Nothing hurts more than a bolt dropped from the 4th floor of a building onto your head. That is why you will always see people wearing hard hats at construction sites. Community bankers that make a lot of construction loans would do well to learn this lesson from the building industry, as they protect themselves against financial risk. Banking is filled with risk. Whether it is the risk of a loan going to nonaccrual, a customer leaving and taking their deposits to a competitor or the risk of opening a new branch that never achieves breakeven - bankers struggle with risk every day.
To control risk within a bank these days, more community bankers have begun to hire Chief Risk Officers ("CROs"). Studies find that nearly 70% of banks either already have a CRO, or will have one within the next 2Ys. In our humble opinion, community banks with assets > $300mm to $500mm should seriously consider having a CRO. While we have written about the value of having a CRO and a comprehensive risk management process before, given this time of heightened economic uncertainty and risk; we felt many bankers might appreciate a refresher.
To begin, most bank CROs have many functions and areas of responsibility, but all of them should have a common thread of controlling and managing risk. Specifically, the CRO should have responsibility for managing overall credit, market, operational, interest rate and other risks. To do the job effectively, the CRO should also ensure the bank has adequate risk analytics, board and management reporting, as well as proper policies and procedures to adequately monitor, manage and control risk.
Some of the most critical areas of responsibility for any CRO include:
- Providing vision, expertise, direction and leadership for risk management across the entire organization.
- Implementing risk metrics and reports to highlight key risk exposures and provide early warning indicators to management.
- Developing risk management policies and procedures.
- Setting risk limits commensurate with the board's risk appetite.
- Working to develop a framework of risk transfer among business units. This can include assigning economic capital to various areas of the company based on risk. Doing this allows banks to better manage precious capital, while optimizing the overall risk portfolio.
- Providing training so that employees are prepared for contingencies and understand how to respond to physical emergencies.
- Assisting management and the board in setting risk-based performance measurement and incentives. This provides a good start to any integrated risk management framework and ensures risks and rewards are aligned over time.
These are but a few examples of the key roles and actions a CRO should play within a community bank. No matter where you are in the risk management process, or whether you have even decided to hire a specific CRO to help manage risk exposures, understanding what this person does is a key first step. While it may be debatable whether having a CRO creates additional profit, it is clear (given current headlines) that not having one provides as much protection as leaving your hardhat at home.