On the evening of September 18, 2008, Federal Reserve Chairman Ben Bernanke and U.S. Treasury Secretary Henry Paulson held an urgent and unusual session on Capitol Hill. Congressional leaders listened in stunned silence as Paulson told them, “… we’re literally maybe days away from a complete meltdown of our financial system, with all the implications here at home and globally.” Within a few days, Paulson proposed a $700 billion bailout package.1
Based on the recent large financial institution failures triggered by the subprime crisis, it is evident that, among other issues, the concepts, methodologies and discipline developed by operational risk management to anticipate and address extreme events were not adopted or followed by many institutions.
In the days that followed the Paulson and Bernanke meeting on Capitol Hill, there was much anger in the public and turmoil in the marketplace. What is shocking is not just the cost of the bailout program (some estimates indicate the total cost of the crisis may hit $8.5 trillion2), but the industry’s under-preparedness for such an extreme risk event. The markets declined with unprecedented volatility as investors became even more anxious about the uncertainty and risks that lie ahead. So-called “nightmare scenarios” became real in a matter of days.
Many firms (large, small, old and new) found themselves embroiled in a situation for which they could have been better prepared. They could have at least partially reduced the overall impact if they had effectively embedded in their business processes and culture a cost-effective, repeatable process called scenario analysis. Instead, they faced a crisis similar to what a senator on the Banking Committee described as “flying a $700 billion plane by the seat of our pants.” Another senator added, “Shouldn’t we have the process designed before we have to do a $700 billion experiment?”3
Challenges and Opportunities
For most organizations, scenario analyses pave the way to designing such a process. To impact firm strategy, scenario analyses should be rooted in an institution’s culture and in the strategic thinking of top management. Too often, the use of scenario analysis is ill-defined in operational risk management policies and, when defined, poorly executed.
Understanding the value of scenario analysis provides a way for all organizations – not just financial institutions – to be proactive in identifying their top operational risks, identifying processes where there may be the greatest risk, and prioritizing risk and compliance initiatives. In fact, the benefits of critical thinking to which scenario analysis lends itself often are the basis for identifying strategies to gain competitive advantage.
Our Point of View
Decisions are based on a person’s predictive judgments as to what might happen (scenarios).
Our view is that organizations should prepare to make the best possible predictive judgments by utilizing a repeatable scenario analysis methodology. The quantification of the top operational risks resulting from this methodology can be used not only to calculate capital, but also to pinpoint the most critical areas needing control investments, and to revisit current risk management strategies being deployed or that may be over-controlled.
Taken solely in isolation, scenario analysis will not prevent the type of systemic risk seen in the marketplace today. Employed effectively and in a disciplined manner, scenario analysis can serve to identify potential “trouble spots” earlier than competitors and allow the organization to take action to protect or even enhance stakeholder value.
How We Help Companies Succeed
We work together with our clients to develop reasonable, insightful and challenging scenarios. Using our proprietary scenario methodology, we guide executive leaders to debate and agree to their top operational risks, and help organizations quickly gather the most appropriate information that can be used to build scenarios scaled to their organization. Our expertise in decision-making, including social psychology and organizational behavior, allows us to mitigate the negative implications of decision-making biases and keep leaders focused on generating predictive judgments and choices. Additionally, our deep experience in risk quantitative methods allows for rapid development of mathematical models and interpretation in everyday terms.
One of the 10 largest U.S. financial institutions sought to identify its top five operational risks. Workshop sessions were held with senior executives from all aspects of the bank, leading the executives through a scenario analysis methodology. Protiviti professionals worked with the client’s corporate operational risk team to gather the appropriate supporting information, including internal losses, external consortium data, risk and control self-assessments, Sarbanes-Oxley data and compliance findings.
Our professionals helped the client generate potential incidents and five scenarios for event risk categories that could have severe impacts and used them during the workshops to guide conversation and critical thinking. We worked with the executives to build severity distributions. These values provided estimates of the likelihood and size of loss events occurring in each business line, as well as the maximum loss a business could incur from a single loss event.
Feedback on the executives’ confidence in their decision outcomes and – equally as important – satisfaction with the scenario process was rated “high value add to the organization.” Our client’s business leaders had never worked together across business and functional boundaries in such a repeatable fashion to identify the top risks for the organization. As a result of this effort:
- Capital modeling was improved through the influence of information obtained in scenario analysis.
- Risk initiatives and investments were prioritized more effectively.
- Management’s confidence in anticipating and managing risks increased substantially.
- Communication across business lines and functions was enhanced significantly, improving risk discussions and transparency.