All directors now know that managing risk is what the banking business is all about. As a director, it is critical to ensure the bank has sound risk management processes, strong internal controls and is in compliance with all regulations. Those are the basics, but there are many ways to manage risk. As the current crisis has shown, understanding which ones to manage and how aggressively to do so are worth talking about.
The first of the major risks is credit risk. This can be defined in various ways, but it essentially boils down to the risk that a borrower will fail to perform as agreed under the terms of their loan. Lending is loaded with credit risk and some sectors carry more risk than others. Directors should endeavor to have a good handle on how to measure, manage and control this risk as conditions change.
Another key risk directors should focus on is liquidity. This is defined as the risk that the bank will not be able to meet its obligations (because it runs out of funding). Directors should have a good understanding of how the bank plans to deal with an unplanned drop in funding sources or an inability to liquidate assets quickly (with limited loss in value). All of these issues can impact the overall liquidity of the bank and having enough liquidity to manage day to day operations (as well as medium to longer term strategies) is critical.
Yet another risk most directors have heard about is interest rate risk ("IRR"). While IRR is usually dumped on the finance team to manage through the ALCO process, having strong knowledge of IRR should not be underestimated. IRR is the risk to bank performance that occurs when rates move. Sub-currents of IRR include repricing risk (mismatches in maturity and interest rate changes in a bank's assets and liabilities, such as funding a long-term fixed rate loan with a short-term deposit), basis risk (rates for assets and liabilities may change at the same time, but not necessarily in the same amount - deposit reprices more like Libor, while loan moves when Prime moves), yield curve risk (changes in interest rates may have different effects on similar instruments with different maturities) and options risk (the risk that an option will be exercised and end up hurting bank performance - such as a loan prepayment, nonmaturity deposits that can be withdrawn at any time, etc.).
IRR risk is rising as the economic recovery takes hold, so understanding the potential impact on earnings and performance is vital. In Jan in fact, banking regulators warned bankers that directors are responsible for the establishment, approval, implementation, oversight and annual review of IRR management strategies, policies, procedures and limits. They also said banks should be assessing the effects of interest rate shocks of at least 300 to 400 basis points. Clearly, IRR is not only important to understand, but also will become more important as the Federal Reserve begins to remove liquidity from the banking system in coming months.
Directors should also be aware of operational risk. This risk is less well known to many and is quite often only discussed in a roundabout fashion. In short, operational risk is the risk that weak IT, inadequate controls, fraud or unexpected catastrophes could result in losses for the bank. Having a good business continuity plan, proper monitoring and other tools are all important when it comes to managing operations risk.
Legal or compliance risks are other consideration for directors. These risks stem from the potential that the bank will get in trouble due to nonconformance with regulations or have contracts that are unenforceable. For legal risk, one easy way to remember this is to think in terms of potential litigation to the bank and the director.
Reputational risk is the risk that negative publicity will harm the bank. While difficult to measure, some studies show 74% of brand damage comes from improperly managing such risk.
In closing, directing a bank at times can seem like walking on a tightrope, but to get across without falling, it all begins with a decent understanding of the risks one is trying to manage.