Risk Management Lessons from Jerry Maguire

"Show me the money!" 

I found myself reflecting on this Jerry Maguire catchphrase when I read recently that a growing number of banks are hiring non-bankers in senior risk management roles.

The theory driving this trend is that risk managers with experience in heavily-regulated industries like pharmaceuticals will possess the process knowledge necessary to oversee virtually any type of risk, regardless of the field.

But is it true that risk-management process knowledge is what has been missing in banking all these years? 

To arrive at an answer, it's helpful to think about the big challenges faced by risk managers today. A few weeks ago, I had the privilege to be the keynote speaker at the Operational Risk Forum, a gathering of about 100 regulators from the Federal Deposit Insurance Corp., the Federal Reserve, and the Office of the Comptroller of the Currency.

In my speech, I discussed the operational losses incurred by banks around the globe in 2011. The publicly available data came from ORX, a London-based organization that conducts research into operational risk measurement and management activities.

The roughly 60 banks included in ORX's study reported total operational losses of $34 billion in 2011. To put this number in perspective, all U.S. banks have averaged a total of $100 billion in profits per year since 2009. So needless to say, $34 billion is a lot of money.

I cited this data to regulators for two reasons. First, although more than 36,000 events contributed to the banks' $34 billion in losses, 80% of the banks' total dollar losses were driven by just 145 events.

This statistic underscores the need for risk management programs for U.S. banks to be designed to "major in the majors" — that is, to identify and mitigate potential loss events that would devastate capital levels and threaten the safety and soundness of individual banks and the financial system as a whole. 

Unfortunately, the current regulatory environment pushes banks to identify thousands and thousands of risks, seemingly irrespective of materiality. In the process of identifying all these risks, bank risk managers encounter a new danger: They can be so busy identifying different threats that they actually miss the big ones that matter most.

The second reason for citing this data was to explain that these big loss events could have been detected three to 10 years earlier, when the business activities associated with the losses first began. This is possibly the most important lesson to be learned from the past decade in banking.

Banks could have identified risky activities much earlier if experienced risk managers had taken more time to scrutinize income statement and balance sheet trends. The bank unit conducting the activity typically enjoyed a substantial and sudden improvement in critical business metrics, all of which can be found on financial statements. 

When a bank unit's expenses, revenue and profits grow much faster than gross domestic product, the risk manager's first question should be "Why?"

Does the bank have competitive advantage from patents, like Qualcomm, or massive scale and cost advantages, like WalMart? Perhaps the bank has built a scalable platform similar to Apple and Microsoft’s operating systems?

If such competitive advantages do not exist, history shows that competitors quickly match innovation and revenue, and profits revert over time to the growth rate of the general economy. History also shows that comparative advantage is incredibly difficult to achieve and sustain in a business like banking, since commoditization of services is commonplace.

All this leads back to the matter of selecting an effective bank risk manager. The industry is right to reconsider the skills needed to do the job well. But bringing in a lot of talent from outside may not be the best solution.

Banks need risk managers who can detect future mega-loss events at the very onset of the activity creating the risk. This requires two specific skill sets.

First, the best risk managers have a deep understanding of bank performance, financial reporting and profit and loss management. They are vigilant students of income statements and balance sheets. This knowledge gives risk managers the ability to challenge the material changes in performance that are the leading indicators of risk. 

Second, top risk talent knows how to spot growth that is too good to be true. Strong performers have a deep knowledge of bank profit-drivers and financial market dynamics, and are equipped to credibly confront the bank leaders who produce profit and revenue.

Process skills are always helpful, especially if regulators are pushing banks to create encyclopedias to catalogue thousands and thousands of potentially risky activities. But identifying the big risks that actually impair a bank's profits requires real business knowledge and informed judgment.

The banking industry needs risk managers who combine accounting and finance experience with several years of hands-on profit and loss management at banks. People with this pedigree are fact-focused by nature, concentrating on numbers and usually unpersuaded by highly compensated bankers who argue that their teams are just smarter than everyone else.

Such risk managers practice what Cuba Gooding, Jr., preached: They demand to be shown the money. They know from experience that rapid changes in revenue, profits and especially compensation are the best early warning signs of big potential losses. 

Richard J. Parsons is author of Broke: America's Banking System and a retired executive of Bank of America, where he was in executive management roles for both the human resources and risk management departments.