Risk management is a term that conjures up images of dismal back offices where accountants slave away in the blue cast of computer screens. But since the financial crisis, it’s a term that has become headline news.
Case in point, this headline from the International Business Times from July 13: “JP Morgan Earnings: London Whale Loss Was Systematic Failure in CIO Risk Management”.
(Read More: Biggest Risk Management Debacles)
It’s no surprise that risk management was a major topic of discussion for Jamie Dimon when he appeared before Congress to explain the Whale debacle. The phrase has been bandied about in the halls of Congress since Wall Street executives began trooping to DC to explain their roles in the 2008 meltdown to the bi-partisan Financial Crisis Inquiry Commission.
With risk management climbing into the national consciousness, it’s worth asking the question what exactly is it and how does Wall Street do it?
CNBC sat down with Brian Leach, the head of risk management at Citigroup to talk about how he thinks about his job. Leach joined Citigroup as Chief Risk Officer in March 2008, to report directly to CEO Vikram Pandit.
He was one of the Morgan Stanley alums who helped Pandit start the hedge fund Old Lane in 2005. When Citi bought Old Lane in 2007, Leach stayed on as co-COO of the unit.
The word on Wall Street is: Brian Leach knows from risk. Before Citi and Old Lane, he was a career Morgan Stanley man, rising through the fixed income division to become the Risk Manager of the Institutional Securities Business. His time at Morgan Stanley was broken by a fourteen-month hiatus to sort out Long Term Capital Management’s liquidation, after the Greenwich-based hedge fund’s notorious disintegration. (Read More: Citigroup Buys Old Lane)
Of course, the hundreds of billions of dollars lost in the 2008 financial crisis, dwarfed the $4.5 billion dollar losses at LTCM. What did risk managers miss in the recent crisis? Leverage, according to Leach. There was so much borrowing at every level of the financial system, that it could amplify any wrong way bet into a systemic meltdown. With everyone from individuals to banks to regulators betting that real estate prices would continue to rise, the risk taking was lopsided.
The financial system is much safer today, in part because financial institutions have cut their borrowing and raised so much more capital, said Leach. They’ve also boosted the assets they can quickly turn into cash, he noted.
This added liquidity and capital are mandated by the Basel III accord that governs international standards for banks. Bolstering Basel III are the parts of the U.S.’s Dodd Frank legislation that make it possible to dismantle a really big financial institution that’s going to fail. (Read More: Inside America's Economic Crisis)
“You know I like to think risk managers would have embraced elements of Dodd-Frank on their own,” Leach explained. “The parts I am supportive of are the concepts of anything that would help institutions be resolvable.”
The job of risk managers is to try to keep the institutions they work for from getting into a situation where they need to be resolved by a government authority. At Citigroup, Leach has spent a lot of time and money on getting the right information systems in place to be able to look at risk from three different angles: product risk — specific to a type of financial instrument; geographic risk — specific to a particular country or region; and credit risk – specific to a company or a government borrower.
Triangulation is Leach’s word for it. He said for any given risk situation, he has three calls to make: one to the credit risk expert, one to the product risk expert and one to the regional risk officer.
All of these experts have to be close to the business units, according to Leach. Risk managers shouldn’t operate in a vacuum. They need to balance their risk concerns with the potential reward to the company, explained Leach. The reverse is true for the people who are laying on risk.
“The good traders, the best traders absolutely think about risk and reward,” said Leach. “They have a lifetime’s view of what is going to happen. Traders who are generally learning the craft often times underestimate the downside potential.” (Read More: Too Many Harvard MBAs Heading to Wall Street)
Ideally, controlling risk is a dialog between risk managers and traders, said Leach. Citi’s risk team has weekly or bi-weekly meetings for its institutional businesses. There are people who assess risk, and others who are controllers assigned to value the positions traders take. Both types of risk professionals have to be empowered to set limits and override traders’ on the value of their trades and the amount of capital they commit.
Deciding how to commit capital is the heart of risk management. The appetite for risk is something that every institution defines differently. Often, it gets down to how much money a firm is willing or able to lose on a given trade, business or division. It’s something bank boards weigh in on.
Once a bank sets its overall risk appetite, it can use its risk management team and data to assess whether it’s meeting its risk goals. Taking no risk makes no money, but excessive risk taking can end in disaster. In general, bankers use several tools to try to figure out how much risk their company is taking at any given time.
Since the financial crisis, there has been a growing emphasis on stress testing. After being forced to undergo regulatory stress tests, executives at the nation’s biggest banks began to see the light. At first, the data the Fed requested seemed extreme, but then bankers saw how useful it was to know what would happen to their institution’s balance sheet and profits if say, the U.S. unemployment rate soared to 13 percent. Since then, systems are being overhauled to deliver the kind of data the Fed is requesting and more.
“It’s absolutely the most important thing that any company can do — and I would say that whether it was financial or industrial — to be able to run through a “what-if” scenario,” Leach noted.
But stress testing is an art. The doomsday scenarios risk managers test for have to have some credible basis. An asteroid hitting the earth — “You can’t manage to that,” said Leach. On the other hand, what about testing the effect of a 50 percent move in the premium to government interest rates paid by corporate borrowers? Sounds improbable, but Leach pointed out it has happened four times in the last decade.
“If your stress scenario is that rates move 50 percent, then you really have not done much,” said Leach.
While banks have become more attune to stress testing for events like the disintegration of the euro, or an Israeli attack on Iran, these models are not the only tools they use to assess risk.
The concept of Value at Risk or VaR is one of the most hotly debated in risk management circles. It’s a measure of how much a bank could lose on any given day with the investing positions it has taken. Bankers accuse the press of making a simplistic assumption that they rely solely on VaR to determine their risk profiles. Leach says VaR is useful for looking at every day risk – something stress testing is not meant to do.
Wall Street continues to struggle with measuring and managing risk, but since the financial crisis, it has set the bar a lot higher.
“What you want to get across to people in the firm who take risk, is that you want them to take intelligent risk,” Leach said.
-By CNBC's Margaret Popper and Kate Kelly
@poppermand @katekellycnbc