Professional Documents
Culture Documents
THE FUTURE OF
RISK MANAGEMENT
TEN YEARS AFTER THE CRISIS
AUTHORS
Thomas Garside, Partner
Jonathan Mitchell, Engagement Manager
During the dog-days of August, a FTSE 100 financial institution, established more than
100 years ago and based in the North of England, suddenly announces a dramatic collapse
in their financial position, and blue-chip investors are left nursing major losses. However it’s
not 2007, it’s now 2017. Ten years on from the start of the Northern Rock crisis, it seems a
reasonable time to ask “so what has changed”?
The last ten years have seen a radical overhaul of risk management at UK banks.
The Northern Rock failure alone would no doubt have prompted big changes. But the
subsequent cascade of events drove massive government and regulatory intervention.
Over the last 10 years, the risk functions of banks have been dominated by the work required
to comply with an avalanche of new regulation.
UK banks have, for the most part, satisfied the new regulatory demands. As a result, they are
much better capitalised than they were in 2007 and with better liquidity and funding ratios.
Despite the risks arising from Brexit and the unwinding of quantitative easing, another crisis
ten years after the last one began seems unlikely.
The next ten years in risk functions will thus be quite unlike the last. The drivers of change
will not be financial recovery and regulatory compliance, but technology-driven changes
to banks’ business models and to the machinery of risk management. Ultimately, the
transformation brought on by these developments could be greater than the cumulative
changes of the last ten years.
Having sketched the story of the last 10 years, and the current state of play in risk
management functions, this report describes the developments that are likely over the
coming years and what CROs can be doing to prepare for them.
In just over twelve months, more than a dozen major financial institutions had been
rescued on both sides of the Atlantic, structured investment vehicles (SIVs) controlling over
$400 billion of assets had closed, and the first phase of the crisis culminated in the collapse
of Lehman Brothers on the 14th September 2008.
The last quarter of 2008 and the first of 2009 were the darkest days of the banking crisis.
Nearly all major banks in Europe and North America came under sustained pressure.
Morgan Stanley and Goldman Sachs were the only major institutions whose credit default
swap (CDS) spreads exceeded 400bps to survive bankruptcy or government recapitalisation.
14 SEP 2007
Northern Rock granted
emergency funding by 6 OCT 2008
Bank of England Hypo Real Estate bailed-out by Germany for €50 BN
13 OCT 2008
British Govt. £37 BN rescue
6 DEC 2007 17 MAR 2008
plan for RBS, Lloyds and HBOS
Cut to UK Bear Sterns rescued
interest rates by JP Morgan 21 OCT 2008
400 Germany rescues IKB
mortgage bank for €9 BN
29 SEP 2008
Nationalisation of
Bradford & Bingley;
Fortis partially
nationalised
200
18 SEP 2008 30 SEP 2008 16 Oct 2008 5 MAR 2009 2 APR 2009
Central banks inject Dexia receives UBS £3 BN Bank of England begins £75 BN G20 agrees $5 TN
billions of pounds €6.4 BN state state injection round of Quantitative Easing financial stimulus package
worth of liquidity injection
0
J F M A M J J A S O N D J F M A M J J A S O N D J F M A M J J A S O N D
Source: Datastream
Bank regulation at the time helped to shape the crisis (see Exhibit 2), if only through the “law
of unintended consequences”. Whereas banks in Europe were subject to a brake on risk via
Basel II and Risk Weighted Assets (RWAs), in the United States, where Basel II had not yet
been implemented, banks were instead subject to a brake on their leverage ratio. Thus it
can be broadly argued that failing European banks blew themselves up with leverage, while
failing US banks blew themselves up with risky assets, the most vulnerable being banks
dependent on large quantities of short-term wholesale funding.
100%
8.1% 8.3%
80%
US
5.9%
60%
Estimated impact
of IFRS “gross-up”
3.8%
40%
3.1%
0%
UK Euro US UK Euro US 2000 2001 2002 2003 2004 2005 2006 2007
area area
What had begun as a perceived issue with US sub-prime loans and structured products
now presented itself as a systemic crisis affecting entire economies. The resulting massive
government interventions were successful in largely stabilising the banking sector problem,
but at the cost of transferring large amounts of debt onto public balance sheets. The stage
was then set for the second phase of the crisis, the European sovereign debt crisis, the exit
from which is still a “work in progress”.
The weaknesses in the financial system and its regulation highlighted by the crisis shaped
the subsequent regulatory response. In addition to strengthening balance sheet ratios,
legislators and supervisory agencies also turned their attention to issues such as “too big
to fail”, the separation of trading and banking activities, the moral hazard implicit in pure
originate-to-distribute models, asset valuation under stressed market conditions, and the
credibility of risk models and RWA calculations (see Exhibit 3). But the ensuing deluge of
regulation and litigation has not been restricted to bank solvency and systemic stability.
A perception of widespread misconduct in banking has resulted in new regulations covering
sales conduct, market conduct (for example, LIBOR), conflicts of interest (for example,
equity research), financial crime and counter terror financing.
Since 2007 banks’ balance sheets and funding strategies have changed dramatically, with
higher (equity) capital ratios and more stable debt funding (see Exhibit 4). Over this period,
the influence of banks’ risk organisations has grown enormously as they have reshaped
themselves, going beyond the management of traditional financial risks to also work on
strengthening risk culture, controls and conduct.
BCBS239
Revised LCR
2,000 EMIR/OTC
Basel 2.5 Dodd-Frank Basel 3
0
Jan Apr Jul Oct Jan Apr Jul Oct Jan Apr Jul Oct Jan Apr Jul Oct Jan Apr Jul Oct Jan Apr Jul Oct Jan Apr Jul Oct Jan Apr Jul Oct Jan Apr Jul Oct
2008 2009 2010 2011 2012 2013 2014 2015 2016
Exhibit 4: CET1 RATIO AND WHOLESALE FUNDING MIX FOR UK BANKS 2007–20161,2
PERCENTAGE NON-WHOLESALE FUNDING
90
Royal Bank of Scotland
HSBC Bank Nationwide
Lloyds Banking Group Building Society
80
70
Standard Chartered
Barclays
Lloyds Bank Plc
60 Bubble size
=
Total RWA
50 HBOS
2007 2016
40
3% 6% 9% 12% 15% 18% 21% 24%
CET1 RATIO
1. Non-wholesale funding % = (Total liabilities – wholesale funding) / Total liabilities, where wholesale funding includes financial liabilities and repurchase agreements,
excludes derivatives and customer deposits
200
100
Private balance
sheets
Public balance
0 sheets
2007 2008 2009 2010 2011 2012 2013 2014 2015 2016
75
1981
50
1991
2001–02
25
2011–12
0 2015–16
16–24 25–34 35–44 45–64 65–74 75+
The dominating economic issue in the UK is Brexit. Executed badly, the credit quality of UK
businesses and households will deteriorate. At present, however, markets are not pricing
a risk premium into tradable UK corporate debt. The immediate credit-related concern in
the UK is consumer lending (see Exhibit 8). The BoE Financial Stability Report (June 2017)
and subsequent publications by both the PRA and FCA express concerns about lending
standards and future affordability for borrowers. There is also growing market interest in
what IFRS9 will mean for banks’ reported results, again most notably for consumer credit,
and in its sensitivity to economic deterioration – in both published accounts and in the
results of future regulatory stress tests.
The other obvious source of concern is the effect higher interest rates will have when,
eventually, the BoE lifts them. Low rates have encouraged leverage and inflated the value
of long-term assets. However, given the uncertainties created by Brexit and the consistent
approach of Mark Carney and the MPC, the likelihood of material rate rises anytime soon
must be judged as low.
And, even if credit conditions deteriorate, the much improved capital ratios and debt
funding maturities of UK banks make a repeat of the financial crisis unlikely. This conclusion
is supported by the Bank of England and EBA stress tests, in which UK banks remain viable
under scenarios similar to those of 2008–9 in combination with another round of heavy
misconduct fines.
500%
400%
Greece (36%)
Indexed to
2010 = 100% Countries
300% with remaining
NPL problem
and no clear
Portugal (13%1) downward trend
200%
Italy (17%)
0%
2007 2008 2009 2010 2011 2012 2013 2014 2015 2016
Source: IMF Global Financial Stability Report, ECB, Oliver Wyman analysis
1. 2016 figures as presented in the IMF Global Financial Stability Report; Portugal and Ireland data is for 2016Q3
Consumer lending
(2016 growth in debt = 6%)
100
Mortgage lending
50 (2016 growth in debt = 4%)
0
2000 2002 2004 2006 2008 2010 2012 2014 2016
First, banks continue to operate in very uncertain political and social environments, with
almost no tolerance for further real or perceived misconduct. Second, the competitive
landscape, including both incumbent and disruptive players, will evolve rapidly over the
next five years and this will require a rethinking of many traditional risk management
approaches. Third, investors will ratchet up pressure on banks to consistently meet their cost
of equity and, in addition to constraining losses, risk management is an important part of
both cost containment and revenue growth.
In this context, we think six items should be near the top of a CRO’s current agenda:
New risks are not limited to cyber. They can arise out of economic trends, geo-politics,
clients and counterparties, markets and competitors, legislation and regulatory activity,
internal processes and employees, and outsourcing. Properly assessing them requires a
rigorous framework and a management process which ultimately engages the Board. We see
banks increasingly looking to other industries – for example, airlines, pharmaceuticals, the
military – to learn how they continually seek to identify and manage new and critical risks.
Success will require risk functions to attract and retain talent that will be competed for both
internally and externally across a range of industries. We consistently find that senior risk
professionals put talent management and influencing skills at the top of their leadership
development requirements.
This is another area where risk and finance teams need to engage in a strategic dialogue with
other areas of the firm, for example, concerning the bank’s API strategies.
3. Data
4. Applications (software)
5. Infrastructure (hardware)
EMEA
+44 20 7333 8333
AMERICAS
+1 212 541 8100
ASIA PACIFIC
+65 6510 9700
www.oliverwyman.com