Bottom-line CR impact: Goldman Sachs, JPMorgan Chase demonstrate good governance and results, but other firms see fortunes destroyed

By Dennis Schaal

With the housing market implosion spurring writedowns and losses of more than $200 billion in subprime mortgages, other credit, and mortgage-backed securities since the beginning of 2007, and assuredly with more to come, many banks and brokerages are scurrying to revamp the way they manage risk as investors and other stakeholders are demanding answers about what went wrong.

Why things went awry varied from firm to firm, and financial services companies have weathered the crisis to date with divergent degrees of success—or failure (see chart, below).

Merrill Lynch, for example, took a staggering $25.1 billion in writedowns that equate to nearly 2.5 percent of its total assets in 2007, while another investment house of similar size, Goldman Sachs, recorded much smaller writedowns and credit losses of $3 billion, or about 12 percent of what Merrill Lynch did.

And, regarding the bottom line, while Merrill Lynch spewed red ink and Bear Stearns teetered on the brink of bankruptcy before the Federal Reserve and JPMorgan Chase came to the rescue, Goldman Sachs and JPMorgan Chase took their hits from the subprime crisis, but continued to produce billions of dollars in profits in 2007.

What is clear from research into the subprime fallout is that while governance structures may have appeared crisp and clear on organizational flow charts at hard-hit firms, in practice the risk management function often lacked independence and risk responsibility was scattered among multiple risk officers, committees and business units without ironclad oversight.

And, perhaps the most important lesson from the meltdown is that when risk appetites are binging, it takes a strong corporate culture and executive willpower at the highest levels to slam shut the refrigerator door.

Subprime Gets A Hearing

Congress investigated aspects of the subprime issue in early March when a House Committee summoned Angelo Mozilo, Founder and CEO of Countrywide Financial; Charles Prince, former Chairman and CEO of Citigroup; E. Stanley O’Neal, former Chairman and CEO of Merrill Lynch; and the heads of their respective compensation committees for a hearing on “CEO Pay and the Mortgage Crisis.”

The committee noted that Mozilo, who bore the brunt of the day’s heat, earned $1.9 million in salary, received performance-based stock awards of $20 million and sold $121 million of company stock in 2007 while Countrywide, which was heavily into subprime mortgage lending, lost more than $700 million and saw its stock price plunge.

Rep. Peter Welch (D-Vermont) honed in on the risk-management angle of the subprime debacle with his questioning of Prince and Richard Parsons, the Time Warner Chairman who heads Citigroup’s compensation committee.

Welch asked Prince, who resigned in November, but departed with a $10.5 million cash bonus, whether Citigroup had a risk-management solution in place that might have shielded the company from its mammoth writedowns, including an $18.1 billion subprime writedown in the fourth quarter.
Prince conceded that Citigroup’s risk model did not forecast that the bottom was about to fall out of the subprime market.

Parsons added that Citigroup is “reworking” its risk-assessment process. “We had one. We thought it was robust, but we missed it,” Parsons said.

Rep. Welch told CRO after the hearing that having a rigid and enforceable risk-management framework in place should be one of the main responsibilities of CEOs in the financial services—or any— industry. Pointing to governance shortcomings, Welch characterized leaders of the compensation committees at Merrill Lynch, Citigroup and Countrywide as “enablers” for approving lucrative pay packages for under-performing CEOs who allowed risk-management responsibilities to slide.

This is what happens when “irrational exuberance overtakes good judgment and common sense,” Welch said, referring to voracious risk appetites within these companies. “The adults in the room are supposed to be the CEOs.”

Best Practices, Subpar Approaches

Although many firms aggressively gambled on risk with over-exposure to subprime mortgages, mortgage-backed securities and collateralized debt obligations, discipline was maintained at some major firms, especially at Goldman Sachs.

Goldman and JPMorgan were impacted by subprime exposures, but for varying reasons their losses pale in comparison to the red ink at most banks and investment houses, where risk systems were inadequate or CEOs were caught napping when key decisions needed to be made.

In March, the Senior Supervisors Group (SSG), a collection of international financial bodies, including the Federal Reserve, released a report on the risk-management practices of 11 of the world’s largest banks and securities firms as they related to their losses in the subprime mortgage market through the end of 2007.

“In particular, some firms made strategic decisions to retain large exposures to super-senior tranches of collateralized debt obligations (CDOs) that far exceeded the firms’ understanding of the risks inherent in such instruments, and failed to take appropriate steps to control or mitigate those risks,” Federal Reserve Bank of New York Chairman William Rutledge wrote in an introduction to the report.

In other words, the volatile nature of the market and the complexity of CDOs and mortgage-backed securities, which were cobbled together out of subprime loans and other mortgage securities, made them very difficult, if not impossible, to accurately value.

Rutledge noted that the survey and discussions with the banks found that some firms that took major losses didn’t live up to the risk-management challenge of pairing balance sheet growth and liquidity needs. For example, some companies failed to adequately assess and price the risk that some “off-balance sheet vehicles” might have to be funded on the balance sheet, and this occurred “precisely when it became difficult or expensive to raise such funds externally,” Rutledge wrote.

The SSG report didn’t identify the 11 banks and securities firms under its microscope, but it pointed to several risk-management practices that differentiated performance in the subprime fiasco:

Risk Management that Worked

• Some banks and securities firms identified the subprime risks as early as mid-2006 because the CEO, chief risk officer, other senior managers and business-line risk managers “generally shared quantitative and qualitative information more effectively across the organization.” They developed companywide plans to reduce or hedge the risk and did not rely on individual business lines to make the tough decisions.
• The better-performing firms had established “rigorous internal processes requiring critical judgment and discipline in the valuation of holdings of complex and potentially illiquid securities;” they were “skeptical of rating agencies’ assessments” of these securities and compiled their own in-house, independent evaluations; and they applied those latter valuations across the company.
• Companies that wrote down fewer assets had more rigorous controls in place to manage funding liquidity, the balance sheet and capital positions. Business lines had incentives to rein in activities “that might otherwise lead to significant balance sheet growth or unexpected reductions in capital.”
• Managers at firms that emerged with less subprime hurt used a wide range of risk measures and multiple tools, some of which included contradictory, underlying assumptions, and they blended “qualitative and quantitative analysis.” In this way, senior managers received “a high level of insight and consistent communication” about ever-changing market conditions.

Risk Management that Fell Short

• Subprime communication was subpar at firms that experienced greater losses as “business line and senior managers did not discuss promptly among themselves and with senior executives, the firm’s risks in light of evolving conditions in the marketplace.” In these firms, various business lines made decisions about growth and hedging in isolation, and sometimes this increased risk exposure.
• Companies that took major hits in the subprime crisis did not utilize internal processes to challenge valuations, relied more heavily on rating agencies’ assessments, and “often continued to rely on estimates of asset correlation that reflected more favorable market conditions.”
• Firms hurt by subprime exposure had weaker controls, including few incentives, to control balance sheet growth and liquidity problems.
• Companies that were more severely challenged by the subprime collapse “seemed more dependent on specific risk measures incorporating outdated (or inflexible) assumptions that management did not probe or challenge and that proved to be wrong.”

Jonathan Weiner, a Duke University professor and President of the Society for Risk Analysis in McLean, Va., says the risk-analysis shortcomings in the banking industry may be partly due to a “herd mentality” and “groupthink.”

“There is always risk and people sometimes get into trouble when they have a misplaced certainty and think they know the world will go one way,” Weiner said, referring to the misguided notion, for instance, that housing prices would be ever-increasing.

Goldman Took Contrarian View

Goldman Sachs was one company that saw the market changing and took steps to cushion itself against the subprime fall.

Goldman, which issued $44.8 billion in mortgage-backed securities in 2006 and was the fourth leading U.S. player in that business, so far has emerged whole from the subprime shakeout. Goldman had net earnings of $11.6 billion in 2007.

While other banks were digging deeper into the subprime market and setting themselves up for large writedowns relative to their total assets, Goldman Chief Financial Officer David Viniar called a meeting in December 2006 with accountants, controllers and traders, some of whom were very concerned that the company’s position was too long in the then-considered sexy mortgage-securities market. In other words, Goldman owned too much of these complex securities, and the decision was made to reduce the company’s exposure.

Goldman began hedging its position in the first quarter of 2007, and as the housing market deteriorated even further in the second quarter, started to sell the mortgage-backed securities it owned, and wrote down the values of the securities that it couldn’t dump. By the time Goldman announced its earnings for its third quarter in September, the company had a net short position in mortgage-backed securities, and recorded a substantial earnings increase while peers’ net incomes were reversing course.

That contrarian maneuvering away from the mortgage-securities business came as Goldman correctly bet that the pricing on mortgage-backed securities would fall.

Goldman’s risk-management prowess, which led to its shying away from some of its risky business in the mortgage market, contrasted sharply with the performance of other banks and brokerages that were lured by the bull market in housing and trampled when conditions changed.

Goldman, as did many gun-shy financial services firms, declined to make officials available for interviews for this article. But, Goldman CFO Viniar, who has been in that post since 1999, described the company’s risk-management approach at a Credit Suisse Group Financial Services Forum Feb. 6 in Naples, Fla.

“Risk management has long been a part of our culture and is at the center of everything we do,” Viniar said. “The basic framework of our risk management structure is to put the right people in the right seats; provide them with an appropriate level of data; and have a consistent level of dialogue between our traders, controllers, risk managers and senior management.”

Traders and Controllers

Viniar noted that traders and controllers interact with one another, but their duties are separate and the control “infrastructure is entirely independent.”

Committees, including the Firmwide Risk Committee, establish limits, endorse capital commitments and monitor large trades, Viniar explained.

“No trader can move money, settle trades, verify prices or allocate capital,” Viniar said. “Only the control people can do those things.”

However, Viniar characterized Goldman’s traders as “our first line of defense.”

“It’s well known that the best risk managers among our traders are promoted the fastest and end up at the most senior levels of the firm,” he said.

Viniar also offered that senior management at Goldman “is completely involved in managing our risk.”
The CFO added: “I would not tell you that risk management is part of our job. We would all tell you it’s what we do.”

To a lesser extent than Goldman, JPMorgan has navigated the subprime mess so far with less hurt than many of its peers, but it wasn't necessarily because its risk analysis was so finely tuned. Instead, JPMorgan dodged the bullet to a great extent because it arrived relatively late to the mortgage securitization business and had less subprime exposure than many rival firms. JP Morgan’s net income stood at $15.4 billion for 2007, including a profit of $3 billion in an industry-wide challenging fourth quarter.

“For a company of JPMorgan’s size, $1.3 billion is still a painful number, but one that the company can withstand,” says Horst Hueniken, financial services research analyst at Thomas Weisel Partners in Toronto, referring to JPMorgan’s writedowns in the fourth quarter. “Investors have become desensitized to large numbers in the billions, but they are still large numbers.”

Regarding sometimes even larger numbers of writedowns, the CtW Investment Group, which is affiliated with union-back pension funds with some $1.4 trillion in assets, has targeted boards and directors at six banks, taking them on regarding risk-management and governance shortfalls related to subprime issues.

Morgan Stanley

For example, CtW charges that John Mack, the Chairman and CEO of Morgan Stanley, weakened the “status and independence” of the firm’s chief risk officer in 2005 just as the firm was implementing a strategy of “aggressive risk taking.” Instead of reporting to the chairman and CEO, the chief risk officer began reporting to a co-president, who also oversaw trading, and then later the chief risk officer reported to the CFO.

“This is what happens when you have a talented and willful CEO whom the board seems reluctant to challenge,” says Michael Garland, CtW’s Director of Value Strategies.

CtW believes it is a best practice in risk management to have the chief risk officer reporting directly to the CEO, a reporting line now in place at Morgan Stanley and one that is becoming more common in the wake of subprime challenges.

Fine-Tuning Risk Management

Like many financial services firms, Morgan Stanley is shoring up its governance and risk management structures. In February, it brought in a new Chief Risk Officer, Ken deRegt, who is a member of the management committee, and independent risk managers now sit on Morgan Stanley’s proprietary trading desk, which the company blames for poor execution of trades that led to much of the firm’s writedowns last year.

And, in March, Citigroup revealed it took steps to bolster “origination quality and underwriting criteria” in its U.S. residential mortgage business. These steps followed Citigroup’s appointment of a new Chief Risk Officer, Brian Leach, who reports to CEO Vikram Pandit.

One of the prime criticisms of some firms’ risk-management efforts in the subprime arena is that individual business units were operating in “silos,” assessing risk and making decisions on their own, sometimes without full oversight from senior management.

Some firms now are taking steps to sharpen governance procedures and to refine business processes to get more transparency about and control over their sometimes-far-flung business units.
Reporting tools, among other software solutions, can be a component of some of those reforms.
Along those lines SAP, the business software firm, is seeing much interest among banks and brokerages, and other firms beyond the financial services arena, that are seeking to bridge some of those risk divides with an integrated platform, says Narina Sippy, Senior Vice President and General Manager of SAP’s Governance, Risk and Compliance (GRC) Business Unit.

In the past, some firms’ emphasis may have tilted toward compliance and or managing risk “in a somewhat siloed fashion,” Sippy says, adding that a unified GRC approach can tie strategy to execution.

“You don’t just want to report after the fact,” Sippy says.

Much of the heightened interest in risk management is being fed by corporate boards that are “driving executive-level interest,” says John Hagerty, a Vice President and Research Fellow at AMR Research, who follows GRC trends.

Varying Risk Appetites

“For every bank, there will be a different element of risk that they are willing to take,” Hagerty says.
“Systems are only as good as the people and corporations that are willing to use them. You have to have executive commitment.”

When that commitment waned, the damage done to homeowners, investors and the banks themselves was incalculable.

Reverberations in Other Sectors

And, that lack of foresight about the housing-market collapse and credit-market vaporization is reverberating throughout the practices of global corporations, well beyond the banking and brokerage industries.

One reason is that the risk-management in the banking industry is considered to be more advanced than in many other sectors. So, if many banks clearly weren’t up to the rigors of managing their risks, other industries with less robust doomsday modeling and stress testing certainly are reviewing their risk assumptions, procedures and governance structures to avoid their own Bear Stearns-like fates.

Predictions of More Regulation Not a Risky Forecast

The impact of the subprime shakeout, which the International Monetary Fund forecasts could reach almost $1 trillion worldwide, will be felt in the governance, risk and compliance (GRC) arena for years. Some of the likely trends include:

• Increased regulation. Treasury Secretary Henry Paulson in late March outlined
• several regulatory proposals that will be hotly debated in the next Congress. Among Paulson’s proposals, the Federal Reserve would be charged with overseeing the
• market stability of the entire financial sector, including hedge funds and investment banks; all federal bank regulators would be consolidated into one, new regulatory body; and a new super-agency would combine the roles of the Securities and Exchange Commission, the Commodities Futures Trading Commission, and insurance and banking regulators’ consumer protection and enforcement roles, all with the aim of safeguarding the rights of consumers and investors.
• Risk-Management Upgrades: AMR Research forecast that companies in the U.S., Germany and Japan would increase GRC spending 7.4 percent to $32 billion in 2008. While spending on compliance would rise 2 percent to $6.2 billion, it would be outpaced by spending on “operational and enterprise risk management,” AMR stated.
• Hot Jobs: Spending on personnel, rather than on business solutions, still
• dominates GRC spending, and job hunters with GRC skills will be hot commodities at companies fine-tooling their risk strategies.
• Governance Groundswell: The big four accounting firms’ governance consultancies likely will see a surge in business from corporate boards eager to mollify stakeholders and to get their governance practices about risk in gear.