By contrast to the examples of financial firms that successfully navigated the crisis, those that failed lacked constructive dialogue in their cultures. I met with one CRO who explained her dilemma: If she kept raising concerns with management, she would become a pain in management's neck; but if she didn't raise concerns, she would be known as the CRO at an institution that blew itself up. She left the firm in 2006 and the firm failed in 2008.

A distinguishing characteristic of unsuccessful firms was their pursuit of shortterm growth without appropriate regard for the risks involved. In 2005-2007 both Fannie Mae and Freddie Mac decided to take on more risk and increase exposure to the subprime mortgage market just as home prices were peaking. Other firms that decided similarly around the same time included Lehman Brothers, Washington Mutual (WaMu), and Countrywide.

Many of the firms that took excessive risk at the wrong time did have chief risk officers (CROs). Sometimes, the chief risk officer reported to the head of a business unit rather than to a committee of the board of directors or at least to the CEO. This muted the CRO's ability to assess risk or make recommendations that top management would hear. Some of the firms that failed either fired the CRO (Freddie Mac) or moved the CRO to a less important position at the company (Lehman) or layered the CRO far down in the company and ignored his input (Countrywide). In one major case, the corporate CRO simply lacked access to information at a part of the firm that was taking excessive risk (AIG). At many firms, ERM specialist Stephen Hiemstra explains, risk management was a compliance exercise rather than a rigorous undertaking.[1]

Firms that came to grief in the crisis lacked both (1) a proper flow of information from inside the organization to the top, and (2) forums for constructive dialogue, so that sound decisions could include consideration of risks as well as potential rewards.[2] Classic was the experience of a Fannie Mae official who told the FCIC that his unit produced pricing models showing that Fannie Mae was not appropriately pricing the mortgages that it purchased. The official recounted that the executive vice president to whom he reported asked, "Can you show me why you think you're right and everyone else is wrong?"[3]

Citigroup CEO Charles Prince, only partly in jest, characterized Citigroup as not having one good culture but five or six good cultures. Prince told the FCIC about his frustration at the inability of Citigroup's business lines to communicate with one another. In an e-mail in October 2007, he wrote about Citi's "[i]ncredible lack of coordination. We really need to break down the silos!"[4] An inability to communicate effectively across organizational lines meant that a firm lacked an enterprise-wide view of risks. A 2008 UBS report to shareholders on the firm's losses similarly notes the absence of strategic coordination at that institution. While the various risk functions relating to market risk, credit risk, and financial risk came together to assess individual transactions, "[i]t does not appear that these functions sought systematically to operate in a strategically connected manner."[5]

The CEOs of both Citigroup and AIG told the FCIC that until sometime in 2007 they were completely unaware of the financial products that almost took their firms down.[6] In part this resulted from the immense size and organizational complexity of these firms. Citigroup had 350,000 employees and nearly 2,500 subsidiaries, and AIG, much smaller than other large, complex financial institutions,[7] consisted of 223 companies that operated in 130 countries with a total of 116,000 employees.[8]

Another problem was the CEO or other powerful top manager who simply refused to take feedback. The FCIC heard repeated statements that pressure from chief officers to increase market share was a problem, for example at Moody's Investors Service, which came under pressure to please issuers with its ratings, and numerous financial institutions, including AIG Financial Products, Lehman, Countrywide, and WaMu. As a European supervisor told staff in an interview, "The best guys in the banks are often the arrogant ones."

The financial crisis was not the first time that executives followed success with serious lapses in judgment. Some years before the crisis, Professor Sydney Finkelstein of Dartmouth College's Tuck School of Business pointed to a pattern:

Want to know one of the best generic warning signs you can look for? How about success, lots of it! . . . Few companies evaluate why business is working (often defaulting the credit to "the CEO is a genius"). But without really understanding why success is happening, it's difficult to see why it might not. You have to be able to identify when things need adjustments. Otherwise you wake up one morning, and it looks like everything went bad overnight. But it didn't – it's a slow process that can often be seen if you look.[9]

This observation helps to relate the credit bubble to governance and risk management: In years when house prices were appreciating and the economy displayed apparent moderation, financial firms grew and reaped generous returns, regardless of whether they had the people and systems and processes in place to ensure effective risk management. The problem was exacerbated as financial firms consolidated and became larger and more complex. CEOs of firms that made substantial profits during the credit bubble too frequently came to believe in their ability to make decisions without soliciting constructive dialogue to inform themselves.

One consequence of this attitude was the diminished role of the risk function at many firms. The FCIC placed on the public record an Oliver Wyman report from early 2008 that describes "Gaps in Risk Management" at Bear Stearns, which failed shortly thereafter. Of relevance here in a long list of shortcomings was the observation that Bear Stearns had a "[l]ack of mandate for the Risk Policy Committee" and a "[l]ack of institutional stature for [the] Risk Management Group." The report bolsters the latter observation by stating, "Risk managers [are] not positioned to challenge front-office decisions."[10]

Clifford Rossi, who held senior risk management and credit positions at Citigroup, Washington Mutual (WaMu), Countrywide, Freddie Mac, and Fannie Mae, observed what he calls "risk dysfunction" at a number of firms. Each of these symptoms relates to the inability of risk managers to bring information to top levels of the company and to engage in a process of constructive dialogue when the company makes major decisions:

• Low morale and self-esteem among risk managers;

• Openly derisive comments and attitudes toward risk staff;

• High turnover in risk functions: voluntary and involuntary;

• Increasingly combative and aggressive posture toward risk management;

• Lack of stature of risk management; and

• Risk management viewed as a cost center.[11]

Based on his experience, Mr. Rossi contends that, to do their work, risk officers need "air cover" from senior officers and the board of a company (and, I would add, from regulators).

  • [1] Stephen W. Hiemstra, "An Enterprise Risk Management View of Financial Supervision," Enterprise Risk Management Institute International, October 2007.
  • [2] This also applies to nonfinancial firms. My book assesses decision making and costly mistakes such as the BP Gulf oil spill, fatalities at the Massey Mining Company, and hospital medical errors. Failures at nonfinancial firms show the same patterns of overbearing or distracted CEOs or others (e.g., doctors) who make poor decisions without obtaining feedback, and cultures that emphasize production without adequate consideration of risk.
  • [3] Financial Crisis Inquiry Commission, "Final Report of the Financial Crisis Inquiry Commission," 2011,181-182.
  • [4] Financial Crisis Inquiry Commission, "Interview of Charles O. Prince," transcript, March 17, 2010, 37 and 41, respectively, available on the FCIC permanent website.
  • [5] UBS AG, "Shareholder Report on UBS's Write-Downs," April 18, 2008, 40.
  • [6] Financial Crisis Inquiry Commission, "Interview of Charles O. Prince," March 17,2010, 73-74; and Financial Crisis Inquiry Commission, "Official Transcript, Hearing on 'The Role of Derivatives in the Financial Crisis,'" June 30, 2010, 151; both available on the FCIC permanent website.
  • [7] Richard Herring and Jacopo Carmassi, "The Corporate Structure of International Financial Conglomerates: Complexity and Its Implications for Safety & Soundness." In Allen N. Berger, Phillip Molyneux, and John Wilson, eds. The Oxford Handbook of Banking, 2009, Chapter 8. "Among the 16 international financial conglomerates identified by regulators as large, complex financial institutions (LCFIs), each has several hundred majority- owned subsidiaries and 8 have more than 1,000 subsidiaries." On the other hand, FCIC staff learned in interviews with federal regulators that many of these subsidiaries and affiliates were small institutions, acquired in a process of accretion, that had little financial significance.
  • [8] Government Accountability Office, "Troubled Asset Relief Program, Status of Government Assistance Provided to AIG," September 2009, 5; AIG, Form 10-K for 2008, 7.
  • [9] Sydney Finkelstein, Why Smart Executives Fail, and What You Can Learn from Their Mistakes (New York: Portfolio, 2003), 251-252.
  • [10] Bear Stearns, "Management Committee: Risk Governance Diagnostic; Recommendations and Case for Economic Capital Development," February 5,2008. Available on the permanent FCIC website.
  • [11] Clifford Rossi, "Removing Barriers to Pathological Risk Behavior: The Art of Effective Communication," Association of Federal Enterprise Risk Management Summit, September 18, 2012.
< Prev   CONTENTS   Next >