Enterprise Risk Management

-- by Keir Breitenfeld

In my previous three postings, I’ve covered basic principles that can define a risk-based authentication process, associated value propositions, and some best-practices to consider.

Finally, I’d like to briefly discuss some emerging informational elements and processes that enhance (or have already enhanced) the notion of risk-based authentication in the coming year.  For simplicity, I’m boiling these down to three categories:

1. Enterprise Risk Management – As you’d imagine, this concept involves the creation of a real-time, cross channel, enterprise-wide (cross business unit) view of a consumer and/or transaction.  That sounds pretty good, right?  Well, the challenge has been, and still remains, the cost of developing and implementing a data sharing and aggregation process that can accomplish this task.  There is little doubt that operating in a more silo’d environment limits the amount of available high-risk and/or positive authentication data associated with a consumer…and therefore limits the predictive value of tools that utilize such data.  It is only a matter of time before we see more widespread implementation of systems designed to look at a single transaction, an initial application profile, previous authentication results, or other relationships a consumer may have within the same organization -- and across all of this information in tandem.  It’s simply a matter of the business case to do so, and the resources to carry it out.

2. Additional Intelligence – Beyond some of the data mentioned above, some additional informational elements emerging as useful in isolation (or, even better, as a factor among others in a holistic assessment of a consumer’s identity and risk profile) include these areas:  IP address vs. physical address comparisons; device ID or fingerprinting; and biometrics (such as voice verification).  While these tools are being used and tested in many organizations and markets, there is still work to be done to strike the right balance as they are incorporated into an overall risk-based authentication process.  False positives, cost and implementation challenges still hinder widespread use of these tools from being a reality.  That should change over time, and quickly to help with the cost of credit risk.

3. Emerging Verification Techniques – Out-of-band authentication is defined as the use of two separate channels, used simultaneously, to authenticate a customer.  For example: using a phone to verify the identity of that person while performing a Web transaction.  Similarly, many institutions are finding success in initiating SMS texts as a means of customer notification and/or verification of monetary or non-monetary transactions.  The ability to reach out to a consumer in a channel alternate to their transaction channel is a customer friendly and cost effective way to perform additional due diligence.

Here’s a further review of results from the Uniform Bank Performance Reports, courtesy of the FDIC, through the third quarter of this year. (See my Dec. 18 post.) The UBPR is based on quarterly call reports that insured banks are required to submit. I wanted to see how the various profit performance components compare to the costs of credit risks discussed in my previous post. The short of it is that banks have a ways to go to be fully pricing for both expected and unexpected risk. (See my Dec. 5 blog dealing with risk definitions.) The FDIC compiles peer averages for various bank size groupings. Here are some findings for the two largest groups, covering 490 reporting banks. Here are the results:

Peer Group 1 consists of 186 institutions with over $3 billion in average total assets for the first nine months.

• Net interest income was 5.34 percent of average total assets for the period. This is down, as we might expect based on this year’s decline in the general level of interest rates, from 6.16 percent in 2007.
• Net interest expense was also down from 2.98 percent in 2007 to 2.16 percent for the nine months to September 30th. 
• Net interest margin, the difference between the two metrics, was down slightly from 3.16 percent in 2007 to 3.14 percent so far in 2008, or a loss of 2 basis points.

It should be noted that net interest margins have been in steady decline for at least ten years, with a torturous regular drop of 2 to 5 basis points per annum in recent years. This year’s drop is not that bad, although it does add to the difficulty in generating bottom-line profits.

To find out a bit more about the drop in margins, especially in light of the steady increase in lending over the same past decade, I looked at loans yields.

• Loan yields averaged 6.22 percent for 2008, down (again, expectedly) from 7.32 percent in 2007. This is a drop of 110 basis points or a decline of 15 percent.
• Meanwhile, rates paid on interest-earning deposits dropped from 3.41 percent in 2007 to 2.48 percent so far in 2008. This 93 basis point decline represents a 27 percent lower cost of interest-bearing deposits.

It seems as though margins should have improved somewhat -- not declined for these banks.

Digging a bit deeper, I see two possible reasons. 

• First, total deposit balances declined from 72 percent of average assets to 70 percent, meaning a larger amount had to be borrowed to fund assets.
• Second, non-interest bearing demand deposits declined from 4.85 percent of average assets to 4.49 percent.
So, fewer deposit balances relative to total asset size, along with a lower proportion of interest-cost-free deposits, appear to have made the difference. Unfortunately, the ”big news” is that margins were only down a bit.

Let’s move on to fee income. Non-interest income, again, as a percent of average total assets, was down to 1.14 percent from 1.23 percent in 2007. For this bank group, fees have also been steadily declining relative to asset size, down from 1.49 percent of assets in 2005. A lot of fee income is deposit based, and largely based on non-interest bearing deposits – and, thus, a source of pressure on fee income.

Operating expenses constituted some good news as they declined from 2.63 percent to 2.61 percent of average assets. That’s 2 basis points to the good. Hey, an improvement is an improvement. Historically this metric has generally moved down, but irregularly from year to year. The number stood at 2.54 percent in 2006, for instance.

As a result of the slight decline in margins and the larger percentage decline in fee income, the Peer Group 1 efficiency ratio lost ground from 57.71 percent in 2007 to only 58.78 percent in 2008. That means the every dollar in gross revenue [net interest income plus fee income] cost them almost 58 cents in administrative expenses so far this year. This metric averaged 55 cents in 2005/2006.

The total impact of margin performance, fee income and operating expenses, if you’ve been tallying along, is a net decline of 0.09 percent on total assets. When we add this to the 2008 increase in provision expense of 57 basis points, we arrive at a total decline in pre-tax operating income of 0.66 percent on total assets. (See my Dec. 18 post.) That is a total decline of 44 percent from the pre-tax performance in 2007 for banks over $3 billion in assets.

It would appear that banks are not pricing enough risk into their loan rates yet – for their own bottom line performance. This would be further confirmed if you compared bank loan rates to the historic risk spreads and absolute rates that the market currently has priced into investment grade and other corporate bonds. They are probably at extremes but still they say more credit risk is present than bank lending rates/yields would indicate.

For Peer Group 2, consisting of 304 reporting banks between $1 billion and $3 billion in assets:

• Net interest income was 5.87 percent of average total assets for the period. This is also down, as expected, from 6.73 percent in 2007.
• Net interest expense was also down from 3.07 percent in 2007 to 2.39 percent for the nine months to September 30th. 
• Net interest margin, was down from 3.66 percent in 2007 to 3.48 percent so far in 2008, or a loss of 18 basis points. These margins are at somewhat higher levels than found in Peer Group 1, but the drop of .18 percent was much larger than the decline in Peer Group 1.

As with all banks, net interest margins have been in steady chronic decline, but the drops for Peer Group 2 have been coming in larger chunks the last two years, down 18 points this year so far, after dropping 16 points from 2006 to 2007.

Behind the drop in margins, loans yields are 6.69 percent for 2008, down from 7.82 percent in 2007. This is a drop of 113 basis points or a decline of 14 percent. Meanwhile rates paid on interest-earning deposits dropped from 3.70 percent in 2007 to 2.85 percent so far in 2008. This 85 basis point decline represents a 23 percent lower cost of interest-bearing deposits. Again, with a steeper decline in interest costs, you’d think margins should have improved somewhat. That didn’t happen. 

I notice the same two culprits.

• Total deposit balances declined from 78 percent of average assets to 76 percent, meaning, again, a larger amount had to be borrowed to fund assets.
• Also, non-interest bearing demand deposits continued an already steady decline from 5.58 percent of average assets in 2007 to 5.08 percent.

Fewer deposit balances relative to total asset size…along with a lower proportion of interest-cost-free deposits…and we know the result.

Now, about fee income for these banks… Non-interest income, again as a percent of average total assets, was down to 0.92 percent from 0.95 percent in 2007. For this bank group, fees have also been steadily declining relative to asset size, down from 1.04 percent of assets in 2005. A smaller non-interest bearing deposit base, without other new and offsetting sources of fee income, will mean pressure on this metric.

Operating expenses constituted some good news here as well. They declined from 2.79 percent to 2.75 percent of average assets. That’s 4 basis points to the good. Historically this metric has been flatter for this size bank, moving up or down a bit from year to year.

As a result of the not-so-slight decline in margins and the continued decline in fee income, the Peer Group 2 efficiency ratio lost ground from 59.52 percent in 2007 to only 61.86 percent in 2008. That means the every dollar in gross revenue cost these banks almost 62 cents in administrative expenses so far this year. This metric averaged 56 cents in 2005/2006.

The total impact of margin performance, fee income and operating expenses is a net decline of 0.17 percent on total assets. When we add this to the 2008 increase in provision expense of 36 basis points, we arrive at a total decline in pre-tax operating income of 0.53 percent on total assets. (See my Dec. 18 post.) That is a total decline of 34 percent from the pre-tax performance in 2007. 

As I concluded above, more credit risk is present than bank lending rates/yields would indicate.

Although all 490 banks are declining in efficiency, the larger banks have a scale edge in this regard. The somewhat smaller banks seem to have an edge in pricing loans, but not regarding deposits. Although up dramatically in 2007 and even more this year for both groups, the Peer Group 2 banks seem to be suffering fewer credit losses relative to their asset size than their larger brethren.

Both groups have resulting huge profit declines, but the largest banks are under the most pressure through this period. It’s interesting to note that, with higher loan yields and fewer apparent losses, Peer Group 2 banks are somewhat better at risk-adjusted loan pricing than the largest bank group.

Results are results. The fourth quarter numbers aren’t expected to show a lot of improvement as the general economy continues to slow and credit issues continue. I’ll comment on entire year’s results in posts early next year.

Next year, too, look for my comments on risk management solutions especially relevant to enterprise risk management.

For the last 16 months or so, the financial services industry has been indicted, tried, found guilty, sentenced and duly executed for ignoring accepted enterprise risk management practices.  Banks, albeit along with goofy risk ratings agencies, lax regulators, and greedy leveraged investors, have been blamed for abandoning normal and proper credit risk behavior and lending to many who did not meet basic debt servicing capability. After things went terribly wrong in capital and liquidity markets, followed by a now-official recession in the “real” economy, banks have tightened lending standards.  (See my blog posted November 13th for more about tightened lending.)

Now, following the TARP capital infusion, the press and Congress seem very upset that banks aren’t rapidly expanding their lending, or even moderating their credit risk regimen.  This dismay, with the lack of an immediate expansion of credit granting, occurs in the face of what the same press and most politicians refer to as the greatest economic meltdown since the Great Depression.

Granted, banks are historically easy whipping boys, but they now seem damned for what they did and damned if they don’t do some more of it. Although suffering in many ways, most banks are still for-profit organizations. Contrary to popular belief, they also actually have credit policies and processes that are aimed at responsible credit risk management – at least for the loans they intend to keep on their own books. Average management intelligence would dictate being cautious in the middle of an economic downturn.

The TARP capital infusion is a sudden large windfall of new equity, like a 20 percent increase for the receiving banks. It begs the question of what to do with it. To grow assets proportionately to the TARP infusion would mean a very rapid (circa plus 30 percent) growth in lending in a very short timeframe. Given the prevalence of banks, it would be very difficult for all of them to grow their loan portfolios this fast even in a good economy.

Most banks do not need TARP funds to survive in the short term. And the weakest banks are not supposed to be granted TARP funds. This is like a steroid shot into the natural process of bank consolidation. It’s obvious that the stronger banks, now infused with hot capital, are using TARP funds to acquire other banks. In many cases the acquired banks have weaknesses that they could not likely overcome on their own. So, the TARP funds are addressing the over-banked state of the financial industry and probably offsetting what would otherwise have been a drain on the Deposit Insurance Fund. I maintain that this is a good, if unintended, outcome for both the industry and the taxpayers.

I’ve heard and read comments (by people who should know better) that the hoarding of TARP funds is aiding bank earnings. Some say that those earnings are protected by TARP because it offsets credit losses. This is an accounting absurdity. The TARP will only help bank earnings if and when it is deployed successfully. This, in turn, requires two things to take place: 1) leveraging up the new capital with other sources of funds; and 2) successfully investing the proceeds in assets that provide a decent risk-adjusted return. In any event, whenever a new amount of risk-based capital comes into the equity account, the ROE will suffer for a while.

Another kind of issue with TARP, even if it isn’t needed or desired by a healthy bank, is the stigma associated with not getting it. The few banks in this category have had to go out of their way to explain why they didn’t go for it. There is a concern that, even if it really isn’t needed, a bank will be at a cash and balance sheet disadvantage in the big fish eating the little fish game.

Finally, who asked for TARP to be created? Bear and Lehman went down. Merrill was rescued. Countrywide went down early and WAMU went later. Citi is now on both a heart-lung machine and dialysis. A bunch of the big boys got killed or were in serious trouble. But not all of them. And, several of them reportedly had to be coerced into taking their share of the first $125 billion. Everyone else pretty much observed the circus on Wall Street and Capital Hill.

So, policy makers, make up your mind.  Do you want banks exercising sound credit risk management practices or not?  Do you want industry consolidation or don’t you?  Do you want sounder banks to acquire relatively weaker ones or would you rather see the FDIC pick up the pieces later?  Do you want to dictate how and when private organizations allocate risk-based capital or not?  A little clarity would be appreciated.  After all, TARP was your idea.  It wasn’t requested by the industry at large. And the flow through to businesses and consumers will take a while. Sorry. It’s in everybody’s best interest that good risk management processes prevail at this time (and always) -- in granting and pricing credit, and in managing available capital. The lack of same helped get us all to this point.