Feeling pressure to build revenues, many banks are turning to new products. It's up to boards and management to drive the risk mitigation planning process.

1. Banks are feeling pressured to build revenues in
a low-interest environment, but raising fees and
cutting costs are not the entire answer to declining
loan growth and margins. As a result, banks across
the United States are increasingly turning to new,
expanded or modified products.
New products mean new risks, however, and it’s up
to boards and management to drive the risk mitigation
planning process. Office of the Comptroller of
the Currency (OCC) Bulletin 2004-20 details the
processes that banks should follow to implement an
effective risk management process when introducing
new, expanded or modified bank products and
services. Although this guidance has been around since
2004, it is especially useful in the current environment.
Good governance for
new bank products
Potential new product risks to earnings/capital
• Strategic risks: Risk from adverse business decisions
or the improper implementation of those decisions
• Reputational risks: Risk from negative public opinion
–– Credit risks: Risk from an obligor’s failure to
meet the terms of any contract with the bank or
otherwise fail to perform as agreed
–– Transaction risks: Risk from problems with
service or product delivery
–– Compliance risks: Risk from violations of laws,
rules or regulations, or from nonconformance
with internal policies and procedures or ethical
standards
It’s up to boards and management
to drive the risk mitigation
planning process.
What the OCC expects
The OCC is looking for three must-have process areas:
1. Risk management controls and processes.
Review established risk management processes
to confirm they are optimally designed and
operating effectively. Revisit these processes when
introducing new, expanded or modified products,
because they may no longer mitigate the risks
being introduced.
2. Performance monitoring. Establish processes to
monitor product performance and ensure that it is
performing as expected. Measures include reviews
to establish that transactions are within specified
limits, benchmarks to determine whether the
product is performing as expected, and a plan for
developing and implementing an exit strategy.
3. Risk management of third parties. While third-party
vendors can assist a bank in achieving its
strategic objectives, they can also introduce new
risks. OCC Bulletin 2013-29 provides guidance on
third-party relationships.

2. 2
The banking industry must act now
Banks cannot afford to wait. As evidenced by the recent punitive damages arising from poor control processes, it is clear that the regulatory environment is becoming less forgiving when risk mitigation is not taken seriously. Banks should have a robust governance process to prove to regulators that they are well-aware of new product risks and have mitigation processes in place.
Tone from the top is key
The board and leadership must drive the risk mitigation process. The tone from the top is critical in effectively developing new, expanded or modified products. According to Teresa Curran, senior vice president and banking supervision and regulation division director at the Federal Reserve Bank of San Francisco, “Management teams that successfully identify and roll out new products and services typically have a documented, repeatable and auditable process to guide their decision-making. In practice, this often means that the board approves and the management team follows comprehensive new product policies and procedures, documents decisions sufficiently, and ensures that all relevant functions within the organization appropriately engage with one another.”
The regulatory environment is becoming less forgiving…
Where to begin
A strong approach to new product governance begins by establishing and assessing governance frameworks to confirm they are designed and operating as intended. Key pillars of a successful strategy include:
•
Leadership buy-in. Senior (or C-suite) executives must be deeply involved in developing a strong new product governance framework. Leadership must also ensure all levels of the organization are involved in the process.
•
Policies and procedures. Comprehensive, carefully defined policies and procedures must be in place. Formal roles and responsibilities of all involved in the new product process, formal risk assessments and documentation of discussions with regulatory bodies must be included in the bank’s overall governance framework.
•
A formal approval process. The approval process must include senior management, and consider the product’s risks, impact and mitigating processes.
•
Centralized identification and tracking process. A centralized process that identifies and tracks all new products and commitments made by the business to the approval committees, and in some cases, the regulatory bodies.
•
Continued discussions after product launch. A standing meeting should be held where product owners can attest and show evidence to the relevant approval committees that what was approved was implemented.
•
A formal reporting process. Financial institutions should confirm that correspondence to the regulatory body is formal, tracked and retained.
Good governance for new bank products

3. Good governance for new bank products
Conclusion
For boards, a thorough understanding of the risks and
risk mitigation process is critically important when
introducing a new product. Weighed against any
identified risks, the benefits must be compelling. Only
those who make an accurate assessment, in line with
their fiscal responsibilities, will avoid undue scrutiny.
Content in this publication is not intended to answer specific questions or suggest suitability of action in a particular case. For additional information about the issues
discussed, consult a Grant Thornton LLP client service partner or another qualified professional.
“Grant Thornton” refers to Grant Thornton LLP, the U.S. member firm of Grant Thornton International Ltd (GTIL). GTIL and its member firms are not a
worldwide partnership. All member firms are individual legal entities separate from GTIL. Services are delivered by the member firms. GTIL does not
provide services to clients. GTIL and its member firms are not agents of, and do not obligate, one another and are not liable for one another’s acts or
omissions. Please visit grantthornton.com for details.
© 2014 Grant Thornton LLP | All rights reserved | U.S. member firm of Grant Thornton International Ltd
Connect with us
grantthornton.com
@grantthorntonus
linkd.in/grantthorntonus
Contact
Mark Springer
Experienced Manager
Business Advisory Services
Grant Thornton LLP
T +1 212 542 9762
E mark.springer@us.gt.com
Jack Katz
Global Leader
National Managing Partner
Financial Services
Grant Thornton LLP
T +1 212 542 9660
E jack.katz@us.gt.com
The board’s role
The banking crisis of 2008–2009 included harsh
lessons for financial institution boards regarding the
questions they didn’t ask and the governance they
didn’t provide. In “The New Risk Paradigm for Corporate
Governance,” a 2011 article in Chief Executive, authors
Leo M. Tilman and David Martin posed these seven
essential questions for boards:
1. Do we fully understand our institution’s risk
exposures?
2. Are our risk exposures appropriate relative to
earnings objectives, risk appetite, capital levels and
desire for long-term sustainability?
3. Is our organization adequately dynamic from the
viewpoint of risk management?
4. How do risk and uncertainty factor into our strategic
decisions?
5. Do we have an integrated, firmwide risk
management process?
6. Are professionals at all levels empowered to
manage risk?
7. Does the company have an appropriate risk
management culture?