Big Banks Flunk OCC Risk Tests

Think corporate governance at the largest banks is weak? You're right, but you probably have no idea just how right you are.

The Office of the Comptroller of the Currency recently graded the 19 largest national banks on five factors designed to gauge how well they are being run.

The results are startling.

Not a single bank met the OCC's requirements for internal auditing, risk management or succession planning. Only two of the 19 banks met the regulator's requirements for defining the company's appetite for risk-taking and communicating it across the company. Only two banks were judged to have boards of directors willing to stand up to their CEOs.

This miserable picture was painted by OCC leaders last month at a closed-door conference for large-bank directors. I obtained a copy of the presentation materials and I asked the OCC to help me understand them.

In an interview Monday, Mike Brosnan, an agency veteran who now leads large-bank supervision, walked me through the progress bankers and examiners alike have made over the last two years. He is confident that the next year will bring marked improvement.

"I'm satisfied with where they have come from, and I like the momentum," Brosnan says. "I think we're at a C-plus/B-minus point, and what we are looking to get to is B-plus or A-minus. We are not looking for A-plus."

Brosnan predicted each of the 19 banks will meet the agency's thresholds in at least one of the five categories by July.

"All these are motherhood and apple pie, but they are really hard to do," he says.

Hard indeed. According to the conference materials, the number of outstanding "matters requiring attention" at the 19 banks stood at 1,083 on Sept. 30, which works out to an average of 57 separate problems cited at each bank.

Brosnan stressed that national banks are being held to higher and tighter standards than ever before. "We've raised the bar significantly."

After the 2008 crisis, Brosnan and his colleagues at the OCC did some serious soul searching and concluded that the same mistakes that have bedeviled banks for decades did them in again: lousy loan underwriting, overleveraging, rapid growth and asset concentrations. Brosnan also faults the regulators, including himself, for missing the obvious.

"We don't have anything to hide behind. This is all fundamental stuff," he says. "Let's not kid ourselves. We got beat the old-fashioned way."

Determined not to get beat again, Brosnan's mission is nothing if not bold. He wants to restore the industry's — and the OCC's — reputation.

"I want the banking system to be valued again and to be recognized that it is a key component to growth," he says. "Also, the supervision of the large banks has to be trusted again."

To do that he's turned the large-bank supervision model inside out. Rather than putting the primary focus on credit, liquidity, interest rate and price risk, Brosnan has the OCC's large-bank examiners targeting operational, compliance, strategic and reputation risks.

"For the first time in my life, we actually say this basket of risks is more important, and more of a priority for the system to deal with, than" asset quality, liquidity, interest rate risk and trading activities.

"It's weird," he admits. "It makes us uncomfortable as examiners, because it's not how we were trained."

Brosnan is an even tougher grader when it comes to his own team. He gave most banks a C-plus or B-minus but gave the Comptroller's Office only a C.

"Fixing capital, reserves and liquidity is much easier than what we're fixing now, which is governance and oversight," he said.

Among the five governance areas being targeted, risk management and audit are getting the harshest eye. "We determined that for these 19 banks, their audit and risk management functions had to be elevated from wherever they were to meet our definition of 'strong,' " Brosnan says.

None of the banks have met that standard for audit; 10 banks are within a year of meeting it while the nine remaining banks will need up to two more years, according to the materials the OCC disseminated at the conference. (The OCC did not identify any of the banks by name.)

None of the banks have met the risk management standards either. Four are within a year and 15 of the banks are going to need up to two years to pull their systems up to snuff, the OCC says.

The OCC also wants bank boards of directors to provide a "credible challenge" to senior management.

"Providing credible challenge means you are informed, and that you also realize you have a fiduciary duty to the community and the employees," Brosnan says. "If they are just going to say 'yes,' then they have failed. They have to be informed, invest the time and then ask the right questions."

Brosnan says directors must demand "information" rather than allowing themselves to be overwhelmed by raw data. They must insist that time is set aside during meetings for genuine discussion, and they have to speak up when they disagree with the CEO. Finally, directors should ensure that the chief risk officer and the chief auditor are flagging matters that require their attention.

"It's a lot of work," Brosnan concedes. "Their hourly wage is probably a bit less than mine."

The OCC is not trying to create an adversarial relationship between a bank's senior management and the board, he says. But it does want some "tension."

"The CEO is the chief executive officer, but they work for the board, and sometimes that got lost in growing their banks," Brosnan says. "CEOs are human. That person can make great decisions and bad ones — no matter who it is. That's why you need the checks and balances" that a board provides.

The OCC figures 14 of the 19 banks are still 12 to 24 months away from having a board of directors that is exercises the proper oversight. Two are there today and three more are within a year of reaching this goal.

The agency is taking a close look at talent management, too, and much of that focus is on succession planning. Does the company have a deep bench? Does it know whom it plans to promote to key jobs? Not a single bank has met the OCC's expectations in this area, but 12 are getting close; seven banks are still 12 to 24 months away.

"The bar we put out there is high. You can't just be OK. We want you to be really good," Brosnan says. He was quick to acknowledge another factor holding banks back: examiners are loath to say a bank has met all the criteria for fear they will stumble and the examiner's judgment will be called into question.

Brosnan says he is working "to get my guys culturally comfortable with that. They are inherently reluctant to call somebody a 1-rated bank or strong," he says.

Finally, the OCC wants to be sure these large banks are defining their risk appetites and communicating that to employees. The biggest hurdle here is rolling risk up to an enterprisewide level. Someone, likely the chief risk officer, should be able to walk the board through the collective risks facing the bank, Brosnan says.

Two of the 19 banks have met the OCC's standards here, while eight more are within 12 months and nine banks are still 12 to 24 months away.

While some large-bank executives argue privately that the OCC is being too intrusive, Brosnan is confident everyone is on the same page.

"They are totally serious. I haven't yet found any of those independent directors or any CEO or the CEO's direct reports who disagree with this being the right course of action," he says. "What they want from us is to make it clear where we think they have gaps and give them some credits for the wins."

Brosnan, 54, has spent most of his working life at the OCC, joining the agency in 1983 as an examiner in Miami. Twenty years later he reached the pinnacle of the exam corps: senior national bank examiner.

He left the agency in 2004 to join MBNA to run its operational risk management. MBNA was bought by Bank of America in 2005, which was ironic as Brosnan had once been B of A's examiner-in-charge. Brosnan rejoined the OCC in 2008 and was promoted in 2010 to his current post, senior deputy comptroller for large banks.

In many interviews over the years, he's always been pretty blunt. He rarely hedges, starting most of his answers with a confident yes or no. He's earnest, passionate and intensely interested in getting supervision right. But perhaps the most striking thing about Brosnan is his optimism.

"They are going to get this right," he says.

Barb Rehm is American Banker's editor at large. She welcomes feedback to her column at Barbara.Rehm@SourceMedia.com. Follow her on Twitter at @barbrehm.