Risk-Management Lessons from Recent Financial Turmoil 
Conference on New Challenges for Operational Risk Measurement and Management Boston, Massachusetts
It is a pleasure to welcome you to this conference on operational risk, and to offer my thoughts on the lessons for risk management that we can glean from recent financial turmoil.1 I would like to thank all of you for attending, and the speakers and organizers for their efforts. Like all of you, I am looking forward to the conference and the opportunity for us, together, to take a fresh look at risk management and risk modeling in light of recent events.
The practices of risk management in general, and operational risk management in particular, have made great strides in the past several years - progress that has been stimulated, in part, by the Basel II process. In the past several years risk management information systems have improved significantly, the collection of data related to risk has become more comprehensive, and the analysis of risk and the determination of appropriate capital has become more sophisticated. In addition, within institutions senior management and boards of directors have become more attuned to their responsibilities in understanding the risks facing their organizations and ensuring they have appropriate capital.
Despite these significant and important gains, there are clearly lessons to learn from the performance of contemporary risk management practices during the period of financial turmoil that began in late July.
As illustrated in Figure 1- which shows the spread between the London Interbank Offered Rate (LIBOR) and the Overnight Index Swap (OIS) rate - the reluctance of banks to lend to each other has been quite elevated since July 2007. A combination of balance sheet constraints2, poor transparency regarding potential losses3, and heightened counterparty-risk concerns has contributed to less liquid financial markets and highlighted the fact that, in retrospect, even improved scenario analysis and stress tests did not fully capture the potential for events like those that have occurred over the past nine months.
As the chart showing the LIBOR/OIS spread indicates, there have been ebbs and flows in the recent turmoil. I would suggest that the path of the chart's line reflects the three phases of recent turmoil - beginning with a focus on liquidity risk, moving to increased concern over credit risk, and now seemingly evolving into concern over economic risks.
Indeed, initially the widening spread seemed to indicate serious liquidity problems. Problems in the subprime4 mortgage market and with securitization and structured products came to light in the summer of 2007. These problems resulted in illiquidity for a variety of financial instruments that market participants had assumed had relatively low risk and were highly liquid.
As the financial turmoil continued, the primary concern moved from illiquid financial instruments to concerns about credit risk and likely asset write-downs. Starting at the end of 2007 and continuing through the first quarter of 2008, a variety of financial institutions announced very significant write-downs, and many also announced that they needed to raise additional capital.
As we move to a third phase, the focus has shifted to concerns about the economic risks - the risks generated by an economy that has slowed noticeably. While much of the turmoil in financial markets occurred during relatively benign macroeconomic conditions, the economic situation has changed. We have seen job losses, persistent increases in food and energy prices, and falling asset prices - all increasing the risk that less benign economic circumstances will add to the already intense challenges faced by financial institutions this year.
With that context, it is useful and important to consider the lessons we can learn regarding risk management and risk modeling in light of recent events. Today I am going to discuss three areas that are important for risk management generally, but also have clear applications to operational risk.
I will cover each of these areas in a bit more detail in a moment. First, however, I want to note that despite a number of lessons from the recent financial turmoil, we should not despair, nor should we see investments in risk management as wasted. Indeed, had the discipline not advanced as far as it has, I believe the recent financial turmoil would be much more damaging.
And as a result of our models and improved risk management, with some nudges from bank supervisors, the capital position of banks in the aggregate remain quite healthy (See Figure 2). The willingness and ability of many financial firms to raise additional capital, despite the financial turmoil, highlights the fact that outside investors have confidence in the long-run strength of these financial institutions and their ability to appropriately manage risk going forward. Already I am hearing about improvements in risk management stemming from the current problems, and by building on these lessons we can be better prepared for future challenges.
I. The Role of Liquidity
Underlying many risk models was the assumption of highly liquid markets. In a variety of markets, assets that were viewed as relatively safe and liquid in July 2007 are now thinly traded - and, when they do trade, do so at surprisingly deep discounts. In particular, there have been very steep discounts for triple-A tranches of asset-backed securities. Not only have prices dropped as investors have become less certain of the likely default experience of these highly rated securities, but prices also include a significant liquidity premium as investors are avoiding assets they now view as difficult to value. These discounts seem particularly large given the plausible estimates of potential losses for these assets - in particular if the economy improves in the second half of this year, as many private forecasters anticipate.6
Recent experience highlights the fact that effective credit risk management requires a robust evaluation of exposure to possible liquidity strains during times of stress. Experience also highlights the issues that come with being overly reliant on credit ratings as a surrogate for rigorous credit evaluation. Firms that have significant investments in structured securities may need to consider whether their so-called "Pillar II" capital7 allocation is adequate to capture some of the liquidity and model risk that has recently shown its importance.
However, traditional credit evaluation is not the only place where liquidity assumptions were imbedded, and somewhat problematic. Many firms held funds that they needed for short-term liquidity in auction-rate securities8 and in structured-product investments. As these complex instruments have become less liquid, many firms have been caught in a cash squeeze. (See Figure 3) Even some sophisticated hedge-fund investors were often too comfortable keeping short-term, liquid funds in complex instruments that encountered difficulties once the financial market turmoil emerged, leading to strains on liquidity. Many of these investors have re-evaluated their holdings, preferring to reduce risk (and return) in funds held for short-term liquidity purposes, and to focus their risk-taking within longer-term portfolios.
Liquidity can also be an issue in operational risk management - the severity of operational losses can be impacted by liquidity assumptions. Backroom problems can occur during periods of stress. Particularly as firms have become more dependent on using credit-default swaps and tailored derivatives to hedge risk, imperfectly placed hedges (for example a hedge that was faulty due to model error) and processing problems that can occur during stressful times can generate outsized risks.
The most recent example of liquidity impacting the severity of operational losses is the illiquidity created by the need to quickly unwind positions generated by rogue traders. Having large unwanted positions that have declined in value can create significant problems for the institution. Such a firm has few appealing options, in that widespread knowledge of the loss can make it quite costly to unwind the position - but at the same time, failure to quickly reveal the loss can create legal entanglements as interested parties seek legal remedies for the concealment of material information. Many of the large rogue-trading losses occurred during periods when trading positions have declined, and where illiquidity made the unwinding of positions potentially costly.
II. Estimating Risk Models with Limited Data
Evaluating the risk of new products, or products undergoing significant change, is a particular challenge for risk managers. The subprime mortgage market is a good case in point, as subprime mortgages have undergone significant changes over the past five years. Traditionally, mortgage loans to "less-than-prime" borrowers were made through government programs such as FHA, or in an environment where prime loans were experiencing difficulties. But over the past five years there was a significant change. The advent of securitization and the ability to originate to distribute had a dramatic impact on this market. (See Figure 4)
The growth in this market benefited from the history of low default rates on home mortgages in general. It was often noted that home prices had not fallen nationally since the 1930s, that real estate cycles had not been correlated in different regions of the country, and that homeowners would go to great lengths to avoid foreclosure on the "roof over their heads."
However, the originate-to-distribute model for subprime lending changed many aspects of these underlying assumptions. The ability of borrowers to purchase homes with little or no capital greatly expanded the pool of potential borrowers - which, coupled with rising prices, resulted in positive homeownership experiences for so-called "subprime borrowers" in the first half of this decade.
As regional real estate markets have become more integrated and their prices more correlated, home price declines have been national, not just regional. While there are certainly some important regional differences, all ten of the metropolitan areas tracked in the Case-Shiller index have seen a fall in home prices (See Figure 5).
The generally accepted approaches to modeling subprime mortgage default probabilities frequently did not capture how the economics of subprime lending had changed. For example, models estimated only on the experience of the first half of this decade - the period for which data on securitized, originate-to-distribute, subprime loans were available - did not include significant downturns, did not have falling home prices, and did not have the increased correlation of regional home prices. The result is that both the ratings and the capital needed to hold mortgage securities underestimated the risk.
Of course, the challenges of new products and short historical time series are quite familiar to operational risk practitioners.9 Product innovation can make historical data less useful for understanding future risks. Operational risk modeling has been plagued by the short period of time that most institutions have collected comprehensive internal data. However, even in this short period of data collection, it is striking how many billion- dollar operational loss experiences have occurred.
The bulk of these billion-dollar losses reflect rogue trading and large legal settlements. Many institutions have viewed losses of this magnitude as "once in a thousand years" events, or not applicable to their own modeling - for example, because of their institution's small size relative to the institutions experiencing those magnitude events (a logic that causes some risk managers at smaller institutions to truncate the potential for losses, perhaps incorrectly). As we get more data, however, it is becoming clear that such losses at financial institutions are more common than was initially thought. Clearly, discounting or artificially constraining such losses can risk leaving institutions with inadequate capital relative to their risks.
The example of subprime mortgages has relevance for operational risk as well as credit risk. The originate-to-distribute model resulted in the loan originator frequently having little interest in sufficiently screening borrowers. In fact, the desire to maintain volumes appears to have caused some originators to engage in fraudulent actions to qualify borrowers. In addition, lawsuits related to subprime loans have emerged, with concerns raised on fraudulent transactions, inadequate disclosure of emerging problems to investors, and selling inappropriate products to borrowers. While the likelihood of success for these lawsuits is uncertain, the relevant lesson for risk management involves fully considering all the potential operational risks with new products, or with new delivery mechanisms for existing products.
Of note are the decisions that some financial institutions made in regard to subprime mortgages. Many large institutions chose not to participate in the subprime market. Conversations with some of these institutions about such decisions indicate that concerns regarding reputational risk and potential lawsuits - rather than credit concerns - seem to have played an important role. Other institutions chose to participate, but limited the products they offered, limited the originators with whom they would do business, or implemented other risk controls to limit exposure to inappropriately underwritten loans. In many respects, these decisions reflect a heightened awareness by senior management and boards of directors regarding operational risks.
It is noteworthy that some of the most poorly underwritten loans that resulted in early payment defaults were made by the sorts of independent, non-depository lenders that operated largely outside of formal regulatory oversight. For those institutions whose risk management approach did not sufficiently consider the operational risks related to these products, the lessons have already been costly, and potentially large legal risks remain from those decisions.
This difference in bank behavior towards subprime mortgages is noteworthy. While it is difficult to prove, firms that were better versed in operational risk may have been more careful in considering all the risks inherent in entering this market. Because subprime loans grew rapidly and were quite profitable for a number of years, it took significant discipline to decide to forego some aspects of the business.
III. The Role of Scenarios and Stress Tests in Evaluating Risk
Particularly given the limited data, many banks have significantly increased their use of scenarios analysis and stress tests. While this is a very important and promising development, we must recognize that we are at the early stages of using these tools. Many institutions did conduct stress tests of what would happen if housing prices fell. Most of these stress tests noted the institution's limited amount of direct exposure to residential mortgages and construction loans. Others noted that while they held mortgage-backed securities, they held only the triple-A tranches of these securitizations.
Much of the modeling was a somewhat more sophisticated migration analysis of direct exposures. However, none of the major stress tests that I am aware of - done by a variety of financial institutions - came close to capturing the depth of the problems that we are experiencing today.
What was missing was economic and financial analysis that would result in an accurate stress scenario:
With so many such linkages missed, and with undue confidence that the scenario was quite unlikely because national housing prices had not declined significantly in the post- war period, some managers took too much comfort.
Operational risk management has increasingly used scenarios to understand the ways in which large losses can occur at a firm. However, as in the subprime example, scenarios that are to accurately reflect risk require a willingness to think expansively about linkages, and cannot be artificially constrained by a desire to minimize capital.
Ideally, scenarios that suggest a need for greater capital should guide the firm in considering whether it needs new controls, or whether it is able in some other way to reduce the "tail risk" (i.e., low probability but high impact) associated with an activity. However, the scenarios used by firms are often capped or truncated in order to avoid incurring a large capital charge, or are assumed to have already been sufficiently mitigated even though they have occurred, sometimes frequently, at competing firms.
Perhaps the biggest challenge arises in capturing legal risk. Most of the largest operational losses have been legal losses (See Figure 6). Frequently a firm is quite careful about discussing pending litigation for fear that it might provide information to the litigant. In addition, the probability of litigation and the possibility of severe impact should a case be lost or settled remain a "blind spot" in risk analysis.
I am hopeful that in the coming years firms will be able to improve models of potential litigation losses. With the experience of accounting and market-timing scandals earlier in the decade, and the litigation likely to stem from the subprime mortgage crisis, firms should have a wealth of data to see if past scenarios captured this risk, whether that risk was elevated to appropriate levels, and whether sufficient actions were taken.
Even with improvements in scenario analysis, there will be significant judgment involved in the exercise. As behavioral economics has highlighted, it can be very difficult to elicit accurate qualitative information from managers. Generating scenario data that are predictive (that is, forward looking) requires calculated rigor. Thus, it seems prudent to approach such analysis with a degree of humility. We should recognize the limits to our ability to capture the many interactions among actors and assets in our formal approaches, and thus introduce a sufficient degree of conservatism in estimating the potential losses highlighted in the scenarios.
Conclusion
The recent financial turmoil has highlighted both the benefits and the challenges associated with pursuing risk management. Clearly, firms that minimized capital estimates and did little analysis surrounding the credit, market, and operational risk associated with subprime securitizations have suffered.
It is not in the long-run interest of a bank to underestimate the capital associated with significant activities. Such an underestimation results in an over-willingness to continue to expand in risky areas and - should those risks come to fruition - risks the firm needing additional capital, being acquired, or in the extreme failing.
Earlier in this decade I asked a risk manager whose firm had just experienced a very significant operational loss how that had influenced the firm's risk management and risk modeling. The answer I received was that it was a once in a thousand years event; so, while they had instituted some additional controls, it did little to change their need to allocate capital for that activity. The next year they had an even larger operational loss in a related area. While it is certainly possible to have two unlikely events in successive years, the probability is relatively remote. Organizations that too willingly ignore the unfortunate events that they or their competitors have experienced only increase the probability that such mistakes will be repeated.
While there have been great strides in risk management practices, risk managers need to be continually pushing their firms to think creatively and expansively about potential risks. The lessons from the recent financial turmoil have probably provided more examples than we would have liked. Nonetheless, I am confident that continued, diligent improvement in risk management and risk modeling will make financial institutions and financial markets even safer and more resilient in the future.
About the Authors
Eric S. Rosengren
Endnotes
- Of course, the views I express today are my own, not necessarily those of my colleagues on the Board of Governors or the Federal Open Market Committee (the FOMC).
- During the recent financial turmoil in the United States bank assets have actually grown, particularly at the largest institutions. Banks have reduced their holdings of government securities, but have expanded their holdings of other securities and commercial and industrial loans. Much of this growth likely reflects "involuntary lending" - that is, banks expanding assets in response to liquidity commitments they extended during the previous good times. Some of the factors that have increased assets on balance sheets have included the inability to roll commercial paper, firms expanding their use of lines of credit, the inability to sell leveraged loans that were originated with the expectation that they would be quickly distributed, liquidity triggers forcing the purchase of municipal bonds, and the inability to sell assets that were in the process of being securitized. Such factors can significantly swell bank assets, placing pressure on capital-constrained banks to pull back in other areas.
- I discussed transparency and disclosure in a March speech available on the Boston Fed's web site.
- In essence subprime loans refer to mortgage loans that have a higher risk of default than prime loans, often because of the borrowers' credit history. The loans carry higher interest rates reflecting the higher risk. Certain lenders, typically mortgage banks, may specialize in subprime loans. Banks, especially smaller community banks, generally do not make subprime loans, although a few large banking organizations are active through mortgage banking subsidiaries.
According to interagency guidance issued, in 2001, "The term ‘subprime' refers to the credit characteristics of individual borrowers. Subprime borrowers typically have weakened credit histories that include payment delinquencies and possibly more severe problems such as charge-offs, judgments, and bankruptcies. They may also display reduced repayment capacity as measured by credit scores, debt-to-income ratios, or other criteria that may encompass borrowers with incomplete credit histories. Subprime loans are loans to borrowers displaying one or more of these characteristics at the time of origination or purchase. Such loans have a higher risk of default than loans to prime borrowers. Generally, subprime borrowers will display a range of credit risk characteristics that may include one or more of the following: Two or more 30-day delinquencies in the last 12 months, or one or more 60-day delinquencies in the last 24 months; Judgment, foreclosure, repossession, or charge-off in the prior 24 months; Bankruptcy in the last 5 years; Relatively high default probability as evidenced by, for example, a credit bureau risk score (FICO) of 660 or below (depending on the product/collateral), or other bureau or proprietary scores with an equivalent default probability likelihood; and/or Debt service-to-income ratio of 50 percent or greater, or otherwise limited ability to cover family living expenses after deducting total monthly debt-service requirements from monthly income. This list is illustrative rather than exhaustive and is not meant to define specific parameters for all subprime borrowers. Additionally, this definition may not match all market or institution specific subprime definitions, but should be viewed as a starting point from which the Agencies will expand examination efforts." - That is, periods characterized by economic or asset-price downturns.
- The recent declines in the highest-graded of some mortgage securities implies very significant losses, as investors would only take losses on these high-grade securities after all lower-graded securities had been wiped out.
- "The Basel Framework is divided into three pillars, the second and third of which are new compared to Basel I. Pillar 1: the minimum capital requirements, which include capital requirements for credit risk, market risk and operational risk ... Pillar 1 lays down a flexible framework within which a bank, subject to a supervisory approval, may apply an approach that best suits its complexity and risk profile ... Pillar 2: supervisory review process (SRP), which adds a qualitative element to the quantitative minimum capital requirements of Pillar 1; the SRP mainly aims at identifying the overall risk of an institution and the main influential factors on its risk situation and to evaluate them from a supervisory perspective. Pillar 3: market discipline, i.e., the institutions are to be subject to enhanced disclosure requirements in order to make use of the disciplining forces of the markets as a complement to the regulatory requirements." Source: Basel II - the new Capital Accord, from the Deutsche Bundesbank's website.
- "Auction-rate securities (ARS) are long-term variable-rate instruments with their interest rates reset at periodic and frequent auctions. They are often marketed to issuers as an alternative variable-rate financing vehicle and to investors as an alternative to money market funds. Investors have historically been able to liquidate ARS positions at face value at frequent auctions, leading many to consider them cash-like. After hundreds of auction failures in February 2008, however, the Wall Street Journal declared that the ARS market had ‘virtually collapsed.'" Source: Stephanie Lee, NERA Economic Consulting, Auction-Rate Securities: Bidder's Remorse? A Primer. May 6, 2008
- "Auction-rate securities (ARS) are long-term variable-rate instruments with their interest rates reset at periodic and frequent auctions. They are often marketed to issuers as an alternative variable-rate financing vehicle and to investors as an alternative to money market funds. Investors have historically been able to liquidate ARS positions at face value at frequent auctions, leading many to consider them cash-like. After hundreds of auction failures in February 2008, however, the Wall Street Journal declared that the ARS market had ‘virtually collapsed.'" Source: Stephanie Lee, NERA Economic Consulting, Auction-Rate Securities: Bidder's Remorse? A Primer. May 6, 2008
- My colleagues in the Bank's Supervision, Regulation, and Credit area note that such issues have occurred throughout the history of financial innovation; this is not an isolated event. A good illustration of this point is the introduction of portfolio insurance in the mid 1980s. Portfolio insurance was a strategy that worked very well for some time, as long as markets were liquid. The assumption was that there would always be buyers at a price - and the pricing was done under the assumption that the various structural and statistical relationships would remain intact.
Unfortunately, the strategy failed when it was needed the most, in October 1987. As soon as the stock market started crashing a large number of dynamic hedges were initiated to cover the insured portfolios. The number of insurance contracts was so large that it aggravated the market decline and triggered further hedges. The existence of portfolio insurance changed the dynamics of the market and could not have been captured by data collected prior to the introduction of this new instrument.
Another similarity between the portfolio insurance and securitization is the fact that investors ignored the change in behavior due to the introduction of the instrument: portfolio insurance gave a false sense of security to fund managers pushing them to adopt riskier strategies, the same way as securitization introduced moral hazard in the mortgage business.