Reconsidering Risk Management, Governance, and Stress Testing

Because of the large role the financial sector played in the Great Recession, governing bodies have passed a wave of new regulations. The Dodd-Frank Act, signed into law in 2010, was the most significant of the reforms and introduced stress tests into banks’ annual calendars. The banking industry has heavily criticized most of these new regulations, particularly Dodd-Frank, for being too costly, and economists and analysts have spoken against them for impeding growth in the supply of credit.¹ By contrast, supporters of Dodd-Frank claim that these regulations have made the financial system more stable and resilient. We believe that both positions have some merit. Some of the regulations in place today have improved practices in the financial system, while other regulations could benefit from simplification. In this article, we discuss areas such as capital stress testing where simplification of regulations and their execution could improve the flow of credit while protecting the financial system. Based on our experience with several client engagements, we recommend simplifying the capital stress testing process through improved governance, cost-benefit analysis, more realistic timelines, greater coordination between regulatory agencies, and increased regulator transparency.

The Great Recession was a wake-up call for banks and all other lenders to review their risk management practices and governance. Because of their size and impact on the economy, banks have gone through a major overhaul of processes and loss forecasting models that feed into capital formation decisions and have started depending more on specialization, expertise, and unbiased views.

In the wake of the recession and under-supervision by regulators, banks have adopted several best practices. For instance, they now consider the role of the macroeconomy more formally in their revenue and loss models and subsequently analyze the impact of the economy on their forecasts. A natural extension of this was to integrate stress scenarios into forecasts as part of the Comprehensive Capital Analysis and Review (CCAR) stress testing process. This practice allowed banks to prepare for downside risks and adjust their capital plans based on future stress scenarios. Another welcome change was that banks began to prepare custom scenarios and include them in decision-making processes. These custom scenarios are intended to capture banks’ own idiosyncratic risks, giving management quantitative insight into their key vulnerabilities.

Although there were long-awaited improvements in banks’ risk management practices, new regulations have also brought difficulties. To begin with, finalizing Dodd-Frank took much longer than planned. Delays – as well as uncertainty about the Federal Reserve’s internal models and scenarios, interpretation of their feedback, and practical implementation issues – have affected the functionality and outlook of the financial sector. Dodd-Frank Act Stress Tests (DFAST) and CCAR examinations have taken on a life of their own and become a multi-billion-dollar industry. They are consuming resources, such as human capital and IT, which could otherwise be put toward improving banks’ bottom line or investing in innovation. On the regulators’ side, lack of transparency and insight into the Fed’s internal models, as well as confusion about the rules, have hurt the credibility of the regulations.

A new administration in the White House could provide opportunities for positive changes to regulation to encourage economic growth and discourage inefficient practices. In the rest of this article, we present our vision for improving the current stress testing framework and practices.

In terms of the future of Dodd-Frank, we can generalize proposals into four camps with varying degrees of potential economic impact:

1. Repeal Dodd-Frank in its entirety; allow banks to self-govern.
2. Repeal parts of Dodd-Frank.
3. Clarify and simplify the execution of Dodd-Frank.
4. Both 2 and 3.

Let’s start with the first proposal. In our opinion, completely repealing Dodd-Frank, as proposed by many Republicans and the White House, would be the least viable option. Supporters of the repeal cite credit tightening as the main reason for the need for repeal; but a repeal could cause more harm than good, especially as many banks have already invested heavily in creating the framework to abide by the regulations. For example, the Financial CHOICE Act (Creating Hope and Opportunity for Investors, Consumers and Entrepreneurs), first proposed by the House Financial Services Committee, would effectively eliminate the Dodd-Frank burden on banks if they met a 10% leverage ratio.² This could encourage a risk management culture that is weak and vulnerable to revenue growth targets. Dodd-Frank allows the Fed to have a say on dividends and share buybacks based on the capital plans it receives from banks, giving the central bank leverage. Without this leverage, the responsibility of corrective action would be largely delegated to the banks which, as we have seen in the past, can ignore sound practices for the sake of short-term profits.

The second proposal, involving the repeal of some parts of Dodd-Frank, is a more viable option. Many in the industry would welcome a repeal of the Volcker Rule, which prohibits banks from conducting certain investment activities with their own accounts. On the other hand, keeping capital and liquidity requirements would balance against potential risk-taking if the Volcker rule is repealed, since capital and liquidity shortages were the main reasons for bank failures during the Great Recession.

The third proposal would ease the enforcement of regulations, which makes the fourth proposal the best course of action in our opinion. This proposal responds to a question that has been long asked: What is the real problem, the regulations or their implementation? Our experience in working with several CCAR and DFAST banks leads us to conclude that it is the manner of implementing Dodd-Frank rules that has bred uncertainty and confusion. For instance, after submission, banks receive lists of matters requiring attention (MRA) and matters requiring immediate attention (MRIA) that provide only vague guidance. These recommendations put banks on the defensive, eating up significant amounts of resources that banks could more efficiently use elsewhere.

Working toward the aims of Dodd-Frank – making the US financial system safer – is key to making regulations work for the economy. Following a process for the sake of having a process will not help avoid another Great Recession.

As part of CCAR and DFAST, which is a complementary exercise to CCAR, the Federal Reserve assesses whether banks with assets of $10 billion or more have adequate capital to continue operations during adverse economic conditions. As part of this review, the Fed also assesses whether banks have robust, forward-looking, scenario-conditioned forecasts and whether underlying models account for unique risks of institutions. Forecasts from loss forecasting models ultimately decide whether institutions have sufficient capital to absorb losses.

The following sections give suggestions on how to fix the capital stress testing process.

A thorough cost and benefit analysis should be conducted at institutions that are subject to regulations. This analysis should differentiate between the sizes of institutions and portfolios.

In a world where regulatory compliance is less stringent, one set of regulations would be sufficient for institutions of all sizes to simplify and avoid confusion, enable knowledge transfer, and deal with turnover more easily. However, given that compliance costs are non-trivial and risks to the economy in the event of failure vary by bank, requirements should be less stringent for small and midsized banks with assets of $50 billion or less.³ Likewise, large banks should be subject to stricter requirements given the greater risks they pose. Easing the regulatory burden on small banks would encourage more banks to open and increase competition, particularly important in the current environment of increasing interest rates. An increased number of small and midsized banks would also benefit small businesses, especially those that are finding it difficult to obtain loans through larger banks. Similarly, cost savings could be achieved by subjecting small portfolios to less scrutiny.

The Fed should be subject to the same transparency standards that the banks have to follow. Markets would also benefit from more flexible regulatory timelines.

Lack of Fed transparency regarding its models and regulatory scenarios has been a subject of criticism since DFAST began. Banks have requested more details on the assumptions behind the Fed’s scenarios and methodologies for projecting revenue, losses, and regulatory capital ratios. Releasing details of the model methodology can level the playing field, prevent wasted resources on guesswork, and help banks understand the standards that they are judged against. The Fed fears that if these details are released, banks may try to game the system – that is, they might use the blind spots of the Fed’s model to adjust portfolio characteristics and take risks in areas not well-captured by the model – but this concern could be handled by giving notice to an institution if such gaming is discovered. Alternatively, the Fed could continue to change its model from year to year to make it more difficult to game the system. Releasing the details of stress test scenarios could be beneficial, especially during times of uncertainty about the future and when the outlook is positive.⁴

More transparency could also help in the feedback the Fed gives to banks. For example, a common misunderstanding is that the Fed demands that banks develop their own internal models. However, regulators emphasize that banks may use external models as long as they thoroughly understand the models and take ownership of them. Leveraging third-party models may also help reduce costs, reduce turnaround time, offer more in-depth documentation, and, hence, increase transparency into data cleaning and model methodology. Some of these models can also be used for multiple purposes, which is increasingly a goal for banks these days.

Banks should comply with a simple set of rules and regulations rather than addressing conflicting guidance from different agencies.

This is of particular concern for midsized banks, as there is much confusion about how much scrutiny they will be subject to from different regulatory agencies when it comes to data and model methodology. Midsized banks face challenges in regard to data, timelines, and human resources which make it hard and costly for them to deal with increased scrutiny and inconsistent guidance. All banks, and especially midsized ones, would benefit if rules and implementation guidance were consistent across regulatory agencies such as the Fed, the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC). These inconsistencies in guidance may affect modeling methodologies or data treatments as well as scenarios.

Banks should regard risk management and stress testing models as part of day-to-day business and integrate them into existing processes. Regulators should encourage this.

With no incentives to look beyond the letter of the regulation, banks can engage in “checking the box” behavior, simply reacting to feedback and following regulations blindly. Instead, institutions should be incentivized to focus on proactive risk management by consciously thinking about the purpose of models, outcomes, and uses. Forecast accuracy, which would lead to enhanced credit formation, should be preferred to the conservative approach of overestimating losses.

Another best practice involves improved collaboration within a bank, which can reduce costs by allowing for the development and use of a single set of models for many purposes. In banks where the channels of communication are open for modelers and line-of-business teams, processes are more efficient and knowledge transfer happens easily. This should be the ideal for risk modelers as they aim to produce meaningful models that can be used by many departments of the bank, including line-of-business teams. To this end, all parties involved should also understand the purpose of the models, as well as the constraints in model development which can stem from concerns about data, economic factors, econometrics, and time and resource limitations.

Finally, building too many models is not only costly but also difficult to manage effectively. A proliferation of models may provide a variety of results, which can cause lines of business to be wary of contradictory model outputs. Thus, banks need a clearly articulated process for dealing with mixed signals. Ideally, the same set of models should be used for stress testing, portfolio management, strategic planning and forecasting, and setting risk appetites. Risk models should be fully integrated across all business lines and should be actively used in decision-making instead of simply checking the box for regulators.⁵

Dodd-Frank has moved risk management from an afterthought to a main consideration in banks, a change in mindset that helps keep the financial system sound. However, complexity and lack of clarity in the regulations have created inefficiencies. Simplification of regulations should unleash economic growth, reduce costs, minimize uncertainty, and help banks prioritize and focus resources to more beneficial endeavors such as business growth. Simplification would also encourage growth in the number of banks. Finally, some deregulation is warranted, but it is important not to go too far. Reducing regulations too much could lead to a return to old methods in which risk management was merely an afterthought.