In "Morgan Stanley reviews position of risk officer over writedowns" (December 22, 2007), Financial Times reporter Henny Sender describes the hostile environment in which some risk management gurus live. Declaring that critics now accuse the Morgan Stanley Chief Risk Officer of being late in "sounding the alarm about the dangers stemming from the bank's exposure to sub-prime related trades" or having used "language that was too technical or obscure," advocates counter that his warnings were ignored. Not surprisingly, other banks are "overhauling their risk management function after announcing multi-billion dollar losses on subprime-related trades. (Morgan Stanley reported an approximate $10 billion loss.)
The article adds that Morgan Stanley's risk guru "was very vocal in saying that there were no proper pricing models for such trades, that positions were not being properly measured, and that the history traders used in their models was not a reliable guide." A further investigation will ultimately shed light on whether Mr. Risk at Morgan Stanley had the authority to effect significant change or was instead unaware of mounting exposures until it was too late.
The lessons to be learned here are far from trivial. Spending significant money to hire a risk wizard or team of pundits is a waste unless (a) the risk control function is recognized as essential to core operating activity and (b) these individuals are empowered to work independently of line managers. A new study suggests that the tide is turning though there is room for improvement.
According to "Beyond Compliance: The Maturation of CROs and Other Senior Executives" (GARP Risk Review, November/December 2007), researchers Annette Mikes and David Townsend describe the way Chief Risk Officers are encouraged to participate in "capital allocation and group-level budgeting and planning." At the same time, more than two-thirds of surveyed bank CROs expressed frustration at not being able to convince top management to improve risk disclosures included in public financial statements. Over reliance on risk models was cited as a concern of CROs, especially when credit allocation decisions are based on "automated model responses, with little oversight from humans." The article concludes that "the ultimate test remains the ability of risk managers to influence risk-taking behavior in the business lines."
As this blog's author wrote several years ago, Chief Risk Officers are part diplomat and part rocket scientist. Ultimately, their contributions are constrained by whether a risk culture exists within an organization. One can be technically competent but lack the organizational wherewithal to put out a fire. Read "Life in Financial Risk Management: Shrinking Violets Need Not Apply" by Dr. Susan Mangiero, Accredited Valuation Analyst, CFA and certified Financial Risk Manager.
Should pension and 401(k) plan sponsors care about bank risk management? Absolutely.
Since many retirement plans hire banks to manage assets or recommend bank funds to defined contribution plan participants, fiduciaries MUST include risk controls as part of their due diligence process when selecting, monitoring and perhaps firing money managers.
Some plan sponsors create and implement risk management policies that are separate from their formal Investment Policy Statement. Elsewhere, ERISA and public plans are hiring risk management professionals to go in-house. For example, the Ohio Public Employee Retirement System (OPERS) seeks a risk analyst who can perform tasks such as those shown below.
<< 1. Develops a comprehensive risk management program to identify, assess, manage and report investment related risks.
2. Oversees in coordination with the appropriate parties, the management of market, credit/counterparty, operations, reputation and other investment related risks.
3. Develops and participates in processes and procedures of reviewing, discussing and prioritizing risks in each major category.
4. Develops and reports risk metrics to monitor market, credit/counterparty, operations and other related risks.
5. Prepares periodic reports for senior management and OPERS Board to review investment related risks and makes recommendations, as appropriate.
6. Assesses risk management tools and capabilities, recommends improvements and implements approved solutions.
7. Reviews, monitors and oversees derivatives activities and capabilities for internal operations and for external managers in coordination with appropriate staff.
8. Performs on-site manager due diligence reviews from a risk assessment, management and monitoring perspective.
9. Leads and/or participates in various risk management committees.
10. Establishes and maintains a customer service focus work policy through example and clear, timely delineation of expectations. >>
.jpg)
