Why risk governance matters

Credit Suisse's systems saw the danger. For months before Archegos defaulted in March 2021, the fund broke the bank's own limits, in some cases every week. Nobody acted. The bank lost about US$5.5 billion. The numbers were right; the people and processes around them failed.

When a firm suffers a huge loss, the first question is often “was the model wrong?” Sometimes it was. But read the official reports into the great failures and a different pattern appears. The risk was usually visible to someone. What failed was the chain from seeing a risk to doing something about it.

That chain is risk governanceThe roles, decision rights, information flows and accountability through which a firm decides how much risk to take, keeps it in bounds and answers for it.. A modelA simplified, usually mathematical, picture of the world that turns data into a number, such as a risk estimate. turns data into a number. Governance decides who sets the rules, who looks at the number, who can challenge it, who must act, and who answers if nobody does. In everyday terms: a smoke alarm is a model. Governance is whether anyone is home, whether they know where the extinguisher is, and whether they are allowed to call the fire brigade.

You met the great failures of the last three decades in L2.1.06: Landmark failures: LTCM and 2008 and L2.1.07: Landmark failures: SVB and Archegos. Run four of them through those questions below. Notice how rarely the answer is “the maths was wrong”.

Models still matter. Models do fail. In 2008, rating models for bonds backed by subprime mortgages assumed that defaults would not cluster as much as they did. But even a flawed model is a governance question: who validated it, who knew its limits, and who decided how much to rely on it? Good governance does not need perfect models. It needs people who ask what the model leaves out, and the authority to act when the answer is worrying.

The building blocks. Every well-run financial firm has the same parts, and this module takes them one at a time. Click each to see what it does and where it is covered.

In 2012 JPMorgan Chase's Chief Investment Office (CIO), a unit meant to invest the bank's spare deposits and hedge its risks, lost at least US$6.2 billion on credit derivatives. A trader nicknamed “the London Whale” had built positions so large they moved the market. Step through the US Senate's March 2013 report the way a risk manager would.

After 2008, supervisors concluded that weak governance, not only weak capital, had sunk many firms. The Senior Supervisors Group (October 2009) found that firms which fared better had senior managers with a firm-wide view of risk and a risk function with real stature. Global standards followed:

• BCBS, Corporate governance principles for banks (July 2015): 13 principles covering the board, senior management, the risk function and CRO, compliance, internal audit, pay and disclosure.
• FSB, Thematic review on risk governance (February 2013) and its 2013 principles on risk appetite and 2014 guidance on risk culture.

Each jurisdiction writes these into its own rules: in the EU, the Capital Requirements Directive and EBA guidelines on internal governance; in the UK, the Senior Managers and Certification Regime; in the US, the Federal Reserve's enhanced prudential standards and the OCC's heightened standards; in Australia, APRA's prudential standards CPS 510 (governance) and CPS 220 (risk management). Later lessons in this module name them where they apply. The detailed rules belong to Level 4: Regulation, Capital & Accounting.

• Risk governance is the set of roles, decision rights, information flows and accountability that turns seeing a risk into acting on it.
• In most great losses the risk was visible: limits were breached, audits flagged it, supervisors raised findings. The failure was in acting.
• Four questions diagnose a failure: who decides, who checks, who knows, who answers.
• Models can fail too, but whether a flawed model is trusted is itself a governance question.
• Global standards (BCBS 2015, FSB 2013 and 2014) set out what good governance looks like; national rules make it binding.

Risk governance

The roles, decision rights, information flows and accountability through which a firm decides how much risk to take, keeps it in bounds and answers for it.

Model

A simplified, usually mathematical, picture of the world that turns data into a number, such as a risk estimate.

Limit

A ceiling on a measure of risk, set in advance, that triggers action when it is reached.

Escalation

Passing a problem up to a more senior person or committee who has the authority to act on it.

Segregation of duties

Splitting a task so that no one person both does something and checks or records it.

Value at risk (VaR)

Value at risk: a loss that a portfolio is not expected to exceed over a set horizon at a given confidence level.