Industry still failing on risk management, surveys find

Two years after the start of the credit crisis, many financial institutions are still without adequate risk management, according to two recent surveys.

Research from credit rating agency Moody's, based in New York, found many major banks were still falling short of expected standards. "Only half of the banks we examined have a dedicated board-level risk committee covering all risks. Even in those firms with a board-level risk committee, meetings of this committee are not as frequent as we would expect, in particular considering the current market crisis," the agency wrote in a report issued on July 24.

A survey of US financial institutions conducted by advisory firm Capital Market Risk Advisors for the Professional Risk Managers' International Association (PRMIA) found similar shortfalls. Only 44% of the institutions surveyed had regular meetings between their chief risk officer and their board: 13% met only once a year and 20% never met. The report emphasised "the importance of the CRO having regular and unfettered access to the board".

And Moody's agreed - "The current financial crisis has made apparent the importance of robust board risk oversight", it wrote, saying that risk tolerance and policies should be set at board level, and the board should take the lead in promoting "a strong risk culture" and ensuring adequate resources for the risk management office. In fact, only 60% of institutions have risk policies approved by their boards, the PRMIA study found.

Moody's said it would expect large banks to have a dedicated and experienced risk committee, with a CRO reporting to the board and to the chief executive. In fact, only 39% of US institutions (but 80% of banks) have a risk committee, PRMIA found (Moody's gave a figure of 49% of large banks worldwide).

Although most banks have a chief risk officer, only three - JP Morgan, Macquarie and Santander - have him report to both board and chief executive, which Moody's described as 'best practice'. Leaving risk oversight up to the audit committeee - a widespread practice - meant a danger of neither job being done properly, Moody's said, adding that this could affect bank ratings in the future.

But, however badly banks may be falling short, other institutions are worse. PRMIA said banks were more likely than asset managers, institutional investors or insurers to have CROs and board risk committees.

See also: Risk managers still seeking empowerment 
Reporting for duty 
Where do we go from here?