Charta is on Google Play: practise on the go. Get the app
Charta

Account for the shifts in regulation and in corporate risk governance that the 2007-2009 financial crisis brought about.

FRM® Part I · Foundations of Risk Management · The Governance of Risk Management · FRM1.FR.3.a

The idea

The 2007-2009 crisis exposed governance failures as much as model failures. Risk functions were siloed, chief risk officers lacked seniority and independence, and boards had little risk expertise. Pay rewarded short-term revenue with no charge for risk. VaR calibrated to calm periods understated tail losses and liquidity risk. The response came in layers. Dodd-Frank (2010) created the Financial Stability Oversight Council, the Volcker Rule limiting proprietary trading, stress tests, resolution plans (living wills) and board risk committees. Basel III raised the quality and quantity of capital and added a leverage ratio, the liquidity coverage ratio and the net stable funding ratio. Supervisors also pushed deferred, risk-adjusted pay and stressed VaR. Remember the pattern: each reform answers a specific crisis weakness, and the exam asks you to match them.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which US law, enacted in 2010 after the financial crisis, created the Financial Stability Oversight Council and introduced the Volcker Rule restricting proprietary trading by banks?

  1. The Sarbanes-Oxley ActWhy not: Sarbanes-Oxley (2002) answered the Enron-era accounting scandals and dealt with auditing and internal controls, not the 2007-2009 crisis.
  2. The Dodd-Frank Wall Street Reform and Consumer Protection Act - correct
  3. The Gramm-Leach-Bliley Financial Services Modernization Act of 1999Why not: Gramm-Leach-Bliley (1999) loosened the separation of commercial and investment banking; it preceded the crisis rather than responding to it.
  4. The Glass-Steagall ActWhy not: Glass-Steagall dates from 1933 and responded to the Great Depression; the Volcker Rule is a different, later measure.

Dodd-Frank (2010) created the FSOC, the Volcker Rule, enhanced prudential standards, stress testing and resolution planning. The other statutes belong to other episodes: 1933, 1999 and 2002.

A harder one

Which compensation practice is most consistent with the post-crisis reforms for staff whose decisions create material risk?

  1. Paying the full annual bonus in cash at year end so that talent is retainedWhy not: Up-front cash on current-year results is the pre-crisis practice that rewarded short-term gains and ignored later losses.
  2. Linking risk managers' bonuses to the revenue of the units they oversee, to align interestsWhy not: This compromises independence; risk staff should be paid independently of the revenue of the businesses they monitor.
  3. Basing desk bonuses on revenue alone, since traders are best placed to judge their own riskWhy not: Pay on revenue alone has no charge for risk or capital and encourages risk beyond the firm's appetite.
  4. Paying a significant share of variable pay over several years, with the right to reduce or recover it if later losses reveal excess risk - correct

Post-crisis rules and supervisory principles favour deferral, risk adjustment, malus and clawback, and pay for control functions that is independent of the units they control.

The hardest tier

A bank's board reviews its governance after heavy losses. The CRO reported to the head of trading, the risk committee consisted of business-line executives, and variable pay was paid in cash on annual revenue. Which package of changes best reflects post-crisis governance expectations?

  1. A CRO with senior independent standing and direct board access, a board risk committee of independent directors with risk expertise, and deferred, risk-adjusted variable pay - correct
  2. A CRO reporting to the head of the largest business to improve commercial awareness, with an independent risk committee and deferred payWhy not: Reporting to a revenue-producing head destroys the CRO's independence, so the package fails even though two elements are sound.
  3. A CRO with direct board access and deferred pay, but a risk committee of senior business-line executives who know the productsWhy not: A risk committee of business executives lacks independence; the board committee needs independent directors with risk expertise.
  4. An independent CRO and risk committee, with risk appetite delegated to management and variable pay kept in cash on annual revenueWhy not: Appetite is for the board to approve and revenue-based cash pay keeps the perverse incentives that the reforms target.

Each pre-crisis flaw has a matching reform: independent, senior CRO; independent board risk committee with expertise; pay that is deferred and risk-adjusted. Packages that keep any one flaw are wrong.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in The Governance of Risk Management