The credit crisis of 2007-2009 has prompted many members of senior management and members of the Board of Directors to ask this simple question: Am I getting the risk management information and analysis that is necessary to protect my institution? For a wide array of institutions, the answer to this question is a simple one: No. This blog post lists four simple questions to determine whether or not your institution is providing best practice risk information to the CEO and the Board, and it explains the reasons that these four questions are so important.
Question 1: What happens to the market capitalization and net income of the firm if any of these risk factors change: home prices, foreign exchange rates, commercial real estate prices, stock index levels, interest rates, commodity prices?
If the answer is “I don’t know,” the institution fails the test.
Question 2: Using an insider’s knowledge of the assets and liabilities of the firm, both “on balance sheet” and “off balance sheet,” what is the best estimate, monthly for the next ten years, of the probability that the firm will fail in each of these 120 monthly periods?
If the answer is “I don’t know,” the institution fails the test.
Question 3: Using only information available to an outsider, what is the best estimate of the probability of the failure of the firm in both the short run and the long run?
If the answer is “I don’t know,” the institution fails the test.
Question 4: If the firm is able to answer Questions 1, 2, and 3, what hedging position is necessary to insure that the macro factor sensitivity of the firm and default probability of the firm reach the target levels set by the Board of Directors?
If the answer is “I don’t know,” the institution fails the test.
Why Do These Four Questions Matter?
When one looks at the ex-post analysis of why institutions like Merrill Lynch, UBS and Citigroup got into such trouble during the current crisis, the feedback from the Board and CEO levels is amazingly consistent. Here is a brief sampling of representative quotes that illustrate the common weaknesses that led to very serious problems:
From Bloomberg.com on April 24, 2008
“Ann Reese, chairwoman of Merrill’s audit committee, said the Board had had ‘numerous discussions’ with management about its investments in the months before the credit crisis. The Board initially didn’t realize that the prices of CDOs were linked to the U.S. housing market, she said…’The CDO position did not come to the Board’s attention until late in the crisis,’ said Reese…’For reasons that we have subsequently explored, there was not a sense that these triple-A securities should be included in the overall exposure to residential real estate.'”
From “Shareholders Report on UBS Write-Downs,” April 18, 2008, UBS AG, page 19
“Whilst there were a number of credit spread RFL [risk factor limits] in place, there was no RFL [risk factor limit] that specifically addressed certain factors relevant to Subprime exposure, such as delinquency rates or residential real estate price developments.”
From Reuters.com, November 25, 2008
“What went wrong is that we had tremendous concentration in the sense we put a lot of our money to work against U.S. real estate,” [Citigroup CEO Vikram] Pandit said in an interview on PBS’ Charlie Rose show. “We got here by lending money, and putting money to work in the U.S. real estate market, in a size that was probably larger than what we ought to have done on a diversification basis.”
All three of these formerly very well-regarded institutions allowed their macro factor exposure to get so large that it wasn’t until the damage was done that the Board clearly understood how close these firms had come to failure.
Why Do Institutions Fail to Answer These Key Questions?
Many risk experts and Main Street U.S. taxpayers are dumbfounded that major financial institutions haven’t asked or answered the four questions above. “I don’t believe it’s possible for someone on the Board of Merrill Lynch not to understand that CDO prices were linked to home prices” one member of the Yale University faculty said to me, but alas, it was indeed possible. Not everyone is a Yale professor! Here is an assortment of the reasons that very large and sophisticated institutions can’t pass the examination above:
1. The Board didn’t ask the right questions. “Do you mean to tell me that no one at Countrywide Financial understood what declining home prices would do to the institution?” one risk expert asked me. The answer–Of course not. My guess is that 4,000 people at Countrywide understood this, but not one of them was a director of the company.
2. The Board couldn’t ask the right questions. “I wanted to ask that question,” one Board member of a failed firm told me, “but the CEO would have fired me from the Board in a heart beat,” said this friend of mine. Instead of resigning from the Board, my friend stayed, didn’t ask the right question, and is currently named in more than 30 lawsuits.
3. The staff couldn’t answer the questions if they had been asked. The reasons for this are almost too numerous to list, but here are some of the reasons we see most often:
a. The CEO wouldn’t authorize a budget for a risk management system that would provide answers to the four key questions
b. The risk system of the institution was based on external or internal credit ratings, not default probabilities, so the link between macro factors and default risk was invisible to the institution
c. The staff selected legacy risk systems vendors whose system was incapable of doing the calculations that would answer these four questions
d. Silo risk management organizations would fight each other, blocking systems progress, rather than cede their right to select a silo risk vendor whose technology wasn’t broad enough to answer the questions
e. Risk systems were selected for reasons other than the system’s ability to answer these questions. What are some of these reasons? They can be implied from questions and comments like this: “We want a vendor that has more market share in Zimbabwe.” “How come you haven’t hired the CEO’s IT company as a consultant on this project?” “Why don’t you have more sophisticated clients like Countrywide Financial, IndyMac, Washington Mutual, and Citigroup?” The list goes on and on. In the end, there is no excuse for an institution that has a risk infrastructure that fails to answer these four questions.
Kamakura Corporation’s Kamakura Risk Manager , KRIS default probability service, and the related Kamakura On-Line Processing Service answer these four questions for our clients on a daily basis. For more information, please contact Kamakura’s President Warren Sherman at info@kamakuraco.com.
Donald R. van Deventer
Kamakura Corporation
Honolulu, April 27, 2009