Importance of Risk Management in Banking

Importance of Risk Management in Banking The fall of Lehman Brothers and Bean Stearns triggered the financial crisis from 2007 to 2008. In the case of Lehman Brothers, which was one of the largest investment banks with old history in United States, illustrated the importance of appropriate internal risk management with control. Self-interview threat occurred and was leading to the bankruptcy. In the event of lacking enough bank reserve for withdrawal, Bank of East Asia (BEA) chose to enter mass of capital and welcome the public to take freely from the account balance. It would like to increase the stakeholder confidence and is finally success and solve the problem. It is obvious that risk management plays an important role in the financial institutions. Risk management is the management of identification, assessment and prioritization of risks to assess the effectiveness and efficiency of the internal control system and reduce the impact of unexpected events. (ISO 31000, 2009) Without proper risk management, banks are diffi cult to operate with financial difficulties and survive during the financial crisis. An effective risk management also improves Corporate Governance procedures that help to increase investor confidence, transparency and accountability that helps institutions operate efficiently. If any error or missing occurs in the process of risk management, it causes a failure of corporate governance and may result in operating difficulty. In United Kingdom (UK), the Financial Services Authority (FSA) provides framework of risk management (Arrow), risk assessment framework and financial risk outlook (FRO) for financial institutions to understand the major risks. In addition, Turnbull provides a guidance of good internal control with implication of UK corporate governance code that focuses on the quality and extent of risk management disclosures in an organization and thus reduces the impacts. Combined Code (1998) requires the board of director (BoD) to maintain a good internal control system that includes risk management that safeguarding the tangible and intangible asset and ensure the effectiveness of system. In United States (US), the Sarbanes-Oxley Act (SOX) 2002 requires that both management and auditor to maintain a sound internal control system. Section 302 requires management to certify the periodic financial reports and disclose significant internal control deficiencies and section 404 requires management to provide assessment of the internal control and auditors to provide opinion on that assessment. And the generally accepted accounting principles (GAAP) set accounting rules that corporations need to follow, i.e. they need to prepare, present and report the financial statements. In Hong Kong, the international banking regulation Basel III is applicable to banks. And HKMA regulates the economic stability in banking industry. Many large banks, like the Hong Kong and Shanghai Banking Corporation Limited (HSBC), also implement the SOX act, New York Stock Exchange (NYSE) corporate governance rules and USA PATRIOT act of the other countries in the Hong Kong. Internal control plays an important role in enterprise risk management (COSO, 2004 Pagano, 2001) Woods (2008) states the relationship between an effective and efficiently internal control linking with enterprise risk management (ERM). It also claims that management-based internal control includes conflicts of interest for internal auditors, is extremely risky for the financial institution. Harker and Stvros (1998) shows the efficiency of risk management significantly affect financial performance of financial institutions. Without effective risk management, auditing of financial statement and expense of audit may be affected and cause unreliable reports. In the financial crisis from 2007 to 2009, many corporations include banks liquated due to a weak internal control system without an effective risk management. Therefore, a good risk management programme is important to the firm in the Hong Kong banking industry. Hong Kong and Shanghai Banking Corporation Limited (HSBC) is one of the worldà ¢Ã¢â€š ¬Ã¢â€ž ¢s largest financial institutions and thus its risk management will be identified, analyzed and compared with its competitors. Banking regulations and frameworks will be reviewed and key elements of risk management will be identified and compared. The debates will be reviewed and the strength and weakness of internal control of HSBC will be identified. In addition, recommendations for future improvement in effective risk management will be drawn. Aim and objectives of study The aims of the study are to illustrate the importance of maintaining a good risk management programme in the Hong Kong banks and to draw recommendations for the improvement of weaken risk management. To achieve this aim, the objectives have been established: To review banking regulations and framework (Basel III) apply to Hong Kong banking industry To compare and examine the risk management of internal control systems in HSBC and its competitors To review different comments given by its stakeholders during financial crisis (2008) and era To identify the strengths and weakness of an HSBCà ¢Ã¢â€š ¬Ã¢â€ž ¢s risk management To provide conclusions and recommendations for future improvement in effective risk management in financial institutions 1.3 Proposed Chapter Headings: Introduction Importance of Risk management Background The aim and objectives of the study Structure of the dissertation Literature Review Introduction of risk management Kinds of bank risks Credit risk Liquidity riskà ¢Ã¢â€š ¬Ã¢â‚¬  funding risk Interest rate risk Mismatch risk Market liquidityà ¢Ã¢â€š ¬Ã¢â‚¬  market price risk Market risk Foreign exchange risk Regulations framework Benefit of risk management Weaknesses of risk management Causes of business failure Stress Testing Example of banks: Hong Kong and Shanghai Banking Corporation Limited (HSBC), Bank of China (BOC) Government and authority intervention Conclusion An effective internal audit function of an successful case in Hong Kong The weakness of internal control system cause influence and failure of business performance Research Methods Statistical analysis of annual reports of different corporations to compare their differences with internal control systems Data findings Profile of respondents Data analysis Conclusion Recommendation Research direction Recommendations and Conclusions Summary of the actual findings Recommendations for an effective internal control system and risk management Limitations of Corporate Governance Chapter 2 Literature Review 2.1 Introduction of risk management The uncertainty environment leads to financial services products have become more complex and also increase the accountability of regulation. (Collier, 2009) Doyle (2007) shows that there are common material weaknesses in the risk management of complex and rapidly growing. Krishnan (2005) states limited scope of research leads to insufficient disclosure of internal control. Internal control plays an important role in enterprise risk management (COSO, 2004 Pagano, 2001) It includes 4 stages: risk identification, quantitative or qualitative assessment of risks, risk prioritization and response planning. Role of risk management Collier (2009) ALARM 2.2 Kinds of bank risks COSO (2004) defines enterprise risk management as a process applied with strategies to identify and manage potential risks and thus providing reasonable assurance of achieving corporate objectives. Basel I (1999) states banks should use measurement techniques based on robust data. Eccles et al (2001) reviews the US GAAP and SEC and illustrates 4 major risks: market risk, credit risk, operational risk and accounting risk. Then, Fell Devine (2003) demonstrate operational risk should be separated as liquidity risk, insurance risk and group risk. Further, De Wit (2007) recognizes that risks also include legal risk, concentration risk and reputation risk in financial institutions. There is legal risk of possibility of court cases. If they are well-known of providing good service about criminal, more companies would like to create financial relationship them that concentration risk arises. Also, negative publicity, which is uncontrollable and unpredictable, often lead to reputation risk in money laundering case. Collier (2009) states there are many ways of classification of risks. Recently, Besis (2010) states there are 7 major types of risks in banks: credit risk; liquidity risk (funding risk); interest rate risk; mismatch risk; market liquidity (market price risk ) and foreign exchange risk. 2.2.1 Credit risk Credit risk, which is risk of financial loss that creditors fail to execute their obligation of payment, is the main risk in banking industry that potential loss due to counterparty fail to execute payment obligation. (Besis, 2010) Collier (2009) mentioned that credit risk increases the impact of default as it can be transferred to third parties by using securitization. 2.2.2 Liquidity riskà ¢Ã¢â€š ¬Ã¢â‚¬  funding risk 2.2.3 Interest rate risk 2.2.4 Mismatch risk 2.2.5 Market liquidityà ¢Ã¢â€š ¬Ã¢â‚¬  market price risk 2.2.6 Market risk 2.2.7 Foreign exchange risk 2.3 Role of governing bodies in risk management and control International Federation of Accountants Committee (IFAC) concludes the role of governing bodies in risk management and control in public sector. (International Federation of Accountants, 2001, cited in Collier, 2009, p.37) They should ensure to establish an effective risk management in the framework of control. Also, ensuring effective internal audit function includes in that framework. Moreover, they should ensure a framework of internal control is well established with practice and the statement of effectiveness is included in the annual report. Lastly, they should form an audit committee that involves non-executive independent members to provide independent review of the framework of control and external audit process. 2.3 Regulations framework 2.3.1 Basel Basel III is a set of international banking regulations developed by the Basel Committee on banking supervision. It revises Basel I and II that requires a higher level of capital. Basel II, which improves the weakness of Basel I, considers regulatory capital with risks. (Glantz Mun, 2008) Basel II provides three approaches for calculation of risk. A standardized approach is commonly used that requires banks to use standard risk assessment to calculate the risk weightings. Next, internal ratings-based (IRB) foundation approach that is based on internal assessment in probability of default from counterparty (PD), quantified estimates of exposure at default (EAD) and loss given default (LGD) can be applicable. And the third approach is called IRB advanced approach, which is based on own internal assessment in PD, EAD and LGD. 2.3.2 Benefit of risk management Weaknesses of risk management Causes of business failure Fight (2004) states that many industry surveys analysed 5 top causes of business failure. First of all, it states cyclical decline in demand is at the top of the five causes. Recession is not the main factor of failure but the element that helps to show the weakness of risk management in firms. It mentions some examples of weakness, such as poor competitive position, problem in internal control of quality and financial and weak capital and liquidity ratios. With these weaknesses, firms lost competitive advantages and cannot fulfill customer needs and also lead to decline in demand. Next, poor top management is followed. Thirdly, lacking of centralized financial control Fourthly, bad acquisition or inadequate integration strategy. The fifth is inappropriate product or market strategy Except the cyclical decline in demand, the other four causes are related to management. It is showed that management of firms plays an important role of survival in economic downturns. Regarding to the case of Lehman Brothers, the creditor fail to execute their obligation of payment that the demand of mortgage or loan was dropped. 2.5 Stress Test 2.6 Example of banks 2.6.1 Hong Kong and Shanghai Banking Corporation Limited (HSBC) Hong Kong and Shanghai Banking Corporation Limited (HSBC) is a world-wide diversified banking group that involves in different business and activities since 2005. It takes conventional strategy in its entities in different areas, such as Europe, Hong Kong, Rest of Asia Pacific, Middle East, North America and Latin America. HSBC Holdings plc (2009) mentions that there are many factors vary the risks in HSBC, such as environment change. vary the degrees, measurement, evaluation of its risk management. mentions there are 4 main types of risks: credit risk, counterparty credit risk, market risk and operational risk in its business. Its credit risks arise from failure of receiving payment by customers or counterparties in its business, such as direct lending, trade finance, leasing business, guarantees, derivatives and debt securities. It applies 3 approaches in Basel international banking regulations to calculate the counterparty credit risk and determine exposure values. The three approaches are standardized, mark-to-market and internal model method (IMM). HSBC adopt the standardized approach and mainly adopt the IRB advanced approach to eliminate the credit risk. In addition, counterparty credit risk is risk of economic loss that counterparty may default in transactions arises from offer-the-counter (OTC) derivatives and securities financing transactions. HSBC uses the mark-to-market and IMM approaches to reduce the counterparty credit risk. Market risk is the risk of lower income or portfolio value with market risk factors, including foreign exchange rates and commodity prices, interest rates, credit spreads and equity prices. To get rid of it, HSBC applied standard rules of financial services authority (FSA) and value at risk (VAR) models. Lastly, operational risk is a risk of potential loss by imperfect internal processes and systems or external events. Actually, it also includes technological and legal risks. HSBC employed the standardized approach to determine its operational risk in group. To control risks in the IT area, 3 ways is implemented. First, it uses risk bases project management (RBPM) and a global HSBC tool that is called clarity tool to control the software development life cycle and ensure the consistency and efficiency of management. Second, a disaster recovery plan (DRP) is implemented. For example, it is used to recover system in the case of disasters to ensure the continuity of system. Third, it maintains a secure and reliable governance structure to control and response to the technological risk in different departments. For instance, senior management committees are responsible for managing the risk. The committees consist of HTS Steering Committee, Risk Management Committee (RMC), Operational Risk and Internal Control Committee (ORICC). In the way of managing legal risk, HSBC concerns with contractual, litigation, legislative or regulatory, reputation and non-contractual rights. In addition, it established policies and procedures, estimates potential losses from the judicial or administrative resolutions, disclose the relevant information. Moreover, it established policies and procedures for the identification, measurement of legal risk to eliminate or reduce the possible loss due to the non-performance of the norms and avoid adverse resolutions. 2.6.2 Bank of China (BOC) Bank of China applied the stress testing. 2.7 Government and authority intervention Woods et al (2009) states without perfect credit risk management, the survival of numerous financial institutions in the financial crisis relies on financial support or taking-over by government. In United States, Lehman Brothers, Bear Stearns and Merrill Lynch collapsed because of no financial support to continue the business. On the contrary, United Kingdom mortgage providers, Northern Rock and Bradford and Bingley, survive in financial crisis as had been taken over by government. In addition, Derbyshire Building Society and the Cheshire Building Society faced substantial problems and then survived as it had been taken over by the Nationwide, a large mortgage lender with a stronger capital base. Starting from summer 2007, accumulating losses on sub-prime mortgage triggered financial tsunami in the global financial system. The paper analyzes that banks and mortgage providers using special purpose entities (SPE), collateralized mortgage obligations (CMOs) or collateralised debt oblig ations (CDOs) and illiquidity as the problems Financial Services Authority (FSA) provides operating framework (Arrow II), risk assessment framework and regulations for financial institutions. 2.8 Conclusion Chapter 3à ¢Ã¢â€š ¬Ã¢â‚¬ Research method The research is mainly based on quantitative research by obtaining statistical data, such as complaints or commercial crimes, and related to annual reports and financial statement. Reports from Hong Kong Monetary Authority (HKMA) and Securities and Futures Commission (SFC) will be a part of source to analyze the data as it is easily assessed and convenient in obtaining data. In addition, the risk management system of 10-15 limited companies will be examined and compared. It helps to define the strength and weakness between different risk management systems under sudden events. It supplements questionnaires collection and theoretical research. Questionnaires collection is also used as an instrument in obtaining useful information. To obtain relevant information from stakeholders, questionnaires about satisfaction of financial institutions will be collected and some samples will be further conducted by face-to-face survey. And theoretical research is taken place on reviewing information of theories and practices about an effective internal control system with suitable risk management from academic journals and textbooks. 3.2Limitation: It is difficult to assess information because the internal information is not related to the operation that source is limited and limited samples are not be sufficient to conclude subject to risk management. In other words, recommendations are not be sufficient for the whole banking industry. In addition, the online questionnaires do not have a large number of respondents as the respondent rate is limited due to many reasons. For example, some people do not interest in filling questionnaire and some people feel trouble to complete the questionnaire. Chapter 4 Profile of the respondents A survey was conducted in late 2010, from October to November. Online questionnaires were collected from 30 respondents to understand their confidence level of banks in Hong Kong whether it is influenced by the occurrence of financial crisis and also obtain recommendations of risk management in Hong Kong banks for improvement. There are 25 questions in a questionnaire (see appendix) and it is formed as 3 parts: Personal Details; Before Financial Crisis (2007 -2008); After Financial Crisis (2007 -2008). The first 5 questions are about à ¢Ã¢â€š ¬Ã…“personal detailsà ¢Ã¢â€š ¬?. For question 6 to 8, questions are part of à ¢Ã¢â€š ¬Ã…“before financial crisisà ¢Ã¢â€š ¬?. And questions 9 to 25 are focused on à ¢Ã¢â€š ¬Ã…“after financial crisisà ¢Ã¢â€š ¬? that shows present. The major findings drew from the questionnaires are concluded as below. Personal Details Question 1: What is your gender? Female Male Total 16 14 30 In the online questionnaires, there were 30 respondents that slightly more than half of them are Female while slightly less than half of them are male. Question 2: What is the range of your age? From the questionnaires, it was found that the respondents are mainly youngsters which are most (26 in 30 respondents) in the range of 18 to 29 years old. And there are a small number of respondents (2 in 30 respondents) in the range 30 to 39 years old and (2 in 30 respondents) the range of 40 to 49 years old. Question 3: What is your education level? According to results of questionnaires, no respondents are educated under primary level. Three fifths of respondents achieve the degree education whereas the minority of them, 2 in 30 respondents, reach the master or above education level. And the other two sixths of respondents completed secondary to diploma education. Question 4: What is the range of your monthly salary? It is showed that half of the respondents have monthly income less than $5000 while one fifth of them have over $5000 but lower than $10000 and the other one fifth have monthly income between $10000 and $19999. The minority of respondents got income more than $20000 each month that one respondent got more than $20000 but less than $30000 and two respondents got more than $30000. Question 5: What is your role in bank? The respondents are mainly customers in banks that there are over 90% of them, 28 in 30 respondents, as the role of customers and less than 10%, 2 in 30 respondents, of them as the role of employees in bank. Before Financial Crisis(2007-2008) Question 6: Before financial crisis (2007 2008), what was the percentage of your salary you spend on saving in a bank each month? Before financial crisis (2007 2008), almost two fifth (37%) of respondents expressed that they had habit of saving. Only a few of them spent their salaries mostly on saving while a minority spent much more on saving every month. And one in six respondents spent almost half of salary on saving. In the meanwhile, three fifths of them spent fewer while a few respondents spent slightly fewer or none on saving. Question 7: Before financial crisis (2007-2008), did you invest in stock of Hong Kong banks, such as HSBC? Over 70% of respondents, 73%, said that they had habit of investment in Hong Kong stock before financial crisis (2007-2008) while slightly less than 30%, 27%, had not invested. Question 8: Before financial crisis (2007-2008), what was the percentage of your salary you spend on investment each month? Before financial crisis (2007-2008), most of respondents had habit of investment. Three fifths of respondents had spent much more and majority or all of salary on investments each month. For example, less than half of them, 43%, had spent the majority and almost all of salary (80% 100%) on investment while one sixth had spent 60% to nearly 80% of salary. And a small number of them, 10%, had spent almost half of salary (40% 59.99%) on investment while nearly one quarter (23%) of them had spent fewer (25% 39.99) on investment. But, few respondents, 7%, said that they had not invested or spent slightly fewer on investment. Question 9: Did you have habit of checking your balance in your current accounts /investment accounts in banks? And how often did you check your balance each month? Before financial crisis (2007-2008), none of the respondents never check their current account or investment account balance. One in three respondents showed that they seldom (1 to 7 times per month) checked their balance in accounts while half of them often checked their accounts over once a week and nearly once per two days (8-15 times per month). And one in five respondents usually checked their accounts (16-30 times per month). After Financial Crisis (Present) Question 10: Do you own any current accounts for saving in banks? How many banks do you own current account? All respondents have current accounts for saving in banks in Hong Kong. One-fifth of respondents reported that they only owned current account in one bank while almost most of them, 77%, said that they owned current accounts in from two to four banks. In addition, only one respondent responded that hold current accounts in more than five banks. Question 11: What is the percentage of your salary you spend in saving each month? It is showed that most of the respondents have habit of saving. Almost a quarter of them, 23%, spend much more on saving while about two fifths of them, 41%, spent majority or almost all on it. Also, no respondents spend almost half of salary (40%-59.99%) while a minority of them reported they spent fewer and nearly a quarter of them reported they spent slightly fewer and almost none on saving. Question 12: Do you invest in stock Hong Kong banks, such as HSBC? After financial crisis (2007-2008), three fifths of respondents said that they had habit of investment in stock of Hong Kong banks while two fifths did not invest. Question 13: Do you own any investment accounts in banks? How many banks do you own current account? Most of the respondents own investment accounts in Hong Kong banks. For illustrate, more than half of respondents, 73%, only own investment accounts in a bank while 1 in 10 respondents own an investment account in two to four banks. And one-sixth of them, 17%, do not own any investment account and. However, no respondent hold investment accounts in more than five banks. Question 14: What is the percentage of your salary you spend on investment each month? More than half of respondents reported that they spent their salaries less on investment. One third of them spent slightly few and almost none of their salary on investment while one fifth spent fewer as well as the other one fifth almost spent half of it on investment. On the other hand, a small number of them, 10%, responded that they spent much more while 1 in 6 respondents spent most and almost all on investment. Question 15: Do you have habit of checking your balance in your current accounts/ investment accounts in banks? And how often do you check your balance each month? After financial crisis, none of the respondents never check their current account balance. Nearly three fifths of respondents,57%, reported that they seldom (1 to 7 times per month) checked their balance in account while one fifth of them often checked their accounts over once a week and nearly once per two days (8-15 times per month). In addition, about a quarter of them checked their accounts frequently (16-30 times per month). Question 16: After financial crisis (2007-2008), what do you pay attention to the bank before investment in it? (Answers can be chosen more than one.) The table shows the issues about bank whether respondents pay attention to before investment or not. After financial crisis (2007-2008), the respondents mainly pay attention to the news about the bank and also the banking industry before investment. Nearly three quarters of them, 73%, pay attention to the news about the bank and banking industry to concern about their investment. In addition, one-fifth of them pay attention to the risk management of the bank to concern whether risks are minimized and properly controlled. And the other one fifth also pay attention to relevant court cases while three in ten respondents focus on the changes in its share price. However, only a minority pay attention to the big issues, such as big loss or financial difficulties. Question 17: What element(s) do you think it is important in risk management? The table illustrates that importance of elements in risk management respondents revealed. Regarding to questionnaires, almost two fifths of the respondents thought identification of risk was important in risk management while about two thirds of them did not. About assessment of risks, nearly third fifths (57%) of them agreed it was an important element while more than two fifths of them (43%) disagreed. In addition one third of respondents expressed that internal control is an important element in risk management. However, only a minority of respondents, 4%, totally agreed that identification, assessment, and prioritization of risks and the internal control are important in risk management. Question 18: Do you trust the risk management of bank can ensure steadily operation with lower risks to prevent bankruptcy? Two thirds of respondents reflected they trusted the risk management of bank that can ensure it operating steadily with lower risks and prevent bankruptcy while one third said that they did not trust it. Question 19: What is the level you rely on the risk management of bank? After financial crisis (2007-2008), a small number (10%) of respondents reflected that they extremely relied on the risk management of bank while one fifth said that they more relied on it. Half of them remained neutral whereas a minority less relied and a few respondent never rely on the risk management of the bank. Question 20: After financial crisis (2007-2008), have your confidence in bank been cracked? About two fifths of respondents, 37%, thought their confidence in bank had not be cracked after financial crisis (2007- 2008). Nevertheless, half of them reflected their confidence were partly impaired while a minority (13%) revealed that their confidence were mostly damaged. Question 21: What is (are) the issue(s) that impair your confidence in the bank and make you think that it has weak risk management? The chart illustrates the issues whether it can impair their confidence of respondents and affect their investment decision in the bank. According to the responds, a majority of respondents, 90%, thought occurring liquidity problem and big loss can impair their confidence in the bank. And 70% of them expressed that weaken defense of risks and without experience of facing financial crisis can lead to bank have a weak risk management and also impair their confidence. Besides, slightly more than a quarter of them, 27%, considered human resources problem was one of the elements of weak risk management. For example, improper authorization and delegation policies lead to conflict of interest exists in the bank. Moreover, nearly one-fifth thought operating without following regulation, such as Basel framework, is more likely to maintain weak risk management. Finally, only a few of them, 7%, responded that involving in court case impair their confidence in bank and they might think it had we ak risk management Question 22: Do you read the annual report of bank to understand its risk management before investment? The above chart shows that one third of respondents responded that they saw annual report of the bank before investment to understand its risk management. However, two thirds of them expressed that they did not. Question 23: Do you think these banks have good risk management? In five Hong Kong banks, respondents expressed which banks they think have good risk management. As a result, most of them commented HSBC had a good risk management while only one third thought Bank of China had a good risk management. Also, half of them expressed that Hangseng Bank had good risk management while the other half disagreed that. Concerning to standard chartered bank, only one fifth thought its risk management was good. Moreover, slightly less than twenty percent of them reflected that Citibank had good risk management. Question 24: What rank do you give for the risk management of HSBC? (Please rank from 1to 5: 1 is weakest; 5 is best) Rank of HSBC Number of respondents