Why Focusing On Bank Risk Culture Is Meaningless

The following is the third in a series of articles on bank risk culture. The previous articles can be accessed on the blog here.

In the previous articles we argued that it is futile if not impossible to separate the risk culture of an institution from the other aspects of culture within it. This article further develops this assertion by looking at some very specific examples of how banks got into trouble during the subprime crisis and why, in each case, only focusing on risk culture would have been totally inadequate.

In a January 2009, The Economist wrote an article on Citigroup entitled “A House Built on Sandy”, a less than veiled reference to the bank’s former CEO Sandy Weill and its troubles during the financial crisis. The article did not pull any punches and here are just a few of the statements it made:

“TOO big to fail, too shit to buy” is the way some Citigroup insiders describe their employer…Acquisitions were poorly integrated. Cultures overlapped rather than melded (the resilience of the Smith Barney name is one telling indicator)…It may be inevitable that some banks are too big to fail; but the lesson of Citi is that they can also be too big to manage.

The real lesson here of course is that no amount of risk management can function effectively in an institution which is itself not functioning effectively. The sheer size and complexity of modern banks can and will undermine the best efforts at risk management whatever the risk culture.

Just as important as an institution’s sheer size is the question of how quickly it got to be that size. For example, RBS went from being a small regional bank to a global powerhouse within a mere decade. During one seven year period the size of the RBS balance sheet quadrupled—and that is how it became a £2 trillion behemoth.

The question is therefore, how can any manager, including risks managers of course, be effective at their job when an institution grows so large and at such a rapid pace?

More specifically, if RBS had been growing its base retail business in its domestic market, then perhaps growth might not have been so difficult to manage. However, RBS was growing and expanding internationally, as well as into new areas i.e. complex derivatives and other investment banking products, in which it had no significant prior experience.

What good is having a great risk culture when you don’t even have time to assess the issues and the new environment which are being thrown your way?

However, banks do not have to become suddenly large and unwieldy to run into problems. Back in the 1990s Merrill Lynch was a very well managed and highly profitable Wall Street firm—that was until Stan O’Neal took over and decided that it was not profitable enough and that the firm needed to be more aggressive in taking risks. That strategy included assuming a higher profile in the subprime mortgage market.

The rest as they say is history. Merrill Lynch is now no longer an independent firm, having decided that surrendering itself to Bank of America (another trouble organisation) was its only hope for survival.

All it took to undermine Merrill Lynch was a change in both leadership and the culture of leadership. Over at UBS however, a change in leadership was not necessary.

UBS had successfully developed one of the world’s greatest franchises in private wealth management. Unfortunately, UBS Management thought that that was not enough and decided that they wanted to compete with Goldman Sachs in the investment banking business. An extract from an internal post crisis report read as follows:

It appears that the focus of the IB (investment bank) was revenue growth and filling the gap to competitors…

This headlong pursuit into an area that was not the bank’s traditional strength ultimately resulted in write-offs of some US$ 50 billion and a bailout by the Swiss National Bank.

The reality is that Citigroup, RBS, Merrill Lynch and UBS are all telling us that leadership, strategy, operational complexity and product complexity all far outweigh the importance of risk culture and risk management. In actuality, each of these elements can and will subvert the best efforts of the most well organised and managed risk functions.

As such, we can conclude that any attempt to develop or focus on a separate risk culture within banks and other financial institutions is both meaningless and wholly inappropriate.

An organisation’s culture is the totality of the experiences within it, and how each of those experiences come together to create a product or service. In the next article we will focus on what banks can learn from other industries in how to better manage the totality of risk.

Jonathan Ledwidge is the author of the book Clearing The Bull, The Financial Crisis And Why Banks Need A Human Transformation (iUniverse).


19 responses to “Why Focusing On Bank Risk Culture Is Meaningless

  1. Terrific articles … creating proactive risk management programs within banking institutions is so fundamental, yet so very difficult and challenging without a Board’s and Senior Management’s understanding, acceptance and cooperation to change the way it does business on a daily basis.

  2. Spot on. Clear, concise and accurate

  3. will do .. Jonathan..

  4. Jonathan,
    excellent article, but one whose conclusion I cannot agree with. You are right off course in saying that emphasis on growth will attempt to subvert good risk management, but ultimately it’s about the management. Responsible managers will not allow growth at the expense of loan quality and as such will treat risk as part of the company culture.

  5. Interesting article Jonathan – I fear that many firms are single mindedly still focusing on enhancing their risk and compliance frameworks in the belief that this will satisfy the regulators and restore customer trust. In my opinion this focus is wrong – behaviours, (personal responsibility), and developing a truly “customer” based culture should be the primary aims. I’ll be very interested to read what final conclusions you draw as a way forward.

    • Steve, thanks for your very generous comments.The next article will be on Sunday if you haven’t already signed up to the blog.

    • terrific and indeed, straight to the point. I like to add that the same holds true for other industries – even if they have not been so much in the media. I observe increasing pressure for short term results and profit also in other industries. If incentives are misaligned (and often they are) this lead to short term optimized trade-off decisions. If senior management (and Boards) lack balance, if risk management is not well embedded and if risk managers do have not an equal seat the next cpy crisis may not be far. Only, typically these companies are not too big to fail… never the less, their failure destroys value. Interested to see developments in this area.

  6. I don’t understand the point here, as precisely if the risk culture was properly implemented (or maybe even enforced) in these financial institutions, in particular by factoring in risks in the strategy before heading after new business opportunities and acquisitions, or by assessing the risks before launching new products, with a leadership being accountable to a board on their risk taking, would all these things happen? This is what is not acceptable anymore, and just as in the SOx years, real sanctions including risk of jail for top bankers seem the only way to “force” a minimal risk culture as obviously, from the stories you told, it’s all been “out of control” in the financial sector… and not sure lessons have been learned.

    • The issue is simply not just one of factoring risks into the strategy–it is more correctly having a strategy and a culture of doing business that inherently reduces risk.

      • Even more confusing, now this is in contradiction with the title ….

      • I don’t think that I quite understand you. I am simply saying that the organisational culture and the strategy that it produces is far more important than the risk culture.

        The organisation’s culture and the strategy that is derived from it strategy are ultimately more important in reducing and managing risk than developing a risk culture which in essence is focused on how risks are managed.

        In later articles in the series I demonstrate this by referring to Lean Production where a culture which focuses on quality and safety for the consumer from the early stages of development results in cars which have less defects and are more safe and reliable. I would also invite you to read some of the other articles in the series.

        Thanks very much for your contribution and I am always happy to hear other views.

      • Thanks for the discussion but again sorry to really disagree with you on the definition of risk culture, and the separation with organizational culture. By just “googling” ‘definition of risk culture’ the 1st item that popped in (an article from business week – http://www.businessweek.com/managing/content/may2009/ca20090512_720476.htm ) is pretty clear about it. Unless I dont understand well, you seem to present risk culture as a methodology, a set of tools…
        I think the risk culture is precisely what has been missing in those big Financial institutions (and maybe still not quite there), that the risk culture is not part of their organisational fabric…. I see them as intimately intertwined.
        Not sure how lean production relates to this – I’m not a manufacturing expert anyway 🙂

      • Thanks for the article. It defines risk culture thus:

        It can be defined as the system of values and behaviors present throughout an organization that shape risk decisions. Risk culture influences the decisions of management and employees, even if they are not consciously weighing risks and benefits.

        This is precisely my point.

        On the other hand, the organisational culture is the system of values and behaviors that shape its mission and values–risk culture is a byproduct of this.

        There is more than a subtle difference. Organisational culture and Risk culture are not the same thing.

        I would definitely recommend that you read the other articles in the series and also more about Lean. The one thing that bankers in general have failed to do is learn from other industries.

  7. Stephen Rosling

    An interesting debate – may I add something? I tend to agree with Jonathan – it’s leadership which sets the tone of the organisational culture and its the organisational culture that reflects the tone and behaviours of the people working in it. If it’s all about managing risks and compliance, (checks, controls, audits etc), then I would suggest the culture of the organisation is one where there is no trust between its employees. Taking this a step further, how can an organisation earn and and maintain the trust of its customers, if there is no trust inside the organisation? You need only think of insurance companies – awash with risk and compliance controls – that treat all it’s customers as if they are trying to commit fraud. I understand why they do this, but it doesn’t make for a trusting relationship – inside or outside the organisation.

    • … and we need new leadership in banks with a risk culture under their skin, so that the right tone is set into the organisation culture; again risk culture is NOT risk management. IT IS NOT A BY-PRODUCT, it needs to be in our blood – again, totally disagree with Jonathan. Not an after, a before; a prerequisite! It’s actually probably an issue with basic education of future leaders in business schools (mine back in the days had a course on business ethics and responsible risk taking – but it was a rarity, I hope things have changed now :))
      And about controls, Stephen – I don’t think checks and controls are implemented primarily because of a lack of trust, unless you were thinking of a small business; there are there to help processes operate and companies perform better, because larger enterprises are complex organisms, and no humans can see, understand everything that’s going on, think of all that needs to be done, etc… and yes some are also necessary to reduce risk of malfeasance from a minority that unfortunately always exist. As a realistic customer, I’d rather trust the vendor company knowing they have sound controls, not lack of trust, but rather good governance no?

      • This is how reading the literature of other industries helps and my particular favorite Lean Production. I hope by reading this you can differentiate between a culture of doing things within an organisation as against a culture of risk. The extract is from a blog called leanbuilds…

        Stop the Line manufacturing is a technique introduced by Taiichi Ohno (of Toyota Production System fame) in which every employee on the assembly line has a responsibility to push a big red button that stops everything whenever they notice a defect on the assembly line. When this was first introduced people couldn’t wrap their heads around it; it was part of manufacturing dogma that the best thing you could do as a plant manager was to keep your assembly lines running full steam as many hours of the day as possible so that you’re maximizing throughput. His idea, however, was that by fixing inefficiencies and problems as they occur what you’re doing instead of maximizing your existing process is actually proactively building a better one.

        When he put this system into practice he found that some of his managers took his advice and some didn’t. The managers who implemented Stop the Line had their productivity drop by a shocking amount; they were spending much of their time fixing defects on the line rather than actually producing any goods. The managers who hadn’t listened thought this was a great victory for them, and I can just imagine them feeling sorry for poor Taiichi Ohno who would be ruined for having come up with such a horrible and wasteful idea.

        Before long, however, something strange started to happen. Slowly but surely the managers that had spent so much time fixing defects instead of producing goods started producing their goods faster, cheaper, and more reliably than their counterparts to the point where the caught up with and then exceeded the lines who hadn’t made improvements. The initial investment in improved process and tools had paid off and Toyota went on to be quite successful using this method. Even today their engineers and managers share a cultural belief that their job is not actually to manufacture cars but instead to learn to manufacture cars better than anyone else.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s