressure on your organisation to improve risk management? (% respondents) (% respondents) Executive management We have not done enough to manage risk across organisational silos 38 41 Regulators We have not carried out sufficient stress testing 20 40 Investors We have not done enough to aggregate risk at a firm-wide level 33 We have lacked technical risk expertise at a senior level in organisation Non-executive directors 31 Governments We have relied too heavily on external ratings 23 Customers We have relied too heavily on risk models 22 Central banks We have relied too heavily on risk measures such as VaR 20 Rating agencies We have lacked technical expertise in the risk function 17 Other, please specify We have not used credit scoring and other models in the past 13 No one is currently exerting pressure Which one of the following statements best describes your company’s approach to enterprise risk management (ERM)? (% respondents) We have an ERM strategy that is well-formulated across the business and fully implemented 16 We have an ERM strategy that is well-formulated across the business, with a clear timetable for implementation 12 We have an ERM strategy in place but it is not well communicated across the business or between departments 26 We have an ERM strategy in place but it is not a fully developed concept and there is no clear timetable for implementation 18 We don’t have an ERM strategy in place but we plan to introduce one in the short-term 11 We have no plans to introduce an ERM strategy Don't know/Not applicable 10 25 © The Economist Intelligence Unit Limited 2009 Appendix Survey results After the storm: A new era for risk management in financial services In which one area of risk will your business invest the most in the next 12 months? (% respondents) Internal risk management, methodology, processes, policy and organisation 19 Credit risk management 16 Operational risk management 13 Integrated risk management 10 Risk data infrastructure Liquidity risk management Asset and liability management Business intelligence Market risk management Underwriting/actuarial risk Anti money-laundering Fraud Other, please specify Which one of the following best describes the level of understanding of risk management within your business? (% respondents) The importance of risk management is widely understood throughout the company 40 There is limited understanding but we are providing training to all employees to improve this 35 There is little understanding of risk management among employees other than those whose primary function is risk management 25 26 © The Economist Intelligence Unit Limited 2009 Appendix Survey results After the storm: A new era for risk management in financial services Please indicate whether you agree or disagree with the following statements (% respondents) Strongly agree Slightly agree Neither agree nor disagree Slightly disagree Strongly disagree The US government should never have repealed the Glass-Steagall Act 19 27 37 9 15 There needs to be a move away from the “originate-to-distribute” banking model and a return to old-fashioned, “buy and hold” banking 17 37 23 Regulators should intervene directly in compensation policies 12 25 16 22 25 The principles of risk management in financial services remain sound 25 25 30 13 The Basel II capital framework has been shown to be deficient 13 34 33 14 16 Risk measures such as VaR have been shown to be no longer fit for purpose 12 36 31 Not enough human judgment is being applied in risk management decisions 31 42 17 Risk management does not have sufficient authority in our organisation 16 30 24 18 11 Analytics have become too complex to assist in business decision making 12 35 28 19 Mark-to-market practices have exacerbated the financial crisis 26 34 20 12 It is not possible adequately to manage risk in financial services 18 20 29 29 We have relied too heavily on external providers for credit ratings 24 36 22 11 About the respondents Which of the following best describes your title? In which region are you personally based? (% respondents) (% respondents) Board member North America 26 Asia-Pacific 26 Western Europe 24 CEO/President/Managing director 16 CFO/Treasurer/Comptroller CIO/Technology director Middle East and Africa 11 Eastern Europe Latin America Other C-level executive 10 SVP/VP/Director 25 Head of Business Unit Head of Department 11 Manager 12 Other 27 © The Economist Intelligence Unit Limited 2009 Appendix Survey results After the storm: A new era for risk management in financial services In which sub sector of financial services does your organisation operate? Select all that apply What is your main functional role? (% respondents) (% respondents) Business line Retail banking 18 26 Group risk management 26 Finance Corporate banking 16 Asset management/custodian 16 22 Credit risk management Investment banking 12 21 Operational risk management 21 Market risk management Private banking/wealth management Capital markets 20 Compliance Broker/dealer 16 Internal audit Trading 14 Life insurance Treasury 13 Other, please specify Mutual fund 11 10 Investment consulting Private equity/venture capital What are your organisation's global assets in US dollars? (% respondents) Real estate/leasing Under $1bn Property and casualty insurance 21 $1bn to $9.9bn Hedge fund 17 $10bn to $24.9bn Pension fund trustee 10 $25bn to $49.9bn $50bn to $99.9bn Reinsurance Stock exchange/trading system $100bn to $149.9bn Other, please specify $150bn to $199.9bn $200bn to $249.9bn Over $250bn 26 28 © The Economist Intelligence Unit Limited 2009 Whilst every effort has been taken to verify the accuracy of this information, neither The Economist Intelligence Unit Ltd nor the sponsor of this report can accept any responsibility or liability for reliance by any person on this white paper or any of the information, opinions or conclusions set out in the white paper Cover image - © Photodisc/Getty Images LONDON 26 Red Lion Square London WC1R 4HQ United Kingdom Tel: (44.20) 7576 8000 Fax: (44.20) 7576 8476 E-mail: london@eiu.com NEW YORK 111 West 57th Street New York NY 10019 United States Tel: (1.212) 554 0600 Fax: (1.212) 586 1181/2 E-mail: newyork@eiu.com HONG KONG 6001, Central Plaza 18 Harbour Road Wanchai Hong Kong Tel: (852) 2585 3888 Fax: (852) 2802 7638 E-mail: hongkong@eiu.com [...]... most in the next 12 months? (% respondents) Internal risk management, methodology, processes, policy and organisation 19 Credit risk management 16 Operational risk management 13 Integrated risk management 10 Risk data infrastructure 9 Liquidity risk management 9 Asset and liability management 6 Business intelligence 6 Market risk management 5 Underwriting/actuarial risk 2 Anti money-laundering 1 Fraud... apply What is your main functional role? (% respondents) (% respondents) Business line Retail banking 18 26 Group risk management 26 Finance Corporate banking 16 Asset management/ custodian 16 22 Credit risk management Investment banking 12 21 Operational risk management 21 Market risk management Private banking/wealth management 8 Capital markets 7 20 Compliance Broker/dealer 4 16 Internal audit Trading... reviews the quality of enterprise risk management as a new component in its reviews of credit ratings Performing classical siloed risk management will only qualify as “adequate” in the new S&P model Mr Mark says the agencies would undoubtedly have had AIG in mind when they changed their methodology “It was the AIG Financial Products area that created significant problems for AIG,” he says “They were the. .. model for rating agencies could be starting to change Independent rating agencies, such as Egan-Jones, are starting to penetrate the market as the inherent conflict of interest in the traditional model – where issuers pay for ratings and the agencies are rewarded on volume – is called into question There are several drivers for a shift towards ratings paid for by investors rather than issuers, says Sean... to the table, have little of their own wealth at stake, 16 © The Economist Intelligence Unit Limited 2009 After the storm: A new era for risk management in financial services What are the three main barriers to improving risk management in your organisation? Select up to three (% respondents) Insufficient quality of data 40 Lack of expertise 32 Lack of risk culture among broader business 31 Inadequate... Appendix Survey results After the storm: A new era for risk management in financial services How confident are you in the ability of the regulators in the country in which you are based to carry out the following initiatives? Rate on a scale of 1 to 5, where 1=Very confident and 5=Not at all confident (% respondents) 1 Very confident 2 3 4 5 Not at all confident Maintain overall stability of the financial. .. have repealed the Glass-Steagall Act, which separated commercial from investment banking Michael Lafferty, chairman of the International Retail Banking Council, believes that they are on the right track “Politicians and regulators may come to realise that far too much attention has been given to salvaging the failed universal bank model and not enough to finding a better retail banking model for the. .. Financial Stability Forum of national and international financial regulators, revolve around the integration of risks, the measurement of risk (four out of ten in the survey, incidentally, say they practice insufficient stress testing) and the lack of constant challenges to accepted methods in light of changing market conditions A new template for rating instruments? There are signs that the existing... need to improve what they do, not abandon their principles They are increasingly recognising the need for new ideas and approaches They should strike while the iron is hot, and before old and inadequate ways become embedded again Many firms have started the long haul already and are revamping, replacing and recalibrating systems and processes, despite the difficulties that cultural change confers Successful... Increasing involvement of senior management in stress testing 39 Introducing or increasing frequency of ad hoc stress testing 36 Strengthening link between stress testing and decision-making 36 Increasing use of hypothetical scenarios 35 Increasing investment in data and IT infrastructure to enhance risk information 27 Introducing or increasing use of scenarios that take a firm-wide perspective 25 Introducing .. .After the storm: A new era for risk management in financial services About this research A fter the storm: a new era for risk management in financial services is an Economist Intelligence... 2009 After the storm: A new era for risk management in financial services How would you rate the performance of your institution over the past year across the following categories of risk management? ... Credit risk management 16 Operational risk management 13 Integrated risk management 10 Risk data infrastructure Liquidity risk management Asset and liability management Business intelligence Market