Bank failures are the most extreme example of risk management gone badly wrong. In many less high-profile areas, a comprehensive rethinking of risk is taking place in the wake of the credit crunch. By Philip Alexander.
The collapse of Lehman Brothers and bail-out of insurance giant AIG in mid-September have reawakened concepts of risk that had lain dormant during the boom years. Liquidity risk is self-evident, as central banks pool resources to keep the lifeblood of banking circulating through the system.
The wide-ranging role in swaps markets of Lehmans and AIG, as well as Bear Stearns, has also prompted a rapid review of counterparty credit risk.
“Bank custodial departments have seen a big pick-up in activity, as pension and insurance funds hurry to look at the documentation and collateral details on their swap contracts,” says Robert Gardner, co-founder of institutional investment advisory firm Redington Partners. “Investors who were posting collateral on a weekly or monthly basis are now switching to daily updates,” he adds.
Behind these high-profile stories, however, a broader and deeper rethink of risk management has been gradually moving through the banking sector at all levels, and we examine several aspects of it in this supplement.
As fears of recession and house repossessions grow on both sides of the Atlantic, attention turns to whether overburdened consumers will also begin defaulting on credit cards in large numbers. Mark Austin, head of Visa Europe, explains how the card provider is helping its member banks adopt a more active approach to managing consumer credit risk.
Meanwhile, financial difficulties at highly leveraged companies that were subject to buyouts during the boom could begin to spread into the middle market. Leveraged loans, especially those that banks failed to syndicate after the credit crisis struck, are being carefully monitored by central management. But middle market credit control is often devolved to local managers, undermining the development of a coherent risk management strategy. Charles Stewart, senior director at credit analytics consultancy Moody’s KMV, argues for banks to reconsider middle market risk management as a way to add value to the business, rather than just avoiding accidents.
Basel background to risk
The implementation of Basel II had already prompted the largest banks to analyse credit and market risk more closely with a view to seeking Advanced Measurement Approaches (AMA) status that allows them to calculate their risk exposures using internal measures rather than credit ratings.
Many practitioners suggest that the third Basel category, operational risk, has been the poor relation of the package – until now. The €5bn impact of rogue trader Jerome Kerviel on Société Générale in early 2008, together with the deluge of securities fraud and misselling claims hitting banks over the subprime crisis has focused minds, says Robert Cannon, a lawyer at Cadwalader, Wickersham & Taft in London.
“They are more aware of how losses can affect the solidity of the bank – it is not that operational losses could cause the bank to go under, but the bank incurring those losses in turn affects how counterparties perceive the bank, their access to long-term funding, and so on,” Mr Cannon observes.
The problem of putting a price on operational risk is data, however. While banks store data on default rates going back decades, the compilation of such statistics on operational risk is comparatively new, and the variety of risks covered by Basel II definitions – from internal and external fraud, misselling of products and trading execution failures to workplace accidents and fire damage – makes analysis all the more complex.
“Banks are beginning to look at insuring some of the Basel II operational risk headings, but not others. The difficulty is that the Basel II categorisation does not match up with the banks’ traditional insurance policies for operational risk – some of the headings are clear-cut, but some are very broad ranging,” says Mr Cannon.
The Basel categories are drafted in a descriptive fashion, without supplying tests to establish distinctions between them, which leaves national regulators significant individual discretion on how to interpret the guidelines.
The Operation Risk Data Exchange Association (ORX), which began launching reports in June 2007, is helping to put right that lacuna by seeking to standardise the categorisation of operational risk loss events across the market. And insurers who are used to working with the largest banks are adapting their policies to meet the requirements of Basel II. But Mr Cannon says for some smaller banks, the cost of tailored policies may outweigh the capital relief they allow.
Consequently, banks are examining ways to pool operational risk funding, or engage in swaps of risk between banks that have different business lines.
“This might involve a cash payment as well. For example a retail bank with relatively low exposure to catastrophic operational risk might be relatively comfortable taking on extra risk from another institution,” says Mr Cannon.
Relationship with insurers
Beyond the advent of Basel II, the credit crunch has also had a significant impact on the interaction between banks and insurers. Insurance broker Aon predicts insurance claims by banks under directors & officers (D&O) policies to jump from 166 in 2007 to around 220 in 2008. Where these cases settle, the average payout is also on the rise, from $26m in 2007 to $38m in 2008.
The size of the losses appears to be captured within the limits of premiums charged to financial institutions, says Sean Whelan, who works for the reinsurance team of insurance broker Willis in the US. But the capacity that is provided for large financial institutions relative to overall exposure is too small, leaving them underinsured.
“If you think about some of the transactions these banks are involved in, it is typically $500m to $1bn for each mortgage-backed security. Yet once you reach about $500m for an insurance policy, you pretty much cap out the world market,” he notes.
According to Daniel Butler, head of financial services operational risk at Aon, the largest banks with $1bn or more of litigation cover were often left frustrated when they needed to make claims after the dot-com bubble and the Enron and WorldCom cases.
“A number of those products settled only after a long period and a process that was more effort than they would have wanted. The banks began to question the efficacy of the product, and a number began to self-insure,” says Mr Butler.
Given the capital relief that could be accorded under Basel II, banks will want to try to restore their relationship with insurers. Mr Butler believes they can do this by providing a clearer analysis of their own underlying risk exposures, rather than relying on insurers to present static products that may not meet the bank’s needs.
Aon has built its own database of claims going back eight years, which begins to build a clear and quantifiable picture of operational risk.
“Once you get above a certain attachment point, the insurable risks that financial institutions can suffer are relatively homogenous – Kerviel at SocGen, Parmalat, Enron, mutual fund misselling – the effects of those issues on the insured institutions were pretty similar, but there is obviously going to be a different likelihood of that event occurring for each institution,” says Mr Butler.
Similarly, Aon often sees the same issues causing problems with insurance settlements or voiding policies time and again, Mr Butler notes. One of the factors that could be particularly significant this time around is selling new, higher risk financial products to clients.
“For banking institutions that are prepared to share the relevant information with insurers, we are confident that we can start to build products that will not repeat the past problems – it is going to be a journey of disclosures that the banking world is still a little nervous about,” Mr Butler explains.
