On June 28, the Federal Reserve Board (FRB) released the results of the 2018 Comprehensive Capital Analysis and Review (CCAR), which examined the capital planning of the 35 financial institutions required to submit to testing. While the overall trend continues to be positive, the boards and CEOs of the examined firms – and of smaller institutions that aspire to a best-practices culture – should view this year’s results as a call to action to closely assess the structure of, and resources devoted to, their capital planning.
Since the creation of the CCAR regime, the FRB has consistently held that it judges a firm’s capital plan not only on how well it holds up to stress testing but also on the quality of the internal practices and policies that inform that plan. At the same time, the FRB has taken a deliberately patient approach to its assessment of those internal processes, given the substantial weaknesses that were exposed by the financial crisis. In the 2015 CCAR, for example, the FRB explicitly stated that it was settling for progress in this area rather than the “full achievement of its high standards.”
In this year’s CCAR, the FRB continues its preference to guide with encouragement rather than reprimand, particularly in the qualitative assessments. In passing 17 of the 18 firms subject to qualitative review under the Large Institution Supervision Coordinating Committee (LISCC) program, the FRB found that the majority of firms are “close to meeting or meeting supervisory expectations for capital planning processes.” Notwithstanding this conclusion, this year’s CCAR report includes an extensive sidebar listing examples of capital planning deficiencies the FRB has uncovered. Even though these shortcomings did not result in an objection in most cases, they suggest that most firms have yet to fully establish the fundamental internal framework necessary for robust capital planning – a full decade after the financial crisis.
A Tougher Tone From the Fed?
Firms should be prepared for the FRB to shift to more stringent standards in its qualitative assessments. Close readers of CCAR reports will note that last year’s edition included an almost identical sidebar detailing qualitative shortcomings, and also will note that the discussion of the mechanics of qualitative assessment has been much more thorough in the past two years. Given the FRB’s increased emphasis on its qualitative expectations, we may be approaching a time when single deficiencies may result in an objection.
A tougher tone from the FRB would also align with the sentiment of many industry investors, analysts and other observers that while CCAR testing has helped firms expand their capacity to absorb losses, there is still insufficient ability to respond adequately in real time to rapid changes in market conditions. (Those concerns will not be mitigated by the FRB’s decision in its quantitative assessment to create an exception for the effects of the Tax Cuts and Jobs Act – exactly the sort of unexpected event that can upend neatly constructed capital plans.)
Breaking the “Black Box”
The CCAR process has provided a much-needed framework for large firms to establish capital planning processes commensurate with the scope of their operations. But for many of these firms, too much of that planning process is still contained within a “black box.” The contents of that box – data management, internal controls, scenario design and so forth – may be more visible and less misunderstood than they once were, but they are still managed in relative siloes.
Firms now need to integrate those components with each other and within the larger scope of operations. To do so, boards and executive committees should ensure that the following items are high on the firm’s agenda:
Shift the risk culture from “compliance” to “best practice.” As much as CCAR has done to raise the level of capital planning, there is also a danger that the regime has become an end in and of itself, with too much attention paid to developments like changes in the asset thresholds at which CCAR requirements apply. This focus obscures the fact that the real goal should be to look beyond compliance with regulatory requirements to establish an ongoing culture and mindset that supports clean and repeatable processes.
A best-practices perspective is particularly important given that CCAR is still in its relative infancy. Rule changes are inevitable in response to lessons learned along the way, evolving standards in governance, and industry and political developments. For example, some LISCC firms have struggled with implementing the CFO attestation rule introduced in 2016 with the larger set of internal control requirements. Taking a higher-level view of capital planning will allow firms to anticipate and adapt to such developments more easily.
Make the capital planning process reflect the real world. There is a tendency for firms to hew too closely to the baseline scenarios provided by the FRB, merely tweaking them based on the different scenarios developed in different parts of the firm. But real-world risks don’t recognize silo boundaries or annual timetables. Banks need to think through their risk models from the ground up, starting with the establishment of a common risk universe spanning enterprise risk management, risk appetite, reporting and other functions. Risk identification should be continuous rather than a periodic exercise timed to the CCAR submission calendar. Thoroughly documenting the rationale for the weights assigned to each risk and analyzing the macroeconomic drivers across the full suite of models will allow banks to better identify which aspects of their scenarios drive the most risk and to capture critical ripple effects that move between portfolios.
The internal audit function can be a catalyst in this transformation if it goes beyond its traditional controls review and compliance role to push the enterprise past compliance and toward a holistic, integrated approach to capital planning and stress testing that reaches across the organization. To do so, internal audit must appropriately challenge assumptions and processes at each stage of the CCAR process lifecycle. Fulfilling this broader mandate requires the internal audit team to be well-versed in the details of the CCAR process, regulatory expectations, the organization’s capital planning, and how these three elements intersect. Given the size and complexity of the operations involved, internal audit should make it a priority to use leading-edge digital approaches, including data analytics, robotic process automation and continuous auditing, to streamline the audit process while giving it greater depth and achieving higher levels of efficiency and productivity.
Put data in the driver’s seat. While firms may be passing their CCAR assessments, our observation has been that the further upstream a function is in the organization, the more manual and disjointed internal processes become. Overcoming these hurdles will require banks to be more aggressive in harnessing the rapidly evolving array of data tools available, from GDPR protocols to blockchain. Firms that do so will be able to build an end-to-end, data-driven internal control function more rapidly that can stand up to the often messy process of rationalizing data from different legacy systems and maintaining data integrity throughout capital planning. Conversely, there needs to be sensitivity throughout the organization that gaps in data management – whether caused by difficulties in accessing timely data or in integrating data from acquisitions – can undermine the integrity of information as it moves up the decision-making chain. As data becomes more accessible, internal audit and other risk management groups will be able to employ data analytics tools and technologies more effectively to leverage the value of their data fully.
CCAR 2018 marks an evolution in the industry’s collective journey toward better capital planning. Increasingly, the question is no longer “How did we do on our stress test?” but rather “What kind of firm do we want to be?” Firms that commit themselves to looking beyond the baseline requirements have the opportunity to build formidable mechanisms for creating stakeholder value.