Post on 08-Apr-2018
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
1/48
Recover, adapt, advanceBack to business in an uncertain world
A survey of the worlds largest banks
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
2/48
1 Executive summary
4 Top challenges
16 Rethinking risk strategies
24 Risk appetite: the Ernst & Young perspective
28 Realigning roles, responsibilities and rewards
34 Recalibrating risk processes
41 Costs and budgeting
44 Final thoughts
Contents
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
3/48
1
The title of our 2010 annual survey on risk governance, Recover, adapt, advance: back
to business in an uncertain world, aptly reects the current mindset of this years
survey participants.
The good news is that most of the executives we spoke with believe that recovery is
underway. No one, however, is optimistic that this recovery will be quick or easy. In fact,
many are bracing for another dip in the form of commercial real estate defaults and
anticipating that another wave of bank closures may follow. Executives, particulary in the
West, are picking up the pieces and are working diligently to clean up the distressed assets
and debt on their balance sheets. As one respondent told us, Its been an exhausting and
debilitating 12 months.
But all agree the challenges are far from over. While the worst of the downturn seems to
be behind us, the global markets are far from stable. Although the economy is showing
signs of recovery in most parts of the world, unemployment remains stubbornly high.
Worldwide, consumer trust and condence in governments in general and in the nancial
industry in particular are at an all-time low. Politicians and regulators are rallying to
tighten controls signicantly, and executives are preparing for an onslaught of new
restrictions that have the potential to affect some very fundamental aspects of the way
they run their rms.
Recovering and adapting would seem to be more than a full-time job for senior management;
however, as one executive told us, Uncertainty aside, we still have a business to run.
Around the globe, banks reported that they are buckling down and getting back to the
day-to-day tasks. Most have adopted a back-to-basics philosophy exiting products and
markets that overextended their capabilities and diluted capital, and returning to their core
businesses. Not surprisingly, attitudes in general are cautious and risk averse.
As the dust settles, boards and senior management are taking the time to reect
strategically on the big picture clarifying growth objectives, basic business models, andorganizational philosophy and culture. They are extremely cognizant of the glaring lessons
of the crisis: the vital importance of managing for liquidity; the need to strengthen and
institutionalize an appropriate risk culture; and the imperative to always be prepared for
the unexpected. As a result, many have enhanced capital planning and tightened controls,
policies and procedures; elevated and strengthened risk governance; and upgraded
forecasting, reporting and assessment capabilities.
Many executives are hopeful that the lessons of the downturn will drive positive and
lasting change in the industry. As one respondent told us, I think memories will be a
little longer this time than perhaps they were in the past. Despite the preponderance of
issues still facing the industry, we came away with a growing feeling of hope about the
possibilities ahead.
Executive summary
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
4/48
22
Key observationsPreparing for the new regulatory realities. In response to the pending regulatory
requirements, particularly the potential restrictions on capital, banks are underway with a
variety of initiatives raising capital and liquidity levels, assessing the impact of proposed
regulations on business strategies, and addressing risk management weaknesses exposed by
increased supervisory expectations to prepare for the anticipated changes.
Rethinking risk strategies. Respondents unanimously agreed that risk governance
must remain a top priority on senior management agendas. In an effort to build a more
comprehensive, consistent and collaborative approach to risk, boards and senior teams are
starting at the top by dening, articulating and enforcing an organizational risk appetite and
working to cascade it throughout the business.
Realigning roles, responsibilities and rewards. Survey respondents consistently expressed
the view that companies underestimated the vital importance of the human factor in
managing risk. To institute and reinforce a strong risk culture, risk must become everyones
business, from boards to front-line decision-makers. As a result, banks are redening roles
and responsibilities for risk management throughout the enterprise strengthening board
oversight duties and signicantly elevating the CROs stature and organizational inuence.
This is the third in a series of proprietary surveys on evolving risk management at global
banking and capital markets institutions conducted by Ernst & Young since 2007. The
goal is to identify key challenges organizations are facing around risk management
and control, and to assess the state of risk management in a turbulent environment.
Ernst & Young again commissioned Broderick & Company, an independent market
strategy rm, to conduct in-depth, qualitatively rich interviews with senior executives
in global banking and capital markets institutions. From October 2009 through
January 2010, Broderick interviewed 39 senior executives from 30 major banking
institutions around the world. The interviewees included a mix of senior executives in
each organization. Among them were: chief nancial ofcers and chief risk ofcers, as
well as heads of functional divisions such as operational risk, market risk, credit risk,
internal audit and compliance.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
5/48
33
Recalibrating risk procedures. Across the banking industry,
initiatives are underway to achieve a more holistic, integrated
approach to identifying high-impact risks and factoring them into
decision-making. Better, faster and more transparent reporting
and more sophisticated, forward-looking forecasting capabilities
are viewed by respondents as two critical success factors in
enterprise-wide risk management.
Streamlining technology. Leveraging technology to more
effectively support risk management remains a work in progress
for most banks. While executives seem to have a clear vision
for how technology can be deployed to better support riskmanagement, they reported ongoing challenges in implementing
effective technology platforms. As a result, technology remains a
major area of investment.
Coping with rising costs. More than 80% of respondents across
regions are bracing for signicant increases in costs. Heightened
regulatory requirements and workout expenses in the aftermath
of the meltdown are predicted to drive costs up for at least the
next 12 to 24 months.
North America Europe Asia-Pacic
American Express
Bank of America
CIBC
Citigroup
Fannie Mae
Goldman Sachs
Northern Trust
PNC
State Street Bank
TD Bank
Banco Santander
Barclays
Credit Suisse
HSBC
Intesa Sanpaolo
ING
Lloyds Banking Group
Nordea
SEB
Socit Gnrale
Swedbank
VTB Bank
ANZ
Bank of China
Bank of Tokyo-Mitsubishi UFJ
ICBC
Macquarie Group
National Australia Bank
Sumitomo Trust & Banking Co. Ltd.
Westpac
Participating
institutions
included:
I think any nancial
institution that says
they havent had lessons
learned is not being
honest. I hope to never
see anything like this
again in my career. Its
not over. Were still on
the carousel.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
6/48
Top
challenges
4
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
7/48
5
When respondents were asked to identify the top two risk management and control challengesfacing their organizations, ve themes quickly surfaced and reverberated throughout our
discussions. Taken together, they form an image of an industry striving to regain its footing in
a still-uid economic and regulatory landscape.
The overwhelming top-of-mind issue cited by 72% of respondents is regulatory uncertainty.
New regulations are expected to impose restrictions on capital, liquidity, risk management and
compensation practices, but how strict they will be and how soon they will take effect remains to be
seen. Anticipating and addressing the potential impact of these new rulings on their organizations is
a time-consuming and often frustrating task for company leaders.
Still focused on the regulatory theme, more than 40% of respondents are grappling with the
business implications of the pending new requirements for capital and liquidity levels, placing it
second on the list of top concerns. More than one-third (38%) of survey interviewees say they are
working hard to upgrade their risk governance policies and procedures with the goal of instillinga risk awareness culture throughout their organizations. Worries that the economy will stagnate,
or worse, dip back into recession, were cited by 36% as a continuing challenge. And nally, in the
aftermath of the crisis, 28% of the executives surveyed are dealing with the tough task of removing
distressed assets and debt from their balance sheets (See Exhibit 1).
Five challenges dominatesenior management agendas
Executives are grappling with regulatory and economic uncertainty
72%Dealing with regulatory uncertainty
41%
Anticipating new capital requirements
38%Shifting the risk culture
36%Navigating the fluid economy
28%Repairing the balance sheets
Exhibit 1: Top challenges facing senior management
Dealing with regulatory
uncertainty is the
top concern
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
8/48
6
Challenge 1
Many different regulatory
changes are being oated
around. But when theyre going
to be brought in, and whether
theyre going to be brought in
on a uniform, global basis is
difcult to assess.
Dealing with regulatory uncertainty
41%
Anticipating new capital requirements
38%
Evolving the risk culture
36%
Navigating the fluid economy
28%
Repairing the balance sheet
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
9/48
7
72%
Multiple regulatory proposals complicate planning as banks
anticipate systemic reform
The rapidly changing regulatory landscape was cited by the majority of respondents as thetop challenge their organizations face around risk management and control. As regulators
and legislators around the world tighten regulatory oversight in response to the nancial
crisis, banks are preparing for what one executive called draconian regulations that have
the potential to affect some very fundamental aspects of the way they run their business.
Financial institutions are, of course, accustomed to dealing with a host of regulations
across all of the jurisdictions in which they operate, but the heightened political scrutiny
and the rush to respond in the wake of the nancial crisis are creating a complex and
sometimes contradictory web of proposals from regulators around the world. Banks are
struggling to navigate through the multiple pieces of legislation from multiple regulators
to determine the impact on their global operations. As one executive summed it up, You
have the G20 coming up with things; you have the Europeans coming up with things;
you have the British coming up with things; and all not necessarily coordinated and notnecessarily all saying the same thing. Its exceedingly difcult.
Plotting a course through this landscape is extremely challenging and intensely time
consuming for internal teams. Banks are diverting a huge amount of senior time to
meet and work with regulators, redeploying teams of people to deal with the growing
documentation requirements and investing in new systems and processes to stay a step
ahead of anticipated changes.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
10/48
8
Challenge 2
If you change the amount of
capital and liquidity required,
there will be big consequences
as to what is an appropriate
and viable business model.
The cost of funding and the cost
of capital mean that there are
certain types of lending and
other activities we probably
wont do.
Dealing with regulatory uncertainty
41%Anticipating new capital requirements
38%
Evolving the risk culture
36%
Navigating the fluid economy
28%
Repairing the balance sheet
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
11/48
9
72%
9
Stricter regulatory proposals are driving banks to reallocate
capital, rebalance portfolios and rethink market strategies
Of the array of regulatory changes under consideration, the expected increase incapital and liquidity requirements represents the most formidable challenge to many
institutions. While many respondents claim they have historically taken a conservative
approach to allocating capital, 50% did indicate that they are in the process of adjusting
their approaches to capital allocation across their business units (See Exhibit 2).
Many banks have raised their capital levels and ratios above the minimums in
anticipation of the new requirements. But the way it will all sort out from a regulatory
standpoint and the ultimate impact on the business decisions of boards and senior
management are still unclear. Some companies are striving to align economic capital
with regulatory capital models to make certain that regulatory requirements are
adequately captured or, as one respondent explained, We are trying to switch our
organizational mindset from economic to regulatory capital.
Even banks that are not changing their capital allocation process acknowledge theyare enhancing governance policies and procedures around capital management:
augmenting reporting requirements, particularly to the board and senior management;
strengthening their forecasting methodologies using scenario planning and stress
tests to evaluate impacts on capital positions; and formalizing and documenting capital
contingency plans.
Many institutions are seriously re-evaluating their portfolios exiting more
capital-intensive, less-protable lines of business and geographies, and shifting
out of more complex, less-liquid instruments into simpler, more-liquid products
with less risk and, of course, less return. Executives worry that the impact
of these decisions could potentially restrain lending and ultimately
slow economic growth and recovery.
Exhibit 2: Changes in approach to capital allocation
Half have changed
their approach to
capital allocation
50%
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
12/48
10
Challenge 3
Working through the crisis,
we gained insights into
how to strengthen our risk
management and control. It
allowed us to shore up our
weaknesses and further develop
the risk management team.
Dealing with regulatory uncertainty
41%
Anticipating new capital requirements
36%
Navigating the fluid economy
28%
Repairing the balance sheet
38%Shifting the risk culture
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
13/48
11
72%
Banks are strengthening their risk culture and governance
processes with greater senior management involvement
and reinvigorated risk procedures
In the Ernst & Young 2009 study conducted at the height of the crisis senior
executives listed shifting the risk culture as their second most important initiative
to tackle once the short-term reghting and damage assessment were over. One
year later, shifting the culture is still very much top of mind for senior executives.
The good news is that the aspiration is slowly becoming a reality. Banks have
undertaken a host of initiatives to institutionalize comprehensive, consistent and
collaborative approaches to risk. Effective risk governance has risen to the top
as a core business imperative, and organizations are mobilizing to identify and
address deciencies. Boards and senior management are now fully engaged in
the risk process, determining and articulating the organizational risk appetite and
parameters; strengthening and clarifying governance policies and procedures; and
clearly establishing risk responsibilities and accountability across all levels of theorganization from board members to front-line managers. The power and inuence
of the risk team have been signicantly elevated, and in several institutions, the
CRO has a dual-reporting relationship to both the CEO and the board as well as a
strong voice in strategic decision-making.
The changes required to institutionalize a strong risk culture are fundamental and
far-reaching. For many banks, making risk everyones business represents a
signicant shift in mindset, policies, systems and processes. As one executive told us,
It is an enormous, multiyear march to accomplish.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
14/48
12
Challenge 4
If I add it all up, the uncertainty
in the environment and how you
manage for that strategically
and in the day-to-day are my
biggest concerns.
Dealing with regulatory uncertainty
41%
Anticipating new capital requirements
38%
Evolving the risk culture
36%Navigating the fluid economy
28%
Repairing the balance sheet
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
15/48
13
72%
Uncertainty about the economy poses a challenge to
long-term and short-term planning
While a few survey respondents used the terms recovery and claimed the worst isbehind us, the optimists were outweighed by the more cautious executives who remain
concerned about the depth of the recession and the pace of economic upturn. But,
regardless of their viewpoint, all agreed the uncertain market environment is making
business planning and decision-making both short- and longer-term extremely difcult.
There is no doubt that serious challenges are still ahead for the industry, and organizations
are bracing for what one executive called the triple threat: the economic, political and
regulatory aftershocks of the crisis.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
16/48
14
Challenge 5
The other thing is that a lot of
assets are still sitting on the
banks balance sheets. Bad
debts tend to lag the economic
position, so things start looking
a lot better, but bad debts keep
coming through.
Dealing with regulatory uncertainty
41%
Anticipating new capital requirements
38%
Evolving the risk culture
36%
Navigating the fluid economy
28%Repairing the balance sheets
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
17/48
15
72%
Many banks are still dealing with fallout from the crisis
Senior banking executives continue to be occupied with the cleanup of the distressed
assets and debt on their balance sheets. In particular, many are keeping a vigilant eye
on their levels of commercial real estate loan defaults in areas where market conditions
continue to weaken.
Some banks reported progress in selling troubled assets, but acknowledge that most
potential purchasers of debt are still waiting on the sidelines to see if the market will
decline further and reduce prices, especially in the commercial real estate sector. Several
banks have deployed teams of qualied workout specialists to keep up with and manage
the portfolio deterioration.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
18/48
16
Rethinkingrisk strategies
16
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
19/48
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
20/48
18
Most respondents acknowledged that their company needsto do a better job dening, articulating and instilling their
organizational risk appetite into the company. Challenged
by both regulatory bodies and boards of directors, senior
executives have elevated risk appetite to a top priority on their
very busy agendas.
While 60% of respondents gave themselves relatively high
marks for having a clearly articulated risk appetite, most
agreed that dening the risk position and embedding it
throughout the organization are two distinct activities
(See Exhibit 3). The process is complicated by the absence of a
risk-appetite statement that applies to all business lines.
The level of acceptable risk must be assessed and determinedfor each risk type and line of business. Disparate business
goals, weak communication and spotty enforcement can cause
a disconnect between the risk parameters set at the board and
senior management level and the day-to-day management of
the business. Cascading the risk appetite down to the business
unit and desk level is critical to putting risk appetite into effect
throughout the organization.
As we have noted, shifting the risk culture is not an easy task
and several interviewees describe multiyear, highly collaborative
and iterative processes to integrate disparate risk tolerances and
create a unied company-wide position.
Reassessing and integrating risk appetite
Boards and senior management are clearly dening risk tolerance and limits
4%
Not clearly
defined
36%
Underway
60%
Clearlydefined
Most have clearly
dened statements of
risk appetite
Exhibit 3: Statements of risk appetite
We always had a squishy risk appetite
philosophy that everyone interpreted
differently. Now we are codifying and
formalizing it.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
21/48
19
Strengthening risk-identication processes
Banks are looking at risk holistically and assuming a more
vigilant stance on risk-identication policies and procedures
Activities underway
Identifyingemerging risks
Respondents reported a wide range of
activities to identify emerging risks more
systematically:
Conducting more frequent and more
formal risk discussions
Instituting emerging-risk identicationcommittees
Strengthening stress testing, using
more forward-looking scenarios
Adopting more rigorous screening and
on-boarding procedures for new clients
Utilizing advanced information
technology to conduct real-time
monitoring of risks of subsidiaries
and branches
Upgrading portfolio risk grading systems Issuing early warning indicator reports
Reinforcing product-approval policies
and procedures
In the aftermath of the crisis, banks moved quickly to take controlof their risk agendas with the immediate goal of identifying and
mitigating vulnerabilities and reducing high-risk behavior and problem
areas. The control-tightening initiatives have led many institutions
to incorporate more rigorous processes for evaluating their risk
portfolios and introduce more stringent controls to ensure that the
banks position is solidly within the accepted parameters of risk.
Survey participants indicated that they have greatly strengthened their
early warning procedures to spot emerging risks and deal with them
quickly before they escalate into major issues. Banks reported a host of
rigorous policy and procedure improvements in this area including: daily
real-time monitoring of risks; stricter portfolio risk-grading systems;
and tighter screening of on-boarding procedures for new clients.Several institutions have formed new cross-functional risk identication
committees composed of managers from nance, risk, technology,
compliance, treasury, accounting and the business units. These come
together regularly to share their respective insights on emerging risks
that could potentially have a negative impact on the company.
The industry has learned the painful lesson that problems in one area
of the bank can reverberate throughout the institution, creating and
exacerbating problems in totally unrelated businesses. As a result,
executives said they are doing a better job of understanding the
correlations of different risks conducting more integrated forecasting
scenarios that look beyond the traditional silos to assess emerging
issues more systematically and holistically. Finally, many companieshave upgraded their product-approval policies and procedures,
increasing the involvement of the risk group in developing, approving
and monitoring products throughout their life cycle. Some now require
the risk organization to sign off both at the initiation of a new product
and on an annual basis to ensure the product is still acceptable on a
risk/return basis and from a reputational standpoint. As one executive
sums it up, Early identication of risks has become the holy grail in
our organization.
Ive got a weekly escalation that ags any new
risks in the business. Youve got to have youreyes and ears open 100% of the time.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
22/48
20
44%
As the focus on risk intensies, companies are enhancing theirmanagement of key risks. This is true not only for traditional
risks classes, such as credit and market risk, but also for
emerging areas, such as operational, liquidity and reputational
risk, which have become more important. As one executive
told us, Its not that we werent cognizant and careful of these
risks before; its that the consequences of getting them wrong
today are much more severe. When asked to prioritize the types
of risk that are currently receiving the most attention in their
businesses, executives placed credit (67%), operational (44%),
liquidity (38%), market (33%) and reputational (26%) risks at the
top of their lists.
Credit risk: the top of the agendaAt the end of our interviews in January 2010, the economy,
particulary in the US and Europe, was still in ux. High
unemployment and low consumer condence persisted, and the
credit markets remained contracted. While cautiously optimistic
that things were stabilizing, respondents expressed concern
that the turnaround would be sluggish or the economy might dip
again into recession. As a consequence, credit risk was top of
mind for most interviewees (See Exhibit 4).
Shifting focus on risk classes
New areas of risk are surfacing on senior management agendas
Credit risk is at
the top of senior
management agendas
Exhibit 4: Risks at top of senior management agendas
Liquidity
38%
Market
33%
Reputational
26%
Operational
44%
Credit67%
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
23/48
21
Executives agreed that making sound credit approval andpricing decisions is even more critical than ever in todays
environment, and many are initiating a variety of activities to
manage exposures and mitigate risk. More specically, banks
are conducting stringent independent credit analysis both
for borrowers and for credit providers and guarantors. They
are deploying special workout teams that will manage loan
portfolios more rigorously to resolve remnant structural
credit positions and monitor deterioration in credit quality,
charge-offs and related delinquencies. And they are
strengthening their credit risk management function and
team. The impact of tail risks, especially for structured credit
products, emerged as a particular area of concern, and many
said they were upgrading their forecasting capabilities to
assess risk in stressed market conditions.
Operational risk: assessing the nuts and boltsAttention to operational risk is on the rise, especially in the
Americas. Almost half of the executives interviewed voted it a
top priority, making it managements second greatest concern.
Financial institutions have, of course, managed operational risks
for years and understand the need to maintain tight controls
and low error rates. However, the heightened scrutiny from
both regulatory bodies and governments, the new operational
risk management framework and measurements required
under Basel II, and the sheer difculty of navigating todays
environment have all intensied the focus on operations.
Banks are examining the nuts and bolts of the business
evaluating, dening and quantifying the people, systems andprocess risks embedded throughout the enterprise. Initiatives
include: standardizing documentation of processes and controls;
improving data gathering, quality and timeliness; developing
methodologies and metrics to quantify risks; and conducting
scenario analysis by risk type. Several companies have created
a new management position focused exclusively on operational
risk oversight, and many are developing risk awareness and
training programs for all units and functions.
Operational risk is the cause du jour
with regulators.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
24/48
22
Liquidity risk: the biggest lesson learnedIn Ernst & Youngs 2009 survey, 88% of respondents viewed
liquidity more specically the loss of liquidity as the single
largest lesson learned from the disastrous ripple effect of the
downturn across global markets.
In this years study, there was still widespread agreement that
the industry underestimated the difculties of measuring and
forecasting liquidity, and all concurred that liquidity must be
factored more fully into risk management. The good news
is that the liquidity lesson appears to have been taken to
heart 84% of banks interviewed indicated that they have
changed their approach to managing and controlling liquidity
risk (See Exhibit 5). Changes ranged from very fundamentalshifts out of businesses and products to tactical internal
adjustments to liquidity management practices.
Seventy percent of banks have adjusted their viewpoints on
liquidity buffers, and many have signicantly increased their
cash reserves to comply with, and in some cases exceed,
regulatory requirements (See Exhibit 6). Many have made
changes to the structure and composition of the risk group,
recruiting more senior people and strengthening their authority
and clout. New liquidity risk committees, comprising very senior
executives and, often including the chairman, meet weekly in
some institutions to track and monitor liquidity positions. Basic
risk governance policies and procedures have been reviewedand strengthened, common terminology established, data
quality and collection upgraded and reports improved. Liquidity
stress testing has become an important part of forecasting,
providing valuable input into the capital and strategic planning
process. Over two-thirds of executives reported adjustments to
testing extending the time horizons and including more worst
of the worst case scenarios (See Exhibit 7).
84%Most banks have madechanges to their approach
to managing and
controlling liquidity risk
Exhibit 5: Approach to managing and controlling liquidity risk
68%More than two-thirds have
changed their approach to
liquidity stress testing
Exhibit 7: Approach to liquidity stress testing
70%More than two-thirds have
adjusted their viewpoint on
liquidity buffers
Exhibit 6: Point of view on adequate liquidity buffer
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
25/48
23
Market risk: calming downMarket risk has been taken off the front burner of senior
management risk agendas. The extreme volatility in the market
is calming down and respondents are breathing a collective sigh
of relief. But the contagion impact the extent of the crisis and
speed with which it swept through the industry is very much
on everyones minds. Banks are working to hone their tools and
processes to better predict their rms sensitivity to shocks
and volatility in the market. They are supplementing traditional
VaR measures with stress testing and scenario analysis some
investment banks are even conducting daily and weekly tests
on their trading books. They are also closely monitoring the
size, concentration and liquidity of positions, and applying goodbusiness judgment to the results of the quantitative models.
Several executives reported that they are focusing on the
correlation between market risk and credit risk and are merging
the two functions under the control of one senior executive.
Reputational risk: an erosion of trustNot surprisingly, effective management of reputational risk
has become increasingly important, and respondents are
brutally aware of the erosion of trust and condence in the
industry. Stakeholders, including shareholders, counterparties,
customers, current employees and potential recruits, gauge
their interactions with the company based on their individual
perceptions of the companys soundness, reliability and
performance an important factor in maintaining a strong
institutional brand.
Many executives discussed the intensity of the political,
public and media scrutiny, and its extremely negative impact
on everyone in the industry including the people andorganizations that managed prudently. One executive noted
sadly, You dont go to a dinner party and tell people you work in
a bank anymore.
Market risk doesnt kill institutions. Its
generally either credit risk or liquidity risk
that brings you down.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
26/48
24
Ernst & Young perspective
24
Risk appetiteSetting the rules of the roadAs regulators and bankers step back and
ponder what went wrong and how to
prevent it from happening again riskappetite has emerged as a critical
foundation of the risk management
process. While the expectation of having
a board of directors approve risk appetite
has been around for some time, boards
and senior management, at the urging
of regulators, are taking a fresh and far
more rigorous approach to dening and
institutionalizing a robust risk appetite. As
they move through the process, they are
discovering that risk appetite is a
powerful management tool that, whenproperly applied, creates a strong linkage
between strategy, risk, business and
capital management.
Risk appetite is the amount and type
of risk a company is willing to tolerate
to achieve its strategic and business
objectives. It is a reection of the board
and senior managements vision for how
the company fundamentally wants to do
business and how it wishes to be perceived
by key stakeholders customers,
shareholders, employees, regulators andrating agencies. The amount and type of
risk an organization is willing to accept
varies from bank to bank depending on
its management philosophy, growth goals,
business focus and geographic reach.
Even within the company itself, there is
no one-size-ts-all measure of risk. Each
business unit and risk type will dictate
a different level and approach to risk. A
banks appetite for credit risk in consumer
lending, for example, is often very
different from its appetite for market risk
in its investment banking organization.
A banks statement of risk appetite should
be expressed in a way that complements
the rms vision and strategy and sets
the rules of the road for the entire
organization, clarifying the board and
senior managements overarching views
on what constitutes acceptable risk at
all levels within the business. A clear,
well-dened statement provides the
connection between the overall business
strategy and the risk governance of the
organization, and is the cornerstone of
an effective risk framework. Far too often,
the risk strategy doesnt translate into the
day-to-day management of the business.
As one executive told us, At our bank
there is good top-of-the-house articulation.Its pushing it into the DNA of the business
thats hard. Creating a risk framework
that is meaningful to management
and translates to actionable limits and
escalation triggers at the business unit
and desk level is a tough job.
Who is responsible for
risk appetite?
Ownership of risk appetite starts at
the very top of the organization andsystematically cascades downward to the
front-line business managers. The key
players in the risk appetite development
and implementation process include:
Board of directors. The role of the
board in risk management has evolved
signicantly post-crisis, from pure
oversight to active participation in dening
risk appetite and approving the broad risk
parameters for the enterprise.
Risk committee. More and more banks
are adding or strengthening the mandate
of board risk committees to focus and
enhance their risk oversight responsibilities,
including active monitoring of the level of
risk exposure for the institution versus the
parameters set in the risk appetite.
CEO. Ultimately the CEO is responsible
for managing risk throughout the
organization. The CEO, together with the
board, is responsible for creating the risk
framework, and articulating and enforcing
the appropriate risk appetite.
CRO. The chief risk ofcer plays a central
role in the risk appetite development
and monitoring process driving the
discussions between the board, business
management and independent control
groups. The CRO is concerned with
identifying disconnects between strategy
and operations. This role owns the
internal assessment of tolerances, limits
and indicators to support measurement
against the risk appetite, as well as
the implementation plan development,
execution and management.
Business unit leaders. Business unit
leaders must communicate their business
and competitive imperatives and related
inherent risks to achieving those objectives
during the risk appetite development phase.
Once the risk appetite is formulated and
communicated, they are accountable for
ensuring that limits, escalation triggers and
other provisions are aligned with the risk
appetite and meticulously observed in the
execution of strategy.
Independent risk management and
control groups. Control and oversight
groups must have sufcient knowledge of
the business activities of the organization
and have the clout to force a review or
escalation when risk parameters have
been breached.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
27/48
2525
Dening risk appetite
Dening the organizational risk appetite is
both a qualitative and quantitative process
that requires careful review of a host of
external and internal factors.
Quantitatively, a banks risk appetite for
earnings volatility, liquidity position and
capital position must be assessed and
calibrated to risk drivers and their related
tolerances and risk limits. Management
must determine the organizations appetite
for a decrease of more than a dened
amount in earnings or capital. They must
also ask themselves: What is the level
of tolerance for a reduction in available
liquidity? and What is the universe of risk
drivers for each of these scenarios, and
what level of tolerance should be assigned
to each?
Economic capital can play an important
role in the quantication of and allocation
of appetite for each of these risks, and
management must carefully consider how
much capital should be allocated to the
various business objectives and strategic
activities of the organization. In addition,
other risk tolerances such as portfolio
concentrations (e.g., in a single sector,
geography, line of business or asset class),
credit quality (e.g., counterparty credit
rating, consumer credit score, delinquency
rates) or market factor sensitivities
(e.g., investment portfolio VaR, percent
change in net interest income under stress
scenarios) can be utilized to express
appetite for additional facets of risk.
Finally, the use of enterprise stress testing,
including reverse stress tests, is an
important tool in identifying and calibrating
additional elements of the overall risk
appetite of the rm.
On the qualitative side, banks must
consider reputational, strategic, culture
and stakeholder opinions. Stakeholder
views will undoubtedly differ on the
desired safety margins, and it is important
to understand these various viewpoints
in setting the appetite. Expectations of
regulatory and rating agencies, for example,
must be balanced with the business goals
and objectives of investors, customers
and boards of directors. Organizational
philosophy, culture and values set the tone
for risk tolerance levels and play a pivotal
role in the decision-making process. And, as
has been amply demonstrated, reputational
damage can signicantly impact a banks
philosophy on reputation and must be
considered in developing risk appetite.
These additional considerations can be
expressed in a number of ways. In many
instances, banks have used key indicators such as key performance indicators or key
risk indicators as a way to numerically
express and measure some of the other,
more difcult to quantify drivers of risk
appetite components like operational or
regulatory risk. In addition, banks should
also utilize purely qualitative risk appetitive
statements as a way to express the boards
views on items such as approved products/
businesses and compliance with external
rules and regulations. These elements,
combined with the quantitative measures,
provide for a more robust risk appetite
framework, which touches on all major
categories of risk.
Regulatory oversight
Internal audit test/evaluate effectiveness of risk governance framework
Board ofdirectors
Independentrisk andcontrol group
Senior managementand lines
of business
approvesstrategy
managesrisk/return
profile
identifies andmanages risk
monitorsrisk
approvesrisk appetite
measures andreports risk
Riskappetite
Risk appetite governance responsibilities
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
28/48
26
Ernst & Young perspective
26
The risk appetite
development framework
Ernst & Young recommends a practical
approach to creating and embedding an
organization-wide risk appetite statement
and process. This process integrates atop-down view of the rms overall appetite
and capacity for risk in the context of its
strategic, nancial and capital objectives,
with a bottom-up view of the infrastructure,
controls and analytic tools used to support
risk management within the business. The
result is a draft risk appetite statement
that is then assessed and rationalized
to establish consistency between the
risk appetite, and business unit and desk
level operating limits. Finally, the process
updates the risk monitoring and reporting
to align with risk appetite.
Done successfully, this integration
establishes a new framework through
which the enterprise-wide risk appetite set
by the board and senior management is
cascaded down to the business in the form
of limits and thresholds. These limits and
thresholds can be measured and monitored
by qualitative and quantitative means, with
appropriate performance reporting fed
back up to senior management. The key
building blocks to this approach, therefore,
aim to establish a sustainable process and
information loop that links the top-down
and bottom-up views.
Draft risk appetite and assess current
risk prole
Top-down. Boards and senior management
must reect on their understanding of
the potential impact of the range and
severities of key risks on the bank and its
strategic objectives. Taking into account
the inherent uncertainties with forecasting
of this nature, banks must dene, through
both quantitative and qualitative means,
how much risk the rm can or is willing to
accept. This understanding of key risks and
potential severities must be translated into
a top-down statement of risk appetite.
In order to do this, boards and senior
management must have a robust and
forward-looking understanding of the most
signicant risks faced by the institution
relative to the achievement of its strategic
goals. Scenario analysis and stress
testing, including so-called reverse stress
tests, along with existing aggregated
risk reporting, should play a key role.
Boards should challenge whether current
executive risk reporting and engagement
with management succeeds in establishing
a key risk inventory that fully addresses the
range and potential severities of the most
signicant risks to which the rm may be
exposed. Management should put in place
processes the will support:
Forward-looking view of risk. Provide
a forward-looking view of risk that
reects the rms strategy, business
model, future market conditions and
the inherent risks, sensitivities
and uncertainties.
Linkages. Understand the linkages
between strategy and risk, and capital
and funding. How would capital and
liquidity be impacted by certain risk
events and how the rm could respond?
Risk capacity. Understand risk
capacity and which shocks to revenue,
reputation, capital and funding could
potentially send a bank into a downward
spiral from which it could not recover by
itself. What scenarios could cause this
to happen?
Bottom-up. A current state, or bottom-
up, analysis of the banks current ability
to monitor and measure risk relative
to appetite is an activity that banks
should undertake. This analysis should
challenge the extent to which existing
processes and systems provide the
ability to sustainably identify, measure,
monitor and report against the identied
risks and limits.
A practical approach to dening a risk appetite
Update risk
monitoring and
reporting to align
with risk appetite
Establish
consistency
between risk
appetite and
operating limits
Assess
completeness
of risk appetite
Draft risk appetite statement
and assess current risk prole
Conrmrisk monitoringreporting andprocess
Conrmrisk appetitestatement andcalibrate operating
parameters
Identify strategicobjectives
Draft risk appetitestatement
Top-downapproach
Inventory risk
measurementtools
Assess current risk
prole, exposuresand limits
Bottom-up
approach
Connectrisk appetitestatement withrisk prole
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
29/48
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
30/48
2828
Realigning roles,responsibilities
and rewards
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
31/48
2929
Banks are clarifyingrisk governance responsibilities
Senior management is reassessing and redening
expectations for risk management
Making risk management a company-wide concern and changing deeply engrained
attitudes toward risk require signicant attention to the people factor in the risk equation.
Building a strong talent base with deep risk expertise and competing successfully to recruit
and retain this expertise continue to be critical challenges industry-wide. It is evident from
respondent interviews that many banking professionals believe the crisis can be traced, in
large measure, to the lack of a strong corps of seasoned risk executives throughout the
industry with the appropriate stature and clout to anticipate and act on risk issues.
There was strong agreement that effectively managing risk across the enterprise requires
both top-down oversight and bottom-up involvement. Accordingly, many banks have
conducted reassessments of the roles and responsibilities for all key internal
stakeholders from board members to business unit heads and their teams to
re-evaluate and clearly articulate expectations for risk management and mitigation.
Compensation, which few respondents believe played a pivotal role in the nancial crisis,
is nonetheless a major issue to be addressed, and bank boards are working proactively to
do a better job of linking pay with risk performance.
Banks are taking a variety of actions to better align their compensation practices with
actual performance, rebalancing the proportion of xed to variable compensation and
more tightly linking variable pay to performance over longer time horizons.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
32/48
30
Well-dened and clearly articulated risk ownership rolesand responsibilities are a critical component of effective risk
governance. Over the past 12 months, many banks have
stepped back to take an inventory of current limit structures,
delegations of authority and existing policies and procedures.
Many found gaps in processes and assignments throughout their
organizations and confusion around risk oversight expectations.
As a result, responsibilities have been claried and positions
strengthened for the key executives across the enterprise.
Boards and risk committees: reinforcing responsibilities
Most respondents shared the conviction that effective, high-
performing boards make an important difference to the
performance of their organization. Accordingly, many are
focused on identifying the critical factors for building and
improving higher impact, more effective boards. Two-thirds
of survey participants indicated that their organizations have
made changes to the roles and responsibilities of the board (See
Exhibit 8). Most reported that their boards are becoming more
educated, asking more pointed questions and challenging more
assumptions. At the same time, they are now much more hands-
on and more fully engaged in risk policy setting and governance.
Setting strategic direction and dening the organizational risk
appetite are now considered to be board responsibilities while
emerging issues such as capital allocation, new business risks
and compensation have risen in importance on the boards
agendas. Many of the companies we surveyed have separated
risk from their audit committees and established a distinct risk
committee to ensure independence and an adequate focus
on each of those critical areas. Several are no longer allowing
board members to serve on both committees. More boards
are requesting that the CRO be given independent access toboard members, creating a more powerful system to perform
checks and balances of executive powers in the business lines.
Unquestionably, boards are conducting deeper dives into matters
that in previous years did not reach their agendas requiring
more sophisticated, in-depth reports and analysis, and asking
tougher questions about risk-related issues as they relate to
strategic decisions.
CEO: the buck stops here
CEOs have clearly been in the hot seat during and since the
crisis, and as everyone is aware, they are often the rst to go
when an organization comes under re. Most respondents
agree that the CEO is ultimately responsible for risk in their
organizations. It is the CEO who must ensure that the company
as a whole gets it right when it comes to critical decisions on risk.
The CEO, together with the board, is responsible for creating the
risk framework and articulating and enforcing the risk appetite
throughout the enterprise.
Chief nancial ofcers: aligned with risk
Senior nance teams face new and complex challenges in
todays dynamic business environment. Respondents reported
that nance is changing the way it organizes and operates to
help ensure that banks execute their global strategies effectively,
manage risk appropriately, comply with regulations and bottom line remain stable and solvent. CFOs are strengthening
the nance functions alignment with risk management teams
so that risk governance, nance and capital allocation decisions
reinforce each other rather than work at cross purposes.
Recalibrating risk management roles and responsibilities
Boards strengthen oversight while CROs expand their inuence
The board has taken a greater interest in
how we manage risk and a greater interest
in where the risk lies within the organization.
Theyre educating themselves so when theyrereformulating the strategy, they have a better
understanding of where we might go next.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
33/48
31
Chief risk ofcers: drivers of cultural transformationWith risk now playing a strategic role equivalent to that of
growth and revenue, nearly half of the companies reported
they have changed the roles and responsibilities of their risk
teams (See Exhibit 9). CROs are now seen as being on a par with
CFOs and have a say in important decisions impacting strategic
direction, risk appetite, product development and compensation.
As part of their new roles, CROs report spending more time with
boards and providing regular reports and intensive briengs to
help members understand and evaluate risk decisions. In some
instances, CROs report both to the CEO and to the boards
risk committee.
Furthermore, the crisis and the move to Basel II have heightenedthe need for the nance and risk teams to work closely together,
and CROs reported a much tighter alignment with CFOs and
nance organizations. Risk teams interact more frequently
with internal human resource teams to develop remuneration
policies and pay structures. Externally, they play a much
more prominent public role before regulators, analysts and
shareholder groups.
CROs are acutely aware of the increased importance of their
role in building and maintaining an effective risk governance
process and infrastructure. Philosophically, many see their role
as both inuencing risk governance decisions and advising CEOs
on risk appetite and strategy. As one CRO described it, We areeducators and drivers of cultural transformation to make risk
everyones responsibility. Risk has become the busiest area
for recruiters as companies search for strong chief risk ofcer
talent that can truly go head-to-head with business executives.
Business unit leaders: committed to risk culture
The senior line leaders and their teams are taking a more active
role in risk management as well. Many have reinvigorated and
restructured executive risk committees at the business unit or
group level to focus more strategically on risk identication
and mitigation.
I think there were days in the past whererisk people felt like they were being
ignored. Now they really feel much
more relevant.
52%Nearly half of respondents
have made changes to roles
and responsibilities of the
CRO and risk team
Exhibit 9: Changes to the roles and responsibilities of theCRO and risk team
66%Two-thirds have madechanges to the roles and
responsibilities of the board
Exhibit 8: Changes to the roles and responsibilities of the board
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
34/48
32
The focus of intense regulatory scrutiny and considerable publicire, executive compensation was described by one executive
as the elephant in the room on every matter. Another CRO
reported speaking to a record number of regulators on this
topic during the week of our interview with him. Our survey
participants were of course aware of the restorm surrounding
compensation and assured us that they were not sitting on the
sidelines waiting for the political and regulatory debate to unfold.
Many are taking a proactive approach to assessing and, when
necessary, adapting compensation practices to ensure that
their pay structure does not incent the taking of excessive risks.
Seventy-three percent of executives reported that they have
made, and will continue to make, changes to their compensation
policies to better align pay structure with risk control tolerances
and rm culture (See Exhibit 10).
Banks are also taking a variety of actions to better align theircompensation practices with actual performance. Many are
rebalancing the proportion of xed to variable compensation
putting a little more on the front end rather the back and
are more tightly linking variable pay to performance over
longer time horizons. Some are adding risk-based measures to
scorecards to counterbalance excessive risk-taking. Others are
determining compensation at the group level rather than the
individual business unit level, to create greater distance between
the risk-takers and those who determine their compensation.
Several are deferring payout for a signicant part of executives
bonuses or performance-related income, sometimes for as many
as ve years, and a growing number are including clawback
provisions in deferred compensation. While clawbacks in the pastwere typically limited to cases of fraud or criminal acts, rms are
developing standards under which a clawback may be invoked
based on portfolio performance over an extended period.
Boards of directors and their compensation committees are
spending considerably more time on pay practices. Board oversight
has been strengthened, and compensation committees have
embraced new methods for reviewing pay delving deeper into
the employee ranks, conducting stress tests on payouts and
retaining more discretion over payments.
Linking compensation to risk performance
Public, political and regulatory pressures have elevated compensation on the
senior management agenda
Three-quartershave made changes to
compensation frameworks
Exhibit 10: Changes to compensation frameworks
73%
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
35/48
33
We are looking very carefully at our
compensation plans to make sure they
dont incent inappropriate risk behavior.
Risk professionals are also being drawn into evaluating the riskdimensions of pay. In many banks, the CRO and risk team are
providing considerable input into the compensation framework,
both directly and indirectly. Risk groups are more closely involved
in offering opinions on existing compensation plans, establishing
new compensation policies, providing metrics for scorecards
for business units and individuals, and in a few cases, actually
reviewing the compensation proposed for the top people in the
organization. In some organizations, CROs now have the power to
insist on a risk capital analysis and possible hedging decision on
large trades and deals, indirectly impacting the bonus pool.
Survey participants agreed that some reform and improvement
are needed for industry compensation policies and most reportprogress is underway to improve the linkage between the
governance of compensation and the companys risk appetite,
management and culture.
Activities underway
Strengtheningcompensationstructures
Respondents reported a range of
activities to adjust pay structures*
Appropriately capital-charging
business and bonus pools
Retaining more discretion in payouts
Stress testing payouts
Moving to longer vesting periods
Increasing deferred compensation
Incorporating risk-weighted metrics
Instituting clawbacks
Increasing base salary
*Banker compensation at a crossroads,
Tapestry Networks research sponsored by
Ernst & Young, November 2009.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
36/48
34
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
37/48
Recalibrating
risk processes
35
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
38/48
36
Strengthening risk governance, systems and processes
Banks are continuing to upgrade their risk forecasting, reporting and technology
Across the banking industry, initiatives are underway toachieve more comprehensive, integrated strategies for risk
management. Throughout 2009, executives moved aggressively
to identify and address deciencies in their risk management
processes. Reporting, forecasting and technology were the
primary target areas for improvement, and banks put in place
the systems and people required for thorough, proactive
approaches to managing and mitigating risk.
Many are well along the path to building strong risk-governance
teams and processes. Sixty percent of executives interviewed
have made changes to their risk management organizations, and
the remainder have either implemented changes or have begun
the process (See Exhibit 11).
The majority have made
changes to risk management
processes and structures
Exhibit 11: Changes to corporate risk management decision-makingprocesses and structures
60%
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
39/48
37
In the wake of the crisis, boards, stakeholders, seniormanagement, rating agencies and regulators are demanding
more reliable, thorough and timely information internally
about the business and externally about the universe of potential
risks. As a result, reporting is becoming more substantive
and qualitatively rich. Senior management, boards and other
stakeholders are beginning to receive management reports
that deliver real, actionable value a clear shift from the data
dump mode that often characterized risk reporting in the past.
Seventy-one percent of executives indicated that they are well
underway with the development of integrated enterprise-wide
risk reports and almost one-third said their effort is nearly
complete (See Exhibit 12). But many companies still have a longway to go. Persistent problems cited by respondents include
poor data quality, inconsistent information from disparate
systems and the sheer volume of data all of which make it
extremely difcult to pinpoint the essential information that
management needs and present it in an actionable manner.
Once reports are upgraded to span a more comprehensive
set of information from across the organization, teams are
turning their attention to delivering the information more
quickly. Executives said that accelerating the reporting process
to support real-time decision-making is one of their biggest
challenges. As one executive describes the situation, We
aggregate risk information quite well, but we do it slowly. We stillare working on an all-singing, all-dancing, instantaneous view
of complete risk to a particular counterparty in real time. Were
getting there.
Respondents agreed that effective risk reporting, in terms ofboth content and timeliness,is a critical step toward effective
enterprise-wide risk governance. It provides senior management
and the front-line business and risk professionals with the
information they need to make sound decisions in line with the
companys risk appetite and business objectives. But many
cautioned that aggregating risk is only the rst hurdle. The
more difcult step is reviewing, analyzing and synthesizing
risk reports to understand the interrelationships across the
organization. Most executives conceded there is more work to be
done in this area.
Upgrading report analysis and delivery
Risk reporting is becoming more comprehensive, actionable and timely
0%In earlystages
71%
Midway
29%
Nearlycomplete
The majority are
in the process of
implementing
enterprise-wide
risk reporting
Exhibit 12: Enterprise-wide risk reportingIt is the ability to, with judgment
and insight, connect the dots
between all of that information.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
40/48
38
Upgrading and reinforcing forecasting
Banks report progress in improving forecasting systems and methods
The past 18 months have demonstrated in a compelling wayan industry need for more robust risk forecasting. Banks
need more sophisticated predictive tools that will enable
management to assess the implications of market events
on and across categories of risk. The industry has clearly
learned this lesson, and many respondents reported increased
investments in upgrading and reinforcing forecasting models,
systems and processes. More than half of this years survey
participants (55%) indicated that they have some forecasting
capabilities within their companies (See Exhibit 13). However,
only 27% characterized their banks as having formal,
enterprise-wide forecasting processes in place. Most agreed
that to become a truly effective management tool, forecasting
must be integrated and standardized across asset classes and
business lines to provide a holistic view of potential risks and
their impact on the entire organization.
Exhibit 14: Changed use of forecasting models
Three-quarters have changed
the use of forecasting models to
rely less on historical data and
assumptions
71%
Exhibit 15: Changed use of stress testing and scenario planning
74%
Most have some organization-wide
forecasting processes in place
18%
Limitedprocesses
55%
Someprocessesin place
27%
Have formalorganization-
wide processes
Exhibit 13: Status of forecasting
The majority have made
changes to stress testing
and scenario planning
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
41/48
3939
Respondents reported some critical changes to their forecastingprocesses. More than 70% have adjusted their models to
rely less on historical data and assumptions (See Exhibit 14).
Seventy-four percent have incorporated forward-looking
scenario planning and stress testing that consider outcomes
with extremely low probability but potentially high impact on the
companys own set of exposures and assumptions (See Exhibit
15). But executives cautioned that forecasting models can get
out of hand, becoming overly complex and too difcult for senior
management to understand and use effectively as decision-
making tools. Many emphasized that analysis must always be
paired with seasoned business judgment, cautioning that you
need to be very careful not to fall in love with your models.
I think you need both good models and good
judgment, but you need to be very careful
not to fall in love with your models.
Activities underway
Risk forecasting
Respondents reported a wide range of
activities to improve and upgrade risk
forecasting:
Establishing uniform modeling
standards across the bank
Varying stress-testing methodologies
appropriate to the banks risk appetite,
level of sophistication and current andplanned operations
Integrating scenarios in order to cover
more than one type of risk
Ensuring analytical metrics are broad
and aligned with how risk is managed
Extending time horizons of scenarios
and forecasts
Complementing weaknesses of VaR by
using a wider variety of methods
Using more worst-case scenarios
Ensuring data used in models are
consistently reliable and appropriate
for models used
Ensuring more accountability around
forecasting of loss levels and capital
utilization
Using historical data but placing more
emphasis on the last 6-12 month
period, which is more reective of
current customer behavior
Instituting more business line-specic,
bottom-up stress testing around
discrete portfolios of risk, particularly
those with tail risks attached
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
42/48
40
Leveraging technology to support risk management moreeffectively remains a work in progress for most banks. As
one executive told us, Youll never stop working on it. More
than three-quarters (78%) of respondents reported that they
are mid-way through the arduous process of mobilizing their
systems to support risk governance a denite improvement
over last years survey results in which only 47% of participants
reported progress on the technology front (See Exhibit 16).
While executives seem to have a clear vision of how
technology can be deployed to better support risk
management, they reported ongoing challenges in
implementing effective technology platforms. The most
vexing of those challenges is data management. Companiesare actively dening the types of data required to produce
useful reports and working to integrate disparate databases
to enable ready access to a consistent data set across thecompany. Many organizations are still in the process of
developing a common platform and centralizing the technology
function as they deal with fragmented and complex systems,
a challenge for the many companies that have grown
by acquisition.
There is strong agreement that streamlining systems is crucial
to improving banks risk management capabilities. As a result,
technology remains a major area of investment. Given the high
costs involved, companies are approaching the IT challenge
from several perspectives. Some have developed prototypes
and are in the testing stage, others are organizing IT projects
around specic systems or addressing system issues at thebusiness-unit level, and a small number have committed to
major system overhauls, such as rebuilding the global market
risk infrastructure.
Streamlining technology to support efciencies
The long march toward improved technology continues
Weve spent a lot of money
over a period of some years in
order to be Basel-compliant.
Youll never stop working on it.
6%
In early
stages
78%
Midway
16%
Nearly
complete
All are working
to upgrade
technology
Exhibit 16: Streamlining technology to support risk management
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
43/48
41
Costs andbudgeting
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
44/48
42
Banks are anticipating heavy investment in risk management
With sweeping regulatory changes in the works, executives expect the cost of
managing risk to continue to rise
As the markets stabilize, executives are bracing for steep costincreases as they boost the time and systems dedicated to
dealing with the aftermath of the crisis and the new regulatory
frontier. Executives across all geographies are in agreement:
risk management costs will continue to escalate over the next
18 months and beyond, with some predicting exponential
increases (See Exhibit 17).
Multiple layers of complex regulations have increased
documentation and reporting requirements and brought more
frequent, deeper-dive examinations into operational areas of
the organization. To support these more frequent and complex
inquiries, companies are deploying additional teams of people
and increasing investments in information management systemsand technology aimed at streamlining data gathering and
management across the organization.
The cost of working out troubled portfolios continues to rise
at some banks as they deploy work-out terms to clean up
distressed assets and debts on the balance sheet. Efforts to
hire competitors talent has intensied, especially when trying
to recruit people specialized in workouts, compliance, modelingand risk forecasting signicantly driving up the people cost for
the foreseeable future.
Longer term, a few optimistic executives expect costs will level
off as portfolios stabilize and investments in systems pay off in
greater efciencies and higher productivity. However, even the
most optimistic do not expect to see any cost stabilization before
mid-2011.
I have a team of risk managers and haverequested a fairly signicant increase in staff.
I think I will get what I requested, and Im the
envy of my colleagues.
Americas EMEIAAsia-Pacific
Increase
Decrease
Staythe same
84%
83% 90%
8%
0%
0%
8%
17%
10%
Across all regions, executives
expect costs to increase
Exhibit 17: Costs by region
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
45/48
43
Seventy percent of respondents indicated they were ableto estimate total annual expenditures for risk-and-control
management across their organizations (See Exhibit 18). This is
a signicant improvement over the results of the Ernst & Young
survey two years ago in which slightly fewer than half (47%) of
those responding claimed they were accurately able to gauge
total costs over a 12-month period.
However, respondents agreed that while they could estimate
the cost of the central risk organization, it is challenging to truly
understand the total enterprise-wide cost of risk management.
When risk is everybodys business it is virtually impossible to
estimate accurately the amount of time people at the business-
unit level spend on managing risk. As one executive put it, To behonest, if we do our jobs correctly, were just putting the policies
and the programs in place. Its that front-line person who, when
she sees a suspicious transaction come through on a client shes
known forever, raises her hand. Thats risk management, but we
dont capture those costs.
Some banks are embarking on studies to assess risk productivityto gain a more sophisticated view of investments in risk across
the enterprise and to benchmark these costs against other
comparative banks. However, the wide variety of denitions of
risk and allocations of resources to risk across the industry make
this a challenging endeavor.
Estimating the cost of risk is complex
Centralized costs of risk management are well known but enterprise-wide costs
are more difcult to quantify
We started to look at the total cost of risk
management and control about four yearsago. It has taken us about two years to get
a handle on it.
Exhibit 18: Ability to estimate cost
The majority canestimate the cost of
risk management
70%
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
46/48
44
thoughts
Final
44
Moving forward with a new respect for risk managementThe nancial crisis exposed inherent weaknesses in the risk management system: siloed infrastructures, disparate
systems and processes, fragmented decision-making, inadequate forecasting, and a dearth of cohesive reporting,
among others. The extraordinarily negative impact of these aws on many institutions shocked the industry, and asa result, there has been a seismic shift in attitude toward risk.
As they move beyond the crisis, reect on its causes and results and adapt to the drastically changed and still-uid
market and regulatory environment, banks are revitalizing strategies to reect the enhanced focus on risk. While
each bank included in our survey is crafting a unique strategy based on its own culture, business focus and growth
goals, common themes are emerging among boards and senior executives.
Most importantly, there is a unanimous commitment to ensuring that a healthy approach to risk underlies both
short-term and long-term strategic planning. Boards and senior management are challenging themselves to
clearly dene their risk appetite and drive its implementation throughout the business. As they do so, they are
aggressively reviewing and realigning the risk-related responsibility and accountability of every function in the
bank and signicantly expanding the inuence of the CRO and risk group along the way. Many banks are making
tremendous investments in time and technology to strengthen the processes and tools to manage risk effectively.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
47/48
4545
From forecasting to reporting to analysis, banks are recalibrating procedures and practices with an eye to providing
management with realistic, actionable and timely information.
There are many lessons to be learned from the crisis. Respondents agreed that the changes required to
institutionalize a strong risk culture are fundamental and far-reaching: risk must become everyones business
throughout the organization from the front line to the functions. Responsibility and accountability for risk areintertwined as never before. All stakeholders, from board members to business unit heads, must be more actively
committed to identifying and mitigating risks.
The question on many minds is whether these lessons will stick. As one executive said, The real question is can
we embed this new risk management culture and processes into the organization so that they can outlast this
generation? Or will it all go wrong again the next time around? No one knows for sure, but all are hopeful. As this
report goes to press, nal regulatory guidelines are still being drawn. The market is calmer, but still volatile and the
full impact of the economic crisis is yet to be absorbed. Banks are denitely back to business recovering, adapting
and advancing in search of the right strategic model in todays uncertain world.
8/7/2019 EY - Recover-adapt-advance_back-to-business-in-an-uncertain-world
48/48
Ernst & Young
Assurance | Tax | Transactions | Advisory
About Ernst & Young
Ernst & Young is a global leader in assurance,
tax, transaction and advisory services.
Worldwide,our 144,000 people are united
by our shared values and an unwavering
commitment to quality. We make a difference
by helping our people,our clients and our wider
communities achieve their potential.
Ernst & Young refers to the global organization
of member firms of Ernst & Young Global
Limited, each of which is a separate legal entity.
Ernst & Young Global Limited, a UK company
limited by guarantee, does not provide services
to clients. For more information about our
organization, please visit www.ey.com.
The Global Banking & Capital Markets Center
Managing risk effectively while satisfying
an array of divergent stakeholders is a key
goal of banks and securities firms. The GlobalBanking & Capital Markets Center brings
together a worldwide team of professionals
to help our clients achieve their potential a
team with deep technical experience in
providing assurance, tax, transaction and
advisory services.
2010 EYGM Limited.
All Rights Reserved.
EYG no. EK0044
Ernst & Young is committed to minimizing its
impact on the environment. This document has
been printed using recycled paper and
vegetable-based ink.
This publication contains information in summary form and is
therefore intended for general guidance only. It is not intended
to be a substitute for detailed research or the exercise of
professional judgment. Neither EYGM Limited nor any other
member of the global Ernst & Young organization can accept
any responsibility for loss occasioned to any person acting
or refraining from action as a result of any material in this
publication. On any specific matter, reference should be made to
the appropriate advisor.