The Common Thread Between Bankers, Doctors and Enterprise Risk Management

One of my favorite books on enterprise risk management theory is a book titled, "How Doctors Think" by Jerome Groopman, M.D. The book isn't actually about ERM, but it provides helpful insight into how you and I think. In his book Groopman points out that most doctors will make a patient diagnosis in less than one minute. They will ask the patient a few questions, observe his or her physical appearance and perhaps go on to run other tests. However, the mental conclusion of the doctor many times has already often been drawn.

The reality is that many of us in business and in banking think the same way. We diagnose the quality of a loan, or a problem with the operation of the bank, or our ability to meet a compliance requirement in a matter of seconds. Our thought process is driven primarily by our own personal experience. We might take more risk when we have had good experience or more knowledge in a particular industry. When we know the people involved we might take more or less risk with a vendor than we would otherwise. When we have had a hand in building a certain process, we are more likely to expect the process to work as designed. When we have hired certain people, we are more likely to have more faith and trust in that person than otherwise would be prudent. This is a natural human nature.

Many decisions in our community bank are made by the senior officer in charge of that area without much outside input. This approach can be very powerful and rewarding when decision makers are thorough, intuitive and experienced. However, often this silo based decision making can leave dangerous blind spots that only someone with outside perspective can see. At a minimum, when decisions are left in the hands of one key officer these decisions are subject to the 60-second rule above. 

Regrettably, in some cases no one takes responsibility for decision making. Recently I interviewed all three levels of management within the lending function of one community bank. Each officer reported proudly that they were "hands off" managers. Each level communicated the benefits of empowering their people to make key decisions. At the end of the day no one took responsibility for managing the details. Unfortunately, the organization was strapped with the fruit of this approach. You can imagine that the outcome was not pretty. Some would say that committees solve this problem, but in many organizations we all know that the committee is likely to agree with whatever the senior officer (to whom most of the committee reports) wants to do. Committee decision making is often what accountants call "form over substance".

Enterprise risk management for our community banks helps to solve this problem. ERM provides better perspective. ERM provides a governance structure that supports bringing collective thinking of key decision makers to bear on every key strategic decision, risk management decision and resource allocation decision for the organization. ERM provides focus on key decisions. It lessens the focus on individual decision making. This approach reduces risk for individual decision makers and the bank. Collective thinking and ongoing measurement of key risk indicators provides better and more thorough perspective to the Board. More thorough analysis and better perspective provide better long-term decision making. Agreement on priorities across the organization provides better deployment of resources. Both of these improvements result in reducing the barriers between strategy and execution.

Top 10 Questions Bank CEO Should Ask Before Adopting ERM

Enterprise risk management is the process of managing the gap between strategy and execution throughout the bank. In other words it is a management tool to help ensure more certain implementation of goals and objectives of the shareholders, Board of Directors, management and the customers. However, ERM is not for every bank. Your organization's structure and processes may already achieve the objectives of ERM. You may only need to define the process as such. Here are 3 of the 10 questions the CEO should ask to determine whether ERM is right for his or her community bank:

1. Are key initiatives driven clearly and directly by the company's vision, mission, values and its strategic plan?

If you answered no, you are not alone. Often we discover that community banks have a documented strategic plan because it is required. However, more often that not these organizations do not use the strategic plan and there is no defining vision for the bank. Management tends to spend more time firefighting and little to no time implementing changes necessary to ensure the business strategy becomes a reality. The ERM process utilizes existing resources to more effectively understand, communicate and implement business strategy and eliminate risks that could stop or slow strategy execution.

2. Do regulators have recurring findings that are similar in nature?

If your answer is "yes", it likely means there are parts of the organization not effectively guided by strategy, personnel or processes. In this case, ERM processes could materially reduce the headache and surprise caused by the regulatory examination process. ERM will help your organization identify and correct process gaps creating these reportable conditions.

3. You, as the bank's CEO, spend very little time managing issues that others in the organization should have identified before you got involved?

No is the common answer to this question. Most community bank CEO's have 8, 10 or 12 direct reports. He or she is the go to person for the BOD and the shareholders and is most usually the "chief relationship officer". With these issues in play there is little time to inspect the expected from the management team. Time for analytics and strategy development or deployment is just not there. ERM helps simply organize and streamline the flow of communication surrounding strategy, risk management and the information necessary to make good risk management decisions on a daily basis.

More of the Top 10 questions your financial institution CEO should ask before adopting enterprise risk management to come.

What is ERM for a Community Bank?

The OCC has created capital guidance that will push more community banks to adopt an enterprise wide risk management approach.  Most community bank CEO's want to know "What is ERM or enterprise risk management?" To them it is another compliance matter they must deal with. We want to take a few minutes to give you a more useable definition of ERM. This might help you see why ERM is becoming increasingly popular with community bankers and credit unions.

The Treadway Commission's Committee of Sponsoring Organizations (COSO) first formally defined ERM in 2004. The COSO team describes the need for ERM as arising from, "a series of high-profile business scandals and failures where investors, company personnel and other stakeholders suffered tremendous loss." The purpose of their initial report on ERM was to better enable management to meet its most critical challenge of "determining how much risk the entity is prepared to and does accept as it strives to create value."

In its most simple form we describe ERM this way: "ERM is the process of managing the gap between business strategy and execution of that strategy."

One of my early mentors used to say that "ideas are money and execution is for monkeys". After managing a large part of a large financial institution myself, today I would beg to differ with this comment. From experience, you and I both know that ideas are truly a dime a dozen. Making ideas a reality is where the rubber hits the road. The reason implementation is difficult is because there is a "gap" between the idea and the implementation. 

As my grandfather used to say, "boy you don't know what you don't know". This gap that is so difficult to overcome - the one between strategy and execution - is uncertainty. Uncertainty is the definition of risk. So, when we talk about managing risk on an enterprise wide basis we are really saying "let's see if we can do something about issues we know about or should know about that could stop or slow down what we are trying to accomplish for the shareholders and for our customers." ERM is truly the process of managing the gap between strategy and execution. 

ERM in its best and most usable form uses the existing management team and structure. However, a process is created to help management measure, track and implement business strategy and implement changes necessary to reduce risks that could impair that strategy. In either case, the result is more certain strategy implementation.

As a key manager of risk in your community financial institution, what are some unknown issues that have become a reality and stopped or slowed execution of strategy in your organization?