Are You Taking Enough Risks?

Chris Henkel, President, Finance.Risk.Unified.

If you’re in banking, you’re in the risk-taking business. 

Too much risk can erode earnings, capital and even lead to failure, while too little can erode the bank’s performance and condition, putting pressure on the board and management team. 

Spurred by technological advancements and heavy-handed regulations, risk and resilience have been common themes in the current climate. Forward-looking banks will want to know what type of information is needed to make informed and strategic decisions.

We’re not in 2008, but these risks should not be taken lightly.

In our current environment, higher-for-longer interest rates continue to have a rippling effect on a bank’s exposure to credit, market and liquidity risks. Commercial real estate, especially for community and regional banks, continues to be challenging due to higher rates, remote work and oversupply in many previous growth markets. Exacerbating matters is the growing amount of interest banks are paying for deposits which also drives down the values of their securities. The level of unrealized losses is staggering. 

Delinquencies on commercial mortgage-backed securities and CRE loans, as well as the uptick in late credit card payments should be considered indicators of heightened risks, and thus monitored and proactively managed.

Higher rates have already put downward pressure on profit margins and liquidity ratios. While most banks shouldn’t have to realize the losses in their securities portfolios, we’ve already seen cases of a liquidity crisis and the need for cash infusions. The unrealized losses on securities were above $500 billion in Q1, and 97% reported unrealized losses on securities.[1] 

Here’s the good news. Where there are risks, there are opportunities.

The number of banks is down, but a closer look will show that the number of banks whose assets are $1 billion to $10 billion have grown by double-digit percentages since 2019, especially the midsize community banks.

They’re performing well, too, with lower levels of uninsured deposits, problem loans and unprofitable institutions – with a stickier deposit base. These institutions are among the highest in profitability as a percentage of income.   

We recently conducted a small study on publicly held community and regional banks that closed a sizeable M&A transaction. Most acquiring banks had above-market returns post-acquisition.

Community and regional banks can provide more personalized customer service and embrace leading practices for managing risks and seeking growth.

In this environment, portfolios and institutions with undervalued assets are attractive targets for acquisition at a discount. There’s also the much-needed technology to capitalize on — integrated platforms across bank functions, digital banking capabilities, new financial products and cybersecurity. 

Strategic and intelligent growth is also cited as an opportunity to attract and retain talent. Consolidation in the industry isn’t going anywhere, but smaller community banks are. Getting bigger isn’t necessarily better, but it’s proving increasingly necessary to remain competitive and profitable while serving customers.

To prepare for the future, we sometimes need to look to the past.

The types of risks haven’t really changed. Asset quality, regulatory compliance, integration challenges, customer impact and culture are often the reasons banks don’t succeed. Risks shouldn’t be avoided; they should be identified and effectively managed by gaining clear, forward-looking visibility with the knowledge, resources and tools available to us today.

 As you reflect on the evolution of risks, here are some questions to consider:

• What have you learned about uninsured deposits and the ease with which deposits can leave the bank? Has that changed your approach toward attracting deposits and managing your deposit base? What are your key performance indicators?
• To what extent has your institution made a digital transformation? It’s not enough just to have online and mobile banking; those are table stakes.
• How have you shifted operations in the post-pandemic era? Maintaining the “status quo” isn’t a strategy. There are secular shifts that require operational and cultural changes. It has been an accelerator for digital transformation and customer interaction models.
• How proactive and agile are your risk management capabilities? Regulation tends to be a laggard, which is a response to what has happened, not a roadmap to guide your decisions. Compliance shouldn’t be the objective; it’s a byproduct of a right-sized and effective risk management program.

How do you think about risk today?

A higher interest rate environment, CRE concentrations, liquidity challenges and regulatory compliance are undeniable risks; however, if you’re confident in your institution’s ability to identify and measure emerging risks, your management team should see them as a cost of being in the banking business. That is as much an opportunity for strategic growth as it is a potential source of financial loss.

If you’re a growth-minded leader recognizing a need to bolster your bank’s resilience to grow, scale and gain confidence in your capabilities and risk awareness, you owe it to your future goals and objectives to understand these risks and manage them. An integrated and strategic view will bolster your ability to anticipate and navigate the economic and financial markets. A healthy strategic view of risk will go a long way to help your institution get out of react mode and put you in the crucial strategic role you signed up for.

[1] Source: FDIC Quarterly Banking Profile, First Quarter 2024. fdic.gov

7 Essential Elements to Integrate Your Financial Metrics and Risk Strategy

John Drew & Aaron Taylor

Banks depend on their financial reporting and performance metrics — but often this data is scattered among multiple systems and spreadsheets at typical community and regional banks, and it is very rarely viewed in conjunction with risk data. As a result, bank executives do not have the visibility they need, while strategic opportunities slip by.

Bank’s risk data is often uncoordinated and confusing, stemming from disjointed risk management processes and poor communication flow. Employees may not have a view of their risk profile or have an established appetite for risk. They view risk as something to react to —not a strategic discipline operating across the entire enterprise.

Banks can no longer simply rely on financial metrics alone, any more than they should view risk as simply a credit issue. Financial data being viewed through a risk lens is necessary if any bank is to have the most accurate profile to make the most effective strategic and forward-looking operational decisions possible.

The largest banks have comprehensive tools, reporting systems and dashboards. Their approach allows several key leaders to pilot the enterprise in a coordinated effort. For the small-to-mid sized bank seeking to be agile and innovative, the technology to make this possible has been either too expensive or difficult to implement.

This unification of finance and risk on a unified platform is now possible for banks of all sizes. Banks now can project a heads-up display of financial data onto a crystal clear windshield of risk visibility. Here’s what it’s going to take to see what you bank needs to see:

1. Strategic and Financial Management 

Generate detailed, driver-based rolling forecasts to project financial performance over the short and long term. Streamline the budgeting and reporting process to incorporate branch, board and external reporting, complete with allocations and consolidating entries, to bring forecasting and strategic planning together.

2. Risk Appetite Definition

Specifically, the risk appetite framework objectives define and manage the levels and types of risk the board and management are willing to take in order to achieve the bank’s strategic objectives. Executives will want to represent the aggregate view of risk across all risk categories and lines of business, and create a dynamic structure that allows for internal and external changes in risk profiles. Because every organization’s risk appetite is different, they should to be sure to Incorporate the bank’s core values, mission and objectives.

3. Top Risk and Key Risk Indicators

This is where risk appetite merges with financial analytics. Key risk indicators (KRIs) measure and indicate changes in the impact or likelihood of a risk against a risk tolerance range or threshold. Develop an enhanced key risk indicator inventory (KRI) aligned to the risk process structure of the corporation. KRIs not only define your bank’s risk capacity, they also provide early indication of changes to your risk profile. It measures performance targets and goals, and provides visibility to the key risk profiles of the corporation.

4. Expected Loss Credit Risk Measurement   

Making loans is at the heart of what banks do. Visibility here is key. Banks need to accurately assess credit risk with scorecards that rate both the borrower and collateral, and quantify expected loss for risk rating, pricing and portfolio risk management. This lets executives see the potential impact on charge-offs and the provision for loan losses while identifying higher risk profile segments of the loan portfolio. Good credit portfolio analytics allows the bank to see the trends before they’re impacted by them, so the bank can act instead of react.

5. Stress Testing

This entails a consolidated risk tool set that includes credit and non-credit stress testing, based on prospective economic scenarios. Banks can simulate prospective economic scenarios and see the potential impact on capital and financial performance, while gaining visibility to the organization’s risk profile. They can also obtain visibility to the potential impact on charge-offs rates and the provision for loan losses, while identifying higher risk profile segments of the loan portfolio. If the bank grows too quickly, will it run out of liquidity and capital? What if earnings aren’t what’s expected? What if the economy slows and interest rates increase? What ultimately happens to credit risk exposure?

6. Monitoring and Visibility

Compare the bank’s risk appetite to its risk profiles across the enterprise, both real time and periodically, with your organization’s strategic plan and movements. This includes loan and deposits performance reporting, analytics and branch reporting. Capture instrument-level loan and deposit data to analyze profitability and activity by customer, product, loan officer and more. This will reveal the bank’s growth potential.

7. Real-Time Prospective Reporting

Where it all comes together: The ability to monitor and manage the business day-to-day using a highly graphical and intuitive interface for operating, performance and risk metrics. This is about making risk-adjusted decisions to optimize your organization’s strategic plan.

Embracing automation that unifies real-time financial optimization and risk quantification allows banks of all sizes to see much further, because the risk outlook and forecasting are driven by a shared and goal-oriented risk language and key risk indicators. Banks can finally look through a windshield that is crystal clear because their finance and risk metrics are comprehensive and true.

This all adds up to freedom. Freedom to spend less time guessing, gathering, and reacting, and more time executing strategy, optimizing risk, and achieving goals.

John Drew, a 42-year veteran in the financial services/banking industry, is President & CEO of OnPoint Risk Advisors, and Chairman of Finance. Risk. Unified. (FRU), a consortium of experienced bankers helping bankers, delivering best-in-class financial and risk management methodologies coupled with a highly automated and intuitive technology platform.

In addition to his previous position as EVP/Chief Credit & Risk Officer of Amegy Bank, John has served on the Enterprise Risk Council as State an National Director for the Risk Management Association. Throughout his career, John has provided risk management training and thought leadership in the area of risk management to over 400 bank regulators across the nation.

 Aaron Taylor, a 23-year banker, is the CEO and Founder of Sola Analytics as well as co-founder and CEO of FRU. His prior scope of responsibilities included the role of Executive Vice President, Director of Capital Planning, Director of Enterprise Risk Management and Director of Financial Planning and Analysis with extensive experience on stress testing, ERM, and financial reporting and analysis.

He was the primary architect for the Dodd Frank Act Stress Testing (DFAST) program, Model Risk Management Program and ERM Program while also designing pre-provision net revenue and credit loss models.