‘It’s time to take notice when risk management is turning into process over purpose’

 As austerity replaces indulgence across Europe, mis-selling scandals rumble on. The most recent scandal came out in April, when it was announced that the UK energy supplier SSE was being fined £10.5m (€12.3m) for “failing to prevent sharp-selling practices by its selling agents”. The regulator for the energy industry, Ofgem, said that its findings “show SSE failed its customers, mis-sold to them and undermined trust in the energy supply industry”.

In Spain, state-owned Bankia is becoming accustomed to angry pensioners storming its branches. In January, 30 of them charged into a Madrid branch, shouting “thieves, thieves”, furious that hybrid products they claim to have been sold as safe investments had been wiped out as part of the Spanish bailout.

Meanwhile, the owners of small businesses are up in arms at having been sold complicated financial derivatives in the boom years, without, they claim, the risks and the breakage costs having been properly explained. In January, the owners of Belgard retail park in Dublin sued Ulster Bank over €54m of allegedly mis-sold interest rate swaps. However, this pales in comparison to the claims made by Italian municipal authorities against banks they claim to have mis-sold hedging instruments. In December 2012, after extensive litigation known as “the Milan derivatives inquisition”, an Italian court found four banks guilty of aggravated fraud for mis-selling financial products to the city authorities. The decision is under appeal, but if it fails, the floodgates may open.

Finally, at the end of one of the interminable investigations into the collapse of two of the largest British banks, the UK Parliamentary Commission on Banking Standards has produced a humdinger of a report. One extract says it all: “The corporate governance of HBOS at board level serves as a model for the future, but not in the way in which Lord Stevenson and other former board members appear to see it. It represents a model of self-delusion, of the triumph of process over purpose.”

It is worth considering that last phrase for a moment. Much of the mis-selling that is now being challenged took place at the tail end of the boom years. In a benign economic environment, it is all too easy to be frustrated by the constraints of risk controls and the vagaries of regulators, forgetting that risk management and good corporate governance has a wider purpose than going through the motions of compliance.

Whenever compliance comes to seem wearying and unnecessary, it is time to sit up and take notice. For that suggests that risk management is becoming process, not purpose.

This, in itself, poses considerable risk, as we are now witnessing. The falling tide has exposed all too many large corporate institutions that were swimming naked, and the cost to their reputation is greater than the cost to their balance sheet. In the wake of the unwelcome exposure, regulators will behave as regulators, and impose further constraints in an (no doubt fruitless) effort to ensure such things do not happen again. In turn, that will lead to yet more compliance fatigue.

The purpose of risk management is to seek an ideal balance between opportunity and risk. In the rush to snap up opportunities, that balance can be skewed out of proportion and the higher purpose of risk management forgotten. It becomes a semi-mechanical process, sharp practice creeps in, the board becomes complacent and deluded, time passes and disaster ensues.