Whether you are a regulator, a director, a banker or in any other industrial or commercial sector, the burning question of the moment is how to respond to the enormity of the dislocation that has created and been created by the global financial crisis. At its core, the crisis shows that risk has been misunderstood, mismanaged and – at least by bankers – mispriced. In the process of the crisis unfolding, fundamental assumptions about risk have been revealed as questionable. Some of the key lessons are:
- We cannot assume away risk – risk does not disappear. There are no miracle cures for risk. A high-risk loan in Florida is not miraculously transformed by selling it to a Norwegian pension fund.
- Mostly, when we talk about ‘risk’, we mean uncertainty or ambiguity or complexity. Unlike risk, uncertainty cannot be controlled; we can only limit (contain) or mitigate the exposure of the uncertainty to our business, absorb the risk or transfer it. The idea of ‘controlling risk’ is usually a linguistic trick.
- Pricing risk accurately requires visibility and transparency. Opaque structures are difficult to price and to manage. Accurate pricing also requires an active market – liquidity – to eliminate the need for use of proxies or ‘shadow prices’.
- Complexity of organisation limits visibility and transparency. While it may be necessary to collect and isolate specific risk types, it adds to complexity and administrative burden. Greater complexity of organisation requires a compensating and meaningful investment in reporting systems and communication channels which can penetrate the fog the complexity creates.
- The world is complex, in both the simple and systemic senses. Any model representing a complex reality contains error in its representation of reality and the processes of interaction of the forces that make up that reality. Complexity of reality cannot be assumed or modeled away. Model risk, and the basis risk of proxy prices, can cause real damage.
- The utility of standardised approaches to risk such as value at risk is that they handle routine risk well; by removing the need to understand in detail the 99%, such approaches make room for the risk manager to focus on the 1% they do not understand well or that bring down the firm – often the model risk and basis risk, but also events that cannot be predicted or foreseen: so-called unknown unknowns.
- Comparative advantage in risk-holding is relative not absolute – AIG may have been better at packaging risk than other players but it over-concentrated corporate default risk, creating a systemic risk in the process.
Part of the problem is that industries have become wedded to techniques of risk structuring and analysis without understanding their limitations, thus creating a new risk – that the limitations will manifest – which, indeed, they have. As philosopher Karl Popper put it:
Whenever a theory appears to you as the only possible one, take this as a sign that you have neither understood the theory nor the problem which it was intended to solve.
So to address the problem, we need to reflect on the approaches we have settled on and question the assumptions upon which the approaches are built. Has that happened?
So what has happened in the last 12 months?
While the huge social consequences of the 1930s have been averted by extensive bank recapitalization, a bank debt assurance programme, fiscal stimulus and unprecedented liquidity expansion, there remain considerable uncertainties in markets.
First, liquidity. Central banks have poured hundreds of billions of dollars / pounds / euros in to markets through purchases of government stock, private sector paper and under-performing asset-backed securities. Their liabilities are running at around 250% of their value of 15 months ago before the ‘quantitative easing’ programmes were launched in an attempt to re-inflate growth.
The stock market
Has it worked? There are two answers to that. Predictably, it has re-inflated depressed asset values, seen most notably in the surge in stock indices since March of 2009 when the programmes began in earnest. This is the second major story of the last 6 to 12 months. The effect of growing the money supply on the real economy is more debatable; we will not know the true story for some time. Even if the transmission mechanism to the real economy is through a mis-placed optimism based on re-inflating asset prices in the stock market, the impact of the optimism can be real and lasting. But it remains a gamble.
The City’s reaction to debate over the regulatory response
In the UK, the debate ignited by the phrase of Adair (Lord) Turner in an otherwise unremarkable roundtable published in the September edition of the political monthly Prospect represents another important change. To describe any element of London’s sacred cow – the financial services market – as “socially useless” was tantamount to heresy. Turner used the phrase in the context of a discussion about the growth of banks’ balance sheets:
. . . the fact that the financial services sector can grow to be larger than is socially optimal is a key insight. There clearly are bits of the financial services sector, and particularly the bits that relate to fixed income securities, trading, derivatives, hedging and possibly also aspects of the asset management industry and equity trading, which have grown beyond a socially reasonable size . . . a lot of the increase in the balance sheets of banks was derived from activities internal to the banking systems. And you have a financial systems that creates products which at one level can help you to hedge volatility but which can also be used in ways that create more volatility.
Given the conditions of the last 24 months, such topics cannot be sacrosanct; underlying assumptions must be questioned. But the furious reaction from the City was revealing. It abated only slightly a week later when none other than Goldman Sachs CEO Lloyd Blankfein told a conference in Frankfurt that
the industry let the growth and complexity in new instruments outstrip their economic and social utility as well as the operational capacity to manage them. As a result, operational risk increased dramatically and this had a direct effect on the overall stability of the financial system.
But the suspicion of Lord Turner has remained. In late October, it was the turn of Bank of England Governor Mervyn King to earn the opprobrium of the City, when he told an Edinburgh business audience:
The sheer scale of support to the banking sector is breathtaking. In the UK, in the form of direct or guaranteed loans and equity investment, it is not far short of a trillion (that is, one thousand billion) pounds, close to two-thirds of the annual output of the entire economy. To paraphrase a great wartime leader, never in the field of financial endeavour has so much money been owed by so few to so many. And, one might add, so far with little real reform.
As he pointed out:
Our national debt is rising rapidly, not least as the consequence of support to the banking system. We shall all be paying for the impact of this crisis on the public finances for a generation.
His speech considered the “too big to fail” argument and lent regulatory weight to the ideas of UK economist John Kay for separation of the utility functions of banks – “narrow banks” in Kay’s terminology, and to former US Federal reserve chairman Paul Volcker for the separation of proprietary trading from utility banking operation.
The response this time was from political circles, where senior Government figures let their anger show. No less a mighty ‘economic’ figure than the Prime Minister, former Chancellor, and a former academic historian of the Labour Party and now its leader, stated in the House of Commons:
Northern Rock was effectively a retail bank and it collapsed. Lehman Brothers was effectively an investment bank without a retail bank and it collapsed. So the difference between having a retail and investment bank is not the cause of the problem. The cause of the problem is that banks have been insufficiently regulated at a global level.
With even greater perceptiveness, the Chancellor argued:
I don't think a Glass-Steagall approach which might have been right for the 1930s is right for the 21st century.
And he would know? The tenor of the debate is baffling. Neither Mervyn King nor Adair Turner nor their senior advisors are trying to do anything other than encourage sensible debate over much-needed reform, to question assumptions. Certainly, such reform must have an international dimension. But until the banking industry recognises its misunderstanding, mismanagement and mispricing of risk has created a millstone around the necks of a generation of taxpayers, we will not move on. Reform is inevitable; but, crucially, the less interventionist, the less dirigiste, the better. But more spectacular in the short term (separation of proprietary risk-taking in trading activities from deposit-taking) may sustain lower regulatory intervention (through the inevitably clumsy tool of capital buffers, especially counter-cyclical ones) in the long term. But the debate must be had.
Institutional liquidity and stress testing
International regulators have strengthened their requirements for firms to conduct stress testing of capital and liquidity positions and have introduced individual liquidity adequacy standards. Arguably, this is not a great change, merely stating explicitly and with regulatory force what well disciplined firms were already doing as part of the their liquidity management and Pillar 2 practices.
The governance issues – the Walker report
In the UK, the report by Sir David Walker, the former chairman of Morgan Stanley International, has addressed the issue of changes required in firms’ governance arrangements to improve their understanding of and management of risk. Sir David’s draft report released in July, which runs to 39 recommendations on diverse topics of governance, is something of a landmark in the debate on governance in the UK. On its release, the backlash from the banking sector foreshadowed the angry reactions that would later emerge to the comments of Turner and King; most focus was on Walker’s inelegant suggestions on delayed remuneration. But these were noise.
The real force of Walker’s report was in other areas. First, he advocated that banks and other major financial institutions (BOFIs, as he called them) establish a risk committee, made up of non-executive directors. While I believe his calls for expanding the role of non-executive directors are unrealistic, the distinction between the forward-looking role of a risk committee versus the backward-looking role of an audit committee is an important insight that will have ramifications well beyond banking.
Secondly, he called for chief risk officer roles to report jointly to the board of directors via the chair of the risk committee, in the same vein as audit directors with audit committee chairs. If the argument were extended to corporate secretaries / company chairs (which I believe it should be), this would create a new cadre of executives – ‘governance’ positions – with dual responsibilities and reporting lines. This may yet end up being the most far-reaching aspect of the reforms proposed by Walker. Its applicability outside financial services also deserves wider consideration, but the case may be less compelling.
The systemic approach to the issue of governance and the role of institutional investors was neither novel nor explicitly addressed in systems terms, but Walker’s thinking on the system of governance and institutional ownership of major listed companies was a step forwards in terms of design principles for governance frameworks. His report stopped short of acknowledging that the current model is broken (which is arguable in any case) but his proposed solutions were elegant and market-based.
Finally, he considered the respective roles and relationships between executives and non-executives. These are the most fraught and difficult issues in governance and a cause of most problems that arise at board level, either between directors or in terms of board performance. He offered no solutions but at least engaged with the debate.
The final report of the Walker review and the Financial Reporting Council’s review of the Combined Code are both eagerly awaited. The FRC approach will, inevitably, be more conservative. Their impact remains to be seen.
What has not happened
No-one has gone to gaol (or ‘jail’ if you were born after 1900) for anything. No directors of the banks that were bailed out have been investigated to my knowledge, least of all prosecuted; none have been banned or deemed unfit to hold office. Most are still in place. Of course, “complicity in collective stupidity” is not a criminal offence. But, by holding so few people to account, we are setting a disastrously low bar for future behaviour.
Finding out what . . . well . . . happened
Despite the enormous, “breath-taking” in Mervyn King's words, bailouts required, there has been no systematic investigation or accounting to the public in any forensic sense of the disastrous decisions by RBS to buy ABN Amro or to force a merger with the troubled HBOS on the board (and the shareholders) of Lloyds TSB. These omissions are a disgrace. Here, the Swiss regulator has set a fine example by requiring a detailed review of UBS be published for its shareholders. Similar requirements in the UK would go a long way to enhancing transparency and improving expectations of performance.
Ignoring the irrelevant / re-framing the remuneration debate
Instead, we have endless debates about bonuses. The simple truth is that the problem is created by accounting fictions – recognition at the time of a transaction of the profit implied by the deal, prior to it being realised in any economic sense. Yet, at no time, has this simple truth emerged in to the debate. How much senior bankers earn is irrelevant. If the market is inefficient, cure the inefficiency, don’t address the symptom: if senior corporate financial officers are too overawed to shop around for names for corporate finance tombstones, that is their shareholders’ problem. The resulting fees may be inflated, but so what? If traders are paid once the money is, so to speak, in the bank, rather than fictionalized on a P&L statement, there would, again, be no problem other than the social utility of it all (to borrow Turner’s phrase). These fundamental issues of the utility of the accounting model require an airing; they are yet to receive it.
Thinking clearly about regulatory capital
Similarly, the BIS model of minimum regulatory capital levels has been discussed only cursorily. The minutae of the rules have received extensive coverage, but the absolute level of the regulatory minimum, the 8% bit of the “8% of risk-weighted assets”, has barely rated a mention – until now. And, creating a counter-cyclical framework is so fraught with difficulty as to seem (at least to a mere economist) a fool’s errand. But I am reassured that Alistair Darling is so convinced by it. I am sure he will bring his barrister’s eye to the eventual rules, regardless of their micro-economic sanity.
How the BIS, after 20 years of considering the problem and regulating on it, should suddenly come up with a workable formula for counter-cyclical capital minima, defies imagination; understanding which part of the cycle you are countering is surely one of the intractable problems of economics. Of course, quite reasonably, opinion is divided on these issues. Turner and King (economist turned actuary and economist respectively) are both reasonable and appear divided; within the ranks of economists, there is considerable disagreement. However, the current debate seems to set the stage for an ultimately unworkable international political compromise.
Quis custodiet ipsos custodes?
The role of supervisors has attracted more limited media comment since the collapse of Lehman Brothers and the slide in market values of stocks through to March of this year. Its prominence after the collapse of Northern Rock has given way to a general presumption that the FSA must be doing something. But what? A clear explanation of how their approach will differ would be worthwhile. CEO Hector Sants’ summary of progress on the supervisory enhancement programme in February of 2009 was embarrassingly inadequate. A far clearer statement of intended changes and periodic reports on progress towards them is a minimum to restore, or possibly to establish for the first time, industry confidence in a robust and organized programme of supervision.
Despite the high political discount rate on substantive change, especially with a general election looming in the UK and mid-term Congressional elections now less than a year away, political pressure will not abate for solutions . . . or the appearance of solutions. The cracks in the façade of global capitalism will not heal themselves and taxpayers (viz. voters) are rightly angry. However, the sin of hasty regulation that is not well thought through may well result in repenting at leisure. Already, reaction to Dr Brown’s suggestion of a Tobin tax at the recent G20 finance ministers’ meeting in St Andrews was swift: it was rejected outright. But issues are on the table that have been ignored since the early days of the Basel Committee’s consideration of prudential regulation. They will take time to work through, possibly a generation. I do not believe we will see wholesale change any time soon.
In designing regulatory responses to the global financial crisis, regulators need to be far more mindful than they have been of the value of innovation in management practice, and more humble about the wholeness of their insights. First ‘against the wall’ should be the lazy notion of ‘best practice’ that has become so prevalent. If the phrase were merely short-hand, that would be one thing, but it is not; prescriptions of corporate activity and ‘best practice guidance’ become de minimis regulation. In his report, Walker used the phrase an astonishing 35 times!
Instead, real principles need to be defined for regulation and the regulation should recognise that ‘best-suited practice’ will depend on the unique circumstances of every firm; firms need to adapt to survive. Regulation should be formulated not for ease of supervisory implementation but to encourage firms to understand best how their circumstances require them managerially to respond; they should be ready to justify their adaptive response and should be called upon (by supervisors and owners) to do so through disclosures which are free of prescription. Encouraging more and better thought and management action would be far more valuable than requiring more and ever-more-precise rule-following.
In the UK, the FSA has led the way in requiring greater attention to board-level competencies with its review of significant influence functions. This is welcome, if a little belated. All sectors, especially financial services, would benefit from far greater concentration on internal and board office-holders’ competencies in risk, control and assurance. But this competence cannot be rule-following or slavish adherence to the chimera of ‘best practice’. It should be built on a deep understanding of the organisational, analytical and behavioural challenges of risk and internal control – of methods and their weaknesses. Greater attention to the limitations of value-at-risk may have limited some of the more reckless pre-crisis behaviour of structurers, securitisers and bond traders. Regulators moving beyond the confines of thinking represented by the COSO model of internal control would be a welcome start.
However, fleetingly, financial institutions’ response to the crisis is giving renewed attention to frameworks for risk and control. Bankers and regulators alike must use this opportunity to ‘launch a thousand ships’ of innovation in these areas. One encouraging area is Solvency II where astute and visionary regulation will force insurers to examine their approaches to enterprise risk and approach it from the right perspective: from the ‘top’, in terms of the roles and responsibilities of the board and executive to consider risk and capital in their strategy-setting and planning, and from the ‘bottom’ in terms of the enhanced data capture requirements for effective risk analysis. Of course, the real impact in practice will depends on the commitment of boards and management teams to understand the requirements fully and to accept change.
So, what does this mean for internal audit?
It is a time to do the basics well. Internal audit functions should redouble their attention to provision of robust testing of internal financial controls and internal control more broadly in the service of opinion on internal control for the CEO and chairman of the audit committee.
But it is also a time of organisational change as firms adjust to new realities of understanding risk. Internal audit must ensure that assumptions really are tested within their firm. If the skills or the inclination to pose and answer searching questions are not available within the firm, or if there is a tendency to ‘paper over the cracks’, internal audit must ensure apply pressure to source the right skills from outside the firm.
As change requirements are identified, internal audit should review these to ensure that governance of risk can be effective – from statements of requirements to decision-making to reporting and oversight. Concerns are best raised at the design stage.
Once change is underway, internal audit should keep alert to slippage of timings, specifications or resources. As firms struggle to retool their risk infrastructures, many promising initiatives will founder on quality of execution.
Finally, internal auditors must be willing to support innovation within their own firms and their own profession. As another great philosopher, Bertrand Russell, said, “every opinion now accepted was once eccentric”. Internal audit is not a profession renowned for being open to new ideas but, with so many risk-related assumptions consigned to the dust-bin, it is time to bring out the drawing-boards again. New ideas must flow and be encouraged and even tried in practice; this includes ideas relating to internal control and assurance.
We live in a time in which change is not only inevitable but essential and an urgent priority – with all the difficulties therein noted by, among others, Niccolo Machiavelli:
There is nothing more difficult to carry out, nor more doubtful of success, nor more dangerous to handle, than to initiate a new order of things. For the reformer has enemies in all those who profit by the old order, and only lukewarm defenders in all those who would profit by the new order, this lukewarmness arising partly from fear of their adversaries, who have the laws in their favour; and partly from the incredulity of mankind, who do not truly believe in anything new until they have had the actual experience of it.
Of course, on this occasion, the law may move in favour of reformers. But the inherent conservatism of the City or Wall St cannot allow so cataclysmic an economic event to pass without reform. That reform must be not be dirigiste: it must not be an ever-expanding rule-book. But the signs are ominous; reaction in the major financial centres has been to add to regulation and, by firms and industry bodies, to resist even discussion of major reform, forcing the debate to be ever more shrill and conducted in sensationalist terms in the full glare of media attention. That is not constructive. Most dangerous of all is the threat of internecine turf battles among regulators, especially in the UK where it has been fuelled politically for electoral advantage.
Internal auditors can run but not hide; change needs to come to internal audit also. But its major contribution will be to ensure that change in their own firms is sought where needed and, where it is embarked upon, that it is robust and effective.
So, is real change on the horizon? Yes, but don’t hold your breath. Regulation will – as it always does – overshoot and require subsequent adjustment. Change is on the horizon and it will be here to stay. But don’t expect it to be effective any time soon.