Remarks by John D. Hawke, Jr. Comptroller of the Currency Before the FFIEC Risk Management Planning Conference Washington, D.C. November 8, 1999 Three weeks ago, the OCC sponsored a conference on risk measurement here in Washington. We had a big turnout of financial professionals, including dozens of community bankers from cities and small towns across America. They heard from many of the world's leading academic and private sector authorities about developments in risk modeling and management. They learned about the state-of-the-art in analyzing and measuring various types of risk, the theoretical bases for these models, and where future research and development in this area is likely to lead us. It was a stimulating two days. But while the conference featured enough differential equations and standard deviations to gladden the heart of most mathematicians, there was a lot more to the conference than numbers. We made a point of including on the program a number of prominent end users -- bankers like you -- to talk about the practical value of the new technology in the larger context of risk management. These bankers displayed a more tempered enthusiasm for risk models. They agreed that models can be an important element in the overall risk management regimes of some -- but not necessarily all -- banks. They agreed on the need for potential users to look at the models critically and cautiously, to fully understand their strengths and limitations before adopting them. And, most of all, they agreed that even the best of these models should be seen as a component of -- rather than a substitute for -- a risk management program solidly grounded in sound judgment. One would most expect to find advanced risk measurement capabilities in the largest and most diverse financial institutions. Risk modeling is indispensable in helping to manage the risks inherent in their vast and varied portfolios. Indeed, we as supervisors would look askance at any institution that takes on such complex risk without having risk measurement systems of comparable power and sophistication. So it was instructive to hear the chairman and co-CEO of one of the nation's largest banks -- a bank that has been on the cutting edge of financial services for decades -- talk to the conference not about his own bank's advances in modeling and measuring risk but about the fundamental principles of risk management -- principles validated by this one bank's own recent experience, but equally applicable to banks of all shapes and sizes. He discussed such fundamental concepts as the importance of capital adequacy -- and defined adequacy in the most expansive terms. He warned a gainst losing sight of the macro factors -- political and social as well as economic -- that shape the risk environment. He emphasized the importance of independent internal risk assessments and the dangers of allowing these assessments to be performed by the operational unit responsible for the activity. And, most of all, he stressed the need for an overall risk management strategy -- a strategy based on a clear understanding of the institution's tolerance for risk -- and the will to see it through, even when that means foregoing short term profit. To some members of our audience, all this may have been seen as simply restating the obvious. But the importance of risk management solidly grounded in the fundamentals can never be exaggerated or taken for granted. Your bank is not Citibank. But the principles that John Reed articulated are as vital and relevant for community banks and for our high-tech times as they were in the days before anyone knew what a computer model was. You may not give a second thought to the political turmoil in Indonesia or other distant lands because you think you have no business exposure there. But, directly or indirectly, your customers might well be exposed -- and if they suffer losses as a result, you might well suffer them, too. You might consider your bank adequately capitalized because it meets or exceeds all statutory standards. But how long would that capital last in the event of a downturn in your local economy? As we know, minimum capital and adequate capital are hardly synonymous. You know your employees by name. You trust them implicitly. But it's still not prudent to rely on the credit officer who originated a loan for an valuation of how well the loan is performing or what the prospects are for repayment. An independent opinion from someone who does not have a reputational stake in the transaction is essential. For financial institutions of all types and sizes, checks and balances are essential. The point is that while community banks face risks that are different in degree from larger institutions, they are in many ways little different in kind. Even the difference in degree is not always what you'd expect. In some cases, the risks facing community banks can be compounded by the advantages of scale they lack. For example, it's relatively easy for a megabank to redeploy resources to augment the loan review function when management decides it's necessary. But where does the community banker obtain that independent second opinion when there's no second person with the necessary skills at hand to do the job? Similarly, it's relatively easy for an integrated megabank with an international presence to diversify its asset base when management decides that concentrations have reached the point of concern. But how do you as a community banker achieve diversification greater than that of the community you serve? For better or worse, its future and yours may be inextricably linked. I'm not suggesting that risk models and other advanced risk management tools have no place in the overall business strategy of community banks. In fact, just the opposite is true. Technology will help resolve s ome of the business dilemmas that I've just described. It can help compensate in some ways for the manpower limitations that are an inescapable fact of life for most community banks. Much of the software that is being developed today to help measure and manage risk is targeted at the small bank market, and the presence of so many community bankers at our conference shows that there's a keen interest in what these products have to offer. Community banks have long used gap models to help them measure asset-liability mismatches, and credit-scoring models have already proved their worth in the loan origination process in many small banks. The use of these and related applications should increase as they improve in reliability and user-friendliness. But while technology can be an invaluable adjunct in the management of risk, and will undoubtedly play an even bigger role in managing it in the future, it can never provide the whole answer, not for a hundred billion dollar bank and not for you. Community bankers seem to have fewer illusions on this score than some of their large bank counterparts. What we see -- encouragingly -- is that community bankers are working hard to manage risk by educating their customers in better ways to manage theirs. For example, some agricultural banks are working with borrowers to help them manage the risk associated with volatile commodity prices -- long the farmer's bane. By encouraging forward sale and marketing arrangements for their crops and livestock, armers can be assured of a more predictable income stream, in good times and bad. In many cases, this has made the difference between a farm loan in default and one that's current. Some big city bankers could learn something from some of their smaller counterparts' innovative approach to managing risk. We see community bankers taking advantage of Small Business Administration and other government guarantee programs to serve as a buffer against risk. Some small banks have even established relationships with banks in nearby communities to help mitigate the effect of concentrations. More and more are taking advantage of opportunities to securitize and sell parts of the loan portfolio to access new sources of liquidity and reduce credit risk. Such instances exemplify risk management at its best. A bank's approach to risk must be as creative -- and as soundly grounded in the fundamentals -- as its approach to any other aspect of its business. In other words, risk management cannot be reduced to a tool or technique or even a model; it's a philosophy -- a consciousness -- that must permeate every aspect of a bank's operations. It starts with an awareness of the forms that risk takes. You can't manage what you don't recognize or understand, and it's the banker's job to inculcate that awareness in the bank's decision makers and its board. It sounds simple, but it's fundamental to effective risk management. The fact is that a bank can have all the right mechanisms and procedures in place and still not have an effective risk management regime if management's heart is not truly in it. For example, a bank's audit department can be well staffed and trained, and be dogged in pursuit of irregularities. But if the bank's culture encourages these problems to be resolved without addressing them at their source, it invites a recurrence. That's not effective risk management. If a bank's compensation plan rewards loan production and loan growth and does not hold its people accountable for the quality and performance of those loans, that too is not effective risk management. Again, lip service to the principles of risk management -- even when accompanied by an infusion of resources -- is not enough. Good risk managers are true believers. For most community banks, the loan portfolio is the largest asset and the primary source of revenues. It's also one of the greatest sources of risk to the bank's safety and soundness -- and the toughest test of a bank's risk management capabilities. When OCC examiners find that banks have effective credit risk procedures in place, it tells them a great deal about a bank's overall attitude toward risk. There was a time when it was sufficient -- from the examiner's standpoint -- that individual loans be properly underwritten and administered. While we strongly believe in the fundamentals of controlling risk at the transactional level, we also take a more comprehensive view of the loan portfolio than ever before, recognizing that the interrelationships among portfolio segments can be as important in determining a bank's credit risk profile. So we look for those things that define a sound risk management culture: clear objectives and risk tolerance limits, management information systems capable of monitoring loan performance, diversification policies, policies on exceptions, stress testing procedures, and independent audit, loan review, and control functions, supplemented by the appropriate risk measurement tools. And we look to ensure that these and other risk management functions work in harmony with one another. The failure of any one can render the others ineffective. All banks need to have fundamental risk management principles in place in some form. But the extent to which they must be formalized into written policies depends on the size of the bank, and the complexity and character of the risk it has assumed. In the largest and most sophisticated banks, policies need to be formal and prescriptive. Community banks, on the other hand, may be able to implement these principles in a less formal, less structured manner than larger banks. The way banks manage credit risk is a good barometer of its approach to risk management across its business. I know of few institutions where careful attention to the fundamentals of controlling credit risk is not reflected in the institution's approach to controlling the other forms of risk that banks assume. Much has been said in recent years about change in the banking system. Given the legislative events of recent weeks, the changes that have occurred already will almost certainly be overshadowed by the changes soon to come. It now seems certain that the arrival of the new millennium will coincide with the start of an important new chapter in the life of this industry. We don't know what the banking business will look like ten years from now except that it will look significantly different than it looks today. But I know of at least one thing that won't change. The fundamentals of risk management are timeless. Bankers who conscientiously and effectively manage risk will be successful. Those who don't manage risk well will eventually be overwhelmed by it. Whatever else happens in the coming years, that much we can count on.