CR 2 – Governance

One poor lending or trading decision can cost a firm a great deal when the deal is large, yet a single bad deal rarely brings a company down. Firms fail when bad deals accumulate into a portfolio of toxic exposures, and, leaving fraud aside, that accumulation comes from a weak risk management framework and a failure of corporate governance rather than from one careless person.

The uncomfortable part is that post-mortem reviews of very large losses often find every procedure was followed. The damage came from rules that did not work as intended, staff who lacked the necessary skills, origination nobody independent was watching, incentives that paid for the wrong outcomes, or flawed approval processes. The failure is collective, and no single person can sensibly be blamed.

Why the focus falls on origination

Effort should therefore concentrate on the processes that create risk in the first place, namely origination of credit, the assessment of its risk and the approval decision. Portfolio management, hedging and risk transfer matter, but none of them can rescue a book of deals that should never have been written, because once a weak portfolio exists the losses are largely locked in. Pricing is no defense either: a rate well above the market does not turn a bad transaction into a good one.

What drives origination

Origination responds to incentives. Most companies reward revenue growth, partly because whether profit has met expectations is only visible much later, and some also reward return on risk-adjusted capital. Originators therefore push for volume, margin and expected return, all of which look better when a deal is shown in its most flattering light. Somebody has to stand for quality, and that role belongs to the risk manager.

To define who is responsible for what, most large organizations now use a model published by the Institute of Internal Auditors in a 2013 position paper on the three lines of defense. It separates the people who take risk, the people who watch it and the people who check that the watching works.

Good governance of credit risk also rests on four principles that shape the quality of what gets originated: guidelines, meaning clear written rules for approving any transaction that creates credit risk; skills, meaning approval authority delegated only to committees and people competent to use it; limits; and oversight by qualified risk staff who are independent and properly resourced.

Guidelines are the written rules a transaction must satisfy before the firm commits to it. Firms give them different names, such as credit policies or risk management standards, but the label does not change the substance: they are the reference point every originator and approver works from.

Brevity and precision pull against each other. Short guidelines are more likely to be read, but pushed too far they become so general that they constrain nothing. The authors half-jokingly suggest keeping lawyers away from the first draft, since the aim is to help people comply, not to build a case against someone who later breaches the rules.

Accessibility sounds trivial, yet in many firms the latest guidelines are hard to find. A practical fix is a one or two page summary posted prominently on the company intranet, stating where the full set lives.

Guidelines are ultimately what protect shareholders’ capital and, in extreme cases, the survival of the firm. Poor transactions usually involve poor human judgment, but if the guidelines allowed a transaction, whether by explicitly authorizing it or by failing to rule it out, accountability rests with executive management.

Creation and approval

For that reason a senior executive, typically the chief risk officer (CRO) or the chief financial officer, sponsors the guidelines, and the Board of Directors approves them. At firms listed on an exchange such as the New York Stock Exchange, the board audit committee is required to review risk management policies, which gives it final oversight of the guidelines. Most financial institutions also have a dedicated risk committee of the board that shares responsibility for oversight, review and final approval.

Keeping guidelines current

The business evolves, so a process must exist to review and amend the guidelines, and the most senior committee should ask for regular updates on their quality and relevance. A review is sensible after any loss, even a small one, and after events nobody anticipated, even harmless ones, because they reveal scenarios the guidelines never considered.

The oil market of April 2020 is the standard illustration. For a few days, for technical reasons, the price of oil was negative, and sellers delivering oil through futures contracts not only received nothing but had to pay buyers $37 a barrel. Most risk managers had worried about oil spiking, not about it falling below zero, so few institutions had guidelines covering a negative price.

Ownership by the chief risk officer’s office

The office of the CRO owns the guidelines, drafting them, seeking approval, promulgating and maintaining them. In a large organization that is a full-time role for one professional, who needs both business knowledge and seniority. Knowledge matters because the rules must reflect how products and markets actually work, which a junior person cannot capture well. Seniority matters politically, since rewriting guidelines often becomes a contest between originators and risk managers, and for the approval itself, since the rules must be presented at the top of the firm by someone credible.

New guidelines, or major rewrites, are needed when the firm enters a new business, when markets change or innovate, or when operations change materially, for example through mergers and acquisitions (M&A). Even without such triggers, periodic updates are needed because operations never stand still. Since the 2007 crisis, closer regulatory scrutiny of risk taking has given firms a strong reason to keep guidelines effective.

What the guidelines should cover

At a minimum, guidelines should set out their purpose, the methodology for defining a transaction’s key parameters, transaction approval and delegation of authority, the process for new products and new markets, the process for reviewing and updating the guidelines themselves, and the consequences of failing to follow them.

Breaches, carve-outs and enforcement

In a well-run firm a breach of guidelines should be rare. Most financial firms dismiss the person responsible at once, because nobody may take more risk than the Board of Directors has accepted, which is exactly why staff must know and understand the rules.

Guidelines can include carve-outs for movements outside an originator’s control, such as foreign-exchange volatility. Suppose an originator uses the full available credit limit for a counterparty, and the exposure later rises above the limit purely because the exchange rate moved. Well-drafted guidelines anticipate this, for instance by expressing the limit in local currency, since currency management normally sits with the treasury function.

A centralized database of exposures and other key credit parameters makes enforcement easier and speeds deal flow, since originators can check instantly whether a deal is allowed. It also ends any debate about whether an originator knew the rules: an unauthorized deal is rejected at entry, and one pushed through anyway is documented as unauthorized.

Sending every deal to the most senior people is impossible, so the authority the Board of Directors grants to executive management has to be passed further down. The rules for doing so sit at the center of the guidelines, and they cause recurring friction between the risk function and the business.

Two sets of priorities

An old saying captures it: risk managers rank not losing money first and making money second, while the business ranks the same two goals the other way round. Originators carry growth targets and want to close deals without collecting many approvals, whereas risk managers look past expected profit to what happens if things go badly.

The advisory role of risk management

Approval authority does not belong to the risk management unit at all. Because it earns no revenue, its role is advisory, helping the people and committees who hold authority decide; this reflects accountability rather than weakness, since business managers answer for the revenue and profit of their units. For deals meeting criteria spelled out in the guidelines, input or a formal recommendation from risk management may be mandatory, but a risk management veto is rare. When risk managers strongly disagree, they need a platform: a written memo attached to the committee package, and a seat on the committee where they can argue their view in person.

The two-step delegation process

Delegation of authority works in two steps. In the first, each transaction is assigned the fundamental parameters that describe it from a risk management standpoint. In the second, approval authority is delegated according to those parameters. Deals too complex or unusual for parameters to be assigned need their own path, and the guidelines may send them automatically to a senior body, for example a transaction committee, that can push them higher still.

The most common risk parameters

For a loan, the tenor runs from the signing of the loan agreement to the date the last principal repayment falls due.

The governing rule is simple: the riskier the deal, the more senior the approval. Large exposures, weak counterparties or long tenors need committees with the right knowledge, experience and rank, while small, short-dated deals with strong counterparties can be approved lower down, sometimes by one person.

A new deal is first given its parameters, which are then compared with the guideline thresholds to identify who has authority. A typical chain starts with the individual originator, moves to the business unit head, then to a transaction committee of unit heads plus advisors such as compliance, legal and tax, and beyond certain size, credit quality and tenor thresholds reaches an executive board or credit committee of top management, including among others the CFO, the chief counsel and the CEO.

The chain is cumulative. Every level along the way must approve, so a deal cannot jump from the originator straight to the credit committee without being endorsed by the levels in between. Limits on counterparties, as opposed to single transactions, are approved through a similar process.

Reading an approval matrix

The table below reproduces an illustrative approval grid for single transactions with a tenor of up to five years. Rows are internal counterparty ratings from R1, the strongest, to R6, the weakest. Each figure is the upper exposure, in millions of U.S. dollars, that the body named in the column header may approve; anything larger moves to the next column, and anything above the transaction committee limit goes to the executive risk committee. In the source grid the first two approval columns both carry the label “Head of trading”; they are kept as two separate levels here, numbered for clarity.

The recommendation of the credit risk assessment unit is required for any exposure above the level 1 limit for the rating. The step column is derived.

Reading down a column, authority shrinks as credit quality weakens; reading across a row, more senior bodies can approve larger amounts.

The top approval body is usually called the credit committee, and it is made up of the firm’s most senior executives. Deals that reach it carry high stakes, so the committee runs on a handful of principles that protect the quality of its decisions.

A decision is only as good as the people who make it, so membership must be diverse and cover every discipline that could spot a problem: the business unit as profit center, risk management, legal, tax, compliance and accounting at a minimum. Membership is personal, and members have only limited ability to send a deputy in their place. The committee’s charter belongs in the credit guidelines or in another document describing the approval process, so that its powers are written down rather than assumed.

Originators must produce an approval package covering every aspect of the deal and circulate it well before the meeting, giving members time to read it and ask for more information or outside advice.

A respected chairperson lets every party speak and keeps the discussion calm and objective. Originators must accept that the answer can be no; a committee that never refuses anything is not doing its job. If members cannot reach consensus, they may vote.

Discussions are minuted in detail and accurately, and the minutes are circulated soon after the meeting. When a deal later goes wrong, the credit committee minutes are among the first documents management and auditors request, because they show what was known and how the decision was reached.

A limit is the absolute amount of risk, in dollars or another currency, that the company is willing to take, or equivalently the largest loss it is prepared to absorb. Limits are often called credit lines, and they can be set for counterparties, industries and countries.

The idea is harder than it looks because, for some transactions, the loss on a counterparty’s bankruptcy cannot be known in advance; it depends on market conditions at the moment of default. Long-term supply or purchase agreements for physical commodities and derivative transactions both behave this way, which gives rise to the idea of dynamic credit exposure.

Combining limits

Firms handle this uncertainty by stacking limits. A company might be comfortable with $200 million of risk on Company A overall, while also requiring that exposure arising from derivatives be no more than 50 percent of that total.

Choosing the size of limits

Setting limits is more art than science. Value at risk models can link exposure parameters to the amount of capital the firm is willing to put at risk in credit activities, but in practice judgment and experience often decide. Executive management may conclude that shareholders, rating agencies and regulators would tolerate a loss of, say, $150 million. It then sets $150 million as the absolute ceiling for any counterparty and grants much smaller limits to weaker names according to their individual credit profiles.

Sharing credit lines across the business

In an ideal setup every originator knows the total credit line available for each counterparty. When several business units want to use the same counterparty line, it can be allocated among them in advance. The existence and size of lines are a frequent cause of tension between front office and risk management. Originators want preapproved limits so they can market to prospective clients without the embarrassment of winning business their firm then refuses to support.

Choosing the right deals is what separates strong organizations from weak ones, so the risk managers who protect the balance sheet must be qualified and able to work effectively.

Independence

Independence must not be compromised, and two rules keep it intact: the risk management unit is never placed inside a business unit that is a profit center, and a risk manager’s pay is never tied to business profitability. Every member of the risk staff should have a reporting line that ends with the chief risk officer (CRO), not a business unit head, so that conflicts of interest are avoided.

In many large companies the CRO reports straight to the chief executive officer, at the same rank as the top business heads, which gives informal influence over the CEO. Its value lies less in any specific objection than in business heads knowing the access exists, which steers them toward compliance. The CRO usually also has a direct line to the board risk or audit committee. Where directors are truly independent, as Sarbanes-Oxley has increasingly made them in the United States, this access may be the single most important safeguard of the CRO’s independence.

Qualifications

Conflict comes with the role, but mutual respect survives it when both sides speak the same language. Business people have no time to teach the basics, and a risk manager who needs a deal’s fundamentals explained loses credibility. Confident originators still value constructive challenge from a capable sparring partner. A weak risk manager, by contrast, is brought in late and only to collect the required recommendation.

Proximity to the business unit

Independence does not mean distance. Risk managers should sit close to operations, organizationally and physically, to understand what motivates colleagues, customers, vendors and every other party to a deal. When client talks stall over a term, price or limit, a trusted risk manager who explains the firm’s position diplomatically can persuade the client or at least limit damage to the relationship.

Two cautions apply. Risk managers are not necessarily seasoned negotiators. A good negotiator fixes a firm walk-away point before entering the room and avoids decisions under pressure that may be regretted later, and a risk manager must likewise know in advance the limits that cannot be breached and use the meeting to convey them. Also, getting too close to the front office can backfire, because the risk manager exists to offer a different view and to protect the balance sheet.

Open mind

An old line says a good risk manager answers with how rather than no. The craft lies in proposing changes that make a transaction acceptable, which both sides welcome, since a risk manager who only refuses frustrates originators. Helping to structure deals on sound terms also makes the job more rewarding.

A common saying in finance is that the chief executive officer (CEO) is the true head of risk management. Beyond answering for profitability, the CEO is fully responsible for making the entire organization respect risk management principles, and a firm should not need a near-death experience to learn this.

Employees will not commit to strict principles unless senior management leads by example, so the CEO and direct reports are expected to back the established principles and to behave as if they were personally in charge of risk. In strategic decisions, including mergers and acquisitions as well as day-to-day transactions, the CEO must bring in the risk management department at the right moment.

The origination process from start to finish

The first screen asks whether the deal fits the firm’s stated risk appetite. Rejection here can follow from sanctions against a country, an industry the firm has chosen to avoid, for example under ESG policies, or a specific company it does not want to deal with. If the deal passes, the exposure it would generate is calculated. For an existing counterparty, the next question is whether credit capacity remains under the current line; if it does, the deal can proceed. If the counterparty is new, or capacity has run out, the credit quality and the firm’s appetite for that name are analyzed, leading either to rejection or to a decision to do the deal in full or in part, after which the new exposure is added to the portfolio.

Supporting steps include an origination checklist, mitigants with a legal review, approval under the guidelines, and periodic credit reviews that renew, cut or raise the line. The principle beneath the whole chart is that the surest protection for capital is to stay out of any deal the firm does not fully understand or that does not match its strategy and risk appetite.