We found it interesting that one study we read indicates the average user spends 49 minutes per day managing email. Yet another study indicates email costs the average company $20,990 per worker, per year. These data points certainly indicate how much information flow has drastically increased over the years.
One area where bankers have been seeing more information flow is around Enterprise Risk Management ("ERM"). While the ERM movement was picking up steam prior to 2008, post crisis, it is surging forward.
ERM covers a broad spectrum of issues, but from a high level, it breaks down into the key risk considerations. These include aligning risk appetite with strategy; reducing operational surprises that generate losses; enhancing risk response decisions (so the bank can better respond when issues arise); identifying risks and managing them across the company (including subsidiaries); improving how the bank deploys its capital; and taking advantage of opportunities that fit both risk appetite and objectives.
To set risk appetite, it is important to agree on a common language in which to quantify risk. Next, management should evaluate strategic options, set objectives and ensure structure is provided to manage the risks around those decisions. A strategic planning session is a great time to consider exactly what risks the bank is willing to take and which ones are not going to work, at a baseline level. Once this foundation is in place, banks will need to make sure they also have a safety valve in place. This requires identifying and choosing among multiple possible responses for each risk that arises. These can include avoiding a risk altogether, accepting it, moving to reduce it in some fashion, or even sharing it with another organization (as occurs when one hedges interest rate risk for example). These risks are presented to the board and risk tolerances are set, around which the bank will operate.
Another focus of the bank should be to work to identify potential events that can occur that might result in a material loss to the organization. While the focus here is on operational activities, determining which ones carry the greatest loss potential for the bank is important. That allows for contingency planning to occur, to isolate, control or otherwise mitigate these risks.
The next consideration is also one of the most difficult, so hold on as we go through it. Once risk appetite has been set and events have been identified that can cause the bank pain; the next move is to put in place processes to identify and manage risks. This should be done across the entire organization, since one unit's response to a risk can create additional risk in the overall entity (such as reputational risk which can occur when a product is cut or a new product is launched that customers don't care for). Risk is interrelated and interconnected, so taking the time to carefully map risks out one at a time is worth its weight in gold. Once you have risks properly mapped out and everyone understands the high level cause and effect of potential actions (for example, growing assets increases funding and credit risk), risk planning goes to the next layer down as it considers other potential issues around the high level ones (such as the risk of diversifying into C&I, when everyone else is trying to do the same thing at the same time).
No matter what you do or how you do it, one cannot ever be certain all risk has been controlled at the bank. Having strong risk management information systems based on capital allocation however, is a decent way to get things rolling. Periodically ask yourself how much capital is needed to support this activity or that activity and then allocate it to calculate return. If the return isn't high enough, think about what options the bank may have to boost return, within an acceptable risk framework. Do this and we venture to say you will save both time and money, as you move to establish a strong ERM program for your bank.