HSBC RISK MANAGEMENT FOR SENIOR BANKERS Steve Troop

HSBC RISK MANAGEMENT FOR SENIOR BANKERS Steve Troop Deputy Chief Executive - HSBC Turkey Istanbul, 20 th November 2002

What today’s presentation is not… 4 Technically-focused : ‘soft’ issues rather than the mechanics of risk management…. . 4 1 Definitive : no-one can offer a set of ‘Answers’ : all I will do today is illustrate some - but by no means all of the ‘Questions’…. . ABC 2

Today’s Presentation 4 The role of senior management in risk management 4 Establishing sound risk management principles 4 Some thoughts on the application of ‘risk-management-in-the-round’ 2 ABC 3

1. Senior Management’s Role 4 Banking is the original ‘risk business’ 4‘No-risk’ banking a contradiction in terms 4 We buy risk, we sell risk, we measure risk, we manage risk, we (or our subordinates) make ‘risk decisions’ all day and every day …… If ‘risk’ is the essence of banking, it follows that the role of senior management is risk management ……. . 3 ABC 4

1. Senior Management’s Role 4 Establishing a culture of risk management Strategy 8 Core Values / the ‘conscience of the company’ 8 Consistency 8 Provide focus 4 Seeing the big picture - ‘joined-up’ risk . management 4 Collective Management at the top of the bank 4 Picking the right team 8 4 ABC 5

The Role of Senior Management(2) 1. Establishing a culture of risk management 8 5 Strategy q Every bank should have one ! q A bank’s strategy is, of itself, a statement of risk appetite q Review, revise , update q ‘Test’ investment and risk decisions against that strategy q Communicate it internally ABC 6

The Role of Senior Management(3) 4 Core Values / the ‘conscience of the company’ 8 Statement of principles 8 Guidelines / handbooks as to staff conduct 8 Role models : talk-the-walk / walk-the-talk 8 Collective belief in the value of risk management (If senior management don’t believe in it, why should anyone else ? ) 4 Consistency Set ‘rules’ and then apply them 8 Be seen to apply them 8 6 ABC 7

The Role of Senior Management(4) 4 Provide focus: 8 Risk management as a tool to achieve efficiency, productivity and profitability 8 7 Deployment of resources : link between risk, return, capital employed, strategy. Measurement and modelling is important though it is decision makers who create the difference……. ABC 8

The Role of Senior Management(5) 8 Seeing the big picture : ‘joined-up’ risk management 8 Multiplicity of risks ; q Credit q Market : interest / exchange rate, repricing, availability q Operational / technical q Compliance / legal q Reputational 8 Complication : some of these risks compete / some offset…… 8 How to pull them all together and ‘see’ the big picture ? 8 ABC 9

The Role of Senior Management(6) 8 Collective management at the top of the bank ; Is there a Top Team ? Is it a Team ? Does it communicate ? 8 Does it discuss risk management? If so, how often? 8 Shared approach to risk management / common view - or ‘someone else’s job ? ’ 8 How ‘honest’ is communication ? Do we encourage intuition / feelings ? 8 9 ABC 10

The Role of Senior Management(7) 8 Have we picked the ‘right team ? ’ 8 Balance : mix of styles / perspectives 8 Professional training, experience, CVs 10 ABC 11

The Role of Senior Management(8) 8 Does our organisational structure facilitate appropriate risk management ? 8 Reporting lines : do these reflect the need for independence / objectivity ? 8……. or do we have the fox looking after the hen house ? 11 ABC 12

The Role of Senior Management(9) 8 Delegated authorities are essential to the effective operation of any large bank: are they ; 8 Unequivocal ? (As to value, limits, scope of activity, decision-making, etc) 8 Clearly understood by those who hold those authorities ? 8 Are excesses -of-authority identified quickly (and by whom) ? 12 ABC 13

The Role of Senior Management(10) 8 Questions to ask - on a regular basis ; Bonuses : do our strategies for variable compensation complement - or compete with - a ‘risk management culture’ ? 8 Recognition : do we promote / advance the careers of those who demonstrate a balanced approach to management (considered commercial judgment with an awareness of risk) ? 8 13 ABC 14

The Role of Senior Management(11) 8 Questions to ask - on a regular basis; 8 Roles & responsibilities : is risk management embedded in everyone’s Job Description - or is there a poachers-andgamekeepers environment ? (‘Creative tension’ is inevitable and healthy : internal warfare is not) Training : does the risk-management ethos inform / shape Training commitments and budgets ? 8 14 ABC 15

The Role of Senior Management(12) 8 Questions to ask - on a regular basis; 8 Reputational risk : key role of senior management. What do we have in place to protect us from ‘banana skins’ that will embarrass us in front of regulators, our customers, our shareholders, our staff, the media and the general public ? 15 ABC 16

The Role of Senior Management(13) 8 More questions ; 8 8 8 16 Are we compliant with legislation ? Though at least as important…… Have we let compliance with legislation / regulation become a proxy for managing risks ? (Going-through-the-motions) Do we shoot-the-messenger or are there channels / mechanisms through which more junior concerns can be listened to ? ABC 17

The Role of Senior Management(14) 8(Yet) more questions ; 8 Do we learn from mistakes ? Formal, independent, objective review with recommendations ? (Are these followed up ? ) 8 Is information flow timely ? (It took an estimated 45 seconds for nervous stimuli to get from the tail of the largest dinosaur to its brain - by which time, the predator had already eaten both hind legs ………. ) 8 Top management meetings : shape and focus is important. Do we spend time explaining (arguing about? ) what happened - or do we focus on what might/could / will happen in future ? 17 ABC 18

2. Sound Risk Management Principles 8 Balance between risk / reward : we all claim to understand the basic principles of risk/ reward. Most of us focus on the reward…… 8 Identifying future income associated with a particular investment / lending decision is straightforward : do we identify (quantify) worstcase risk ? 8 If we do, do we have house-limits on worst-case risks ? (Put bluntly, how much are we prepared - or indeed, how much can we afford - to lose ? ) 18 ABC 19

Sound Risk Management Principles (2) 1. Do we look at profitability on transactions / relationships / business-lines ? 8 Loss-leadership a fact of commercial life in competitive markets 8 Loss-leadership is a tactic - not a strategy…. 8 Do we / can we measure loss-leadership ? Do we limit (time or value) how far we are prepared to go with loss-leadership at a bank-level ? 19 ABC 20

Sound Risk Management Principles (3) 8 Do we have a portfolio strategy ? 8 Have we limited activity / exposure to specific sectors ? 8 If we have, can we implement it ? (i. e. is the data accessible / is it recorded correctly ? ) 8 Do we have ‘natural hedges’ ? Do these supply the ‘balance’ we need ? 8 If no, what hedging tools can we put in place ? 20 ABC 21

Sound Risk Management Principles (4) 8 Do we demonstrate resolve 8 How do we deal with policy exceptions ? 8 How many exceptions do we have ? (If a large number, do we really have a policy ? ) 8 ‘It’s all about execution’ ……… 21 ABC 22

Sound Risk Management Principles (5) 8 Top Team involvement ; 8 Collective decisions (not just collective discussions) 8 Don’t be afraid to micro-manage / spot -check from time to time……… 22 ABC 23

3. Risk Management-in-the-round 8 A clear and obvious need to ‘bring it all together’ : 8 Executive Risk Committee 8 ALCO 8 EXCO 8 IT Steering Committee 8 Board Meetings 8 Audit Reports 8 Contingency Management 23 ABC 24

3. Risk Management-in-the-round 8 Executive Risk Committee 8 Risk Decree requirement 8 Chaired by non-Executive Director & Board Member (Minutes for Board) 8 Quarterly reviews of risk management 8 No business leadership participates 8 Heads of Audit, Operations, Compliance, Legal, Credit, Treasury Control/ Back Office, ICU. 24 ABC 25

3. Risk Management-in-the-round 8 ALCO 8 Weekly (more often as needed) 8 Minuted 8 Standard format : specific sections on limit excesses (credit, treasury) 8 Reviews pricing, funding, balance-sheet, P&L, profitability 8 Attended by both business leadership and risk control functions. 25 ABC 26

3. Risk Management-in-the-round 8 EXCO 8 Monthly (more often as needed) 8 Business leadership & top management of the bank 8 Minuted 8 Reviews out put from Audit, ERC and ALCO. 26 ABC 27

3. Risk Management-in-the-round 8 IT Steering Committee 8 Quarterly (more often as needed) 8 Business leadership & top management of the bank 8 Minuted 8 IT: material in any risk management discussion plus inherent risks in IT itself 8 IT’s central role as provider of numeric tools for measurement and management of risk 27 ABC 28

3. Risk Management-in-the-round 8 Role of Audit 8 Reviews the adequacy / effectiveness of risk controls 8 Publishes formal reports & recommendations addressed to ‘owners’ of businesses and processes. 8 Timely responses required / tracked to conclusion. 8 Formal reporting line to Audit in Head Office (London) 28 ABC 29

3. Risk Management-in-the-round 8 Contingency Management 8 Pre-identifcation of possible event / systemic risks 8 Modelling tools / ‘early warning’ signals 8 Business Resumption / Disaster Recovery Plans (Test them………) 29 ABC 30

SUMMARY 8 Risk management is the very essence of top management’s role and its principal responsibility 8 Top management set the tone for risk management / risk consciousness at any institution…… 8 Risks are interdependent : top management’s job is to see ‘The Big Picture’…… 30 ABC 31

CONCLUSION 8 No ‘Right Answer’. . … 8 An evolutionary process : complacency the greatest threat 8 Asking ‘difficult’ Questions - and constant refinement of the Answers - is the most valuable thing any senior manager can and should be doing…. . 31 ABC 32

THANKYOU FOR LISTENING. ANY QUESTIONS ? 32 ABC 33