How to Measure and Mitigate Conduct Risk

Enterprise Risk · Credit Risk · Market Risk · Operational Risk · Regulatory Compliance · Securities Lending
1
JOIN. ENGAGE. LEAD.
HOW TO MEASURE AND
MITIGATE CONDUCT RISK
By RMA’s Market Risk Council
From The RMA Journal, June 2017

2
JOIN. ENGAGE. LEAD.
$321B
Fines since the
financial crisis.
In March 2017, the Boston
Consulting Group provided
the latest tally on the fines
financial institutions have
paid globally since the
financial crisis: a
staggering $321 billion.

3
JOIN. ENGAGE. LEAD.
MISCONDUCT FINES
Potential misconduct fines are
now one of banking’s biggest
risks.
They can determine the
direction of CET1 capital ratios
and motivate the need for
capital raises and business
restructuring.

4
JOIN. ENGAGE. LEAD.
MISCONDUCT FINES (CONT.)
Operational
Risk
• Generally, conduct risk has
been lumped into the
category of “all other risks” in
the operational risk basket.
• But now that it can be a large
part of operational risk—
sometimes, in and of itself,
ranking alongside credit and
market risk—it’s time to start
measuring it.
All other
risks
Operational
risk

5
JOIN. ENGAGE. LEAD.
C
B
A
Institutions need to
collect metrics
associated with
conduct risk and
aggregate these
metrics to answer
the question,
“Are we getting
better or worse?”
These are huge
challenges.
Then they have
to identify actions
that will improve
the risk profile.
METRICS

6
JOIN. ENGAGE. LEAD.
Profiling
conduct risk
Strategy and
financials
Inherent
conduct risks
External
factors
To address conduct risk,
RMA’s Market Risk Council
describes best practices in
measuring and monitoring
conduct risk and in enacting a
conduct risk policy for capital
markets activity.
While institutions have not
yet finished evolving their
practices, lessons can still
be learned from the ones
that seem to be working.
BEST PRACTICES
Conduct risk
metrics
Conduct risk
& market risk
Embedding
Governance

7
JOIN. ENGAGE. LEAD.
Profiling Conduct Risk

8
JOIN. ENGAGE. LEAD.
PROFILING CONDUCT RISK
Conduct risk is not like
financial risks, where there
are well-developed metrics
and ways of aggregating and
slicing and dicing to identify
risk concentrations.
But organizations still need a
way—from the board down
to the trading desk—to
understand and appreciate
the conduct risk profile.

9
JOIN. ENGAGE. LEAD.
PROFILING CONDUCT RISK (CONT.)
The Market Risk Council
recommends 1) working across
the organization to understand
the sources of conduct risk and
2) collecting data indicative of
good or bad conduct.

10
JOIN. ENGAGE. LEAD.
• The key is to find forward-looking indicators of potential
areas of concern.
• Ex-post measures like fines are great metrics, but banks
must look into the future for possible occurrences of
unacceptable conduct.

11
JOIN. ENGAGE. LEAD.
A risk management executive from
RMA’s Market Risk Council said his
bank’s capital markets operation sought
input from the senior executives from all
business lines and support functions.
“From this, we built conduct risk profiles
for each business,” he said. “Some parts
of the profiles were highly descriptive,
but served to provide important context.
Other parts of the profile were much
more data-driven and provided the
familiar ‘traffic light’ system of
red/amber/green status.”

12
JOIN. ENGAGE. LEAD.
Another difference between
conduct risk and financial risks
is that there is no appetite for
conduct risk, whereas banks
take finely judged approaches
to credit and market risk
appetite in the hope and
expectation of reward.
This is not a risk that
needs to be taken in
pursuit of profits, and it
has no place in any
institution.
Expressing an appetite to
take conduct risk would
send entirely the wrong
message to an
organization and the
market.
PROFILING
CONDUCT RISK (CONT.)
Risk
Appetite Don’tsend
the wrong
message
Not needed
for profits

13
JOIN. ENGAGE. LEAD.
Strategy and Financials

14
JOIN. ENGAGE. LEAD.
The performance of a
business should be
examined across the
products offered, the
customer base, areas
of operation, and
technology changes.
STRATEGY AND FINANCIALS
Areas of
operation
Products
Technology
Customers
Business
Performance

15
JOIN. ENGAGE. LEAD.
The aim is to highlight how
a significant change in any
of these areas could trigger
an environment of higher
conduct risk.
For example, a recent poor
financial performance could
lead to riskier sales practices.
STRATEGY AND FINANCIALS (CONT.)
Conduct
Risk
Areas of
operation
Products
Technology
Customers

16
JOIN. ENGAGE. LEAD.
Inherent Risks

17
JOIN. ENGAGE. LEAD.
INHERENT CONDUCT RISKS
All businesses contain inherent conduct risks.
Institutions should:
Fully communicate
them to staff.
Describe the
mitigants.
Identify operations
and staff with the
most significant
residual risk.*
*The amount of risk remaining after taking mitigants into account.

18
JOIN. ENGAGE. LEAD.
INHERENT CONDUCT RISKS (CONT.)
All businesses contain inherent conduct risks.
For example, in investment banking, one of the most significant
inherent risks is the failure to adequately control material nonpublic
information. Mitigants can include:
Physical separation of
the business from
other areas.
Segregation of IT
systems.
Regular training,
monitoring, and
surveillance of the
effectiveness of the
Chinese walls.

19
JOIN. ENGAGE. LEAD.
External Factors

20
JOIN. ENGAGE. LEAD.
Example
Other
factors
The continually evolving
regulatory landscape limits
conduct risk by enforcing
greater discipline, e.g., the
requirement for greater
product-suitability testing,
in particular post-sale
monitoring of product
performance.
On the other
hand, other
factors could help
increase risk.
Low interest rates lead
to stronger customer
demand for higher-
yielding investments,
which are likely to be
riskier.
External
Factors Play a
Role in Risk

21
JOIN. ENGAGE. LEAD.
Conduct Risk Metrics

22
JOIN. ENGAGE. LEAD.
CONDUCT RISK METRICS
Each institution will want to
determine the metrics most
pertinent to it.

23
JOIN. ENGAGE. LEAD.
CONDUCT RISK METRICS
Institution-wide:
• Current and complete staff mandates.
• Successful completion of mandatory online training.
• Completion of mandatory on-boarding training for new joiners.
• Adherence to a continuous mandatory absence period by all
employees.
• Regular reviews of all building key cards for appropriate access.
• Strict adherence to IT control protocols (passwords, network
access).
Business line
(for a trading
business):
• Compliance with all market risk and counterparty credit risk limits.
• Daily P&Ls signed off on time.
• Count of cancels and amends.
• No independent price verification discrepancies over thresholds.
In the following example, a bank has divided its risk-mitigation metrics
into two sub-sets—institution-wide and business specific.

24
JOIN. ENGAGE. LEAD.
CONDUCT RISK METRICS (CONT.)
A best practice is
to set
red/amber/green
thresholds for
these metrics
and track
quarter-on-quarter
changes as a
forward-looking
indicator of
problems.
A change with
any one metric
may not have
any significance
on its own, but
consideration of
such changes
may be useful in
trying to discern
any slippage
toward a culture
of noncompliance
with policies and
procedures.
Set red/amber/green
thresholds

25
JOIN. ENGAGE. LEAD.
Conduct and Market Risk

26
JOIN. ENGAGE. LEAD.
CONDUCT RISK AND MARKET RISK
One of the most
obvious areas of
potential conduct risk
is when trading-floor
staff breach limits set
by risk management.

27
JOIN. ENGAGE. LEAD.
CONDUCT RISK AND MARKET RISK (CONT.)
This is one of the easier
metrics to collect and track,
and it is also quite revealing.

28
JOIN. ENGAGE. LEAD.
Some may suggest that,
prior to 2008, the
occurrence of limit
excesses—e.g., market
and counterparty credit
risk—was almost seen
in a positive light as a
way of ensuring strong
engagement, active
dialogue, and challenge
between traders and
risk managers.
An absence of limit
excesses could
mean that risk
managers have
become isolated and
disconnected from
the actuality of
trading in markets.
Priorto2008
Incontrast

29
JOIN. ENGAGE. LEAD.
A best practice is to review all limit metrics to ensure
that limits are tightly aligned with risk appetite.
• Take market-making activities, for example. To
comply with Volcker Rule controls, inventories
could be calibrated to meet the regulation’s
“reasonably expected near-term demand”
standard.

30
JOIN. ENGAGE. LEAD.
A member of RMA’s Market Risk Council said that his institution has
changed the way it approaches limit excesses.
He said that, previously, “the lowest level of market risk management’s
limits was at the desk level.

31
JOIN. ENGAGE. LEAD.
Typically this could be three to 10 traders. “But
conduct risk is focused on an individual’s
behavior,” he added.
“So risk management had to work with desk
heads to identify the specific individual who had
caused a limit to be exceeded.”

32
JOIN. ENGAGE. LEAD.
Previously, a limit-excess
situation would be
resolved between the risk
manager and the desk
head with an agreement
to bring back a position
to within limits in a short
time frame.
Now there is a much
more robust process so
that the individual can be
identified and the
behavior scrutinized by
risk management and
the business head as to
whether it was
acceptable or not.
Robust
Process

33
JOIN. ENGAGE. LEAD.
“This ensures
consistency in
outcomes across all
trading
businesses.”
“A highly disciplined
process within risk
management ensures
that all limit excesses
are reviewed at a senior
level independently of
trading as to whether
there had been a
conduct violation, and if
so, to judge the severity
of it.”
Discipline

34
JOIN. ENGAGE. LEAD.
Embedding

35
JOIN. ENGAGE. LEAD.
Risk management
must also explain
the process and
provide examples
of poor conduct
and its potential
outcomes.
ExplainLead
It takes time for such
practices to become
embedded within the
organization.
Risk management has
to take the lead in
ensuring training for
trading-room managers
and the consistency of
practice across an
organization.
Time
EMBEDDING

36
JOIN. ENGAGE. LEAD.
EMBEDDING (CONT.)
The consequences of
noncompliance should be clearly
spelled out, including the potential
negative impacts on pay and
career trajectory.

37
JOIN. ENGAGE. LEAD.
EMBEDDING (CONT.)
These days, limit violations are a serious matter
and behaviors on the trading floor have changed
as a result.
• For example, some organizations report that
traders’ requests to risk management for
preapproval of limit exceptions are the
absolute norm.

38
JOIN. ENGAGE. LEAD.
Governance

39
JOIN. ENGAGE. LEAD.
GOVERNANCE
Before the financial
crisis, the term
“conduct risk” did not
even exist.

40
JOIN. ENGAGE. LEAD.
GOVERNANCE (CONT.)
Since then, there has been no shortage of
industry seminars,
briefings, and forums
to discuss emerging practices
and find the best among them.

41
JOIN. ENGAGE. LEAD.
GOVERNANCE (CONT.)
Such practices have to be
adapted to the particular
strategy and culture of an
organization and made
appropriate for particular
business lines.

42
JOIN. ENGAGE. LEAD.
GOVERNANCE (CONT.)
“Our organization places ownership of all risks
within the first line of defense—the business
heads,” one Market Risk Council member said.
• “They are the ones that ultimately have direct
responsibility and accountability for the
behaviors of their staff.”

43
JOIN. ENGAGE. LEAD.
The second line of
defense is the control
functions:
GOVERNANCE (CONT.)
Measuring
Conduct Compliance
Risk
management
Legal Finance

44
JOIN. ENGAGE. LEAD.
2nd set
“We deliver two
sets of
management
information on
conduct.”
“One set is overall conduct
metrics that allow the CRO
and the board to see how
conduct risk is trending
over time—by business line
and by sub-category within
our conduct risk schema.”
“A second set is
provided to the Human
Resources Committee.”
Overall
conduct
metrics
GOVERNANCE (CONT.)
A Council
member’s
experience

45
JOIN. ENGAGE. LEAD.
GOVERNANCE (CONT.)
Depending on the nature of the
individual conduct events, these
may be presented to the
committee, which will then
determine whether to apply
downward revisions to year-end
compensation.

46
JOIN. ENGAGE. LEAD.
Conclusion

47
JOIN. ENGAGE. LEAD.
100%
Conduct risk has become a
new risk discipline over the last
few years—with a very clear
regulatory imperative that
obliges financial institutions to
be 100% vigilant in policing
conduct.
CONCLUSION

48
JOIN. ENGAGE. LEAD.
Measuring
Conduct
Ex-post, institutions
can look at statistics
on regulatory
sanctions and the
number of staff
disciplined.
Measuring conduct is
difficult—certainly
on an ex-ante basis.
CONCLUSION (CONT.)

49
JOIN. ENGAGE. LEAD.
CONCLUSION (CONT.)
Being able to detect warning signs is
difficult.
• A well-thought-out package of
conduct risk indicators for each
business line can help senior
management and the board at least
identify any concerning trends.

50
JOIN. ENGAGE. LEAD.
New
problems
But it has also brought
a new set of problems,
where the second line
of defense is no longer
simply identifying
excesses and agreeing
to remediation plans.
Within the market and
counterparty credit risk
space, we have seen
limit-excess data
used as a key metric
to measure
trading-room
conduct.
We are now
being drawn
into the weeds
of “who did
what” and with
what intent.
We see that,
ultimately, conduct
is about individuals
and whether their
actions were
significantly
misaligned to
standards of
conduct.
CONCLUSION (CONT.)

51
JOIN. ENGAGE. LEAD.
The Market Risk Council promotes and
advances sound industry practices among
RMA's constituencies on market risk issues.
The council’s efforts assist risk managers in
understanding market risk management
methods and best practices, and the benefits
obtained from their application.
About RMA’s Market Risk Council

52
JOIN. ENGAGE. LEAD.
SHARE THIS PRESENTATION
Visit http://www.rmahq.org for information on risk management.
RMA is a member-driven professional association whose sole
purpose is to advance sound risk principles in the financial services
industry.
RMA helps its members use sound risk principles to improve
institutional performance and financial stability, and enhance the risk
competency of individuals through information, education, peer
sharing, and networking.
Become a member today.

How to Measure and Mitigate Conduct Risk

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to How to Measure and Mitigate Conduct Risk

Similar to How to Measure and Mitigate Conduct Risk (20)

More from Colleen Beck-Domanico

More from Colleen Beck-Domanico (20)

Recently uploaded

Recently uploaded (20)

How to Measure and Mitigate Conduct Risk