ey - recover-adapt-advance_back-to-business-in-an-uncertain-world

8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world

1/48

Recover, adapt, advanceBack to business in an uncertain world

A survey of the worlds largest banks


2/48

1 Executive summary

4 Top challenges

16 Rethinking risk strategies

24 Risk appetite: the Ernst & Young perspective

28 Realigning roles, responsibilities and rewards

34 Recalibrating risk processes

41 Costs and budgeting

44 Final thoughts

Contents


3/48

1

The title of our 2010 annual survey on risk governance, Recover, adapt, advance: back

to business in an uncertain world, aptly reects the current mindset of this years

survey participants.

The good news is that most of the executives we spoke with believe that recovery is

underway. No one, however, is optimistic that this recovery will be quick or easy. In fact,

many are bracing for another dip in the form of commercial real estate defaults and

anticipating that another wave of bank closures may follow. Executives, particulary in the

West, are picking up the pieces and are working diligently to clean up the distressed assets

and debt on their balance sheets. As one respondent told us, Its been an exhausting and

debilitating 12 months.

But all agree the challenges are far from over. While the worst of the downturn seems to

be behind us, the global markets are far from stable. Although the economy is showing

signs of recovery in most parts of the world, unemployment remains stubbornly high.

Worldwide, consumer trust and condence in governments in general and in the nancial

industry in particular are at an all-time low. Politicians and regulators are rallying to

tighten controls signicantly, and executives are preparing for an onslaught of new

restrictions that have the potential to affect some very fundamental aspects of the way

they run their rms.

Recovering and adapting would seem to be more than a full-time job for senior management;

however, as one executive told us, Uncertainty aside, we still have a business to run.

Around the globe, banks reported that they are buckling down and getting back to the

day-to-day tasks. Most have adopted a back-to-basics philosophy exiting products and

markets that overextended their capabilities and diluted capital, and returning to their core

businesses. Not surprisingly, attitudes in general are cautious and risk averse.

As the dust settles, boards and senior management are taking the time to reect

strategically on the big picture clarifying growth objectives, basic business models, andorganizational philosophy and culture. They are extremely cognizant of the glaring lessons

of the crisis: the vital importance of managing for liquidity; the need to strengthen and

institutionalize an appropriate risk culture; and the imperative to always be prepared for

the unexpected. As a result, many have enhanced capital planning and tightened controls,

policies and procedures; elevated and strengthened risk governance; and upgraded

forecasting, reporting and assessment capabilities.

Many executives are hopeful that the lessons of the downturn will drive positive and

lasting change in the industry. As one respondent told us, I think memories will be a

little longer this time than perhaps they were in the past. Despite the preponderance of

issues still facing the industry, we came away with a growing feeling of hope about the

possibilities ahead.

Executive summary


4/48

22

Key observationsPreparing for the new regulatory realities. In response to the pending regulatory

requirements, particularly the potential restrictions on capital, banks are underway with a

variety of initiatives raising capital and liquidity levels, assessing the impact of proposed

regulations on business strategies, and addressing risk management weaknesses exposed by

increased supervisory expectations to prepare for the anticipated changes.

Rethinking risk strategies. Respondents unanimously agreed that risk governance

must remain a top priority on senior management agendas. In an effort to build a more

comprehensive, consistent and collaborative approach to risk, boards and senior teams are

starting at the top by dening, articulating and enforcing an organizational risk appetite and

working to cascade it throughout the business.

Realigning roles, responsibilities and rewards. Survey respondents consistently expressed

the view that companies underestimated the vital importance of the human factor in

managing risk. To institute and reinforce a strong risk culture, risk must become everyones

business, from boards to front-line decision-makers. As a result, banks are redening roles

and responsibilities for risk management throughout the enterprise strengthening board

oversight duties and signicantly elevating the CROs stature and organizational inuence.

This is the third in a series of proprietary surveys on evolving risk management at global

banking and capital markets institutions conducted by Ernst & Young since 2007. The

goal is to identify key challenges organizations are facing around risk management

and control, and to assess the state of risk management in a turbulent environment.

Ernst & Young again commissioned Broderick & Company, an independent market

strategy rm, to conduct in-depth, qualitatively rich interviews with senior executives

in global banking and capital markets institutions. From October 2009 through

January 2010, Broderick interviewed 39 senior executives from 30 major banking

institutions around the world. The interviewees included a mix of senior executives in

each organization. Among them were: chief nancial ofcers and chief risk ofcers, as

well as heads of functional divisions such as operational risk, market risk, credit risk,

internal audit and compliance.


5/48

33

Recalibrating risk procedures. Across the banking industry,

initiatives are underway to achieve a more holistic, integrated

approach to identifying high-impact risks and factoring them into

decision-making. Better, faster and more transparent reporting

and more sophisticated, forward-looking forecasting capabilities

are viewed by respondents as two critical success factors in

enterprise-wide risk management.

Streamlining technology. Leveraging technology to more

effectively support risk management remains a work in progress

for most banks. While executives seem to have a clear vision

for how technology can be deployed to better support riskmanagement, they reported ongoing challenges in implementing

effective technology platforms. As a result, technology remains a

major area of investment.

Coping with rising costs. More than 80% of respondents across

regions are bracing for signicant increases in costs. Heightened

regulatory requirements and workout expenses in the aftermath

of the meltdown are predicted to drive costs up for at least the

next 12 to 24 months.

North America Europe Asia-Pacic

American Express

Bank of America

CIBC

Citigroup

Fannie Mae

Goldman Sachs

Northern Trust

PNC

State Street Bank

TD Bank

Banco Santander

Barclays

Credit Suisse

HSBC

Intesa Sanpaolo

ING

Lloyds Banking Group

Nordea

SEB

Socit Gnrale

Swedbank

VTB Bank

ANZ

Bank of China

Bank of Tokyo-Mitsubishi UFJ

ICBC

Macquarie Group

National Australia Bank

Sumitomo Trust & Banking Co. Ltd.

Westpac

Participating

institutions

included:

I think any nancial

institution that says

they havent had lessons

learned is not being

honest. I hope to never

see anything like this

again in my career. Its

not over. Were still on

the carousel.


6/48

Top

challenges

4


7/48

5

When respondents were asked to identify the top two risk management and control challengesfacing their organizations, ve themes quickly surfaced and reverberated throughout our

discussions. Taken together, they form an image of an industry striving to regain its footing in

a still-uid economic and regulatory landscape.

The overwhelming top-of-mind issue cited by 72% of respondents is regulatory uncertainty.

New regulations are expected to impose restrictions on capital, liquidity, risk management and

compensation practices, but how strict they will be and how soon they will take effect remains to be

seen. Anticipating and addressing the potential impact of these new rulings on their organizations is

a time-consuming and often frustrating task for company leaders.

Still focused on the regulatory theme, more than 40% of respondents are grappling with the

business implications of the pending new requirements for capital and liquidity levels, placing it

second on the list of top concerns. More than one-third (38%) of survey interviewees say they are

working hard to upgrade their risk governance policies and procedures with the goal of instillinga risk awareness culture throughout their organizations. Worries that the economy will stagnate,

or worse, dip back into recession, were cited by 36% as a continuing challenge. And nally, in the

aftermath of the crisis, 28% of the executives surveyed are dealing with the tough task of removing

distressed assets and debt from their balance sheets (See Exhibit 1).

Five challenges dominatesenior management agendas

Executives are grappling with regulatory and economic uncertainty

72%Dealing with regulatory uncertainty

41%

Anticipating new capital requirements

38%Shifting the risk culture

36%Navigating the fluid economy

28%Repairing the balance sheets

Exhibit 1: Top challenges facing senior management

Dealing with regulatory

uncertainty is the

top concern


8/48

6

Challenge 1

Many different regulatory

changes are being oated

around. But when theyre going

to be brought in, and whether

theyre going to be brought in

on a uniform, global basis is

difcult to assess.

Dealing with regulatory uncertainty

41%


38%

Evolving the risk culture

36%

Navigating the fluid economy

28%

Repairing the balance sheet


9/48

7

72%

Multiple regulatory proposals complicate planning as banks

anticipate systemic reform

The rapidly changing regulatory landscape was cited by the majority of respondents as thetop challenge their organizations face around risk management and control. As regulators

and legislators around the world tighten regulatory oversight in response to the nancial

crisis, banks are preparing for what one executive called draconian regulations that have

the potential to affect some very fundamental aspects of the way they run their business.

Financial institutions are, of course, accustomed to dealing with a host of regulations

across all of the jurisdictions in which they operate, but the heightened political scrutiny

and the rush to respond in the wake of the nancial crisis are creating a complex and

sometimes contradictory web of proposals from regulators around the world. Banks are

struggling to navigate through the multiple pieces of legislation from multiple regulators

to determine the impact on their global operations. As one executive summed it up, You

have the G20 coming up with things; you have the Europeans coming up with things;

you have the British coming up with things; and all not necessarily coordinated and notnecessarily all saying the same thing. Its exceedingly difcult.

Plotting a course through this landscape is extremely challenging and intensely time

consuming for internal teams. Banks are diverting a huge amount of senior time to

meet and work with regulators, redeploying teams of people to deal with the growing

documentation requirements and investing in new systems and processes to stay a step

ahead of anticipated changes.


10/48

8

Challenge 2

If you change the amount of

capital and liquidity required,

there will be big consequences

as to what is an appropriate

and viable business model.

The cost of funding and the cost

of capital mean that there are

certain types of lending and

other activities we probably

wont do.


41%Anticipating new capital requirements

38%


36%


28%



11/48

9

72%

9

Stricter regulatory proposals are driving banks to reallocate

capital, rebalance portfolios and rethink market strategies

Of the array of regulatory changes under consideration, the expected increase incapital and liquidity requirements represents the most formidable challenge to many

institutions. While many respondents claim they have historically taken a conservative

approach to allocating capital, 50% did indicate that they are in the process of adjusting

their approaches to capital allocation across their business units (See Exhibit 2).

Many banks have raised their capital levels and ratios above the minimums in

anticipation of the new requirements. But the way it will all sort out from a regulatory

standpoint and the ultimate impact on the business decisions of boards and senior

management are still unclear. Some companies are striving to align economic capital

with regulatory capital models to make certain that regulatory requirements are

adequately captured or, as one respondent explained, We are trying to switch our

organizational mindset from economic to regulatory capital.

Even banks that are not changing their capital allocation process acknowledge theyare enhancing governance policies and procedures around capital management:

augmenting reporting requirements, particularly to the board and senior management;

strengthening their forecasting methodologies using scenario planning and stress

tests to evaluate impacts on capital positions; and formalizing and documenting capital

contingency plans.

Many institutions are seriously re-evaluating their portfolios exiting more

capital-intensive, less-protable lines of business and geographies, and shifting

out of more complex, less-liquid instruments into simpler, more-liquid products

with less risk and, of course, less return. Executives worry that the impact

of these decisions could potentially restrain lending and ultimately

slow economic growth and recovery.

Exhibit 2: Changes in approach to capital allocation

Half have changed

their approach to

capital allocation

50%


12/48

10

Challenge 3

Working through the crisis,

we gained insights into

how to strengthen our risk

management and control. It

allowed us to shore up our

weaknesses and further develop

the risk management team.


41%


36%


28%


38%Shifting the risk culture


13/48

11

72%

Banks are strengthening their risk culture and governance

processes with greater senior management involvement

and reinvigorated risk procedures

In the Ernst & Young 2009 study conducted at the height of the crisis senior

executives listed shifting the risk culture as their second most important initiative

to tackle once the short-term reghting and damage assessment were over. One

year later, shifting the culture is still very much top of mind for senior executives.

The good news is that the aspiration is slowly becoming a reality. Banks have

undertaken a host of initiatives to institutionalize comprehensive, consistent and

collaborative approaches to risk. Effective risk governance has risen to the top

as a core business imperative, and organizations are mobilizing to identify and

address deciencies. Boards and senior management are now fully engaged in

the risk process, determining and articulating the organizational risk appetite and

parameters; strengthening and clarifying governance policies and procedures; and

clearly establishing risk responsibilities and accountability across all levels of theorganization from board members to front-line managers. The power and inuence

of the risk team have been signicantly elevated, and in several institutions, the

CRO has a dual-reporting relationship to both the CEO and the board as well as a

strong voice in strategic decision-making.

The changes required to institutionalize a strong risk culture are fundamental and

far-reaching. For many banks, making risk everyones business represents a

signicant shift in mindset, policies, systems and processes. As one executive told us,

It is an enormous, multiyear march to accomplish.


14/48

12

Challenge 4

If I add it all up, the uncertainty

in the environment and how you

manage for that strategically

and in the day-to-day are my

biggest concerns.


41%


38%


36%Navigating the fluid economy

28%



15/48

13

72%

Uncertainty about the economy poses a challenge to

long-term and short-term planning

While a few survey respondents used the terms recovery and claimed the worst isbehind us, the optimists were outweighed by the more cautious executives who remain

concerned about the depth of the recession and the pace of economic upturn. But,

regardless of their viewpoint, all agreed the uncertain market environment is making

business planning and decision-making both short- and longer-term extremely difcult.

There is no doubt that serious challenges are still ahead for the industry, and organizations

are bracing for what one executive called the triple threat: the economic, political and

regulatory aftershocks of the crisis.


16/48

14

Challenge 5

The other thing is that a lot of

assets are still sitting on the

banks balance sheets. Bad

debts tend to lag the economic

position, so things start looking

a lot better, but bad debts keep

coming through.


41%


38%


36%


28%Repairing the balance sheets


17/48

15

72%

Many banks are still dealing with fallout from the crisis

Senior banking executives continue to be occupied with the cleanup of the distressed

assets and debt on their balance sheets. In particular, many are keeping a vigilant eye

on their levels of commercial real estate loan defaults in areas where market conditions

continue to weaken.

Some banks reported progress in selling troubled assets, but acknowledge that most

potential purchasers of debt are still waiting on the sidelines to see if the market will

decline further and reduce prices, especially in the commercial real estate sector. Several

banks have deployed teams of qualied workout specialists to keep up with and manage

the portfolio deterioration.


18/48

16

Rethinkingrisk strategies

16


19/48


20/48

18

Most respondents acknowledged that their company needsto do a better job dening, articulating and instilling their

organizational risk appetite into the company. Challenged

by both regulatory bodies and boards of directors, senior

executives have elevated risk appetite to a top priority on their

very busy agendas.

While 60% of respondents gave themselves relatively high

marks for having a clearly articulated risk appetite, most

agreed that dening the risk position and embedding it

throughout the organization are two distinct activities

(See Exhibit 3). The process is complicated by the absence of a

risk-appetite statement that applies to all business lines.

The level of acceptable risk must be assessed and determinedfor each risk type and line of business. Disparate business

goals, weak communication and spotty enforcement can cause

a disconnect between the risk parameters set at the board and

senior management level and the day-to-day management of

the business. Cascading the risk appetite down to the business

unit and desk level is critical to putting risk appetite into effect

throughout the organization.

As we have noted, shifting the risk culture is not an easy task

and several interviewees describe multiyear, highly collaborative

and iterative processes to integrate disparate risk tolerances and

create a unied company-wide position.

Reassessing and integrating risk appetite

Boards and senior management are clearly dening risk tolerance and limits

4%

Not clearly

defined

36%

Underway

60%

Clearlydefined

Most have clearly

dened statements of

risk appetite

Exhibit 3: Statements of risk appetite

We always had a squishy risk appetite

philosophy that everyone interpreted

differently. Now we are codifying and

formalizing it.


21/48

19

Strengthening risk-identication processes

Banks are looking at risk holistically and assuming a more

vigilant stance on risk-identication policies and procedures

Activities underway

Identifyingemerging risks

Respondents reported a wide range of

activities to identify emerging risks more

systematically:

Conducting more frequent and more

formal risk discussions

Instituting emerging-risk identicationcommittees

Strengthening stress testing, using

more forward-looking scenarios

Adopting more rigorous screening and

on-boarding procedures for new clients

Utilizing advanced information

technology to conduct real-time

monitoring of risks of subsidiaries

and branches

Upgrading portfolio risk grading systems Issuing early warning indicator reports

Reinforcing product-approval policies

and procedures

In the aftermath of the crisis, banks moved quickly to take controlof their risk agendas with the immediate goal of identifying and

mitigating vulnerabilities and reducing high-risk behavior and problem

areas. The control-tightening initiatives have led many institutions

to incorporate more rigorous processes for evaluating their risk

portfolios and introduce more stringent controls to ensure that the

banks position is solidly within the accepted parameters of risk.

Survey participants indicated that they have greatly strengthened their

early warning procedures to spot emerging risks and deal with them

quickly before they escalate into major issues. Banks reported a host of

rigorous policy and procedure improvements in this area including: daily

real-time monitoring of risks; stricter portfolio risk-grading systems;

and tighter screening of on-boarding procedures for new clients.Several institutions have formed new cross-functional risk identication

committees composed of managers from nance, risk, technology,

compliance, treasury, accounting and the business units. These come

together regularly to share their respective insights on emerging risks

that could potentially have a negative impact on the company.

The industry has learned the painful lesson that problems in one area

of the bank can reverberate throughout the institution, creating and

exacerbating problems in totally unrelated businesses. As a result,

executives said they are doing a better job of understanding the

correlations of different risks conducting more integrated forecasting

scenarios that look beyond the traditional silos to assess emerging

issues more systematically and holistically. Finally, many companieshave upgraded their product-approval policies and procedures,

increasing the involvement of the risk group in developing, approving

and monitoring products throughout their life cycle. Some now require

the risk organization to sign off both at the initiation of a new product

and on an annual basis to ensure the product is still acceptable on a

risk/return basis and from a reputational standpoint. As one executive

sums it up, Early identication of risks has become the holy grail in

our organization.

Ive got a weekly escalation that ags any new

risks in the business. Youve got to have youreyes and ears open 100% of the time.


22/48

20

44%

As the focus on risk intensies, companies are enhancing theirmanagement of key risks. This is true not only for traditional

risks classes, such as credit and market risk, but also for

emerging areas, such as operational, liquidity and reputational

risk, which have become more important. As one executive

told us, Its not that we werent cognizant and careful of these

risks before; its that the consequences of getting them wrong

today are much more severe. When asked to prioritize the types

of risk that are currently receiving the most attention in their

businesses, executives placed credit (67%), operational (44%),

liquidity (38%), market (33%) and reputational (26%) risks at the

top of their lists.

Credit risk: the top of the agendaAt the end of our interviews in January 2010, the economy,

particulary in the US and Europe, was still in ux. High

unemployment and low consumer condence persisted, and the

credit markets remained contracted. While cautiously optimistic

that things were stabilizing, respondents expressed concern

that the turnaround would be sluggish or the economy might dip

again into recession. As a consequence, credit risk was top of

mind for most interviewees (See Exhibit 4).

Shifting focus on risk classes

New areas of risk are surfacing on senior management agendas

Credit risk is at

the top of senior

management agendas

Exhibit 4: Risks at top of senior management agendas

Liquidity

38%

Market

33%

Reputational

26%

Operational

44%

Credit67%


23/48

21

Executives agreed that making sound credit approval andpricing decisions is even more critical than ever in todays

environment, and many are initiating a variety of activities to

manage exposures and mitigate risk. More specically, banks

are conducting stringent independent credit analysis both

for borrowers and for credit providers and guarantors. They

are deploying special workout teams that will manage loan

portfolios more rigorously to resolve remnant structural

credit positions and monitor deterioration in credit quality,

charge-offs and related delinquencies. And they are

strengthening their credit risk management function and

team. The impact of tail risks, especially for structured credit

products, emerged as a particular area of concern, and many

said they were upgrading their forecasting capabilities to

assess risk in stressed market conditions.

Operational risk: assessing the nuts and boltsAttention to operational risk is on the rise, especially in the

Americas. Almost half of the executives interviewed voted it a

top priority, making it managements second greatest concern.

Financial institutions have, of course, managed operational risks

for years and understand the need to maintain tight controls

and low error rates. However, the heightened scrutiny from

both regulatory bodies and governments, the new operational

risk management framework and measurements required

under Basel II, and the sheer difculty of navigating todays

environment have all intensied the focus on operations.

Banks are examining the nuts and bolts of the business

evaluating, dening and quantifying the people, systems andprocess risks embedded throughout the enterprise. Initiatives

include: standardizing documentation of processes and controls;

improving data gathering, quality and timeliness; developing

methodologies and metrics to quantify risks; and conducting

scenario analysis by risk type. Several companies have created

a new management position focused exclusively on operational

risk oversight, and many are developing risk awareness and

training programs for all units and functions.

Operational risk is the cause du jour

with regulators.


24/48

22

Liquidity risk: the biggest lesson learnedIn Ernst & Youngs 2009 survey, 88% of respondents viewed

liquidity more specically the loss of liquidity as the single

largest lesson learned from the disastrous ripple effect of the

downturn across global markets.

In this years study, there was still widespread agreement that

the industry underestimated the difculties of measuring and

forecasting liquidity, and all concurred that liquidity must be

factored more fully into risk management. The good news

is that the liquidity lesson appears to have been taken to

heart 84% of banks interviewed indicated that they have

changed their approach to managing and controlling liquidity

risk (See Exhibit 5). Changes ranged from very fundamentalshifts out of businesses and products to tactical internal

adjustments to liquidity management practices.

Seventy percent of banks have adjusted their viewpoints on

liquidity buffers, and many have signicantly increased their

cash reserves to comply with, and in some cases exceed,

regulatory requirements (See Exhibit 6). Many have made

changes to the structure and composition of the risk group,

recruiting more senior people and strengthening their authority

and clout. New liquidity risk committees, comprising very senior

executives and, often including the chairman, meet weekly in

some institutions to track and monitor liquidity positions. Basic

risk governance policies and procedures have been reviewedand strengthened, common terminology established, data

quality and collection upgraded and reports improved. Liquidity

stress testing has become an important part of forecasting,

providing valuable input into the capital and strategic planning

process. Over two-thirds of executives reported adjustments to

testing extending the time horizons and including more worst

of the worst case scenarios (See Exhibit 7).

84%Most banks have madechanges to their approach

to managing and

controlling liquidity risk

Exhibit 5: Approach to managing and controlling liquidity risk

68%More than two-thirds have

changed their approach to

liquidity stress testing

Exhibit 7: Approach to liquidity stress testing

70%More than two-thirds have

adjusted their viewpoint on

liquidity buffers

Exhibit 6: Point of view on adequate liquidity buffer


25/48

23

Market risk: calming downMarket risk has been taken off the front burner of senior

management risk agendas. The extreme volatility in the market

is calming down and respondents are breathing a collective sigh

of relief. But the contagion impact the extent of the crisis and

speed with which it swept through the industry is very much

on everyones minds. Banks are working to hone their tools and

processes to better predict their rms sensitivity to shocks

and volatility in the market. They are supplementing traditional

VaR measures with stress testing and scenario analysis some

investment banks are even conducting daily and weekly tests

on their trading books. They are also closely monitoring the

size, concentration and liquidity of positions, and applying goodbusiness judgment to the results of the quantitative models.

Several executives reported that they are focusing on the

correlation between market risk and credit risk and are merging

the two functions under the control of one senior executive.

Reputational risk: an erosion of trustNot surprisingly, effective management of reputational risk

has become increasingly important, and respondents are

brutally aware of the erosion of trust and condence in the

industry. Stakeholders, including shareholders, counterparties,

customers, current employees and potential recruits, gauge

their interactions with the company based on their individual

perceptions of the companys soundness, reliability and

performance an important factor in maintaining a strong

institutional brand.

Many executives discussed the intensity of the political,

public and media scrutiny, and its extremely negative impact

on everyone in the industry including the people andorganizations that managed prudently. One executive noted

sadly, You dont go to a dinner party and tell people you work in

a bank anymore.

Market risk doesnt kill institutions. Its

generally either credit risk or liquidity risk

that brings you down.


26/48

24

Ernst & Young perspective

24

Risk appetiteSetting the rules of the roadAs regulators and bankers step back and

ponder what went wrong and how to

prevent it from happening again riskappetite has emerged as a critical

foundation of the risk management

process. While the expectation of having

a board of directors approve risk appetite

has been around for some time, boards

and senior management, at the urging

of regulators, are taking a fresh and far

more rigorous approach to dening and

institutionalizing a robust risk appetite. As

they move through the process, they are

discovering that risk appetite is a

powerful management tool that, whenproperly applied, creates a strong linkage

between strategy, risk, business and

capital management.

Risk appetite is the amount and type

of risk a company is willing to tolerate

to achieve its strategic and business

objectives. It is a reection of the board

and senior managements vision for how

the company fundamentally wants to do

business and how it wishes to be perceived

by key stakeholders customers,

shareholders, employees, regulators andrating agencies. The amount and type of

risk an organization is willing to accept

varies from bank to bank depending on

its management philosophy, growth goals,

business focus and geographic reach.

Even within the company itself, there is

no one-size-ts-all measure of risk. Each

business unit and risk type will dictate

a different level and approach to risk. A

banks appetite for credit risk in consumer

lending, for example, is often very

different from its appetite for market risk

in its investment banking organization.

A banks statement of risk appetite should

be expressed in a way that complements

the rms vision and strategy and sets

the rules of the road for the entire

organization, clarifying the board and

senior managements overarching views

on what constitutes acceptable risk at

all levels within the business. A clear,

well-dened statement provides the

connection between the overall business

strategy and the risk governance of the

organization, and is the cornerstone of

an effective risk framework. Far too often,

the risk strategy doesnt translate into the

day-to-day management of the business.

As one executive told us, At our bank

there is good top-of-the-house articulation.Its pushing it into the DNA of the business

thats hard. Creating a risk framework

that is meaningful to management

and translates to actionable limits and

escalation triggers at the business unit

and desk level is a tough job.

Who is responsible for

risk appetite?

Ownership of risk appetite starts at

the very top of the organization andsystematically cascades downward to the

front-line business managers. The key

players in the risk appetite development

and implementation process include:

Board of directors. The role of the

board in risk management has evolved

signicantly post-crisis, from pure

oversight to active participation in dening

risk appetite and approving the broad risk

parameters for the enterprise.

Risk committee. More and more banks

are adding or strengthening the mandate

of board risk committees to focus and

enhance their risk oversight responsibilities,

including active monitoring of the level of

risk exposure for the institution versus the

parameters set in the risk appetite.

CEO. Ultimately the CEO is responsible

for managing risk throughout the

organization. The CEO, together with the

board, is responsible for creating the risk

framework, and articulating and enforcing

the appropriate risk appetite.

CRO. The chief risk ofcer plays a central

role in the risk appetite development

and monitoring process driving the

discussions between the board, business

management and independent control

groups. The CRO is concerned with

identifying disconnects between strategy

and operations. This role owns the

internal assessment of tolerances, limits

and indicators to support measurement

against the risk appetite, as well as

the implementation plan development,

execution and management.

Business unit leaders. Business unit

leaders must communicate their business

and competitive imperatives and related

inherent risks to achieving those objectives

during the risk appetite development phase.

Once the risk appetite is formulated and

communicated, they are accountable for

ensuring that limits, escalation triggers and

other provisions are aligned with the risk

appetite and meticulously observed in the

execution of strategy.

Independent risk management and

control groups. Control and oversight

groups must have sufcient knowledge of

the business activities of the organization

and have the clout to force a review or

escalation when risk parameters have

been breached.


27/48

2525

Dening risk appetite

Dening the organizational risk appetite is

both a qualitative and quantitative process

that requires careful review of a host of

external and internal factors.

Quantitatively, a banks risk appetite for

earnings volatility, liquidity position and

capital position must be assessed and

calibrated to risk drivers and their related

tolerances and risk limits. Management

must determine the organizations appetite

for a decrease of more than a dened

amount in earnings or capital. They must

also ask themselves: What is the level

of tolerance for a reduction in available

liquidity? and What is the universe of risk

drivers for each of these scenarios, and

what level of tolerance should be assigned

to each?

Economic capital can play an important

role in the quantication of and allocation

of appetite for each of these risks, and

management must carefully consider how

much capital should be allocated to the

various business objectives and strategic

activities of the organization. In addition,

other risk tolerances such as portfolio

concentrations (e.g., in a single sector,

geography, line of business or asset class),

credit quality (e.g., counterparty credit

rating, consumer credit score, delinquency

rates) or market factor sensitivities

(e.g., investment portfolio VaR, percent

change in net interest income under stress

scenarios) can be utilized to express

appetite for additional facets of risk.

Finally, the use of enterprise stress testing,

including reverse stress tests, is an

important tool in identifying and calibrating

additional elements of the overall risk

appetite of the rm.

On the qualitative side, banks must

consider reputational, strategic, culture

and stakeholder opinions. Stakeholder

views will undoubtedly differ on the

desired safety margins, and it is important

to understand these various viewpoints

in setting the appetite. Expectations of

regulatory and rating agencies, for example,

must be balanced with the business goals

and objectives of investors, customers

and boards of directors. Organizational

philosophy, culture and values set the tone

for risk tolerance levels and play a pivotal

role in the decision-making process. And, as

has been amply demonstrated, reputational

damage can signicantly impact a banks

philosophy on reputation and must be

considered in developing risk appetite.

These additional considerations can be

expressed in a number of ways. In many

instances, banks have used key indicators such as key performance indicators or key

risk indicators as a way to numerically

express and measure some of the other,

more difcult to quantify drivers of risk

appetite components like operational or

regulatory risk. In addition, banks should

also utilize purely qualitative risk appetitive

statements as a way to express the boards

views on items such as approved products/

businesses and compliance with external

rules and regulations. These elements,

combined with the quantitative measures,

provide for a more robust risk appetite

framework, which touches on all major

categories of risk.

Regulatory oversight

Internal audit test/evaluate effectiveness of risk governance framework

Board ofdirectors

Independentrisk andcontrol group

Senior managementand lines

of business

approvesstrategy

managesrisk/return

profile

identifies andmanages risk

monitorsrisk

approvesrisk appetite

measures andreports risk

Riskappetite

Risk appetite governance responsibilities


28/48

26

Ernst & Young perspective

26

The risk appetite

development framework

Ernst & Young recommends a practical

approach to creating and embedding an

organization-wide risk appetite statement

and process. This process integrates atop-down view of the rms overall appetite

and capacity for risk in the context of its

strategic, nancial and capital objectives,

with a bottom-up view of the infrastructure,

controls and analytic tools used to support

risk management within the business. The

result is a draft risk appetite statement

that is then assessed and rationalized

to establish consistency between the

risk appetite, and business unit and desk

level operating limits. Finally, the process

updates the risk monitoring and reporting

to align with risk appetite.

Done successfully, this integration

establishes a new framework through

which the enterprise-wide risk appetite set

by the board and senior management is

cascaded down to the business in the form

of limits and thresholds. These limits and

thresholds can be measured and monitored

by qualitative and quantitative means, with

appropriate performance reporting fed

back up to senior management. The key

building blocks to this approach, therefore,

aim to establish a sustainable process and

information loop that links the top-down

and bottom-up views.

Draft risk appetite and assess current

risk prole

Top-down. Boards and senior management

must reect on their understanding of

the potential impact of the range and

severities of key risks on the bank and its

strategic objectives. Taking into account

the inherent uncertainties with forecasting

of this nature, banks must dene, through

both quantitative and qualitative means,

how much risk the rm can or is willing to

accept. This understanding of key risks and

potential severities must be translated into

a top-down statement of risk appetite.

In order to do this, boards and senior

management must have a robust and

forward-looking understanding of the most

signicant risks faced by the institution

relative to the achievement of its strategic

goals. Scenario analysis and stress

testing, including so-called reverse stress

tests, along with existing aggregated

risk reporting, should play a key role.

Boards should challenge whether current

executive risk reporting and engagement

with management succeeds in establishing

a key risk inventory that fully addresses the

range and potential severities of the most

signicant risks to which the rm may be

exposed. Management should put in place

processes the will support:

Forward-looking view of risk. Provide

a forward-looking view of risk that

reects the rms strategy, business

model, future market conditions and

the inherent risks, sensitivities

and uncertainties.

Linkages. Understand the linkages

between strategy and risk, and capital

and funding. How would capital and

liquidity be impacted by certain risk

events and how the rm could respond?

Risk capacity. Understand risk

capacity and which shocks to revenue,

reputation, capital and funding could

potentially send a bank into a downward

spiral from which it could not recover by

itself. What scenarios could cause this

to happen?

Bottom-up. A current state, or bottom-

up, analysis of the banks current ability

to monitor and measure risk relative

to appetite is an activity that banks

should undertake. This analysis should

challenge the extent to which existing

processes and systems provide the

ability to sustainably identify, measure,

monitor and report against the identied

risks and limits.

A practical approach to dening a risk appetite

Update risk

monitoring and

reporting to align

with risk appetite

Establish

consistency

between risk

appetite and

operating limits

Assess

completeness

of risk appetite

Draft risk appetite statement

and assess current risk prole

Conrmrisk monitoringreporting andprocess

Conrmrisk appetitestatement andcalibrate operating

parameters

Identify strategicobjectives

Draft risk appetitestatement

Top-downapproach

Inventory risk

measurementtools

Assess current risk

prole, exposuresand limits

Bottom-up

approach

Connectrisk appetitestatement withrisk prole


29/48


30/48

2828

Realigning roles,responsibilities

and rewards


31/48

2929

Banks are clarifyingrisk governance responsibilities

Senior management is reassessing and redening

expectations for risk management

Making risk management a company-wide concern and changing deeply engrained

attitudes toward risk require signicant attention to the people factor in the risk equation.

Building a strong talent base with deep risk expertise and competing successfully to recruit

and retain this expertise continue to be critical challenges industry-wide. It is evident from

respondent interviews that many banking professionals believe the crisis can be traced, in

large measure, to the lack of a strong corps of seasoned risk executives throughout the

industry with the appropriate stature and clout to anticipate and act on risk issues.

There was strong agreement that effectively managing risk across the enterprise requires

both top-down oversight and bottom-up involvement. Accordingly, many banks have

conducted reassessments of the roles and responsibilities for all key internal

stakeholders from board members to business unit heads and their teams to

re-evaluate and clearly articulate expectations for risk management and mitigation.

Compensation, which few respondents believe played a pivotal role in the nancial crisis,

is nonetheless a major issue to be addressed, and bank boards are working proactively to

do a better job of linking pay with risk performance.

Banks are taking a variety of actions to better align their compensation practices with

actual performance, rebalancing the proportion of xed to variable compensation and

more tightly linking variable pay to performance over longer time horizons.


32/48

30

Well-dened and clearly articulated risk ownership rolesand responsibilities are a critical component of effective risk

governance. Over the past 12 months, many banks have

stepped back to take an inventory of current limit structures,

delegations of authority and existing policies and procedures.

Many found gaps in processes and assignments throughout their

organizations and confusion around risk oversight expectations.

As a result, responsibilities have been claried and positions

strengthened for the key executives across the enterprise.

Boards and risk committees: reinforcing responsibilities

Most respondents shared the conviction that effective, high-

performing boards make an important difference to the

performance of their organization. Accordingly, many are

focused on identifying the critical factors for building and

improving higher impact, more effective boards. Two-thirds

of survey participants indicated that their organizations have

made changes to the roles and responsibilities of the board (See

Exhibit 8). Most reported that their boards are becoming more

educated, asking more pointed questions and challenging more

assumptions. At the same time, they are now much more hands-

on and more fully engaged in risk policy setting and governance.

Setting strategic direction and dening the organizational risk

appetite are now considered to be board responsibilities while

emerging issues such as capital allocation, new business risks

and compensation have risen in importance on the boards

agendas. Many of the companies we surveyed have separated

risk from their audit committees and established a distinct risk

committee to ensure independence and an adequate focus

on each of those critical areas. Several are no longer allowing

board members to serve on both committees. More boards

are requesting that the CRO be given independent access toboard members, creating a more powerful system to perform

checks and balances of executive powers in the business lines.

Unquestionably, boards are conducting deeper dives into matters

that in previous years did not reach their agendas requiring

more sophisticated, in-depth reports and analysis, and asking

tougher questions about risk-related issues as they relate to

strategic decisions.

CEO: the buck stops here

CEOs have clearly been in the hot seat during and since the

crisis, and as everyone is aware, they are often the rst to go

when an organization comes under re. Most respondents

agree that the CEO is ultimately responsible for risk in their

organizations. It is the CEO who must ensure that the company

as a whole gets it right when it comes to critical decisions on risk.

The CEO, together with the board, is responsible for creating the

risk framework and articulating and enforcing the risk appetite

throughout the enterprise.

Chief nancial ofcers: aligned with risk

Senior nance teams face new and complex challenges in

todays dynamic business environment. Respondents reported

that nance is changing the way it organizes and operates to

help ensure that banks execute their global strategies effectively,

manage risk appropriately, comply with regulations and bottom line remain stable and solvent. CFOs are strengthening

the nance functions alignment with risk management teams

so that risk governance, nance and capital allocation decisions

reinforce each other rather than work at cross purposes.

Recalibrating risk management roles and responsibilities

Boards strengthen oversight while CROs expand their inuence

The board has taken a greater interest in

how we manage risk and a greater interest

in where the risk lies within the organization.

Theyre educating themselves so when theyrereformulating the strategy, they have a better

understanding of where we might go next.


33/48

31

Chief risk ofcers: drivers of cultural transformationWith risk now playing a strategic role equivalent to that of

growth and revenue, nearly half of the companies reported

they have changed the roles and responsibilities of their risk

teams (See Exhibit 9). CROs are now seen as being on a par with

CFOs and have a say in important decisions impacting strategic

direction, risk appetite, product development and compensation.

As part of their new roles, CROs report spending more time with

boards and providing regular reports and intensive briengs to

help members understand and evaluate risk decisions. In some

instances, CROs report both to the CEO and to the boards

risk committee.

Furthermore, the crisis and the move to Basel II have heightenedthe need for the nance and risk teams to work closely together,

and CROs reported a much tighter alignment with CFOs and

nance organizations. Risk teams interact more frequently

with internal human resource teams to develop remuneration

policies and pay structures. Externally, they play a much

more prominent public role before regulators, analysts and

shareholder groups.

CROs are acutely aware of the increased importance of their

role in building and maintaining an effective risk governance

process and infrastructure. Philosophically, many see their role

as both inuencing risk governance decisions and advising CEOs

on risk appetite and strategy. As one CRO described it, We areeducators and drivers of cultural transformation to make risk

everyones responsibility. Risk has become the busiest area

for recruiters as companies search for strong chief risk ofcer

talent that can truly go head-to-head with business executives.

Business unit leaders: committed to risk culture

The senior line leaders and their teams are taking a more active

role in risk management as well. Many have reinvigorated and

restructured executive risk committees at the business unit or

group level to focus more strategically on risk identication

and mitigation.

I think there were days in the past whererisk people felt like they were being

ignored. Now they really feel much

more relevant.

52%Nearly half of respondents

have made changes to roles

and responsibilities of the

CRO and risk team

Exhibit 9: Changes to the roles and responsibilities of theCRO and risk team

66%Two-thirds have madechanges to the roles and

responsibilities of the board

Exhibit 8: Changes to the roles and responsibilities of the board


34/48

32

The focus of intense regulatory scrutiny and considerable publicire, executive compensation was described by one executive

as the elephant in the room on every matter. Another CRO

reported speaking to a record number of regulators on this

topic during the week of our interview with him. Our survey

participants were of course aware of the restorm surrounding

compensation and assured us that they were not sitting on the

sidelines waiting for the political and regulatory debate to unfold.

Many are taking a proactive approach to assessing and, when

necessary, adapting compensation practices to ensure that

their pay structure does not incent the taking of excessive risks.

Seventy-three percent of executives reported that they have

made, and will continue to make, changes to their compensation

policies to better align pay structure with risk control tolerances

and rm culture (See Exhibit 10).

Banks are also taking a variety of actions to better align theircompensation practices with actual performance. Many are

rebalancing the proportion of xed to variable compensation

putting a little more on the front end rather the back and

are more tightly linking variable pay to performance over

longer time horizons. Some are adding risk-based measures to

scorecards to counterbalance excessive risk-taking. Others are

determining compensation at the group level rather than the

individual business unit level, to create greater distance between

the risk-takers and those who determine their compensation.

Several are deferring payout for a signicant part of executives

bonuses or performance-related income, sometimes for as many

as ve years, and a growing number are including clawback

provisions in deferred compensation. While clawbacks in the pastwere typically limited to cases of fraud or criminal acts, rms are

developing standards under which a clawback may be invoked

based on portfolio performance over an extended period.

Boards of directors and their compensation committees are

spending considerably more time on pay practices. Board oversight

has been strengthened, and compensation committees have

embraced new methods for reviewing pay delving deeper into

the employee ranks, conducting stress tests on payouts and

retaining more discretion over payments.

Linking compensation to risk performance

Public, political and regulatory pressures have elevated compensation on the

senior management agenda

Three-quartershave made changes to

compensation frameworks

Exhibit 10: Changes to compensation frameworks

73%


35/48

33

We are looking very carefully at our

compensation plans to make sure they

dont incent inappropriate risk behavior.

Risk professionals are also being drawn into evaluating the riskdimensions of pay. In many banks, the CRO and risk team are

providing considerable input into the compensation framework,

both directly and indirectly. Risk groups are more closely involved

in offering opinions on existing compensation plans, establishing

new compensation policies, providing metrics for scorecards

for business units and individuals, and in a few cases, actually

reviewing the compensation proposed for the top people in the

organization. In some organizations, CROs now have the power to

insist on a risk capital analysis and possible hedging decision on

large trades and deals, indirectly impacting the bonus pool.

Survey participants agreed that some reform and improvement

are needed for industry compensation policies and most reportprogress is underway to improve the linkage between the

governance of compensation and the companys risk appetite,

management and culture.

Activities underway

Strengtheningcompensationstructures

Respondents reported a range of

activities to adjust pay structures*

Appropriately capital-charging

business and bonus pools

Retaining more discretion in payouts

Stress testing payouts

Moving to longer vesting periods

Increasing deferred compensation

Incorporating risk-weighted metrics

Instituting clawbacks

Increasing base salary

*Banker compensation at a crossroads,

Tapestry Networks research sponsored by

Ernst & Young, November 2009.


36/48

34


37/48

Recalibrating

risk processes

35


38/48

36

Strengthening risk governance, systems and processes

Banks are continuing to upgrade their risk forecasting, reporting and technology

Across the banking industry, initiatives are underway toachieve more comprehensive, integrated strategies for risk

management. Throughout 2009, executives moved aggressively

to identify and address deciencies in their risk management

processes. Reporting, forecasting and technology were the

primary target areas for improvement, and banks put in place

the systems and people required for thorough, proactive

approaches to managing and mitigating risk.

Many are well along the path to building strong risk-governance

teams and processes. Sixty percent of executives interviewed

have made changes to their risk management organizations, and

the remainder have either implemented changes or have begun

the process (See Exhibit 11).

The majority have made

changes to risk management

processes and structures

Exhibit 11: Changes to corporate risk management decision-makingprocesses and structures

60%


39/48

37

In the wake of the crisis, boards, stakeholders, seniormanagement, rating agencies and regulators are demanding

more reliable, thorough and timely information internally

about the business and externally about the universe of potential

risks. As a result, reporting is becoming more substantive

and qualitatively rich. Senior management, boards and other

stakeholders are beginning to receive management reports

that deliver real, actionable value a clear shift from the data

dump mode that often characterized risk reporting in the past.

Seventy-one percent of executives indicated that they are well

underway with the development of integrated enterprise-wide

risk reports and almost one-third said their effort is nearly

complete (See Exhibit 12). But many companies still have a longway to go. Persistent problems cited by respondents include

poor data quality, inconsistent information from disparate

systems and the sheer volume of data all of which make it

extremely difcult to pinpoint the essential information that

management needs and present it in an actionable manner.

Once reports are upgraded to span a more comprehensive

set of information from across the organization, teams are

turning their attention to delivering the information more

quickly. Executives said that accelerating the reporting process

to support real-time decision-making is one of their biggest

challenges. As one executive describes the situation, We

aggregate risk information quite well, but we do it slowly. We stillare working on an all-singing, all-dancing, instantaneous view

of complete risk to a particular counterparty in real time. Were

getting there.

Respondents agreed that effective risk reporting, in terms ofboth content and timeliness,is a critical step toward effective

enterprise-wide risk governance. It provides senior management

and the front-line business and risk professionals with the

information they need to make sound decisions in line with the

companys risk appetite and business objectives. But many

cautioned that aggregating risk is only the rst hurdle. The

more difcult step is reviewing, analyzing and synthesizing

risk reports to understand the interrelationships across the

organization. Most executives conceded there is more work to be

done in this area.

Upgrading report analysis and delivery

Risk reporting is becoming more comprehensive, actionable and timely

0%In earlystages

71%

Midway

29%

Nearlycomplete

The majority are

in the process of

implementing

enterprise-wide

risk reporting

Exhibit 12: Enterprise-wide risk reportingIt is the ability to, with judgment

and insight, connect the dots

between all of that information.


40/48

38

Upgrading and reinforcing forecasting

Banks report progress in improving forecasting systems and methods

The past 18 months have demonstrated in a compelling wayan industry need for more robust risk forecasting. Banks

need more sophisticated predictive tools that will enable

management to assess the implications of market events

on and across categories of risk. The industry has clearly

learned this lesson, and many respondents reported increased

investments in upgrading and reinforcing forecasting models,

systems and processes. More than half of this years survey

participants (55%) indicated that they have some forecasting

capabilities within their companies (See Exhibit 13). However,

only 27% characterized their banks as having formal,

enterprise-wide forecasting processes in place. Most agreed

that to become a truly effective management tool, forecasting

must be integrated and standardized across asset classes and

business lines to provide a holistic view of potential risks and

their impact on the entire organization.

Exhibit 14: Changed use of forecasting models

Three-quarters have changed

the use of forecasting models to

rely less on historical data and

assumptions

71%

Exhibit 15: Changed use of stress testing and scenario planning

74%

Most have some organization-wide

forecasting processes in place

18%

Limitedprocesses

55%

Someprocessesin place

27%

Have formalorganization-

wide processes

Exhibit 13: Status of forecasting

The majority have made

changes to stress testing

and scenario planning


41/48

3939

Respondents reported some critical changes to their forecastingprocesses. More than 70% have adjusted their models to

rely less on historical data and assumptions (See Exhibit 14).

Seventy-four percent have incorporated forward-looking

scenario planning and stress testing that consider outcomes

with extremely low probability but potentially high impact on the

companys own set of exposures and assumptions (See Exhibit

15). But executives cautioned that forecasting models can get

out of hand, becoming overly complex and too difcult for senior

management to understand and use effectively as decision-

making tools. Many emphasized that analysis must always be

paired with seasoned business judgment, cautioning that you

need to be very careful not to fall in love with your models.

I think you need both good models and good

judgment, but you need to be very careful

not to fall in love with your models.

Activities underway

Risk forecasting

Respondents reported a wide range of

activities to improve and upgrade risk

forecasting:

Establishing uniform modeling

standards across the bank

Varying stress-testing methodologies

appropriate to the banks risk appetite,

level of sophistication and current andplanned operations

Integrating scenarios in order to cover

more than one type of risk

Ensuring analytical metrics are broad

and aligned with how risk is managed

Extending time horizons of scenarios

and forecasts

Complementing weaknesses of VaR by

using a wider variety of methods

Using more worst-case scenarios

Ensuring data used in models are

consistently reliable and appropriate

for models used

Ensuring more accountability around

forecasting of loss levels and capital

utilization

Using historical data but placing more

emphasis on the last 6-12 month

period, which is more reective of

current customer behavior

Instituting more business line-specic,

bottom-up stress testing around

discrete portfolios of risk, particularly

those with tail risks attached


42/48

40

Leveraging technology to support risk management moreeffectively remains a work in progress for most banks. As

one executive told us, Youll never stop working on it. More

than three-quarters (78%) of respondents reported that they

are mid-way through the arduous process of mobilizing their

systems to support risk governance a denite improvement

over last years survey results in which only 47% of participants

reported progress on the technology front (See Exhibit 16).

While executives seem to have a clear vision of how

technology can be deployed to better support risk

management, they reported ongoing challenges in

implementing effective technology platforms. The most

vexing of those challenges is data management. Companiesare actively dening the types of data required to produce

useful reports and working to integrate disparate databases

to enable ready access to a consistent data set across thecompany. Many organizations are still in the process of

developing a common platform and centralizing the technology

function as they deal with fragmented and complex systems,

a challenge for the many companies that have grown

by acquisition.

There is strong agreement that streamlining systems is crucial

to improving banks risk management capabilities. As a result,

technology remains a major area of investment. Given the high

costs involved, companies are approaching the IT challenge

from several perspectives. Some have developed prototypes

and are in the testing stage, others are organizing IT projects

around specic systems or addressing system issues at thebusiness-unit level, and a small number have committed to

major system overhauls, such as rebuilding the global market

risk infrastructure.

Streamlining technology to support efciencies

The long march toward improved technology continues

Weve spent a lot of money

over a period of some years in

order to be Basel-compliant.

Youll never stop working on it.

6%

In early

stages

78%

Midway

16%

Nearly

complete

All are working

to upgrade

technology

Exhibit 16: Streamlining technology to support risk management


43/48

41

Costs andbudgeting


44/48

42

Banks are anticipating heavy investment in risk management

With sweeping regulatory changes in the works, executives expect the cost of

managing risk to continue to rise

As the markets stabilize, executives are bracing for steep costincreases as they boost the time and systems dedicated to

dealing with the aftermath of the crisis and the new regulatory

frontier. Executives across all geographies are in agreement:

risk management costs will continue to escalate over the next

18 months and beyond, with some predicting exponential

increases (See Exhibit 17).

Multiple layers of complex regulations have increased

documentation and reporting requirements and brought more

frequent, deeper-dive examinations into operational areas of

the organization. To support these more frequent and complex

inquiries, companies are deploying additional teams of people

and increasing investments in information management systemsand technology aimed at streamlining data gathering and

management across the organization.

The cost of working out troubled portfolios continues to rise

at some banks as they deploy work-out terms to clean up

distressed assets and debts on the balance sheet. Efforts to

hire competitors talent has intensied, especially when trying

to recruit people specialized in workouts, compliance, modelingand risk forecasting signicantly driving up the people cost for

the foreseeable future.

Longer term, a few optimistic executives expect costs will level

off as portfolios stabilize and investments in systems pay off in

greater efciencies and higher productivity. However, even the

most optimistic do not expect to see any cost stabilization before

mid-2011.

I have a team of risk managers and haverequested a fairly signicant increase in staff.

I think I will get what I requested, and Im the

envy of my colleagues.

Americas EMEIAAsia-Pacific

Increase

Decrease

Staythe same

84%

83% 90%

8%

0%

0%

8%

17%

10%

Across all regions, executives

expect costs to increase

Exhibit 17: Costs by region


45/48

43

Seventy percent of respondents indicated they were ableto estimate total annual expenditures for risk-and-control

management across their organizations (See Exhibit 18). This is

a signicant improvement over the results of the Ernst & Young

survey two years ago in which slightly fewer than half (47%) of

those responding claimed they were accurately able to gauge

total costs over a 12-month period.

However, respondents agreed that while they could estimate

the cost of the central risk organization, it is challenging to truly

understand the total enterprise-wide cost of risk management.

When risk is everybodys business it is virtually impossible to

estimate accurately the amount of time people at the business-

unit level spend on managing risk. As one executive put it, To behonest, if we do our jobs correctly, were just putting the policies

and the programs in place. Its that front-line person who, when

she sees a suspicious transaction come through on a client shes

known forever, raises her hand. Thats risk management, but we

dont capture those costs.

Some banks are embarking on studies to assess risk productivityto gain a more sophisticated view of investments in risk across

the enterprise and to benchmark these costs against other

comparative banks. However, the wide variety of denitions of

risk and allocations of resources to risk across the industry make

this a challenging endeavor.

Estimating the cost of risk is complex

Centralized costs of risk management are well known but enterprise-wide costs

are more difcult to quantify

We started to look at the total cost of risk

management and control about four yearsago. It has taken us about two years to get

a handle on it.

Exhibit 18: Ability to estimate cost

The majority canestimate the cost of

risk management

70%


46/48

44

thoughts

Final

44

Moving forward with a new respect for risk managementThe nancial crisis exposed inherent weaknesses in the risk management system: siloed infrastructures, disparate

systems and processes, fragmented decision-making, inadequate forecasting, and a dearth of cohesive reporting,

among others. The extraordinarily negative impact of these aws on many institutions shocked the industry, and asa result, there has been a seismic shift in attitude toward risk.

As they move beyond the crisis, reect on its causes and results and adapt to the drastically changed and still-uid

market and regulatory environment, banks are revitalizing strategies to reect the enhanced focus on risk. While

each bank included in our survey is crafting a unique strategy based on its own culture, business focus and growth

goals, common themes are emerging among boards and senior executives.

Most importantly, there is a unanimous commitment to ensuring that a healthy approach to risk underlies both

short-term and long-term strategic planning. Boards and senior management are challenging themselves to

clearly dene their risk appetite and drive its implementation throughout the business. As they do so, they are

aggressively reviewing and realigning the risk-related responsibility and accountability of every function in the

bank and signicantly expanding the inuence of the CRO and risk group along the way. Many banks are making

tremendous investments in time and technology to strengthen the processes and tools to manage risk effectively.


47/48

4545

From forecasting to reporting to analysis, banks are recalibrating procedures and practices with an eye to providing

management with realistic, actionable and timely information.

There are many lessons to be learned from the crisis. Respondents agreed that the changes required to

institutionalize a strong risk culture are fundamental and far-reaching: risk must become everyones business

throughout the organization from the front line to the functions. Responsibility and accountability for risk areintertwined as never before. All stakeholders, from board members to business unit heads, must be more actively

committed to identifying and mitigating risks.

The question on many minds is whether these lessons will stick. As one executive said, The real question is can

we embed this new risk management culture and processes into the organization so that they can outlast this

generation? Or will it all go wrong again the next time around? No one knows for sure, but all are hopeful. As this

report goes to press, nal regulatory guidelines are still being drawn. The market is calmer, but still volatile and the

full impact of the economic crisis is yet to be absorbed. Banks are denitely back to business recovering, adapting

and advancing in search of the right strategic model in todays uncertain world.


48/48

Ernst & Young

Assurance | Tax | Transactions | Advisory

About Ernst & Young

Ernst & Young is a global leader in assurance,

tax, transaction and advisory services.

Worldwide,our 144,000 people are united

by our shared values and an unwavering

commitment to quality. We make a difference

by helping our people,our clients and our wider

communities achieve their potential.

Ernst & Young refers to the global organization

of member firms of Ernst & Young Global

Limited, each of which is a separate legal entity.

Ernst & Young Global Limited, a UK company

limited by guarantee, does not provide services

to clients. For more information about our

organization, please visit www.ey.com.

The Global Banking & Capital Markets Center

Managing risk effectively while satisfying

an array of divergent stakeholders is a key

goal of banks and securities firms. The GlobalBanking & Capital Markets Center brings

together a worldwide team of professionals

to help our clients achieve their potential a

team with deep technical experience in

providing assurance, tax, transaction and

advisory services.

2010 EYGM Limited.

All Rights Reserved.

EYG no. EK0044

Ernst & Young is committed to minimizing its

impact on the environment. This document has

been printed using recycled paper and

vegetable-based ink.

This publication contains information in summary form and is

therefore intended for general guidance only. It is not intended

to be a substitute for detailed research or the exercise of

professional judgment. Neither EYGM Limited nor any other

member of the global Ernst & Young organization can accept

any responsibility for loss occasioned to any person acting

or refraining from action as a result of any material in this

publication. On any specific matter, reference should be made to

the appropriate advisor.

ey - recover-adapt-advance_back-to-business-in-an-uncertain-world

Documents