Risk, return, resilience: The future financial system

Speech by José Manuel González-Páramo, Member of the Executive Board of the ECB, at 3rd Annual Risk and Return Russia Conference, Moscow, 14 April 2011

1. Introduction

Ladies and gentlemen,

As the crisis is still unfolding, we cannot tell with certainty how our economic and financial systems will function in the future. Unfortunately, based on past experience, we can safely predict that individual banks, and the financial system as a whole, will face new challenges, and even crises.

We, as risk managers, have the weighty responsibility of ensuring that our institutions are prepared to weather these financial storms. Our role is not to eliminate the risk faced by an institution – this would not be possible or even desirable. In order to create resilient institutions, our role must be to act as guardians of the balance between risk and return. To do this, we must learn lessons from history; however, we should not be blinkered by history – we must use our knowledge of the past, combined with our intellect and our imagination, to anticipate and design appropriate responses for the challenges of the future.

In response to the crisis, a new risk control framework is evolving in many of our institutions. This framework puts risk management at the core of the decision-making process. Today, based on lessons learned from the crisis, I would like to highlight some of the principles which should guide the development of this new approach. Moreover, since this framework will require powerful quantitative and judgemental based tools to guide decision-making, I would like to highlight the importance of taking a twin pillar approach so that the risk to which an institution is exposed is recognised and controlled – here, I am referring to the twin pillars of statistical risk models and stress testing. Although today I will focus on the framework being developed by institutions in the private sector, I would like to point out that many of the guiding principles as well as the quantitative and judgemental based tools are equally relevant in public institutions such as central banks.

2. The importance of the financial system ^[1]

Before considering this new framework in more detail, let me first emphasise that the role of institutional risk managers and institutional-specific risk control frameworks is more significant than simply protecting an individual institution from failure: the concerted efforts of risk managers, regulators and central bankers can – and indeed must – ensure the resilience of the entire financial system.

Why is the resilience of the financial system so important? The financial system is the lifeblood of the real economy. It touches all facets of our economy from households to corporations and even governments. Although much could be said about the positive contributions of the financial system to the real economy, for the sake of brevity let me highlight three contributions which I believe are of fundamental importance:

1. First, an important role of the financial system in the real economy is to intermediate between savers and borrowers to create a mutually beneficial symbiotic relationship:

   • From the point of view of borrowers the existence of sound financial intermediation means that people can obtain mortgages to buy homes; entrepreneurs can obtain funding to bring new ideas and innovations to life; and governments can undertake long-term projects to build roads and hospitals.

   • From the point of view of individual savers lending through a sound financial intermediary is less risky than lending directly to borrowers since intermediaries screen potential borrowers; perform ongoing due diligence; diversify over many loans; have expertise in assessing the risk in investment strategies and importantly financial intermediaries can provide savers with the level of liquidity they require.

2. Second, capital markets on one hand can give corporations access to funding allowing them to invest and grow their businesses, and on the other hand the reliance of a corporation on capital markets creates incentive for good governance in order to entice and retain shareholder investment.

3. Third, financial products allow businesses to hedge against risks such as adverse interest rate and exchange rate movements, allowing entrepreneurs to concentrate on growing their core business.

The seeds of the crisis were sown when the financial system began to loose its focus on these core services:

• ‘Originate-to-distribute’ business models meant that institutions no longer fulfilled their primary function of performing due diligence on borrowers.

• Investors purchased opaque financial products such as securitisations but were unable to undertake adequate due diligence of the instruments they held, instead they relied blindly on the judgements and the assessments of third parties such as credit rating agencies

• The risk involved in investment strategies was not properly assessed, in particular the probability and impact of tail events.

• Rather than relying on deposits from private savers, some financial institutions began relying on wholesale funding markets which are much more sensitive to confidence-related shocks.

• Some institutions began investing in complex financial products whose function had little to do with economic fundamentals, for example re-securitised products such as CDO squared;

The crisis has demonstrated in no uncertain terms that the behaviour of financial institutions has the power to inflict great harm on the real economy. As a result of the crisis, trust in the financial system has been damaged. Regulators and central bankers have now started on the long road to rebuilding this trust:

• The regulatory and supervisory framework for financial institutions is currently undergoing a major overhaul to close the gaps identified by the crisis – for example Basel III and Solvency II will strengthen the capital and liquidity positions of financial institutions and thus enhance the resilience of the financial system as a whole.

• Initiatives to improve the transparency of the financial system have also been launched. For example, in cooperation with market participants, the ECB has launched the ABS loan level project. This is an initiative to make loan-by-loan data available for European asset-backed securities. The aim is to promote greater transparency in these historically opaque instruments in order to foster renewed confidence in securitisation markets.

• Steps are being taken by regulators and central banks to reduce their over-reliance on external credit assessments. ^[2]

Risk managers also have an important role to play - using the new regulatory framework as a sound foundation, the risk control framework for the future needs to be implemented to ensure the resilience of individual institutions and to contribute towards the resilience of the financial system as a whole. A resilient financial system will have a positive influence on the economy as a whole.

3. Challenges facing individual institutions and the global financial system

Now, let’s consider some adverse scenarios which could serve as food for thought for risk managers when designing a risk control framework for the future. Even during the relative calm of the last few decades there have been numerous crises in different parts of the globe – some which impacted only individual institutions while others which have been systemic in nature. Although these events never seem to repeat themselves in exactly the same way, it is possible to identify some common causes and triggers. For each of these causes and triggers, risk managers need to ask themselves the question ‘How would my institution cope if …?’

Due to the nature of finance, it is not uncommon for individual banks to face challenges. These challenges come in many shapes and forms: for example, a counterparty default, a credit rating downgrade, the withdrawal of a secure funding line, the overvaluation of assets, an upsurge in non-performing loans, flight of deposits, or outright fraud. These are potential adverse scenarios which a risk manager must consider when preparing for the future.

Of course banks do not exist in isolation: they are subject to their economic environment. Therefore, in collaboration with supervisors and regulators, risk managers need to prepare for the eventuality of systemic crises in the markets where they operate. For example:

• Many of you sitting in the audience today will have experienced first hand the devastating impact of the currency crisis which Russia experienced in the 1990s. Directly, this impacted banks reliant on foreign borrowing. Indirectly, bond and equity prices collapsed and the resulting depression resulted in higher levels of nonperforming loans. ^[3] A risk manager needs to understand the direct and indirect impact that an event can have on an institution by evaluating well thought-out and comprehensive potential adverse scenarios.

• During the past decades, assets have played an increasingly important role in many economies. Therefore the boom and bust cycles of asset prices can have far-reaching consequences economically. For example, we witnessed the severe impact of a property price bubble in Japan in the 1990s. Currently, we are witnessing a sharp increase in commodity prices, as the growing emerging economies account for an increasing share of global consumption. The role of risk managers is to evaluate and prepare for the impact of a downturn in prices.

• In recent decades we have also witnessed crises in emerging markets where economies have overheated. For example the Asian Crisis in the late 1990s first became evident in Thailand before quickly spreading to neighbouring countries and led to fears of wider economic impact due to financial contagion. A risk manager must consider where the risks may lie in the future, for example by considering the impact of a financial slowdown in important emerging economies like Brazil or China.

• In light of the current banking crisis, it is evident that the impact of the activities of lightly regulated entities on the financial system cannot be ignored. In particular, risk managers must become more aware of the risks associated with the off-balance sheets activities of their own institutions since the crisis has revealed that these activities can have a direct impact on the financial health of the institution.

With these adverse scenarios in mind, it is clear that the risk control framework needs to be robust and comprehensive so that institution-specific events or wider economic challenges don’t create a crisis for the institution.

Let us now consider how the risk control frameworks of the past need to evolve to meet the challenges of the future.

4. A robust risk control framework for the future

The role of the risk control framework is to evaluate the risk inherent in the business activities of an institution and to ensure that these risks don’t endanger the institution even in extreme circumstances. However, financial institutions have struggled as the current financial crisis has unfolded and many have not been able to withstand the shocks that the financial system has experienced. But exactly why did these failures occur? Well, the diagnosis is clear: industry reports highlight that the risk control framework in many institutions was not robust enough, due primarily to weak governance and lack of understanding of the risks inherent in the business strategies adopted. The reports conclude that risk management reforms are necessary to create stronger institutions and a resilient financial system. ^[4]

Individual institutions and the financial industry as a whole are learning from experience and are now developing a resilient risk management framework for the future. This framework should be built following some guiding principles and should be supported by a comprehensive risk management toolkit, namely the twin pillars of statistical risk models and of stress-testing programmes.

I would like to add that central banks do not consider themselves exempt from the implementation of such a framework. Central banks, as public institutions, are accountable to the citizens they serve and must lead by example: In normal times, the core functions of a central bank include conducting repurchase operations to implement monetary policy and the investment of public money. In order to do this prudently, a framework must be in place to assess and mitigate the associated risks. Moreover, in times of crisis a central bank must act as the Lender of Last Resort and take socially necessary risks to safeguard the stability of the financial system. Inevitably, this means additional credit risk exposure. However, this additional risk should not be borne blindly: it is essential that the risk control framework can quantify the true magnitude of the risk borne by the central bank.

4.1 Principles for a risk control framework

Let us now consider four guiding principles around which the risk control framework should be built. ^[5]

1. First, and most important, is the principle of sound governance: The voice of risk management must be independent and within the boardroom must be at least as powerful as that of the revenue-makers: good advice from risk managers is worthless if senior management do not listen or are not fully committed to controlling the risks generated by revenue-makers. Clearly, this first principle is the base upon which the other principles stand. If this principle is not followed, then the impact of the other principles is, to all intents and purposes, nullified.

2. Second, there needs to be a clear understanding of the risk inherent in the business model adopted by the institution. The risk control framework needs to give a bird’s eye view of the risks associated with the high-level overarching strategy, individual business lines and specific portfolios. Even the risks associated with the off-balance sheet activities of the institution cannot be overlooked. Let me illustrate the importance of each of these considerations by drawing on some of the lessons of the crisis which I briefly mentioned earlier:

   • The crisis highlighted the vulnerability of some business models, in particular those models which relied heavily on wholesale markets for funding. It is clear that the liquidity risks associated with such a model were not properly assessed or understood. Consequently sufficient contingency measures, such as adequate liquidity reserves or alternative sources of funding, were not in place to cope with the evaporation of liquidity in stressed conditions. Therefore it is essential that the risk framework can properly assess the risks associated with the high-level business model and that steps are taken to mitigate these risks.

   • The crisis showed that many institutions did not properly understand the risks associated with the complex instruments which they held in their portfolios and that there was a blind reliance on the trading strategies or the assessments of others, for example so-called ‘smart’ market participants or rating agencies. Therefore a robust risk framework must be able to drill down to a granular level so that the risk associated with individual portfolios can be analysed.

   • The crisis revealed that the activities of lightly regulated entities were not as de-linked from their originators or sponsors as was previously thought. During the crisis many institutions had to bring the assets of the lightly regulated entities to which they had close links onto their balance sheet when the entities ran into trouble, although in most cases there was no legal onus to do this. The reason for such action was to help protect the reputation of the regulated institution in the markets.

   When defining the business model and strategy of a firm the risk tolerance of the institution needs to be clearly defined and communicated to all business lines. The risk control framework needs to include explicit checks and controls to ensure that the actual risk profile of the firm stays line in with the risk tolerance of the financial institution.

   Furthermore it should be recalled that the potential for high returns goes hand in hand with high risks, therefore when developing business strategies a balance needs to be struck so that long run profitability can be ensured. In particular the risk control framework should be able to identify the risks associated with high profit business lines so that this can to be signalled to, and understood by, the highest level of management.

3. The third key principle is the concept of diversification: It is clear that an institution which has well diversified activities is better placed to weather challenges. However, as our global economy becomes more interconnected the traditional definition of diversification must be re-examined: diversifying across equity, market and credit risk is no longer enough – institutions also need to consider business lines which are less sensitive to the business cycle. 
Having said this there is still room in our financial system for specialised banks which have the expertise required to take particular risks onto their balance sheet. For these banks which lack the cushion that diversification provides, the second principle which I mentioned, a clear understanding of the risks inherent in the business model, is paramount. ^[6]

4. Fourth and finally, the strategy of an institution should be forward looking: The risk control framework should look ‘through the cycle’ and in particular identify and seek to mitigate the risks associated with pro-cyclicality – that is the exaggeration of the peaks and troughs of the natural economic cycle. For example, the institutional risk control framework must account for the risks associated with following similar strategies as other market participants particularly during the contraction phases of economic cycles, when many firms may be unwinding similar positions at the same time. Here, of course, the individual institutions can benefit from the counsel and guidance of the macro-prudential supervisors.

4.2 Strategic decisions should be guided by a two pillar analytical approach: A toolbox of statistical risk models and a comprehensive stress-testing programme

In order that these four core principles can be followed, the tools used within the risk control framework need to be capable of evaluating the totality of the risk the institution faces. Furthermore, it should be possible to communicate this evaluation in a concise but comprehensive way to all stakeholders in the institution. In order to achieve this, a comprehensive risk evaluation toolbox needs to be put in place. This toolbox should comprise of a suite of complementary statistical risk models and a comprehensive stress testing programme.

First let me highlight some considerations regarding the statistical risk models before turning my attention to the concept of stress-testing.

A toolbox of complementary statistical risk models

We use statistical risk measures such as value-at-risk, expected loss or expected shortfall to assess the risk facing an institution. However, as I’m sure you are aware, statistical risk models have been subject to strong criticism in recent times since the crisis has brought the shortcomings of some of these models to light. Nevertheless, this does not signal the death toll for such models. On the contrary, statistical models, properly used, will be an important component of the risk control framework since they allow us to compress the myriad of risks facing an institution into a few easy-to-understand figures.

There are some common-sense guiding principles which will ensure that this toolbox is used in a constructive manner to evaluate and control the risks faced by an institution:

1. First, and perhaps most importantly, risk models are a tool: they are created to help aid our understanding of risk but are not there to replace the intellect of a risk manager who must interpret their output in a meaningful way.

2. Second, risk models should not be used in isolation: every model encapsulates a different version of reality therefore using different models helps to build a more representative picture of the risks facing an institution.

3. Third, risk models by their nature make simplifying assumptions regarding reality. Therefore limitations of individual models should be clearly signalled. If the limitations of the model are not properly understood then this can lead to misinterpretations of the output. For example, statistical models may work well under normal market conditions but not under stressed market conditions where accessing funding may become more challenging or liquidity may evaporate.

4. Fourth, since statistical models use historical data to anticipate what might happen in the future, accurate and representative historical data is a basic requirement as without this, even the most sophisticated model is worthless.

5. Fifth, the field of statistical risk modelling is still evolving but it is important when developing new models that emphasis is placed on ease of use and calibration and that model outputs are easily interpreted and understood: sophisticated models are worthless if it is not possible to derive realistic input assumptions from the market or interpret the output in a meaningful way.

With these guiding principles in mind, it should be possible to create a statistical risk toolbox which can help inform the decision makers of an institution.

A comprehensive stress-testing programme ^[7]

Now let me turn to the second pillar of the risk analysis toolbox – namely a comprehensive stress-testing programme. (Of course, I refer here to an “internal” stress-testing programme which is designed and executed by the institution itself, rather than the “external” stress-tests carried out by regulators such as the European Banking Authority.) An internal institution-specific stress-testing programme should be used to complement statistical risk analysis since a well-developed programme will allow decision-makers to gain an insight into what happens in extreme circumstances or so-called ‘tail-events’.

In the past, stress-testing in an institution was normally done in a rather ad-hoc way, for example:

• sensitivity tests were carried out to check that statistical models where not concealing potentially large risk exposures due to their specific assumptions and limitations, or

• mechanical stress tests were carried out, for example, increasing interest rates by a certain – rather arbitrary – factor to determine the impact on a particular portfolio.

Although sensitivity tests and mechanical tests have their place, such tests are not necessarily a reflection of reality. So while these tests may be stressful, it is difficult to interpret whether they are in fact plausible.

This, of course, must be the core tenet of a comprehensive stress testing programme: scenarios should be ‘stressful but plausible’. To achieve this, institutions are placing less emphasis on the ad-hoc tests of the past and are implementing an approach whereby scenarios are defined by considering a set of coherent events; the impact of these events on the institution, on business lines and even on individual portfolios and positions is then examined.

In order to ensure that such scenarios are indeed ‘stressful but plausible’, this programme cannot be the sole responsibility of risk managers – all business areas within the institution need to be involved, and macro-prudential supervisors consulted, so that the end-result is credible. For inspiration, to those of you who will take up the challenge of developing such a programme, let me recall some of the adverse scenarios I mentioned earlier:

• on one hand, institution-specific (and even business-line specific) events need to be considered: a counter-party default, a credit rating downgrade, the withdrawal of a secure funding line, the overvaluation of assets…

• on the other hand, and perhaps more importantly, macroeconomic scenarios need to be considered: for example asset price bubbles, slowing global economies, the impact of difficulties in the less regulated markets.

Once an array of scenarios have been chosen, these skeletal scenarios must then have meat added to them. The chain reaction resulting from the initial scenario needs to be developed: for example a slowing emerging economy may or may not have a large direct impact on an institution, but what if an important counterparty is exposed? Or what if the slowing emerging economy causes a collapse in the demand for commodities, how would this affect internal portfolios? Is the institution indirectly affected by a collapse in commodity prices due to high exposure to commodity-rich countries? ... and so on.

The impact of such a scenario on an individual institution can be determined by looking at historical data, but it is not reasonable to assume that the world is not changing; we must also prepare for risks which have never occurred. To help us economic forecasts and analysis play a role – but our judgement and imagination are also indispensable tools.

To develop such a comprehensive stress-testing programme is not a trivial task. It will require an investment of time and resources. But there are high dividends to be reaped: institutions with such a programme will surely be better placed to survive the next crisis.

5. Conclusion

Let me conclude.

In the years leading up to the crisis, too often, in the clamour for ever higher returns, the voice of reason was not heard and risks were ignored. The crisis has exposed this and has revealed significant shortcomings in the risk control frameworks of financial institutions. In particular, the failure to properly assess the risks inherent in business models, in portfolios, and in off-balance sheet activities has become evident. Consequently, a rebalancing of risk and return is required to ensure resilient institutions and a resilient financial system.

To achieve this, a strengthening of the risk control framework is needed so that our financial institutions are ready to face the challenges that lie ahead. Such a framework needs to put risk management at the heart of the strategy and decision making processes of each institution. The framework should be supported by the twin pillars of risk analysis, that is a suite of statistical risk models to provide a measure of the different risks faced by the institution and a comprehensive stress testing programme which consists of a more judgemental and coherent risk analysis based on scenarios that the institutions may be facing in the future.

I will leave you with a final reflection: although the global economy may show signs of recovery, many uncertainties remain. There is no room for complacency as new challenges will undoubtedly arise. We must act now to rigorously implement risk control frameworks so that we are prepared to face the next challenge from wherever that may come.

Thank you for your attention.