Credit risk management has become core to the performance of latter-day lenders. However, many businesses lack an understanding of the function. Operational heads may assume that the risk management team is performing optimally. But what if it is not? How do you spot the underperforming team?
In many retail banks, credit scoring has become an integral part of the credit risk function and a critical competence for the effective management of the bank’s risk and profit objectives. The advancement of credit scoring within retail banks has brought with it the need for a risk analytics team that has a far greater capability and strategic awareness than was previously required.
Today, the responsibility of the risk analytics team must encompass:
- Scorecard development, monitoring, and refinement
- Strategy design and decision system management
- Portfolio monitoring
- Development of forward-looking risk management information.
This increase in scope, from both an organizational and a deliverable perspective, means that the risk analytics function has become a significant and essential component in the development of value-creating strategies and initiatives within retail banks.
Unfortunately, it is often difficult for senior management, who are not directly involved with the risk analytics function, to know if the team is effectively managing all the above mentioned areas of responsibility. It is also difficult to know whether or not the credit risk models are accurate and correctly monitored, and if outputs are used appropriately.
In many cases, the difficulty in evaluating the performance of the risk analytics function stems from credit risk being perceived as an “expert” area that cannot be managed through the bank’s normal structure. As a result, the risk analytics function is often self-managed, internally focused, and distant from the organization as a whole.
This is a potentially dangerous situation, as an underperforming risk analytics function, if left undiagnosed and unresolved, could be destroying value for the bank. As an example, it is possible that the good:bad odds for certain scorecards are incorrectly calculated which can result in inaccurate loss provisioning calculations and incorrect accept/reject decisions being made on transactions.
In our experience, organizations that are not realizing optimal business benefit from their risk analytics function present the following three high-level symptoms:
- Poor utilization of risk analytics resources
- Limited understanding of risk analytics within the organization
- Underperforming risk models.
Each of these is discussed in detail below.
Poor utilization of risk analytics resources
Although the risk analytics team may appear to be working hard and continuously producing some form of analytics, the relevance and strategic value of these outputs is not always evident. Two issues arise from this sub-optimal use of resources, firstly, the risk analytics team is not cost-effective, and secondly, the tremendous strategic value that can be achieved through credit scoring is lost.
Poor utilization of risk analytics resources is evidenced by four signs:
- Aggressive recruitment of new analysts
- Over production of risk information packs
- Misuse of the risk analytics resources
- Manual production of reports that could be automated.
Aggressive recruitment of new analysts is predominately of junior analysts who are employed in an attempt to free up the senior analysts from labor-intensive activities. Aggressive recruitment may also be in response to underlying staff retention issues. In both cases, the paradox is that junior analysts need to be trained, which takes time, and they lack the business understanding that is required for the strategic focus of the risk analytics function.
The second sign is the distribution of an excessively large risk information pack, produced routinely for both the credit department and the business. This pack is typically very detailed and time-consuming to produce and it seldom adds strategic insight for the intended audience.
The misuse of the risk analytics resources by external business units who do not understand the true role of the risk analytics team is the third sign of poor utilization of risk analytics resources. These business units tend to request management information and ad hoc reports that are outside the scope of the risk analytics function and thus distract the team from functions that are within their scope.
The manual production of reports that could be automated is the next sign. Due to software and system limitations, they are more often produced through laborious queries and as a result the team wastes time on retrieving data from numerous unrelated data sources.
Risk analytics
The risk analytics team has a tendency to become isolated from the bank’s business areas and, as a result, the importance of incorporating credit risk analytics into key business decisions is often overlooked. Strategies that do not include risk elements, but are nonetheless implemented by the business, can have a disastrous impact on the bank’s performance.
Figure 1 (below) is an example of an acquisition model for a retail bank. This shows how flawed models can be damaging to the business. The white area highlights a decision strategy where customers are approved for credit facilities, however, these customers would in fact be value-destroying. This could negatively impact the performance of the specific credit portfolio as well as put unplanned pressure on the client credit management and collection functions.
Figure 1: Decision strategies and customer value
Limited awareness of the importance of risk analytics within organizations can be identified by:
- Unutilized risk outputs
- Poor implementation of models
- Negative attitudes.
The first of these, unutilized risk outputs, indicates that business units, such as product or marketing, either mistrust the information produced by the risk analytics team or have not been made aware of how risk outputs can be incorporated into their business strategies. Retention models that do not take risk analytics into consideration are good examples of where risk outputs are overlooked and not used. In some cases, business units develop alternative risk models, which is effectively a duplication of effort and is also dangerous if people lacking the skills required develop the risk models.
Models may be poorly implemented as a result of the risk analytics team not defining their long-term requirements to ensure that technical solutions will support future risk related plans. In addition, IT is often unable to implement these risk models effectively, as they are unfamiliar with credit scoring technologies or may not give risk solutions due priority. Furthermore, many banks are constrained by inflexible legacy systems that hinder the integration of risk systems and models.
Lastly, the existence of negative attitudes that arise due to conflicting interests or historic issues, may highlight that there is limited awareness of risk analytics within the organization. This is typically seen between the sales and credit functions as a result of a misunderstanding of the risk analytics team’s role. The risk analytics team is often viewed negatively, especially where there is little or no proactive sharing, and communication of, credit risk information and knowledge across the business.
Underperforming risk models
A poorly performing risk analytics team is unlikely to be adequately monitoring risk models to ensure they are delivering accurate outputs. This is problematic as inaccurate risk models can have a widespread negative impact on the business as a result of credit scoring having become so integrated into the bank’s infrastructure. Underperforming risk models can be discovered through:
- Lack of feedback loops
- Difference between expected loss provisions and actual losses
- High levels of overrides
- Lack of adequate change control procedures.
A lack of feedback loops, or champion-challenger efforts is often the result of risk models not being adequately integrated with product and decision technologies. This means that there is no form of continuous improvement and models are not revisited on a regular basis despite significant changes, such as product introductions, changes in the regulatory environment or population shifts.
Another indication of the likelihood of underperforming risk models is the observed differences between expected loss provisions and actual losses as result of inaccurate models rather than variances typical of forecasts. These differences, if observed continuously over time (see figure 2), may indicate that incorrect assumptions are being made with regard to the business dynamics. Outputs should not be accepted without first questioning their accuracy, as fundamental flaws in the risk models could lie hidden in these assumptions.
Figure 2: Comparison of expected and actual losses
A high level of overrides could indicate that business users either mistrust the risk models or that existing risk strategies are no longer relevant to the current business environment. The overriding of automated decisions indicates that users are making subjective risk decisions that could detrimentally affect the bank and nullify the reason for implementing decision systems in the first place.
Finally, a lack of adequate change control procedures to ensure that adjustments to models and decision strategies are thoroughly tested and signe off before implementation may be the result of underperforming risk models. Incorrect changes to existing risk models may have a downstream impact on other models and as a result, could negatively alter the risk position of the bank.
We have developed a simple checklist (please contact the authors for further information and a copy of the checklist) to assist in identifying the symptoms of underperformance, however, identifying the symptoms is only the first step towards improving the performance of the risk analytics function. If banks are to realize maximum value from the risk and credit scoring initiatives within their business, they need to address the underlying problems they identify in the risk analytics function.
