Risk management's missing link

RMA Journal, The, Dec, 2003 by Jee Meng Chen

The moral: Risk management comes only after corporate culture management. This statement is given life in an illustrative case study. As the author asserts, "No amount of policies, guidelines, and surveillance systems is going to stop a rogue trader, an overzealous business development manager, or a fraudster."

In a routine review, the head of Operations was browsing through transactional files and documents when he saw something that warranted an ad hoc staff meeting. He began, "I am afraid that some of you don't really care about controls, do you?" Holding a fax of an outward remittance application form, he pointed at the authorization column. "Here, the Customer's Signature Verified stamp had been appended as evidence of a check. I should be happy that the officer concerned has complied with internal audit's recommendation, right? But look more carefully. The customer's signature is missing!"

Risk Management's Missing Link

Literature reviews of recent financial debacles involving Metallgesellschaft, Natwest Markets, Orange County, and LTCM shed light on the inherent riskiness of exotic financial instruments and the value of prudent risk management practices. With a showcase of financial mishaps, the international banking world is increasingly aware of fundamental risk management controls and their importance. The growth of sophisticated financial products and increased market volatility set the stage for research and development of risk management techniques to better mitigate incidences of financial losses (see Figure 1). Yet, given such knowledge, how many banks are confident of managing the full spectrum of risks effectively?

[FIGURE 1 OMITTED]

Depending on the size of the financial institution and the volume and complexity of business activities undertaken, risk management tends to focus on one or more of the following:

* Setting rules in accordance with banking best practices and regulatory guidelines.

* Crafting comprehensive bank-wide policies and procedures.

* Implementing bank-wide analytical and control processes.

* Developing sophisticated risk management systems; quantifying risks and measuring risk factor correlation.

The search for better risk management tools is akin to a better mousetrap fallacy. Though risk controls are critical, they are merely mechanistic tools. It doesn't take a genius to circumvent the bank's surveillance system. Insider fraud, lack of due diligence, or a "don't ask unnecessary questions" mentality is sufficient to crack any system. The conventional risk management approach of focusing on business processes, systems, and infrastructure issues inadvertently ignores the fact that risk management is largely a cultural issue (see Figure 2)! Far too often, the execution of risk management strategies is devoid of the bank's cultural perspective. This could be found in a situation where the bank engages in a new product and/or market.

[FIGURE 2 OMITTED]

The frequently asked question would be, "Does the bank possess requisite resources and capability to manage new products and their inherent market risks?" While most banks would subject the proposition to an analytical process known generically as New Product Approval, attention invariably focuses on risk management issues rather than the inherent product/market/cultural fit. It is highly unlikely the new product committee would query, "Is the product/market engagement in line with the bank's strategic profile? Would the proposed product/market be developed fully on a long-term basis?" It's possible bank practitioners don't care at all. After all, product implementation and/or market penetration is often carried out in test mode, and business development would carry on as usual until losses hit the books. So, what is the price of failure? Simply, market exit! In the meantime, banks will refrain from all new activities and perhaps conduct a postmortem review to analyze the plausible reasons for the loss. Consequently, with refinements in risk controls, bank practitioners once again believe they are better equipped to manage risks. However, as we keep hearing, the business cycle has not been repealed.

Bank practitioners need to conscientiously factor the culture/ business model/risk management perspective into their decision making. Not doing so would likely render risk management ineffective. An illustrative case can help illuminate the inseparable relationship between corporate culture and bank risk management. A well-embraced culture is the only assurance that far-flung overseas operations are operating in compliance with stipulated policies and directives. Indeed, a review of classic financial debacles of the 20th century revealed that irregularities tend to happen more often in branches or remote subsidiaries than at the head office.

The Case of NCBS

National Commerce Bank SEA branch (NCBS), a subsidiary of the National Commerce Banking Group (NCB Group), began offshore branch banking operations in early 1990. All overseas branches came under the direct supervision of the International and Overseas Banking Operations (IOBO), a department of the corporate banking division at the head office. As the business operations of overseas branches focused on corporate lending, this reporting structure enabled credit-related matters to be addressed promptly. NCBS's operations were fairly straightforward--the branch offered no-frills banking services. The credit department was active in bilateral lending and the treasury department was primarily responsible for funding liquidity management. Proprietary trades were mainly plain-vanilla foreign exchange deals and money market gapping.