With the publication last week of Good Supervision: Lessons from the Field, the International Monetary Fund (IMF) adds its own report to the growing pile of inquiries into the banking sector turmoil among regional US banks and one globally significant European bank this past spring.
The IMF draws the same key conclusions as many others who have already weighed in: the collapse of Silicon Valley Bank (SVB) and forced sale of Credit Suisse resulted from failures in risk management at firms, compounded by flaccid supervisory oversight.
The IMF argues that this series of unfortunate events underscores “the importance of enhancing supervisory focus on corporate governance and business models in assessing whether risk management and risk buffers are fit-for-purpose”.
Many policy-makers have, yet again, had cause to emphasise the importance of culture to the success of risk management. “A robust governance structure is the first and the most important requirement for ensuring stability of a bank,” stated Reserve Bank of India governor Shaktikanta Das in a May speech. Bank boards should therefore prioritise driving “a culture where the expectation would be to go beyond baseline compliance to regulatory and legal requirements and aim for higher, best-in-industry standards”, added deputy governor Rajeshwar Rao.
“Poor internal controls, risk culture, and governance are at the root of other deficiencies in banks,” warned Financial Stability Board (FSB) chair Klaas Knot during a June 1 speech. “Weak decision-making procedures and the absence of a healthy challenge culture hamper effective governance and strategic steering, which can ultimately lead to a bank failure,” he added.
By contrast, “well-run banks — in other words, banks with strong risk management and governance — don’t fail”, European Central Bank supervisory board chair Andrea Enria has correctly insisted. Bank management, not their supervisors, must take ownership of identifying and managing risk, Mr Enria argues. “That means having robust governance and a sound risk culture, so that the pursuit of growth and profitability never comes before prudence.”
Culture and conduct
In the end, the collapse of SVB and Signature Bank in the US, and of Credit Suisse in Europe, followed from poor cultures permissive of poor risk management, abetted by poor board oversight. But while blame for the failures rightly sits with management, supervisors share in the responsibility, as many themselves have since noted.
Bank for International Settlements head Agustín Carstens, for instance, has stressed that banking sector supervisors must work to assure that their own cultures promote desired standards of inquiry. “Banking supervision needs to step up to ensure the safety and soundness of financial institutions,” asserted Mr Carstens. Going forward, “supervisors will need to have operational independence, strengthen their forward-looking culture and adopt a more intrusive stance”, he continued.
The supervisory focus on culture and conduct must continue to evolve and contemplate new risks, threats, technologies, and business models.
In its 2018 report, Culture and Conduct: A Permanent Mindset Change, the Group of Thirty arrived at many of these same conclusions regarding the significance of culture in the context of risk governance and supervisory oversight alike. The 2008–09 global financial crisis (GFC) called attention to banking culture and conduct, the G30 noted. Ten years on from the GFC, the G30 report found that banking sector culture and the conduct it promotes remained “at the center of a slow, uphill battle for trust”.
Five years later, we see that ensuring good conduct and culture remains a process of struggling up-slope for many firms and their overseers. Supervisory vigilance, a continued focus on bank boards, on management cultures, and internal risk management processes, remains essential. And the marked supervisory focus on culture and conduct that has been seen in recent years must continue to evolve and contemplate new risks, threats, technologies, and business models.
Carolyn Rogers — formerly secretary general of the Basel Committee on Banking Supervision — made the case neatly in the 2021 Starling Compendium — an annual report on global trends in the governance and supervision of culture and conduct risks in the banking sector.
“If the last decade of bank supervision was about designing rules that lead to more resilient bank balance sheets,” wrote Ms Rogers, “the next will be about designing supervisory tools and strategies that lead to more resilient bank cultures.”
The March 2023 banking collapses have illustrated again that when supervision fails, poor risk management practices will fester, and problems grow and mutate. Moreover, they highlight the fact that well capitalised banks, which suffer nonetheless from poor reputations and weakened market confidence, are particularly vulnerable to contagion effects when panic ensues.
As an Expert Group on Banking Stability makes plain in a report issued earlier this month, Credit Suisse remained well capitalised until the end. Its demise “was caused by customers losing confidence in its management and in the bank’s business conduct”. Confidence is unlikely to have been restored by added capital alone and yet, to date, a majority of prudential regulators have focused policy prescriptions on expanding capital cushions. This misses the larger lessons that recent events impart.
Giving guidance
On September 11, the central bank governors and heads of supervision who make up the oversight body of the Basel Committee met to take stock of lessons learned from the recent banking turmoil. They rightly emphasised banks’ risk management practices and governance arrangements as “the first and most important source of financial and operational resilience”.
It is critical, they concluded, that supervisors “act early and effectively to identify and promptly correct weaknesses”. Going forward, this will mean strengthening supervisory effectiveness and identifying issues “that could merit additional guidance at a global level”.
And much guidance is clearly necessary. “For institutions that rely so heavily on that confidence, the success of a firm’s culture in contributing to that confidence is of critical importance,” observes Randy Quarles, past chairman of the FSB and vice chair for supervision at the Fed, in Starling’s 2023 Compendium.
“The challenge for bank examiners is how to assess a firm’s culture, and a management team’s work in fostering that culture, in a way that doesn’t simply devolve into vague, subjective, personal preferences — which are as likely to be wrong as right,” he said.
As international policy co-ordination and standard-setting bodies, the FSB and the Basel Committee must continue to explore new methods by which firms, and their supervisors, can assess the organisational drivers of success and failure in risk governance — and the oversight thereof. Ever-expanding volumes of prescriptive rules are unwanted here. Instead, the use of machine learning technologies by supervisors for industry-wide culture and conduct monitoring would provide better answers.
Such technologies already exist, and the relevant data resides within individual institutions, creating conditions for latent value extraction at costs well below those involved when systemic risks are made manifest and punitive fines ensue. Advancing rapidly, these technologies offer supervisors a means by which leading indicators of non-financial risks may be identified, system-wide, on a near real-time basis, positioning them to engage proactively in hopes of avoiding future crises.
And we expect that firms would welcome the development of reliable, transparent, quantitative metrics regarding such risks, as they are likely to find it far preferable that qualitative supervisory judgements are underpinned by defensible quantitative data analyses.
To be clear, this is not to dismiss the importance of experienced supervisory judgement. Rather, we urge supervisors to consider how their capacity to improve upon such would be expanded by reliable, data-driven metrics, applied consistently, thus enabling horizontal peer review on an apples-to-apples basis.
As we seek to draw lessons from this past spring and to set priorities to avoid future turmoil, we should consider how supervisory technologies might position us to exercise informed judgement from the front foot by equipping us with supervisory and risk management red flags.
Culture is alternatingly pointed to as culprit or cure when risk governance and the supervision thereof are found wanting. If assertions in either direction are to be credible and actionable, assessing cultural drivers of performance outcomes effectively must become a policy priority.
Stephen Scott (left) is founder and CEO of Starling Trust Sciences, a predictive behavioural analytics platform. Stuart Mackintosh is the executive director of the Group of Thirty, an international financial think tank.
