Board of Governors of the Federal Reserve System

It is a pleasure to be addressing the new American Bankers Association, which has arisen from the successful merger of America's Community Bankers and the ABA. Your association truly represents the full range of banks in the United States. The focus of my remarks today--the importance of fundamentals in risk management--should still resonate with all of you, whether you are part of a large global bank or a smaller community bank. Unfortunately, recent market events have shown us that banking institutions still face some risk management challenges, including a need to refocus on some key fundamentals. The good news, however, is that we also have many examples of sound risk management practices during the recent disruptions.

Risk Management Challenges
Getting the fundamentals right--and being ever vigilant about their consistent application and execution--forms the basis of any sound risk management system. I am not trying to imply that implementing risk management fundamentals is easy; that is, just because something is fundamental does not mean that it comes naturally. In fact, there are a number of risk management challenges inherent in banking that require careful identification and attention.

One of the most basic risk management challenges relates to concentration of risks. From the beginnings of banking, bankers always have had to be cautious to guard against, as the old adage says, "putting all their eggs in one basket." For example, Renaissance bankers learned the lesson--some of them the hard way--that they did better by lending not just to a few merchants active in one trade, but to a range of merchants active in a variety of trades. As risk management techniques grew over the centuries, bankers became more adept at identifying, measuring, and managing risk concentrations, but that does not mean the original problem presented by concentrations--that losses could occur all at the same time--has vanished. Indeed, some bankers occasionally forget that this challenge still exists, usually with unfavorable consequences.

It is also important to note that concentrations in banking include not just basic lending, but also holding securities, trading complex instruments, providing liquidity facilities, engaging in off-balance sheet transactions, and conducting other financial activities. As banks have extended their range of activities and involvement in new markets, they must be particularly mindful of potential for concentrations of risk to arise for a number of reasons. First, any new activity will be less familiar and involve less data and experience for evaluating risk compared with long-standing activities or markets. Second, risk concentrations can be hidden during normal times and may only manifest themselves during times of stress when activities or instruments that might in normal times have little or negative correlation suddenly become correlated, such as with a market-wide increase in the demand for liquidity as we have seen recently. In other words, bankers may have far more eggs jostling around in the same basket, and each of those eggs may be more fragile than originally thought.

Understanding the linkage between risk concentrations and capital is especially important, since the concentration of risk of a given portfolio markedly affects the amount of capital that should be held against it. Heavy concentrations can produce so-called fat tails in a loss distribution, meaning that considerably higher capital levels are required to support the risk taken. If one underestimates the amount of capital needed to be held against risk concentrations and/or the extent of the concentrations themselves, then a banker would realize that the initial level of capital was not sufficient and that remedial actions would need to be taken. Naturally, both large and small banks can continue to be successful and profitable by having some lending or other types of concentrations, but they need to be aware of the risks involved and have the proper risk management and capital to support those concentrations.

Risk Management Fundamentals
I would now like to elaborate on three key risk management fundamentals and their relationship to concentrations of risk in banking: Governance and risk control; risk identification and measurement; and liquidity risk management. In doing so, I will highlight some important findings from a report released last week by a group of supervisory agencies from France, Germany, Switzerland, the United Kingdom and the United States, known as the Senior Supervisors Group or SSG.¹ The report, "Observations on Risk Management Practices during the Recent Market Turbulence," provides a summary and analysis of a joint survey and review, initiated last autumn, of risk management practices to understand how different approaches fared during the recent financial stress. Although the analysis covered a group of the largest banking and securities firms, the lessons learned actually have relevance for all financial institutions of all sizes and scope--even those that have thus far not suffered from recent financial turbulence. I will also discuss a few other examples of supervisory activities, such as our recent guidance on commercial real estate concentrations, from which we have learned valuable lessons.

Governance and controls
I will start with perhaps one of the most fundamental aspects of risk management at banking organizations--in fact, at any organization: governance and controls. The SSG report highlighted solid senior management oversight and engagement as a key factor that differentiated performance during recent events. Clearly, senior management must take on a very active and involved role in risk management. Although this may seem somewhat obvious, a few recent cases demonstrate, unfortunately, that senior management may not always exercise proper oversight and may not have been as engaged as would have been wise. As supervisors, governance and controls is a key feature we look at in assessing risk management at an institution.

Clearly, senior managers also need to ensure that they have proper understanding of the risks assumed by their firm, but this does not always happen. For example, we have seen some evidence that information was kept in silos within firms and not adequately distributed both vertically and horizontally within certain firms. This segregation prevented senior managers from developing an enterprise-wide perspective on risks to the whole entity. It meant that managers were not fully aware of the extent to which the risks of the different activities undertaken by the firm could, first, become correlated in times of stress and, second, result in high concentrations of risk exposures. To be quite specific, in particular cases, senior management was not fully aware of the firm's latent concentrations to U.S. subprime mortgages, because they did not realize that in addition to the subprime mortgages on their books, they had exposure through off-balance sheet vehicles holding mortgages, through claims on counterparties exposed to subprime, and through certain complex securities. Adequate distribution of information allows for an enterprise-wide perspective on risk. Information must percolate up to senior management, but top executives must, in turn, disseminate their views and analysis back down through the business lines.

Effective risk management remains sturdy and durable only if supported by strong and independent risk functions that produce unbiased information. Empowering independent risk managers results in clear, dispassionate thinking about the entire firm's risk profile, with no favoritism toward any business unit. Senior managers should encourage risk managers to dig deep to uncover not only risks within each business unit, but also risk concentrations that can arise from the set of activities undertaken by the firm as a whole as well as latent risks--such as hidden risk concentrations that can arise from correlation of risk in times of stress. Such risk management assessments should lead risk managers to point out cases in which certain business lines are assuming too much risk.

In other words, it is good to have a few people within the institution who--to paraphrase a former Federal Reserve Chairman--know when to take away the punch bowl. Being the party pooper, however, can be very difficult in any organization, and that is why it is crucial for the risk manager to be known as an independent voice who is influential with top management and for top executives, of large or small firms, to set the appropriate "tone at the top" with respect to the importance of independent and unbiased risk evaluation.

As I discussed in detail at a speech before the Global Association of Risk Professionals a couple of weeks ago, any successful organization needs to develop appropriate mechanisms to ensure adherence to, and sustainability of, its risk management.² Incentive structures are a key mechanism for this purpose. Appropriate incentives reward good behavior and penalize inappropriate behavior. Of course, incentives work best when they are known well in advance, that is, when they serve as ex ante signals of what should and should not be done. Naturally, in very large organizations it is difficult for senior management to monitor each individual, so incentives need to be consistent, permeate even the lowest levels of the organization, and remind each individual that his or her risk-taking affects the whole enterprise.

Limits and controls can be useful tools for creating the right incentives and sending appropriate signals, but they of course need to be tailored individually to each firm. Problems can arise when incentives are not properly structured and appropriate "risk discipline" is not exercised--for example, when limits and controls are not set or, if they are set, when adherence to them is not monitored or enforced. Such controls provide incentives for business-line leaders to assume only the risks that the firm can absorb because they penalize those who try to take on excessive risk or inadequate mitigation in the name of maximizing short-term profit. This is just as true at large international firms as it is at community banks.

Risk Identification and Measurement
The second fundamental of sound risk management relates to risk identification and measurement. Timely and accurate information is the lifeblood of sound risk management. A good risk-management structure must encompass risks across the entire firm, gathering and processing information on an enterprise-wide basis in real time. In short, you cannot manage your risks if you do not know what they are.

Aggregating information across a large, diversified financial institution is not easy and should be done with appropriate care and with adequate resources for checking timeliness and veracity. The SSG report, for example, noted that some firms could not easily integrate market and counterparty risk positions across risks types, making it difficult for their executives to identify concentrations across the entire firm. Aggregating information about risk exposures and the concentration of risks may not be as challenging at smaller institutions, but checking the timeliness and veracity of the data is important at institutions of all sizes. In other words, risk managers should live by the adage "Trust but verify," being careful not to rely on assessments or data from others without conducting proper due diligence.

It is also worth noting that financial institutions should gather a wide range of relevant information before they see market troubles brewing. In other words, scrambling for information once turbulence sets in is not good practice. Understanding a firm's true risk exposures requires examining not just risks on the balance sheet, but also off-balance-sheet risks that are sometimes more difficult to identify and often not so easy to quantify. Latent risks from certain complex products and certain risky activities should be properly recognized, because they can manifest themselves when market turbulence sets in.

As the SSG report indicates, some firms had a poor understanding of the risks inherent in certain complex products or failed to recognize that certain activities contained latent risks that could be manifest in unexpected concentrations of risk exposures when market turbulence arose. For example, we witnessed some lapses in credit risk identification and measurement when, as I noted, certain institutions underestimated the actual credit risk of subprime mortgages and the secondary or tertiary effects brought on by disruptions in subprime markets for their broader set of activities.

Stress testing and scenario analysis are of paramount importance, since they can reveal potential concentrations of risk that may not be apparent from using information gleaned from normal times. The SSG report emphasizes this point, but the U.S. banking agencies have also highlighted its importance for smaller- and medium-sized institutions, for example in the guidance on commercial real estate (CRE) concentrations we issued at the end of 2006. After on-the-ground supervisors reported seeing increases in CRE concentrations at many institutions across the country, supervisors examined historical data on risks associated with CRE concentrations to provide the basis for developing supervisory guidance. That guidance counseled banking organizations with high CRE exposures relative to capital to engage in stress testing to evaluate behavior of those exposures and the impact on capital in adverse circumstances.

Some financial institutions already employ stress tests, but they should re-check their robustness in light of recent events. For example, banking organizations might benefit from expanding tests to include a wider set of variables to stress and to consider shocks they might have considered much less probable one or two years ago. Banks should also remember that past experience is not always predictive of future events, meaning that they should be somewhat creative in designing potential shocks. In CRE, for example, banks should move beyond considering single-name risk and include scenarios involving broader risks to the CRE sector and how such risk may be correlated in times of stress with other parts of the portfolio.

In addition, a number of risk-measurement and risk-quantification challenges relate to valuation practices, particularly with new products. Firms should have greater motivation for applying proper valuation practices as part of good risk management.³ At the center of these practices is the ability to make appropriate judgments about the quality of information being used for valuations. The process usually starts with an initial experimentation phase in which market participants learn a great deal about the product's expected performance and risk characteristics, preferably under different market conditions. Conducting due diligence about new products can be costly and take time, but it is usually worth it. Unfortunately, in some recent cases new products were developed very quickly and not properly "road-tested." In observing the valuation challenges, the "Trust but verify" adage has equal application. Market participants must ensure that they do not make valuation decisions based solely on excessive reliance of external ratings or evaluations, but that they also undertake their own assessment. And I would suggest that the value of independent due diligence on the part of market participants is especially high for newer and more-complex products.

Encouragingly, we have examples of some firms recognizing the potential risks of broad market disruptions, for example, if there were dramatic and unexpected price movements, or if market illiquidity set in. Those firms faring better typically use a number of tools to assess risk positions that draw on differing underlying assumptions. Such tools provide management with more information and different perspectives on its potential risk exposures. In the best cases, the tools are flexible enough to allow perspectives on risk to change as business conditions change. For example, they can help identify when risk concentrations are changing as a result of market movements or changes in counterparty positions.

Liquidity Risk Management
Now I wish to consider the third fundamental. Liquidity risk management. Banks, of course, have been managing expected liquidity demands since the beginning of banking itself. ⁴ Because of its central role in the business of banking, liquidity risk requires rigorous and effective management. Naturally, financial institutions both large and small must pay careful attention to liquidity risks, even if they manifest themselves in different ways.

Regarding recent events, a number of financial firms were surprised by the extent of market disruptions and were forced to take funding actions not anticipated in their contingency funding plans, including some decisions to support affiliates that were based on reputational concerns rather than contractual obligations. At the same time, some institutions were able to avoid more serious problems from these events by aligning treasury functions more closely with risk-management processes and incorporating information from all businesses into global liquidity planning, including actual and contingent liquidity risk. They also made attempts to embed market liquidity premia or apply market liquidity haircuts in pricing models and valuations.

Recent events have shown that during times of systemwide stress, liquidity shocks can become correlated so that the same factors that can lead to liquidity problems for the bank's assets or off-balance sheet vehicles can simultaneously put pressure on banks' own funding liquidity. Again, we see the trouble that risk concentrations can cause if an institution has not tried to identify them in advance and take steps to mitigate their effects. As with other risk areas, supervisors suggest extensive use of firm-wide stress testing to ensure the incorporation of low-probability but potentially severe liquidity events that may have the potential to converge. Smaller banks, as well as large, global banks, should conduct liquidity stress tests to evaluate what could happen to liquidity positions in times of stress.

We have also noticed the potential for liquidity risk to have an impact on capital adequacy. As you are well aware, several large global banks ended up having to deal with so-called unplanned asset expansions arising from a variety of liquidity stresses related to the asset side of the balance sheet. In a few cases, these unexpected increases in the balance sheet created some pressures on capital ratios, even if the level of capital remained stable. Although bank liquidity management and capital management may be conceptually distinct, recent events illustrate in practice how liquidity management and capital management are intimately related, particularly in times of financial stress. Since risk concentrations have the potential to manifest themselves during times of stress and at that time adversely affect capital positions, it is particularly important that firms assess how liquidity events could place pressure on capital levels. In a nutshell: liquidity problems always have the potential to affect bank balance sheets and, in doing so, bank capital adequacy.

Conclusion
One of the most basic lessons of banking is that lending concentrations must be carefully identified, monitored, and managed. As I noted at the outset, the current financial market turbulence underscores the importance of getting the fundamentals of sound risk management right and being ever vigilant about their consistent application, execution, and improvement in light of new data and experiences. I have highlighted the importance of three fundamentals--governance and risk control; risk identification and measurement; and liquidity risk management--and the SSG report provides evidence that those institutions taking care to get these fundamentals right generally performed better during recent events than other institutions. Concentrations of risk can pose challenges to financial institutions, and top managers must be aware of their potential and have a risk management system in place ready to deal with them. This is true not only for large global players but also for small-and medium-sized banks, as my discussion of the CRE concentration guidance emphasized.

As supervisors, we strive to achieve the appropriate balance, recognizing that supervision and regulation has costs and benefits that need to be weighed against one another. For instance, we need to be careful that lending is conducted on a prudent basis, and at the same time, take care not to stifle the provision of credit when it is done properly.

Before concluding, I would like to mention a topic in supervision and regulation that I have not yet touched upon in these remarks, namely, credit cards. As you know, the Federal Reserve has proposed new rules under Regulation Z, which implements the Truth in Lending Act, regarding open-end credit to require new, more informative, and consumer-tested disclosures by credit card issuers and expects to propose new rules for credit cards under the Federal Reserve's unfair and deceptive acts and practices authority. To help us better assess the current state of the credit card market and possible challenges in credit card markets for consumers and others involved in those markets, I have invited key credit card market participants--card issuers and processors, consumer advocates, counseling agencies, and other regulatory agencies--to participate in a forum hosted by the Federal Reserve Board on April 8. The forum will allow us to collect additional information about relevant industry trends and to identify areas that may warrant action or further study.

Footnotes

1.  The report is available at: http://www.newyorkfed.org/newsevents/news/banking/2008/rp080306.html Return to text

2 Randall S. Kroszner, 2008, "Improving Risk Management in Light of Recent Market Events," speech delivered at the Global Association of Risk Management Professionals Annual Risk Convention, New York, February 25. Return to text

3.  Randall S. Kroszner, 2007, "Innovation, Information, and Regulation in Financial Markets," speech delivered at the Philadelphia Fed Policy Forum, Philadelphia, November 30. Return to text

4.  Randall S. Kroszner (2008), "Liquidity-Risk Management in the Business of Banking," speech delivered at the Institute of International Bankers, Washington, DC, March 3. Return to text