A New Approach to Strategic Risk Management in Banks

Edward works as the chief risk officer for a large regional bank. With a recent shift in strategic initiatives, the bank’s environment has grown more dynamic and complex. These initiatives marked a big change in terms of how the bank aims to conduct business.

With this shift in strategy, new risks have emerged, and those new risks keep demanding more of Edward’s time, but that extra time doesn’t exist. The risk management to-do list keeps growing and growing, but resources and talent haven’t expanded to match.

Acquiring available talent is a constant struggle for Edward. Very few individuals have the niche enterprise risk management skill set and experience to fill the roles that Edward needs most. Consequently, Edward takes on responsibility for doing everything, all at once, all the time, and that’s unsustainable.

Sometimes, Edward is simply too busy putting out fires and managing too many disparate risk disciplines to focus deeply on any area of risk. He knows that he could get some traction if only he had the right resources.

Jeanine works as the chief compliance officer at a larger bank, and a lack of resources is one problem she doesn’t struggle with. Jeanine’s position is more manageable than Edward’s in a lot of ways, but she has her own challenges to tackle.

A few years ago, Jeanine’s bank received a regulatory enforcement action. In the wake of that challenge, the direction from the top was clear: Open the checkbook for risk management and spend whatever it takes to get the bank into compliance and in good standing from a regulatory perspective.

Now, Jeanine’s team has so many people that it’s hard for Jeanine to remember who’s who and who does what. The lines of communication constantly feel jumbled. The entire risk management framework was dashed together to solve a pressing regulatory problem. But with that task in the rearview, what’s next?

The first line feels like it’s stuck in a maze of risk management processes. Without an ability to see through the inner workings, first-line team members don’t have a solid sense of where risk is lurking in the organization. At the same time, stakeholders are evaluating the organization’s big risk management budget, and they wonder what value they’re getting.

Despite all the resources at her disposal, Jeanine is concerned that the dots aren’t connecting. She’s not sure how she can untangle the complicated knot of her enterprise risk management program, and sometimes she wonders if she should just strip it back and rebuild it in a way that makes sense. This set of circumstances is ideal for responsible optimization of the risk management function.

Meanwhile, Pierre is a chief risk officer whose life is less stressful than either Jeanine’s or Edward’s. As a relatively young startup banking organization with a lot of fintech partnerships, Pierre’s bank decided early on that it wanted to focus on a highly efficient approach to strategic risk management.

An experienced chief risk officer, Pierre had seen the pitfalls at other organizations, and he worked hard to design a risk management approach that was right-sized for his bank’s needs and complexity. That strategic approach led to a second-line team that is organized, honed, and efficient – but Pierre isn’t sure that the efficiency always translates to effectiveness.

The problem: Pierre’s second-line team has taken on all the risk management activities for the business, and the first line barely thinks about risk and compliance. The disconnect works both ways. Pierre’s team spends all its time on risk management instead of also engaging with the organization’s overall strategy. Even with a relatively smooth relationship between business and risk management teams, the gaps of knowledge, language, and focus between the first and second lines at Pierre’s organization are as wide as ever.

Stakeholders at the business see this problem, and they want Pierre’s help solving it. They’re willing to invest more in risk management, but that’s not the real issue.

In environments where the first line is charging ahead and the second line is left to shoulder risk ownership, it can be difficult to confirm risk is meaningfully considered. The objective for risk management teams isn’t to impede momentum or delay strategic execution but to position risk as a function that adds value in decision-making. Doing so requires embedding risk into the flow of the business so that second-line perspectives are present in the right forums, conversations, and decisions as they happen. Without that level of integration, risk functions become reactive and might struggle to keep pace with the business and effectively inform or support critical decisions.

The question that Pierre must answer is the same one that can help Jeanine and Edward solve their tough risk management challenges: How can our bank implement more strategic risk management activities that will inform our first-line professionals and help the business grow?

Effective risk management does not belong to one line. When teams across the organization understand the jobs to be done, define roles and responsibilities, eliminate redundancies, manage to risk appetite, and measure for ongoing alignment and reporting, appropriate adjustments and decisions become possible.

The risk management approach at each of these fictional banks is held back by fundamental problems. And though Jeanine, Edward, and Pierre have unique challenges and different ways to address them, their goal is the same: a new approach to strategic risk management that shifts the responsibility for managing risk to the first line.

As strange as it might sound, second-line risk and compliance teams at organizations with the most effective, agile risk management programs don’t spend too much time managing risk.

Instead, these second-line teams empower the organization’s business teams to understand and manage risk. With the first line driving risk management activities, the second line can provide the governance, feedback, and oversight that supports those first-line controls and activities and helps them run smoothly and evolve to address new risks.

Banking organizations that want to practice truly proactive, collaborative, and strategic risk management need their organizational stakeholders and risk management leaders to ask questions such as:

• What products and services does our business depend on?
• How do we deliver those products and services?
• What day-to-day activities do our first-line professionals engage in?
• Where does the risk lie in our first line? Within the range of our products, services, delivery methods, and activities, what could go wrong and how?
• Which of the first line’s current day-to-day activities function as controls that address specific risks?
• How can we talk about risk management in a way that makes sense to our first-line teams and frames risk management activities in terms of products, services, and business activities?