The banking industry has long viewed the problem of risk management as the need to control four of the above risks which make up most, if not all, of their risk exposure, viz., credit, interest rate, foreign exchange and liquidity risk. While they recognize counterparty and legal risks, they view them as less central to their concerns. Where counterparty risk is significant, it is evaluated using standard credit risk procedures, and often within the credit department itself. Likewise, most bankers would view legal risks as arising from their credit decisions or, more likely, proper process not employed in financial contracting.
Accordingly, the study of bank risk management processes is essentially an investigation of how they manage these four risks. In each case, the procedure outlined above is adapted to the risk considered so as to standardize, measure, constrain and manage each of these risks. To illustrate how this is achieved, this review of firm-level risk management begins with a discussion of risk management controls in each area. The more difficult issue of summing over these risks and adding still other, more amorphous, ones such as legal, regulatory or reputational risk, will be left to the end.
A. Credit Risk Management Procedures
In presenting the approach employed to manage credit risk, we refer to the four-step process outlined in Section II D above, drawing different pieces from different organizations. The institutions are not named, but are selected because of the representative nature of their documentation of the process. We begin with standards and reports. As noted above, each bank must apply a consistent evaluation and rating scheme to all its investment opportunities in order for credit decisions to be made in a consistent manner and for the resultant aggregate reporting of credit risk exposure to be meaningful. To facilitate this, a substantial degree of standardization of process and documentation is required. This has lead to standardized ratings across borrowers and a credit portfolio report that presents meaningful information on the overall quality of the credit portfolio. In Table 1, a credit-rating procedure is presented that is typical of those employed within the commercial banking industry.
The form reported here is a single rating system where a single value is given to each loan, which relates to the borrower’s underlying credit quality. At some institutions, a dual system is in place where both the borrower and the credit facility are rated. In the latter, attention centers on collateral and covenants, while in the former, the general credit worthiness of the borrower is measured. Some banks prefer such a dual system, while others argue that it obscures the issue of recovery to separate the facility from the borrower in such a manner. In any case, the reader will note that in the reported system all loans are rated using a single numerical scale ranging between 1 and 10.8 For each numerical category, a qualitative definition of the borrower and the loan’s quality is offered and an analytic representation of the underlying financials of the
borrower is presented. Such an approach, whether it is a single or a dual rating system allows the credit committee some comfort in its knowledge of loan asset quality at any moment of time. It requires only that new loan officers be introduced to the system of loan ratings, through training and apprenticeship to achieve a standardization of ratings throughout the bank.
Given these standards, the bank can report the quality of its loan portfolio at any time, along the lines of the report presented in Table 2. Notice that total receivables, including loans, leases and commitments and derivatives, are reported in a single format. Assuming the adherence to standards, the entirety of the firm’s credit quality is reported to senior management monthly via this reporting mechanism. Changes in this report from one period to another occur for two reasons, viz., loans have entered or exited the system, or the rating of individual loans has changed over the intervening time interval. The first reason is associated with standard loan turnover. Loans are repaid and new loans are made. The second cause for a change in the credit quality report is more substantive. Variations over time indicate changes in loan quality and expected loan losses from the credit portfolio. In fact, credit quality reports should signal changes in expected loan losses, if the rating system is meaningful. Studies by Moody’s on their rating system have illustrated the relationship between credit rating and ex post default rates.9 A similar result should be expected from internal bank-rating schemes of this type as well. However, the lack of available industry data to do an appropriate aggregate migration study does not permit the industry the same degree of confidence in their expected loss calculations.
For this type of credit quality report to be meaningful, all credits must be monitored, and reviewed periodically. It is, in fact, standard for all credits above some dollar volume to be reviewed on a quarterly or annual basis to ensure the accuracy of the rating associated with the lending facility. In addition, a material change in the conditions associated either with the borrower or the facility itself, such as a change in the value of collateral, will trigger a re-evaluation. This process, therefore, results in a periodic but timely report card on the quality of the credit portfolio and its change from month to month.
Generally accepted accounting principles require this monitoring. The credit portfolio is subject to fair value accounting standards, which have recently been tightened by The Financial Accounting Standards Board (FASB). Commercial banks are required to have a loan loss reserve account (a contra-asset) which accurately represents the diminution in market value from known or estimated credit losses. As an industry, banks have generally sought estimates of expected loss using a two-step process, including default probability, and an estimate of loss given default. This approach parallels the work of Moody’s referred to above. At least quarterly, the level of the reserve account is re-assessed, given the evidence of loss exposure driven directly from the credit quality report, and internal studies of loan migration through various quality ratings. Absent from the discussion thus far is any analysis of systematic risk contained in the portfolio. Traditionally mutual funds and merchant banks have concerned themselves with such risk exposure, but the commercial banking sector has not. This appears to be changing in light of the recent substantial losses in real estate and similar losses in the not-too-distant past in petrochemicals. Accordingly, many banks are beginning to develop concentration reports, indicating industry composition of the loan portfolio. This process was initially hampered by the lack of a simple industry index. SIC codes were employed at some institutions, but most found them unsatisfactory. Recently, however, Moody’s has developed a system of 34 industry groups that may be used to report concentrations. Table 3 reports such an industry grouping to illustrate the kind of concentration reports that are emerging as standard in the banking industry. Notice that the report indicates the portfolio percentages by sector, as well as commitments to various industries. For the real estate portfolio, geography is also reported, as Table 4 suggests. While this may be insufficient to capture total geographic concentration, it is a beginning.
For the investment management community, concentrations are generally benchmarked against some market indexes, and mutual funds will generally report not only the absolute percentage of their industry concentration, but also their positions relative to the broad market indexes. Unfortunately, there is no comparable benchmark for the loan portfolio. Accordingly, firms must weigh the pros and cons of specialization and concentration by industry group and establish subjective limits on their overall exposure.
This is generally done with both guidelines and limits set by senior management. Such a report is not the result of any analytical exercise to evaluate the potential downside loss, but rather a subjective evaluation of management’s tolerance, based upon rather imprecise recollections of previous downturns. In addition, we are seeing the emergence of a portfolio manager to watch over the loan portfolio’s degree of concentration and exposure to both types of risk concentration discussed above.
Most organizations also will report concentration by individual counterparty. To be meaningful, however, this exposure must be bank wide and include all related affiliates. Both of these requirements are not easily satisfied. For large institutions, a key relationship manager must be appointed to assure that overall bank exposure to a particular client is captured and monitored. This level of data accumulation is never easy, particularly across time zones. Nonetheless, such a relationship report is required to capture the disparate activity from many parts of the bank. Transaction with affiliated firms needs to be aggregated and maintained in close to real time.
An example of this type of report is offered here as Table 5, drawn from one particular client report. Each different lending facility is reported. In addition, the existing lines of credit, both used and open, need to be reported as well. Generally, this type of credit risk exposure or concentration report has both an upper and lower cut-off value so that only concentrations above a minimum size are recorded, and no one credit exposure exceeds its predetermined limit. The latter, an example of the second technique of risk management is monitored and set by the credit committee for the relationship as a whole.
B. Interest Rate Risk Management Procedures
The area of interest rate risk is the second area of major concern and on-going risk monitoring and management. Here, however, the tradition has been for the banking industry to diverge somewhat from other parts of the financial sector in their treatment of interest rate risk. Most commercial banks make a clear distinction between their trading activity and their balance sheet interest rate exposure. Investment banks generally have viewed interest rate risk as a classic part of market risk, and have developed elaborate trading risk management systems to measure and monitor exposure. For large commercial banks and European-type universal banks that have an active trading business, such systems have become a required part of the infrastructure. But, in fact, these trading risk management systems vary substantially from bank to bank and generally are less real than imagined. In many firms, fancy value-at-risk models, now known by the acronym VaR, are up and running. But, in many more cases, they are still in the implementation phase. In the interim, simple ad hoc limits and close monitoring substitute for elaborate real time systems. While this may be completely satisfactory for institutions that have little trading activity and work primarily on behalf of clients, the absence of adequate trading systems elsewhere in the industry is a bit distressing.
For institutions that do have active trading businesses, value-at-risk has become the standard approach. This procedure has recently been publicly displayed with the release of Risk metrics by J. P. Morgan, but similar systems are in place at other firms. In that much exists in the public record about these systems12, there is little value to reviewing this technique here. Suffice it to say that the daily, weekly, or monthly volatility of the market value of fixed-rate assets are incorporated into a measure of total portfolio risk analysis along with equity’s market risk, and that of foreign-denominated assets.
For balance sheet exposure to interest rate risk, commercial banking firms follow a different drummer — or is it accountant? Given the generally accepted accounting procedures (GAAP) established for bank assets, as well as the close correspondence of asset and liability structures, commercial banks tend not to use market value reports, guidelines or limits. Rather, their approach relies on cash flow and book values, at the expense of market values. Asset cash flows are reported in various re pricing schedules along the line of Table 6. This system has been labeled traditionally a "gap reporting system", as the asymmetry of the re pricing of assets and liabilities results in a gap. This has classically been measured in ratio or percentage mismatch terms over a standardized interval such as a 30-day or one-year period.
This is sometimes supplemented with a duration analysis of the portfolio, as seen in Table 7. However, many assumptions are necessary to move from cash flows to duration. Asset categories that do not have fixed maturities, such as prime rate loans, must be assigned a duration measure based upon actual re pricing flexibility. A similar problem exists for core liabilities, such as retail demand and savings balances.
Nonetheless, the industry attempts to measure these estimates accurately, and include both on- and off-balance sheet exposures in this type of reporting procedure. The result of this exercise is a rather crude approximation of the duration gap.
Most banks, however, have attempted to move beyond this gap methodology. They recognize that the gap and duration reports are static, and do not fit well with the dynamic nature of the banking market, where assets and liabilities change over time and spreads fluctuate. In fact, the variability of spreads is largely responsible for the highly profitable performance of the industry over the last two years. Accordingly, the industry has added the next level of analysis to their balance sheet interest rate risk management procedures.
Currently, many banks are using balance sheet simulation models to investigate the effect of interest rate variation on reported earnings over one-, three- and five-year horizons. These simulations, of course, are a bit of science and a bit of art. They require relatively informed repricing schedules, as well as estimates of prepayments and cash flows. In terms of the first issue, such an analysis requires an assumed response function on the part of the bank to rate movement, in which bank pricing decisions in both their local and national franchises are simulated for each rate environment. In terms of the second area, the simulations require precise prepayment models for proprietary products, such as middle market loans, as well as standard products such as residential mortgages or traditional consumer debt. In addition, these simulations require yield curve simulation over a presumed relevant range of rate movements and yield curve shifts. Once completed, the simulation reports the resultant deviations in earnings associated with the rate scenarios considered. Whether or not this is acceptable depends upon the limits imposed by management, which are usually couched in terms of deviations of earnings from the expected or most likely outcome. This notion of Earnings at Risk is emerging as a common benchmark for interest rate risk. However, it is of limited value as it presumes that the range of rates considered is correct, and/or the bank’s response mechanism contained in the simulation is accurate and feasible. Nonetheless, the results are viewed as indicative of the effect of underlying interest rate mismatch contained in the balance sheet. Reports of these simulations, such as contained in Table 8, are now commonplace in the industry. Because of concerns over the potential earnings outcomes of the simulations, treasury officials often make use of the cash, futures and swap markets to reduce the implied earnings risk contained in the bank’s embedded rate exposure. However, as has become increasingly evident, such markets contain their own set of risks. Accordingly, every institution has an investment policy in place which defines the set of allowable assets and limits to the bank’s participation in any one area; see, for example, Table 9. All institutions restrict the activity of the treasury to some extent by defining the set of activities it can employ to change the bank’s interest rate position in both the cash and forward markets. Some are willing to accept derivative activity, but all restrict their positions in the swap caps and floors market to some degree to prevent unfortunate surprises.
As reported losses by some institutions mount in this area, however, investment guidelines are becoming increasingly circumspect concerning allowable investment and hedging alternatives.
C. Foreign Exchange Risk Management Procedures
In this area there is considerable difference in current practice. This can be explained by the different franchises that coexist in the banking industry. Most banking institutions view activity in the foreign exchange market beyond their franchise, while others are active participants. The former will take virtually no principal risk, no forward open positions, and have no expectations of trading volume. Within the latter group, there is a clear distinction between those that restrict themselves to acting as agents for corporate and/or retail clients and those that have active trading positions.
The most active banks in this area have large trading accounts and multiple trading locations. And, for these, reporting is rather straightforward. Currencies are kept in real time, with spot and forward positions marked-to-market. As is well known, however, reporting positions is easier than measuring and limiting risk. Here, the latter is more common than the former. Limits are set by desk and by individual trader, with monitoring occurring in real time by some banks, and daily closing at other institutions. As a general characterization, those banks with more active trading positions tend to have invested in the real-time VaR systems discussed above, but there are exceptions.
Limits are the key elements of the risk management systems in foreign exchange trading as they are for all trading businesses. As Table 10 illustrates by example, it is fairly standard for limits to be set by currency for both the spot and forward positions in the set of trading currencies. At many institutions, the derivation of exposure limits has tended to be an imprecise and inexact science. For these institutions, risk limits are set currency-by-currency by subjective variance tolerance. Others, however, do attempt to derive the limits using a method that is analytically similar to the approach used in the area of interest rate risk.
Even for banks without a VaR system in place, stress tests are done to evaluate the potential loss associated with changes in the exchange rate. This is done for small deviations in exchange rates as shown in Table 10, but it also may be investigated for historical maximum movements. The latter is investigated in two ways. Either historical events are captured, and worse-case scenario simulated, or the historical events are used to estimate a distribution from which the disturbances are drawn. In the latter case, a one or two standard deviation change in the exchange rate is considered. While some use these methods to estimate volatility, until recently most did not use covariability in setting individual currency limits, or in the aggregating exposure across multiple correlated currencies.
Incentive systems for foreign exchange traders are another area of significant differences between the average commercial bank and its investment banking counterpart. While, in the investment banking community trader performance is directly linked to compensation, this is less true in the banking industry. While some admit to significant correlation between trader income and trading profits, many argue that there is absolutely none. This latter group tends to see such linkages leading to excess risk taking by traders who gain from successes but do not suffer from losses. Accordingly, to their way of thinking, risk is reduced by separating foreign exchange profitability and trader compensation.
D. Liquidity Risk Management Procedures
Two different notions of liquidity risk have evolved in the banking sector. Each has some validity. The first, and the easiest in most regards, is a notion of liquidity risk as a need for continued funding. The counterpart of standard cash management, this liquidity need is forecastable and easily analyzed. Yet, the result is not worth much. In today’s capital market banks of the sort considered here have ample resources for growth and recourse to additional liabilities for unexpectedly high asset growth. Accordingly, attempts to analyze liquidity risk as a need for resources to facilitate growth, or honor outstanding credit lines are of little relevance to the risk management agenda pursued here.
The liquidity risk that does present a real challenge is the need for funding when and if a sudden crisis arises. In this case, the issues are very different from those addressed above. Standard reports on liquid assets and open lines of credit, which are germane to the first type of liquidity need, are substantially less relevant to the second. Rather, what is required is an analysis of funding demands under a series of "worst case" scenarios. These include the liquidity needs associated with a bank-specific shock, such as a severe loss, and a crisis that is system-wide. In each case, the bank examines the extent to which it can be self-supporting in the event of a crisis, and tries to estimate the speed with which the shock will result in a funding crisis.
Reports center on both features of the crisis with Table 11 illustrating one bank’s attempt to estimate the immediate funding shortfall associated with a downgrade. Other institutions attempt to measure the speed with which assets can be liquidated to respond to the situation using a report that indicates the speed with which the bank can acquire needed liquidity in a crisis. Response strategies considered include the extent to which the bank can accomplish substantial balance sheet shrinkage and estimates are made of the sources of funds that will remain available to the institution in a time of crisis. Results of such simulated crises are usually expressed in days of exposure, or days to funding crisis.
Such studies are, by their nature, imprecise but essential to efficient operation in the event of a substantial change in the financial conditions of the firm. As a result, regulatory authorities have increasingly mandated that a liquidity risk plan be developed by members of the industry. Yet, there is a clear distinction among institutions, as to the value of this type of exercise. Some attempt to develop careful funding plans and estimate their vulnerability to the crisis with considerable precision. They contend that, either from prior experience or attempts at verification, they could and would use the proposed plan in a time of crisis. Others view this planning document as little more than a regulatory hurdle. While some actually invest in backup lines without "material adverse conditions" clauses, others have little faith in their ability to access them in a time of need.
E. Other Risks Considered But Not Modeled
Beyond the basic four financial risks, viz., credit, interest rate, foreign exchange and liquidity risk, banks have a host of other concerns as was indicated above. Some of these, like operating risk, and/or system failure, are a natural outgrowth of their business and banks employ standard risk avoidance techniques to mitigate them. Standard business judgment is used in this area to measure the costs and benefits of both risk reduction expenditures and system design, as well as operational redundancy. While generally referred to as risk management, this activity is substantially different from the management of financial risk addressed here.
Yet, there are still other risks, somewhat more amorphous, but no less important. In this latter category are legal, regulatory, suitability, reputational and environmental risk. In each of these risk areas, substantial time and resources are devoted to protecting the firm’s franchise value from erosion. As these risks are less financially measurable, they are generally not addressed in any formal, structured way. Yet, they are not ignored at the senior management level of the bank.