Risks over the horizon, and how to prepare

Lately I’ve attended many funerals and memorial services for friends, neighbors, and colleagues.

Earlier this month it was my sad responsibility to attend the services for a colleague whom I met on my first working day in New Mexico in 1991. Paul Boushelle was an executive vice-president at First National Bank in Albuquerque and was manager of bank operations and retail banking until his retirement in 1999. By then, we were First Security Bank of New Mexico and Paul’s influence had shifted from purely New Mexico issues to regional concerns within First Security’s six-state footprint and our focus on a smooth transition to and through the anxiety-laden Y2K issues.

Paul was suitably and fittingly eulogized by friends and family and by one of his bank operations protégés during her first years with the bank. My thoughts came sharply into focus during her comments as she gave her firsthand reflections on what Paul contributed to the bank and to her personal development as a banker.

Risk management’s natural roots

She described how Paul would ask questions like “Why” and “Why not” and “What if” and “What next?”

I suddenly realized that questions like these are prominent in a risk anticipation and management context. Paul had not accidentally stumbled onto what are now very current issues but rather intuitively understood these 25 or 30 years before they became obvious to most anyone else.

His perspective was not particularly concerned with this week or this quarter. No, Paul’s perspective was not unlike what navies around the world think about—the risks and challenges that lie just out of view around the curvature of the earth.

Fittingly enough, Paul was a naval veteran so he really did have a practical sense about trying to anticipate what was not yet in view.

Sorting out the risks ahead

Bankers like to say that ours is by definition a risk-taking business. Normally we tend to compartmentalize risk by categories such as credit risk, liquidity risk, capital risk, strategic risk, market risk, compliance risk, and operational risk. Unfortunately, simply knowing about each category isn’t enough anymore. We have to figure out the linkages between one category and the other and look for problem intersections.

The links between credit risk and liquidity risk are obvious to all. But what other types of links exist that unite these and connect types of risks that are not necessarily evident?

Operational risk is one type that can be insidious because it is not usually thought about in the proper context.

One way to understand the durability of operational risk is the Return on Equity ratio. Most consider this ratio to be the fundamental way to calculate how any enterprise is performing for its owners. Equity represents the financial interest of the shareholders or owners of the business. What their investment earns ultimately is a very reliable scorecard on how wealth performs. The higher the return on equity, the better the result is for the ownership.

That’s not the whole story, though.

Balancing risks and payoffs

Investors are also concerned about consistency and predictability of performance. These characteristics are not unrelated to the degree of risks assumed in the business. More risk is almost always accompanied by more volatility in financial results.

If we minimize risk, we are limiting the opportunity for a higher level of financial performance. If we take on too much risk, then we are implicitly taking on more volatility in our performance results. About the worst thing we can do for our owners is to assume a level of risk that we don’t understand or fail to estimate correctly.

Operational risk is an area where we often underestimate the degree of risk simply because we’re not looking hard enough nor do we link up the silos and look for interconnected exposures.

Sweating details … and the cost of not doing so

Paul Boushelle understood that, which is why he insisted on high performance standards for routine processes. When First Security acquired us and converted our systems to theirs, the difference between Paul’s standards and our new owner’s in at least one area was stark. We learned this when converting our deposit systems many months after the merger of the two banks was accomplished.

First Security was required to notify First National’s  “households” of the terms and conditions of its deposit accounts. Notice was by mail and often consisted of bulky printed materials.

Our principal ownership family at First National received 65 identical pieces of mail on the DDA account transition alone. Their business interests were complex and diverse but the point of householding is to know how the various accounts are related and “roll up” into a consolidated entity. Considering that each mailed piece had postage (15 years ago) of over a dollar, it was evident that at least in that one area things were amiss and it was costing a lot of money unnecessarily.

Several years before, when he assumed reporting responsibility for First National’s CIF, Paul set an acceptable error rate of not more than one half of one percent. The remarkable thing is how quickly the accuracy of the system deteriorated when Paul was no longer in charge and his standards were viewed as unnecessary.

Effective operational risk control means watching things like the teller over and under statistics, other losses, training to a high standard, automating internal routines to eliminate hand processing and taking the variability out of day to day routines .

Risk management and creativity go together

As I worked with Paul over the years I admired his creativity which was amply demonstrated as we successfully introduced as the state of New Mexico’s fiscal agent one of the first electronic benefit cards nationally for the food stamp program and the state’s aid to dependent children’s entitlement.

Paul also came up with the idea of a mobile branch, which in the late 1980s meant an ATM installed in a converted motor home. This was so successful that we designed and delivered similar vehicles for banks in other states and it became a significant source of other income for a time.

Ultimately, operation risk management requires quality

Paul’s real genius, I have come to realize, was in successfully tackling the much less obvious operational risks. His contribution to the industry and to his staff of mostly young, hardworking people lay in activities and personal example of standards that have come into industry prominence many years after he became their chief practitioner at First National.

When one uses the term “quality” in the context of the banking business, my association in the people sense will be to think of Paul.

That means, in U.S. Navy parlance, “Job well done.”