Rekindling Risk Management at Banks and Fintechs

Recent bank failures have thrown a spotlight on Risk Management at Banks – undoubtedly, the role of managing risk is vital but seldom understood well. In this article, I share my beliefs about how risk leaders can effectively influence the development of sustainable strategies at banks and fintechs.

While it may sound trite to say that "banks are in the business of managing risk", the truth is that banks are well aware that they will encounter unexpected losses. Their job is to earn appropriate returns for taking that risk, and to preserve capital and liquidity under scenarios where key drivers such as interest margins and credit losses are worse than anticipated. Managing risk – by analyzing unique drivers of business, going beyond the limitations of generic frameworks, and catalyzing candid conversations – is about co-creating strategies, products and services such that they can generate sustainable rewards over a period of ups and downs.

Thinking about what matters uniquely to their business

To achieve robust returns through an economic cycle, a risk manager needs to acutely understand the business context. They need to think hard about what could go wrong or what might be implicit in their assumptions. The purpose is not to create the longest possible list of concerns, but to identify those risk factors that are central to their business.?

The broad categories of risks (e.g. credit, interest rate, liquidity, etc.) are well known, but bottom-up analysis aided by experimentation has far more specificity and impact. In particular, thinking probabilistically about upsides and downsides is crucial, as it can help better assess situations where small gains exist in a happy path but catastrophic challenges loom in other scenarios.

For instance, an institution with a mix of unsecured loans, auto loans, and investments in long-term Treasury bonds and mortgage-backed securities can use their own data on consumer price elasticity, used car prices, and the impact of changes in the unemployment rate to understand a wide range of potential economic outcomes. By combining this analysis with possible interest rate paths, such an evaluation can identify asymmetric favorable and unfavorable consequences for certain strategies, resulting in a robust plan of action suitable for the institution's needs.

Avoiding the tyranny of frameworks

CCAR and DFAST stress tests, ERM taxonomy, Three Lines of Defense, COSO framework, and similar such methodologies have their purposes. But frameworks, by their nature, are not customized. So, when risk management processes evolve to primarily serve these frameworks rather than thoroughly evaluate unique risks, there is every chance that specific risks and mitigating actions do not get proper attention.?

Risk management should not be limited to fulfilling the requirements of these frameworks. Risk management should not just be about collating information from different parts of the organization to come up with a “top of the house” view. Risk management should also not be confined to oversight and governance. Risk management needs to be a foundational, analytical problem solving function, first and foremost. A data driven, empirically grounded approach to determining which risks to take on is a messy, iterative process. But parsing through those nuances in what risk management is all about.

Risk conversations often get sidetracked by issues such as where in the organization should the Risk function be placed, who represents risk related matters to the board committees, which forums should “Red” issues be discussed at. Those topics are not insignificant, but it is critical that matters of strategic leverage do not get crowded out in the process.

Communicating with credibility

When it comes to communicating and influencing effectively, risk leaders have an unenviable job. Nonetheless, it is indispensable. When risk leaders are confronted with a decision to make a recommendation to, say, not pursue a new product expansion or an acquisition (especially in a seemingly benign macroenvironment when practically everyone else is raring to go), it can be a really tough call. Not only do they have to rely on the conviction of their analysis and judgment, but also convey their thoughts with candor and courage.

It is a part of the job to challenge the natural orientation of decision making at critical junctures when risk adjusted returns are potentially insufficient. How one does that with a resolute yet empathetic demeanor is probably the most important aspect of what defines a strong risk leader. Cultivating trust and credibility takes work everyday, obviously isn’t something that can happen instantaneously during times of crisis. Different leaders follow different approaches for developing that reputation, but what’s clear is that a risk manager will be unable to influence their colleagues and their CEO in absence of a trusted relationship.

My hope is that risk managers at banks and fintechs assert the pivotal role they need to play by fostering a culture of thoughtful, relevant analysis; focusing strategic choices on probabilistic evaluation of outcomes rather than formulaic recommendations; and facilitating sincere, frank conversations about differentiated actions and bold new tests of products and services.