Non-financial risks (NFR) are becoming a more significant threat to financial institutions than financial risks. A CRO’s role is evolving, as these intangible threats, like climate risk, cyber threats, and reputation damage, require a culture-driven appro
display-middle-ads-here
In my capacity as a chief risk officer, I oversee a broad
spectrum of risks which are largely divided into two pots. We call them
financial and non-financial risk, a delineation which is commonly acknowledged
in the banking industry.
Financial risks are the ones that first come to mind when I
talk about finance and risk management in a social setting, like at a cocktail
party where I might casually chat with another guest.
The guests understand credit risk and, with a little bit of
explaining, market risk. But at this gathering, I rarely have the opportunity
to delve deeper and explain how, as a CRO, I spend an increasingly large amount
of my time on something incredibly interesting and intellectually challenging,
which is non-financial risk (NFR).
If it does come up, I keep the explanation high level (and
hopefully intriguing), saying a large part of my role is focused on people and
corporate culture. Let me explain.
In banking, institutions are spending more money and time
on managing compliance with regulations, reducing operational errors, fighting
fraud and cyber threats. Add to that geopolitical uncertainties, climate risk
and other external events, and the list of nonfinancial risks starts to become
quite long.
Managing these risks is increasingly important because of
the ever-changing external environment, the complexity of large banks, and
regulators’ increasingly high expectations.
My argument is that despite its moniker, the impact of NFR
on financial institutions is in many ways more threatening than that of
financial risks.
NFR poses distinctive challenges, necessitating a departure
from conventional financial risk management approaches that have been in place
for decades. The problems NFR poses for CROs is that some NFR events are more
difficult to predict.
Take climate risk as an example. The long term trend of
more volatile weather events is very clear, yet the location and severity of
the next big storm or drought can be hard to predict.
Reputation takes years to build, so protecting it is
essential. The goal is to avoid the occurrence of any material events that
might affect organizational reputation negatively. But the potential impact on
the firm of any event is hard to quantify.
A bank’s reputation in the market or its relationship with
regulators and media is precious, and damage to it can be immeasurable.
Consequently, it is difficult to apply the traditional
financial risk management approach when addressing these risks.
Risk appetite’s battle with NFR
Typically, the risk management process starts with defining
a risk appetite, and assessing the threshold within which a financial
institution is willing to assume certain risks.
Financial risk is commonly expressed in monetary terms –
typically representing the amount a bank is prepared to put at risk and
potentially lose.
However, setting risk appetite for NFR is a much more
elusive and theoretical concept. How do you set a risk appetite for an event
when your stated tolerance should be zero occurrences?
Or how do you quantify damage to the firm’s reputation, for
example being mentioned in a less-thanflattering story on the front page of The
Financial Times?
