Risk Minds USA 2013

1. Risk Minds USA 2013 Risk Governance and Risk Management: Oxymorons? J. V. Rizzi June, 2013 Macrostrategies, LLC Macrostrategies, LLC

2. Table of Contents • Introduction • Decisions • Governance • Why Change • Conclusion Macrostrategies, LLC

3. Introduction Macrostrategies, LLC

4. Introduction Risk governance worked, except for “rare” exceptions… • Never attribute to malice or stupidity that which can be explained by moderately rational individuals following incentives in a complex system of interactions. – Douglas Hubbard • Purpose of governance is to protect the institution from being driven by the narrow interests of an individual or group of individuals. • Absent governance, the institutional imperatives takes hold: 1) an institution will resist any change in its current direction; 2) business cravings of the leader(s), however foolish, will be supported by detailed rate-of-return and strategic studies prepared by his troops; 3) behavior of peer companies will be mindlessly imitated. – Warren Buffett Role of the Board is to understand and monitor senior management behavior to protect shareholder interests… …like financial crisis, MF Global, London Whale…ha. Macrostrategies, LLC

5. Introduction Continued Process (Governance Puzzle: How to resist excessive risk e.g. JPMC Big Whale… Governance (Board) Montoring & Rebalancing Investment Strategy & Risk Appetite Performance (Asymmetric information) …taking in benign market(s). Macrostrategies, LLC

6. Decisions Macrostrategies, LLC

7. Social Decision Making (The birds do it, the bees do it… • Herding • Safety in Numbers • Peer Comparisons • Cycle Amplifications • Momentum • Liquidity • Leverage • Information Cascade • Feedback Loops • Self-fulfilling Prophecies …everyone is doing it.) Macrostrategies, LLC

8. Statistical Bias (Risk as a challenge to overcome… • Fooled by Randomness • The star banker problem • Risk vs. uncertainty • Extrapolation • Historical experience • Mean reversion • Model Struck: illusion of knowledge • Market efficiency • Liquidity • Rational Participants …or an uncontrollable chance outcome?) Macrostrategies, LLC

9. Disaster Myopia (The influence of Risk Management… Defined: underestimate the impact of low probability high impact events. • Psychological Basis • Availability • Threshold • Reinforced by internal accounting & bonus schemes • Line managers • Breakdown of pricing • Herding • Impact …decreases by the square of the time since the last crisis.) Macrostrategies, LLC

10. Group Think (If it cannot go wrong – it will.) • Group Think: Shared Reasoning Deficiency • Sources • Conformity • Organizational Pressures and Optimism • Expert Illusion • Results • Married to positions • Absence of critical thinking • Lack of exit or downside plan • Denial (Fools are always certain, while the wise are doubtful.) Macrostrategies, LLC

11. Decisions at Risk (DAR) (Who decides… Uncertainty &Behavioral BiasAmplifiersControl Asymmetric Over Confidence Incentives Internal Information Illusion of Control Bureaucracy - Board monitoring Beyond the data Hindsight Bias Opaque - Incentives events: Anchoring Accounting - Sanction - Experiences Leverage External - Exposures Complexity - Regulators Black Swans - Rating Agencies Adverse Selection - Marked for Control Moral Hazard …how do they decide?) Macrostrategies, LLC

12. Governance Macrostrategies, LLC

13. Governance Failure (We do not need better models… • Unnoticed Risk Appetite Change • Failure to understand Risk Implications of Strategy • Inconsistent capital Structure and Stakeholder Communications • Top management and Board failed to understand arcane models • Entering new activities can misalign incentives requiring organizational, compensation and control structure changes …we need better governance.) Macrostrategies, LLC

14. The Board and Risk Management (Ignorance is not bliss… Although 90% of directors say they understand the risk implications of the current strategy… • Only 77% of directors say they understand the risk/return tradeoffs underlying the current strategy. • Only 73% of directors say their companies fully manage risk. • Only 59% of directors understand how business segments interact in the company’s overall risk portfolio. • Only 54% have clearly defined risk tolerance levels. • Only 48% of boards rank key risks. • Only 42% have formal practices and policies in place to address reputational risk. Source: The Conference Board …it is rot.) Macrostrategies, LLC

15. Governance Culture (I admire individuals unafraid to speak their minds… • Rewards for Risk Taking • Acceptance of Bad News • Internal Competition Level • Performance Pressure • More than Compliance • Hero Worship and the Great Man Problem • Succession Plan …even if it costs them their job. – L.B. Mayer) Macrostrategies, LLC

16. Information Management (Risk management as… • Organizational and Transaction Complexity and Transparency. • Diagnostic Performance Gaps • Extent of Decentralization: decisions made without direct senior management oversight. • Board Awareness/Board Understanding • Judgment vs. Models • Illusory profits given inadequate reserving • Ability to put organization at risk • Speed • Financial risks are opaque and do not immediately manifest themselves • Track records of limited use • Difficult to distinguish luck vs. skill …exposure measurement and accounting.) Macrostrategies, LLC

17. Board Focus (In God we trust… • Risk Appetite • Relative to capital • Limit Setting • Monitoring • Discipline • Reward • Succession Plan • Annual Independent Assessment of Risk Governance Framework …every else must bring the data.) Macrostrategies, LLC

18. Board Independence and Quality (Do you want to believe what you see… • Size • Outside to Inside Ratio • Lead Director • Dedication: limit number of directorships • Splitting CEO – Chairman Roles • Meeting Frequency • Experience • Compensation • Financial commitment: eat own cooking • Selection and Tenure • Limit tenure • Chair Board Committees with Independent Directors • Risk • Compliance • Compensation …or what I am telling you?) Macrostrategies, LLC

19. JPM Chase 2012 Management DiscussionWhale Lessons Learned (Now they tell us… • Fight Complacency: do not assume tomorrow will look like today, especially after a long period of good times. • Overcome Conflict Avoidance: ask hard questions. • Control Must Match the Size of the Risk Involved: big bet your bank type risk exposures require rigorous review process • Trust but Verify: make them verify their plans – do not blindly assume they are correct. • Do Not Shoot the Messenger: encourage surfacing problems before they become fatal. …do they believe it, and if so for how long?) Macrostrategies, LLC

20. Why Change Macrostrategies, LLC

21. Regulatory (Beware turning risk management and governance… • CAMELS: management “m” to include Board competence and engagement • Dodd Frank • Risk committee requirement: $10B ≤ assets < $50 • Chaired by independent direction; one risk management professional • Chief Risk Office requirement: assets ≥ $50B • Reports to risk committee and CEO • Components • Risk Appetite: policies and processes for risk oversight • Monitoring: management compliance with risk limits • Control: management of risk exposures and controls …into a compliance and audit function.) Macrostrategies, LLC

22. Shareholder Activism (Change before… • Just one crisis away from shareholder action • JPM • Goldman • Non-banks • Activists • Supporters • Advisors • Pensions …being changed.) Macrostrategies, LLC

23. Conclusion Macrostrategies, LLC

24. Conclusion (Purpose of governance is to protect institution from being… • Role of Board: understand and monitor senior management to protect shareholder interests • Beware of Bias • Judgment vs. Model • Risk Appetite • Risk Management vs. Risk Measurement • Duty of Care …manipulated towards narrow management interests.) Macrostrategies, LLC