In recent weeks, several banks have revamped their Boards. Some new Directors even have the word “risk” feature in parts of their Resumes. That’s very nice. Now what?

The current crisis has revealed that many banks’ boards (and executive management) failed in their risk oversight responsibilities. Not only do many lack board-level risk committees, but those that have risk committees do not meet regularly nor do they have the functional feedback necessary for meaningful governance.

It is time Boards of Directors become pro-actively committed to risk management. It is time Regulators focus keenly on risk governance in their analysis of the health of banks. And it is time investors and shareholders and customers differentiate banks on this basis.

So, with so many stakeholders looking over its shoulders, what’s a Board to do?

• Start with a holistic approach. Align practice with strategic objectives by issuing a well developed top down statement of risk appetite. It is high time we moved away from cliché in this regard. Risk appetite need not be all quantitative. And it is unlikely to be static. And it is always relative. Boards must not only understand current business risks but assess the changing marketplace, identify new risks, monitor the business and be prepared to respond rapidly.

• Transparency is crucial. Set the trend by actively disclosing risk appetite and tolerance to all stakeholders for critique and comment.

• Mandatorily disclose the available risk architecture that reconciles bottom-up business and risk management practices and output, with target appetite, tolerance, and results.

• ‘Stakeholders’ necessarily includes the internal organization. Are all employees aware of the statement of risk appetite, can they find it, have they read it? Does the statement of risk appetite describe what is expected insofar as the unusual, the unintended, and the unacceptable? Does the firm have a meaningful way to aggregate, understand, and respond to risk? Are all staff able to articulate the parameters of their own risk responsibilities?

• Define a meaningful relationship between the risk function and the Board. Equip and empower the CRO and the risk management organization, with clarity in culture, role, and accountabilities.

More on this soon

Posted by Jaidev Iyer, MD, GARP at 9:27 AM