As regulators insist that banks change their ways and strengthen their defences against another ruinous crisis, some bankers complain that their demands are unnecessarily onerous. There is, however, one particular area where few dispute the pressing need for reform – in risk governance. But willingness to comply does not change the fact that overhauling risk structures and cultures is easier said than done.
In the buoyant lead-up to the crisis, many banks grievously underestimated the levels of risk to which they were exposed. Some failed to aggregate concentrations of subprime mortgage risk across many different business areas and, as the boom progressed, value-at-risk models based on insufficiently long data histories lulled many into a false sense of security. Even Basel II internal ratings-based models proved misleading if they used a point-in-time rather than through-the-cycle methodology. As banks rushed to sell good assets, liquidity problems emerged in unexpected places.
