Why wrangling risk at banks is so hard

Unlock the Editor’s Digest for free

Roula Khalaf, Editor of the FT, selects her favourite stories in this weekly newsletter.

The writer is a managing director at Frontline Analysts and the author of ‘The Unaccountability Machine’

One of the episodes from my career as an equity analyst that has stuck in my mind was the time I went to Dublin, back in the innocent days of the so-called Celtic Tiger era of the 1990s and 2000s. I was there to talk to banks about what was, in those days, referred to as the real estate “boom” rather than “bubble”. The pair of bankers in front of me were in a relaxed mood, and wanted me to understand how backward and unsophisticated the Irish regulators were.

“Can you believe,” one of them said to me, “they asked us for details of all of our highly leveraged borrowers? We told them, sure, we’ll give you all the details — just tell us the address of the warehouse to send the trucks of paper to!”

I remember thinking at the time that this was a bit of a red flag, in two senses. First, it’s not great when supervisors command so little respect that bankers are prepared to mock them to a complete stranger. And second, if this really was the only way to provide the data needed to look for patterns and risks in the real estate lending book, then that wasn’t just a problem for the regulators, but for management too.

That was a little less than 20 years ago, and it’s unlikely that any major bank in Europe has important data that isn’t accessible today in electronic form. But the same problems persist; there are still dysfunctional relationships between financial institutions and their regulators, and it is still a struggle for management to get a clear view of the risks they are taking.

In fact, the two problems are as related now as they were then. The two sides still see things completely differently. Supervisors presume that banks have all the information they need at their fingertips, and just need to be encouraged to make the right decisions. Banks think their supervisors don’t understand how much of their business is carried out in the financial equivalent of the fog of war. Neither are right.

The unfortunate secret about risk management is that it is less a matter of higher mathematics and more a constant struggle to get people to email you their spreadsheets on time. There is no panopticon in the form of a central ledger into which every transaction appears automatically; there are just thousands of employees in hundreds of teams, dutifully typing into dozens of different software applications, each one developed ad hoc a decade earlier.

Obviously, the dream of banks and regulators alike is to build that panopticon. But so far it’s proved too difficult for nearly everyone who has tried. Every time you think you have a fully realised set of “risk data aggregation systems”, somebody invents a new product or enters a new market, and the data gaps start to build up again.

The great misunderstanding between banks and regulators is likely to get even more frustrating in the short term. In the name of simplification and streamlining, the supervisors are having a look at all the regular reports they require from the banks, and getting rid of the less useful ones. Instead, they will only ask for specific data, on the questions they deem important, as and when they arise.

From the regulatory perspective, they are being helpful — no more routine pointless paperwork and red tape, just the occasional request for specific data tailored to an immediate problem. But the banks don’t see it like that. Routine and regular reports are not difficult to deliver. They don’t change from month to month and you know what goes into them. They can often be automated.

An ad hoc request, though, is a requirement to give exactly the panopticon view that doesn’t exist. It’s an even more demanding and impractical imposition than asking to deliver a warehouse full of documents. Every such request requires huge amounts of labour and manual intervention in the systems, stitching together things that were never previously meant to be added up. Trading off fewer easy regular reports for exercises such as this is a nightmare scenario for most risk management departments.

The whole business of management is to try to organise the flood of data that a company generates and boil it down to the raw material of decision-making without losing anything important — literally, to make things manageable. But information that is compiled in this way for one purpose is highly unlikely to be easily usable for another. This mismatch is the real problem at the heart of banks’ relationship with their supervisors.