Banks need to do more to overhaul their risk management culture in the wake of the financial crisis, says a new report from Ernst & Young (EY) and the banking industry lobby group, the Institute of International Finance Inc. (IIF).
Based on a survey of 74 firms across 36 countries, including interviews with senior risk executives, and an online survey of 66 global banks and eight insurance companies, the report finds that leading financial services firms are taking “major steps to remake their risk governance frameworks and have made substantial progress in implementing risk-management changes”; and, that a renewed emphasis on risk culture is now the top priority for banks’ boards and senior management.
“A key issue at the time of the crisis was balancing a sales-focused culture with a risk-control culture. This remains an issue, but this year the emphasis has been on assessing overall culture and moving reputation and operational risk higher up the agenda,” the report says. “The belief at board level that they knew what the culture was throughout the organization has been shaken, and the majority of banks surveyed have moved, or are planning to move, to carry out reviews of culture.”
The report also finds an increased focus on operational and reputation risk; that while banks have enhanced risk management, they are still working to make these changes operational; and, they are reviewing their cultures across various businesses, following lessons from the crisis and high profile conduct cases. Additionally, it finds that business models are being rethought in the light of regulatory changes, with banks exiting activities, markets, and geographies, in response.
“This year, we’ve seen a large shift in the focus of firms towards testing culture and then shifting the culture as necessary,” says Rick Waugh, vice chairman of the IIF, who is also chairman of its Committee on Governance and Industry Practices and CEO of Scotiabank.
“Clarity on the values is essential, reinforced by training, but most importantly, accountability throughout the organization,” Waugh notes. “The fact that 44% of respondents are actually exiting businesses reflects the changing risk appetite. The dramatic changes we are seeing provide hard evidence that a changed risk culture is being embedded in our organizations.”
The report notes that one of the lessons from the crisis was that many banks were not fully aware of the concentrated positions in their organizations. “This had led to a focus on risk transparency, and work is still continuing with programs to enhance stress testing and make it a more usable management tool, as well as through redevelopment of models and management information,” it says. “But all of this is putting ever-greater strain on IT and data platforms; enhancements, although continuing apace, will continue for some time to come.”
The report also finds that banks are still ratcheting up board oversight of risk; that liquidity risk remains at the top of agenda; and, that capital management is being rethought across the industry, with 55% of respondents aligning capital allocation with regulatory capital.
Leader of the study, Patricia Jackson, EY’s head of financial regulatory advice for Europe, Middle East, India and Africa (EMEIA), said, “Much has been achieved in improving risk management frameworks but more change is still needed. Embedding risk appetite remains an aspiration in many banks and enhancements are ongoing to improve stress testing and overall risk transparency. IT and data remain impediments in many areas. Nonetheless the largest change in this year’s survey is the further emphasis on reviewing culture and on operational and reputation risk.”