Introduction to Failings of Risk Management in the Global Financial Crisis and Beyond to the Australian Banking Royal Commission Enquiry into Banking Misconduct

Chapter 38 contains an introduction to the failings of risk management in the GFC and beyond to the Australian Banking Royal Commission Inquiry into banking misconduct including APRA’s Prudential Standard CPS 220 Risk Management. We examine the link between risk management and governance and examine board responsibilities and failings of board oversight in risk management. We construct governance variables based on board responsibilities and principal failings of board oversight in risk management, internal monitoring and decision-quality. There follows our approach to modelling governance variables, governance variables for board responsibilities in CPS 220 Risk Management and additional requirements on the head of a group. Chapter 38 then constructs governance variable for a long list of failings including: failure to identify risks on an organisation-wide basis rather than by business unit or activity; separation and low status of risk managers likely to cause a deficiency or reduction in the flow of information from management to the risk manager on the details of particular risks; failure to escalate problems or ‘red flags’ – deficiencies in the flow of information upward through the bank to senior management and/or the board; failure in information flow on leverage and risks due to over-reliance on regulatory capital ratios and rates of return on equity; failure of information flow on identifying risks; failure of information flow on risks in CDOs and other financial products; failure of information flow to senior management due to ‘silo structures’; failure of information flow due to conducting stress testing with past information; failure to understand and compare bank’s risk position relative to risk appetite; failure of risk model assumptions; failure by board to continuously review internal structure of bank for clear lines of accountability/responsibility, risk culture and flow of information about risks; failure in training employees responsible for distributing risk products; failure in expertise or experience of risk management employees in entire range of risks; failure to monitor changes in risks in real time and to escalate information rapidly upward in the bank; failure to upgrade IT tools for complex and opaque bank structures; failure to devote sufficient management time to management of risks; failure to align corporate strategy, risk appetite and the internal risk management structure; failure to separate risk management and control from profit centres; failure of Chief Risk Officer (CRO) to report directly to board and Board Risk Committee (BRC) in addition to the CEO; and failure in transparency and understandability of material risk factors ranked in order of importance.