Posted on November 1, 2008 by

7 Habits of Highly Effective Risk Reporting

In the wake of the credit crisis that has swamped both the financial services industry and the ‘real’ economy, many are seeking to understand the causes of the crisis and what steps need to be taken to move forward from it.

Whilst there have been many factors that lead to this crisis, we believe that there are two critical factors that significantly contributed to both the crisis and the recovery. These two factors are;

  1. Poor quality of management information, particularly risk related information.
  2. Failure to act appropriately on available management information.

This may seem a very simplistic view but is it? Let’s consider some examples.

Northern Rock, the bank that was at the centre of the UK’s first bank run for over 100 years and one of the first major bank failures of the current crisis. The underlying business model is reported to have relied heavily on wholesale markets for funding. A well structured management information process would have focused on this critical fact and deployed indicators, (KPIs, KRIs & KCIs), to monitor a number of factors around accessing funding from the markets, such as availability, interbank rates, cost of funds, costs and internal liquidity position etc.

If this type of management information was not available to senior management, it indicates poor quality management information systems and processes. If it was available, then it represents a failure of management to act appropriately on available management information in a timely manner.

Consider the example of an investment bank, which early last year reviewed their appetite for subprime backed assets and set new, higher limits for this class of asset. Two teams were directed to purchase these assets however due to poor, complex risk systems and a lack of automated reporting the assets purchased were not included in regular risk reporting. It was only after the current crisis took hold that this organisation discovered their level of exposure was double the planned level as they were holding double the volume of these (rapidly devaluing) assets, and as such incurred double the eventual write-off!!

Strip away the issues around trading limits, communications and risk processes and ultimately we find poor management information which was inaccurate, out of date and ultimately misleading.

More generally, let’s consider the issue of short selling and confidence in the market. Did the management of the various Banks and Insurance companies have the management information at their fingertips to be able to communicate effectively to the various stakeholders to ease concerns? Did they have the management information at their fingertips to evaluate best-case and worst-case scenarios when considering raising fresh capital, determining their true positions and risk exposures, including off balance sheets items (many of which were brought on balance sheet as the crisis unfolded)?

There is an often told story that after 9/11, Southwest Airlines was able to completely re-plan its business, its strategy and routes in just a few days because of its high quality, well-developed management information systems and processes. How many financial services companies have the management information to react similarly in the face of the current crisis?
So poor management information, particularly risk related information, and a failure to act appropriately on available management information appears to have contributed to the current crisis. But how do we fix it? Using Stephen Covey’s 7 Habits as a framework and in the context of risk reporting and the current crisis, below are 7 ‘habits’ designed to enable risk professionals to improve risk reporting and deliver benefits rapidly.

1. Be Proactive

  • Engage senior management, regulators and other key stakeholder in the change agenda that will be required to improve risk reporting.
  • Develop a clear vision of the future state of risk reporting and a roadmap to realise this vision.
  • Work with senior management and the regulator in the development of both the vision and roadmap.

2. Begin With The End In Mind

  • Building on the first point, it is important that the future vision should include a ’conceptually sound’ methodology. Using the Risk-based performance methodology provides such an approach, it also enables choices to be made about where to start and how to plan in quick wins without compromising the integrity of the longer term vision.
  • Part of the vision should include a single, enterprise-wide view of risk, including any off balance sheet items. In the short term this view may have some data gaps but in the longer term this will be a key decision-making tool.
  • Use Risk and control tolerances to embed, cascade and communicate risk appetite across the firm.

3. Put First Things First

  • Given the current crisis, business and risk priorities will have changed dramatically for the next 12 months, and probably radically over the last 2-3 months. It is important that current priorities are clearly defined and presented in a format that is easy to understand and communicate, across the organisation and to external stakeholders, such as regulators. The Risk-based performance strategy map provides the structure to define current business priorities and related risks. Additionally use the Risk Map to analyse and position key risks to determine the high priority risks. The Risk Scorecard and Controls Scorecard provide the historical data to enable trend analysis of risk profile and controls effectiveness.
  • The issues around risk reporting are regularly framed as a technology issue, in many cases new technology is unlikely to be required. Given the urgency of the current situation a long drawn out technology project is likely to distract resources from the core problem. Instead organisations should look to leverage existing, familiar technologies to achieve quick wins and build momentum. Such technology could include:

SQL Server – A leading database, recent editions include a number of business intelligence capabilities which can be utilised for risk reporting.

Analysis Services provides powerful multi-dimensional storage and analysis capabilities which are tightly integrated into the familiar MS Office environment. Utilise Analysis Services to provide powerful risk analysis across the enterprise.

Reporting Services provides enterprise strength production reporting capabilities with a familiar, MS office like development environment and easy output to multiple formats, such as MS Office, pdf and the web. Utilise Reporting Services to provide powerful risk reporting for senior management, to front-line staff, and externally to regulators.

Integration Services provides enterprise strength data extraction, transformation and load (ETL) capabilities, enabling data from multiple line of business systems to be brought together to create a ‘single version of the truth’. Utilise Integration Services to improve the integrity of data and timeliness of risk reports and dashboards.

  • SharePoint – This widely used tool is typically deployed as a platform for company intranets, however it also includes a range of data capture, dashboard and workflow capabilities. In the short term the ability to quickly develop data capture forms with validation and data integrity rules using SharePoint can add significant value to risk reporting efforts. It can improve highly manual, slow reporting process while adding auditable and security. The dashboarding capabilities within SharePoint provides a quick, easy and professional approach to delivering risk dashboards to senior management, frontline staff and regulators alike. Supporting these data capture and dashboarding capabilities is a powerful workflow for managing automated review, approval and sign-off processes.
  • Excel – Currently the most widely deployed Business Intelligence tool in the world, Excel is often regarded as the enemy of good reporting. However with improvements such as Excel Services, it should now be considered the friend of risk professionals and the business intelligence community. Moving existing excel spreadsheets into an Excel Services environment can rapidly improve the robustness of the reporting environment, reduce reporting errors and significantly reduce administration costs.

4. Think Win/Win

  • In the wake of the current crisis risk professionals should work hard to emphasise that risk is a combination of threats and opportunities. As stated by the recently launched Risk Management Code of Practice, BS31100, Risk is the effect of uncertainty on objectives. This can be positive (representing an opportunity) or negative (representing a threat). In this time of unparalleled turbulence, there are major opportunities for companies to gain competitive advantages and market positions that will create value for many years to come. Risk professionals must play their part in helping their companies to recognise and deliver the capabilities to fully exploit these opportunities, as well as managing threats.

5. Seek First To Understand, Then To Be Understood

  • Historically in many companies risk professionals were not as highly regarded or did not have the level of influence that is desirable. Recommendations in the recent IIF report, Market Best Practices: Principles of Conduct and Best Practice, provides guidance to improve the effectiveness of risk management functions. It states, “CRO should have sufficient seniority and internal voice in the firm to have a meaningful impact on decisions” and “CRO must have effective ways to influence the key decision makers in the firm”. Clearly there are issues with the standing of risk professionals in many firms. To improve relationships between risk and the business, it is critical that risk professionals engage the business in improving risk reporting and management processes. Using the strategy map and risk map in combination can enable risk and business to speak a common language and develop a shared understanding of the importance of good risk reporting.

6. Synergise

  • Developing an appropriate culture is critical to effective risk management, and in fact, effective strategic execution. At this time of crisis risk professionals have a unique opportunity to work collaboratively across the firm to understand the causes of the crisis, the individual firm-specific failures and what lessons can be learnt. Conducting this type of ‘lessons learnt’ process can be part of improving risk reporting and analysis in the short term and in the longer term can be a critical step towards shaping the future and developing the ‘right’ culture to meet future challenges and exploit future opportunities.

7. Sharpen the saw

  • Fixing risk reporting and analysis is a task that in many firms cannot be successfully completed in the immediate short-term, therefore it is important that risk professionals ensure that everyone, from senior management to front-line staff, understands the iterative nature of this process. Driving improvements in risk reporting is as much a journey as a destination. Using tools such as the strategy map and the trend analysis behind the three scorecards within Risk-based performance enables improvements to be easily demonstrated. It enables momentum to be built and maintained and it enables benefits to be clearly tracked and reported back as they are made. All of these factors help sustain the firm’s effort to improve risk reporting in both the short and long term.

Improving risk reporting is demanding in the best of environments, however the current crisis it presents some specific challenges, and opportunities for risk professionals to add value to their firm.

We would be interested to hear your thoughts on this article and to hear about your efforts to improve risk reporting in your firm.