Developing risk culture at institutions

It is almost axiomatic in a post-recession seminar on financial sector to say that India escaped the impact of recession in 2008 and the years thereafter because of effective regulation.

The situation today is far different. The known unknown – credit risk, and the unknown unknown – market risk, are on the rise despite technology inroads reflected in core banking solutions, centralised processing platforms, video conferencing with clients, improved risk ‘governance' claims on the part of banks and financing institutions.

It is a well-known fact that financial sector is a haven of risk.

Further to the acceptance and introduction of Basel Committee norms, risk management departments have been set up. The RBI issued detailed guidelines.

General Managers/Executive Directors have been kept in charge of the Risk Management Departments in head offices. Risk Management Committees are part of the Board Management. But, ask any employee of a bank branch about risk management, you will still get a stock reply: “Oh! Risk Management is looked after by the head office. We submit whatever returns are required in this regard.”

The younger generation is attempting to pursue professional certification courses in risk management from IIBF, PRMIA or GARP.

All the globally placed banks have moved to Advanced Approach to Risk management under Basel II and claim to be ready for Basel III by 2013. Yet, bulging NPAs, increasing cyber frauds, interest rate risks, forex risks, inflation risks, and retarding economic growth have been causes of great worry in 2011-12.

In one public sector bank in Andhra Pradesh, frauds, both systemic and manmade, have been uncovered in many branches, that exposed the hollowness of the risk management practices and risk management audit, if any, taking place in that bank.

Soon after the assumption of new Chairman in the country's biggest public sector bank , irregularities were found in the balance sheet formulations for the preceding financial year that sent the markets tizzy for a while.

The frauds reported according to the 2010-11 annual report of the RBI showed an increase of 1.2 per cent over the previous year. This raises the fundamental question: Is it enough if banks follow governance prescriptions and comply with guidelines on risk management issued by the central bank?

SPREADING RISK CULTURE

The answer lies in spreading risk culture across the length and breadth of the institutions. But what is this risk culture that the banks are yet to imbibe? Is it peculiar only to India or elsewhere in the world of finance? Banks continue to say that there is adequate capital provisioning; risk measurement as required is in place; data warehousing has improved substantially; EAD and LGD are better now than before and are able to reach the global standards for all the globally placed banks in India etc., and the regulator also releases QIS data on Basel standards substantiating the claims and affirms effective supervision standards prevailing in the banks.

The Institute of International Finance, among many others, cited cultural failures, and specifically those of risk culture, as a leading cause of the credit and liquidity crisis of 2008. Switzerland-based UBS, in an October 2010 accounting report to shareholders of its crisis-period losses, admitted to “organisational shortcomings and the lack of adequate controls inside the bank.”

Indian banks are yet to admit such lapses. Many provisions in post-crisis legislation and regulation were intended to tighten governance and risk management principles and standards.

It is important that every employee in a bank understands that he is working in an institution that is exposed to risk everywhere. He has to be conscious that his neighbour is also a potential risk to the same degree as provider of a kinetic energy.

In several branches of the banks or insurance companies, transfers take place periodically. Even within the branch, staff would keep changing the desks. Such shifts and transfers have potential to expose the lapses and reduce risks in the organisation. If any employee does not apply for leave for a full year, he needs to be keenly watched for transactions handled by him and his personal accounts.

DEALING WITH EMPLOYEES

Each employee's personal accounts would need scrutiny to make sure that there are no abnormal credits or debits in his or her account. All these acts of vigilance contribute to developing risk culture.

In a white paper of McKinseys' “Taking control of Organisational risk culture”, by Levy and McKinsey, risk management specialists Eric Lamarre and James Twining concluded that flaws in the prevailing culture have led to material financial disasters in the corporate world in the past several years – including Deepwater Horizon, the Société Générale rogue trading scandal and the Enron Corporation implosion.

Levy identified four key indicators that would provide opportunity for inculcating risk culture. Those four groups of indicators are: the transparency of risk at a given organisation; the acknowledgement of risk; the responsiveness to risk; and the respect for risk. If risk culture improves in the organisation, there is a high probability of minimal operational risk.

(The author is Regional Director, Professional Risk Managers’ International Organisation, Hyderabad Chapter.)

COMMENT NOW