<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

3 Reasons Chief Risk Officers Fail

author Michael Berman
2 min read
Aug 7, 2017

You’d think that a bank with a chief risk officer would have a strong handle on careful risk management, but like a lot of what we’ve learned from the financial crisis, logic doesn’t always apply.

At least that’s the finding of a new study which concluded that big banks that employed a CRO were far more likely to be overexposed to the riskiest new financial derivatives. The study, The Hazards of Expert Control: Chief Risk Officers and Risky Derivatives, was published in the American Sociological Review and discussed by its authors in a Harvard Business Review. It’s based on studying the derivatives use of the 157 largest U.S. banks between 1995 and 2010.

The researchers suggest three reasons why CROs at these banks didn’t properly manage risk.

  1. Their job was to maximize profits, not manage threats. Ask any good chief risk officer what her job is, and she’ll tell you that she’s there to identify, assess, mitigate and monitor risk. She is guided by her institution’s appetite for risk and helps the board and management make strategic decisions that align with it.

    That’s not what was happening in many big banks using risky derivatives, the researchers believe:

    “In hitching themselves to the shareholder-value bandwagon, they had to abandon their old mantra of reducing risk, which wasn’t seen as being in the interest of shareholders. Instead, they embraced a new mantra of ‘maximizing risk-adjusted returns,’ which involved using their expertise to bring risk right up to the edge of allowable limits, with no wasteful margin for error.”

  2. No one else cared about risk management. Risky behavior was more common at banks with CROs because management and employees were less inclined to worry about risk, mentally outsourcing the task to the CRO. It’s a psychological concept called moral licensing.

    “In creating a new, high-level position to oversee risk management (signaling that the bank was ‘risk aware’), executives may have encouraged the managers of other bank departments to become less cautious in policing their own risky behavior.”

  3. The CRO wasn’t supported. A CRO may be responsible for policies and strategies, but those won’t go anywhere without management and board support. If management chooses to turn a blind eye to risk when tempted by increased profits or encourages a CRO to engage in overly risky strategies, risk management will be nonexistent. Unfortunately, some CEOs were incentivized to prioritize short-term profits over long-term stability.

    “When they [CEOs] had more skin in the game — for example, if they held a lot of stock in the company — they restrained the CRO’s push for risky derivatives. But the opposite was true when CEOs received more compensation in the form of performance pay (like a big cash bonus), which rewards outsize risk taking but doesn’t penalize losses.”

The lesson here is clear. It’s not enough to have an employee with the title CRO. Everyone at an institution, especially those at the top, needs to make risk management a priority. While a smart risk management strategy can help bolster profits, the true goal of risk management is to balance profits with protecting the institution from threats to its long-term success.

If your board and management aren’t taking risk management seriously, now is a good time to start.

 

Related: Creating Reliable Risk Assessments

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings Regulatory Compliance OCC Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Artificial Intelligence Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
Risk Management
Risk Management

Risk Management

Nov 12, 2018 1 min read
Risk Management Planning
Risk Management

Risk Management Planning

Oct 31, 2018 1 min read
Risk Management In Healthcare
Risk Management

Risk Management In Healthcare

Oct 31, 2018 2 min read