What Is Enterprise Risk Management in Banking?

Enterprise risk management (ERM) looks at all of an institution's risks together. Ordinary risk management measures one exposure at a time. A list of risks is only the raw material. ERM adds the ability to rank those risks, size them against what the institution can afford to carry, and see when two of them share a common cause. In a bank or credit union the difference is clearest when one event, such as a rise in interest rates, hits several desks at once.

A list of risks is not risk management

Take two fictional institutions, Acme Bank and Acme Credit Union. Each has $100 billion in assets. One is a national bank and the other is a federally chartered credit union. Ask what risks they carry and most people produce a list like this:

• Borrowers who do not repay. At Acme Bank this is not a generic worry, because its book is concentrated in commercial property, and commercial loans tend to be very large compared with consumer loans.
• Rates that move against an institution that is funded short and lends long. This is the lending business itself, not a flaw in it.
• Depositors and members who can withdraw far faster than a 30-year mortgage matures.
• Systems that fail, people who make mistakes, and vendors who stop answering the phone.
• Rules that are broken and rules that change, which are two different problems.

The list is good. Every line is a real risk, and every line applies to both institutions. Still, three things are missing, and they are the three that turn a list into a discipline:

1. Nothing on it says which risk matters most.
2. Nothing says how much of each risk the institution can afford to carry.
3. Nothing says what happens when two of them show up in the same week.

Siloed versus enterprise-wide risk management

An institution can organize risk in two broad ways.

In the siloed model, each desk owns its own risk. The credit function watches credit. Treasury watches rates and liquidity. Operations watches process failures, and compliance watches the rule book. Each one measures risk in its own natural units. Credit thinks in expected loss, the average amount it expects to lose across a book of loans. Treasury thinks in basis points (hundredths of a percentage point) and in duration, which measures how far a bond's value moves when rates move. Operations counts incidents. Each desk reports upward on its own schedule.

The siloed model is not stupid. The expertise is deep and sits right next to the business it covers, and for a long time this was simply how institutions were run.

In the enterprise-wide model, risk is still owned locally. That does not change, and any model that takes ownership away from the business will make things worse, not better. The change is that everything aggregates:

• One taxonomy, so the parts can actually be added together.
• A common way of describing severity, so a credit risk and an operational risk can be compared at all.
• A single view of the whole portfolio.
• Someone whose explicit job is the interactions between the boxes.

The difference is not effort. A siloed institution can have a superb credit team, a superb treasury, and a superb audit function all at once. Siloed failure is not incompetence in the parts. It is the absence of any place where the parts get put together, which is why it is so hard to see from inside any one of them.

One rate shock, three "manageable" reports

Now make it concrete. Suppose rates rise sharply. This is not a crisis, just a rate cycle, the kind that has happened repeatedly and will happen again. Here is what it does to Acme Bank.

• Treasury looks at the $22 billion securities book. When rates rise, the market value of those investments falls. Treasury reports the mark to market and calls it manageable.
• Deposit pricing looks at $80 billion of deposits, about 80 percent of the balance sheet. Only 23 percent of that is noninterest-bearing, so most of the funding reprices upward, and the cheapest slice is the one under the most competitive pressure to leave. The deposit desk reports a margin squeeze and calls it manageable.
• Credit looks at the commercial book. Commercial real estate and construction together stand at 186 percent of total capital, and those borrowers are refinancing into higher rates against properties valued at higher capitalization rates. Credit reports rising stress and calls it manageable.

Three desks wrote three reports, and all three used the word manageable. Each report is honest and correct within its own boundary. But one rate move is driving all three. They are not three independent problems that happen to occur together. They are one problem wearing three different costumes. They will get worse together and at the same time, and the same capital has to absorb them.

No desk in that structure is in a position to say so, not because anybody failed, but because saying it requires standing somewhere none of them stands. That place is what enterprise risk management is.

What the enterprise view adds

The enterprise view adds five things, listed here from least to most difficult:

1. Aggregation. Express the pieces in a form where adding them up produces a number that means something. It sounds like bookkeeping, but it is the hardest thing in the discipline.
2. Correlation. Which risks move together, and why. The rate shock is a correlation story. Treating those three exposures as independent would badly understate the total.
3. A portfolio view. One total, not a stack of separate totals. Those are different numbers, and the gap is not small.
4. Comparability. A common language for how bad something is, so that a credit exposure and a cyber exposure can be discussed in the same meeting without the conversation collapsing.
5. Capacity. How much the institution can actually afford to carry, given its capital, earnings, and funding. Everything else serves this question, and it is the one that becomes risk appetite.

The COSO definition of enterprise risk management

COSO defines it this way: "Enterprise risk management is not a function or department. It is the culture, capabilities, and practices that organizations integrate with strategy-setting and apply when they carry out that strategy, with a purpose of managing risk in creating, preserving, and realizing value."

Three parts of that sentence are deliberate and often missed.

• It opens with what ERM is not. You cannot buy ERM by hiring a team and giving it that name. Institutions have tried, and the result is a department that writes reports nobody acts on.
• It is tied to strategy setting. ERM is not bolted on afterwards. The risk question belongs in the room where the plan is made, not in a review of the plan six months later.
• Its purpose is value, not just avoiding loss. Preserving value is part of it, but so are creating and realizing value. A risk function that only ever says no is failing at two-thirds of its job. An institution that takes no credit risk earns nothing and dies from that.

Why supervisors care about enterprise risk management

Supervisors care because a supervisor does not supervise the credit department. It supervises the entire institution, and the things that make institutions fail are enterprise-level. Capital is held against everything at once. Liquidity is available to the whole balance sheet, not allocated desk by desk. The board is accountable for the whole of it and cannot delegate that responsibility away. And failures rarely arrive politely, one at a time in their own categories. More often they arrive correlated, because they share a common cause.

Several things follow from that:

• Aggregate exposure has to be knowable, or capital adequacy is a guess.
• Someone has to own the total, or the total is nobody's job.
• The board has to receive one coherent story. A board given six separate reassurances cannot tell that they are about the same thing.
• Management has to be able to show that it saw the problem coming, which is a question about process rather than outcome.

This leads to a point that surprises people. The framework itself becomes examinable. Supervisors look at more than loans and controls. Whether you have a coherent way of knowing your own position is something the supervisor forms a view about, measures you on, and writes down.

What enterprise risk management is not

Institutions really have built each of these things and called it ERM.

• Not eliminating risk. An institution that eliminates credit risk has stopped lending and has no business left. The goal is risk that is chosen on purpose, sized against capacity, and properly priced.
• Not a department that owns risk for everyone. When the business believes risk belongs to the risk team, the business stops managing it. Ownership stays with the people taking the risk, typically the first-line business units.
• Not a report. A beautifully produced monthly pack that changes no decision is a cost with no benefit. The test of a risk report is whether anything is ever different because of it.
• Not compliance. The two overlap and need each other, but they are different jobs. Compliance asks whether you are within the rules. ERM asks whether you can survive what you are doing. You can be fully compliant and dangerously exposed.
• Not prediction. The discipline is preparation: knowing what you are exposed to, how much you could lose, and what you would do about it. Those questions can be answered. Predicting the future cannot.

Key takeaways

• A list of risks is the raw material for risk management, not risk management itself.
• ERM adds the ability to rank risks, size them against what the institution can afford, and see when they share a common cause.
• Siloed risk management fails because nobody puts the parts together, not because the parts are incompetent.
• One rate rise can produce three honest "manageable" reports that are really one problem hitting the same capital.
• The enterprise view adds aggregation, correlation, a portfolio view, comparability, and capacity.
• Under the COSO definition, ERM is not a function or department, is integrated with strategy, and exists to create, preserve, and realize value.
• Supervisors examine the whole institution, so the ERM framework itself becomes something they examine.