Why did Swiss Bank Corp managers take so many of the key positions in the newly merged United Bank of Switzerland? One suggestion, which they won’t comment on, is that SBC far outshone its bigger rival Union Bank of Switzerland in risk management and control.
As an example, there were rumblings about Union Bank’s equity derivatives and equity convertible books, regarded by the market as “brave” and “adventurous” (in other words “mispriced”) which were suddenly shut down in October. The extent of losses hasn’t been made public.
Can this be the biggest instance to date of a risk management team providing its firm with palpable shareholder value in this case a strong negotiating position going into a merger?
If so it gives those at the leading edge exactly the argument they need to explain why risk managers aren’t just in-house policemen, they’re portfolio optimizers: their understanding of risks can put a firm in the best position to enhance its earnings according to its overall risk-appetite.
Tim Shepheard-Walwyn, head of risk identification at SBC in Basle, argues that risk management, (a) gives comfort that the bank is controlled, (b) defines an operating band within which the bank is prepared to accept volatility its risk appetite,(c) helps you use that appetite in the shareholder’s interest, improving the quality of earnings that you generate. “It’s optimization not minimization,” Shepheard-Walwyn says.
This is good textbook stuff, likely if nothing else to enhance the status of risk managers within a firm. But the SBC view is supported by others at the cutting edge. “We’re trying to get some objectivity on the risk appetite,” says Andrew Cross, director in the risk management and quantitative analysis department at CSFP. “We’re there to support business being done: risk itself is not a bad thing.”
At Bankers Trust, senior managing director Clinton Lively concurs: “There’s a one-to-one linkage between profit-and-loss and risk management. As you calculate the utilization of capital [on a risk-adjusted return basis], so you move from a defensive standpoint to a strategic one.”
Does this mean that risk managers are abandoning their role, once seen as controlling the risk-takers, and becoming risk-takers themselves? If so, who controls them? Quis custodiet ipsos custodies?
The principle of independence is important for risk control functions, says Don Vangel, a partner in Ernst & Young’s risk management and regulatory practice. Risk management should not have “business development responsibilities” and in most firms he believes it doesn’t.
This is mostly a semantic question: what does the term risk management mean? To some it means risk measurement: assembling ever finer data and identifying, and if possible quantifying, classes of risk: market risk, credit risk, certain types of operational risk etc. To others it means risk control: the monitoring of risks run by departments and individuals in the firm and supervising the correctness of behaviour according to risk and conduct-of-business guidelines. But in its broadest sense risk management includes risk measurement, risk control and using these tools to tune the firm’s risk/return ratio. Risk management can also mean fostering an entire culture to pervade the firm from top to bottom.
No wonder there is confusion about what risk managers do, and what their purpose is. For example, Daniel Napoli, head of market risk at Merrill Lynch, refers to the firm’s salesforce as “our best assets and best risk managers: they see everything, from trader behaviour to customer behaviour, and they know best at what price an asset will clear”.
This is true. But other firms, such as SBC and Goldman are more interested in systematizing that information flow. Merrill relies on its culture and force of character. Napoli and his 10 risk managers there have been only 10 for more than a decade roam Merrill’s global trading floors interacting with the traders and reinforcing the culture that was born in 1987, after mortgage losses and an uncovered hidden trade in a trader’s drawer. Dan Tully, then president of the firm ordained: “This must never happen again.”
Value-at-risk, a market-risk measure, “doesn’t pick up the losses I really worry about”, says Napoli. Napoli worries about the low probability events, “such as (God forbid) a major work-stopping event in the World Financial Center, a major credit meltdown, or a surprise litigation the outer wings of the bell curve”.
These are the “fat-tail” events that the risk measurers worry about too but have difficulty quantifying. All risk measurers know that these 50-year events (which unsportingly could happen tomorrow just as easily as in 2048) are the ones that the firm’s capital must guard against. Value-at-risk numbers (market-risk losses that might occur once in a hundred-or-so days) pale into insignificance beside such big events. “Market risk is about sixth on my scale of the overall risks,” says Napoli.
Extreme value theory, predicting the impact of severe events, is something that increasingly exercises risk managers. They simulate severe events either by inventing scenarios on the scale of a 1987 crash, a Gulf War, a Mexican peso crisis, and estimating where that would put their market risk portfolio, or they stress-test the portfolio by applying a sharp rise in interest rates, perhaps coupled with a fall in equity markets and/or the dollar. “We routinely run six scenarios a week,” says Clinton Lively, “the 1987 crash, the Gulf War, the 1990 junk bond crisis, the 1994 bond market shock, the Tequila Crisis, and last October’s downturn. Or our chief economist throws in future scenarios of his own: the integration of Hong Kong with China, the break-up of Emu, Korean unification.”
Such stress-testing is obviously a useful exercise, but the numbers generated cannot be a source of much comfort, since they’re not likely to be close to any future real event. “Risk managers seem to think they can predict what’s going to happen,” says Ethan Berman, managing director at JP Morgan. “But things happen because no one thinks they’re going to happen.”
Holding enough capital to ride out the worst combination of past market events may not be feasible. “The 87 crash alone was a 25 standard deviation event,” says one risk manager. Most trading books are run on the basis of three or four standard deviations, which will be breached by three or four market events a year. Regulators looking at setting sufficient capital levels aren’t trying to ensure that banks don’t fail. “Ten percent more or less capital in a bank isn’t what determines failure,” says one regulator. “It’s management and culture.”
But scenario analysis is increasingly regarded as the best way to make senior managers aware of weaknesses in the firm’s defences. Regulators would like to see firms do more work on systemic scenarios. “Risk management practice has tended to concentrate on the firm level,” says Christine Cumming senior vice president at the New York Federal Reserve. “But a lot of the problems we’ve had have been at the macro level such as the US real estate crisis of the early 1990s. Despite prudence at the individual level you can get caught up in these.”
Pure market risk is low on the list of nightmare scenarios because recent technology has allowed market risk to be quantified as never before. Since the mid-1980s financial firms have invested millions in front-office trading systems and more recently in mid- and back-office systems. Moreover, most risk managers are confident that they would lose less than value-at-risk figures predict, “because VAR assumes everyone sits on his hands for two weeks”, says Napoli at Merrill Lynch.
After such attention to market risk, a similar effort is being made in the more quantifiable areas of credit risk such as the risk of credit spreads widening, the probability of default by companies of a certain credit rating etc. Risk measurement of this type “is not a goal, it’s a journey,” says Maarten Nederlof, senior vice president at Capital Market Risk Advisors in New York. Of the attempt to quantify, says Lively at Bankers Trust: “85% of its value is in the discovery process. The production of the figures requires you to answer so many questions. Even if you don’t produce the numbers you know the business so much better.”
One goal of risk measurement is to reduce the number of surprises that can occur, in as many areas of the business as possible. “We have a ‘no surprise’ mandate,” says Lively, “to act as a catalyst for discussion and make sure that no [useful] idea is unpresented.”
Gathering the information into one place, as even one of the most sophisticated global banks (JP Morgan) admits, “is not a trivial exercise”. But advances in information technology have made it more feasible.
That has tempted institutions into the belief that they can do something else: allocate a theoretical capital cost to different risks and business areas within the firm. Getting that allocation right means the firm’s resources will be put at risk in the most efficient way for the optimum quality of returns.
However, the allocation is finally a matter of judgement, not mathematics, as any attempt so far has shown. Mathematics can’t yet convincingly factor in a capital cost for the following: legal risk, settlement risk, operational risk, fraud, walkout of personnel, or any string of low probability events such as war, earthquake, a systemic financial shock, or a body-blow to the firm’s reputation.
Despite this limitation, leading firms are getting closer to what they believe is the right allocation of economic capital to different businesses. Some operational risks, such as errors and failed trades, do have a data history to work from. SBC is using this information to develop its approach to pricing operational risks. For its credit portfolio it has performed what it calls “actuarial credit risk accounting” (ACRA) which puts the risk into three categories expected loss (the normally expected loss rate on a credit portfolio, which is absorbed by the net profit), unexpected loss (because of credit volatility for which SBC makes a reserve), and stress loss (extremely high losses with low probability, for which SBC runs its risk limits system as primary protection, backed up by capital and general reserves). CSFP has a similar model for the credit risk on its portfolio, which it has also published as CreditRisk+. Like ACRA it is used to calculate numbers for the entire group’s loan portfolio.
SBC’s credit business would normally run at a profit on the basis of its credit margins, which fund the reserve for unexpected loss. But the business should also be charged something in effect an option premium for its call in extremis on the firm’s capital and general reserves. Because financial firms are leveraged, however, capital is not allocated directly to each business area.
A firm must develop a “shadow risk-pricing mechanism” to calculate the risk/return on its various businesses: that is what SBC and Goldman Sachs risk managers argue in a joint paper to be delivered at a seminar at the New York Federal Reserve on February 26. [Building a coherent risk measurement and capital optimization model for financial firms, by Tim Shepheard-Walwyn, corporate risk control, SBC, and Robert Litterman, firm-wide risk management, Goldman Sachs.] The capital which management then selects “should be greater than the capital which the regulators require, which in turn must be greater than the minimum capital which is produced by the risk modelling process”, the paper says. The authors devise an equation, based on the standard Sharpe (risk/return) ratio for investment portfolios, and, extrapolating from the aggregate risks run by the firm they show that a Sharpe ratio for the entire risk of the firm can be arrived at, and appropriate risk charges can be made to the business areas. The Sharpe ratios for the different businesses, and the shadow risk prices, can be used to determine which businesses are producing the most efficient risk/return. Ergo, risk-pricing can assist decisions on how much to invest in which businesses. Risk management becomes a business driver.
The authors admit that “much more work remains to be done on risk measurement” before firms can factor in operational risks, “which impact the firm’s volatility of earnings…and where measurement techniques are relatively underdeveloped at present”. But risk pricing is better than capital allocation, they conclude, because it recognizes correlation between the different risks run by different business areas, and because it doesn’t demand precise measurement of all risk factors. New factors can be added as they become better quantified.
For Bob Gumerlock, formerly with SBC risk control, now running the SBC-LTCB joint venture in Tokyo, this is what a firm’s chief financial officer “always wanted to do, but he never had the tools”.
Getting the risk pricing right is important, however. “Banks often wreck perfectly good businesses because they think they’re underachieving,” says Bob Blower, marketer of risk management products at Reuters. “Areas like foreign exchange and money markets actually make good, solid returns compared with some difficult-to-price derivatives.”
Setting a risk/return on businesses is important for another reason rewarding the risk-takers (traders) on the basis not just of their earnings, but on returns adjusted by the losses the entire firm might incur and by other business considerations. “If compensation is based [just] on trading revenues,” says Napoli at Merrill, “I guarantee bad behaviour.” Merrill rewards risk-takers on the basis of “a partnership in business areas” and shares restricted over five years. Few but the most feudal of firms will pay “a direct percentage of a trader’s earnings”, says a managing director at a big bank. But he notes that market pressure, particularly from the hedge fund industry, tilts trader compensation to a degree that is tantamount to a “one-way option” on a financial firm. The trader shares the upside but not the downside of a firm’s performance. The trick is “to build incentives [for traders] to improve the quality of [the firm’s] earnings,” says Shepheard-Walwyn at SBC. The next trick is to ensure that, whatever incentives you build are not set in stone but are constantly evolving, so that smart traders don’t permanently skew their business to what can only be an imperfect model. “Traders find out how the brownie points work and learn how to push up their score,” says Nederlof at Capital Markets Risk Advisors.
Measuring performance isn’t just a numbers game: business isn’t always best done for a palpable profit. How do you value and reward a transaction done to reinforce a customer franchise or to establish market-share? At Citibank “we don’t look at [a trader’s] dollar of revenue but we ask ‘how much has he supported the sales business etcetera’,” says Guy Whittacker, manager of Citibank’s global foreign exchange. “For the last 10 years we’ve been factoring in client feedback and customer satisfaction.”
New-look Bankers Trust sees the client relationship as a “key consideration” in risk/return. “What are the correlated effects on the overall client relationship and can we quantify them?” asks Lively. “We attempt to.”
The wider task, outlined by the SBC/Goldman paper, is to set a firm’s economic capital. This must be more than the capital-at-risk implied by the firm’s various risk models, and it must also be more than that required by the regulators. Otherwise there is a danger that regulatory capital requirements will skew the business and distort its efficiency.
According to the market consensus this has historically happened with the capital standards set by the Basle Committee on Banking Supervision in 1988 and again in 1997. The 1988 Basle accord specified 8% capital cover for a bank’s credit risk including rule-of-thumb weightings for credit exposure on off-balance sheet items.
In a paper that castigates the Basle capital standards, Berkeley finance professor Terry Marsh and a colleague, Jean-Michel Paul, cite Japanese banks as an instance where the standards “appear to have goaded weaker banks, which after all are the target of the standards, into undertaking more rather than less credit risk”.
According to the latest credit risk measurement techniques, which aggregate probabilities of default across a portfolio and predict recovery rates from value-impaired loans, leading banks believe the fair value of loan exposures can be more finely estimated on a portfolio basis. Credit managers can assign a high percentage of par value for the best credits and lower percentages for the lowest credits and work out an aggregate figure for loan value-at-risk. This doesn’t address the problem of specific risk the risk that a single name in the market will be affected by its own event and trigger a loss.
The 1997 Basle accord on market risk was a breakthrough for the risk management profession. For the first time, regulators accepted the principle that a firm’s internal risk models may be used to set the level of regulatory capital to be held against market risk positions. From August to October last year a handful of global banks were asked, as an experiment by the New York Clearing House, to pre-commit the amount of capital suggested by their models for market risk, to see how accurate they could be. None of the 10 firms overshot its pre-committed capital on the other hand the penalties for overshooting weren’t specified, so the banks were super-careful.
Now a debate is raging over how far the pre-commitment approach (PCA) might be used to set regulatory capital for market risk. The alternative, enshrined in the 1997 Basle accord, taking a bank’s value-at-risk figure and multiplying it by at least three, is regarded as intellectually unsound, even though in some jurisdictions it has come into force.
The objections to PCA are that financial penalties for overshooting would be counterproductive, damaging firms that are already in trouble, and that penalties, or just admission of overshooting, would have too volatile an effect on a trading house without more predictable flows, such as a retail or commercial banking book. “Pre-committed capital has to be added to other activities with other capital,” says Paul Kupiec, formerly of the US Federal Reserve, now with JP Morgan. “PCA is a replacement for regulators approving banks’ internal models, but it won’t do for a whole bank.” Kupiec was joint originator of the PCA concept in a 1995 working paper for the Fed. At first the idea was welcomed by JP Morgan but rejected by others such as SBC. Now there’s more of a consensus that bits of PCA might work for a handful of institutions.
The SBC/Goldman paper supports what it calls a base-plus approach. The regulator would set a base level of capital for the firm, based on its costs or revenues, then there would be a modification, according to the firm’s risk profile as revealed by its own risk models. To prevent the firm from radically altering its risk profile after the capital was set, it would have to pre-commit an extra amount to cover anticipated changes over the next reporting period. “We believe that this could provide a productive basis for an optimal capital regime for financial firms in the 21st century,” the authors conclude hopefully.
Fixing a firm’s optimum economic capital is something that has come late to the finance industry. Oil companies and other manufacturers have been calculating their earnings volatility with computer models of their (admittedly much simpler) businesses since the 1950s. Financial firms have used computers for trading and for management information systems (MIS) for 12 to 15 years. They’re just beginning to calculate their enterprise-wide risk as other industries have done. “Banks got ahead of each other by acquiring more and more knowledge,” says Michael Dempster director of the centre for financial research at the Judge Institute of Management, Cambridge University. “Now the trick is what you can do with information.”
Risk managers are astonished at how important their profession has become. “Something that started as an MIS experiment is now a major function,” says Lively at Bankers Trust. “It’s extraordinary. It’s a new profession, nobody’s done this before.”
Some regulators feel that giving risk management the status of a profession, with qualifications and a code of conduct, would be the key to raising standards among the second-tier firms. “If you break the code, you lose your status, as in the insurance industry,” suggests one bank supervisor.
Does this all add up to re-inventing the wheel? Have the risks run by financial firms changed so much from those prevalent in the 1970s or even the 19th century? “One man used to be able to keep them all in his head,” volunteers one risk manager, “now positions are so complex, no one can do that any more, not even [world chess champion] Garry Kasparov.” A comparison might be an early biplane with canvass wings which could coast to earth if it got into trouble. Now a global financial firm is more like a deliberately unstable superfighter which will crash if the pilot dares to fly it without its onboard computer.
Goldman Sachs was apparently content to rely on its partners’ risk-taking instincts, until 1994, when it was caught by the US interest-rate hike. Since then, having developed what rivals acknowledge to be one of the best risk management departments on the street, its value-at-risk chart shows profit-and-loss staying within a much narrower volatility band, yet the firm has been making more money than ever. “Bob Litterman has been outstanding at taking the value-at-risk concept and getting the most out of it,” says a rival.
In a joint book The Practice of Risk Management, published this month by Euromoney, SBC and Goldman admit to small differences in their risk management approach, although “we agree on all the important issues”, says SBC’s Shepheard-Walwyn. SBC puts more emphasis on establishing a control structure and sticking to it as befits a larger, quoted institution that includes deposit-taking and retail banking while Goldman has controls which can be more flexible. For example Goldman’s trader limits tend to be tighter but can be re-negotiated with traders, while at SBC, once limits have been agreed they are then sacrosanct. “We can buy into the trader’s arguments,” says Litterman at Goldman. Moreover, Goldman is happy with several traders worldwide trading the same product: a Goldman trader in Italian bonds, for example, is free to arbitrage his Italian government bond position against German Bunds. SBC runs centralized books for different product classes which are managed globally as distinct portfolios.
Litterman at Goldman sees the quantitative side of market risk management as “probably a very small part of the firm’s risk, the main risk being reputational risk”. Yet that hasn’t diverted Goldman from producing a state-of-the-art firm-wide market risk report daily, identifying hot spots for the benefit of senior managers.
The next question, whether risk management does or should take offsetting positions for the bank, is wide open. “I am allowed to take offsetting positions,” says Merrill’s Napoli, “but I use it rarely. I’d rather the desks do their own hedging. If a trader knows you’re behind him with a hedge, it gives him only upside.” Lively at Bankers Trust agrees: “By and large we don’t have a central hedging function. It undermines accountability and it cuts across profit-centre responsibilities. We tend to go back to the profit centre to hedge.” But, Lively adds, there are “strategic portfolio effects which justify portfolio hedging techniques,” for example, if several profit centres are taking the same risk. Moreover “banks are traditionally long credit spreads. We might do something to counteract that, perhaps with a credit derivative”.
Likewise Goldman as a securities firm is traditionally long equities. It often hedges that by taking a short equity position, such as selling S&P futures.
But the question then arises, don’t investors buy Bankers Trust shares in order to be long in the credit market? Haven’t Goldman’s partners bought into a firm with a long-standing commitment to the equity markets? Surely hedging a core business risk is like getting out of the business. Lively dispatches that idea with a rapier-thrust: “The question isn’t whether you are a bank or not, but can you perform better. By not leaving these things naked, can you be more efficient in the intermediation process.”
Banks that are more efficient risk-takers are benefiting the economy and even performing a social good, argues Lively. “There’s less distortion. Intermediation is much more efficient, and that has social value to the economy.”
Risk managers as prime contributors to shareholder value and society at large may be a difficult concept to swallow. But it may become more credible, depending on what role these big financial institutions play in future. Will they exist mainly to cushion players in the so-called real economy from financial risk, or will their main role be to lay off such risks on investors and insurers? If it’s the former, then regulators are bound to be more concerned with their long-term survival; if the latter, then the regulators might be content with big bank failures, as long as any wind-down or sell-off is done in orderly fashion.
A bank which regulators regard as too important or too big to fail enjoys a free put option on its home government and taxpayers. Regulators are right to demand something in return for that option, such as a certain level of regulatory capital or minimum reserves.
But if that put option is somehow cancelled, by the government and taxpayer credibly denying support regulatory capital and minimum reserves are unnecessary, or so the champions of economic capital would argue.
The pre-commitment approach to bank capital goes some way to providing the government and the taxpayer with a put option on the bank. But what do the banks get for it? It puts less onus on the regulators, but are the regulators prepared to pay the premium? “Why would we give them a free option, unless it was for more freedom?” asks one risk manager.
Today global banks and other large financial institutions tend to ignore the distortion caused by the too-big-to-fail concept. The IMF-led Asian bailout has shown how taxpayers are almost bound to give banks some relief when there’s the threat of a systemic crisis. But how can a bank correctly price its cost of doing business and its true risks unless it prices in the put option that its shareholders enjoy, courtesy of the government, possibly the IMF, and the taxpayer?
Perhaps this is expecting too much. Option valuation, as most bankers and regulators acknowledge, is an imprecise science. Assumptions have to be made about the volatility of the underlying asset and of the option price itself. It is possible to regard every fork in the decision tree as an option which has a theoretical net present value.
Two McKinsey consultants recently wrote a paper introducing the concept of “real options”, attempting to put a price on the flexibility to choose the timing, as well as whether or not to do a piece of business, such as investing in an oil well or launching a ship. The application in finance of real options is now being explored. Who knows whether it will make the risk manager’s job easier, or simply more fraught with spurious quantification.
Ultimately, the endeavours of a firm’s risk managers must fit into a structure that is coming to be known as firm-wide risk management. “People want it, but they haven’t got there yet,” says Dempster at the Cambridge Judge Institute.
Few firms have a single professional risk manager overseeing all risks market risk, credit risk and operational risk. “Firm-wide risk management is not the function of a single department,” says Lively at Bankers Trust. “Our chairman Frank Newman is our firm-wide risk manager.”
After all the quantification has been done, and the chief risk officer on the firm’s executive committee has had his say, further leadership is still expected from the chairman or CEO. If there is such a person as a firm-wide risk manager, it’s him or her. Unless, of course, the professional risk manager is also head of the firm. That day must surely come.
