Thread by @SAH16928046

Two striking resemblances btw #SVB & former @CreditSuisse.
Both banks did not pay attention to the top 8–20 risks, which every board must.
Either these banks kept their risk desks understaffed or didn't hire key managerial position holders at all.
Why?
Need introspection now.

@CreditSuisse It was reported on this forum that #SVB did not have a CRO for some 8 months during the VC Market spiralling.
Also, I read just now that former @CreditSuisse was sacking key MDs in their across their risk desks.
This trend continued since the #Archegos fiasco surfaced after 2019

CRO Chief Risk Officer or Head of Risk Management is a key managerial decision-making position and C Suite Level role which every financial institution can afford to keep empty these days.
The Front, Middle, and Back Office roles form key lines of defence against top risks.

The 3-LOD model, which is mostly passed on by the IAD-Internal Audit Department to other risk control units as a supervisory framework for risk management architecture and design structuring in line with the #COSO and @TheIIA guidelines, requires appropriate independent reporting

@TheIIA #Banks which are hovering in between @BIS_org and #COSO frameworks have at times difficulty in developing an #ERM Framework when implementing two different guidelines issued by separate entities.
That is where #ISO31000 RMS is used to buttress the risk framework implementation.

The problem is that with such extensive literature that accompanies the SDI (System-Design and Implementation) of an ERM Model framework, specialist staffing, training and technological systems are needed.
Market recruitment of risk staff is a talent acquisition challenge for HR

Risk Taxonomy,Risk Registers,Risk Library, alongside KRI Mapping tools in real-time, KCI -Key Control Indicators & KPI (Key performance indicators) with random testing of effectiveness and robustness of ICs-(Internal Controls) alongside exception & escalation reporting are needed

Once the three lines of defence are sorted out and the Risk management architectural structural and design parameters are approved by the board, the front, middle, and back office units are segregated to avoid conflict of interest.
A CRO is a must! He is the captain of the ship

No Bank can be supervised directly by the BOD or the Non-Risk Units due to conflict of interest.
Internal Audit and Compliance cannot do what a CRO with his team can attain.
They form the second line of defence which proactively identifies, measures and manages/ monitors risks.

In this thread, I am not going to discuss the role of risk management from a Corporate Governance or GRC Perspective only.
The role of board and management committees and the terms of references that are to be drafted are only one aspect of setting up an ERM Unit at a firm.

There is a lot more to developing a sustainable and viable ERM Governance Architecture and planning its actual design, which is often overlooked by the practitioners in the field.

I believe building an ERM Governance Design and Model Framework is an important topic that needs to be further explored using a bottom-up approach.

Not many risk management professionals have had the distinction of working both within the FI and the Non-Financial Sectors as I do, hence I would like to share my experiences with all of you and explain the major differences.

This would help the job market aspirants to carefully select job roles and think twice before switching careers from one industry to another.

In the traditional financial services industry, the role of a risk manager although still largely misunderstood and mercurial remains centrally affixed in the OD Chart prepared by the HR Department.

This is largely due to the regulatory demands without which no bank, fund, or insurance can do.
Hence, in financial services, the role of a risk manager is ubiquitous and here to stay until a new paradigm emerges, which for the moment seems almost inconceivable.

The Risk Management Department might like to twist and tweak the ERM Model Framework a bit to adjust taxonomies, control definitions, and mitigants to meet risk management requirements, in a more customized manner.

Unfortunately, neither the ISO - 31000 upgraded Standard nor the COSO updated Framework provides clear guidelines on how to incorporate quantitative risk management methodologies and techniques in managing each level and class of risk incident which might occur in a process

I am not going to touch on IFRS, GAAP, GAAS and other Audit and Accounting standards and professional practice conventions in the discussion in this blog.
Because that would increase the complexity of the argument beyond the scope of our basic discussion.

However, the inter-operative nature of such standards and best practices followed by the IAD has a direct bearing on enterprise risk management practices

The first line of defence is the process owners, the second line of defence are the risk managers primarily working in a dedicated risk management silo/unit and the third line of defence is the Internal Auditors.

Hence, the three lines of defence have to coordinate risk management activities with one another in other to establish and implement an ERM-based organizational order under normal circumstances.

This would further require the implementation and design of some more quintessential step/s to ensure that an ERM-driven philosophy as per a chosen model framework is being adhered to across the board as given below =>

1. A Risk Model-based Policy must be put down on paper using the admixture of various standard/s or risk management model/s.
There is no one size fits all solution that can help an organization evaluate, assess and monitor risks on a firm-wide basis.

Hence, drawing the best from all or any of the management standards or internal control models or conventions/accords such as any published framework or ISO Standard can help to attain the right mix that is required to address the complexities surrounding risks,

potentially cascading across various levels in the modern money-making capitalist organization.

2. A Risk Culture and Communications Strategy firmly placed within the BI / Information Sharing Model to develop DSS - Decision Support Systems.

These risk reporting templates used to share and collect information regarding adverse risk consequences encompassing a potentially negative outcome such as a hazard might include =>

RCSAs
GAP Study templates
Risk Registers with the KRIs Risk Controls and other risk taxonomies
Portfolio Market Risk Reports
Portfolio Credit Risk Reports
Liquidity Risk Reports
ALM Risk Reports
Operational Risk Reports
Etc.

3. A Risk Resilience Model Application drove the Methodology and Plan to ensure reliability, reproducibility, and repeatability in terms of tackling negative and positive outcomes as per your firm's risk appetite.

4. Risk Oversight and Escalation Steps at the Management Level by forming an Executive RMC - Risk Management Committee.

5. Risk Oversight and follow-up at the BOD Board of Directors Level by forming a BRMC - Board Risk Management Committee.

6. Putting in place the BCP - Business Continuity Plan: Taking the right decision at the right level to manage events and rapid risk-reducing responses in a crisis.

7. Separating Crisis Management and Complexity Management Frameworks and Taxonomies from traditional and orthodox risk management best practices - learn where to draw a line. Normal risks can be managed by the CRO and his team.

For managing non-normal or abnormal risks, a concerted forum and management escalation plan are normally required. The Board of Directors should provide complete supervisory guidance to the group risk team on such issues.

These kinds of hazards might include NAT CAT - Natural Catastrophe drove risks or other BS - BLACK SWAN Risks having single to multiple impact/s.

Hence, historical severance rates of all such hazards should be studied / and or simulated to draw a revivability plan for the firm in the event of such an incident taking place. (Read Nasim Taleb).

8. Integrating the job profiles and descriptions of various risk management teams within one well-defined governance architecture framework. Multiple teams working independently of one another across silos may lead to both confusion and chaos.

The CRO must standardize and measure the quality of the risk management best practices across silos to create a unity of command and response in the event of a risk event/incident-driven consequence materializing into an actual loss.

9. A proper RACI Matrix should be handed out to both the process owners and specialized risk managers operating across a firm. All risks must be prioritized and an RPN - Risk Priority Number should be assigned to each potential hazard as per a given taxonomy

and level based on frequency and severity. In the Manufacturing Company/business, risk managers additionally undertake the use of certain historical models which establishes a timeline for risks.

Certain investigative procedures and introspective experiments can be conducted using causal modelling methods such as the FBRA - Fish Bone and Root Analysis, RCA Studies such as the Pareto 80/20 empirical principle, FMEA, FEMA, dFMEA, Gauge R&R Study,

SPC - Statistical Process Controls and Capability Tests, SIX SIGMA -> DMAIC/ PPDCA, /PDCA, and in addition to these many other gap study models can be elucidated to prioritize risks and develop appropriate escalation plans.

Detection Risk Value as per a chosen scale is multiplied by the severity and frequency risk scaled values to arrive at an RPN and course of setting out the action under a given hazardous circumstance.

I would not like to address the role of Deep Learning & AI / Machine Learning / Business and Risk Analytical platforms and models/procedural techniques used in Data Sciences, these days, to assess enterprise-wide risks for the time being. That would require a separate blog!!!

10. Moving from the traditional, Board-Room Working Papers dependent Sketch Board towards developing an Analytical Dashboard drove ERM Oversight Mechanisms-
Playing Shell Games using Descriptive, Diagnostic, Predictive and Prescriptive Risk and Business Analytics.

Directors as much as senior management members should be trained in using data sample sets or observances to draw inferences concerning risks.
Computational Statistics Workshops and basic code writing and its understanding is the way forward for the Board Room Appointees.

11. Internal Control Testing - Control Testing is the key to establishing a sound ERM Framework. No-Risk Governance Architecture can be considered to be exhaustive and does not discuss control testing procedures.

Compliance Testing and Substantive Testing are the two common methods used to check the viability of placed controls. Quantitative backtesting as used by Actuaries and Financial Risk Managers in the financial services industry has added more flavour to the subject.

Financial Auditors, generally prefer non-random sampling techniques such as the Haphazard Non-Random Sampling Design Method and other guidelines as prescribed by the GAAS, whereas risk managers and actuaries prefer to undertake random-sampling methods to test controls.

Especially, when it comes to testing financial auditing-based controls which are used to prevent and detect materiality misstatement risks, it is often observed that with monetary aggregates, statistically significant upper bound and lower bounds cannot be established,

which are required for hypothesis testing, as the SE - Standard Error is not meaningful, i.e. Equal to Zero.

12. Exceptions Management Framework - Non -Compliances and Violations of Internal Controls should be identified in REAL TIME!!!

All exceptions should be identified on time.
They should be flagged on time and
if possible escalated and controlled promptly too!!
Loops should be created between Risk and the two other lines of defence to consolidate the incident reporting and recording process.

These loops are generally missing, which makes incident reporting and exception marking/flagging difficult for the risk manager.
Without creating a system of integrated feedback loops, no modern enterprise risk management unit can control operational or financial risks.

This can also be done through automation of the risk management processes. Hence, risk technology plays an important part in monitoring internal controls and flag-raising as risk accidents/ incidents with varying likelihoods and impacts take place during business operations.

The 3 - LOD Model should create such feedback loops that mark exceptions at all levels to prevent risk cascading effects on a firm-wide basis.
All exceptions to internal risk-based controls should be reported to and regularized by the Board Audit Committee.

13. Reward-to-Risk Assessment - Applying Performance Attribution Analytics to check the rewards earned to risks. This might be challenging in a Non -Financial Firm,

where processes are not always measured in terms of quantifiable units. In the standard Investment Management and Banking Industry, standard RAP-Ms (Risk-Adjusted Performance Measures) are used to study risk-adjusted profitability and returns on funds invested.

14. Scenario Analyzing Outcomes using Stress Tests - The standard ERM tool without which risks can be scenario analyzed. All Risks lie in the future.
Hence, Risk Managers must stress test risks based on multiple scenarios by applying shock treatments.

The stress test can be uni-dimensional, bi-dimensional or multi-dimensional in nature. Sensitivity Analysis is one, e.g.
The purpose of Stressing risk variables is to know how much worse things might get on a Non -normal day! You should never stress-test normal scenarios.

Only the worst-case scenarios should be developed and stress-tested based on a host of imagined scenarios. This requires imaginative thinking.

Stress testing should always be performed on Tail Risks, which cannot be ideally captured by an ND - Normal (Gaussian) Distribution Probability Model.

15. Ruin Risk and Solvency Analysis - Once stress testing is done, the organization should do a Ruin Risk Analysis and check whether it has enough capital to remain afloat when a severe risk event/ incident occurs.

Mathematically, Ruin Risk of a risk-taking firm is computed as =>

UL - EL = RR
RR - RUIN RISK
UL - UNEXPECTED LOSS
EL - EXPECTED LOSS

At banks, the regulator demands such analysis. The Basel Capital Accord/s emphasizes measuring and stress testing the bank solvency level, using the CAR - Capital Adequacy Ratio Measure using various mathematical and statistical models.

Similarly, Insurance Firms also have their own methodology of stress testing Solvency Requirements using the SCR Guidelines which are referred to as Solvency II Guidelines as issued by the EU.

In the Non -Financial Industry this concept is still in its infancy and not well integrated within the commonly used IA- Internal Auditing and RM - Risk Management best practices.

16. Integrating Corporate Business Strategy with the Risk Strategy - This is the lynchpin compulsion before we draw an ERM Road Map on the Dashboard.
The capstone concept of any effective RM Framework and Governance Model used to undertake the CBA - Cost-Benefit Analysis.

If Corporate strategies or business activities and processes are not integrated well enough with the risk strategy model, the two would go in a completely different directions.

Hence, to assess the risk-adjusted reward-based incentives and processes, we must align the corporate strategic business objectives with the strategic risk objectives, plans, and procedures within the framework of a much larger policy as approved by the Board of Directors

and the Senior Executives.
To understand the Risk Model, we must study the business model.
Only then we shall be able to comment on whether the ERM framework is Fit -for-purpose or is the opposite.

17. Consolidating the ERM-based Portfolio View of Risks - ERM is an admixture of many applied concepts. For e.g. the CERA (Certified Enterprise Risk Analyst) Program offered by the SOA -Society of Actuaries curriculum emphasizes teaching various models and methodologies

which would enable a risk manager to control firm-wide risks using various portfolio management models.
Many practitioners and scholars misunderstand risk management as a one-track profession.

However, everything and anything can be included within the ERM Framework Model and Governance Architecture as long as it enables the business to identify, measure and manage/ monitor the Strengths, Weaknesses, Opportunities, and Threats in a proactive manner,

by coordinating risk mitigating and escalation (4T Methodology as outlined in ISO31000 Standard) activities.
The Neutral Middle Office controls exposure and thereof related process risks independently of the Front and Back Offices.

At FIs the role of a specialized middle office using structured financial risk-specific hedging tools to optimize firm-wide portfolio risks, across the three lines of defence, is an e.g. which even the non-financial firm can explore.

This shortcoming in the Manufacturing and Agribusiness driven sectors can be discussed at a later stage.
The layered application of Internal Audit designed Detection, Prevention and Corrective Controls as outlined in the updated COSO ERM Framework

and earlier published Internal Controls Framework for the Enterprise are not enough on their own.
Risk Management has to move a step forward in terms of designing risk controls and responses to joint hazardous events and incidents /accidents.

Risk Management, unlike Audit, must deliver integrated portfolio-based risk solutions to prevent risks from cascading effects in REAL-TIME.
Risk Cascading effects can prove to be like a virus spreading in a human body, which can spread from one organ to another, leading to death

! Hence, the ERM Model should be very closely aligned with the Business Continuity Plan and the IAD Objectives to ensure timely detection and control of the adverse consequences leading to negative outcomes.

Nevertheless, the ERM Department /Silo /Unit should integrate all risk management frameworks being used across SKUs or SBUs and develop a conjoint view of risk management!

The MPT - Modern Portfolio Theory and its proponents taught in a standard Financial Economics or Quantitative Finance Degree, would enable the risk managers in any organization to understand how processes and objectives are correlated and where diversification benefits

help to decouple the risks. All Core Businesses and even Non-Core other Risk-Taking (Potential or Actual Loss Exposure Creating Process/es and Activities) must be viewed as part of one single portfolio!!

That portfolio perspective forms the existential basis of the Firm's ERM Model per se.

18. Re-balancing the Risk Appetite and Business Activity Portfolio Mix -

How to measure RA?

RA = IHR - RR
IHR - INHERENT RISK
RR - RESIDUAL RISK
RA = TA (TARGETED RISK LEVEL)

I am not going to get down into the debate as to how RA should be mathematically linked to a loss measure and what are the shortcomings of different loss variables in traditional risk management literature.
The optimal portfolio risk-sensitive re-balancing is the key to ERM!

Will skip ahead and assume you know how to set RA Limits for the firm-wide processes and exposures.
The ERM Unit must check and recompute risk appetite at the end of each fiscal operating year or at a point of its own choosing.

Risk Appetite will undergo a navigational change, and therefore, the risk assessments must be reflective of any corresponding diversions in objectives and business strategies.

19. Re-configuring & possibly upgrading or replacing Internal (Risk-based) Controls - Once, all is done as mentioned above, the RM and IAD units must backtest the effectiveness of the controls framework. Ultimately, in an ERM Model Framework,

the responsibility of designing, managing, and monitoring ICs - Internal Controls would gravitate from IAD to RM.

All impotent or superfluous controls must be removed.
Any new control must require board approval and management oversight.
All existing controls should be monitored and the violations / non -compliances should be flagged.

The business case for adding or deleting controls must be well represented by providing arguments for or against in the form of working papers. Unfortunately, ERM Managers are still not into writing working papers like the Auditors do! Here we can learn from the IAD.

Ideally, all Risk Controls should be re-configured using risk and business case-sensitive analytics and machine learning tools.
Not many firms are doing this at the moment outside the Financial Services Industry. Sadly!

No modern organization can afford to ignore data science concepts.
This is the way forward!

20. Accountability of Key Risk Management, Governance, Auditing, and Compliance Roles - All Risk Management Performances should be assessed! Easier said than done.

Risk Management is not like Fund Management, where the trader or the fund manager can post a hefty profit in dollars and boost his or her achievements.
How to quantify the work done by risk managers? That is a big debate per se.

For e.g. the bonus and other monetary incentives in an asset management firm such as a mutual fund company are linked to Alphas (excess performance over a selected benchmark).

How to develop an Alpha-like metric for both the auditor and risk manager which is both meaningful and quantifiable?
That I think would help revolutionize the risk management profession in the long -run.

21. Right Compensation, Recognition and Incentivizing Risk-Adjusted Behaviour of Key Process Owners and Risk Managers (Reward to top performers) - The statement is self-explanatory!

22. Developing a Risk Library of Events to support and record all ERM Activities -
Data Management, Incident reporting and hazard event-based loss coding are the backbones of any ERM, DMAIC and PDCA (PLAN-DO-CHECK-ACT) Frameworks.

Hence, Historical Model-based ERM / IAD activities should collect and collate observational sample data and record the incidents as much as possible using a suitable template/s.

Again, Data Science and Data Engineering Tools would help the modern risk manager to make use of SQL /R/Python /Cloud-based Computing to store and disseminate information as per requirements.

No ERM Framework can flourish without a proper MIS (Management Information System) and DSS (Decision Support System).

23. Re-assessing the Remedial Management Strategies - What can go wrong will go wrong! be prepared for every eventuality
Don't just blindly rely on your risk transfer, risk sharing, risk pooling and other alternative risk financing methods.

Once a crisis begins, it won't automatically end! We saw that during the global financial crisis in 2007-08. One bank after another filed for bankruptcy in the USA and around the world.

The BCM and ERM should be well integrated alongside the other management system standards to provide multiple layers of protection that a firm needs.

Remedial management or crisis management model must exist to deal with the complexities in addition to ERM and IAD Planned Processes and Objectives.

24. Provide Joint Risk Assurance/s - Gone are the days when IAD alone provided Risk Assurances!
I believe this requires a fundamental mindset sea change.
Internal Auditing or External Auditing based firms should not provide assurance in isolation.

All GRC - (Governance/Risk /Compliance) Units must participate in the assurance closing-off process. Sign-offs should be taken from all risk management silos.
Cannot leave things to the third line of defence alone!

25. Sound Housekeeping - Data and Document Archival and Storage Facilities are very important. Must have an information retrieval process in the event of a crisis or during normal periods.

A Strong Room should also be assigned to the ERM Unit where they can archive all files and printed material of original documents as required.

Access Controls limiting authorization to such a room/facility are of utmost importance to avoid any tampering with the official documents or the records from official activities or proceedings.

26. Creating linkages among Risk Logic, Philosophy, and Methodology applied - Both Empirical Facts and Rational Transcendental Sensations, Perceptions, and Conceptions shape our logical concepts, philosophical reasoning and methodological applications. The three are linked!

If the Logic is wrong, everything else will go wrong too!!!
One form of logic in one industry or a given standard or model framework cannot and should not be applied blindly elsewhere.

Merit and De-merits of any Risk Management Processor Plan require argumentative reasoning using supportive examples.
ERM Logic will lack the first brick in the edifice. A basic RCA - Root Cause Analysis is not enough in my opinion.

We need to integrate mathematical forms of logic and philosophy to check our risk statements and problem constructs and taxonomical definitions.
All arguments must have an axiomatic flow.

What would we like to achieve, why would like to achieve that goal /objective, and when and where we would like to achieve certain objectives?
Without answering the above, we cannot develop an effective ERM Governance Architectural Model.

I hope this much will help readers of this thread and my blog available online to better understand the nature of "#GAPS" that might have existed at one or all four banks which have now defaulted and filed for bankruptcy in the USA and in Switzerland.

Hope you have enjoyed reading this thread!
#SVB #SignatureBank #CreditSuisse #Silvergatebank #FRB

Pardon the typos

@threadreaderapp unroll