Banks urged to grasp risk management

Despite the continued fall-out from the financial crisis across the banking industry, it appears that not enough institutions are planning to make fundamental changes to their risk frameworks, according to a survey.

The results show that 90 % of the 400 banking execs surveyed by the Economist Intelligence Unit on behalf of KPMG have carried out — or plan to carry out — a review of the way they manage risk. Yet only 42 % of respondents have made — or plan to make — fundamental changes to their risk processes.

This hints at a feeling amongst many banks that the required medicine may not be as severe as some might think — or that the full extent of the fall-out is yet to be realized.

Commenting on the results, Nigel Harman of KPMG advisory said: ‘What we have is a fairly non-committal response, with just over four out of ten respondents committing their organisation to the sort of fundamental changes which a crisis of this magnitude merits.’

‘A key part of the healing process will be to overhaul the whole framework for managing risk; not just to focus on isolated issues. Without that complete overhaul, the risk remains of this happening all over again.’

The KPMG research highlights several areas in which changes will need to be made — the lack of risk expertise at Board level; communication between the risk function and the rest of the business; and the relative lack of influence exerted by the risk function.

Seventy-six percent of respondents believe that risk is still stigmatised as nothing more than a support function. However, seven out of ten believe that the function holds more influence than two years ago while even more believe the way they manage risk to be a source of competitive advantage.

Chief Risk Officers are now believed by many respondents to be exerting greater authority over the key areas of strategy development and capital allocation.

Few respondents felt that a lack of risk expertise at Board level was a serious contributory factor behind the banks’ travails.

Less than 20 % believed a lack of communication across organisational silos to be an important contributory factor. But findings did reveal problems in communicating risk policies through to an operational level.

Harman continued: ‘What this research helps to show is that banks should be instilling a robust culture which can address risk governance at all levels. Such a culture effectively requires employees to become risk managers but such a change also requires employees to understand the organization’s risk appetite. The modern structure for managing risk should be based on three lines of defense; the business unit people ‘on the ground’, the risk management function and then internal audit. For an appropriate culture to come into being, senior management should provide a strong tone from the top.’

He added: ‘It was poor judgment which brought this crisis upon us — with an apparently excessive focus on short-term gain and a lack of healthy scepticism.’