Introduction

Thank you, John Rodi for that kind introduction and inviting me to speak to you today. It’s a pleasure to be here. I always find settings like these valuable because they give those of us in policymaking positions a chance to hear from professionals who participate every day in the markets and industries we spend so much time thinking about.

I imagine most of you remain quite busy navigating through the ongoing recovery from the financial crisis. For financial institutions, conditions continue to improve by most measures. Banks are better capitalized than they were a few years ago, experiencing strong commercial loan growth; and they now have historically low credit losses. At the same time, financial firms, particularly the largest ones, face a variety of new regulatory requirements. Some of them are already in effect, while others will be phased in over the next few years.

Risk Culture

One aspect of the regulatory landscape I’d like to address today is the responsibility of financial institutions to develop a strong, accountable and proactive risk culture. It’s easier to talk about meeting specific risk-management requirements than it is to talk about institutional culture — especially risk culture. Financial services firms, including the Federal Reserve Bank of Chicago, are subject to a diverse set of formal risk-management requirements, including internal audit, Sarbanes-Oxley Act (SOX)[1] compliance, contingency planning, enterprise risk management and other activities. These functions, taken together, are formal ways to identify and contain risks to individual firms, as well as the broader financial system. Risk-management requirements, most notably stronger transparency and disclosure policies, are also a key source of confidence and protection for investors and customers.

While these functions are critical, I would argue that an organization’s risk culture is even more important. As a leader, I strongly believe that my staff should not just go through the motions of checking off the list for audit compliance or set up risk-management efforts that operate in name only. Like any organization, we do like to know what our external auditors expect — and that’s certainly reasonable. As a chief executive officer (CEO), though, one of the challenges I face is making sure my staff understands the principles and goals we have as an organization — which should at a minimum align with the auditors’ expectations. Moreover, I must ensure that my staff incorporates these objectives into their daily work by setting the right tone at the top. The notion of risk culture is admittedly hard to describe. I think we can agree it starts broadly with how all ranks of an organization’s personnel — from entry-level staff to the CEO — identify and respond to risks and threats — even when they’re not explicitly covered by specific rules and regulations.

It is for these and other reasons that banking supervisors, like auditors, encourage financial firms and their senior leaders to look at risk-management requirements as more than mere compliance functions or “cost centers.”

As my colleague William Dudley noted in a speech last year, supervisory agencies simply cannot have enough “boots on the ground” to “ferret out all forms of bad behavior” or risks to the financial system.[2] It is incumbent on financial institutions to serve as their own first line of defense. A strong risk culture enables institutions to proactively identify and manage not only broad risks, but also risks that are specific to their business.

Capital Stress Testing

For the financial services industry, stress tests are an emerging way to make sure systemically important financial institutions are supporting the strength, stability and safety of the entire financial system.

The Comprehensive Capital Analysis and Review, or CCAR, is the centerpiece of these tests and implements the requirements outlined in the Dodd–Frank Act. Now entering its sixth year, the program applies to the largest U.S.-based financial institutions, as well as a number of foreign firms with significant operations in our markets.

The financial institutions that are subject to these requirements hold more than 80 percent of U.S. banking assets. Together, these firms provide a deep and rich view of the health and composition of our financial system. The broad goal of capital stress testing, of course, is to ensure the resiliency of the financial system, particularly in times of market turmoil and economic stress.

There are other industries in which risk culture and even supervised internal stress tests are staple ingredients of successful firms and business models. Automobile manufacturers routinely spend millions of dollars each year on crash tests of their products. Pharmaceutical companies are subject to many rounds of trials before new therapies are released to the public. Makers of home appliances — from toasters to electronics — must demonstrate their products have effective safety checks, even under very stressful and extraordinary conditions. It is likewise crucial that financial firms adopt and embrace similar processes — in service to their customers and themselves.

The CCAR enables supervisors to identify key emerging risks by comparing the largest, most complex banking organizations side by side, and as a whole, to identify key emerging risks. Subject matter experts from across the Federal Reserve System come together during CCAR to analyze each firm’s submission and evaluate its capital adequacy and planning process. At the same time, CCAR is a way for institutions to take stock of their own risks to capital positions and to make plans and adjustments accordingly.

The CCAR results are disclosed annually, providing transparency and confidence for banking customers, market counterparties and investors. Since the first form of a stress test in 2009,[3] common equity capital levels and ratios at the largest U.S. financial institutions have more than doubled in aggregate.[4]

The results of the most recent CCAR exercise were released in March.[5] They present a timely opportunity to talk about risk culture and the way financial institutions weave that culture into their business models and workplace environments. I understand from my supervisory staff that we continue to find a range of practices and approaches in how firms treat the stress testing and capital planning requirements. This is in some ways to be expected: Financial institutions are responding to challenging operating conditions here and abroad while having to meet stronger banking and consumer compliance requirements. Since the establishment of CCAR, firms have made sizable improvements in areas such as data collection, risk analytics and elements of corporate governance. Nonetheless, there is room for further improvement. Today I want to discuss some examples of how firms approach capital planning and stress tests.[6]

Observed Behavior

The capital plan rule specifies that participants in CCAR should project revenues, losses, reserves and pro forma capital levels over a planning horizon under different scenarios: baseline, adverse and severely adverse supervisory stress scenarios, as well as at least one stress scenario developed by the holding company.[7] This last scenario, sometimes referred to as a firm’s internal stress scenario, is expected to capture the firm-specific risks that may face a particular organization. We find some companies take a thoughtful approach to developing and designing their internal stress scenario. These companies try to capture the risks inherent to their specific business model. Additionally, these firms typically use validated models, involving rigorous development and testing of assumptions.

In contrast, there are still some firms that attempt to mirror the Federal Reserve System’s stress testing instead of developing models and internal stress scenarios that reflect their own inherent risks. In planning for our review, these firms often seem to want to know what’s on the test. While the Federal Reserve supervisory model aims to provide a meaningful stress scenario, it cannot identify and measure all possible bad banking outcomes. Institutions can potentially create blind spots to their true risks and capital needs by overly focusing on supervisory models for these scenarios. Firms should instead seek to build a capital planning and stress testing framework that thoughtfully identifies firm-specific risks and which ultimately informs the development of their own capital targets. Therefore, when it comes to developing internal stress scenarios, banks should not merely default to the Fed approaches, but instead flesh out the idiosyncratic risks of their own enterprises. A proactive, not a reactive, approach to stress testing would clearly increase the resiliency of the individual firms and overall financial system.

Strong internal controls and audit involvement are critically important as firms translate stress scenarios into pro forma financial results. At large, complex organizations this often involves multiple models and lines of business. Some firms have developed strong governance functions where all parties work in concert to implement the stress scenarios and to coordinate assumptions. Such practices ensure consistency of scenario conditions across the lines of business. At these firms, control points have been established to promote repeatable practices within the modeling framework and to verify data throughout the process. Key assumptions used to estimate losses, risk weighted assets, and revenues are clearly documented, and internal audit serves as an important third line of defense in identifying any weaknesses in the process.

However, some firms distribute the initial scenarios across business lines, but do not have sufficient controls or management engagement to ensure that everyone is on the same page during execution. Without proper guidance, each line of business can interpret the scenario in ways that are inconsistent or that run counter to the original intent. Results which are overly optimistic for a particular stress may go unchallenged because key assumptions are not well-supported or adequately socialized. Poor documentation practices in these situations make it difficult to identify these issues — and it limits the effectiveness of internal audit. Ultimately, such weaknesses can undermine the credibility of the stress test modeling framework and the pro forma financial results.

Financial industry participants and the media often focus on the quantitative CCAR results, but the qualitative elements of capital planning are also important. Even some of our largest firms still lack something as fundamental as a robust capital policy. Capital policies are intended to provide formal guidance about senior management’s expectations. We expect each of these firms to provide us with a written, stand-alone capital policy statement outlining the principles and guidelines for capital planning, issuance, usage and distributions. A capital policy also provides detailed descriptions of capital goals and targets.[8] In contrast, a limited capital policy that merely references regulatory minimums is not consistent with supervisory expectations. The lack of a robust policy creates challenges in determining whether or not staff decisions, including those for specific business lines, align with the risk appetite of the board.

To be clear, capital policies are not expected to be so prescriptive that they constrain an organization. It does stand to reason that management’s expectations strike the appropriate balance between choreographing a firm’s every move and allowing staff to exercise their judgment and discretion as the business environment or economy shifts. In fact, a number of firms integrate their capital planning/stress testing framework with their strategy, capital adequacy and budgeting processes. At firms with more robust frameworks, the capital policy is one key way to formally link all of these processes together. Firms that use such an approach to capital planning demonstrate that key decision-makers have a working understanding of the board’s risk appetite and direction.

Moral Hazard

The positive ways I’ve shared of how CCAR fits into a firm’s risk culture or risk infrastructure are not just “nice to have” features. Rather, they are important tools for combating the moral hazard that still exists in the financial system. Since the financial crisis, the notion that a company is too big to fail — whereby the government would come to the aid of a firm in financial distress — is something that policymakers have been working to address. Policymakers have enacted substantial regulatory reforms intended to strengthen financial stability and ensure that all firms bear the full consequences of their risk-taking. Living wills, CCAR and liquidity requirements all formally combat the potential moral hazard of our largest firms. Earlier this year Chair Yellen emphasized the importance that risk management and internal controls play in such regulatory requirements.[9] A proactive risk culture strengthens individual firms and also bolsters the resiliency of our financial system.

Other Risk Culture Concepts

I just spent considerable time discussing capital-related aspects of the stress tests. But the concept of risk culture encompasses more than just risk models, profit-and-loss projections and even capital. Many other elements, including the strength of board oversight and corporate governance, promotion and incentive compensation practices, affect how the firm’s employees approach their work and help to shape a firm’s overall risk culture. And while our largest firms have a responsibility to foster a proactive risk culture that is rooted in financial stability considerations, smaller firms would also do well to pay attention to the evolving conversation about risk culture. It’s worth noting the recent work of researchers from the St. Louis Fed,[10] who explored the distinguishing features among community banks that thrived during the most recent financial crisis. After looking at capital ratios, economic conditions and many other factors, they concluded the single distinguishing feature of thriving banks was an embrace of risk controls and operating standards regardless of economic or market conditions — in other words, a strong risk culture.

Firms of all sizes are well served when their board members can offer what is often called “credible challenge” — thoughtful, probing questions that serve as a second opinion and safety check. But for firms to receive such helpful feedback, their directors must have the skills and experience necessary to fully understand and review an institution’s underlying business models and strategies. Credible challenge also requires directors to receive and digest sufficiently granular updates in a timely fashion, pose questions to senior executives, request further rounds of review and offer contrarian opinions. When boards of directors are skilled, empowered and accountable, they are a driving force for the institution’s direction, health, and staying power. As I touched on before, setting the tone at the top for risk culture is paramount.

As an illustration, take the case of two financial institutions that identified commercial equipment leasing as a high-growth sector presenting profitable opportunities. In the first of these examples, the institution’s board of directors thoroughly vetted the business plan, including a separate review by the chief risk officer function. The firm also hired professionals with experience in equipment leasing, and the risk-management team identified a handful of “no go” business sectors, including segments of the energy and health care industries, for which the firm lacked expertise. Two years after implementation, the firm’s leasing business was performing according to plan, meeting risk measures and adding capital to the broader enterprise. In the other example, senior management green-lighted an existing business line’s proposal to underwrite equipment leases — a new product at the firm. To keep costs down, the team avoided hiring personnel with additional expertise. Also, a variety of specialty leasing sectors were fair game for lenders to target. Senior managers justified a limited review by the chief risk officer as well as the board because the new product was expected to account for no more than 2 percent of annual revenues. Several large leasing customers entered bankruptcy less than 24 months later, presenting the institution with rising losses and siphoning capital away from core business lines.

The value of a solid risk culture is unquestionable in this simple illustration — strong risk practices position the firm for success, while poor risk-management decisions clearly translate into losses and impact to the bottom line. The reality, though, is that the unintended consequences of a weak risk culture often aren’t immediately visible — let alone easily quantified — at any institution regardless of its size or complexity. Therein lies the challenge facing all of us who want to establish and promote a healthy risk culture at our firms.

Conclusion

To conclude, I think embracing a more proactive risk culture and embedding the spirit of supervisory expectations into business practices are particularly important at our largest firms. As regulatory agencies continue to reform rules and requirements in the wake of the crisis, risk management — including risk culture — is critical for increasing financial stability and eliminating the moral hazard that remains in place today. Regardless of the systemic footprint of your organization, I hope my remarks have helped convince you of the value of sound risk management — and, most importantly, the need for a proactive firm-wide risk culture. Such a risk culture makes good banking sense and serves as financial firms’ best form of defense — for themselves, their customers and the broader financial system.

Notes

References

Board of Governors of the Federal Reserve System, 2015, "Comprehensive Capital Analysis and Review 2015: Assessment framework and results," report, Washington, DC, March

Board of Governors of the Federal Reserve System, 2014, "Comprehensive Capital Analysis and Review 2015: Summary instructions and guidance," October, Appendix A: Common Themes from CCAR.

Board of Governors of the Federal Reserve System, 2013, "Capital Planning at Large Bank Holding Companies: Supervisory expectations and range of current practice," report, Washington, DC, August.

Board of Governors of the Federal Reserve System, 2009, “The Supervisory Capital Assessment Program: Overview of results,” report, Washington, DC, May 7.

Dudley, William C., 2014, “Enhancing financial stability by improving culture in the financial services industry,” speech, Workshop on Reforming Culture and Behavior in the Financial Services Industry, Federal Reserve Bank of New York, New York City, October 20.

Gilbert, R. Alton, Andrew P. Meyer and James W. Fuchs, 2013, “The future of community banks: Lessons from banks that thrived during the recent financial crisis,” Review, Federal Reserve Bank of St. Louis, Vol. 95, No. 2, March/April, pp. 115–143.

Yellen, Janet L., 2015, "Finance and society," speech, Finance and Society conference, sponsored by the Institute for New Economic Thinking, Washington, DC, May 6.