INTRODUCTION Risk Management Technical
Risk management has existed as a technical discipline in financial
institutions for many years and Regulators have assessed institutions on
their ability to manage risk appropriately (McCormally, B. C., Allen, C.
L., and Mayer, H. E., 2012; Hall, M., Mikes, A., and Millo, Y., 2013).
Regulators and market participants alike have held the positives to “good
management” that the discipline of risk management practices
apparently brings (Hall et al., 2013; Mikes, 2011; COSO, 2004; ISO,
2009). Although evidence that risk management prominence and stature
continues to increase in organizations as policy initiatives expand
enterprise controls to include risk management, the global financial
crisis of 2007-2009, and continuing risk management failures, call for an
examination of risk management practices (Bhimani, 2009; Hall et al.,
2013). With the number of years of risk managements’ existence,
available procedures/processes, and its importance to organizations, we
have to question why does risk management fail? In this paper, we seek
to explore perspectives on barriers to effective risk management.
As the financial industry has had a history of crisis, including the
most recent Great Recession, we seek to continue on those institutions
subject to resolution plans (Cho, Mier, Jones and Bellenger, 2014) to
explore what are barriers to effective risk management. From a
historical perspective, Martinez-Ruiz, E., and Pons, M.A.’s (2014) paper
summarizes studies of past financial crisis. While this historical analysis
of past financial crisis revealed vulnerabilities in financial markets
resulting from the globalization of financial systems and processes
initiated in 1971, the analysis relied on the historical evidence from the
first globalization (1870-1913) to draw similarities and differences
(Martinez-Ruiz et al., 2014). One of the studies is Marichal’s
(2014) analysis of hearings published following what many economic
historians view as the first truly global financial crisis in modern
capitalism called the “Great Depression of 1873-1896.” This analysis
identified that pressure from the public who were troubled by the
magnitude and effects of financial misconduct was the genesis of the
resultant commissions established to investigate the crisis. These
commission reports identified that key causes of the crisis included poor
management and fraud (Martinez-Ruiz et al., 2014). Marichal’s (2014)
study indicates a period of calm in world finance until the financial crisis
of 1907 that marked the beginning of a deep depression in the United
States. Some view the most important decision taken by the U.S.
Congress was to establish the National Monetary Commission (NMC).
The NMC reassessed the role of banking systems culminating in the
creation of the Federal Reserve Bank in 1913, which shaped the
regulatory and institutional banking and financial architecture in the
United States (Marichal, 2014).
Another study by Minsky (1992) suggest that financial instability
does not come as a consequence of external shocks but is rather an
inherent phenomenon in the financial realm.
Minsky’s (1992) Financial Instability Hypothesis (FIH) challenged the
classic principles that the economy is constantly an equilibrium-seeking
and sustaining system. The FIH suggests that over periods of prolonged
prosperity, capitalist economies, i.e., an economy with pricey capital
assets and a sophisticated financial system tend to move from a financial
structure dominated by stability to one of instability (Minsky, 1992). As
we can see from the most recent crisis of 2007-
2009, learning more about previous experiences does not prevent us
from suffering new crises. All major financial crises over the last two
centuries have incited disbelief because of their rapidity and the large
costs that resulted (Marichal, 2014). This seems evident in the case of
the global financial crisis of 2007-2009.
The 2007-2009 global financial and economic crisis emerged as the
most significant economic recession experienced by the United States
since the Great Depression (Gökay, 2009). The financial crisis that
emerged indicated a need for change as it revealed a unique financial
system with a special ability to socialize losses while also privatizing
profits (Guynn, 2012; Andersen, L. B., Häger, D., Maberg, S., Næss, M.
B., and Tungland, M., 2012). Indeed, the economic crisis raised
questions on how institution leadership, including the boards and senior
executives, were managing their institutions risks which resulted in calls
to improve risk management in financial institutions (Beasley, M. S.,
Branson, B. C., and Hancock, B., 2010; Andersen et al., 2012). Many
have questioned the role and profile of risk management in financial
institutions contending that challenges institutions faced were due in part
to a lack of focus on identifying, assessing and managing their existing
and emerging risks. Some attribute this inability to the existence of a
risk management system or framework that was incapable of identifying,
assessing, mitigating and monitoring risks, and because institution
leaders were overconfident about their informal approaches to risk
management (Aebi, V., Sabato, G., and
Schmid, M., 2012; Beasley et al., 2010; Harner, 2010).
In the wake of this Great Recession, Congress passed the Dodd–Frank
Wall Street
Reform and Consumer Protection Act (DFA), to “promote the financial
stability of the United States by improving accountability and
transparency in the financial system, to end “too big to fail”, to protect
the U.S. taxpayer by ending bailouts, to protect consumers from abusive
financial services practices, and for other purposes” (Govtrack, 2010).
The DFA increased the resolution powers of regulators and Section
165(d) established requirements of resolution plans (RPs), or
“living wills” for the more than 130 systemically important financial
institutions that own more than $50 billion in total consolidated assets
(US Government Printing Office, 2012). Section 165 also calls for risk
management requirements for certain financial institutions to create
independent board-level risk committees and establish or enhance its risk
management, to one that operates on an enterprise-wide basis (Bugalla,
J., Kallman, J., and Narvaez, K., 2014; McDonald, 2004; Martin, D., and
Power, M., 2007; McCormally et al., 2012;).
As suggested in Cho et al.’s (2014) recent study, the perspectives
of the RPs resulting from Section 165(d) of the DFA resulted in mixed
views of their effectiveness by the experts most closely involved with
their creation and regulation, namely, employees of the affected banks
(BANs) and federal regulators (REGs) with RP oversight
responsibilities. Cho et al.’s
(2014) qualitative data provides rich perspectives from BANs and REGs,
including strengths of RPs. The main strength the respondents identified
was RPs created greater understanding among BANs of their own
organizations, including their complexity, dependencies, and risks.
According to one BAN, the RPs “have forced institutions to reconsider
their corporate structures, and have started them down the path to
simplification.” Another BAN detailed that “they have exposed gaps in
operational processes, strategic plans, and organizational structures that
have been fixed as a result.” The responses to the study’s open ended
questions fell into the primary category of “Greater Understanding” with
the coded responses being, 1) Enhanced transparency on the operations
and size of the organization; 2) Improved risk monitoring and reporting
by BANs; and 3) Improved understanding of the institution and
operational risks by BANs (Cho et al., 2014).
As important that risk management is to the banking industry, and
recognizing the aforementioned strengths as shared by the BANs and
REGs indicating that RPs “enhanced transparency to operations,”
“improved risk monitoring and reporting by bankers,” and
“improved understanding of the institution and operational risks by
bankers” (Cho et al, 2014), why did it take a massive regulation such as
DFA and its requirement for RPs to illicit such responses relative to
“risk management?” Should this “improved understanding of risks” have
been byproducts of the institutions risk management practices versus a
regulatory requirement in the form of RPs? The basic views on risk
management is that its risk mitigation processes should be explicitly
related to organizational and sub-organizational objectives and
processes, yet many view that despite the growing complexities of risks
faced by organizations, the level of risk management remains fairly
immature (Power, 2009; Beasley et al., 2010; Hall et al., 2013; COSO,
2004). Many question whether risk management is evolving in the right
direction and this appears questionable as extensive research in the
discipline of risk management indicates as much. Furthermore, our
review of literature identified additional concerns relative to risk
management.
Current literature is varied and inconsistent on what challenges or
barriers may exist to effective risk management. A great deal of
literature questions the most highly referenced of risk management
concepts, enterprise-wide risk management (ERM), questioning its
ability to enable institutions to manage risk effectively (Power, 2004;
Power, 2004b; Schiller, F., and Prpich, G., 2014; Mikes, 2009; Mikes,
A., and Kaplan, R. S., 2014; Huber, C., and Scheytt, T., 2013).
Criticism includes ERMs’ lacking in its ability due to its high ambiguity
and to some that it is internal controls based and not empirically
grounded (Paape, L., and Speklè, R. F., 2012; Schiller et al., 2014;
Martin et al., 2007; Power, 2009; Huber et al., 2013). Further, Schiller
et al. (2014) suggests that organizations risk management is limited due
to a lack of the concept of risk and risk knowledge generation with
current ERM frameworks, noting a failure to recognize the value of
internal communication as it can result in poor integration of risk
knowledge bases and risk management systems.
This paper aims to make several contributions to theory and
practice. First, based on survey data from 130 institutions subject to the
RP requirements of DFA, and perspectives of certain regulatory agencies
examiners and analyst and bankers with risk management
responsibilities, we explore barriers to effective risk management. As
noted, the study by Cho et al. (2014) identified that going through the
process of creating RPs a benefit was improved risk management and
knowing the organization better, yet, most of these institutions subject to
RP undoubtedly had some level of risk management practices prior to
DFA (McCormally et al., 2012; Hall et al., 2013; Mikes, 2011; Harner,
2010). We seek to explore what are barriers to effective risk
management. This part of our study connects to previous work of
Kleffner, A. E., Lee, R. B., and McGannon, B. (2003), and Beasley, M.
S., Clune, R., and Hermanson, D. R., (2005), which calls for additional
research including barriers to effective risk management. Our study
adds perspectives from those institutions risk management practices
recently required to create RPs and certain agency’s regulators, thus
providing insights, and practical perspectives to risk management
professionals and academia.
Our study to understand barriers to effective risk management
requires a lens with which to explore these barriers (Arena, M.,
Arnaboldi, M., and Azzone, G., 2010). To this end, which also
represents our second contribution, we draw from Yaraghi, N., and
Langhe, R. G., (2011) risk management systems/practices (RMS) study,
which identified critical success factors to
RMS. We adapted as three phases of RMS, “Readiness,” “Execution,”
and “Administration” and some of the noted success factors, to explore
these barriers. This connects with his call for leveraging these factors
and phases of RMS in different empirical ways relative to risk
management. Third, we refined the factors and phases of our RMS by
drawing from Mikes et al.’s (2014) study which suggests three ERM
design parameters and three contingency variables classifying different
types of risk events. The three design parameters are, (1) Processes for
identifying, assessing, and prioritizing risks; (2) Frequency of risk
meetings; and (3) Risk tools.
The three contingency variables classify different types of risk events as,
(1) Preventable risks; (2) Strategic execution risks; and (3) External
risks. As Mikes et al. (2014) indicates that organizations risks are
contingent on context and circumstances, she offers these as ideas about
what risk management may depend on.
Lundqvist’s (2014) research explored what an ERM firm “looks
like” and suggests four pillars as integral to the implementation of an
ERM as, (1) General internal environment and objective setting; (2)
General control activities and information and communication; (3)
Holistic organization of risk management; and (4) Specific risk
identification and risk assessment activities. A primary motivator of her
study was the use of inconsistent indicators and measures of ERM
implementation. Given the nature of these pillars, we refined our RMS
by aligning these pillars as underlying concepts that we view as
important considerations for the phases of our RMS. Relative to Mikes
et al.’s (2014) and Lundqvist’s (2014) studies and resultant
contributions, while we find these to be compelling and providing
substantive detail, we thought of these as exactly that; key “details,”
which we likened to having savory sausage meat without the casing.
Hence, we adapted this detail to the RMS to provide it some model
structure which may ease the ability of practitioners to draw from as they
consider this valuable detail for their risk management efforts and
practices. This connects with their calls for leveraging these design
parameters and contingency variables, and furthering analysis of the four
pillars.
As noted, Schiller et al. (2014) suggests that organizations risk
management is limited due to a lack of the concept of risk and risk
knowledge generation with current ERM frameworks, noting a failure to
recognize the value of internal communication as it can result in poor
integration of risk knowledge bases and risk management systems. As
such, our fourth contribution is our proposed new “risk governance
framework” (RGF). We draw from van
Asselt et al.’s (2011) risk governance study which explicates the idea
that risk management is to help risk professionals to familiarize
themselves with a broader concept of risk. We view that what may be
missing from these normative ERM frameworks are underlying
guidelines that can inform thinking about how to deal with uncertain,
complex and/or ambiguous risks in various contexts. These three risk
principles are, (1) Communication and Inclusion; (2) Integration; and (3)
Reflection. We connect with her efforts to synthesize risk governance
and incorporate these principles to serve as the underlying guiding risk
principles of our proposed RGF. In summary, our research on barriers
to effective risk management through the lens of the proposed RGF,
which incorporates the RMS enhanced as noted above, provides a risk
governance framework with an RMS empirically grounded in success
factors and corresponding phases, and risk theory based principles
serving as underlying guidance, will provide a sound lens with which to
explore perspectives on barriers to effective risk management. Tables
26, 27, 28, and 29 reflect the critical success factor variables and three
phases adapted from Yaraghi et al. (2011) and enhanced with the
parameters and variables from Mikes et al. (2014). Table 30 reflects the
RMS design parameters and contingent variables adapted from Mikes et
al. (2014). Table 31 reflects the four pillars of RMS implementation
adapted from Lundqvist (2014). Table 32 reflects the three guiding risk
principles adapted from van Asselt et al. (2011). Table 33 reflects the
proposed RGF which draws from Yaraghi et al. (2011), Mikes et al.
(2014), Lundqvist (2014), and van Asselt et al. (2011). See Appendix A
for these Tables.
In the next sections we provide a perspective of risk and risk
management, followed by a discussion on the evolution of risk
management and the rise of enterprise-wide risk management.
This is followed by perspectives on various challenges of risk
management including views on challenges with implementing an
enterprise-wide risk management framework. Sections three and four
present the methodology and discussion of our results. The final section
five reflects our conclusions, implications, limitations, and future
research suggestions.
LITERATURE REVIEW
II.1 Overview of Risk and Risk Management
Risk and risk management began to receive regular exposure only
from about the mid1990's onwards (Power, 2004b; Hall et al., 2013;
Power, 2009; Kleffner et al., 2003; Arena et al., 2010; Martin et al.,
2007). Extensive research on risk has still not produced a widely
accepted definition of the term which should not be surprising as risk is
studied in a broad range of fields, ranging from sciences to finance and
medicine to engineering and over varied disciplines and perspectives
(Doorn, 2013; Bhimani, 2009). The very concept of "risk" itself, implies
the exante possibility that things can go wrong including the possibility
of damage, loss or injury whether in health, environmental or other terms
(Power, 2004b; Harner, 2010; van Asselt et al., 2011; Corbett, 2013).
The ambiguity surrounding the term risk provides various actors with a
broad concept upon which they can pursue their interests; hence, it is a
fundamental element that drives financial behavior (Talwar, 2011; Huber
et al., 2013; Bhimani, 2009). In the business context, the concept of risk
includes not only the probability of loss but also the consequences of
that loss or risk event (Power, 2004b; Harner, 2010; Talwar, 2011).
Historic perspective reveals that within organizations and organizations
in varying industries have taken more of a silo approach thus managing
risk differently and separately (Bromiley, P., McShane, M., Nair, A., and
Rustambekov, E., 2014). This can be seen, for example, by a finance
department addressing interest rate risks or risk associated with
currency, and operations focusing on safety and quality control risks
(Bromiley et al., 2014).
Relative to risk management, it is an intuitive concept and is as
much art as it is science (Doorn, 2013; McCormally et al., 2012; Mikes,
2011). Risk management may be defined as a process directed towards
identifying, evaluating, and determining the risks an organization is
exposed to and developing policies, processes, and procedures to
monitor and manage the risks identified (Talwar, 2011; Hall et al.,
2013). Some view risk management as the key to the banking industries
continued survival and growth as they are in the business of managing
risk, not avoiding it (Talwar, 2011). Organizations seek to define the
most favorable levels of adverse outcomes based on an assessment of
probability and impact, and then focus on those risks considered
unacceptable (Power, 2004b; Huber et al., 2013a; Power, 2009). Risk
management practices are viewed as an efficient and reasonable means
to test institution policies, procedures, processes, practices, and products
to reduce the harmful impacts of risk taking without stifling it; in many
ways, risk management is a central corporate governance task as it
sustains value creation (Huber et al., 2013; Mikes, 2008; Andersen et al.,
2012; Martin et al., 2007; Pirson, M., and Turnbull, S., 2011). This
expression of an organization’s risk attitude at the level of the
organization as a whole is referred to as its “risk appetite” and the
Committee of the Sponsoring Organizations of the Treadway
Commission (COSO) defines it as “the amount of risk, on a broad level,
an entity is willing to accept in pursuit of value” (COSO, 2004; Paape et
al., 2012).
The goal of risk management is not viewed as the elimination of all
risk, but the pursuit of sensible and informed risk profiling and decision
making toward increased returns (Harner, 2010; Talwar, 2011). Thus
some consider that risk management issues demand greater democracy
in the decision process as risk management touches many areas, and that
risk knowledge itself is so uncertain, risk management may not be able
to claim any unique authority (Power, 2004b). Therefore, risk
management finds they are presented as risk experts, but admitting that
many areas of relevant knowledge are essentially conjectural (Power,
2004b). Indeed, in financial institutions, risk management has often
been described as a highly abstract yet analytical activity (Mikes, 2011).
McCormally et al. (2012) suggests that financial institutions face unique
challenges in risk management as they are exposed to traditional
business risks, and also to those inherent in the business of banking—for
example, credit risks, and interest rate risks. Financial institutions
operate in a heavily regulated environment that creates compliance risks
of its own, and failure to manage these risks to the satisfaction of
regulators may result in enforcement actions and significant reputational
harm (McCormally et al., 2012).
Empirical work has highlighted the proliferation of risk
management into different domains such as higher education, banking,
and agriculture (Huber et al., 2013; Termeer, 2009). Risk management
has been gaining ground in banking, fuelled by regulators and market
participants calls for “good management” that the discipline of risk
management practices brings as a corporate governance and
management control practice applicable across all industries
(Mikes, 2009; Power, 2009; Hall et al., 2013; Mikes, 2011; Paape et al.,
2012; COSO, 2004; ISO, 2009). Further, their expectations regarding
risk management have been rising rapidly, especially since the recent
financial crisis. In that crisis, weaknesses in risk management practices
that included governance side and financial risk modelling issues
became visible, and it seems that the importance of risk management
elevates in times of failures or crisis (Mikes, 2011; Harner, 2010). The
financial crisis of 2007–2009 led regulators to call for firms to focus on
enterprise-wide risk oversight and institutions faced significant pressure
to strengthen their risk management systems and control practices, and
to take appropriate actions to improve stakeholder value protection
(Paape et al., 2012; Bhimani, 2009). Significant public policy debates
and propagated new risk management rules by regulators and standard
setters evidenced these pressures (Paape et al., 2012; Mikes, 2011;
Bhimani, 2009). The importance of making risk management “count” in
high-level strategic decisions is perhaps the most agreed upon
lesson that industry actors are taking from the recent financial crisis
(Mikes, 2009). As Mikes’
(2009) noted from a Wall Street quote, “After an era of go–go growth
that led firms into profitable but chancy areas like mortgage securities,
the industry is moving toward the kind of leader who gets down into the
nitty-gritty of risk management.”
II.2 Evolution of Risk Management
In light of the recent financial crisis, Power’s (2004) study
resonates today in that the risk management of everything turned out to
be the risk management of nothing (Power, 2009; Mikes, 2011). No
other term has received such a significant echo in the media during the
global financial crisis of 2007-2009 than that of risk management (Huber
et al., 2013; Power, 2009). In the approximate 20 years prior to this
event, the interest in risk management has steadily increased (Bhimani,
2009; Huber et al., 2013). Risk management has emerged as a means for
managing potential adverse organizational outcomes by using
“probability x impact” frameworks to define parameters to assess and
differentiate acceptable levels of unfavorable outcomes (Huber et al.,
2013a; Jordan, S., Jørgensen, L., and Mitterhofer, H., 2013; Kaplan, R.
S., and Mikes, A., 2012; McCormally et al. 2012). Risk management has
shifted from a back-office, defensive role into a fundamental part of the
business model and has emerged as a means of providing ex-ante
rationalizations of the limits of prospective organizational action to
optimize the outcomes of those actions (Huber et al., 2013a; Power,
2004b). This redefines the lens through which undesirable events can be
assessed, tolerated, and managed by organizations (Huber et al., 2013a).
Some view the rise of risk management is a self-protective reply to
a more demanding organizational environment of consumers and
stakeholders (Power, 2004). Power (2004) indicates that risk
management has been characterized by an increasing focus on risk
management of secondary risk such as reputation risks, which he views
as a serious concern to the concept of risk management and to society.
Risk related regulatory reforms, including the Turnbull report, the listing
requirements of the New York Stock Exchange (NYSE), the U.S.
Department of Justice Sentencing Guidelines, and the Sarbanes-Oxley
Act of 2002, significantly expanded societies’ perspectives and public
policies related to effective risk management, and the rise of this
regulatory conception of risk management, finds its roots in internal
controls (Beasley et al., 2005; Martin et al., 2007; Arena et al., 2010;
Harner, 2010; ICAEW, 1999; Gates, 2006). Risk management has been
high on the agenda of finance practitioners and scholars as its focus has
broadened to include more questions of internal control, and new risk
categories including operational and reputational risks (Mikes, 2009;
Huber et al., 2013a). When applied to areas outside finance
departments, traditional statistical-driven techniques gave way to
broader and nebulous methodologies (Huber et al., 2013; Mikes, 2011).
The growth of risk management out of internal controls has
evolved risk management into an intensified focus on auditability of
processes, and corresponding trails of documentation to evidence
organizational adherence to interested stakeholders (Power, 2004b;
Tekathen, M., and Dechow, N., 2013; Bhimani, 2009; Jordan et al.,
2013). Power’s (2009) disheartening view on the growth of risk
management - the risk management of nearly everything - was less about
managing risk as it is formally understood and more about organizations
creating evidence of due process. Instead of managing risk, the financial
crisis of 2007-2009 found extreme risktaking to have played a pivotal
role (Dobbin, 2010), and that risk management may have helped
disguise poor risk practices (Huber et al., 2013).
II.2.1 Enterprise-wide Risk Management
Yet, risk management continues to be viewed as relevant and
important in many industries and types of organizations and this is
especially so when risk management takes on what many view as its
most popular paradigm called enterprise-wide risk management (ERM).
In September 2004, the COSO issued Enterprise Risk Management -
Integrated Framework, to provide a model framework for ERM. The
framework defines ERM as:
A process, effected by an entity’s board of directors, management
and other personnel, applied in strategy setting and across the
enterprise, designed to identify potential events that may affect the
entity, and manage risk to be within its risk appetite, to provide
reasonable assurance regarding the achievement of entity
objectives (COSO, 2004;
Beasley et al., 2005; Harner, 2010; Arena et al., 2010; Mikes,
2009; Beasley et al., 2010). COSO is a coalition of the main accounting
and finance trade associations in the United States and was formed due
to the fraudulent financial reporting issues in the mid-1980s (Power,
2009; COSO, 2004; Power, 2007).
As we discussed, and considering the influence of the internal
controls foundation over risk management, it is important to note
COSO’s 1992 Internal Control – Integrated Framework which
suggested that: by calling upon the risk awareness of employees, an
internal risk culture can be created; risk attitudes are aligned with
strategies and objectives; hazards and opportunities are identified in
relation to an organization’s objectives; and risks are assessed by the
potential likelihood and impact of their harm (Schiller et al., 2014;
COSO, 1992). Schiller et al., (2014) suggests that organizations risk
management is limited due to a lack of the concept of risk and risk
knowledge generation with current ERM frameworks, which may be
indicative of why current risk management has lost sight of the value of
integrating risk knowledge bases and risk management systems. Instead,
it seems that the COSO (1992) guidance provides the precursor
conceptual building blocks for the COSO 2004 ERM as a controls-based
approach to risk management, thus a direct influence on ERM can be
traced to an accounting conception of internal control (Power, 2009).
Hence, the ERM model is strongly influenced by accounting and
auditing standards of control, with an emphasis on detailed controls
supported with robust documentation evidencing effectiveness of the
controls (Power, 2009; Talwar, 2011; Jordan et al., 2013). Our proposed
risk governance framework seems warranted as it foundationally rest on
risk governance principles versus emphasizing standards of internal
controls which may enhance the understanding of risks and the ways in
which actors and institutions, public and private, deal with risks
surrounded by uncertainty, complexity, and/or ambiguity (van Asselt et
al., 2011) that appear to be lacking with current organizational risk
management (Schiller et al., 2014).
Nonetheless, while ERM has various sources feeding the same
basic idea, the COSO
(2004) version has become a global framework for best practice (Power,
2009; Paape et al., 2012; Huber et al., 2013). In a study by Viscelli
(2013) 64% of interviewees indicated that they leveraged COSO as a
reference or starting point but did not follow it in detail which is a telling
sign and indicative of the inconsistency in ERMs noted in some
research. ERM was viewed as one response to growing expectations by
various stakeholders as a possible effective response to risk management
challenges (Beasley et al., 2005; Paape et al., 2012). Broadly described
as a “process,” ERM requires a business entity to develop an
organization-wide, top down approach to identifying, assessing,
managing, and monitoring risks that would prevent the organization
from meeting its objectives and managing risks throughout its operations
(Beasley et al., 2005;
Kleffner et al., 2003; Harner, 2010; Pirson et al., 2011; McCormally et
al. 2012; Mikes et al.,
2014; Viscelli, 2013; Talwar, 2011; Arena et al., 2010; Jordan et al.,
2013). ERM is an
integrated risk-management framework intended to improve knowledge
of and communication about possible risks throughout the firm, and was
designed to increase the boards and senior management’s ability to
oversee these risks (Beasley et al., 2005; Kleffner et al., 2003; Harner,
2010; Pirson et al., 2011; McCormally et al. 2012; Mikes et al., 2014;
Viscelli, 2013).
ERM differs from earlier views of risk management with its
enterprise focus, and holistic versus silo approach where strategic,
operational, compliance risks, and financial risks, are addressed
concurrently (Paape et al., 2012; Harner, 2010; Kleffner et al., 2003;
Schiller et al., 2014; Gates, 2006; Mikes, 2009). For operational risk,
organizations were encouraged to consider the Basel II regulatory
definition, “the risk of loss resulting from inadequate or failed internal
processes, people and systems or from external events” (Basel, 2004).
Operational risk is broad and includes costs associated from human
error, legal liabilities, natural disasters, and can include cyber security
threats and regulatory fines, while strategic risks covers the hard-
toquantify risks that threaten key strategic and business objectives
(Basel, 2004; Mikes, 2008; Andersen et al., 2012; Heltman, 2015). In
these secondary risks such as strategy and reputation risk, we saw efforts
to quantify risks in an effort to formalize management’s judgement and
knowledge (Burchell, S., Clubb, C., Hopwood, A., Hughes, J., and
Nahapiet, J., 1980). The COSO ERM concept defines risk management
using a top-down approach that segments managerial responsibilities at
all levels of decision making and planning (COSO, 2004). It considers,
for example, that “each manager should be accountable to the next
higher level for his or her portion of enterprise risk management, with
the CEO ultimately accountable to the board” (Tekathen et al., 2013;
Arena et al., 2010; COSO, 2004). The intent of this integrated approach
was to help companies deal with risks and opportunities more
effectively, enhancing the organization’s ability to create and preserve
value for its stakeholders, and to promote more efficient use of capital in
financial and non-financial institutions alike (Power, 2009; Kleffner et
al., 2003; COSO, 2004).
The COSO ERM is represented as a three-dimensional matrix of
eight elements deemed essential for achieving strategic, operational,
reporting and compliance goals (COSO, 2004) and an organizations risk
appetite is a key concept in the COSO ERM framework. Risk appetite
refers to “the amount of risk, on a broad level, an entity is willing to
accept in pursuit of value” (COSO, 2004). This expresses the
organization’s risk attitude at the level of the organization as a whole
(Power, 2009; Paape et al., 2012). Risk appetite is the starting point of
COSO type ERM, and according to COSO (2004), consideration and
defining of the organizations risk appetite is essential for successful risk
management. Risk appetite may be expressed in qualitative or
quantitative terms, and at lower levels of an organization in the form of
risk tolerances that are subsequently aggregated (COSO, 2004; Power,
2009; Paape et al., 2012; Harner, 2010). While the design and
implementation of ERM is firm specific, it involves mapping the firm's
business strategies and risks. At its core, ERM revolves around efficient
and effective communication and monitoring of the organization's risks
against its risk portfolio. In addition to the risk appetite, organizations
are encouraged to develop key risk indicators that facilitate more
effective monitoring of potential risk events (Harner, 2010; COSO,
2004). In 2009, COSO issued a thought paper, titled Strengthening
Enterprise Risk Management for Strategic Advantage, to discuss the
importance of the board's role in ERM and to provide some guidance in
strengthening risk-management practices and complying with
anticipated regulatory mandates on risk management to assist boards in
fulfilling their role (Harner, 2010).
Once a company achieves a certain level of ERM sophistication,
risk oversight begins to take on an independent status, and ways this has
been signified include the appointment of a “chief risk officer” or the
transfer of risk oversight to an area such as strategic planning to avoid
possible conflicts of interest in responsibilities (Gates, 2006). The
purpose of such independence was that many organizations used outside
auditors to design and establish the ERM objectives and sought to avoid
the conflict of interest inherent in having them then be responsible for
evaluating those same ERM processes (Gates, 2006). To this end, as a
professional group, risk managements role included accommodating the
demands of various stakeholder groups: regulators, corporate executives,
shareholders, debt-holders and the general public (Mikes,
2008).
II.2.2 Role of Risk Management
It is believed by some that ERM provides a source of competitive
advantage for those who can demonstrate a strong ERM capability and
discipline (Beasley et al., 2005; Lessard, D., and Lucea, R., 2009). In
Mikes’ (2008) study, the interviewed senior risk officers emphasized
that the risk function creates strategic value when risk professionals
partner with the business lines and help them understand the cost of risk
taking. ERM factors from a governance and organization perspective
are: A clearly defined risk appetite articulated through limits and
monitoring procedures; Involvement of the board; Centralized ERM
organizational functions in place; A set of risk committees at both
corporate and business unit levels that ensure proper communication and
help to in-still risk awareness into the culture of the business
(McDonald, 2004; Schiller et al., 2014; Talwar, 2011). An ERM
framework should align the organization standards and policies, risk
measurement methodologies, and systems and tools (McDonald, 2004;
Pirson et al., 2011; McCormally et al. 2012; Mikes et al., 2014; Viscelli,
2013).
The role of risk management became more important as rating agencies
introduced requirements and from continued promulgation of risk
management by regulation. In May 2008, Standard & Poor’s announced
its efforts in evaluating an issuer’s ERM processes as an additional
component of their credit evaluation procedures (Standard & Poor’s,
2008). In March 2010, the Securities & Exchange Commission amended
required proxy disclosures by requiring publicly traded companies to
begin describing the board’s role in risk management practices (Beasley
et al., 2010; McCormally et al. 2012). While many financial institutions
were already subject to, or encouraged to act by, these requirements, it
was not until 2010 that the DFA created statutory ERM requirements
explicitly for financial institutions (McCormally et al. 2012; Bugalla, J.,
Kallman, J., and Narvaez, K., 2014; McDonald, 2004; Martin et al.,
2007). Changes in NYSE governance rules include requirements for
NYSE registrant audit committees to assume responsibilities with
respect to ‘‘risk assessment and risk management,’’ including risks
beyond financial reporting (Beasley et al., 2005; NYSE, 2003). Basel
Committee’s Core Principles for Effective Banking Supervision, require
regulators of banks to ensure that all banks in their country have in place
a suitable risk management process to identify, measure, monitor and
control risks (Talwar, 2011). This, in part, pressed regulatory agencies
to become more explicit about having a risk-based approach to
regulation. Regulators have repeatedly emphasized five areas: effective
structural governance, robust and independent internal audit functions,
consistent flow of risk-related information to the highest levels of the
institution, instilling a strong corporate culture, and early identification
of risks (McCormally et al., 2012).
Some recent studies have provided perspectives on the roles that
risk management plays in organizations and determined that it can
depend on the type of “calculative culture” within the organization
(Mikes, 2008). Mikes’ (2011) study identified two types of risk
management: one driven by a strong shareholder value imperative (risk
management by the numbers), the other corresponding to the demands of
the risk-based internal control imperative (holistic risk management).
The differences in the two styles are attributed to the calculative culture
of
“quantitative enthusiasm” and “quantitative scepticism” (Mikes, 2009;
Mikes, 2008). This shapes management preferences towards risk
management, hence impacting the role that risk management plays in an
organization. “Quantitative enthusiasts” aim to replace judgmental risk
assessments with risk quantification whereas “quantitative sceptics” turn
to risk modelling with caution, and are wary of managing risks by
numbers and rely more on executive judgement (Mikes, 2009; Talwar,
2011). In light of the new regulatory requirements in financial
institutions, it is not surprising that risk managers are under pressure and
are tasked by boards and senior leadership to be able to demonstrate how
the organization is meeting its risk management responsibilities (Mikes,
2008). Hence, the role of risk management also includes the production
of risk reports, risk maps, stress test, and scenario analysis, and to also
satisfy regulatory expectations (Mikes, 2009; Mikes et al., 2014; Jordan
et al., 2013). Risk maps are based on risk identification and assessment
processes, stress tests are based on data collection and statistical
analysis, and scenario analyses are based on possible risk events that the
organization may find itself impacted by (Mikes, 2009; Mikes et al.,
2014; Jordan et al., 2013). In particular, regulators will look to see
whether the information reaches senior management and whether and
under what circumstances information reaches the Audit Committee,
Risk Committee, and board (McCormally et al., 2012).
From a scholar’s perspective one might believe that, with such an
abundance of principles, guidelines, and standards, risk management is a
mature discipline with clear and proven concepts and tools used by
organizations in practice (Mikes, 2014). However, this does not appear
to be the case as risk management systems are largely unproven and still
emerging (Mikes, 2014). Many organizations are not implementing
ERM’s (Viscelli, 2013) and if they are, they are creating their own
hybrid systems to manage risk (Arena et al., 2010; Mikes, 2011; Jordan
et al., 2013; Mikes, 2014). This is impactful as it makes it difficult to
ascertain whether or not risk management systems such as ERM are
creating their supposed value (Huber et al., 2013a; Mikes, 2008;
Andersen et al., 2012; Martin et al., 2007; Pirson et al., 2011). Also,
while some of the studies discussed provide perspectives on the role that
risk management plays in organizations, the wide variety in risk
management systems makes it challenging to understand the dynamics
and components impacting risk management practices which affects the
research in this space. Further, many practitioners have expressed
dissatisfaction with the proposed normative and regulatory ERM
frameworks (Mikes, 2014; Paape et al., 2012; Arena et al., 2010).
Research into barriers to effective risk management is needed and our
study seeks to provide a sound risk governance framework with which to
explore what these barriers may be.
II.3 Challenges of Risk Management
The global financial crisis of 2007-2009 has negatively impacted
the reputation of risk management as a suitable response to uncertainty
(Huber et al., 2013; Tekathen et al., 2013). Some literature indicates that
organizational focus is on adhering to expectations and avoiding
potential blame by evidencing their conformance to regulatory
requirements and document trails. Indeed, Power (2009) suggest that
ERM might be better termed the ‘risk management of nothing’ being
nothing more than an emblematic response to a growing audit culture,
with little and even dysfunctional, impacts on routine operations (Huber
et al., 2013a). This focus on auditability by interested stakeholders may
cause organizations to overlook perhaps weaker indicators that may
actually point towards risks (Power, 2004; Huber et al., 2013; Tekathen
et al.,
2013). In turn, organizations address what is referred to as policy risks
thus prompting organization focus on meeting and adhering to policy
actions called for by regulators and governments (Ghoshal, 1987).
Hence, we can see the evolved accounting or internal controls based risk
management systems serving as organizational compliance mechanisms
or
“rationalization machines” which have been implicated as the reason for
some company’s failure, as risk management was relegated to a
compliance function (Ghoshal, 1987; Beasley et al., 2010; Mikes et al.,
2014; Burchell et al., 1980; Kaplan et al., 2012). Organizations can then
project an illusion of control to sustain external legitimacy while doing
little in practice to actually manage problems (Huber et al., 2013a;
Martin et al., 2007; Powers, 2004).
The perception that risk management was part of a “tools culture”
driven by concerns for audit and control undermined the extent to which
organizations felt it could improve decisionmaking (Huber et al., 2013a).
Hence, many people question the value in investing further in their
organizations risk management system and practices (Beasley et al.,
2010). This effect may be compounded by the notion that as it enters the
organization, risk management systems such as ERM inevitably
encounter other legacy risk management systems or practices which
introduces variations in risk management practices (Arena et al., 2010).
Most financial institutions have some kind of risk management system in
place, but most of these systems are piecemeal approaches, which is
further accentuated as many organization leaders believe their ad hoc
and informal approaches are adequate and appropriate (Talwar, 2011;
Beasley et al., 2010).
ERM may be relevant for regulators and others in need of proof of
good governance as existing top-down designs for ERM are valued by
regulators seeking to make senior management accountable, but such
approaches are not realistic as it has become progressively detached
from the reality of modern financial organizations and are not grounded
in the demand for management action, which is always somehow
“outside” the framework (Martin et al., 2007).
Indeed, the recurring instances of risk management system weaknesses
have often been implicated as a contributor to the widespread failure of
managerial and regulatory intelligence suggesting that the approach to,
or implementation of, risk management practices is deficient in some
respect (Power, 2009; Harner, 2010; Beasley et al., 2010). This
indicates room for improving underlying processes and procedures to
strengthen an organization’s identification, assessment, and reporting of
key risk exposures arising across all aspects of the organization (Power,
2009; Harner, 2010; Beasley et al., 2010). To this end, identifying
barriers to effective risk management may bridge the gap between
literature and practice in the field of risk management thus providing
practitioners the ability to draw from these factors to better focus their
limited resource on those things which really make the difference
between success and failure (Yaraghi et al., 2011). Research into
identifying barriers to effective risk management is needed to help
provide such insights and perspectives to risk management professionals
and academia alike.
II.3.1 Barriers to Risk Management
Current assessment still finds that empirical work on ERM is
limited and can be classified along three main lines of research –
describing the ERM practice, analyzing the determinants of ERM
adoption, and assessing the valuation effect of ERM (Eckles, D. L.,
Hoyt, R. E., and Miller, S. M., 2014). In most cases, our review of risk
management literature has found that the focus of the articles was not
explicitly to seek barriers to effective risk management, however, our
analysis has identified certain salient themes relative to barriers to
effective risk management which can be categorized as strategy,
organization structure, organization culture, communication, bias,
process design/tools, and a final theme of the barrier being the concept
of risk management itself. These are not presented as an exhaustive list,
but the perspectives provide views of possible barriers to effective risk
management.
It does not appear that literature supports that organizations are
linking ERM to strategy (Viscelli, 2013). Poor level of board
involvement and strategic oversight was found to be impactful towards
ensuring the firms risk appetite was broadly understood in the
organization (McCormally et al. 2012). In one case study, it appeared
that a banks inability to secure the faith of the board in strategic
discussions affected its risk management capabilities (Mikes, 2009).
Organization structure led to a great deal of variability in a study where
the multiplicity of local risk management circles throughout the firm led
to data inconsistencies (Tekathen et al., 2013). Organizations may
recognize certain risks and potential events were important, but in
practice, there was no overarching strategy or process design, hence it
was not clear who in the organization owned responsibility for
“information objects” (Tekathen et al., 2013). One study found that a
deterrent to risk management systems such as ERM was an organization
structure that discouraged ERM (Kleffner et al., 2003).
Organizational culture was found to be a major deterrent to risk
management as risk management practices were discouraged and
resistance to change was constant; some studies reflected a rebellious
tone where risk management practices were treated by managers as
unavoidable tasks imposed by the parent company that did not add value
to their existing knowledge (Kleffner et al., 2003; Arena et al., 2010).
One study’s finding suggested that the observed poor risk management
practices could be linked to an unhealthy organizational culture which
played a significant role in the failure to implement sound risk
management practices
(Andersen et al., 2012). “Mind-sets” can be impacted as a study
showed that less attention was paid to those issues where responsibilities
were shared, which suggested that rather than challenging organizational
practices, it acted as a force toward organizational conservatism thus
reinforcing existing understanding and practice (Huber et al., 2013a). As
noted in a recent Wall Street article, Thomas Baxter, general counsel of
the Federal Reserve Bank of New York, stated in a speech on culture, “I
confess that proof is hard to come by, yet I am not alone in the
fundamental belief that a strong organizational culture will lead to better
behaviour” (Glazer, E., and Rexrode, C., 2015). Organizational culture
has also been found to negatively impact the notion of accountability as
a study noted that accountability became an object of desire rather than
an effect of their practice (Tekathen et al., 2013). Organization culture
was identified in a study of Malaysian public companies of independent
non-executive directors as impacting, or being barriers to, their
effectiveness in performing their roles (Annuar, 2012). Organizational
culture has been widely held to be the major barrier to creating and
leveraging knowledge assets and in one study of policy formulation
contributed to the observed fear of undermining an existing policy
(David, W., and Fahey, L., 2000; Termeer, 2009).
Harner’s (2010) research noted apparent weaknesses in
communication as risk managers rarely discussed or assessed the
company's overall risk profile and instead confined their risk
management to separate and individual silos. Communication
challenges can come in the form of pressure to conform due to positive
feedback loops as Hindmoor and McConnell’s (2013) study found that
where a policy is perceived as being generally successful, a positive
feedback emerges where pressures to extend a policy form resulting in
risk signals being discounted. Harm in the form of miscommunication
may arise as a study by Huber et al. (2013a) suggested that while the
language of risk created a common “currency” with which to
communicate, it also created potential for serious miscommunication as
risk assessments communicated the most likely impacts of policy
options, and paid little attention to related uncertainties. Communication
through documentation can present challenges as the more parties touch
the documents, the communicated character of specific issues can
become opaque with each additional review (Tekathen et al., 2013).
Timeliness in communication of risk information was realized in one
study where the needs for timelier and firmer signals to decision makers
were identified (Mikes, 2009). The lack of communication in the form
of organizational silence is a paradox where most employees know the
truth about certain issues and problems yet do not speak of it to their
supervisors (Morrison, E. W., and Milliken, F. J., 2000).
Relative to bias, organizations may be pressured to deliver upon
immediate goals which results in bias toward the preservation of existing
institution policies and procedures leading to minimizing the need to
clarify and communicate risks (Hindmoor et al., 2013; Harner, 2010;
Termeer, 2009). Mikes (2014) indicates that organizational biases, such
as “groupthink,” which is akin to organizational silence, also inhibit
good thinking about risks. Groupthink arises when individuals, still in
doubt about a course of action that the majority has approved, decide to
keep quiet and go along (Mikes, 2014; Morrison et al., 2000).
Process design/tools challenges can be seen in circumstances
where risk management practices were not able to be supported by the
risk applications and infrastructure (Martin et al.,
2007). In Mikes’ (2009) study, process design may have proved
impactful as the process of treating “red signals” were treated as learning
opportunities which prompted revisions of limits versus the process
being designed to risk manage and intervene. Power’s (2009) study
indicated potential process design issues where the need to embed “risk
management and internal control systems within business processes”
was an understood imperative, yet, there was little elaboration of what
that might involve. Termeer’s (2009) case study found that the framing
of a situation as a crisis or a race to reach a deadline put additional
pressure on the process, causing managers to fall back on methods and
tactic’s they were familiar with. Tools or risk models was a point of
challenge for a bank in Mikes’ (2009) study in that risk personnel spent a
great deal of time on calculating how much risk they had and ignored the
bigger picture. Further, a risk controller in the study was not convinced
that a risk tool was able to accurately reflect the underlying risk
exposure and its dynamics (Mikes, 2009).
Some studies question facets of risk management including the
paradigm ERM and the notion of risk silos. Tekathen et al. (2013)
suggest that the implementation of ERM does not ensure organizational
risk management but instead actualizes the ambiguity and heterogeneity
of organizational risk practices. Paape et al. (2012) indicated that they
found no evidence that application of the COSO framework improves
risk management effectiveness to help organizations establish sound risk
management (Schiller et al., 2014). One study identified an obstacle to
risk management being the existence of the silo risk mentality (Kleffner
et al., 2003).
Hall et al.’s (2013) study expressed the negative of the organization
having compartmentalized risk, i.e., operation risk, credit risk, market
risk, and reputation risk, when they should be viewed as all interacting.
A top Federal Reserve official said the central bank is still grappling
with how to quantify certain types of risk for which incidents are
unpredictable such as operational risk at the largest banks much less
identify reliable controls to manage them (Heltman, 2015).
As can be seen above, while most of the studies did not explicitly
seek to identify barriers to effective risk management, our analysis
reveals the identification of several factors that may denote barriers to
effective risk management. The study by Cho et al. (2014) identified that
going through the process of creating RPs a benefit was improved risk
management and knowing the organization better, yet, most of these
institutions subject to RP undoubtedly had some level of risk
management practices prior to DFA (McCormalley et al., 2012; Hall et
al., 2013; Mikes, 2011; Harner, 2010). We seek to explore what are
barriers to effective risk management.
II.3.2 Proposed Risk Governance Framework
Yaraghi et al. (2011) developed critical success factors related to
risk management and developed them in a way to show how these
factors relate to each other, and how RMS strategies can be defined,
monitored, and controlled to provide adequate treatment to these factors
from the time a organization decides to implement RMS, during the
project of design and implementation, and finally throughout the life of
the RMS. Our adapted three phases of RMS, readiness, execution, and
administration is the first component of our proposed risk governance
framework (RGF). We view these phases as part of an on-going
feedback loop that should not be viewed as strictly linear. This is
important as risk management and governance in institutions change
over time, hence; for example, the organization may need to transition
from administration back to readiness to consider new risk events and its
impact to the organization and the RGF. With the variety of
organization’s risk management structures in existence, it would be very
difficult to generalize a mapping or alignment of our three phases to an
organization risk management systems/practices. Part of the strength of
our proposed RGF is to provide flexibility for practitioners and academia
to leverage this framework at all levels of an organization’s risk
management systems/practices and in a variety of industries. Hence, one
should readily be able to consider the correlation of the three phases to
their respective organizations risk management systems/practices. For
example, from a responsibility perspective, one could consider that all
three phases would be led by senior executives and committees with
perhaps certain facets of the phases aligned with middle/lower level
management and committees, e.g., while “strategy” approval during the
readiness phase may require board approval, “process design”
responsibilities during the execution phase may have more involvement
of middle level management and committees.
We also draw from recent studies that provide opportunities to
refine the success factors underlying the RMS and enhance the
conceptualization of the three phases. We refined the factors and phases
by drawing from Mikes’ (2014) study which suggests three ERM design
parameters and three contingency variables classifying different types of
risk events. The three design parameters (see Table 30 for more details)
are, (1) Processes for identifying, assessing, and prioritizing risks; (2)
Frequency of risk meetings; and (3) Risk tools. Mikes (2014) identified
these parameters as an “ERM mix,” and as fundamental components of
risk management. The three contingency variables classify different
types of risk events (see Table
30 for more details) as, (1) Preventable risks; (2) Strategic execution
risks; and (3) External risks. Specifically, we enhanced the CSF Process
design to reflect the three design parameters and the three types of risk
events. We also enhanced the CSF Environment to reflect External
risks. As Mikes’ (2014) study indicates that organizations risks are
contingent on context and circumstances, she offers these as ideas about
what risk management may depend on.
In Lundqvist’s (2014) study, she identified four pillars that are
integral to the implementation of an ERM (see Table 31 for more
details) as, (1) General internal environment and objective setting; (2)
General control activities and information and communication; (3)
Holistic organization of risk management; and (4) Specific risk
identification and risk assessment activities. Interestingly, relative to
pillars 1 and 2, she found these components are not directly associated
with risk management; firms that demonstrate no risk management
activities could still implement these two components in a robust way,
for example, if they have strong governance in place. Hence,
conceptualizing dimensions or components by separating riskrelated
dimensions or components from those that are not directly related to risk
could be a way to improve RMS (Lundqvist, 2014). Given our three
phases, we refined our RMS by aligning pillar 1 to readiness and pillar’s
2, 3, and 4 to readiness, execution and administration.
Furthermore, Lundqvist (2014) suggests a more consolidated framework
with “broader components” as existing frameworks may offer too many
components. This may provide better guidance with risk management
frameworks as her study showed that organizations do not implement
ERM based on existing component definitions and instead implement on
broader terms. Our RMS aligns with this suggestion with three broader
phases aligned to the four pillars. This may provide a framework for
practitioners to draw from as it separates risk and non-risk related
phases, i.e., readiness, and conceptualizes components on a broader
level, i.e., readiness, execution, and administration.
The growth of risk management out of internal controls has in turn
evolved risk management into an intensified focus on process, and on
auditable trails of documentation thus supporting the need for external
display of internal organizational coherence (Power, 2004b;
Tekathen et al., 2013; Bhimani, 2009; Jordan et al., 2013). Although
COSO’s 1992 Internal - Integrated Framework suggested more of a risk
awareness and internal risk culture, instead, it seems that the COSO
(1992) guidance provided the conceptual building blocks for the COSO
2004 ERM as a controls-based approach to risk management, thus a
direct influence on ERM can be traced to an accounting conception of
internal control (Power, 2004). This drives organizations to create
elaborate trails of detailed controls with corresponding documentation to
prove the quality of processes (Power, 2009; Martin et al., 2007; Talwar,
2011; Jordan et al., 2013). Schiller et al. (2014) suggests that
organizations risk management is limited due to a lack of the concept of
risk and risk knowledge generation with current ERM frameworks,
which may be indicative of why current risk management has lost sight
of the value of integrating risk knowledge bases and risk management
systems.
The notion of “risk governance” has been coined only recently and
is generally linked to efforts related to “TRUSTNET – concerted action
on risk governance” (van Asselt et al., 2011). The concept of risk
governance pertains to the various ways in which many actors,
individuals, and institutions, public and private, deal with risks
surrounded by uncertainty, complexity, and/or ambiguity (van Asselt et
al., 2011). Risk governance provides a conceptual as well as normative
basis for how to deal responsibly with uncertain, complex, and/or
ambiguous risks in particular (van Asselt et al., 2011). However,
research suggests that COSO ERM does not address the management of
uncertainties (Tekathen et al., 2013). Risk principles may serve as
guidance for practitioners as they need to understand how different
individuals and groups within organizations define risk, potential biases
in risk assessment, and challenges in implementing risk management
initiatives as many risks cannot be calculated on the basis of probability
and effects alone (Bromiley et al., 2014; van Asselt et al., 2011). Risk
governance highlights the importance of uncertain, complex, and/or
ambiguous risks; however, it is a consistent finding that in most of these
cases, the risks are treated, assessed, and managed as if they were simple
(van Asselt et al., 2011). Perhaps it is the uncertainty around what
constitutes risk which lends it the capacity to alter, define, and reshape
risk management activities in particular ways (Bhimani, 2009). The lack
of precise definitional characteristics enables the concept of risk to effect
organizational risk management by conferring legitimacy on redefining
boundaries of risk management (Bhimani, 2009). The failures to deal
adequately with risks such as the financial crisis demonstrate the need to
develop alternative concepts and approaches to deal with uncertain,
complex, and/or ambiguous risks (van Asselt et al., 2011).
We therefore draw from van Asselt et al.’s (2011) risk governance
study. While there may be other risk governance principles, van Asselt
et al.’s (2011) study synthesized the body of scholarly ideas and
proposals on governance of systemic risks and explicates the idea that
risk management is to help risk professionals to familiarize themselves
with a broader concept of risk. We view that what may be missing from
these normative RMS frameworks are underlying guidelines that can
inform thinking about how to deal with uncertain, complex and/or
ambiguous risks in various contexts. We adapted van Asselt et al.’s
(2011) set of three principles which are
(see Table 32 for more details), (1) Communication and Inclusion; (2)
Integration; and (3) Reflection. These principles should be read as a
synthesis of what needs to be seriously considered in organizing
structures and processes to manage risks (van Asselt et al., 2011).
Schiller et al., (2014) notes organizational failure to recognize the value
of communication as it can result in poor integration of risk knowledge
bases and risk management systems. Bromiley et al. (2014) suggests
that as underlying strategic choices strongly influence firm-level risk,
then risk management efforts at lower levels may have limited value,
hence it is important to consider communication and inclusion with risk
management practices. Risk management should be embedded and
integrated in the company's cultural and organizational fabric that it is
barely noticeable as a distinct management function at either the
strategic or tactical level (Lessard et al., 2009). The integration principle
may provide guidance as risk management requires coordination so that
decisions made at one level in the organization do not result in the
creation of new risks at other levels (Lessard et al., 2009). Reflection is
important as it is difficult for risk governance to be routinized (van
Asselt et al., 2011); managers make decisions based on what they
believe and often their beliefs differ greatly from objective measures of
risk (Bromiley et al., 2014). Also, individuals or organizations do not
make consistent risk judgments or have consistent risk preferences,
hence, the incorporation of the risk governance reflection principle, may
enhance understanding managerial mental models of cause and effect for
hard-to-measure types of risk (Bromiley et al., 2014; van Asselt et al.,
2011). We refined and enhanced our RMS by utilizing these three risk
principles to function as underlying guiding principles to managing
risks, which completes our refinements and enhancement to the RMS
thus resulting in the RGF
(see Table 33 for more details).
II.3.3 Summary
Our research on barriers to effective risk management through the
lens of the RGF, which as Table 33 shows, incorporates the RMS
enhanced as noted above, provides an RGF with an RMS empirically
grounded in success factors and corresponding phases, and risk theory
based principles serving as underlying guiding principles to enhance risk
management, will provide rich perspectives on barriers to effective risk
management. We view the proposed RGF as a model that may provide
practitioners a more practical framework to draw from to enhance their
organizations ability to address "organizational realities" (Arena et al.,
2010, Martin et al., 2007) versus providing a mere auditability of risk
management practices (Power, 2004; Huber et al., 2013; Tekathen et al.,
2013). By leveraging our proposed RGF, we can explore the various
phases of RMS where barriers to effective risk management may arise
thus creating unanticipated effects. We provide practitioners a model to
draw from that foundationally rest on risk governance principles versus
internal control basis, which may enhance the understanding of risk
governance and the various ways in which many actors, individuals, and
institutions, public and private, deal with risks surrounded by
uncertainty, complexity, and/or ambiguity (van Asselt et al., 2011) that
appear to be lacking with current organizational risk management
(Schiller et al., 2014). Lastly, we do not necessarily portray the RGF as
an enterprise-wide risk management system, but more so a model that
may be drawn upon by practitioners in varying industries and at all
levels of an organization’s risk management practices (Talwar, 2011).
II.3.4 Research Model
The study by Cho et al. (2014) identified that going through the
process of creating RPs benefits cited by respondents were improved
risk management and knowing the organization better, yet, most of these
institutions subject to RP undoubtedly had some level of risk
management practices prior to DFA (McCormalley et al., 2012; Hall et
al., 2013; Mikes, 2011; Harner, 2010). We seek to explore barriers to
effective risk management for the 130 institutions subject to the RP
requirements of DFA. We draw from Yaraghi et al.’s (2011) RMS study,
which identified critical success factors to RMS to explore barriers to
effective risk management. We adapted as three phases of RMS,
readiness, execution, and administration, and some of the noted success
factors, to explore these barriers.
We will seek to obtain the perspectives of the respondents and
based on our review of the survey results, we will test the following
hypotheses:
H1 - Both RMs and REGs will not view Readiness factors as
barriers to effective risk management.
H2 - RMs will have a higher perception than REGs that Execution
factors are barriers to effective risk management.
H3 - REGs will have a higher perception than RMs that
Administration factors are barriers to effective risk management.
Relative to the three risk governance principles, as van Asselt et al.
(2011) expressed that her study does not provide a model in the strict
sense of the word, there is no prior empirical research performed on the
three risk principles as adapted to the RGF, therefore, our analysis is
structured around a research question (i.e., survey question 5; see the
questionnaire located in Appendix B) and focusing on analyzing those
results rather than testing the theory. Hence, we will review the survey
results and test the following hypothesis:
H4 - Both RMs and REGs will view Risk principles as favorable
towards effective risk management.
Our survey data comes from institutions subject to RPs and many
of these institutions most likely have risk management practices in place
and/or underway and many may have enterprise-wide risk programs in
place or underway. As we seek to explore barriers to effective "risk
management" and not just "enterprise -wide" practices, we control for
this plausible factor by focusing on the three phases of readiness,
execution, and administration and the variables to subscribe to the notion
of "risk management" practices and not just "enterprise-wide" practices.
DATA AND METHODOLOGY
III.1 Research Approach
The goal of this research is explore barriers to effective risk
management. Based on survey data from 130 institutions subject to the
RP requirements of DFA, and certain regulatory agency’s examiners and
analyst, we explored these barriers using our proposed RGF as the lens
through which we performed the analysis. Appendix B has the survey
questionnaire we used in this study. The survey questions were adapted
from Yaraghi et al.’s (2011) study which defined critical success factors
and their properties for risk management systems and from Cho et al.’s
(2014) study on perceptions of the effectiveness of RPs. The questions
asked were designed to reveal possible barriers to effective risk
management in the phases of readiness, execution, and administration.
We also explored perspectives relative to the three risk principles (van
Asselt et al., 2011) that serve as guiding principles for the RGF. We
complimented the results from our
Likert-type scaled survey with several open ended questions and the
feedback provided to those. Therefore, we chose a mixed methods
approach as the qualitative results may provide richer insights into the
quantitative analysis findings (Venkatesh, 2013).
III.2 Data Collection
Our sampling of experts had two criteria, such that respondents are
(1) involved in or knowledgeable about risk management systems and
practices and (2) currently employed in the financial industry or serve as
a financial industry expert (REG) (Cho et al, 2014). We identified the
financial industry individual as risk management personnel (RM) at the
130 financial institutions subject to RP requirements. We defined RMs
as the members of financial institutions who are responsible for the
firm’s risk management activities. REGs are employed by the Federal
Reserve District Banks (Fed), the Office of the Comptroller of the
Currency (OCC), the Federal Reserve System (Board), or the Federal
Deposit Insurance Corporation
(FDIC), and involved in the oversight of one of the 130 RPs.
To locate RMs and REGs with firsthand knowledge of risk
management systems/practices, we contacted approximately 650 Fed,
FDIC, and OCC regulators with job titles of “Examiner” or “Analyst,”
including Board personnel responsible for the supervision and regulation
of the financial institutions, as well as bankers with explicit titles or
responsibilities relative to risk management. All 12 Fed’s were included.
We also solicited information from approximately 130 LinkedIn
members currently employed by the approximately 130 institutions
whose public profiles suggested possible responsibilities for risk
management oversight. The questionnaire is comprised of 20 questions:
7 quantitative and 8 open-ended, qualitative items; there was also one
question that served to identify the respondent as RM and REG; three
questions captured demographic information; and one question captured
whether or not the respondent would like to obtain a summary of the
study. We collected the data between June 15, 2015 and August 8, 2015.
First, we asked potential respondents to identify the type of
organization that currently employed them. The options provided to
respondents included, “Financial institution” and “Government
regulatory agency.”
Second, respondents selected their responses on a Likert-type,
seven-point scale on their views of barriers to effective risk management
systems/practices in the phases of readiness, execution, and
administration. We also measured their perspectives on the three risk
principles and the value they placed on these principles towards effective
risk governance and risk management. Eight open-ended questions
helped us gain insight into what these expert respondents viewed as
barriers to effective risk management, including factors shaping
perceptions of risk management, as well as what changes they would
suggest to improve the effectiveness of risk management
systems/practices. A weighted response question asked respondents to
choose, from a list of nine possible barriers that we gathered from
previous literature, which ones they believe are barriers to effective risk
management.
III.3 Data Analysis
III.3.1 Quantitative Data
Our statistical tests include Independent Samples T-Test to
evaluate differences between RMs and REGs relative to the phases of
RMS and perspectives as to the extent that barriers to effective risk
management exist in the phases of readiness, execution, or
administration. We performed independent samples t-test to evaluate
perspectives of the importance of the three risk principles towards
effective risk management and to rank the respondents response to a
weighted response question that asked respondents to choose, from a list
of nine possible types of barriers that we gathered from previous
literature, which ones they believe are barriers to effective risk
management. To examine differences between RMs and REGs, we
summed for each variable the numerical values of each of our subscales
including the three phases of readiness, execution, and administration
and took the mean to produce the total score (Burns, 2008).
III.3.2 Qualitative Data
The responses to our eight open-ended questions were analyzed
and coded in accordance with descriptive coding methods (Miles, M.B.,
Huberman, A.M., and Saldana, J., 2014). First, one author reviewed the
responses to the open-ended Question 8 (see in Appendix B) and applied
a content analysis technique to develop phrase categories or coded
responses based on each respondent’s response to the question (Myers,
2009). The barriers listed in our Question 7 (see in Appendix B), were
used to help shape the coded responses. Still, the majority of our coded
responses emerged through Inductive coding from our collected data
(Miles et al., 2014).
Second, the same author reviewed the responses in the remaining
seven open-ended questions and used where possible the coded
responses generated from Question 8. Myers (2009) content analysis
technique was employed to develop additional coded responses based on
each respondent’s response to each of the seven remaining open-ended
questions where necessary. As a result, each of the eight open-ended
questions reflected a set of coded responses and some of the coded
responses were applicable to more than one open-ended question.
Third, we invited two REGs who were participants in the survey,
and hence familiar with the survey tool, to code the eight open-ended
questions. We did not seek to utilize a RM as one of the coders, as the
nature of the topic and interaction by “banker” along with “regulator”
generated angst and raised concerns of confidentiality. Independently,
each REG applied the content analysis technique (Myers, 2009), but
utilized the coded responses that were previously identified for each of
the eight open-ended questions by the one author.
Fourth, the one author obtained the completed coded responses
from both REGs and consolidated the three independent coded
responses. This was performed for each open-ended question. This first
cycle coding identified differences in the coded responses assigned.
This was attributed to the fact that some of the open-ended questions
elicited broad responses for a single question from a respondent.
Fifth, we collaborated on determining the common coded response
and on determining common themes, for each respondent’s response in
each of the eight open-ended questions, to summarize them. For
intercoder reliability, the first cycle coding ranged in agreement from 58
percent to 92 percent and 98 percent to 100 percent after the second
cycle (Miles et al., 2014).
IV.1 Comparison of RMs and REGs
Provides descriptive profiles of our respondent group of 41 RMs
and 96 REGs who completed our survey. Many of our respondents are
overwhelmingly male, 78% and 77% for RMs and REGs respectively,
and a large majority had four year college degrees (32% and 33% for
RM and REG respectively), some postgraduate (7% and 17% for RM
and REG respectively), and postgraduate degrees (59% and 49% for RM
and REG respectively). The respondent group was represented by a
broad age range but most were 35 years or older, with the largest
percentage population in the age range of 45-54 at 44% and 38% for
RMs and REGs respectively.
Our research provides rich perspectives on barriers to effective risk
management. This includes their views obtained from open-ended
questions on compensation practices, the current unique banking
environment with the concept of “too big to fail” providing perhaps a
type of “insurance” in that some organizations would be “bailed out,”
how complete risk management systems/practices should be to be
“effective,” the impact of the state of the financial/economic
environment in shaping perceptions of effective risk management,
barriers to effective risk management leading up to the financial crisis of
2007-2009, whether current risk management practices are more
“quantitatively” or “qualitatively” driven, and finally what changes they
would suggest to improve the effectiveness of risk management
systems/practices.
We conducted Independent Samples T-Test to evaluate our four
hypotheses and to facilitate analysis of mean scores for our one weighted
response question to rank the respondents perspectives on the list of nine
possible barriers. For our H1, that both RMs and REGs will not view
Readiness factors as barriers to effective risk management revealed that
RMs and REGs do not differ significantly in terms of Readiness factors
(see Table 3), such that both groups expressed moderately strong views
that weaknesses in these Readiness factors may manifest barriers to
effective risk management.
For our H2, that RMs will have a higher perception than REGs that
Execution factors are barriers to effective risk management revealed that
RMs and REGs do not differ significantly in terms of Execution factors
(see Table 4), such that both groups expressed strong views that
weaknesses in these Execution factors may manifest barriers to effective
risk management.
For our H3, that REGs will have a higher perception than RMs that
Administration factors are barriers to effective risk management
revealed that the “Administration – Inadequate levels of top management
support of risk management systems/practices” factor was statistically
significantly different (RM M = 5.88, REG M = 6.48; t = -2.14, p = .04),
such that REGs more strongly viewed this Administration factor as
manifesting barriers to effective risk management systems/practices than
RMs (see Table 5). The difference in this factor reveals perhaps a level
of skepticism that REGs may have as part of their supervisory oversight
in dealing with top management that may not exist with RMs working
under that management. It could boil down
to a level of confidence issue. However, similar to Readiness and
Execution phases, both respondent groups expressed strong views that
weaknesses in these Administration factors may manifest barriers to
effective risk management.
For our H4, that both RMs and REGs will view Risk principles as
favorable towards effective risk management revealed that RMs and
REGs do not differ significantly in terms of the Risk principles (see
Table 6), such that both groups expressed strong views that these Risk
principles are important to effective risk governance and risk
management. The strong beliefs of the importance of Risk principles is
consistent with the perspective that Risk principles may serve as
guidance for practitioners as they need to understand how different
individuals and groups within organizations define risk, potential biases
in risk assessment, and challenges in implementing risk management
initiatives (Bromiley et al., 2014; van Asselt et al., 2011).
Our hypotheses, with the exception of the one Administration
factor that was statistically significantly different, while not supported,
gave us more practical comfort relative to perspectives of RMs and
REGs. We tailored these hypotheses to baseline presumptions of
perspectives that we felt RMs and REGs would have. For example, for
H2, that RMs would have a higher perception than REGs that Execution
factors are barriers to effective risk management was predicated on the
possibility that as RMs live closer with RMS execution daily, that RMs
would have stronger views than REGs that Execution factors may
manifest barriers to effective risk management. Similarly, for H3, that
REGs would have a higher perception than RMs that Administration
factors are barriers to effective risk management was predicated on the
view that as supervisors, with focus and concerns more relative to
governance and administration of RMS, REGs would have a higher
perception than RMs that barriers to effective risk management may
manifest in the Administration phase. While one Administration factor
(Inadequate levels of top management support of RMS) proved to be
statistically significantly different, the other three Administration factors
did not. Further, for H1, that both RMs and REGs will not view
Readiness factors as barriers to effective risk management was
predicated on the view that perhaps a weakness with RMS relative to our
respondent groups of RMs and REGs would stem from a greater focus
by these groups on Execution and Administration phases due to our
previous views noted. With the challenges and scrutiny that RMS faces,
one could take solace with these hypotheses not being proven, which
would seem to evidence alignment in RMs and REGs perceptions that
barriers to effective risk management may manifest in all the phases of
Readiness, Execution, and Administration, including the balanced
perspective that Readiness factors are not overshadowed by the latter
two phases of Execution and Administration.
The study by Cho et al. (2014) identified that going through the
process of creating RPs a benefit was improved risk management and
knowing the organization better, yet, most of these institutions subject to
RPs undoubtedly had some level of risk management practices prior to
DFA (McCormally et al., 2012; Hall et al., 2013; Mikes, 2011; Harner,
2010). Our proposed RGF lens enabled exploration of RMS and our
respondents strongly viewed that barriers to effective risk management
can manifest in the phases of Readiness, Execution and
Administration. The respondents also strongly viewed the importance of
the three risk principles to effective risk governance and risk
management. To further augment our exploration of barriers to effective
risk management, we turned to the qualitative data for additional
perspectives.
IV.2 Selected Barriers to Effective Risk Management
Displays the responses to the Likert-type question that featured
nine possible barriers to effective risk management. We obtained the
mean scores to each of the nine barriers by RM and REG and took the
average of their mean scores and ranked the nine barriers.
Tekathen et al.’s (2013) study suggests accountability became an object
of desire in
organizations. In line with this, the most highly ranked item selected
overall was Accountability,
i.e., lack of accountability, poorly defined job roles/responsibilities, and
the level of employee involvement in risk management systems/practices
(Average mean score = 6.01). Personnel, i.e., lack of qualified personnel
to execute risk management practices (Average mean score = 5.91), and
Oversight, i.e., inadequate oversight by the board and senior leadership
(Average mean score
= 5.65) ranked second and third overall respectively. The rankings of
items differed by respondent category though. That is, REGs indicated
that their second ranked concern was
Oversight, (REG mean score = 6.01) versus Personnel. Further, of the
nine barriers, only
Oversight’s Independent Samples T-Test indicated a significant
difference in scores for RMs and REGs (RM M = 5.29, REG M = 6.01; t
= -2.90, p = .004), such that REGs more strongly viewed inadequate
oversight by the board and senior leadership as a barrier to effective risk
management systems/practices than RMs.
IV.3 Compensation Practices
Our count and phase analysis indicates that both RMs and REGs
believe compensation practices may manifest barriers to effective risk
management and generally in the Execution phase. Our coding and
subsequent content analysis identified five major categories of the types
of barriers that may manifest: misalignment to strategy (e.g.,
compensation practices not tied to strategy), risk taking (e.g.,
compensation practices that encourages excessive risk taking),
compensation controls (e.g., lack of compensation related controls), risk
culture (e.g., culture that does not promote risk management), and risk
management personnel (e.g., lack of experienced, sufficiently
compensated risk management staff).
Both RMs and REGs believe compensation practices may manifest
barriers to effective risk management. RMs and REGs responded “Yes”
at 91 percent and 89 percent respectively. While both respondents
indicated that compensation practices may manifest barriers in all three
phases, the highest percent cited was for the Execution phase at 46
percent and 63 percent for
RMs and REGs respectively.
Misalignment to strategy - based comments were the most common
among both RMs and REGs of the types of barriers that may manifest.
They indicated that misaligned organization risk tolerance and objectives
to strategy are drivers of possible barriers to effective risk management.
As one RM stated, “Effective risk management is all about Execution
and the design and Administration of the systems is necessary but
completely insufficient. Employees need to be hired and compensated
for behaving consistently with the strategy. Currently, people do what is
inspected not what is expected.” This theme was echoed in spirit in the
following REG comment, noting “Whenever compensation is an
incentive to a certain behavior, the behavior must align with risk
management strategies or the compensation becomes a barrier to
effective risk management.” It is not surprising that this theme emerged
as the top theme for this question as this appears consistent, more
broadly, with prior studies that suggest that organizations are not linking
ERM to strategy (Viscelli, 2013).
Risk taking - themed comments were the next most common. A
higher percentage of REGs indicated this, compared with RMs, but the
overall themes were consistent, namely, that compensation practices
encourages excessive risk taking. One REG commenting on the
excessive risk taking explained, “Yes, compensation practices can
promote ineffective decision making which leads to taking excessive
risks (just to earn a large bonus as an example). The barrier to effective
risk management this creates is in the Execution phase more so than in
the Readiness or Administration phases.” A RM shared a similar view
about risk taking,
“Compensation practices which are not aligned to risk management
practices manifest barriers during the execution phase. The execution
phase is when risk is actually taken and where risk should be managed.
Without alignment, organization may inadvertently foster a risk-taking
philosophy.”
The remaining themes reflected compensation control comments
(e.g., lack of compensation related controls, i.e. governance, safeguards,
and escalation controls), risk culture (e.g., culture that does not promote
risk management), and risk management personnel (e.g., lack of
experienced, sufficiently compensated risk management staff).
IV.4 Banking Environment Provides a Type of “Insurance”
We asked respondents to share their views on the notion of
“insurance” and if in banking it manifests barriers to effective risk
management.
Our count and phase analysis indicates some differences in
perspectives between RMs and REGs that the notion of “insurance” may
manifest barriers to effective risk management. However, both RMs and
REGs believed if barriers did manifest, it would generally be in the
Execution phase. Our coding and subsequent content analysis identified
six major categories of the types of barriers that may manifest:
incentives (e.g., creates moral hazard or sense of safety net promoting
higher or excessive risk taking), risk culture (e.g., culture that does not
promote risk management), repercussions (e.g., lack of appropriate
repercussion, e.g., civil, criminal penalties, global requirements),
regulatory oversight (e.g., higher cost of "insurance," i.e., higher capital
requirements result in more effective risk management), complexity
(e.g., the barrier is really "too big to manage," i.e., poor data
management, reporting), and misalignment to strategy (e.g.,
performance/compensation not aligned with organization risk tolerance,
objectives).
RMs and REGs perspectives that the notion of “insurance” may
manifest barriers to effective risk management differed. RMs
responded “No” at 68 percent while REGs responded
“Yes” at 49 percent. Also, although REGs “Yes” responses were higher
than REGs “No” responses at 49 percent and 47 percent respectively,
this slight difference would seem to indicate questions exist for this
respondent group on the notion of “insurance” and the “moral hazard” it
may present relative to impacts to effective risk management. However,
while perspectives that the notion of “insurance” may manifest barriers
to effective risk management differed for RMs and REGs, for those
respondents who indicated phases where barriers may manifest, the
highest percent cited for both RMs and REGs was for the Execution
phase at 100 percent and 45 percent respectively.
Incentives - based comments were the most common overall for
RMs and REGs of the types of barriers that may manifest. They
indicated that the sense of a “safety net” promoted higher or excessive
risk taking. As one REG stated, “I do believe that the concept of "too big
to fail" is providing a safety net for large organizations. "Readiness"
again would be most likely affected because the inclination to take risk
is higher when there is a safety net. Although SIFIs failing would cause
ripples in the economy, just about any type of safety net has the
opportunity to be misused. In certain circumstances, I believe the safety
net might actually incentivize misuse and risky behavior because the
organization knows it will be "caught" by the net and protected from
sustaining fatal damage.” One RM stated, “Yes. Execution. The concept
of "too big to fail" wasn't introduced until there was a need. Now the
term is widely accepted and is no doubt being used to leverage risk
taking in extremely large organizations, but this is an opinion as I have
no supporting evidence to back it up. Should we end up in another bail
out situation, expect applicability of the term and conditions to
resurface.”
Risk culture - themed comments were next most common. They
indicated “too big to fail" might be a factor in enabling a poor risk
culture. One RM stated, “Not for "Readiness or Administration."
Actually those two are the most regulated. For the key activity
"Execution" I think "too big to fail" might be a factor in enabling a poor
risk culture.” One REG stated, “I would think this would be a factor in
the readiness phase. Too big to fail is more problematic at the top of the
house in developing sound strategic plans that adequately incorporate
sound risk management - and setting the culture for risk management
from the top.” The risk culture theme is consistent with Andersen et al.
(2012) who appeared to find that poor risk management practices could
be linked to an unhealthy organizational culture which played a
significant role in the failure to implement sound risk management
practices.
For some RMs and REGs regulatory oversight themed comments
were provided and interestingly, these themes indicated a perceived
benefit to effective risk management arising from the notion of
“insurance” and “too big to fail.” Some respondents indicated the
current environment benefits from "too big to fail" as organizations are
paying a high price for that "insurance" and believe that this has resulted
in more effective risk management. As one RM stated, “I believe that in
the current environment bank's that benefit from "too big to fail" are
paying a high price for that "insurance" (i.e., through high capital
requirements and regulatory demands).This has forced risk organizations
to become more active in challenging all business decisions and the
quality of the information those decisions are based on. If anything, this
has resulted in more effective risk management.” One REG shared the
essence of this perspective with the following, “Yes. The "Big Banks"
had an advantage of too big to fail. With what Federal Reserve Board
has proposed, increased capital requirement for large banks will reduce
the advantage.”
The remaining themes reflected repercussions (e.g., lack of
appropriate repercussion, e.g., civil, criminal penalties, global
requirements), complexity (e.g., the barrier is really "too big to manage,"
i.e., poor data management, reporting), and misalignment to strategy
(e.g., performance/compensation not aligned with organization risk
tolerance, objectives).
IV.5 RMS Phases and Percent Complete
We asked respondents through a two part question to share their
views on the RMS phase factors of Readiness, Execution, and
Administration and “how complete” must the phase factors be for risk
management systems/practices to be effective. The first part sought
perspectives of either “100 percent complete” or “<100 percent
complete.” The second was an open-ended question seeking any
additional perspectives to the percentage complete portion of the
question.
Our count analysis indicates both RMs and REGs share the
perspective of “<100 percent complete;” RMs and REGs indicated 80
percent and 74 percent respectively with this view. Our coding and
subsequent content analysis for respondents who offered perspectives for
“100 percent complete” identified four categories of perspectives for
their choice of the percentage complete portion of the question: dynamic
risk management (e.g., risk systems/practices should be dynamic and
evolve with environment), key risk controls (e.g., include yearly
simulations and trials), interconnectivity, and risk culture (e.g., risk
systems/practices specifications should be implemented completely).
Our coding and subsequent content analysis for respondents who offered
perspectives for “<100 percent complete” identified eight categories of
perspectives for their choice of the percentage complete portion of the
question: dynamic risk management (e.g., risk systems/practices can
have gaps but still be effective), risk management maturity level (e.g.,
experienced risk managers can offset risk systems/practices that are not
100% complete), risk culture (e.g., risk culture should enable risk
systems/practices to be effective), key risk controls (e.g., risk
systems/practices can have gaps but still be effective), qualitative
challenges (e.g., risk systems/practices can have gaps but still be
effective), level of investment (e.g., risk systems/practices can have gaps
but still be effective), accountability (e.g., risk systems/practices should
be complemented by accountability), and issue awareness (e.g., risk
systems/practices should be dynamic and evolve with environment).
For RMS to be effective, both RMs and REGs indicated that all
phases of Readiness, Execution, and Administration factors must be in
place, but do not have to be 100% complete, for risk management
systems/practices to be “effective.” RMs and REGs responded “<100
percent complete” at 80 percent and 74 percent respectively.
Most respondents did not provide additional perspectives on their
selection for the first part of this question regarding their choice of “100
percent complete.” Further, while our coding and content analysis for
respondents who offered perspectives did identify categories, there were
no common categories between RMs and REGs. For RMs, the most
common category was dynamic risk management and for REGs, the
most common category was key risk controls.
Relative to dynamic risk management, one RM offered this perspective
for their selection of “100 percent complete,” “While there's degrees to
each of the factors of risk management, all three need to be working in
concert for risk management to be effective across categories of risk.”
For key risk controls, one REG stated, “In short, you don't know what
you don't know. In order to be confident that risk management systems
are operating effectively, they need to be fully implemented, executed,
and tested for effectiveness and sustainability.” The two remaining
categories of interconnectivity, and risk culture were common for REGs
but not for RMs. For interconnectivity, one REG offered this
perspective for their selection of “100 percent complete,”
“Weaknesses in certain aspects of risk management will hinder
performance in other processes.”
Relative to risk culture, one REG stated, “An effective risk management
framework must be complete in order to create and instill a positive
culture. Leaving a framework incomplete sends the message that risk
management is not a priority.”
More respondents provided additional perspectives on their
selection for the first part of this question regarding their choice of
“<100 percent complete.” Dynamic risk managementbased comments
were the most common among both RMs and REGs. Unlike for “100
percent complete” where our coding and subsequent content analysis did
not identify dynamic risk management as a category for REGs, this
category was the most common among both RMs and
REGs for “<100 percent complete.” One REG stated, “Given that risk
management practices are still evolving, waiting until all components are
in place and functioning is worse than having a phased approach to risk
management processes.” As echoed by one RM, “My belief is that you
have to do as much as you can, as soon as you can in regards to
identifying and mitigating risks. You cannot wait until all phases are
perfect and all systems are "Go", the process must be iterative and
malleable.”
Risk management maturity level - themed comments were the next
most common. They indicated that experienced risk managers may
offset risk systems/practices that are not 100% complete. One RM
stated, “Effective Risk management is about the ability to identify,
quantify and report the risk, not all of which will be immediately
possible when the risk is initially discovered. All of the phases should
be able to move to 100% complete, but "effective" management includes
the ability to provide early warning signs of emerging themes and
issues.”
Similarly, one REG stated, “In any organization, there may be gaps or
identified weaknesses that exist, but may be offset by key strengths to
maintain an effective risk management structure.
The key factor is the existence of an experienced and skilled
management structure that knows its strategic objectives, establishes an
effective governance structure, and effectively communicates to all
levels of the organization that can be easily understood and followed.”
Risk culture - themed comments were the third most common.
They indicated that risk systems/practices can have gaps but still be
effective with a strong risk culture. One REG offered, “If Readiness and
Execution have been met, the risk management culture should take hold
and allow the processes to be effective. Then Administration aspects
may be completed over time to fully implement the system. Risk
management is more than the sum of the processes or the system used to
manage risk; it must be socialized and operationalized. The
administration of the system should be just a formality at that point.”
One RM shared a similar cultural perspective stating, “I believe you
could still have some small gaps in the process but still have an effective
system in place. Self ID audit issues should be encouraged to document
the gaps and remediate the issues while the gaps are small.” For RMs,
however, this themed comment ranked second and risk management
maturity level ranked third.
Similar to “100 percent complete,” our coding and content analysis
for respondents who offered perspectives for their choice of “<100
percent complete,” identified some categories that were not common
between RMs and REGs. These remaining themes reflected key risk
controls (e.g., risk systems/practices can have gaps but still be effective),
qualitative challenges (e.g., qualitatively challenges can make executing
risk systems/practices difficult and inconsistent), level of investment
(e.g., risk systems/practices can have gaps but still be effective),
accountability (e.g., risk systems/practices should be complemented by
accountability), and issue awareness (e.g., risk systems/practices should
be dynamic and evolve with environment).
IV.6 State of the Financial/Economic Environment
We asked respondents to share their views on the importance of the
state of the financial/economic environment in shaping general
perceptions of the effectiveness of risk management and if it may
manifest barriers to effective risk management
Our count and phase analysis indicates that both RMs and REGs
believe the state of the financial/economic environment is important in
shaping general perceptions of the effectiveness of risk management and
these perceptions may generate barriers to effective risk management
generally in the Execution phase. Our coding and subsequent content
analysis identified six major categories of the types of barriers that may
manifest: risk focus (e.g., periods of stability reduces the focus on or
priority of risk management), risk taking & complacency (e.g., periods
of stability promotes more risk taking and complacency), sustainability
(e.g., it can cause risk management to be backward instead of forward
looking), perceptions (e.g., strong risk culture and risk management is
not sustained during perceived periods of stability), regulatory oversight
(e.g., it has increased the levels of regulatory oversight including risk
management), and complexity & interconnectedness (e.g., complexity
and interconnectedness of financial/economic environment creates
barriers to effective risk management).
Both RMs and REGs believe the state of the financial/economic
environment is important in shaping general perceptions of the
effectiveness of risk management. RMs and REGs indicated a high level
of importance at 68 percent and 69 percent respectively. While both
respondents indicated that the state of the financial/economic
environment may manifest barriers in all three phases, the highest
percent cited was for the Execution phase with both RMs and REGs at
56 percent.
Risk focus - based comments were the most common among both
RMs and REGs of the types of barriers that may manifest. They
indicated that periods of stability can reduce risk focus and that strong
risk management should be maintained in up and down
financial/economic cycles. One REG stated, “Yes, in periods of long
stability, management may begin focusing on revenue priorities and may
cut funding to risk remediation activities thereby creating a barrier to
effective risk management.” This theme was echoed in spirit in the
following RM comment, noting “Interest on the maintenance of effective
risk management practices will continue to decline, now that a period of
improvement and the beginnings of a more stable environment is on the
horizon, so this will become a barrier to effective risk management.”
Risk taking & complacency - themed comments were the next
most common. A slightly higher percentage of REGs indicated this,
compared with RMs, but the overall themes were consistent, namely,
that periods of stability may promote more risk taking and complacency.
One RM commented, “Yes, executives, business unit managers, and risk
managers can become lax in their diligence and, I feel, can lose the focus
on the independence of their role. Risk inventories may not be reviewed
as thoroughly, and relationships between business unit and risk
executives may become such that the required institutionalised friction
between roles may be lessened. "Times are good, do we really need to
do a ground-up inventory of our business unit risks?”” A REG shared a
similar view, “I do believe the financial/economic environment may
manifest barriers. All phases may be affected in long periods of
stability, creating more incentive for risk, less emphasis on renewing and
revising risk management practices over time, and lax implementation of
existing risk management practices.” The risk focus and risk taking &
complacency themes are in line with Huber et al. (2013a) who suggest
that conservatism can reinforce existing understanding and practices.
Sustainability - themed comments were the third most common.
They indicated that strong risk systems/practices should be sustained
regardless of the state of the financial/economic environment. One REG
offered, “Bank's fundamentals should not change as a result of economic
environment. During good times and bad times bank's approach to risk
should not change. Good times do not last. It is an economic cycle.
Bank's risk appetite and how it carries out its risk tolerances determines
its own fate.” One RM shared a similar perspective stating, “If proper
controls and documentation are in place, theoretically, the external
environment would not hinder REA. Separating risk reporting lines
from finance to ensure independence is also important.”
For some RMs and REGs regulatory oversight themed comments
were provided and interestingly, indicated that they may manifest
barriers to effective risk management. This is due to regulatory
oversight “driving the focus of risk management” or that there is a “lag
between financial entrepreneurialism and needed regulation.” One REG
stated, “Yes, due to the compression of bank's earnings they will only
implement the risk management they are forced to by regulators.” One
RM shared the essence of this perspective with the following, “It doesn't
act as a barrier necessarily, but can act as a catalyst when regulations and
oversight are adjusted to promote sustained economic growth.”
The remaining themes reflected perception comments (e.g., state of
the economy can promote incorrect perceptions of the level of risk in the
environment and the quality of risk management), and complexity &
interconnectedness (e.g., complexity and interconnectedness of
financial/economic environment creates barriers to effective risk
management).
IV.7 Categories of Barriers to Effective Risk Management By RMS
Phase
The hypotheses tests for the three phases of Readiness, Execution,
and Administration clearly indicate both RMs and REGs view that
weaknesses in these phases’ factors may manifest barriers to effective
risk management. We augment the perspectives toward these phases by
capturing the types of barriers to effective risk management that may
result as identified from three of the open-ended questions presented
earlier where we sought the respondent groups’ perspectives on phases
that may manifest barriers. Table 17 lists the previously discussed
category of barriers by phase as determined by our content analysis for
the questions pertaining to compensation practices, the banking
environment providing a type of “insurance,” and the state of
financial/economic environment.
Some categories overlap phases and this is because the nuances of
categories appear to have aspects that may result in alignment with
different phases depending on the lens through which it is being viewed.
As one RM states, “I believe that compensation practices in the
execution phase could manifest barriers to effective risk management if
they do not have the proper controls. If there were not compensating
Risk Appetite controls on growth of new accounts for example, you
could grow the number of accounts by dropping the credit quality scores
of the purchasers to increase the potential pool of clients. This would
result in higher sales, but would also potentially increase your losses
significantly. The controls along with the proper governance and
escalation process are a key component of risk management of the
process.” Whereas one REG stated, “An organization's compensation
structure may be designed in a manner to introduce misconduct risk in
an otherwise perceived effective risk management framework. This
would be evident in the Administration phase, where well-written
policies and adequate reporting exists.”
The table presents a more explicit view relative to phases and not
surprisingly aligns with the earlier detailed analysis. For the notion of
“insurance,” RMs largely indicated “No” regarding its impact to
manifesting barriers, hence, most of the categories noted are mainly
cited by REGs. Similarly, it is easier to see why regulatory oversight
seemingly contradicts itself as a benefit to effective risk management for
the notion of “insurance,” i.e., organizations paying a higher price for
“too big to fail” and has forced organizations to scrutinize their business
decisions, and as a barrier to effective risk management for the state of
the financial/economic environment, i.e., regulation my drive risk focus
or may be the root cause of lags between financial entrepreneurialism
and supervision.
IV.8 Barriers to Effective Risk Management Leading up to the Financial
Crisis of 2007-2009
We asked respondents to share their perspectives on barriers to
effective risk management leading up to the financial crisis of 2007–
2009. Table 18 summarizes the respondents’ responses to the open-
ended question: “Benefits cited by bankers and regulators that were
preparing Resolution Plans included improved understanding of the
bank and improved risk management. However, risk management
practices were in place prior to the requirement for Resolution Plans.
Our coding and subsequent content analysis identified 13 major
categories of the types of barriers to effective risk management at firms
leading up to the financial crisis of 2007– 2009: risk culture (e.g., lack of
a risk culture and accountability), underestimating risk (e.g., under
estimating risk, including the nature of it; type of risk; and its level of
possible systemic impact ), siloed risk management (e.g., siloed risk
management processes and inadequate resources ), corporate greed
(e.g., revenue incentives driving transaction decisions), risk focus (e.g.,
periods of stability/complacency reduces the focus on or priority of risk
management), complexity & interconnectedness (e.g., complexity and
interconnectedness of financial/economic environment creates barriers to
effective risk management), overconfidence (e.g., overconfidence in
existing risk management processes), regulatory oversight (e.g., weak
regulatory oversight), misalignment to strategy (e.g.,
performance/compensation not aligned with organization risk tolerance,
objectives), repercussions (e.g., lack of appropriate repercussion, e.g.,
civil, criminal penalties, global requirements), standardized risk
management (e.g., risk management practices that were too standardized
and lacked adaptability), independent oversight (e.g., lack of
independent risk assessments/oversight), and qualitative challenges
(e.g., firms lacked the qualitative perspective to properly and
consistently execute risk management).
Organizational culture was found to be a major deterrent to risk
management as risk management practices were discouraged and
resistance to change was constant (Kleffner et al., 2003). Consistent
with this, risk culture - based comments were the most common overall
among RMs and REGs of the types of barriers to effective risk
management at firms leading up to the financial crisis of 2007– 2009.
They indicated that risk culture and accountability were missing in most
organizations. One RM stated, “Lack of need for effective risk
management - it is not embedded cultural in most organisations, and
certainly not within organisations that have a strong focus on Investment
banking, so are more prone to risk taking. Historically, I have not found
effective risk management practices and culture to be embedded
appropriately within these types of banks and financial services, so it is
not surprising that ineffective practices were in place prior to the
regulators mandates for RRP requirements.” One REG stated, “Herd
mentality and the need to stay in the game. If you are in the business of
banking, as the competitive pressures move to weaker risk management
principles, institutions need to decide where their breaking point is and
get out. The consequences of pulling back require the willingness to
sacrifice returns and prepare to ride out the storm.”
Underestimating risk and siloed risk management - themed
comments tied for the next most common. A higher number of RMs
responses aligned to underestimating risk whereas for REGs, it was
siloed risk management, but the overall number of responses for both
was equal.
For underestimating risk, one RM commented, “The greatest barrier may
have been a lack of imagination - I think the severity of the financial
crisis game as a genuine shock and really challenged peoples
assumptions about the soundness of their institutions. Also, risk
management functions are much better resourced now than they were in
2007 so there were significant barriers arising from a lack of trained
staff.” A REG shared a similar view, “Underestimation of "worst case"
scenarios. People who quantified risk underestimated the downside.
Management doesn't understand models and relied too heavily on
models…The failure to understand that actions that benefit the
individual firm in the short run could make the situation worse for the
industry.”
For siloed risk management, one RM stated, “Lack of integration
from an enterprise level down to a LOB unit level. Lack of a
multidisciplinary view of risks (credit vs. tech vs.
operational vs. fraud vs. vendors vs. market vs. business continuity, etc.)
caused each to managed within a silo. Focus on safety/soundness vs.
consumer protection. There was also a lack of accountability. The Gov’t
would fine or issue a MRA, but until they took control of capital
reallocation it was less of an area of focus for CEO/Board level
executives.” Similar to this perspective, one REG offered, “Lack of a
fully integrated, enterprise-wide approach to risk management
(structural/governance defects), inadequate resources devoted to risk
management functions (under skilled and under staffed), MIS
insufficient to provide for risk data aggregation across the firm
(fragmented IS and reporting structure), mis-aligned employee incentive
compensation policies (emphasizing profits without appropriate
consideration of associated risks), and cultural/tone-from-the-top
environmental factors that allowed and sometimes encouraged excessive
risk taking were several of the key barriers to effective risk
management.”
Corporate greed - themed comments were the fourth most
common, however, only REGs comments reflected this theme.
Interestingly, our coding and subsequent content analysis did not
identify this theme with RMs, yet, the instances from REGs alone were
enough that this theme ranked fourth overall. One REG offered, “I
believe the barriers included complacency (e.g., prosperity, what
bubble?), lack of accountability (e.g., "too big to fail" so called insurance
policy) and too much greed (e.g., revenue based incentives primarily
driving all financial transaction decisions, including those decisions
made by Rating agencies. Risk management was not part of the
compensation equation.)” Another stated, “Focus on profitability over
safety and soundness. Lack of concentration risk management practices.
Short-term incentive compensation practices need to put capital to use.”
Risk focus - based comments were the fifth most common overall
among RMs and REGs. They indicated that the long stability leading up
to the crisis reduced risk focus for many organizations. One REG stated,
“I think the sustained period of stability was a factor. Also the stress
scenarios used by management across the LOBs and risk categories did
not expose the level of credit and liquidity risk within the institutions.”
A RM shared a similar perspective stating, “A long period of stability
caused increased loosening until the system imploded.”
The remaining themes reflected complexity & interconnectedness
(e.g., complexity and interconnectedness of financial/economic
environment creates barriers to effective risk management),
overconfidence (e.g., overconfidence in existing risk management
processes), regulatory oversight (e.g., weak regulatory oversight),
misalignment to strategy (e.g., performance/Compensation not aligned
with organization risk tolerance, objectives), repercussions (e.g., lack of
appropriate repercussion, e.g., civil, criminal penalties, global
requirements), standardized risk management (e.g., risk management
practices that were too standardized and lacked adaptability),
independent oversight (e.g., lack of independent risk
assessments/oversight), and qualitative challenges (e.g., firms lacked the
qualitative perspective to properly and consistently execute risk
management).
IV.9 Quantitative, Qualitative, or Mixture
Respondents were asked to share their perspectives on current risk
management systems/practices and whether they believe current RMS
were more quantitatively, qualitatively driven, or if it were a mixture of
both. Tables 19 and 20 summarizes the respondents’ responses to the
open-ended question: “Would you describe current risk management
systems/practices as more “quantitatively driven” (i.e., increasing
availability of data and the rising sophistication of risk modeling
renders more and more risk types as manageable by numbers), or
“qualitatively driven” (i.e., risk modeling and managing risks by
numbers is turned to with caution; risk measurements are trend
indicators which may complement or be overwritten by senior
managerial discretion, experience and judgment) and to provide any
additional perspectives.”
Our count analysis indicates that both RMs and REGs believe that
current RMS are more quantitatively driven. Our coding and subsequent
content analysis for respondents who offered perspectives identified six
major categories of perspectives: quantitative (e.g., risk management is
becoming more driven from models/numbers), mixture (e.g., risk
management needs to balance strengths of both), judgment (e.g., data
does improve risk management, but judgment of management should be
a factor), process & tools (e.g., quantitative practices, however, the
related processes, e.g., complex governance, complex models, do not
allow for effective risk management), qualitative (e.g., qualitative as
some risk are inherently difficult to quantify), and risk type (e.g.,
mixture as some risk are more quantifiable than others).
Both RMs and REGs indicated that current RMS are seemingly
more quantitatively driven. RMs and REGs indicated quantitative at 53
percent and 43 percent respectively. Many REGs however identified
mixture (37 percent) and comments appear to be reflective of the current
regulatory environment that calls for modeling techniques in
determining capital levels that must be augmented by qualitative
measures such as scenario analysis and strength of internal controls. For
the REGs who indicated it depends on the firm, comments were light
with responses such as “depends on the institution,” or “it depends on
size and complexity of the institution.”
Quantitative themed comments were the most common among
both respondent groups. They indicated that risk management is
becoming more driven by models and numbers with capabilities to set
quantifiable limits and measure against them. According to one REG,
“They are more quantitatively driven, which is primarily due to 1) the
large size and complexity of large institutions, which requires more
quantitatively driven approaches, and 2) regulators have pushed banks
that way, especially through exercises like CCAR. Regulators have all
but ignored or severely undervalued the qualitatively driven de-risking
and risk management that has take place post-crisis. For example, some
banks have significantly de-risked via improved AQ, changed
underwriting practices and strategies, and running-off problem assets,
but regulators give them little credit and instead focus on the bank's
CCAR models.” Another REG stated, “Risk management is more
quantitatively driven as institutions attempt to model for every
situation.” The RMs shared these perspectives as one stated, “Risk
management practices are more quantitative today than they were prior
to the crisis. Additional work is required to ensure that the models are
more robust, the data used in decision making process are high quality.
The key to sustainability is process excellence.” Another RM shared,
“Yes, current risk management practices are more quantitatively driven
in my space. It's all about scorecard management and how we are
tracking that.”
Mixture - themed comments were the next most common. As
noted, a higher number of REGs responses aligned to this theme than
RMs with the difference between REGs indication of quantitative and
mixture counts from our content analysis resulting in 24 and 23
respectively.
One REG stated, “The current risk management environment is a
mixture of quantity and quality driven methodologies with history
established and models to project into the future a range of performance
scenarios and financial outputs.” Another REG offered similar
perspectives which also seemed to capture challenges organizations face
today by stating, “Many firms are trying to hold on to quantitatively
driven systems given the time and effort placed into creating complex
models. However, the importance of qualitative factors is being realized
and a shift is taking place. I believe both are almost equally considered
in today's companies.” An RM shared a similar perspective stating, “I
believe it is a combination of both. I think we've got better numbers for
the models, but that the past performance bias of the models may not be
as good a predictor of future performance due to the large number of
changes that have been implemented. I believe we need a more effective
way to weight the changes in the business, for example practices that
have been stopped or businesses that have been sold as a moderator to
the capital models.”
Judgment - themed comments were the third most common. For
both RMs and REGs who initially appeared to indicate quantitative,
qualitative or mixture, our content analysis identified such an explicit
indication of the importance of judgment regardless of said indication,
this category was thus created. As an example, one RM stated, “The
shift is toward quantitative but the current mix is still typically 60 / 40
qualitative / quantitative. Dependence on experience, judgment and
reflection will not diminish, but will be fortified with better
quantification of risk factors.” One REG shared a similar perspective
indicating, “I believe, current risk management practices are being
driven by both quantitative and qualitative factors. The regulatory and
legislative environment seems to be largely driving a change toward a
more quantitative approach. For example, Basel legislation seems to be
pushing the banks toward developing sophisticated risk rating programs
and risk modeling systems, to calculate the bank's risk based capital
calculation. However, the bank's still seem to maintain a sense of expert
judgment and discretion, in their risk management programs and
modeling assumptions. In my opinion, the bankers seem to realize the
importance of providing this judgmental overlay, to the quantitative
modeling approach.”
Process & tools - themed comments were the fourth most common.
Our content analysis for both RMs and REGs indicated some of the
comments that appeared initially as quantitative or mixture themes were
in fact driving at deeper concerns with processes and tools that needed to
be reassessed, as without these, the data was meaningless. According
to one RM, “I would describe my experience as more quantitatively
driven at the present. We are in an environment of over measuring and
reporting. In fact the amount of data and reporting has become so dense
that in fact the metrics/reporting themselves can be a barrier to effective
risk management.” A similar sentiment was offered by a REG who
stated, “They are more quantitatively driven which in most cases can be
a problem because the banker does not understand the data and what it is
really telling them. Garbage in - garbage out.” This perspective appears
to be in line with Martin et al.’s (2007) study which suggest process tool
challenges can be seen in circumstances where risk management
practices were not able to be supported by the risk applications and
infrastructure.
Qualitative - themed comments were fifth as both RMs and REGs
indicated some risks are inherently difficult to quantify. One RM state,
“It's more qualitative. There should be a balance between the two. In
some cases, there is a lack of talent or expanding emphasis on the
quantitative side. We risk having blind spots by just solely going on
senior management discretion. It's what you "don't see" or what you're
not 'willing to see' that creates issues/events.”
A REG shared this view stating, “It is mostly qualitatively driven.
Quantitative measures vary significantly by risk discipline, product line,
etc. However I still believe decisions to concentrate on certain asset
classes or activities is largely strategic outcomes based on organizational
perceptions of what they are good at. I have yet to visit a bank where
statisticians are occupying the executive suites.”
Risk type - themed comments were only identified with REGs.
Similarly to judgment and process & tools, our content analysis
indicated the responses were driving at the impact that the type of risk
may have. As one REG shared, “Qualitatively driven, with the
exception of credit risk management which tends to be quantitative. Due
to the maturity of certain risk management practices (e.g. credit,
liquidity, and interest rate risk) in most institutions, they are more easily
quantified, are ingrained and garner significant attention. Other risks,
such as compliance and reputation risk, are extremely difficult to
quantify. Most measurements of these nebulous risks tend to be
performance indicators and not risk indicators, backwards-looking and
not forward-looking. This leads management to be more reactive rather
than proactive.”
Another REGs comment indicated impacts of risk type by stating, “I
think it is a mixture of both. Some things such as credit risk are more
easily quantifiable than other things such as strategic or operational
risk.” While this theme was only identified with REGs, it is consistent
with
Lundqvist’s (2014) study’s suggested pillar of “specific risk
identification and risk assessment activities which is integral to
implementing enterprise risk management systems/practices.” IV.10
Suggestions to Improve the Effectiveness of RMS
In our final open-ended question, we asked respondents to share
their suggestions to improve the effectiveness of risk management
systems/practices.
Our coding and subsequent content analysis identified eight major
categories of suggestions: improve risk function (e.g., risk management
that functions and emanates consistently at Enterprise level down to
current business activity level), risk culture (e.g., culture of risk
management and accountability supported by the board and senior
leadership), preemptive techniques (e.g., develop more dynamic,
forward looking, and preemptive risk management tools and techniques
that blends quantitative and qualitative), aligned to strategy (e.g.,
performance/compensation aligned with organization risk tolerance,
objectives), regulatory oversight (e.g., strengthen regulations and
regulatory oversight), repercussions (e.g., implement stronger
repercussion for individual and organization, e.g., civil, criminal
penalties, capital penalties), industry standards (e.g., risk management
standards tailored at an industry level), and independent oversight (e.g.,
stronger independent assessment of risk management, e.g., outside
organization/3rd line of defense).
Lessard et al. (2009) suggest that risk management should be
embedded and integrated in the company's cultural and organizational
fabric such that it is barely noticeable as a distinct management function
at either the strategic or tactical level. Also, Lundqvist’s (2014) study
suggests “holistic organization of risk management” as a pillar that is
integral to the implementation of enterprise risk management
systems/practices. In line with these perspectives, the most common
suggestion category overall was improve risk function. They indicated
that risk management functions that emanate at the enterprise level down
to business activities are key as are risk management monitoring and
challenge functions with the right skilled resources. According to one
REG, “Human resources responsible for risk management must be
treated like critical employees instead of a necessary evil. They should
be qualified and empowered to do their jobs effectively. They should
also see themselves in senior management - both in terms of promotion
opportunities and in terms of support from senior management.” One
RM offered, “Staff operational and compliance risk management
functions as needed to provide
the depth of coverage required to proactively monitor and assist in
managing risk.”
Risk culture-themed comments was the second most common
category overall. These responses reflected earlier comments of the
importance of a strong risk culture and compensation practices. One
RM suggested the following, “The mandate of senior management, and
examples of senior management support of the enterprise and in-
business-unit risk groups would improve the perception of the risk
management process across the firm. The perception of a risk (and
audit) group much be culturally changed to that of a partner to the
business, not an adversary.”
One REG shared a similar view stating, “It has to start at the top of the
organization. The board and senior management need to fully
understand and support its enterprise risk management framework. Risk
management needs to be integrated in all levels of the organization. To
improve systems and practices, we need to ensure that we are providing
appropriate education and training to develop the proper talent needed to
sustain sound progress towards developing risk management into a
business as usual function.”
While preemptive techniques was overall the third most common
suggestion, this was the top suggestion overall for RMs. Both RMs and
REGs indicated however the need to develop more dynamic, forward
looking, risk management tools and techniques that blends quantitative
and qualitative methods. This is consistent with Mikes (2014) study
which suggests design parameter of risk tools which we adapted to the
Execution phase. This theme of preemptive techniques may provide
practitioners context to consider relative to the Execution phase. One
RM stated, “Better tools that can be scaled to measure and quantify
effectively. Balance of adherence vs risk taking. We tend to over-do
one at the expense of the other depending on the financial climate and
performance of the company. Good leadership with vision and
willingness to have transparency.” This view was shared by one REG
who stated, “Focus on preemptive risk management processes. Too often
risk management policies and practices are developed after an incident
has occurred and are prepared to correct prior existing issues, while
attempting to stop future occurrences.”
Although aligned to strategy was overall the fourth most common
suggestion, this ranked third overall for REGs. Both respondent
categories indicated a need to improve alignment between risk culture
and risk accountability to strategy. One RM suggested, “Compensation
tied to risk management across all disciplines / Rewards for elevating
high risk processes or self identified audit issues / Acknowledgement
and training / Communication.” A REG shared this perspective
indicating, “More stringent compensation, hiring and governance
requirements. The Chief Risk Officer should be as important to the
Company as the CEO and as independent. Compensation and should be
a direct reflection of performance over the long term. A hindrance to
compensation management is the ability for talented individuals to job
hop without regard for their previous employer.”
The overall fifth most common suggestion was regulatory
oversight, however, this ranked sixth overall for RMs. Both suggested
the strengthening of regulations and regulatory oversight. As one REG
stated, “Maintain current high level, macro oversight by banks and
regulators. However, insure that regulators have the capacity (staff and
experienced/trained examiners sufficient to conduct targeted reviews.
Ensure continuous monitoring is in place at all large (>$10B).” One RM
offered this suggestion, “There needs to be appropriate pressure by
regulators on firms to improve effectiveness and keep focus on risk
management. However, prescriptive approaches are less beneficial that
conceptual frameworks left to the banks/insurers to interpret and apply
themselves as they see appropriate to the unique aspects of their
organizations. Regulators genuinely need to eliminate the "too big to
fail" perception in the market place by reinstating Glass Steagall and
reducing the size of banks and increasing the number of larger banks.
Too much focus on the largest financial institutions at the expense of
smaller financial institutions.”
Repercussions was the overall sixth most common suggestion,
however, this ranked last overall for RMs and all responses to this
category were from REGs. Perhaps this should not be surprising given
the nature of this category relative to bankers and regulators. One REG
offered,
“Accountability for risk takers, if not from within (upper management /
Board / shareholders), then the financial institution regulatory agencies
should step up their game by making full use of remedies already at their
disposal (suspensions and/or removals/permanent industry bars).”
Another REG suggested, “Let individual firms bear the consequences of
the failed risk management, e.g. eliminate "too big to fail",” while
another stated, “Financial accountability at the most senior levels (i.e.
CEOs and board members), as well as business line heads.”
The overall seventh most common suggestion was industry
standards. They suggested the development of more industry centric
risk management to drive consistency, more industry collaboration, and
more global coordination. One REG stated, “Risk mgmt and regulatory
supervision should be more coordinated across the global while still
taking into consideration the different cultures and beliefs.” This
sentiment was reflected in one RMs comment stating, “A lot of progress
has been made on risk management, but reducing variability within and
across institutions will be required for risk management to be effective
within the industry.”
The final suggestion was independent oversight where they
suggested stronger independent assessment of risk management
systems/practices. As offered by one REG, “I think a periodic,
independent assessment of risk management systems and practices is
needed in an organization on a regular basis. This can be from the third
line of defense, but an outside firm's view is the best. They see risk
management across an industry and can provide valuable help in
identifying emerging trends.” This was echoed by one RM stating,
“Independence needs to be there; stronger then third line.”
Suggestions to Improve the Effectiveness of RMS: Analyzed Through
Descriptive
Profiles
We sought to further analyze the suggestions to improve the
effectiveness of RMS as reflected by analyzing the suggested
improvements by the respondent groups descriptive profiles captured in
to determine if there were differences in the ranking of the suggested
improvements by analysis through gender, education, and age of our
respondent groups of RM and REG.
Summarizes the suggested improvements by gender of the
respondent groups. The gender total count differs from the education,
age, and summary of suggested improvements Tables of 28 RMs and 77
REGs. The gender total count is 27 RMs and 76 REGs as two
respondents did not provide their gender, however,we were still able to
code these two respondent’s responses through our content analysis and
hence include the category of their coded response as part of the gender
total count. These two are reflected in the table as “blank.” Suggestions
to Improve the Effectiveness of Risk Management Systems/Practices
While the overall total count conforms to the totals in suggested
improvements to RMS, which we expected, we do note several
differences in rankings of suggestions for improvement of RMS by
gender. First, for RMs, the most frequent category was preemptive
techniques; yet, females had no responses that were coded as this. For
females, the top category was improve risk function which aligns to the
top overall category when combining both respondent groups. It is
difficult to surmise what may be the root cause driver of the difference
in males versus females relative to preemptive techniques, however,
relative to its top ranking to the RM respondent group would seem to
suggest this is due to their intimacy with risk management in day to day
activities as bankers and hence their desires for the development of more
dynamic, forward looking, and preemptive risk management tools and
techniques that blends quantitative and qualitative methods.
Second, for REGs, the most frequent category was improve risk
function and it was the top category for males. However, for females, it
was second, behind risk culture. Perhaps one driver may be the females
desire to be overall more protective. Yet, as with RMs and their overall
top choice of preemptive techniques, not surprisingly, the top choice for
our supervisory regulators of improve risk function may be driven in
part by their sense of the importance of oversight and governance
capabilities in financial institutions.
Summarizes the suggested improvements by education of the
respondent groups. We collapsed education into two groups; four year
college or less and more than four year college. Unlike gender, all
respondents provided their education profile thus there is no blank label
and consistent with the suggested improvements the respondent group
counts are 28 and 77 for RMs and REGs respectively.
The sub-totals and the overall total count numbers do not change
compared to the suggested improvements , and gender. For RMs, the
most frequent category of preemptive techniques was generally
suggested by those with more than a four year degree; this may provide
those individuals with additional insights and perspectives and may
serve as the difference between individuals with similar overall years of
experience. This may also reflect additional learned perspectives
resulting in more explicit suggestions such as industry specific risk
management standards and independent oversight beyond the traditional
third line of defense, versus perhaps the more general notion of
“culture,” which was the top category for RMs with four year college or
less. Similarly for REGs, the distinctions appear to be in categories of
repercussions, industry standards and independent oversight, which may
reflect additional learned perspectives resulting from additional formal
education.
summarizes the suggested improvements by age of the respondent
groups. We collapsed age into three groups; less than mid (i.e., 34 or
less), mid (i.e., 35 – 44), and more than mid (i.e., 45 or more). Unlike
gender, all respondents provided their age profile thus there is no blank
label and consistent with the suggested improvements , gender , and
education , the respondent group counts are 28 and 77 for RMs and
REGs respectively.
The sub-totals and the overall total count numbers do not change
compared to the suggested improvements , gender , and education . For
RMs, the most frequent category of preemptive techniques was generally
suggested by those in the more than mid group; this may be indicative of
the experiences of these individuals with existing risk management
techniques utilized within their institutions thus prompting this response.
For REGs, the most frequent category if improve risk function may be a
reflection of these seasoned supervisory regulators to improve risk
function to enhance oversight and governance capabilities in financial
institutions.
Conclusions
Despite the past history of financial crisis’ including the most
recent Great Recession and the resultant calls to improve risk
management, there is still good reason to worry about the role and
profile of risk management as financial institutions continue to be
distressed by negative events. Yet, current assessment still finds that
empirical work on ERM is limited (Eckles et al., 2014) and in most
cases, our review of risk management literature has found that the focus
of the articles was not explicitly to seek barriers to effective risk
management.
This research contributes to the literature in a number of ways.
Our exploration of barriers to effective risk management connects with
previous work of Kleffner et al. (2003), and Beasley et al. (2005) that
calls for additional research including barriers to effective risk
management. The proposed RGF utilizes an RMS with three phases of
Readiness, Execution, and Administration adapted from Yaraghi et al.
(2011) connects with his call for leveraging these factors and phases of
RMS in different empirical ways relative to risk management. We
refined our RMS by drawing from Mikes et al.’s (2014) study which
suggests three ERM design parameters and three contingency variables
classifying different types of risk events and
Lundqvist’s (2014) research which suggests four pillars as integral to the
implementation of an ERM. This connects with their calls for
leveraging these design parameters and contingency variables, and
furthering analysis of the four pillars. Schiller et al. (2014) suggests that
organizations risk management is limited due to a lack of the concept of
risk and risk knowledge generation with current ERM frameworks.
Hence, our final contribution is our proposed RGF that draws from van
Asselt et al.’s (2011) three risk principles which connects with her
efforts to synthesize risk governance and incorporate these principles to
serve as the underlying guiding risk principles of our proposed RGF.
As a result, our research on barriers to effective risk management
through the lens of the proposed RGF, which incorporates the RMS
enhanced as noted, provides rich perspectives on barriers to effective
risk management and suggestions to improve effectiveness of risk
management which may help practitioners and academia alike consider
ways to analyze and improve risk management.
In comparing RMs and REGs, the findings indicate that our
respondents strongly viewed that barriers to effective risk management
can manifest in the phases of Readiness, Execution and Administration.
The respondents also strongly viewed the importance of the three risk
principles to effective risk governance and risk management. Both RMs
and REGs have similar views of the selected barriers to effective risk
management ranking accountability, i.e., a lack of accountability, poorly
defined job roles/responsibilities, and the level of employee involvement
in risk management systems/practices, as the top item with only the
Independent Samples T-Test for oversight indicating a statistically
significant difference. Some studies suggest that the focus on
auditability by interested stakeholders may cause organizations to
overlook perhaps weaker indicators that may actually point towards risks
(Power, 2004; Huber et al., 2013; Tekathen et al., 2013). Our results
however do not seem to support that auditability focus is a strong barrier
to effective risk management. Of the selected nine possible barriers to
effective risk management, auditability ranked ninth overall and for
REGs, and tied for eighth overall for RMs.
Both RMs and REGs believe compensation practices may manifest
barriers to effective risk management and indicated the greatest barrier
may arise from compensation practices that are misaligned to strategy.
They indicated personnel “should be compensated for behaving
consistently with the strategy, i.e., performing what is expected and not
inspected.” This misalignment could also be with an organizations risk
tolerance levels as one REG noted the importance of “aligning to risk
management strategies.” In addition, excessive risk taking and lack of
compensation related controls round out the top three. While both
respondent groups indicated that barriers may manifest in the Execution
phase, the percentage of REGs who viewed this was higher than RMs
and both indicated Administration as the second most impacted phase
which appears reasonable with the notion of properly administering
compensation practices to ensure alignment to strategy.
The notion of “insurance” creating barriers to effective risk
management reflected some differences between RMs and REGs where
RMs generally did not believe barriers would manifest and REGs
generally indicated it may. However, it is interesting that REGs “Yes”
response was 49 percent and “No” response was 47 percent which seems
to indicate questions exists on the notion of “insurance” and the “moral
hazard” it may present. For some RMs and REGs, regulatory oversight
themed comments indicated a perceive benefit to risk management
resulting from the “higher price is paid through high capital
requirements” thus causing organizations to “become more active in
challenging business decisions.” However, there was agreement on the
phase where barriers may manifest; for those respondents who indicated
phases, the highest percent for both RMs and REGS was for the
Execution phase.
On how complete RMS must be to be “effective,” both respondent
groups overall indicated “<100 percent complete.” The top category of
themes for both “100 percent complete” and “<100 percent complete”
was dynamic risk management. The general notion for both appeared to
be that regardless of the percent complete, “the bar on RMS should be
dynamic and evolve with the environment.” There were clear
indications of the importance of risk culture with RMS but its meaning
differed, e.g., the “<100 percent complete” responses indicated the risk
culture as important to enable RMS when less than 100 percent, yet, for
“100 percent complete” was cited with, “Leaving a framework
incomplete sends the message that risk management is not a priority.”
The second top category for “100 percent complete” and “<100 percent
complete” was key risk controls and risk management maturity level
respectively. For “100 percent complete” key controls included yearly
simulations and trail testing of key controls and for “<100 percent
complete” respondents indicated strong risk managers can offset
incomplete RMS.
The state of the financial/economic environment is viewed as
important in shaping general perceptions of the effectiveness of risk
management and that these perceptions may generate barriers to
effective risk management. Both RMs and REGs viewed the level of
importance as overall high. If barriers were to manifest they would
generally do so in the
Execution phase. Administration was the next most cited phase where
barriers may manifest. Risk focus was the top category as respondents
indicated that periods of stability may reduce the focus on or priority of
risk management. Concerns were also expressed that strong risk culture
needs to be maintained in both up and down cycles. Similarly, both
respondent groups indicated that perceived stability may drive more risk
taking and complacency. Interestingly both respondent groups indicated
regulatory oversight may manifest barriers by “driving the focus of risk
management” or that there is a “lag between financial entrepreneurialism
and regulation.”
In an effort to identify barriers to effective risk management
leading up to the financial crisis of 2007-2009, our analysis revealed 13
major categories. The top three are risk culture, underestimating risk,
and siloed risk management. Organization culture was identified in a
study of Malaysian public companies of independent non-executive
directors as impacting, or being barriers to, their effectiveness in
performing their roles (Annuar, 2012). In line with this, risk culture was
the top theme overall among RMs and REGs. They indicated that risk
culture and accountability were missing in most organizations as one
RM stated: “Lack of need for effective risk management - it is not
embedded cultural in most organisations, and certainly not within
organisations that have a strong focus on Investment banking, so are
more prone to risk taking. Historically, I have not found effective risk
management practices and culture to be embedded appropriately within
these types of banks and financial services, so it is not surprising that
ineffective practices were in place prior to the regulators mandates for
RRP requirements.” Underestimating risk responses from both
respondent groups indicate insufficient stress testing and consideration
of tail events, a lack of imagination, and lack of understand of the types
of risks present. Both respondents indicated siloed risk management as
the third category citing a lack of integration from an enterprise level
down to a LOB unit level. They indicated this included inadequate
resources devoted to risk management functions.
Mikes’ (2011) study characterized two types of calculative risk
cultures of “quantitative enthusiasm” and “quantitative scepticism” and
our results seem generally consistent in that our content analysis of
respondents’ responses identified a mixture category indicating both
quantitative and qualitative even though mixture was not offered in the
survey question.
However, our results do not appear to align with the notion of
“scepticism” with quantitative information but rather a need to balance
the “strengths” of quantitative and qualitative methods. Nonetheless,
both RMs and REGs indicated that current RMS are seemingly more
quantitatively driven. REGs however also identified with mixture along
with quantitative at 37 percent and 43 percent respectively. Quantitative
based themes indicated large size and complexity of institutions require
more quantitative driven approaches which have been amplified by
regulations such as capital adequacy reviews. The mixture based themes
do not necessarily cast quantitative method in a negative light but rather
impress the growing importance of qualitative methods such as scenario
analysis and risk control self assessments and that simply some risk are
just inherently difficult to quantify.
The final perspectives obtained from the respondent group were
suggestions to improve the effectiveness of RMS. REGs suggested as
their top choice, which was the top choice overall, to improve the risk
function. This includes enhancing the function with experienced,
sufficiently compensated personnel; improving monitoring and
challenge functionality by ensuring the right people are involved in the
process; and improving risk metrics and reporting. While improve risk
function was the top category overall, for RMs, it was second and the
top category was preemptive techniques. RMs suggests the development
of more dynamic, forward looking and preemptive risk management
tools and techniques that blend quantitative and qualitative methods;
stronger risk analysis and use of lessons learned; and also improving
metrics and reporting. Risk culture was overall second and both
respondent groups indicated the importance of a strong risk culture
emanating down from the board and senior leadership with heavy
emphasis on accountability; and ensuring performance/compensation
practices are aligned to organization risk tolerances, objectives and
strategy.
Our study adds perspectives from those institutions risk
management practices recently required to create RPs and certain
agency’s regulators, thus providing rich insights, and practical
perspectives to risk management professionals and academia alike. In
most cases, our review of risk management literature has found that the
focus of the articles was not explicitly to seek barriers to effective risk
management. Our study provides such focus and additional
perspectives. Also, we do not necessarily portray our proposed RGF as
an enterprise-wide risk management system or as a framework for just
financial institutions, but more so a model that may be drawn upon by
practitioners in varying industries and at all levels of an organization’s
risk management practices.
Implications
Our research indicates that empirical work on risk management is
limited and can be classified along three main lines of research –
describing the ERM practice, analyzing the determinants of ERM
adoption, and assessing the valuation effect of ERM (Eckles et al.,
2014). While these paradigms may offer continuing research
opportunities, we suggest a different mission for risk management in
research and practice. Our agenda would move us away from perhaps
why RMS is or is not adopted to one of why does it not function as fully
as intended.
Given the emphasis on RMS and the seemingly continued focus on
it and the challenges it has faced, the extant research often seems
peripheral to the core importance of RMS: to mitigate risks. RMS
adoption, including its most popular form of ERM, and whether its
organically developed or whether you are getting the necessary valuation
from RMS, does not seem as controversial any more versus the time
where most financial institutions were throwing around the acronym of
“ERM” as the savior against risk. It seems since, and perhaps evidenced
by literature and more importantly, real life negative events, that RMS,
including ERM, has continued to miss the mark of its intended purpose:
to mitigate risk. Our mission seeks to pursue research of RMS in
empirical ways that go beyond the traditional paradigms to new, more
realistic and practical views.
At the core of our mission are four perspectives. We share these
perspectives to help move away from these current paradigms that seems
to, in part, drive RMS research and to help practitioners leverage this
study’s findings in their fight against barriers to effective risk
management. First, the notion of controls and procedures are important
points to include as part of any RMS, but its focus should not be at the
expense of the RMS’s intended purpose of mitigating risks. This may
drive the perception that RMS is simply a part of a “tools culture” driven
by concerns for audit and control thus undermining its ability to improve
risk management (Huber et al., 2013a). Hence, we can see the evolved
accounting or internal controls based RMS serving as organizational
compliance mechanisms or “rationalization machines” which have been
implicated as the reason for some company’s failure, as risk
management was relegated to a compliance function (Ghoshal, 1987;
Beasley et al., 2010; Mikes et al., 2014; Burchell et al., 1980; Kaplan et
al., 2012).
One way to achieve a more sound foundation of RMS to transcend
these perceptions and truly drive a “risk focus” versus “controls focus”
is to ground RMS in Risk principles. The concept of risk management
and governance pertains to the various ways in which many actors,
individuals, and institutions, public and private, deal with risks
surrounded by uncertainty, complexity, and/or ambiguity (van Asselt et
al., 2011). Risk principles may serve as guidance for practitioners as
they need to understand how different individuals and groups within
organizations define risk, potential biases in risk assessment, and
challenges in implementing risk management initiatives as many risks
cannot be calculated on the basis of probability and effects alone
(Bromiley et al., 2014; van Asselt et al., 2011).
Second in our mission is normative research on barriers to
effective risk management. Our review of risk management literature
generally did not find articles focusing explicitly on barriers to effective
RMS. Our study provides practical perspectives that may be explored to
provide realistic benefit and value in understanding risk management
both practically and academically. From our selected barriers to
effective risk management question, lack of accountability and
weaknesses in risk management personnel resonated most with both our
respondent groups . Risk culture was prevalent through our
respondents’ responses and was the top category identified of barriers
leading up to the financial crisis of 2007-2009 (see Table 18). The top
three suggestions to improve the effectiveness of RMS are improving the
risk function, risk culture, and preemptive techniques.
Normative implications may be beneficial and such studies could
investigate, for example, are there particular risk categories (e.g.,
operational, credit risk) that preemptive techniques may be better suited
for, or what prevents organizations from incorporating more forwarding
looking risk management tools and techniques. Similarly, we can seek
perspective of our study’s identified “mixture” category when we sought
respondent’s perspectives on whether the current RMS’s are more
quantitatively or qualitatively driven. Rather than seeking perspectives
of “calculative risk cultures” (Mikes, 2011) and whether organizations
are “quantitative enthusiast or skeptics,” perhaps perform studies on
organizations to identify “RMS enthusiast” and the type of “risk culture”
that is present that shapes their success or failure.
Studies of factors impeding “accountability” as cited by both our
respondent groups as the top barrier of effective RMS from the selected
barriers question would seem warranted and perhaps timely with recent
negative events including the London Whale and from past issues such
as underwriting issues stemming in part from the notion of “robo
signing.” Research on inconsistent “risk focus” could ask how
organizations may improve it such that it is consistently maintained in
both up and down financial cycles; is it due to management biases or
some other theoretical concept that may be root cause drivers of, for
example, complacency during up cycles. This may in turn provide
organizations practical perspectives to consider correcting such
impediments to consistent execution of “risk focus.”
Continued leveraging of the RGF is the third mission perspective.
Schiller et al., (2014) suggests that organizations risk management is
limited due to a lack of the concept of risk and risk knowledge
generation with current ERM frameworks. Further, some suggest that
the current ERM model is too strongly influenced by accounting and
auditing standards of control, with an emphasis on detailed controls
supported with robust documentation evidencing effectiveness of the
controls (Power, 2009; Talwar, 2011; Jordan et al., 2013). Our RGF
seems warranted as it foundationally rest on Risk principles versus
emphasizing standards of internal controls which may enhance the
understanding of risks and the ways in which actors and institutions,
public and private, deal with risks surrounded by uncertainty,
complexity, and/or ambiguity (van Asselt et al., 2011) that appear to be
lacking with current organizational risk management (Schiller et al.,
2014).
On-going investigation of RMS at financial institutions through the
RGF may continue to refine and further enrich the practical insights
gained from our study. previously discussed category of barriers by
phase as determined by our content analysis for the questions pertaining
to compensation practices, the banking environment providing a type of
“insurance,” and the state of financial/economic environment. Further
research into these barriers may enhance views and perspectives into
current RMS to identify more practical solutions by phase to mitigate
these barriers. Similarly, scrutiny from academia may identify factors
correlating to organization learning, adaptive leadership, or decision
making theories that provide additional insights into these theories
and/or other paradigms.
Finally, we would probably all agree that RMS will continue to be
a focus area for practitioners for the foreseeable future. With that said
we believe our study identifies practical focus areas for practitioners to
consider breaking down barriers to effective risk management and
improving RMS. We suggest that while the study’s major findings and
implications are not necessarily definitive answers to the challenges of
RMS, we are confident in suggesting that the perspectives obtained from
these RMs and REGs should be strongly considered and leveraged
where appropriate regardless of industry.
Major Suggestions/Implications
The major suggestions and implications to improving RMS are
reflected. This table reflects the top overall categories from the
questions: nine selected barriers to effective risk management,
compensation practices, barriers leading up to the financial crisis of
20072009, suggestions to improve risk management, and state of the
financial/economic environment.
Accountability – was the top category from the nine selected
barriers to effective risk management question . Organizations, simply
put, need to be more aggressive on this point. As one REG indicated,
“You can have all the systems and/or processes in the world…but it
matters not when the body creating risk is not held accountable.” It must
be hardwired at the board and senior management team level and the
notion of a “lack of accountability” should be eliminated. Incorporating
the use of explicit procedures, controls and governing policies and
standards can drive the importance of and enforcement of accountability
and it should be done so at all levels and areas of an organization.
Misalignment to strategy – was the top category from the
compensation practices question . However, this perspective is critical
on many levels as our respondents’ responses suggest, thus it should not
be limited to the notion of compensation alone. Many financial
institutions have a strategy and may have elements such as a risk
appetite statement to serve as guidance for the entire organization.
Ensuring that all organizations actions and activities are not in
contravention of these types of guiding statements needs to be critically
assessed. While areas such as compensation practices in revenue
generating areas may be an obvious area of focus to ensuring alignment
to strategy and should not be ignored, critical assessment should include
ensuring proper alignment of the Risk Management Function program
and the scope and activities of the Internal Audit function to such
guiding statements, thus ensuring the rigor and direction of these
control/assurance functions.
Risk culture – was the top category for the barriers leading up to
the financial crisis of 2007-2009 question (Table 18), but was also a
prevalent category in other questions. A strong risk culture, including
risk management, cannot be viewed, as noted by one RM, “as an
impediment by the business or an expensive overhead cost.” Much the
same with
Accountability, and really any of these categories, it must start from the
top of the organization and be driven throughout the organization to all
levels. As the notion of risk “culture” denotes a conceptual/intangible
perspective, one way to put some substance to risk culture may be to
formalize explicit assessments of risk culture by second and third lines
of defense in the form of the Risk Management Function creating “risk
culture” requirements that businesses must adhere to and are periodically
assessed against by the Risk Management Function. This could be
further supported by periodic assessments by Internal Audit’s review of
the Risk Management Function,
i.e., how well they drive adherence to risk culture at the business unit,
and enterprise levels.
These assessments should be fundamentally and deliberately enhanced
to first align with van
Asselt et al.’s (2011) Risk principles focus of understanding how the
enterprise and/or business units tackle risks that they may not be certain
with, are complex, or ambiguous. The Risk Management Function
should have a critical eye toward business units or enterprise functions
that tend to jump straight to the notion of, “what are the controls and
processes we have in place,” i.e., a “controls focus” versus ensuring their
understanding of the risk presented, i.e., a desired “risk focus.”
Improve risk function – was the top category for the suggestions to
improve the effectiveness of RMS question (Table 21). Several of the
respondents indicated the need to have risk management processes and
techniques emanating from the enterprise level consistently down to the
business unit level. Also, one REG suggested that the Risk Management
Function,
“Should be qualified and empowered to do their jobs effectively. They
should also see themselves in senior management - both in terms of
promotion opportunities and in terms of support from senior
management.” While we did not disagree with the importance of the
stature of the Risk Management Function, we suggest, and view the
following as equally if not more important than stature, that the Risk
Management Function needs to be respected for its knowledgeable
personnel; perhaps on a certain level, even feared, due to their practical
knowledge of the businesses they support in a second line capacity.
Risk focus – was the top category for the question of the state of
the financial/economic environment (Table 16). Organizations need to
focus on putting a priority on RMS in both up and down cycles. This is
important as one RM indicated, “All the attention is placed on bad times
because there is proof of poor risk taking. In good times, when too
much risk is being taken, there is no proof and therefore less ability to
challenge that behavior. It’s about sustaining reasonable behavior
during both parts of the cycle.” One suggestion is to deploy similar
tactics noted for risk culture whereby periodic mandatory risk
assessments are performed relative to maintaining risk focus by the first,
second, and third lines of defense. As one REG indicated,
“The systems were not in fact good when the economy was favorable
but the shape of the economy played a big part in everyone believing
that risk management was good because there was a lack of testing of the
adequacy of systems.” However, as noted for risk culture, these
assessments should be fundamentally and deliberately enhanced to first
align with van Asselt et al.’s (2011) Risk principles focus of
understanding how the enterprise and/or business units tackle risks that
they may not be certain with, are complex, or ambiguous. The Risk
Management Function should have a critical eye toward business units
or enterprise functions that tend to jump straight to the notion of, “what
are the controls and processes we have in place,” i.e., a “controls focus”
versus ensuring their understanding of the risk presented, i.e., a desired
“risk focus.”
This study provides many more practical consideration points for
practitioners to consider towards breaking down barriers to effective risk
management. History of the financial crisis’ experienced over the years
paints a dire picture of the supposed positives of RMS; however, we
view our study as one that provides rich perspectives of barriers to
effective risk management that is not readily apparent in extant
literature, that we believe will have positive implications for both
academia and practitioners alike.
Limitations
Risk management as a technical discipline has been in existence
for over 50 years and it seems the role and its profile will continue to
have strong bearing in practice and in academia. Though this study has
proposed a RGF, it is an exploratory initial effort. As with all research,
there are limitations associated with this study. This study builds from
Cho et al.’s (2014) study on perceptions of the effectiveness of RPs.
Hence, first, the study targeted only the 130 financial institutions subject
to the Section 165 (d) RP formation requirements and only two groups,
Risk Managers and Regulators. Therefore, it is not unreasonable to
assume that expanding the targeted population and the respondent
groups to non-financial industries and non regulated groups may build
upon this study’s data and further enrich perspectives on barriers to
effective risk management. Second, this analysis required coding of
responses, and identification of categories and themes, and required
professional judgment, still however, the intercoder reliability seems to
evidence sound analysis. Lastly, the RGF has been developed from
existing literature and the researcher’s perspectives as a regulator.
Future Research
Future research leveraging this RGF may identify opportunities for
enhancement based on feedback from industry practitioners and
academia. A study focusing more explicitly on facets of the RGF may
identify opportunities for enhancement and provide additional insights
into the practical applications, for example, of the three risk principles.
A second area of research is continued exploration of the insights
obtained from this study. Risk culture was such a prevalent theme and
perhaps it should not be a surprise, but one obvious question is what are
barriers to effective risk culture? The notion of adaptive leadership and
the possible benefits toward driving an organization to embrace risk
culture may provide insights to risk management challenges as well.
Third, research into the impacts of modeling and their use to an
organizations risk management processes may be insightful with the
growing regulatory requirements calling for the use of models; does this
change the dynamics of the risk functions? The necessary make-up of
resources in the risk function? One respondent indicated that he/she has
yet to go into a bank and see a “quant” sitting in the CEO’s desk, but
what about CRO? Or COO? Fourth, continuing exploration using the
RGF in other regulated industries such as healthcare may provide further
rich context on barriers to effective risk management.
