London, United Kingdom, June 21, 2012 — Leading financial services firms have made major changes in the organization and approach to risk management following the global financial crisis, but there is still much to be done to change and embed new methodologies and approaches, according to a new report by Ernst & Young, in conjunction with the Institute of International Finance.

The findings of the report are based on a survey of 75 firms with headquarters in 38 countries. The report noted significant increases in the overall resources now being deployed by firms to strengthen risk management and risk governance.

Ms. Patricia Jackson, Ernst & Young’s Head of Financial Regulatory Advice, Europe, Middle East, India and Africa (EMEIA), who directed the survey, stated, “This is the third annual survey of its kind and the results show clearly that the structure of risk management has undergone a significant change since before the 2008-2009 financial crisis.. However, there is still much to be done to change and fully integrate new methodologies and processes. For example, risk appetite – the amount and type of risk that a company is able and willing to accept in pursuit of its business objectives – has emerged post-crisis as a critical foundation of the risk management process, but our survey finds that embedding risk appetite across all levels remains a key challenge for many firms”

Today’s report contains the perspectives of the IIF’s Committee on Governance and Industry Practices, whose chairman, Rick Waugh, Vice Chairman of the Board of Directors of the IIF, President and Chief Executive Officer, Scotiabank, said, “We are seeing firms make major increases in the number of staff they assign to risk management functions today and still further increases are in prospect. The added expenditures reflect the priority that firms are placing on the overall risk management function, plus the complexity of compliance with Basel III and many other new regulations and capital requirements.”

Mr. Waugh stressed, “The annual IIF – Ernst and Young survey measures progress against the benchmarks of risk management reform that were recommended in a landmark mid-2008 report by the IIF. There is no question that major progress is being seen in risk management. But, at the same time, as the respondents in the survey underscore, the new regulatory environment is forcing profound rethinking of business models, adding enormous complexity not only to the vital risk management function, but to all facets of the work of senior managements and boards of directors.”

The survey found that banks have reworked the structure of risk management. 87% reported having board risk committees, which is a major change since pre-crisis and the status of CROs has increased with 82% now reporting directly to the CEO or jointly to the CEO and the board risk committee. Banks have also increased resources devoted to risk management. On average 57% of the firms surveyed increased the numbers of staff engaged in risk management over the last year and 36% said they expect a further increase in the coming year.

Mr. Waugh emphasized, “Boards of directors and senior management teams recognize that core issues of corporate culture are crucial to sound risk management. Incentives need to be set appropriately and, over and above all the technical systems improvements, there needs to be an acute understanding that good risk management demands excellent judgment. The proper risk culture, understanding the right balance of risk appetite, and the right balance of risk/reward, are essential to mitigating future crises, without which, no amount of capital or prospective rules will hold us safe.”

Survey responses confirmed that strengthening risk culture is a critical area of management focus, particularly for firms most severely affected by the 2008 crisis. Strengthening risk roles and responsibilities, enhancing communication and training, and reinforcing accountability were the key initiatives reported to strengthen risk culture: 58% increased attention on risk culture in the past 12 months. 41% (vs. 23% in 2011) say they are pleased with progress to achieve a strong risk culture.

The survey found that effective implementation of a fully developed risk-appetite process is now a prime challenge in risk management. Risk appetite ranked alongside credit risk and liquidity risk as one of the top three issues now requiring the attention of Chief Risk Officers (CROs).

While there is some difference across regions, the survey found that 51% of firms reported good progress establishing risk-appetite parameters at the enterprise level, but had not yet driven it into the businesses. Ms. Jackson noted, “Although virtually all executives interviewed indicated they were underway at some level with the risk appetite process, only 26% overall indicated they had made good progress embedding the risk appetite into the businesses, with European firms reporting the most progress. However, of that group, none were confident they had achieved a fully operational, fully integrated risk-appetite framework across the firm.”

A major shift of emphasis in risk management is in the use of stress testing. The evolving regulatory and business environment has heightened management’s attention on strengthening internal stress-testing strategies and processes, with 75% of this year’s study participants reporting they have created and implemented new processes in the past 12 months.

To support the changes in risk management banks are increasing their investments on IT to overcome continuing systems and data challenges.

The survey also highlights the extent to which the new Basel III regulatory requirements are changing the industry. 65% are evaluating portfolios, 30% exiting lines of business and 13% exiting countries. Firms predicted that the changes will have a significant effect on the costs of doing business. The result will be that return on equity will go down, costs and leverage will have to be reduced, and margins will have to go up. 40% of banks which estimated the effect on margins on corporate loans thought increases of 50 to 100 basis points would be needed.

Ms. Jackson noted, “Liquidity and capital management were at the top of senior management agendas for most participants. Changes in management were needed following the crisis but firms have also been struggling with the challenges of the new regulatory requirements. Systems were not designed with the new liquidity requirements in mind and have to be reconfigured. The combined effect of the new capital and liquidity requirements on banks business models will be profound.’

IIF Managing Director Charles Dallara added, “There is impressive evidence that boards of directors are now devoting significantly greater time to all areas of risk management. The survey finds, for example, that boards are playing an influential role in, particular, in such areas as risk appetite, liquidity, culture and compensation. There is, however, concern that implementing all of the new regulatory requirements in a compressed time period takes such a proportion of the time and attention of senior managements and boards of directors that their ability to focus on business and indeed risk issues in ways not mandated by regulations may be compromised.”

The survey found that Boards and senior management teams are strategically reviewing and assessing their businesses to determine how best to adapt to this “new normal” environment, and many are making some fundamental changes to how they do business. Many of the risk officers interviewed spoke candidly about the complex issues that they confront. One executive noted, for example, “We are facing a significant challenge just to achieve technical compliance with the new rules and ratios, let alone reorient the institution for success.”

About the Survey: From December 2011 through March 2012, Ernst & Young, on behalf of the IIF, surveyed IIF member firms. An online quantitative questionnaire was distributed to the top member firms by asset size. In addition, the team conducted telephone interviews with chief risk officers and other senior risk executives of the largest global firms. A total of 75 firms across 38 countries participated in the study either online and (or) by telephone, which resulted in 32 interviews with CROs and 12 interviews with other senior risk executives, and 68 online survey responses.