Your firm just suffered its worst year in history and you’re scrambling to improve risk management. What’s the solution? Spend more on IT.
That’s a key suggestion from a report by the Senior Supervisors Group (SSG), a gathering of regulators from the U.S. (including the Fed, OCC, SEC and the New York Fed Bank), Canada, France, Germany, Japan, Switzerland and the UK:
Overall, the crisis highlighted the inadequacy of many firms’ IT infrastructures in supporting the broad management of financial risks. In some cases, the obstacle to improving risk management systems has been the poor integration of data that has resulted from firms’ multiple mergers and acquisitions. This problem has been seen as affecting firms’ ability to implement effective transfer pricing, consistently value complex products throughout an organization, estimate counterparty credit risk (CCR) levels, aggregate credit exposures quickly, and perform forward-looking stress tests. Building more robust infrastructure systems requires a significant commitment of financial and human resources on the part of firms, but is viewed as critical to the long-term sustainability of improvements in risk management.
This is an utterly predictable regulatory response. Sure, some firms have IT gaps that prevent them from properly measuring and mitigating risk. But that’s a symptom of the underlying problem, not the problem itself. Until senior management and boards focus on risk management, IT departments and corporate treasury won’t worry about installing better IT controls.
So why does the SSG report address IT spending (in fairness, it also addresses board and management failings)? Regulators tend to struggle when it comes to getting management and boards to listen, and sometimes the company even has a well-crafted risk management policy that nobody follows–Enron being one example. It’s quick and easy for regulators to demand more technology and hope the latest software catches the next problem.
