CA on Governance, Risk and Compliance (GRC)
- Insights and observations on happenings in the GRC market
Compliance Week recently reported on a policy paper issued by the Association of Chartered Certified Accountants attributing the current financial crisis to failed corporate governance, not sub-prime mortgage defaults as others have suggested. CA’s Christopher Fox takes a look at the ACCA’s findings and weighs in with his thoughts.
The principal cause of the credit crunch was not sub-prime mortgage defaults but a failure of corporate governance at banks, according to international accountancy body the Association of Chartered Certified Accountants. The ACCA has published a policy paper, “Climbing Out of the Credit Crunch,” available for download here.
In this paper, the ACCA asserts the following:
“Underlying much of the credit crunch has been a fundamental failure in corporate governance. While the financial institutions involved may have been in compliance with local requirements and codes, they have ignored the key point – good corporate governance is about boards directing and controlling the organizations so they operate in their shareholders’ interests. Boards should be answerable to company owners, to account properly for their stewardship and to ensure both sound internal control and the ethical health of the organizations. The use of overly-complex financial products, which thwarted effective supervisory control, and the unethical advancement, at the point of sale, of loans to people with little realistic hope of repaying them shows a lack of basic corporate governance.”
“In early 2007, few senior managers thought they were betting on the viability of their banks. It appears they did not understand the risks and were using risk assessment with tools which were inappropriate. Boards may not have expended the necessary time and energy, and/or lacked the expertise to ask the right questions.”
I support these conclusions. I find it difficult to believe that a Board would willingly accept the risks associated with sub-prime mortgages if they truly understood the risks. In other areas of a bank, particularly derivatives trading, the use of stress testing to evaluate market risk and historical data to evaluate credit risk, there are good tools to evaluate risk. In the sub-prime mortgage area the tools used were ineffective. Under the COSO Enterprise Risk Management Framework, the Board and management establish a risk appetite for trading activities. If a Board were fully informed, I would expect that sub-prime trading would have been considered high risk, and appropriate checks and balances implemented. Rather, under the existing regulations mortgages were considered low risk and required lower reserves than other types of assets.
I think that there are at least two lessons to be learned:
On a final note, it is likely that something similar to what happened to policy management under the Federal Sentencing Guidelines could occur, i.e. issuing policies is no longer enough, you must demonstrate that people have read and understood the policies and that there is a mechanism to keep the policies up-to-date.
In the future it may not be sufficient to pay lip service to corporate governance; instead you may need to prove that you have a functioning GRC system in place. This will most likely apply to all industries, not just the financial services industry.
There’s another interesting blog post that relates to this topic. It’s from the Scientific Leader, and describes a survey of CFOs that indicate that poor risk management was, in their opinion, the most important factor in the current economic crisis. The posting can be found at:
http://scientificleader.wordpress.com/2008/10/29/cfos-feel-risk-management-practices-1-root-cause/
I don’t think that poor risk management alone is the cause. In a lot of the literature there is a lot of focus on risk and compliance but very little on governance. I’m sure that a lot of middle management wee aware of the risks - but their bonuses asnd employement was based on results. When they looked at risk and reward they probably believed that the rewards were greater than the risks. The question is did more senior management, including the C level and the Board realize the extent of the risks that were being accepted. I’m confident that if senior management knew that loans were being written for unemployed people and that loan officers were completing the application forms that they would have been concerned.
I always considered Senior Management’s awareness of lower level risks, including those undertaken by middle management to be a component of Enterprise Risk Management. The fact that this wasn’t transparent enough to C-levels, was part of the problem.
Please Leave a Comment: