As banks and regulators scurry to respond to the most perilous industry conditions since the 2007-08 financial crisis, experts say one persistent issue needs attention: risk oversight that’s not always up to the job.
Board-level risk committees at many banks have neither the clout nor the expertise to push back against corporate leadership, risk professionals say, a weakness that should be addressed in the wake of the recent bank collapses.
The largest banks, those with $50 billion or more in consolidated assets, are required by law to maintain a risk committee that reports directly to the bank holding company’s board. Those committees must include at least one member with experience in “identifying, assessing, and managing” risk exposures of large financial firms, according to an amended version of the Dodd-Frank Act, which was passed after the financial crisis.
But the board-level risk committees often don’t go beyond that single qualified member and can sometimes lack the expertise to stand up to senior management, said Clifford Rossi, a former chief risk officer for Citigroup Inc.’s consumer lending group and now a professor at the University of Maryland’s Robert H. Smith School of Business.
The problems can be serious, Dr. Rossi says. His research found most of the failures of the previous financial crisis could be traced to deficiencies in risk governance. His paper proposed some policy solutions, including more scrutiny of risk management from regulators and insurers.
Good risk management can protect a bank—even save it—in times of extreme stress. But the work is laborious, technical and involves poking at business plans to look for potential trouble spots. Although the causes of the recent bank meltdowns aren’t yet fully known, some industry observers have pointed to slack risk management.
The Bank Policy Institute, a trade group that counted SVB as a member, said the failures of SVB and Signature Bank “appear to reflect primarily a failure of management and supervision.” BPI noted, however, that its analysis was based on “initial and partial thoughts.”
Risk professionals say the moment should serve as a wake-up for banks to beef up oversight.
Many global institutions, and even U.S. regional banks, have made great strides in improving risk oversight since the financial crisis, said Robert M. Iommazzo, a managing director at talent advisory firm ZRG Partners who works as a recruiter of risk and compliance talent for financial institutions and other businesses. The effectiveness of bank boards’ risk oversight, however, falls on a “continuum,” he said.
Some newer banks that primarily serve the tech sector have been less focused on risk and more on marketing and revenue, Mr. Iommazzo said. He recently declined work from a bank client who wanted to fill a risk position, but seemed more focused on the optics of the candidates than their expertise.
At Silicon Valley Bank, some of the board risk-committee members had résumés far removed from conventional risk management. One was a Napa Valley vineyard owner whose appointment was written up in Wine Business, a trade publication. SVB listed “premium wines” as one of its core focus areas in a securities filing. Another board member spent a career at a consulting firm. SVB’s risk committee chair was a venture investor.
SVB’s risk committee did have at least one member with a risk background: Mary Miller, a former U.S. Treasury Department undersecretary with decades of experience at an investment firm. However, the post of chief risk officer at SVB had been vacant for about eight months after the previous occupant stopped serving in that function in April of last year.
Some surveys show bank leaders have been moving toward a greater emphasis on risk management. A November survey of chief financial officers conducted by U.S. Bank showed that 30% ranked improving risk identification and mitigation as a top priority, up from 18% the previous year.
Mr. Iommazzo said he believes many banks are getting qualified board members. But even a risk committee packed with experts can face headwinds if expectations aren’t clearly defined.
“Just what is expected of the board risk committee, that is still very nascent, quite frankly,” he said. These bank failures cast “a spotlight on board governance in general, and the need for more training and understanding of what is expected of the board.”
Kristen Jaconi, a former U.S. Treasury official who now heads the risk management education program at the University of Southern California’s Marshall School of Business, said she is reluctant to make a quick assessment on the root causes of the two banks’ failures. Many banks have taken at least some steps to empower risk management, but culture determines whether those steps will succeed.
“You or I can go into any of these banks today, whether recently collapsed or thriving, and you can probably see a well-crafted set of risk management policies and procedures,” she said. “But in the end, it all comes down to culture.”
