Early warning systems

Northwestern Financial Review, Mar 15, 2001 by Proctor, Ken

With competitive forces so challenging, effective risk management has never been more important

Taking risks is an essential element of banking. But in today's complex financial services environment, the types and potential severity of risks to which all institutions are exposed have multiplied. Many community banks, however, lag behind their larger counterparts when it comes to devoting resources to risk management, believing that less complex institutions do not have the same need, or capacity, to manage risk as do larger banks. The reality is that banks of all sizes face the same risks and have access to the same methods, markets and products to manage those risks.

Why has there been a surge in risk and risk-taking among financial institutions? Consider:

Competition and profit pressures keep intensifying, resulting in greater credit risk-taking to maintain margins.

The decline in traditional core deposit funding has forced banks to seek alternate funding sources, which in some cases are more volatile and increase interest rate and liquidity risk.

Financial products are more complex than they were years ago.

The financial modernization law has opened the door to new and unfamiliar business lines.

Financial institutions are the targets of increasingly sophisticated crime, including computer crimes and international money laundering schemes.

Employees have been accorded numerous statutory and regulatory rights enforced by the courts.

Stockholders are increasingly sophisticated and demanding of management.

Customers possess numerous rights, including the right to information privacy.

Technology has altered the risk equation, mitigating some risks but significantly increasing others. For example, the use of technology has eroded many of the traditional separation-of-duty controls that were present in manual systems, thereby increasing operational risk. Automated accounting, processing and money transfer systems provide individual employees an increased ability to process a transaction without management review. Technology systems also provide the ability to move greater amounts of money in a single transaction. The increased use of online and Internet-based transaCtion systems further increases operational risk by increasing the ability of third parties to perpetrate frauds.

The use of technology also increases risk in other areas. Failing to invest in appropriate technology increases strategic risk, while failing to implement technology correctly exposes the bank to increased reputation risk. Increasing use of automated credit scoring systems brings with it increased compliance risk. For example, are all borrowers who fail to meet the credit scoring system criteria treated the same, or are exceptions made for certain applicants?

Regulators acknowledge that different institutions face different types of risk, depending on their business strategy, size and other variables. But they also make clear that all institutions bear risks, and the methods used by financial institutions to identify, measure, monitor and control risks will be specifically evaluated during supervisory examination. Since the mid-1990s, all regulatory agencies have adopted a risk-based approach to examining financial institutions. Increasingly, they are holding boards of directors and management personnel directly accountable for the quality of the bank's risk management program.

Regulators have identified a list of risk exposures common to modern financial institutions. The Office of the Comptroller of the Currency has identified nine risk categories including strategic, credit, interest rate, liquidity, pricing, reputation, compliance, transaction and foreign exchange risk. The Federal Reserve Bank has enumerated several risk categories including credit, interest rate, liquidity, compliance, legal, reputation and operational risk.

Regulators have developed tools to alert them oo changing risk conditions at the banks they regulate. The OCC, for example, utilizes a risk monitoring system called "Project Canary." Reports are produced quarterly for all national banks by the Project Canary system providing an analysis of 15 benchmark risk ratios. The purpose of the Canary Reports are to help the OCC identify those banks that might be growing too rapidly, accepting an immoderate level of credit risk, relying heavily on volatile short-term funding, or exposing themselves to significant asset/liability pricing and interest rate risk. The 15 risk ratios are broken down into three categories: credit risk, interest rate risk and liquidity risk.

Texas-based Alex Sheshunoff Management Services, calculated the Canary ratios for all commercial banks in the United States to gauge the relative risk in the banking industry. Based on the third-quarter 2000 call report data, 971 banks -- about 10 percent - exceeded eight or more of the benchmark risk ratios.

In November, FDIC Chairman Donna Tanoue warned bankers to watch the increasing level of credit risk from commercial real estate loans in booming real estate markets. She added, "a tornado watch does not mean that severe weather is inevitable but that conditions exist for the development of a tornado and that one needs to keep up to date on the latest weather information." Canary Project ratios and recent economic trends indicate conditions of increased risk exist which might lead to stormy weather for the nation's banking industry.