United States: What Really Drives Risk? Lessons From Financial Services*

With billions of dollars at stake in their credit portfolios and trading operations, banks have been forced to look much more closely at the risks they take every day (and every minute of the day). Yet many financial institutions ignore a much more fundamental type of risk: their choices about which markets to participate in, how to compete in those markets and the impact of those choices on the risk profile of their institutions. Call this "strategic risk," if you will.

A 2004 Marakon study of the long-term performance of 1,400 leading U.S. corporations, including all the major financial services firms,¹ found that two factors drove the risk profile of the companies: whether they competed in markets and segments with attractive economics, and whether they were competitively advantaged in those markets/segments. Companies that made poor choices on these two dimensions had six times the risk (defined as the volatility of a company’s earnings relative to its level of earnings) compared to companies that were advantaged on both dimensions.

How can companies reduce such strategic risk? Only by rethinking their approach to risk management, which today emphasizes the avoidance of operational disasters, policing activities after the fact, monitoring risks in separate departments and tracking short-term risks. Instead, risk management must become a subset of capital management (not the other way around) and be fully embedded in the company’s strategic planning process rather than an adjunct or control mechanism. The path that financial services firms have traversed, and where they need to head in the future, is instructive for companies in all industries.

The amount of risk that banks are taking in pursuit of greater returns is staggering and on the rise, according to several leading business publications.² At face value, the figures on banks’ exposures are immense. For example, the notional value of the derivatives portfolios³ of the world’s 10 largest banks in 2003 was close to $70 trillion, a considerable multiple of their capital base or market value – and, for perspective, seven times the size of the U.S. Gross Domestic Product. The global market for credit derivatives has grown from $2 billion in the early ’90s to more than $2 trillion today.

Advancements on many fronts – computer and telecommunications technology, concepts in assessing and pricing for risk, even laws and regulations – have increased the opportunities and cut the costs for offloading risks that could not have been reduced only 10 years ago. Clearly, this diversification has a benefit. For example, after lending telecom companies hundreds of billions of dollars in the mid- and late ‘90s, banks largely escaped the subsequent meltdown of equity values and spate of high-profile casualties in the sector (the impact on a few year-end bonuses notwithstanding).

But just as comedian Steven Wright once observed, "I just lost 10 pounds…where did it go?," that risk went somewhere. It didn’t leave the system. One clue is that non-bank purchasers of syndicated debt consume one-tenth of the volume but almost one-quarter of the bad credit. So there’s one benefit, at least, of having a hundred (or even a thousand) times more credit analysts on the seller’s side of the table than on the buyer’s side. Another possibility is that insurance companies or pension funds are stuck with a significant portion of the remaining loss, the true nature and magnitude of which will take time to be revealed behind the Byzantine accounting rules of those types of institutions.

Despite the diversification of risk offered by these increasingly complex financial products, recent reports on the "value at risk"⁴ show an increase of 20-40% in the exposure that many of the largest financial institutions are willing to pursue in search of greater returns. Although this rise is notable, other factors should be of greater concern to shareowners:

• Companies, especially banks, are far more (or sometimes far less) at risk than they believe themselves to be, leading to false choices and incorrect trade-offs between risk and reward (e.g., the belief that diversification always lowers risk), and value-reducing strategic and operational decisions

• Managers rely on inappropriate or incomplete metrics such as RAROC (for "risk-adjusted return on capital") and Basel II–type metrics of "risk" that don’t capture what really drives risk from a shareowner’s perspective

• The risk management functions at even the most sophisticated financial institutions typically invert the hierarchy of risk management actions, focusing on policies that affect operational risk (such as capital adequacy and trading limits) while under-weighting or ignoring the inherent risks in their product market strategies – in other words, strategic risk.

While there are numerous ways to assess risk, viewing how investors and lenders look at it is useful. Shareowners express their assessment of risk through the cost of equity, which reflects the benefits of holding a widely diversified portfolio of investments. For this reason, shareowners will not reward an institution for mitigating risk in a manner that they could do better themselves (meaning more easily, cheaply and tailored). Debtholders are similar in that the cost of debt and the terms of the instrument reflect the benefits of holding a widely diversified portfolio – with some benefit accorded to diversification due to the effect of cross-subsidies within a portfolio (i.e., disastrous results in one unit, geography or customer segment can be offset by other areas).

But hearing that investors have "fully priced into the stock" the risk that a given company might fail does little to ease the minds of the managers of that company. While agency costs (where the interests of the owners and their agents – the professional managers – may diverge) are well understood, they are very hard to counteract, particularly in the hazy realm of assessing risk and reward. For example, in the recent spate of large U.S. bank mergers, acquirers have touted geographic and/or business mix diversity as one of the top benefits of the combinations.

But what do these deals really accomplish for shareowners other than placing a bet for them that the potential cost savings and revenue gains from cross-selling will overshadow the premium? Very little, according to research by the Federal Reserve Bank of New York. A recent report summarized the impact on risk of the last 10 years of bank mergers as follows: "…it doesn't seem to be hurting, but it's hard to make the case that this is working."⁵

In Europe, many proposed and speculative cross-border bank acquisitions have also included a sizable element of supposed diversification benefits to justify the likely frothy price and uncertain cost savings. But several banks show that diversification is not necessary to deliver high and stable returns. One of the best-performing and most creditworthy financial institutions, Wells Fargo, is also one of the least diversified, focused largely on retail banking, on California and, as it turns out, on making money.⁶

Most risk measurement models used by managers, such as RAROC, focus on volatility without much consideration of the profitability or the underlying drivers of profitability and growth for the business. As a result, these "risk-adjusted" models impute capital (to serve as a cushion to guard against unexpected losses) in a manner that is different from how the capital markets would otherwise dictate.

While many of these models capture volatility from credit losses, banks can and do suffer unexpected losses from other forces. For example, banks – just like any other business – are exposed to unexpected (and usually unfavorable) pressures on non-interest expenses and income, none of which is captured by the traditional risk-adjusted models. Moreover, while net margin risk – in terms of "gaps" with treasury markets – is typically covered in these models, net interest margin volatility due to competitive pressures is not.

All of these overlooked forces impact profitability, and the capital markets care a great deal about these in setting the price of securities. So do credit analysts and ratings agencies in assessing creditworthiness. In these communities, profitability and the ability to generate robust growth in the top and bottom line play a starring role compared to the cameo role they play under RAROC modeling and concomitant decision-making.

While credit and trading losses are often viewed as the major sources of risk at most banks, our research indicates otherwise. Strategic risk is far greater than operational risk. In studying the long-term results of 1,400 leading companies, we found that risk – when measured as the ratio of volatility of earnings divided by earnings⁷ – is driven primarily by the choices that companies make about what markets and segments to participate in and the strategies for how to compete in those markets and segments. Choice of markets and market segments (e.g., product, channel, geography, customer) is crucial. Markets and segments with favorable economics are those in which the average player earns more than the cost of equity capital over time. Companies that are advantaged in their markets earn peer-beating returns via strategies and capabilities that deliver lower costs, better pricing discipline, better products, better selection and better management of customers (see Figure 1).

After analyzing the markets and strategies of these 1,400 companies, we found a strong correlation between companies operating in favorable markets with competitive advantages and those enjoying lower earnings volatility. Specifically, as shown in Figure 1, we discovered companies that were disadvantaged on these two dimensions had six times the risk of those that were advantaged on both dimensions.

Why Strategic Risk Is Substantial Risk
Why is participating in the right markets with the right set of strategies and execution so critical to reducing risk? Two factors help to explain this finding. Banks that focus on profitable markets where they can maintain an advantage earn higher returns (resulting in a higher denominator in the calculation). That somewhat obvious conclusion, however, accounts for less than half of the observed six-fold difference in risk. The remainder is driven by lower volatility of earnings (resulting in a lower numerator) – a finding which flies in the face of common wisdom about the so-called "risk-return trade-off." In fact, in the product markets, there is no trade-off between strategies that pursue higher returns and strategies that pursue lower risk. Strategies with higher returns – driven by better choices and execution in which markets to serve and how to compete in them – are at the same time lower-risk strategies. So rather than capital or liquidity being the best cushion against a downturn in the markets, it is competitive advantage that provides the best protection (see Figure 2).

So do most banks manage risk this way – i.e., emphasizing strategic over operational risk? Unfortunately not. Instead, three practices are common:

• Most of their public communication on the management of risks (in annual reports and other filings) is about "avoiding disaster." Occasionally, they mention how certain tools enable better tactics (e.g., pricing of loans to consumers) or more effective decisions (e.g., proprietary trading), but seldom do they mention risk management writ large as important in creating long-term company value.

• Risk management functions are usually run as separate departments (sometimes, many separate departments), with uninterrupted reporting lines upward as a way to ensure independence and objectivity. While this no doubt achieves independence, it can bear the high cost of balkanized information. That degrades the quality of the dialogue due to the division of expertise and the inevitable "I’m from the IRS and I’m here to help" mentality that ensues.

• Risk management activities typically are focused on near-term indicators – the next six to 12 months or in some cases, a bit longer (one to two years). Either way, the policies and limits are oriented toward decisions at the margin (e.g., should we make this loan or participate in this deal, or not?). While these policies are necessary – they can help prevent trading losses of the type that rogue trader Nick Leeson made, triggering the collapse of the venerable U.K. merchant bank Barings – they do not properly inform decisions on strategy (which markets the bank should participate in, with what kinds of offerings). These are the longer-term decisions that truly impact the risk profile of the bank. Typically, more than half the value of any institution is driven by investors’ expectations for cash flows after the next five years.

This isn’t to say that risk management hasn’t improved substantially over the last 15 years – it has (see any of Alan Greenspan’s recent speeches before the U.S. Senate Committee on Banking for elaboration). But the fact is, most banks – even some of the best-run institutions – have their risk management agenda items in the wrong order. At the top of the list are items on capital adequacy and VAR limits (and the like); at the bottom (if at all) are the inherent risks in the bank’s product market strategies.

To reduce their most fundamental risks, banks must view their risks in an entirely new light. First, they must regard risk management as a subset of capital management – not the other way around. (By capital management, we mean the decisions on where, when and how to invest the institution’s capital.) Driving changes in capital management is often necessary to ensure that changes in risk management practices will translate into better decisions and better performance.

Obviously, this is a much broader topic and more significant challenge than refining risk management. Here are some ways to get started along the path:

• Establish an explicit and measurable risk standard. For example, bank managers can do this by ensuring that they earn a given credit rating (throughout interest, credit and other cycles). This will go a long way toward ensuring that a consistent definition of risk is used as a backdrop for dialogues on strategy and capital management, focusing those dialogues on the true drivers of risk (both short- and long-term) and mitigating agency costs or, at a minimum, exposing them to harsher light.

• Improve management’s "line of sight" on the sources and drivers of profitability, growth and volatility (at least down to the level of individual product markets). This will allow for trade-offs and decisions at a level that minimizes undesired and suboptimal impacts in other areas. For example, determining the risk of certain macro-level market participation decisions (e.g., to increase or decrease investment in private equity, Argentina, etc.) demands an "it depends" answer. It depends on the shape of the existing portfolio; it depends on the strategy and expected returns of the anticipated investment; and so on. A better but still incomplete question would be to determine the changes in the portfolio that would make such a participation decision risk-neutral. Addressing that question requires a deeper understanding and dialogue of the drivers of risk and return. However, the answer is still likely to be insufficient. As an example, a leading North American retail bank debated dramatic and very different ways to restructure the franchise while reducing the volatility of its underlying businesses. The managers running major products and market segments knew there was deadwood within the portfolio, but eliminating it would result in unacceptable costs or risks elsewhere in the portfolio. Only when the portfolio was scrutinized at a much lower level – down to the level of customer sub-segments – did they find that only 4% of the customer base contributed materially to the risks within the portfolio and destroyed profits equal to what the other 96% earned! Even the most ardent proponents of the "it’s-all-fixed-costs" school of thinking recognized the need to change.

• Initiate a "capital recycling program" to increase the share of investment flowing to profitable markets where competitive advantage can be maintained. Kick-start this effort with a goal of recycling 10-20% of capital within one to two years. This "tail-wagging-the-dog" effort will help to move capital around the portfolio. More importantly, it raises the bar on the types of dialogues (around information, alternatives and analysis) that are necessary to make decisions of this magnitude with confidence. Establish an end goal of having 80% of the portfolio invested in the "upper right-hand corner" of Figures 1 and 2 (i.e., profitable markets where competitive advantage can be maintained).

• Ensure that the strategy development process has real consequences and, as a result, that other key management processes are driven by strategy approval. This means that investments in capital and other resources are made as a result of strategy approval, not through a separate capital allocation exercise. Budgets are therefore determined from the forecasts implied in managers’ strategy discussions, rather than in reverse order to accommodate a predetermined budget figure.

• Have high-quality dialogues on strategy development and execution. This doesn’t mean reams of data and slick, thick binders. To the contrary, it means concise and compelling explanations for a short list of items, including:

• Give risk professionals a "seat at the table" in strategy development discussions that will ultimately reduce the institution’s strategic risk profile. In many instances, representation from risk management in strategy discussions is limited to what could best be described as a fiduciary role – commenting (where appropriate) on risk-focused topics, rather than participating early, broadly and deeply on how the bank’s strategy should be planned and executed.

• Catalog current policies used to manage the drivers of operational risk (such as capital adequacy, liquidity, hedging, concentration and trading limits) and have senior line management perform a "sense check" to ensure that the policies do not duplicate each other and that the full breadth of policies is used in light of the changes described above. As one senior trader commented shortly after a merger, "My decision checklist went from three items in the old bank to almost 900 in the new one. How can that be right?"

• Align the incentives of top management with those of shareholders, namely long-term growth in the company’s value. The nature of the labor markets and the "tail risk"⁸ of some of the products makes this difficult to do, at least completely. But a tighter alignment in incentives (and behavior) will reduce agency costs and allow the risk management function to do more than avert disasters and perpetually play "bad cop."

The changes we are suggesting in the ways that bank senior managers assess and manage risk are designed to increase alignment across the disciplines of capital, strategy and risk management, and to improve and ultimately simplify decision-making. While the implementation challenges for driving change of this nature and magnitude are significant, the benefits of doing so can begin to materialize within three to six months and build from there. Eventually, the way bank managers make decisions will become a source of advantage in and of itself.