Article for Mortgage Finance Gazette

By Simon D’Arcy, Head of Internal Audit at Vaultex UK Limited and past-President of the Institute of Internal Auditors – UK and Ireland

World financial mayhem began with the failure of the US sub-prime market. This bubble was simply waiting to burst.  When the inevitable catastrophe was unleashed, it moved relentlessly from institution to institution, growing all the time, tsunami-like.  Just as the previous dot-com bubble, the credit bubble was the result of irrational, risky behaviour.  Neither Government nor the regulators constrained the market or acted in time; lenders and borrowers meanwhile behaved like it was an end of the world party.

Deregulation of the City and the financial markets had opened up countless opportunities.  Buoyant conditions, unprecedented confidence and greed obscured the fundamentals of market economics; the miracle of risk free, high returns seemed to be able to trump strong risk management in Board room deliberations.  Individual lenders changed their lending criteria partly because it enabled them to do more business. Traditional, conservative lending ratios went out of the window.  

Significantly, there also was ignorance of the risks inherent in complex financial products.  It was perceived that derivatives and related instruments would offset the real risks of the credit boom.  Ironically, misplaced belief in these products probably helped to fuel this boom.  Deep down there was a dangerous misconception shared by Government, regulators and lending institutions that they really understood all the risks and how those risks could manifest themselves.  There was also a reliance on untested controls which when actually invoked could prove more damaging that the underlying risk itself - such as when Northern Rock invoked its contingency of going to the Bank of England as lender of last resort, resulting in a terminal run on the bank.

The origins of the financial crisis are obviously tangled, but one clear factor emerges - the wrong attitudes to risk.  There is a pressing need to recalibrate our perceptions of risk and how we deal with it individually and collectively.  Boards must use their internal audit departments’ risk management resources to re-educate their organisations and to embed the right risk culture.

Paring down pay

Some of the strongest institutions in the financial services sector have suffered most from risky lending.  When market confidence dried up, their only way to continue was for the Government (effectively taxpayers) to guarantee them and pump in funds.  The consequent call to ‘punish greedy bankers’ has been loud and clear and the Government has responded to public sentiment that any bail-out of the bankers had to have strings attached.  Bonuses have been cancelled and Government potentially has the power to interfere with their business.  Now we have a partially nationalised banking system – and in the City thousands of jobs have gone and will continue to go. 

Stringent control of remuneration seems to be one way in which society at large aims to teach decision-makers to act more responsibly when calculating lending risks.  (Interestingly, one of Barack Obama’s first statements on the economy included a plea for bankers to forego end of year bonuses.)

New market dynamics - new risk calculations

The popping of the house price bubble and the lack of any real understanding of risk, meant that banks’ share prices were vastly over-valued and P/E ratios went awry.  Chaos, then paralysis, followed.

Former CE of HBOS, Sir James Crosby’s recent report has predicted increasing mortgage market stagnation and urged the Government to intervene to unfreeze lending and prevent a prolonged fall in house prices.  But currently the Government has taken only limited actions to try to achieve this. 

It’s difficult to see a return to a time of looser lending criteria.  We are in the era of more austere credit risk assessments based on relatively modest multiples of salary. The volume of lending will take a long, long time to recover.  Liquidity has reduced.  Too many lenders will be competing to lend to an ever-shrinking pool of creditworthy people and those with the lowest credit risk will soak up the limited amount of credit that is available.   Lenders will use price as a means of capturing market share.  The nationalised banks will have a pricing advantage, but political intervention may mean that they will be forced to lend to the less creditworthy.  The freer banks will be able to cherry pick the most creditworthy, but may be less competitive on price. 

Maintaining the size of market share and simultaneously preserving profit margins is a fine balancing act for risk management.  Responding to and fixing a risk issue in one area can create unacceptable risks elsewhere. Evaluation and remediation of one control, without considering its impact on the whole, must be avoided. Analysis and assessment of systemic risk has to recognise that all organisations - and therefore their risk management frameworks - are interlinked in the global financial marketplace. 

From now on every lender is going to want to seek assurance with increasing directness and rigour on the substance of the collateral or assets that they are lending against.    How do you do that in remote geographical areas or in different product markets?  It’s yet another challenge for risk managers and internal auditors.  For it is much harder to make lending decisions when the value of housing is changing, ie effectively decreasing, or when variables in different countries shift.  

Political intervention will also muddy the water for certain lenders.  The Government has injected funds to strengthen the balance sheet of some institutions.   Yet there is simultaneous pressure from the Government on these banks to pass this on to borrowers.  These apparently conflicting factors must be reconciled from a risk management perspective.

Another maxim an internal auditor should advise any institution to follow is that ‘me too’ is not a reliable or effective risk management technique.  Herd mentality has dominated the lending market for too long.  Just because one institution is offering product X at price Y, doesn’t mean that it is good for another bank or mortgage company to follow suit. It is never advisable to mimic other organisations’ products assuming that they have done the risk work and come to the right answer.  Short cuts spell trouble. An institution must get its own risk managers and internal auditors to provide assurance that the analysis supports any proposed business strategy.

We have to recognise that we are in a very different place coming out of the immediate crisis.  The idea of huge returns is a thing of the past.  It’s going to be a low-return business for the immediate future.  Risk managers will be in a completely different space. The financial services market is a long supply chain of complex interactions. Trust, recommendation – and the opinions of the ratings agencies! -  oiled the mechanism in former times and reliance on brand name and credit rating was the norm.  Now, relying on validation through SAS 70 and third party assessment may become history.  Today it’s conceivable that a lender will send in its own risk assurance team to verify directly the controls of every third party within its supply chain.  That will be confusing, invasive and resource intensive.   

High risk activities that an organisation understands and has experienced before are probably a better bet in this environment than new and apparently lesser risk activities in untrodden territory.  In the new order, experimentation may unfortunately pose greater risks.

Independence of mind

Someone described the current financial crisis as a once in a 100,000 year event, which is a nonsense, given the length of human history and the shorter span of industrial activity on the planet!  This is typical of the blinkered and ingrained attitudes to risk and short term memory often encountered.  Even if we do allow for the appearance of a black swan (an extraordinary or normally unimaginable event), it won’t be exactly as we envisage, but a one and a half-winged black and white creature with half a leg.  (For instance, what would you do if house prices reduce by a further 50% - is repossession an effective risk mitigant in such a scenario? The unimaginable is just what it says it is). 

Far too much reliance has been placed on the pseudo science of models.  The problem with models is that they evoke an aura of invincibility and objectivity.  The truth is, that base assumptions in models are subjective, somebody’s guesswork - but put it in a model and we all get suckered in -believing that the output from the model is incontrovertible truth.  In some respects quantitative models are the modern day equivalent of ‘elixirs of life’ pedalled by charlatans at Victorian fairgrounds.   Models make us doubt our own instincts and make us lazy.

If we can learn nothing else about risk from this crisis, we must recognise that it is crucial to trust our instincts and experience and maintain constant vigilance.  We must avoid the pitfalls – unlike, for instance, the weather forecaster who is so busy at his satellite screens which say it’s not likely to rain, but fails to look out of the window next to him and see it’s actually pouring down. Strong, independent thinking should be encouraged to promote management rigour and avoid the acquiescence and complacency that contributed to this virtual economic collapse.

Within organisations, corporate governance professionals such as internal auditors and risk managers should be given more scope to challenge business decisions.  This will only happen if there is a sea change of attitude at senior management level – directors should allow internal auditors into the Boardroom to advise on the risk and governance implications of proposed business strategy.  

At a macro level, we need to bolster the financial market regulator’s powers.   A better resourced, stronger regulatory infrastructure will support and underpin companies’ initiatives towards self-regulation.

Morals matter more than risk models

Ultimately however, what we’re really confronting here is a moral issue.  The moral health of an organisation is the most likely barometer of its attitude to risk.

In July this year the Institute of International Finance Markets Best Practice Report reviewed the market turmoil of 2007 and 2008 and commented on importance of good governance and risk culture in reducing organisations’ exposure to market vagaries. Assurance on culture, behaviour and ethics in addition to assurance on operational controls, it concluded, is of more value than assurance on operational controls alone.

Models and operational controls may be undermined and made irrelevant by poor risk culture. A consistently embedded risk culture is the best indicator of effective risk management. 

How does the risk manager or internal auditor assess whether or not the right attitudes are embedded within an organisation?  Do employees have the right approach to their roles and remuneration and, significantly, to taking risks?

The first plank of risk management is recruiting the right people.  On the one hand it is probably reputation suicide for major players in financial institutions to be seen to be taking vast bonuses.  On the other, how do you attract good people?  Your reputation for financial responsibility must be balanced against the potential rewards to a successful employee.  How do you incentivise the right behaviour?   Is the person seeking the highest remuneration the one with the most talent or indeed the right moral outlook?

Good people with good attitudes make a difference, especially when they are given excellent training and a rigorous risk evaluation framework within which to make sensible lending decisions.

Hiring high calibre staff is first and foremost down to ‘eyeballing’.  Look them in the eye and ask forthright questions.  It’s soon possible to tell whether the force is with them or if they’re on the dark side.  As Ralph Waldo Emerson said, “Character is higher than intellect.”  One can of course also use psychometric testing, as the police force does, to get an accurate personality profile.  

At Deloittes’ and the Institute of Internal Auditors’ joint conference in May 2008 it was mooted that all organisations would benefit from an individual who would be a trusted ‘guru’ or moral advisor.  This person would counsel management on a whole array of ethical issues.  The most likely candidate to act as a moral touchstone is the Head of Internal Audit.

Read the published article online on the Mortgage Finance Gazette website