Something bad's happened
We have to add new controls
Oh! Happened again

[Next verse same as first
....
Next verse same as first]

* Haiku is a Japanese poetry form in which a concept is encapsulated in 17 sounds/syllables, typically in three lines of 5, 7 and 5 sounds.

See also the Risk Managers' Job Description

APRA leads the supervisory field by demanding that regulated banks ensure that 'the performance-based components of remuneration must be designed to align remuneration with prudent risk-taking'. [Note the emphasis on 'prudent', how will that be measured?]

Under the new rules, performance-based components of risk-takers' remuneration must incorporate 'adjustments' to reflect not only the risks taken, actual outcomes and the time for risk outcomes to emerge, but also 'the cost of the associated capital'. In effect there must be some form of 'Risk Adjusted Performance Measurement' (RAPM), such as RAROC (Risk Adjusted Return on Capital).

Without detailing in any way how risk-adjusted performance is to be measured, APRA requires that remuneration policies must cover senior management and risk takers, whose 'activities, individually or collectively, may affect the financial soundness of the institution'. [In practice a lot of (very powerful) people].

Of interest in this forum, is that the regulator requires that new policies explicitly cover remuneration for 'risk and financial control personnel', ensuring that remuneration of risk management staff does not 'compromise the independence of these personnel in carrying out their functions'. The new rules dictate that the Board Remuneration Committee must have 'free and unfettered access to risk and financial control personnel and other parties (internal and external) in carrying out its duties'.

[Note that for insurers, APRA includes Actuaries in its definition of 'risk and financial control personnel'].

Risk Managers will have, at least, three roles in implementing the new policies.

First, the risk management function, led by the Chief Risk Officer (CRO), will have to take the lead in developing RAPM methodologies and ensuring that they are understood and approved by the Remunerations Committee and senior management, as part of the firm's overall Risk Management Framework.

Secondly, and potentially more treacherous, risk managers will be forced to make judgments on individual business managers as to their risk management behaviors. In practice, normal events, such as risk limit breaches, will gain enormously in importance, as the resolution of such events will impact on the evaluation of a risk-taker's adherence to risk policies. Expect more blowback from business!

Last, risk management professionals will have to be rewarded on a basis that is independent of the performance of the businesses that they serve.

What will be the rules for remunerating risk professionals under new rules?

Obviously the occurrence of a risk event, or not, is not a valid measure. If a risk manager estimates that a firm will probably incur a particular loss once every year, say, and nothing happens: is the risk manager good, bad, or just lucky?

Reward for risk managers, in such a new regime, must be based not only on risk assessment abilities but also on softer skills such as their ability to improve the 'risk culture' of the firm overall. Since risk culture is extremely difficult to measure, influence on changing culture will probably be impossible to measure.

So what makes a good risk manager?

Obviously, 'skill' will be important and that, to a great extent, will be impacted by education and ongoing evaluation. In the new risk reward model, certification, such as the PRM designation, will become increasingly important, and will be necessary, but not sufficient. There must also be ongoing evaluation of a risk practitioner's skill set. I.e. there must be some form of Continuous Professional Education (CPE) for risk managers and potentially gradation in qualifications, such as the attainment of Fellowship status by examination, as in the Actuarial profession.

Professionalism will be important. How risk managers conduct themselves, with clients, colleagues and potential adversaries will be important to any evaluation of their contribution to a firm's risk culture. PRMIA's Standards of Best Practice, Conduct and Ethics, is a good starting point for evaluating adequate levels of professionalism but will probably need expansion going forward.

Lastly, knowledge and experience will be essential. Risk managers gain a 'feel' for risk though exposure to risk making decisions, both good and bad. Difficult to measure but essential to evaluation, experience 'in battle', and the ability to use that experience productively, will become a key determinant of a risk manager's 'worth'.

APRA is the first regulator into print, but one only has to pick up the financial press to see that similar rules are on their way, everywhere!

Who will Boards turn to when the issue of risk-adjusted performance is tabled? The first port of call will be Human Resources, of course, but Risk will not be far behind.

What will the risk profession do when the question is asked?

I suggest that 'don't know' will not be a satisfactory answer!

There is a need for risk professionals to think about these issues as a matter of some urgency and one of the first questions to tackle is

'How much is a Risk Manager worth?'