In any crisis and its aftermath, risks rise. Given that the COVID-19 pandemic has created some of the most extreme challenges seen in a generation, risk management must surely be on the agenda for banks like never before.
On the positive side, many banks have of course invested significantly in risk management capabilities, particularly in the wake of the global financial crisis. Alongside this, requirements from financial regulators have led them to build up their capital and liquidity buffers. As a result, they were generally in a good position to handle the shocks that the COVID-19 outbreak triggered.
Nevertheless, the disruptions have been so extreme that they pointed up areas in which banks must strengthen and improve. Liquidity risk management was top of the agenda as the crisis really took hold. Liquidity in the bond markets dried up. Market risk limits were exceeded as values fluctuated wildly. Credit risk spreads became unreliable.
What the pandemic showed is that many banks need to improve their ability to analyze a new situation quickly when input data (share values, currency fluctuations, and economic forecasts) dramatically changes. In such a situation, they must be able to simulate how their positions will develop over time and rapidly adapt their scenarios to model the effects.
No one would pretend that this is easy. COVID-19 was, after all, exceptionally severe. However, we could yet see second waves of the virus or a new and different crisis of similar proportions - and banks must be ready.
What’s more, there are ongoing fallouts from the pandemic which mean that risk management will be strategically and operationally crucial as we move forward.
Credit risk will remain a key focus as the possibility of customer defaults rises. Historical models for credit risk analysis may not be fit for purpose. How does a bank assess the prospects of a restaurant business, for example, when it is not clear how many seats they will be able to operate with, when and how quickly that number might increase (or, even, need to decrease again), nor what ‘appetite’ there will be for dining among consumers? Underwriting a new or existing facility becomes truly challenging.
The credit ratings that banks apply to their portfolios have been a vexed question. During the pandemic, nearly all the data that banks held on customers became virtually obsolete. They had to make completely new assessments of their loan books and apply a certain amount of ‘free style’ judgment as they dynamically managed the risks in a highly fluid situation. They needed to make qualitative assessments alongside what their models were telling them, because the information in the models had become outdated almost overnight.
These qualitative assessments will likely need to continue while banks recalibrate and adjust some of their models based on the learnings from the COVID-19 experience. This will take some time – especially as some changes could require approval from regulators.
How then can banks continue to strengthen and optimize their risk management approaches? Without doubt, data holds the key. One of the struggles during the pandemic was simply to obtain the data needed from disparate databases and report it in a timely manner. Repositories of data must be better linked up, both within the risk function itself and in other parts of the business such as finance, with enhanced abilities to extract and analyze it. Data quality is another critical issue. To be of use, banks must be able to pull out disaggregated information that tells them specifically what they need to know.
Data quality is another critical issue. To be of use, banks must be able to pull out disaggregated information that tells them specifically what they need to know.
Part of the task, therefore, is an IT system challenge of linking up different information sources and making them talk to each other. But a crucial element is also to introduce advanced data analytics capabilities that will allow banks to model likely outcomes. To be robust, this also means combining internal data with external information and inputs too – something for which cloud-based tools including AI are likely to be indispensable.
At the same time, regulatory requirements will continue to play a major factor in banks’ risk management approaches. Regulatory stress tests, for example, have become an important feature in many markets. In the US, the Federal Reserve Board has recently completed its annual Comprehensive Capital Analysis and Review (CCAR) stress tests and decreed that the dividends banks can issue in the third quarter will be capped at the level of their second quarter distribution. Banks that ‘fail’ the latest tests (which will also, for the first time, be repeated later this year) will not be allowed to issue any dividends in the third quarter at all.
It will be fascinating to see how regulatory approaches develop in the coming years. Regulators were in fact quick to relax certain requirements during the COVID-19 outbreak. They showed significant forbearance of their own, such as by relaxing the Basel capital requirements and enabling more leeway on the IFRS 9 accounting requirement to move certain loans into the expected lifetime loss category.
These measures were greatly supportive for banks. Some commentators have long suggested that there is an element of pro-cyclicality in certain regulatory requirements, effectively exacerbating negative factors in a downturn situation. We can expect to see ongoing discussion and debate about whether changes are needed to alleviate this.
Moving forward, those banks that optimize their approaches through enhanced models based on better data and smarter analytics will see an advantage over their peers. There may also be opportunities for growth by developing new products suited to changing consumer behavior (such as increased digital/remote purchasing) and servicing customers more effectively due to an increased understanding of their risk profiles. With some institutions likely to be hit by increased loan losses and falling valuations, inorganic growth opportunities could also present themselves to strong banks who preserve sufficient capital.
With some institutions likely to be hit by increased loan losses and falling valuations, inorganic growth opportunities could also present themselves to strong banks who preserve sufficient capital.
Underlying all of this is the ongoing requirement for strong operational risk management and resiliency, particularly around cyber security, data protection and IT controls in an ever more digital age. As firms deal with extended virtual working environments with a possibly significant proportion of their workforce working from home as in the US, their governance and internal control environments will need to adapt. One particularly challenging area is likely to be trader surveillance which will be a key compliance concern for as long as some traders are working remotely rather than on-site.
With a new risk management playbook needed, it is all to play for in the coming years.
Explore how these trends are unfolding in in your country using the interactive map below.