This article was first published on March 5, 2020
COVID-19: How should Risk functions respond?
The Coronavirus (COVID-19) outbreak is urging financial institutions and their risk functions to form crisis plans as well as implement necessary measures to ensure the health and well-being of societies, employees and clients. All major international banks have begun to implement their business continuity plans (BCPs) regarding travel curtailment, remote work and reduced in-person meetings.
Compared to the rest of the industry, banks, by virtue of their important intermediation role, have been early movers. Years of contingency planning and stress testing has prepared most banks and other financial intermediaries to respond effectively to this threat. While there are a wide range of practices, most banks in developed markets are now enacting explicit pandemic response plans they have developed in the past.
The real acid test for banks will not be around developing capabilities, but the agility by which they can divert their resources from already existing books of work. This will not just be a test for banks but the financial ecosystem as a whole, including supervisors and other market players, who need to work together closely to ensure stability of the financial system.
In terms of how Risk functions should respond to the situation, Oliver Wyman has compiled a point-in-time set of practical attention areas for banks to feed into their responses.
Be agile and if necessary re-prioritize ruthlessly
The virus was not foreseen and is evolving so the response needs to be quick and reactive to the challenge. Banks need to:
- Empower their designated staff to make decisions without having to consult a bureaucratic governance body
- Form cross-functional teams that span across business, risk, compliance, operations, economists and evaluate the problem holistically
- Be pragmatic and iterative. Take your existing capabilities, re-purpose them into prototypes and continue to evolve (model the credit risk impact of primary sectors on static balance sheet before applying further assumptions for example)
It is unlikely that progress on the rest of the books of work will be left unscathed by the COVID-19 response. Risk functions already had their hands full before the pandemic with various regulatory initiatives such as IRB model re-developments in Europe, that require both resources and management time. Modelling skillsets can be usefully deployed to model and analyze the financial impact of the outbreak.
The mission for the risk response must be to protect the people and manage the impactKlaus Hoelzer , Head of Finance and Risk, EMEA
Impact on the people must remain the number one priority
The biggest risk for banks remains their ability to operate in all potential scenarios of the outbreak. Banks should continue to ensure the health and well-being of their employees, implementing and continually re-examining their business continuity plans. The use of technology to enable work to continue without physical proximity will be essential. This is the time to demonstrate your commitment to your employees and your concern for their well-being.
Understand the full impact of COVID-19 and how to manage it
The outbreak and the global spread of the COVID-19 is undoubtedly going to have a non-trivial impact on the global economy. It will impact some parts of the economy such as shipping, aviation and hospitality disproportionately more than others. The impact is not only expected to hit equity, it is also likely to have an effect on credit. Leading banks have already started to analyze this impact, with a focus on supply chain disruptions. It is important for banks to keep sight of both the first-order risks as well as second-order risks ( impact to rates, impact to manufacturing companies etc.). Practically speaking, in our view, the right response should at a minimum include the following actions:
Teaming up with crisis experts and economists to prepare scenarios to cover an “expected case” and a “severe case” spanning 6 to 18 months covering primary (such as aviation, shipping, hospitality sectors) and secondary ( such as the manufacturing sector) effects of the outbreak, including supply chain dislocations, tailored to the bank’s vulnerabilities.
Modelling and understanding the implications of these scenarios on earnings / revenue and potential credit losses by re-purposing existing tools for this exercise, as well as adding any necessary capabilities in an agile way.
Working with the business to figure out the best course of action, including tactical and near-term strategic business moves (for example, identifying clients where lending should cease or increase to balance the impact on earnings) to limit the impact.
This exercise will also be a test for how effective risk and business teams can work together to take actions to mitigate risk in a constantly evolving environment.
Think beyond the obvious
One of the challenges in developing a response to COVID-19 is its lack of direct precedent. Vulnerabilities cannot easily be identified by looking at past experiences, but we can use the experience from analogous situations, monitor the market situation, learn from good / bad practices to evolve our thinking, and challenge ourselves to think outside-the-box. There is no “one size fits all”. Banks’ risks will differ by their operating model, business mix, geographical location of hubs among other factors.
The list of less obvious risks are beginning to emerge, and include:
Extended vulnerability alert: The current situation can give rise to additional vulnerability beyond the direct implications of the spread of COVID-19. An environment of uncertainty and panic are cyber criminals’ best friends. Cyber-readiness will be more important than ever.
Supply chain issues are not only an issue for the manufacturing industry. Beyond the losses tied to supply chain dislocations that will be transferred to bank balance sheets, banks have critical services that are out-sourced / co-sourced. Sometimes the vendors sub-contracting parts of the process (client-on boarding, payments processing etc.) and the exposure to affected areas are not initially clear. Critical processes need to be studied in detail, getting more information from vendors as required to make an assessment of potential risks resulting from non-performance or the stoppage of services, including both regulatory and customer relationships.
Increased compliance risks due to the change in working practices are already causing headaches (such as increasing market abuse risk while working from home). In a “severe case”, banks may have an issue if there is an insufficient number of key staff (for example traders) to make markets when market volatility levels rise. Finding a viable response to these issues will require closer coordination with supervisory authorities.
The situation is evolving every day, testing both the crisis response readiness and the agility of risk functions. The mission for the risk response must be to protect people and manage the impact.
Editor's note: Oliver Wyman is monitoring the COVID events in real time and we have compiled resources to help our clients and the industries they serve. Please continue to monitor the Oliver Wyman Coronavirus hub for updates.