Global Risk Management

Global risk management
survey, ninth edition

Operating in the new normal:
Increased regulation and heightened
expectations
Global risk management survey, ninth edition
About the editor

Edward Hida
Edward Hida is the global leader of Risk & Capital Management and a partner in the Governance,
Regulatory & Risk Strategies practice of Deloitte & Touche LLP, where he leads Risk & Capital
services. He has substantial experience consulting on a variety of financial risk management and
capital markets issues, and has completed a wide range of risk management consulting assignments
for US and global financial services organizations.
Acknowledgements
This report is a result of a team effort that included contributions by financial services practitioners
from member firms of Deloitte Touche Tohmatsu Limited around the world. Special thanks
are given to Bayer Consulting for administering the survey and their assistance with the
final document.
In addition, the following individuals conducted analysis and provided project management,
editorial, and/or design support:
Andrew Brooks Stuart Shroff

United States United States
Deloitte & Touche LLP Deloitte & Touche LLP
Michelle Dahl Jeanne-marie Smith

United States United States
Deloitte Services LP Deloitte & Touche LLP
David Merrill
United States
Deloitte Services LP
About Deloitte’s financial services industry practice
A recognized leader in providing audit, tax, consulting and financial advisory services to the
financial services industry, Deloitte’s clients include banks, securities firms, insurance companies,
investment managers, and real estate services companies from around the world. Over 35,000 prac-
titioners, including 4,400 partners, are dedicated to serving financial services industry clients across
more than 40 member firms in the Deloitte network.
Operating in the new normal: Increased regulation and heightened expectations
Contents
Foreword | 2
Executive summary | 4
Introduction: Economic and business environment | 6
Risk governance | 15
Enterprise risk management | 22
Economic capital | 26
Stress testing | 28
Sector spotlight: Banking | 31
Sector spotlight: Insurance | 35
Sector spotlight: Investment management | 39
Management of key risks | 46
Credit risk | 47
Market risk | 48
Liquidity risk | 48
Asset liability management | 49
Operational risk | 49
Regulatory risk | 51
Risk management information systems and technology | 53
Conclusion | 55
Endnotes | 57
1
Foreword
Dear colleague, practice. In the area of capital adequacy, almost

all the banks surveyed that are subject to Basel
W E are pleased to present the ninth edi-

tion of Global risk management survey,
the latest installment in Deloitte’s ongoing
III requirements already meet the minimum
capital ratios. Further, the tidal wave of regula-
tory developments ushered in by the global
assessment of the state of risk management financial crisis shows no signs of abating,
in the global financial services industry. The especially for large institutions deemed to be
survey findings are based on the responses of systemically important.
71 financial institutions from around the world Risk management must respond to “the
and across multiple sectors, representing a total new normal”—an environment of continual
of almost US$18 trillion in aggregate assets. regulatory change and ever more demand-
We wish to express appreciation to all the sur- ing expectations. In the United States, the
vey participants for their time and insights. Federal Reserve has introduced the Enhanced
Financial institutions continue to make Prudential Standards and the Comprehensive
progress in many areas of risk management. Capital Adequacy Review. In Europe, the
Boards of directors are devoting more time to European Central Bank assumed responsibility
risk management and most boards are address- for the prudential supervision of the region’s
ing key issues such as approving the risk appe- banks, and has conducted its comprehensive
tite statement and aligning corporate strategy assessment asset quality review and stress tests.
with the organization’s risk profile. Having a In addition, a new European Union Capital
chief risk officer position and an enterprise risk Markets Union is under development. The
management program is becoming prevailing Basel Committee for Banking Supervision
2
is introducing higher standards for capital Financial institutions must not only comply
adequacy and liquidity. The Solvency II capital with these new regulatory requirements and
adequacy regime is due to become effective priorities, they also need the flexibility to
for European insurers at the beginning of respond to the next round of regulatory devel-
2016, while the International Association of opments that is likely over the coming years.
Insurance Supervisors is developing a global This will require strong risk management capa-
insurance capital standard. These are just a few bilities, robust risk infrastructures, and timely,
of the many new regulatory initiatives under- high-quality risk data that are aggregated
way around the world. across the organization.
Two emerging risks in particular are receiv- We hope that this comprehensive examina-
ing increased attention from financial institution of risk management at financial institu-
tions and their regulators. Cyber attacks on tions around the world provides you with
corporations, including financial institutions, helpful insights into today’s challenges and
have increased dramatically in the last few stimulates your thinking on how to further
years, requiring institutions to strengthen the enhance your organization’s risk management.
safeguards for information systems and cus-
tomer data. Regulators are more closely scru- Sincerely,
tinizing how institutions manage conduct risk
and the steps they are taking to create a risk Edward T. Hida II, CFA
culture and incentive compensation programs
that encourage ethical behavior. Global leader, Risk & Capital Management
Global Financial Services Industry
Deloitte Touche Tohmatsu Limited
3
Executive summary
T HE global financial crisis was the catalyst

for an era of sweeping regulatory change
that shows little sign of abating. Across the
the world that operate across a range of finan-
cial sectors and with aggregate assets of almost
US$18 trillion.
financial services industry, regulatory require-
ments are becoming broader in scope and Key findings
more stringent.
More focus on risk management by
After new regulations are enacted, it can
boards of directors. Reflecting increased regu-
take years before their practical implications
latory requirements, 85 percent of respondents
become clear. Although the Dodd-Frank
reported that their board of directors currently
Wall Street Reform and Consumer Protection
devotes more time to oversight of risk than it
Act (Dodd-Frank Act) in the United States
did two years ago. The most common board
and Basel III were introduced several years
responsibilities are approve the enterprise-level
ago, their rules are still being finalized.
statement of risk appetite (89 percent) and
New regulatory developments include the
review corporate strategy for alignment with the
US Federal Reserve’s Enhanced Prudential
risk profile of the organization (80 percent).
Standards (EPS), the European Central Bank
Broad adoption of CRO position. During
(ECB) becoming the prudential supervisor
the course of this global risk management
of Eurozone banks, a new Banking Standards
survey series, the existence of a chief risk
Review Council in the United Kingdom, and
officer (CRO) position has grown to be nearly
Solvency II becoming effective for European
universal. In the current survey, 92 percent of
insurers in 2016.
institutions reported having a CRO or equiva-
The new regulatory landscape is placing
lent position, up from 89 percent in 2012 and
demands on financial institutions in such areas
65 percent in 2002. Although it is considered
as corporate governance, risk appetite, capital
a leading practice1 for the CRO to report to
adequacy, stress tests, operational risk, technol-
the board of directors, only 46 percent of
ogy data and information systems, and risk
respondents said this is the case, while 68
culture, to name only some areas of focus. As
percent said the CRO reports to the CEO.2 In
institutions prepare to comply, they will need
a positive sign, 68 percent of respondents said
the flexibility, in both their business models
the CRO has primary oversight responsibil-
and compliance programs, to respond to the
ity for risk management, an increase from
seemingly inevitable next round of reforms.
42 percent in 2012. Three responsibilities of
Deloitte’s Global risk management survey,
the independent risk management program
ninth edition assesses the industry’s risk man-
led by the CRO were cited by more than 90
agement practices and challenges in this period
percent of respondents: develop and implement
of reexamination. The survey was conducted in
the risk management framework, methodolo-
the second half of 2014 and includes responses
gies, standards, policies, and limits; oversee risk
from 71 financial services institutions around
model governance; and meet regularly with
4
board of directors or board risk committees. Yet focus on the steps that institutions can take to
only 57 percent of respondents said their risk manage conduct risk and to create a risk cul-
management program had the responsibility to ture that encourages employees to follow ethi-
approve new business or products. cal practices and assume an appropriate level
ERM becoming standard practice. It has of risk, but more work appears to be needed
become a regulatory expectation for larger in this area. Sixty percent of respondents said
institutions to have an enterprise risk manage- their board of directors works to establish and
ment (ERM) program, and this is reflected embed the risk culture of the enterprise and
in the survey results. Ninety-two percent of promote open discussions regarding risk, and a
respondents said their institution either had an similar percentage said that one of the board’s
ERM program or was in the process of imple- responsibilities is to review incentive compensa-
menting one, an increase from 83 percent in tion plans to consider alignment of risks with
2012 and 59 percent in 2008. Another positive rewards, while the remaining respondents said
development is that among these institutions, these were not among the board’s responsibili-
78 percent have an ERM framework and/or ties. Only about half of respondents said it was
ERM policy approved by the board of directors a responsibility of their institution’s risk man-
or a board committee. agement program to review compensation plan
Progress in meeting Basel III capi- to assess its impact on risk appetite and culture.
tal requirements. Eighty-nine percent of Increasing importance and cost of regula-
respondents at banks subject to Basel III or to tory requirements. When asked which risk
equivalent regulatory requirements said their types would increase the most in importance
institution already meets the minimum capital for their institution over the next two years,
ratios. The most common response to Basel regulatory/compliance risk was most often
III’s capital requirements was to devote more ranked among the top three, and 79 percent
time on capital efficiency and capital allocation felt that increasing regulatory requirements and
(75 percent). expectations were their greatest challenge. The
Increasing use of stress tests. Regulators most important impact of regulatory reform
are increasingly relying on stress tests to assess was noticing an increased cost of compliance,
capital adequacy, and respondents said stress cited by 87 percent of respondents.
testing plays a variety of roles in their institu- Risk data and technology systems con-
tions, including enables forward-looking assess- tinue to pose challenges. Again in 2014, the
ments of risk (86 percent), feeds into capital and survey results indicated a need for continued
liquidity planning procedures (85 percent), and improvement to risk data and information
informs setting of risk tolerance (82 percent). systems. Sixty-two percent of respondents said
Low effectiveness ratings on managing that risk information systems and technology
operational risk types. Roughly two-thirds of infrastructure were extremely or very challeng-
respondents felt their institution was extremely ing, and 46 percent said the same about risk
or very effective in managing the more tradi- data. Issues related to data quality and infor-
tional types of operational risks, such as legal mation systems were also considered by many
(70 percent), regulatory/compliance (67 per- respondents to be extremely or very challeng-
cent), and tax (66 percent). Fewer respondents ing in complying with Basel III (56 percent)
felt their institution was extremely or very and Solvency II (77 percent), and in managing
effective when it came to other operational risk investment management risk (55 percent).
types such as third party (44 percent), cyberse- Going forward, 48 percent of respondents were
curity (42 percent), data integrity (40 percent), extremely or very concerned about the abil-
and model (37 percent). ity of the technology systems at their institu-
More attention needed on conduct risk tion to be able to respond flexibly to ongoing
and risk culture. There has been increased regulatory change.
5
Introduction: Economic and

business environment
D ELOITTE’S Global risk management

survey, ninth edition assessed the risk
management programs and challenges at 71
The US GDP grew 2.4 percent in 2014, and
the World Bank predicts the US recovery will
continue, with growth at 3.2 percent in 2015.4
financial services institutions representing a Although the United States had its strongest
range of geographic regions, asset sizes, and year for job growth since 1999, real wages have
industry sectors. (See “About the survey.”) The not advanced.5 In 2014, average hourly wages
survey was conducted as regulatory changes increased only 1.65 percent, roughly the same
continued to sweep over the industry and amid as the inflation rate.6
an uncertain outlook for the global economy. The UK recovery has continued, with
growth of 2.8 percent in 2014, and a similar
Economic storm clouds pace is anticipated for 2015.7
The outlook is darker in other regions.
Although the US and UK economies
Although the Eurozone economies are no
continued to grow, economies in the Eurozone
longer contracting, GDP grew by only 0.9
and Japan remained weak. Emerging markets,
percent in 2014 and is expected to expand by
especially China, are also growing more slowly
1.1 percent in 2015.8 In January 2015, the ECB
than in the past. The strength of the US dollar
launched a $1.25 trillion package of quantita-
is having major but unpredictable impacts
tive easing in an effort to prevent deflation
on many economies. By March 2015, the US
and stimulate growth.9 A new government was
dollar had increased in value by 25 percent
elected in Greece in early 2015, promising to
compared to a basket of commonly used
end austerity policies and demanding forgive-
international currencies since the US Federal
ness of debt by external creditors, renewing
Reserve announced in 2013 that it would
concerns that the country may exit from the
phase out quantitative easing.3 As a result, debt
euro. The economy in Japan was stagnant,
service has become an increasing burden for
with no growth in 2014 and growth of only 1.2
companies outside the United States that have
percent anticipated in 2015.10
borrowed in US dollars, while exporters in
Emerging markets, especially China, are
these countries have become more competi-
not growing at the blistering pace they once
tive. Another important trend has been the
were, due to weaker demand from devel-
dramatic fall in energy prices. Lower energy
oped countries that has not been replaced by
prices are expected to benefit many economies,
demand from their internal markets. Growth
but will have adverse effects on certain oil-
in the Chinese economy slowed to 7.4 percent
producing countries, such as Russia, and on
in 2014 and is predicted to decline further to
financial institutions with exposures to these
7.1 percent in 2015.11 Falling demand from
countries or to companies in or dependent on
China is expected to have a negative impact
the energy sector.
on commodity-producing countries such as
Australia, Brazil, and Russia.
6
Continuing regulatory reform In 2014, the US Federal Reserve announced

the final EPS covering banks with more than
The focus of regulators on such issues as
$10 billion in consolidated assets and places
capital adequacy, liquidity, operational risk,
additional requirements on banks with assets
governance, and culture is driving change
of $50 billion or more. These standards codify
throughout the financial industry. The impacts
regulatory requirements on risk management
have been widespread as new requirements
topics including capital, debt-to-equity ratio,
continue to be proposed by regulators around
liquidity, counterparty limits, risk governance,
the world, even as the final rules to imple-
stress testing, and early remediation. Many
ment existing laws are still being written.
financial institutions will need to enhance their
Complying with multiple, sometimes conflict-
capabilities to meet these requirements.
ing, regulatory requirements implemented by
The Federal Reserve also introduced EPS
different regulatory
for foreign banks
authorities poses
(FBOs) and for non-
a significant chal-
lenge for global The focus of regulators bank systemically
important financial
financial institutions.
Applicable to on such issues as institutions (SIFIs).
Foreign banks that
US bank-holding
companies with $50 capital adequacy, have total global
assets of $50 billion
billion or more in
consolidated assets,
liquidity, operational or more and also
have $50 billion or
the Federal Reserve’s
Comprehensive
risk, governance, and more in US non-
branch assets are
Capital Adequacy culture is driving required to hold
Review (CCAR) has
among its objectives change throughout the minimum levels of
capital, maintain
to increase the likeli-
hood that institu- financial industry. minimum levels
of highly liquid
tions have sufficient
assets, and conduct
capital to continue
stress tests, as are
operations through-
US banks. Some foreign banks are building up
out times of economic and financial stress.12
their US operations to comply, while others
The CCAR also applies to larger foreign banks
are evaluating which of their businesses should
operating in the United States.
remain in the United States.
Regulators have extended the scope of
There have also been significant changes in
CCAR to cover all the dimensions that could
the European regulatory environment. These
potentially impact capital adequacy.13 Under
include the ECB becoming the prudential
CCAR, the Federal Reserve reviews an insti-
supervisor of Eurozone banks, the creation
tution’s capital planning processes to assess
of the Single Resolution Board to address the
whether they are adequate to identify, measure,
resolvability of cross-border banks, and a new
assess, and control risks; incorporate strong
Banking Standards Review Council in the
internal controls; and include effective over-
United Kingdom.15
sight by the board of directors and manage-
The implementation of Basel III continues
ment.14 The Federal Reserve has indicated that
with new requirements for capital adequacy
it expects to continually raise its expectations
and liquidity. New requirements proposed by
for CCAR, requiring banks to constantly
the Basel Committee on Banking Supervision
upgrade their capabilities.
(Basel Committee) for operational risk and
7
credit risk would replace existing standardized retain substantial discretion on the application
approaches and bring these methodologies of the rules. The final form of the ring-fencing
closer to the advanced approaches. In October rules remains unclear, and in December 2014,
2013, the Basel Committee issued a consulta- a draft report by the European parliament
tive paper containing a revised framework for proposed that the new rules should remove the
market risk.16 presumption that deposit-taking and trad-
In response to the allegations of miscon- ing should be separated and instead provide
duct in setting the LIBOR rate and in the regulators with the flexibility to use other tools
foreign exchange markets, both the Financial to reduce risk.20
Stability Board (FSB) and the International
Organisation of Securities Commissions Higher capital requirements
(IOSCO) have worked on standards of
Concerned about the solvency of finan-
behavior related to rate fixing. IOSCO has
cial institutions in times of financial stress,
also released a policy recommending that
regulators have been requiring them to hold
financial institutions assess the suitability
more capital. The Basel Committee is pursu-
of wholesale and retail clients when selling
ing multiple efforts to transform the current
complex products.
Basel III capital regime. These efforts include
Banks are also facing new regulations that
proposals to revamp the capital charge regimes
require them to restructure their operations.
for both credit and operational risk, and a
Under the Federal Reserve’s FBO EPS, foreign
new requirement for Total Loss-Absorbing
banks operating in the United States that have
Capacity (TLAC), which will require addi-
total global assets of $50 billion or more and
tional financial resources.
also have $50 billion or more in US non-
The US Federal Reserve has also increased
branch assets are required to form an inter-
its capital requirements, as well as adopted a
mediate holding company and run their US
requirement for TLAC. One estimate is that US
operations as a standalone bank.
banks will need to add as much as $68 billion
In Europe, several structural reform initia-
in additional capital to comply.21 In Australia,
tives may require banks to revise their busi-
the Financial System Inquiry has also recom-
ness models and restructure their operations
mended adopting a standard for TLAC.
due to restrictions placed on businesses such
Solvency II, a capital adequacy regime
as proprietary trading and requirements for
for European insurers, is due to come into
ring-fencing their retail operations and their
effect on January 1, 2016. The International
investment banking and trading operations
Association of Insurance Supervisors (IAIS) is
into separate subsidiaries.17 Legislation now
also developing a risk-based global Insurance
exists in France, Germany, Belgium, and the
Capital Standard, which is expected to be com-
United Kingdom. In the United Kingdom, the
pleted by the end of 2016.
largest banks were required to submit pre-
liminary plans in January 2015 to the Bank of
England’s Prudential Regulation Authority for Stress testing
how they will implement ring-fencing of their There has been a trend for regulators to rely
retail banking operations.18 In 2014, the EC more on stress tests to assess capital adequacy.
issued a proposal to ban proprietary trading In the United States, stress tests have become
and require ring-fencing for EU-headquartered the primary capital constraint for banks, with
global systemically important banks (G-SIBs) the Federal Reserve requiring stress tests of
as well as other banks with substantial trad- all banks with $10 billion or more in assets
ing activities in the European Union, even to assess how well they could withstand a
if headquartered elsewhere.19 Under the EC major downturn in the economy and the
proposal, national regulatory authorities would financial markets. “Stress testing ... holds
8
great promise as a capital tool, a risk-sensitive

capital tool, for big institutions,” said Daniel
K. Tarullo, a governor of the Federal Reserve
who sits on the Federal Reserve’s financial
stability committee.22
The ECB conducted stress tests of European
banks in 2014. Considered less rigorous
than the US stress tests, only 13 of 130 banks
failed to pass once measures taken in 2014 to
improve their capital are taken into account.23
For its next round of stress tests, the ECB is
planning a more intensive examination of the
region’s banks that focuses on the risks and
viability of their business models.24 The Bank
of England also conducts stress tests and told
its banks that the tests in 2015 would be more
exacting and focus more on risks from over-
seas markets.25 In Australia, the Australian
Prudential Regulatory Authority conducted
stress tests in 2014 of banks’ mortgage books
across the industry, concluding that the coun-
try’s banks were poorly prepared to recover or not. The five major US banking regulatory
from another financial crisis.26 bodies charged with implementing the Volcker
With stress tests being required by the Rule will be issuing a report, as mandated by
US Federal Reserve, the ECB, the Bank of the Dodd-Frank Act, which will list which
England, and other regulators, some large activities are allowed.28
global institutions will be subject to stress tests Banks covered by the Volcker Rule
conducted by multiple regulators. must comply by July 21, 2015.29 However,
For European insurance companies, in December 2014, the Federal Reserve
stress tests in 2014 required by the European announced that banks would have until 2017
Insurance and Occupational Pensions to divest their stakes in hedge funds and
Authority (EIOPA) concluded that one in private equity funds.30 Banks subject to the
seven insurers in the European Union did not Volcker Rule will need rigorous policies and
have the level of capital that will be required procedures, including automated workflows,
under Solvency II by 2016.27 that will enable them to comply, including doc-
umenting their policies on hedging and justify-
Volcker Rule ing the classification of their inventories related
The final Volcker Rule under the Dodd- to market-making.31 Institutions with greater
Frank Act was released by US regulators in than $10 billion in assets will be required to
December 2013. It prohibits various forms subject their compliance with the Volcker
of proprietary trading by banks operating in Rule to independent testing, while institutions
the United States and reduces their permitted with greater than $50 billion in assets will also
investments in hedge funds and private equity be required to furnish an attestation by the
activities. Implementing the Volcker Rule is a firm’s CEO. Some foreign banks are consider-
complex task. Market-making, hedging, and ing whether to limit their participation in US
underwriting are still allowed, but it can be capital markets to take advantage of the “solely
difficult to determine if a trade is permissible outside the United States” exemption.
9
European regulators have also proposed structures remained too complex to recover or
restrictions on trading activities by banks. The resolve in the event of financial distress.34 The
EC issued a proposal in 2014 that would ban institutions will need to revise these plans and
the largest banks operating in the European rethink their underlying structures.
Union from engaging in proprietary trad- European regulators are also focusing
ing or having certain relationships with on resolution. Beginning in 2015, the Single
hedge funds.32 The rules would apply to Resolution Board within the Banking Union
EU-headquartered G-SIBs and also to banks in the European Union will begin work-
that have large or complex trading operations ing with national authorities on resolution
in the European Union. planning, resolvability assessments, and the
setting of loss absorbency.35 In addition, the
Systemically important EU’s Bank Recovery and Resolution Directive
(BRRD) gives regulatory authorities wide-
financial institutions ranging powers to mandate banks to change
The Financial Stability Oversight Council their legal, operational, and financial struc-
(FSOC), comprised of US regulators, was tures to improve their resolvability, including
established by the Dodd-Frank Act and requiring the EU operations of a bank head-
charged with identifying and addressing risks quartered elsewhere to operate under an EU
to the US financial system. When the FSOC holding company.36
designates a firm as a “systemically impor-
tant financial institution” (SIFI), it is subject
to stricter regulatory oversight and capital
Record level of fines
requirements. Several nonbanks have also been Regulatory fines levied on banks have
designated as US SIFIs. Designation of a bank mounted to unprecedented levels. Banks
as a SIFI depends on its asset size, but the cri- around the world paid a record $56 billion
teria are more complex for insurers and other in fines to regulatory authorities in 2014 and
nonbank financial institutions.33 The process more than $200 billion over the last several
for designating an institution as a US SIFI has years.37 Given the size of the fines being levied,
been criticized for a lack of transparency and the regulators may need to consider the impact
clear criteria, and that fines could have
one institution has on the capital of
individual institu-
challenged its desig-
nation in court.
Regulatory fines levied tions and on the
One objective of
the Dodd-Frank Act
on banks have mounted financial system as
a whole.
was to address the to unprecedented levels. These fines
were the result of a
problem that some
financial institutions variety of incidents,
were considered including allegations
“too big to fail” during the global financial that banks misled investors about mortgage-
crisis and received government bailouts. In backed securities during the global financial
response, SIFIs are required to develop recov- crisis, manipulated foreign exchange markets
ery and resolution plans (“living wills”). In and LIBOR interest rates, and violated sanc-
August 2014, however, the Federal Reserve and tions imposed on foreign governments includ-
the Federal Deposit Insurance Corporation ing Cuba, Iran, and Sudan. Some have argued
(FDIC) rejected the living wills submitted by that regulators are using fines as a covert
all the major US financial institutions, say- strategy to restrain the size of large financial
ing they were unrealistic and their corporate
10
institutions, in an effort to address the problem In February 2015, the EC published its first
of “too big to fail.” green paper (GP) identifying five early ini-
tiatives for the CMU agenda: review of the
More regulatory changes prospectus regime, high-quality securitization
standards, pan-European private placements,
on the horizon improving credit information for small and
There is every indication that the next few medium-sized enterprises, and encouraging
years will bring further regulatory change. the uptake of European Long Term Investment
In October 2014, the Basel Committee Funds.44 There are also indications that the
announced proposals to revise the standard- CMU will place a new focus on nonbank forms
ized approach for measuring operational risk of finance, often termed “shadow banking,”
capital, moving from using gross income as in an effort to stimulate jobs and growth, and
a key input to determine the operational risk this may be reflected when the Money Market
charge to what they believe is a statistically Funds Regulation is proposed. Although the
superior approach.38 In December 2014, it new EU Regulations and Directives was passed
released a consultative document to revise the by the EC and Parliament, the European
standardized approach for credit risk. Among Supervisory Authorities still have to publish
other changes, the proposal would reduce the the detailed implementing standards.45
reliance on ratings by credit rating agencies, After a uniform trend of ever-stricter regu-
require more granularity and risk sensitiv- latory requirements, there were some develop-
ity, and provide more comparability with the ments in 2014 and early 2015 that moved in
internal ratings-based (IRB) approach for the opposite direction in the United States.
similar exposures.39 Over the next three years, The US Congress repealed a provision of the
the Basel Committee is expected to raise the Dodd-Frank Act requiring banks to “push out”
risk-based capital ratio, revise risk weighting, the trading of derivatives into subsidiaries that
and decrease the use of models for assessing do not benefit from deposit insurance.46 There
risk and setting capital requirements.40 were steps to slow the implementation of the
Although the Dodd-Frank Act was passed Volcker Rule and narrow its scope. Smaller
in 2010, establishing the required rules has US banks won relaxation of a number of
been a slow process. As of December 1, 2014, requirements of the Dodd-Frank Act, includ-
only 58 percent of the 398 total required rule- ing a relaxation of restrictions on lending
makings had been finalized, while 23.6 percent and acquisitions, an exemption from stricter
had not yet been proposed.41 post-crisis rules on mortgage lending, and a
The European Commission (EC) has proposal by the Federal Reserve to allow small
launched the Capital Markets Union (CMU) to banks to assume more debt to finance mergers
develop a single market for capital. These prin- and acquisitions.47
ciples apply to all 26 EU member states. One of
the principal goals of the initiative is to maxi-
mize economic growth by creating more inte-
Profitability predicament
grated and deeper capital markets. Although These developments have placed conflicting
Europe’s capital markets have grown in recent pressures on financial institutions. Institutions
decades, those in the United States remain far are facing significantly increased compliance
larger.42 The debt securities markets, includ- costs due to new regulatory requirements,
ing the markets for corporate and government more frequent and intrusive examinations, and
bonds, are three times larger in the United greatly expanded fines. Potentially adding to
States than in the European Union, while the these costs, in early 2015, European finance
US market for private placements is almost ministers from 11 countries were consider-
three times as large as its EU counterpart.43 ing imposing a harmonized tax on financial
11
Cyber risk
Cyber risk continues to increase in impor-
tance for financial services institutions and
other companies, which have been targeted
by sophisticated hacker groups. Some of
these groups are believed to be well-financed
criminal organizations, while others appear
to be state-sponsored actors. In 2014, hack-
ers gained access to customer data at several
major US banks in a series of coordinated
attacks, stealing checking and savings account
information, while another attack during the
same year resulted in a data breach impact-
ing millions of insurance customer records.51
In recent years, banks have been subject to
distributed denial of service (DDoS) attacks in
which their networks are flooded with so much
transactions.48 At the same time, institutions traffic that they slow or stop completely. These
are required to hold higher levels of capital attacks have been blamed on, among others,
under the capital adequacy standards of Basel China, Russia, North Korea, Iran, and extrem-
III, the US CCAR, and Solvency II, as well as ist Islamic groups.52
a surcharge on G-SIBs imposed by Basel III
and an additional G-SIB surcharge imposed by Risk data
some countries such as the United States and Financial institutions face the complex task
Switzerland. The introduction of minimum of complying with stricter regulatory require-
levels of TLAC by the Basel Committee and ments concerning risk data quality and the
the US Federal Reserve will further increase ability to aggregate data in a timely fashion
the capital requirements. The higher capital across the enterprise. The Basel Committee’s
requirements have spurred banks to move principles for risk data aggregation and report-
away from activities that require more capital, ing (BCBS 239) currently apply only to G-SIBs,
such as trading. The percentage of bank assets but there are indications that regulators will
dedicated to trading dropped from 41 percent require these principles to be adopted by a
in 2006 to 21 percent in 2013, according to wider group of institutions. Many large banks
analysis by the International Monetary Fund.49 have indicated they are facing significant chal-
But higher compliance costs and increased lenges to achieve compliance by the deadline of
capital levels are not all. Many institutions also January 1, 2016, and smaller institutions may
have fewer revenue-generating opportuni- find it even more difficult to adhere to these
ties due to restrictions on proprietary trading, principles. These data standards apply to the
bank interchange fees, and the loss of market- full range of risks facing the organization.
making for over-the-counter derivatives due In the United States, the Office of the
to a requirement that derivatives be traded on Comptroller of the Currency (OCC) has issued
exchanges and centrally cleared with lower heightened standards for certain large national
margins. The net result of rising compliance banks and a liquidity-coverage rule that will
costs coupled with limitations on business require many institutions to upgrade their data
activities is a squeeze on revenues and profit- capabilities. European insurers will face more
ability. For example, revenues at US banks have stringent data and reporting requirements as a
been flat since 2010.50 result of Solvency II, with preparatory Pillar III
12
reporting disclosures expected in 2015, prior also to create and embed risk culture. In 2013,
to implementation on January 1, 2016. The a new Financial Conduct Authority (FCA)
European Securities and Markets Authority was created with the goal of ensuring that the
is expected to publish new requirements for financial industry is run with integrity and
reporting by securities firms on post-trade that consumers are treated fairly. Among the
reporting, transaction reporting, and com- FCA’s priorities for 2015–2016 are to review
modities derivatives positions reporting culture change programs in retail and whole-
requirements under the Markets in Financial sale banks, inducements and conflicts of
Instruments Regulation (MiFIR). interest relating to retail investment advice,
and retirement sales practices.55 The Fair and
Conduct risk and risk culture Effective Markets Review (FEMR) was estab-
lished in 2014 with the goal of restoring trust
Recently, regulators have increased their
in wholesale financial markets in the wake
attention on conduct risk, that is, behavior that
of recent abuses, and the Banking Standards
is perceived to have detrimental impacts on
Review Council was launched in 2015 with
customers, whether retail or wholesale, or that
the mission of promoting high standards of
could harm market integrity. Supporting their
behavior across the industry. Elsewhere in the
focus on conduct risk, regulatory authorities
European Union, supervisory authorities have
are also increasing their scrutiny of the broader
also been encouraged to increase the focus on
qualitative issues that comprise an institution’s
consumer protection.
risk culture, such as its ethical standards, its
In the United States, enforcement actions
compensation practices, and the role of the
by the Consumer Financial Protection Bureau
board of directors and senior management
have resulted in large restitution requirements
in promoting ethical behavior. Commenting
and fines levied on financial institutions. The
on the importance of conduct risk and risk
US Federal Reserve has placed a new emphasis
culture, William Dudley, the president of
on how financial institutions can encourage
the Federal Reserve Bank of New York, said,
ethical behavior by their employees through
“There is evidence of deep-seated cultural and
appropriate hiring, compensation, promo-
ethical failures at many large financial institu-
tions, and demotions, as well as by having
tions. Whether this is due to size and com-
senior management stress the importance of
plexity, bad incentives, or some other issues
ethical behavior.56 The US Comptroller of the
is difficult to judge, but it is another critical
Currency, Thomas Curry, has said that assess-
problem that needs to be addressed.”53
ment of a bank’s culture could significantly
In its report on risk governance in February
affect the OCC’s CAMELS rating for capital
2013, the FSB identified the importance for
adequacy, asset quality, management, earnings,
regulators to assess business conduct and the
liquidity, and sensitivity to market risk.57
suitability of products, both the type of prod-
The US Federal Reserve, the OCC, and the
ucts and whom they are sold to.54 Since then
FDIC are working to implement regulatory
there have been a variety of developments by
requirements for incentive compensation as
regulators around the work addressing conduct
mandated by the Dodd-Frank Act. There are
risk and risk culture.
indications that these rules may require that
Regulators in the United Kingdom have
institutions employ clawbacks in cases of fraud
been especially active in this area. The Senior
or excessive risk-taking and also retain a signif-
Managers Regime introduced for banking
icant portion of compensation for a period.58
and insurance will result in more supervisory
In Asia, Singapore’s Financial Advisory
scrutiny of individuals, while the Prudential
Industry Review Panel completed a com-
Regulation Authority has placed a premium
prehensive review of the financial services
for institutions to manage conduct risk and
industry in 2013 and released a consultation
13
paper on legislative amendments for comment Banks are responding to the regulatory
in October 2014.59 One of its principal objec- focus on culture by establishing new com-
tives was to promote a culture of fair dealing in mittees, conduct-risk functions, and poli-
the distribution of investment and life insur- cies.62 While no one disputes its importance,
ance products.60 The Hong Kong Monetary financial institutions are struggling to develop
Authority has launched a Treat Customers approaches to measure and quantify risk
Fairly initiative designed to improve corpo- culture through such tools as employee surveys
rate culture and customer practices among and scorecards as well as the use of more
retail banks.61 innovative techniques.63
ABOUT THE SURVEY

This report presents the key findings from the ninth edition of Deloitte’s ongoing assessment of risk management
practices in the global financial services industry. The survey gathered the views of CROs or their equivalents at 71
financial services institutions around the world and was conducted from August to November 2014.
The institutions participating in the survey represent the major economic regions of the world, with most
institutions headquartered in the United States/Canada, Europe, or Asia Pacific (figure 1). Most of the survey
participants are multinational institutions, with 68 percent having operations outside their home country.
The survey participant companies provide a range of financial services offerings, including insurance (58 percent),
banking (55 percent), and investment management (48 percent) (figure 2).64
The institutions have total combined assets of US$17.8 trillion and represent a range of asset sizes (figure 3).
The survey participants that provide asset management services represent a total of US$5.6 trillion in assets
under management.
Where relevant, the report compares the results from the current survey with those from earlier surveys in this
ongoing series.
Figure 1. Participants by headquarters Figure 2. Participants by financial Figure 3. Participants by asset size
location services provided
Africa
Latin 6%
America Insurance 58% < $10B
8% 22%
Asia United > $100B
Pacific Banking 55% 37%
States and
14% Canada
39% Investment
management
48%
Note: Percentages total more than 100% since

Europe $10B–$100B
respondents could make multiple selections.
33% 41%
Graphic: Deloitte University Press | DUPress.com
Analysis by asset size

In this report, selected survey results are analyzed by the asset size of participating institutions using the
following definitions:
• Small institutions—institutions with total assets of less than US$10 billion
• Mid-size institutions—institutions with total assets of US$10 billion to less than $100 billion
• Large institutions—institutions with total assets of US$100 billion or more
14
Risk governance
Role of the board of directors “With regard to changes

T HE central role of the board of direc-
tors in providing oversight of a financial
institution’s risk management program has
in risk governance, if we
been a regulatory expectation for some time. start from the top at the
In October 2010, the Basel Committee issued
principles designed to enhance governance board level, there is a lot
that addressed the role of the board of direc-
tors in risk management, the qualifications of
more interest in the risk
the board members, and the importance of
an independent risk management function.
management policy. Risk-
The US OCC issued its heightened standards
requiring that large banks have a board-
focused discussion is getting
approved risk-governance framework. For US a lot more air time than it
insurers, in 2014 the National Association of
Insurance Commissioners (NAIC) approved did five years ago.”
a framework for adoption by the states that
requires insurers to file an annual report about —— Chief risk officer, insurance
their corporate governance practices, includ-
ing their governance framework, the policies
banks, “There’s clear evidence across all large
and practices of their board of directors and
institutions that boards of directors are more
committees, and their management policies
actively overseeing banks they supervise.”67
and practices.65
Among subgroups of participants, both
More than six years after the global finan-
European respondents and those from small
cial crisis, risk management continues to
institutions were more likely to say their board
demand greater attention from boards of direc-
of directors is devoting considerably more time
tors. Eighty-five percent of respondents said
than before to oversight of risk. Fifty-two per-
their board of directors currently devotes more
cent of European respondents said their board
time to oversight of risk than it did two years
now spends considerably more time on risk
ago; only 1 percent said it spends less time than
management than two years ago, compared to
before. However, the pace of increasing board
39 percent among respondents in the United
activity on risk management appears to be
States/Canada.68 Among small institutions, 56
slowing. Forty-four percent of respondents said
percent said their board devotes considerably
their board of directors spends considerably
more time to risk management than before,
more time than before on risk management,
compared to 41 percent for mid-size institu-
compared to 67 percent in the 2012 survey.66
tions and 38 percent for large institutions.
Molly Scherf, a deputy US comptroller in the
These trends are consistent with the focus on
OCC, commented in early 2015 about large US
board risk oversight, which began with large
15
institutions, followed by mid-sized and then to inform the institution’s decisions, including
smaller institutions. review corporate strategy for alignment with
Most boards of directors have a wide variety the risk profile of the organization (80 percent),
of risk management responsibilities. The board monitor risk appetite utilization including finan-
responsibility cited most often was approve the cial and non-financial risk (77 percent), and
enterprise-level statement of risk appetite (89 monitor new and emerging risks (71 percent).
percent), which is up from 78 percent in 2012, Fewer boards of directors are active in other
and reflects the emphasis that regulators have areas, although there has been some progress
placed on the board’s responsibility in this area since 2012. Sixty percent of respondents said
(figure 4). Although almost all respondents their board of directors works to establish
said their board of directors approves a risk and embed the risk culture of the enterprise
appetite statement, fewer said it engages in sev- and promote open discussions regarding risk,
eral other monitoring and planning activities which is an increase from 51 percent in 2012.
that are needed for the risk appetite statement This is consistent with the increased focus
Figure 4. Which of the following risk oversight activities does your company’s board of directors or
board risk committee(s) perform?
Approve the enterprise-level statement 89%

of risk appetite
Review regular risk management reports on the 86%

range of risks facing the organization
Review and approve overall risk management 84%

policy and/or ERM framework
Review and approve the organization’s formal 83%

risk governance framework
Review corporate strategy for alignment with the risk 80%

profile of the organization
Monitor risk appetite utilization including

financial and non-financial risk 77%
Monitor new and emerging risks 71%
Review individual risk management policies, e.g., for 69%

market, credit, liquidity, or operational risk
Review incentive compensation plans to 63%

consider alignment of risks with rewards
Conduct executive sessions with the 61%

chief risk officer (CRO)
Help establish and embed the risk culture of the 60%

enterprise; promote open discussions regarding risk
Review management’s steps to remediate any

noncompliance with risk management policy 56%
Define risk management reporting lines 41%

and independence
Review the charters of management-level 37%

risk committees
16
by regulators around the world on managing committee overseeing all US operations.70 This
conduct risk and embedding a risk culture that committee may either be placed at the interme-
promotes ethical behavior by employees. diate holding company for its US operations,
Reviewing incentive compensation is or else at the board of directors of the parent.
another area where board involvement has In either case, this committee is required to
become more common but where there is still have at least one independent director.
room for improvement. Sixty-three percent of Respondents most often said the board of
respondents said a responsibility of their board directors assigns its primary oversight respon-
of directors is to review incentive compensa- sibility to the board risk committee (51 per-
tion plans to consider alignment of risks with cent), which is an increase from 43 percent in
rewards, which is up from 49 percent in 2012. 2012. An additional 23 percent of respondents
With increasing regulatory expectations said oversight is assigned to other board com-
for boards of directors, institutions may find it mittees: audit committee (10 percent), com-
more difficult than before to identify qualified bined audit and risk committees (7 percent), or
board members when seats become vacant. multiple board committees (6 percent).
Today, board members need more knowledge Yet, the second most common structure is
of the business and greater skills, especially to have oversight responsibility lodged in the
for those serving as designated risk experts. At full board of directors (23 percent).
the same time, potential board members may Placing responsibility in a board risk com-
conclude that serving on the board of a finan- mittee is much more common in the United
cial institution or on the board risk committee States/Canada (61 percent) than in Europe
entails greater personal risks than before. (30 percent), which reflects the emphasis that
the Federal Reserve and the OCC have placed
Board risk committees on this approach. Among small institutions,
only 19 percent assign primary oversight to a
There has been a continuing trend toward
board risk committee, compared to 55 percent
the board of directors placing oversight
for mid-size institutions and 65 percent for
responsibility in a board risk committee. This
large institutions. Among small institutions, 25
structure is a regulatory expectation and has
percent of respondents said oversight responsi-
come to be seen as a leading practice. The EPS
bility is assigned to the audit committee of the
issued by the Federal Reserve in March 2014
board, while 19 percent said it was shared by
requires that US publicly traded banks with
the audit and risk committees.
consolidated assets of $10 billion or more have
There is a regulatory expectation that the
a risk committee of the board of directors
board risk committee should contain indepen-
that is chaired by an independent director.69
dent directors and an identified risk manage-
The risk committee is expected to review and
ment expert, and more financial institutions
approve the risk management policies of the
are following these practices. In the survey,
bank’s global operations. For US banks with
86 percent of respondents reported that their
consolidated assets of $50 billion or more, the
institution has at least one independent direc-
risk committee must be an independent com-
tor on its board risk management committee,
mittee of the board and have exclusive over-
up from 58 percent in 2012, and 79 percent
sight of the bank’s risk management policies
said the risk committee is chaired by an inde-
and risk management framework for its global
pendent director, up from 54 percent in 2012.
operations. The Federal Reserve’s EPS for for-
In 2014, 60 percent of respondents said the
eign banks requires foreign banking organiza-
board risk committee contains an identified
tions that have total global assets of $50 billion
risk management expert, up slightly from 55
or more and also have $50 billion or more in
percent in 2012, with this being more com-
US non-branch assets to establish a US risk
mon in the United States/Canada (68 percent)
17
than in Europe (43 percent). One reason for and with the lines of business. Senior man-
the differences between regions is that while agement is also the key player in fostering
US regulations have the expectation that the a culture that integrates risk considerations
board risk committee contains an identified when making business decisions and promotes
risk management expert, European regulations ethical behavior.
contain a more general requirement that risk The existence of a CRO or an equivalent
committee members “... shall have appropriate position that has management oversight for the
knowledge, skills and expertise to fully under- risk management program across the organi-
stand and monitor the risk strategy and the zation is a leading practice and a regulatory
risk appetite of the institution.” 71 expectation. Over the more than 10 years
A separate study of US banks with more of Deloitte’s global risk management survey
than $50 billion in assets by the Deloitte series, the CRO position has become almost
Center for Financial Services found that universal. In 2014, 92 percent of respondents
institutions having board risk committees that said their institution has a CRO or equivalent
review and approve the firm’s risk manage- position,73 up slightly from 89 percent in 2012
ment framework and also those that require and up sharply from 65 percent in 2002 (figure
a risk expert on the risk committee each had 5). The existence of a CRO is closely related to
a higher average return on average assets the size of the institution. All the respondents
(ROAA) than other institutions.72 Although at large institutions and 97 percent of those at
these practices may not directly cause higher mid-size institutions reported having a CRO,
performance, they may indicate that a connec- compared to 69 percent at small institutions.
tion exists between good risk governance and It is also considered a leading practice for
stronger performance. the CRO to report directly to the board of
directors, but this practice is not widespread.
Role of the CRO Most respondents said the CRO reports to
the institution’s CEO (68 percent), while only
Although the board of directors has ulti-
46 percent said the CRO reports to the board
mate oversight responsibility for risk manage-
of directors.74 Both figures are similar to the
ment, senior management is responsible for
results in 2012.
managing the risk program, including foster-
When it comes to the management-level
ing effective coordination with other func-
oversight of the risk management program,
tions, such as finance and human resources,
regulatory expectations and leading practice
Figure 5. Does your organization currently have a CRO or equivalent?

100% 89% 92%
84% 86%
90% 81%
80% 73%
65%
70%
60%
50%
40%
30%
20%
10%
0%
2002 2004 2006 2008 2010 2012 2014
Note: Figures indicate the percentage of institutions with a CRO or equivalent.
18
suggest the CRO should have primary over- of respondents said a responsibility of the inde-
sight responsibility, and more institutions are pendent risk management group is to review
moving in this direction. In the current survey, compensation plan to assess its impact on risk
respondents were most likely to report the appetite and culture.
CRO has primary oversight responsibility (55
percent), an increase from the 2012 survey Risk appetite
(42 percent). At the same time, the percentage
The development of a written statement
of respondents that said the CEO is primar-
of risk appetite plays a central role in clarify-
ily responsible for risk management oversight
ing the level of risk an institution is willing to
dropped to 23 percent from 39 percent in 2012.
assume. It can serve as important guidance for
Assigning primary responsibility for risk
senior management when setting the institu-
management to the CRO is less common
tion’s strategy and strategic objectives, as well
among institutions providing investment
as for the lines of business when seeking new
management services (44 percent) than among
business or considering their trading posi-
those in banking (67 percent) or insurance (66
tions.75 Since the global financial crisis, the
percent). These differences are likely shaped by
importance of a risk appetite statement has
industry practices driven by prevailing busi-
received greater attention. In 2009, the Senior
ness models and regulatory expectations. As
Supervisors Group, which is composed of
expected, the risk management program is also
the senior financial supervisors from seven
less likely to be overseen by the CRO at small
countries,76 released a report that identified the
institutions (38 percent) than at mid-size (62
failure of some boards of directors to establish
percent) or large institutions (58 percent).
the level of risk acceptable to their institu-
What roles do institutions assign to their
tion,77 and the following year released a series
firm-wide, independent risk management
of recommendations regarding the issue.78
group? Leading the list of responsibilities is
The FSB issued principles for an effective risk
develop and implement the risk management
appetite framework in November 2013.79 In
framework, methodologies, standards, policies,
the United States, the OCC issued enforce-
and limits (98 percent). The items cited next
able guidance for heightened standards that
most often were oversee risk model governance
require banks with more than $50 billion in
(94 percent) and meet regularly with board of
consolidated assets to have a comprehensive
directors or board risk committees (94 percent).
risk appetite statement that is approved by the
More work is needed to establish a con-
board of directors.
sistent set of risk responsibilities for boards
Given the key role of the risk appetite
of directors. Risk should be considered when
statement, it is a prevailing practice for it to be
setting strategy or establishing company objec-
reviewed and approved by the board of direc-
tives, but 32 percent of respondents said the
tors. Three-quarters of respondents said their
head of the firm-wide risk management group
institution has a written enterprise-level state-
does not serve as a member of the execu-
ment of risk appetite that has been approved
tive management committee. Although it is
by the board of directors, an increase from 67
important for organizations to understand the
percent in 2012. An additional 13 percent said
risks they are assuming when they enter new
their institution was currently in the process of
lines of business or introduce new products,
developing a risk appetite statement and seek-
only 57 percent of respondents said approving
ing board approval.
these initiatives is a responsibility of their risk
Most respondents at large and mid-size
management group. Since the global financial
institutions said their organization has a
crisis, the role of compensation in risk man-
board-approved risk appetite statement, and
agement has received close attention from both
this was more common than in 2012: large
regulators and investors, but just 51 percent
19
“The process of developing appetite separately for individual risk types and
then measure risk in each area. The two issues
our risk appetite statement that respondents most often considered to be
extremely or very challenging were defining
has promoted and been risk appetite for strategic risk (55 percent) and
defining risk appetite for reputational risk (55
a catalyst for some really percent) (figure 6). Measuring strategic risk
requires an institution to assess the overall
good discussions about risk posed by, and to, its business strategy.
Reputational risk is typically a secondary risk
what’s important to us as that is the consequence of other types of risk
an organization. Our risk events such as market, credit, or operational

risk. Both are difficult to measure and establish
appetite statement is not limits for. The issue cited next most often as
extremely or very challenging was defining risk
just about listing things we appetite for operational risk (38 percent), which
poses similar measurement difficulties.
don’t want to have happen: An encouraging sign was that several
important tasks in developing and implement-
It’s about understanding the ing a risk appetite statement were considered
challenging by relatively few respondents:
risks we should be taking.” integrating stress testing results when defining
risk appetite (21 percent), gaining the active
—— Chief risk officer, insurance participation of business units in implementing
the risk appetite and risk limits (18 percent),
and complying with regulatory expectations
institutions (85 percent versus 67 percent in
regarding risk appetite (11 percent). In some
2012) and mid-size institutions (79 percent
cases, business unit management may resist the
versus 61 percent in 2012).
use of risk appetite as limiting their ability to
It is a regulatory expectation that both
manage their business activities and generate
banks and insurance companies have a risk
profits, but this does not appear to be common.
appetite statement approved by their board of
directors and almost all banks (95 percent) and
insurance companies (97 percent) either have Three lines of defense risk
a board-approved statement of risk appetite or governance model
are in the process of developing one and seek- Employing a “three lines of defense”
ing approval. This was somewhat less common approach to risk management is increasingly
for investment management firms (83 percent). accepted as a leading practice that specifies
Regulatory expectations regarding the the risk management roles played by different
application of the risk appetite statement parts of the organization.
have been relatively modest. Regulators have The three lines of defense governance
indicated they want institutions to have a model can be summarized as follows:
risk appetite statement and to use it and
report on it, but have not been specific about • Line 1: Business units own and
its characteristics. manage risks
Developing an effective statement of risk
appetite can pose a variety of challenges. It can • Line 2: Control functions for risk provide
be difficult for institutions to define their risk oversight and control
20
Figure 6. How challenging is each of the following in defining and implementing your organization’s
enterprise-level risk appetite statement?
Defining risk appetite for strategic risk 55%
Defining risk appetite for reputational risk 55%
Defining risk appetite for operational risk 38%
Allocating the risk appetite among different 37%

business units
Translating the risk appetite for individual risk types into

quantitative risk limits 35%
Integrating stress testing results when defining

risk appetite 21%
Gaining the active participation of business units in

implementing the risk appetite and risk limits 18%
Complying with regulatory expectations regarding

risk appetite 11%
Note: Figures represent the percentage of respondents identifying each item as extremely or very challenging.
• Line 3: Internal audit function validates the model is defining and maintaining the distinc-
risk and control framework tion in roles between line 1 (the business) and
line 2 (risk management), with 51 percent of
The three lines of defense risk governance respondents citing this as a significant chal-
model has become widely adopted. In 2014, lenge.80 In addition, 36 percent of respondents
94 percent of respondents reported that their said getting buy-in from line 1 (the business)
institution employs this model, up from 88 presents a significant challenge. This proved
percent in 2012. especially challenging for small institutions (54
Respondents said the most significant chal- percent) compared to mid-size (31 percent)
lenge in employing the three lines of defense and large institutions (32 percent).
21
Enterprise risk management
A N ERM program is designed to provide

a comprehensive assessment of the risks
an institution faces and a process for managing
Among institutions that have an ERM
program or are implementing one, 92 percent
have an approved ERM framework and/or an
them. By taking an integrated view across the ERM policy, including 78 percent that have it
organization, ERM programs assist institutions approved by the board of directors or a board
in understanding the full range of risks they committee. A positive trend is that both figures
face and how these compare to its risk appe- have increased significantly since 2012 when
tite. They also help identify interrelationships 73 percent reported having an ERM frame-
among risks in different lines of business or work and/or policy and 59 percent said it was
geographies that might have gone undetected. approved by the board or a board committee.
Both large and mid-size financial institutions
are being encouraged by regulatory authorities Key challenges
to implement ERM programs and integrate
Complying with new regulations was seen
their findings into business decision-making.
by respondents as by far the greatest challenge,
Ninety-two percent of respondents said
with 79 percent of respondents saying increas-
their institution either has an ERM program in
ing regulatory requirements and expectations is
place or is in the process of implementing one,
extremely or very challenging for their institu-
an increase from 83 percent in 2012 and 59
tion (figure 8).
percent in 2008 (figure 7). As expected, having
Other issues that were often seen as
an ERM program in place or implementing
extremely or very challenging were risk
one is more common in large (85 percent) and
information systems and technology infrastruc-
mid-size institutions (72 percent) than in small
ture (62 percent) and risk data (46 percent).
institutions (38 percent).
Regulators are expecting financial institutions
Figure 7. Does your organization have an ERM program or equivalent?
36% 23%
59% 79% 52%
21%
83% 92%
27% 62%
69%
23%
2008 2010 2012 2014

Yes, program in place Yes, currently implementing one
22
Figure 8. How challenging is each of the following for your company when managing risk?
Increasing regulatory requirements and 79%

expectations
Risk information systems and technology 62%

infrastructure
Risk data 46%
Establishing and embedding the risk culture 35%

across the enterprise
Identifying and managing new and 35%

emerging risks
Attracting and retaining risk management

professionals with required skills 32%
Attracting and retaining business unit

professionals with required risk management skills 32%
Aligning compensation and incentives with risk 26%

management
Securing adequate budget and resources 25%
Collaboration between the business units and the 17%

risk management function
Active C-suite involvement 15%
Active involvement of senior management 13%
Collaboration between the risk 8%

management function and other functions
Active involvement of the board of directors 7%
to provide timely information on such issues as establishing and embedding the risk culture
capital, liquidity, stress testing, resolution plan- across the enterprise was considered to be
ning, consumer protection, and Volcker Rule extremely or very challenging by 35 percent
compliance. Data on these and other areas of respondents.
need to be timely, accurate, and aggregated Following these issues were two items
across the enterprise. related to talent. Roughly one-third of respon-
Staying current on the changing nature of dents said it is extremely or very challenging
the risks facing an institution is difficult, and to attract and retain business unit profession-
35 percent of respondents considered identify- als with required risk management skills and a
ing and managing new and emerging risks to be similar percentage said the same about attract-
extremely or very challenging. ing and retaining risk management profes-
The increasing attention by regulators sionals. Some commentators have noted the
to risk culture was reflected in the fact that lack of an adequate supply of talent with risk
23
management skills in such areas as operational, have enhanced their governance processes
reputational, and regulatory risk. and increasingly use such tools as multiple
A positive indication was the fact that few incentives, clawbacks, and payment in stock.
respondents considered several important Although improved compensation practices
issues to be extremely or very challenging on their own cannot prevent employees from
for their institution, including collaboration taking inappropriate risks, the economic
between the business units and the risk man- incentive to do so for personal gain has been
agement function (17 percent), active C-suite severely curtailed.
involvement (15 percent), and active involve- Given the focus on aligning compensation
ment of the board of directors (7 percent). with a firm’s risk appetite, it was surprising that
Although progress has been made, institutions only 63 percent of respondents said their board
often face challenges in implementing the three of directors or board risk committee reviews
lines of defense model and having their busi- incentive compensation plans to consider align-
ness units fully embrace their role as the first ment of risk with rewards.
line of defense in owning and managing risks. Some leading compensation practices
Given all these challenges, it is not surpris- are relatively common among management,
ing that 65 percent of respondents expected including require that a portion of the annual
their institution would increase spending on incentive be tied to overall corporate results (72
risk management over the next three years percent), balance the emphasis on short- and
by 5 percent or more, including 37 percent long-term incentive (64 percent), use of mul-
who expected spending to rise by 10 percent tiple incentive plan metrics (62 percent), and
or more. deferred payouts linked to future performance
(61 percent) (figure 9). However, relatively few
Aligning compensation respondents said their institution uses other
compensation practices designed to align
In recent years, there has been increased
employee incentives with the institution’s risk
scrutiny on whether incentive compensation
management objectives such as caps on payouts
at financial institutions is aligned with risk
(30 percent), establish for employees identi-
appetite and whether compensation plans
fied as material risk takers a maximum ratio
may encourage excessive risk taking. Among
between the fixed and the variable component
its other provisions, the heightened standards
of their total remuneration (29 percent), use of
guidance issued by the OCC in 2014 requires
individual metrics tied to the implementation of
banks with more than $50 billion in consoli-
effective risk mitigation strategies (28 percent),
dated assets to have well-specified talent man-
and match the timing of payouts with the term
agement and compensation programs.
of the risk (19 percent). It is likely that many of
Responding to changing expectations
these practices will become more widespread
by regulatory bodies, as well as by investors
over time as regulators focus on compensa-
and the general public, in recent years there
tion as part of their increased attention to
has been a tremendous shift in compensa-
risk culture.
tion practices. Many financial institutions
24
Figure 9. Which of the following practices does your organization employ regarding compensation?
Require that a portion of the annual incentive be tied 72%

to overall corporate results
Balance the emphasis on short- and long-term

incentives 64%
Use of multiple incentive plan metrics 62%
Deferred payouts linked to future performance 61%
Payment in company stock 58%
Incorporate risk management effectiveness into

performance goals and compensation for senior 54%
management
Incorporate risk management effectiveness into
performance goals and compensation for 48%
professionals identified as risk-takers
(e.g., trading, investing, lending)
Use of clawback provisions (e.g., in the event of
misconduct or overstatement of earnings) 46%
Caps on payouts 30%
Establish for employees identified as material risk-takers

a maximum ratio between the fixed and the variable 29%
component of their total remuneration
Use of individual metrics tied to the

implementation of effective risk mitigation strategies 28%
Match the timing of payouts with the term of the risk 19%
25
Economic capital
M ANY financial institutions calculate

economic capital to assess their risk-
adjusted performance and allocate capital. All
(62 percent). Economic capital is used much
less often for other risk types such as liquidity
risk (30 percent), strategic risk (20 percent),
the respondents reported that their institutions reputational risk (17 percent), or systemic risk
calculate economic capital, an increase from (8 percent).
roughly 80 percent in 2012, and said they most The most common uses of economic capital
often calculate it for market risk (72 percent), are at the senior management level for strategic
credit risk (68 percent), and operational risk decision-making (67 percent) and at the board
Figure 10. For which of the following risk types does your organization calculate economic capital?
Market 72%
Credit 68%
Operational 62%
Interest rate risk of the
52%
balance sheet
Counterparty credit 51%
Mortality* 49%
Lapse* 41%
Property and casualty* 39%

Diversification effects/benefits
across risk types 38%
Morbidity* 34%
Liquidity 30%
Catastrophe* 29%
Strategic 20%
Reputational 17%
Systemic 8%
*Asked of respondents at institutions that provide insurance or reinsurance services.

26
level for strategic decision-making (63 percent). the customer level to support risk-based profit-
It is used less often at lower levels such as at ability analysis (32 percent).
the business unit level to evaluate risk-adjusted Many banks and insurance companies also
performance (53 percent), at the transaction need to comply with regulatory requirements
level for risk-based pricing (54 percent), or at for capital adequacy. (See “Sector spotlight:
Banking” and “Sector spotlight: Insurance.”)
27
Stress testing
R EGULATORY authorities, including the

Federal Reserve, the ECB, the Bank of
England, and EIOPA for insurers, require
In 2014, respondents were more likely to
say stress testing plays a wider range of roles
in their organization than was the case in
financial institutions to conduct stress tests. In 2012, indicating that this tool appears to be
the United States, the stress tests under CCAR more embedded in planning and operations.
assess a wide range of issues including capital Respondents most often said stress testing
adequacy, risk appetite, data, and financial enables forward-looking assessments of risk (86
planning, among others. It also requires that percent versus 80 percent in 2012), feeds into
banks clearly document their risk manage- capital and liquidity planning procedures (85
ment processes and internal controls.82 In percent versus 66 percent), informs setting of
recent years, regulatory authorities have been risk tolerance (82 percent versus 70 percent),
expanding the scope of stress tests beyond informs setting of capital and liquidity targets
solely quantitative results to also encompass (80 percent versus 61 percent), and supports
qualitative issues such as the effectiveness of the development of risk mitigation and contin-
the risk management control environment gency plans (77 percent versus 57 percent).
and information systems, the quality of risk To strengthen their stress-testing pro-
data, whether all relevant risks are addressed, grams, some institutions are working to better
the adequacy of risk models, and the ability of integrate data from risk management and
the risk management program to identify and finance and improve the coordination of these
manage emerging risks. two functions. Typically, the finance function
Facing a variety of different stress testing is responsible for financial projections, capi-
mandates from different jurisdictions, some tal management, and reporting to regulators,
global financial institutions respond piecemeal while the risk management function is respon-
to each set of requirements, which can lead to sible for calculating risk levels. To be effective,
duplication of effort and increase the potential stress testing must be a shared effort, but at
for control failures. Institutions can benefit some institutions these functions operate as
from developing a consolidated approach that separate silos, with incompatible information
will allow them to use consistent procedures systems and with distinct cultures.
to comply with the distinct stress requirements Although the vast majority (94 percent) of
imposed by the different regulators in the juris- respondents use stress testing in some capac-
dictions where they operate. ity, the specific uses vary widely (figure 11).
With the regulatory focus on stress testing, Leading the list of areas where institutions use
it is not surprising that 94 percent of respon- stress testing either extensively or somewhat
dents said their institution uses stress testing, were reporting to the board (94 percent), under-
the same percentage as in 2012, although stress standing firm’s risk profile (92 percent), and
testing is less widespread among small institu- reporting to senior management (92 percent).
tions (75 percent).83 At the lower end of practice, only 40 percent
28
Figure 11. To what extent are the results of stress tests used by your organization for each of the
following purposes?
Reporting to the board 47% 47% 94%
Reporting to senior management 50% 42% 92%
Understanding firm’s risk profile 44% 48% 92%
Regulator inquiries 43% 46% 89%

Assessing adequacy of
regulatory capital 52% 34% 86%
Defining/updating capital capacity 39%
requirements for risk 45% 84%
Defining/updating risk appetite 35% 48% 83%
Strategy and business planning 19% 59% 78%

Assessing concentrations and
setting limits 26% 51% 77%
Assessing adequacy of 44% 74%

economic capital 30%
Rating agency inquiries 17% 54% 71%

Deciding on hedging and other risk
mitigation strategies 13% 52% 65%
Allocating capital to businesses
and products 5% 39% 44%
Pricing products or benefits 3% 37% 40% Extensively used

Somewhat used
Merger and acquisition decisions 6% 34% 40%
Note: Percentages were calculated on a base of respondents at institutions using stress testing.
of respondents reported using stress testing for percent up from 67 percent), strategy and busi-
merger and acquisition decisions. ness planning (78 percent up from 68 percent),
However, the area where respondents most and defining/updating risk appetite (83 percent
often said their institution extensively uses up from 73 percent).
stress testing results was assessing the adequacy The key challenges in using stress testing
of regulatory capital (52 percent up from 45 concern data quality and the validation of
percent in 2012). This is consistent with the models. Conducting stress tests requires high-
increased reliance by regulators, including quality, aggregated, and timely data, but this
the Federal Reserve and the ECB, on stress is a challenge for many institutions. The item
tests to assess whether financial institutions most often rated as extremely or very challeng-
have sufficient capital to withstand a severe ing in using stress testing was data quality and
economic downturn. management for stress testing calculations (44
Several other uses of stress testing results percent).
were also cited more often in 2014 as being Regulatory authorities are requiring that
used, either extensively or somewhat, than in all models employed in stress testing be
2012: assessing adequacy of economic capi- validated, and 40 percent of respondents said
tal (74 percent up from 58 percent in 2012), implementing formal validation procedures and
assessing concentrations and setting limits (77 documentation standards for the models used in
29
stress testing was also extremely or very chal- that considered securing talent to be extremely
lenging. In a large institution, validation could or very challenging.
cover hundreds of models and require a major With greater attention by regulators on
commitment of resources. Further, the level stress testing at banks, respondents from these
of rigor now required by the Federal Reserve institutions were more likely to say they found
is higher when testing the underlying models. issues to be challenging than those from other
The Federal Reserve has expanded the defini- institutions. For example, 44 percent of respon-
tion of the “models” that need to be tested, dents at banks said that attracting and retain-
which has increased the size of the task and ing risk management professionals with the
expanded the required scope of stress testing. required skills is extremely or very challenging
The greater attention by regulators on stress with respect to stress testing, compared to 34
testing and its expanded use by financial insti- percent among insurance companies. Similarly,
tutions have made it more difficult to secure implementing formal validation procedures and
professionals with the skills and expertise documentation standards for the models used in
required. Eighty-eight percent of respondents stress testing was considered to be extremely or
said attracting and retaining risk management very challenging by 50 percent of respondents
professionals with the required skills is at least at banking institutions compared to 37 percent
somewhat challenging, including 32 percent of those at insurers.
30
Sector spotlight: Banking
B ANKS have been subject to an array of

new regulatory requirements, which have
increased their costs of compliance while
regarding the level of risk they assign to their
assets and will standardize the methodolo-
gies used to assign risk weightings, poten-
placing new limits on their business activi- tially increasing the required capital for some
ties. These have included the Dodd-Frank Act banks.85 The Basel Committee has indicated
in the United States, the US Federal Reserve’s that it will propose a “floor” on the minimum
EPS, Basel III capital and liquidity require- amount of capital banks are required to hold,
ments, and stress tests required by the Federal even if they use their own models to assess the
Reserve and the ECB. Given the volume of risk of their assets, which may reduce the capi-
regulatory changes, it is not surprising that tal relief provided by using internal models.86
respondents in banking (51 percent) were In December 2014, the Federal Reserve
more likely to report that their board of direc- proposed that the eight largest US banks,
tors is devoting considerably more time to the which are designated as G-SIBs, be subject to
oversight of risk management than before than an additional capital surcharge ranging from 1
were those in investment management (38 to 4.5 percent above the capital requirements
percent) and insurance (37 percent). under Basel III, with the size of the surcharge
depending on the extent to which an institu-
Basel III tion relies on short-term funding such as
overnight loans.87 Under the proposal, the new
Basel III introduced a higher capital
requirements would be phased in by 2019,
requirement, with banks required to hold
although the Federal Reserve said that almost
capital equivalent to at least 6 percent of tier 1
all the banks already meet the stricter require-
risk-weighted assets and a “capital conserva-
ments. The eight largest US banks are also
tion buffer” of 2.5 percent. There are indica-
required by the Federal Reserve to increase
tions that the Basel Committee will issue
their total TLAC to a minimum of 3 percent to
additional requirements for global systemically
5 percent of assets.
important banks (G-SIBs). In 2014, the FSB, in
Some countries have also set higher
consultation with the Basel Committee, issued
capital standards than contained in Basel III.
a public consultation with proposed require-
Switzerland has imposed a higher require-
ments for G-SIBs that include a minimum level
ment for its systemically important banks of 19
of TLAC of 16 to 20 percent of risk-weighted
percent of total capital through the so-called
assets, which is double the current Basel III
“Swiss Finish” compared to 13 percent man-
capital level, and a minimum 6 percent lever-
dated by Basel III.88 China added a 1 percent
age ratio, which is also twice the Basel III
capital buffer for G-SIBs above the Basel III
leverage requirement.84 The Basel Committee
requirement, and Singapore imposed a higher
is also expected to issue new guidelines that
requirement of 10.5 percent for its tier 1
will reduce the discretion banks currently have
capital ratio.89
31
The Basel III deadlines for regulatory Liquidity

capital are being phased in through 2019, and
Banks are also responding to new regula-
almost all the banks participating in the survey
tory requirements addressing liquidity. Basel
are well along in complying.90 Eighty-nine
III introduces two new liquidity ratios: the
percent of respondents said their bank already
Liquidity Coverage Ratio (LCR) and the Net
meets the minimum capital ratios, while 8
Stable Funding Ratio (NSFR).
percent expect to meet them well before the
The LCR requires banks to maintain a
deadlines and 3 percent expect to meet them
specified level of cash and liquid assets that
by the deadlines.
would be available to survive a 30-day severe
Complying with the Basel III capital
downturn. On January 1, 2015, the LCR
requirements can have substantial impacts on
required banks to have high-quality liquid
a bank. By far, the most common actions that
assets (HQLA) equal to at least 60 percent
banking respondents said their institution
of total expected cash outflows in a specified
had taken, or were planning to take in order
stress scenario over the next 30 days.91 The
to respond was to devote more time on capital
LCR will increase by 10 percentage points
efficiency and capital allocation (75 percent).
each year to reach 100 percent on January 1,
The steps cited next most often were improve
2019. In times of financial stress, banks will be
ongoing balance sheet management (47 percent)
allowed to fall below the minimum by using
and migrate to internal modeling approaches
their stock of HQLA.
(42 percent up from 27 percent in 2012).
The NSFR requires banks “to maintain a
In contrast, scale back on capital-intensive
stable funding profile in relation to their on-
portfolios was mentioned by 22 percent of
and off-balance sheet activities.”92 In October
banking respondents in 2014, down from 43
2014, the Basel Committee issued the final
percent in 2012, suggesting that some institu-
NSFR, which among other provisions covered
tions have already restructured their busi-
the required stable funding for short-term
nesses and portfolios in response to the new
exposures to banks and other financial insti-
capital requirements.
tutions and for derivatives exposures.93 The
Relatively few respondents said their bank
NSFR will become a minimum standard by
had taken or was intending to take more strate-
January 1, 2018.
gic responses to Basel III such as exit or reduce
In the United States, in September 2014
an existing business area (22 percent), assess
the Federal Reserve, the OCC, and the FDIC
the continuing economic viability of individual
issued the final version of the Liquidity
trading businesses (14 percent), adjust business
Coverage Rule, which requires the largest
models (14 percent), or enter into a merger
internationally active banks94 to maintain
(3 percent). In sharp contrast, 49 percent of
enough HQLA, such as cash or treasury bonds,
respondents in 2012 said their bank expected
to fund themselves for 30 days during a crisis,
to change its business model in response.
which could require some banks to hold more
While some of the planned changes to business
liquid assets.95 The Federal Reserve said the
models may have already taken place, the con-
largest banks would need to hold $1.5 trillion
tinuing revisions to Basel III over the next few
in highly liquid assets by 2017, about $100
years in such areas as capital adequacy require-
billion more than they do today.96 Banks with
ments and leverage ratios may lead some banks
more than $250 billion in assets will eventually
to reconsider whether they need to adjust their
have to calculate their liquidity needs daily.97
business model or activities.
Banks have made less progress in meet-
ing the Basel liquidity ratios than in comply-
ing with the capital requirements. Sixty-nine
32
percent of respondents said their bank already Basel III challenges

meets the liquidity ratios, while another 26
The issues that pose the greatest challenges
percent said they expect to meet them well
for banks in complying with Basel III concern
before the deadlines. Since the Basel III
data and information systems. Respondents
liquidity requirements have been issued more
most often considered data management (56
recently, most banks are still developing the
percent) and technology/infrastructure (55
capabilities and operational infrastructure
percent) to be extremely or very challenging in
needed to comply.
implementing these new requirements (fig-
Banks should also consider their organiza-
ure 12). It can also be difficult to understand
tional structure to manage liquidity. Although
clearly what Basel III demands. Forty-four
regulatory requirements for liquidity and
percent of respondents said the clarity/expecta-
capital are both designed to increase safety and
tions of regulatory requirements for Basel III is
soundness, these areas are typically managed
extremely or very challenging, although this
separately, with information systems that are
figure declined from 53 percent in 2012.
not integrated. Banks could benefit by develop-
A related issue is that banks must man-
ing a consistent approach to evaluate liquidity
age multiple Basel III requirements in such
and capital requirements.
areas as the minimum capital ratio, Common
Figure 12. How challenging for your organization is each of the following aspects of implementation
of Basel III reforms?
Data management 56%
Technology/infrastructure 55%
Clarity/expectations of regulatory
requirements 44%
Strict deadlines 26%
Internal resources/capabilities and

budget 26%
Functional reorganization/
integration 23%
Home/host supervision 23%
Program/implmentation
management 18%
Business realignment 17%
Note: Figures represent the percentage of respondents identifying each item as extremely or very challenging. Percentages were
calculated on a base of respondents at institutions subject to Basel II/III or that have adopted it.
33
Equity Tier One ratio, NSFR and LCR leverage a consistent approach to complying with
ratios, and G-SIB requirements, among others. the diversity of requirements, in part due to
Not only have they served to increase compli- divided responsibilities and to the difficulty of
ance costs, banks often struggle to develop obtaining aggregated, high-quality risk data.
LEADING PRACTICES IN BANKING RISK MANAGEMENT

There have been many areas where expectations have risen and banks have enhanced risk
management capabilities. Some of the leading practices and other important areas for banks to
consider include:
• Strengthening risk governance by enhancing the board risk committee with a board risk expert and
independent directors
• Providing effective challenge of the risk and capital management processes by the board risk
committee
• Enhancing the bank’s risk appetite framework and statement in ways that clearly articulate the
business activities the firm is willing to engage in and the types and levels of risk it is willing to
assume throughout the organization
• Integrating the assumptions used in strategic planning, capital planning, and risk management
• Improving risk culture and conduct risk management by establishing clear business practices
guidance and oversight mechanisms
• More fully integrating risk management into the compensation process by enhancing risk-based
incentive structures for management and risk-taking personnel
• Operationalizing enterprise-wide stress-testing infrastructure and capabilities into bank business-as-

usual processes
• Evaluating impact of and planning for proposed revisions to regulatory capital calculation
methodologies
• Integrating liquidity and capital management planning processes
• Strengthening the bank’s three lines of defense framework by better defining roles and
responsibilities of each, including escalation procedures, to provide appropriate checks and balances
that are well understood and implemented across the organization
• Building capabilities to practically implement and operate recovery and resolution plans across
business areas
• Enhancing the model development and validation framework and capabilities to cover all models of
the bank that drive finance, risk, and capital results
• Evaluating and improving end-to-end risk and finance data from transaction origination and
reference data to analytics, aggregation, and reporting
34
Sector spotlight: Insurance
T HE impacts of regulatory reform on insur-

ers have been significant. According to
a Deloitte analysis, the European insurance
supervision are those that conduct business in
multiple jurisdictions or have a nature, scale,
size, or complexity that attracts additional
industry spent between $5.7 and $6.6 billion regulatory expectations.
in 2012 to comply with new regulations being In addition to the movement toward
phased in from 2012 to 2015, and similar group-based supervision, regulators have also
amounts had been spent in the two previous required insurers to implement ERM pro-
years.98 For European insurers, these costs were grams. Insurers have responded by taking a
equivalent to a 1.01 percent point impact on total balance sheet view of risk, which assesses
return on equity (ROE). Fundamental regula- all the risks across the enterprise. Among the
tory reform is also underway in the United insurance companies participating in the sur-
States and internationally, as led by the IAIS. vey, 95 percent either have an ERM program
(73 percent) or are currently implementing one
Movement toward group- (22 percent).
Regulators are also encouraging insurance
based regulation companies to adopt stronger risk governance
While regulation in Europe regulates insur- practices such as creating a CRO position,
ers on a consolidated group basis, regulation in and this was reflected in the survey results.
some jurisdictions is on a legal-entity basis. For All the insurance institutions participat-
example, insurance regulation in the United ing in the survey reported having a CRO or
States has been the domain of the individual equivalent position.
states, which regulate the legal entity operating
in their state. There is now a movement in the
United States and elsewhere to increase group-
Increased capital requirements
based supervision. As with banks, insurers are facing increased
The US Federal Reserve has been given regulatory capital requirements. In Europe,
additional regulatory authority over insur- Solvency II is a capital adequacy regime
ers. In addition to its regulatory authority developed by EU regulators for insurance
over bank holding companies, which may companies, which is due to come into effect
include insurance operations, it also regulates on January 1, 2016. The goal of the initiative
insurance companies designated as systemi- is to implement solvency requirements that
cally important, and it has now designated better reflect the risks companies face, as well
three insurance companies as SIFIs. Both the as develop a system that is consistent across
Federal Reserve and the NAIC are review- all member states. As with Basel II, Solvency
ing approaches for a group insurance capital II has a three-pillar structure addressing
standard. The first US insurers likely to be quantitative capital adequacy requirements,
affected by the trend toward group-based supervisor review, and market discipline.
Solvency II is requiring European insurers
35
to assess comprehensively all their risks and of risk and its expected impacts. US insur-
consider stress scenarios when assessing ers are required to file ORSAs with their state
capital adequacy. regulators. Other regulators around the world
Countries in Asia-Pacific are also mov- are also at different stages of development in
ing toward adopting Solvency II including this area.
Australia, Japan, Malaysia, and Taiwan.99 Issues related to risk data are additional
At the international level, the IAIS is areas of attention since few insurers have
developing a risk-based group-wide global invested sufficiently in data quality, data aggre-
Insurance Capital Standard (ICS) for global gation, and advanced analytics, with many still
systemically important insurers (G-SIIs) and relying on manual processes. The issue cited
for Internationally Active Insurance Groups, second most often was data infrastructure and
which is due to be completed by the end of data handling processes, mentioned by 78 per-
2016. In addition, global G-SIIs will have a cent of respondents, up sharply from 31 per-
High Loss Absorbency (HLA) layer of addi- cent in 2012. On the other hand, 57 percent of
tional capital. It is not clear at this stage of the respondents mentioned review of the quality of
consultation process what the HLA will look the data used, down from 77 percent in 2012.
like and whether this additional capital layer
will focus on any non-traditional insurance Assessing insurance risk
activity or extend beyond this, but any addi-
Respondents said the most common
tional layer of capital will provide a further
approach to assessing insurance risk is actu-
“bite” from regulators. The second round of
arial reserving, which is used by 91 percent of
IAIS Field Testing will commence at the end of
institutions, including 64 percent that use it
April 2015, and this should further help inform
as a primary methodology. The second most
the Basic Capital Requirement (BCR), ICS,
common method is regulatory capital, used by
and the HLA. Field Test participants will help
87 percent of institutions, including 59 percent
provide insights to regulators as they develop
that use it as a primary methodology (figure
these standards.
13).
Roughly 60 percent of survey respondents
Stress testing is also widely used. Seventy-
reported that their institution was either sub-
eight percent of insurance respondents said
ject to Solvency II requirements or to equiva-
their institution uses stress testing to assess
lent revised regulatory capital requirements.
insurance risk, either as a primary methodol-
Among these respondents, the area cited
ogy (36 percent) or a secondary methodology
most often as a planned area of focus related
(42 percent).
to Solvency II was Own Risk and Solvency
Among respondents at insurance firms that
Assessment (ORSA) (87 percent). Regulatory
conduct stress testing, the insurance risk factor
authorities are requiring insurance compa-
on which they most often conduct stress tests
nies to regularly perform ORSAs to assess
is interest rate (94 percent), followed by mortal-
their capital adequacy and solvency and then
ity (67 percent) and lapse (61 percent). Less
to report the results. This requirement is one
than half of insurance respondents said their
of the most important regulatory changes in
institution performs stress testing on property
decades for insurance companies and involves
and casualty claim cost (48 percent) or morbid-
taking a forward-looking, holistic assessment
ity (45 percent).
36
Figure 13. To what extent does your company use the following methods to assess insurance risk?
Actuarial reserving 64% 27% 91%
Regulatory capital 59% 28% 87%
Stress testing 36% 42% 78%
Claims ratio analysis 41% 34% 75%
Economic capital 37% 29% 66%
Asset adequacy analysis 37% 20% 57%
Value at risk 32% 19% 51%
Value of new business 34% 16% 50%
Market consistent embedded value 22% 22% 44%
Primary methodology
Dynamic financial analysis 16% 26% 42%
Secondary methodology
Stochastic embedded value 25% 13% 38%
Note: Percentages were calculated on a base of respondents at institutions providing insurance or reinsurance services.
37
LEADING PRACTICES IN INSURANCE RISK MANAGEMENT

As global regulatory bodies and boards of directors increasingly turn their attention to how insurance
entities are managing risk, there are a number of areas where insurers should focus their efforts to
meet these challenges.
• Finalizing development and implementation of a sustainable ORSA process that is fully integrated
into business strategy and decision making
• Improving linkages of quantitative risk measures to risk limits and tolerances implemented in business
operations
• Enhancing methods to measure and react to emerging reputational and strategic risks
• Establishing improved risk governance to reflect increased regulatory expectations for an effective
second line of defense risk management function
• Continuing to monitor and evaluate potential impact of proposed insurance regulatory group capital
standards
• Advancing current methods for evaluating operational risk through development of enhanced
key risk indicators, more robust loss event data collection, and industry-appropriate quantitative
measurement methodologies
• Investing in risk data quality and systems to enable more effective risk monitoring, reporting, and
analytics
• Further strengthening risk culture by embedding risk management in business strategy and adding
insights into risk-taking activities
38
Sector spotlight: Investment

management
T HE investment management sector is

diverse, comprising not only large and
boutique stand-alone asset management firms
Investment management firms are typi-
cally strong in managing market risk since
this is central to their business. Many are now
but also subsidiaries of diversified banks and addressing risk management areas where
insurance companies. Depending on their they may not be as strong such as IT applica-
structure, investment management operations tions, data management, and oversight of the
can be subject to a variety of requirements extended enterprise. Respondents were asked
imposed by regulators for the parent banking to rate how challenging each of a series of
or insurance company. issues is for the investment risk management
Respondents from investment manage- function in their organization (figure 14).
ment firms were asked how their organiza-
tion assesses investment risk. By far the most Risk technology and data
common approach is performance attribu-
The technology and data used to monitor
tion against a benchmark (97 percent). Other
and manage risk continue to be top priorities
measures are employed by half or more of
and concerns for investment management
investment management institutions: mandate
firms. In the period following the global finan-
breaches (72 percent), absolute return (69 per-
cial crisis, many asset managers’ investments
cent), and Sharpe ratio (50 percent).
Figure 14. How challenging is each of the following for the investment risk management function in
your organization?
38%
55% 48% 42% 41%
IT applications Regulatory Data management Third-party service
and systems compliance and availability provider
oversight
33% 30% 24%

Resourcing Analytics and Risk
reporting governance
Note: Figures represent the percentage of respondents identifying each item as extremely or very challenging. Percentages were
calculated on a base of respondents at institutions that provide investment management services.
39
in risk technology reflected a best-of-breed risk technology and data, it is not surpris-
approach, addressing gaps in coverage and ing that significantly greater percentages of
the depth of risk analytics across asset classes respondents said they consider these issues
and products through the use of multiple risk to be extremely or very challenging for their
engines or service providers. Increasing the investment management activities than was
depth and coverage of risk analytics addressed the case in 2012. The issue most often rated as
one need but inadvertently created additional extremely or very challenging was IT appli-
issues by increasing the sources and volume cations and systems (55 percent up from 23
of risk data. The proliferation of risk data has percent in 2012), while data management and
challenged the ability of asset managers to availability was cited third most often (42 per-
aggregate risk measures and exposures across cent up from 35 percent). Although 30 percent
multiple products, funds, and strategies to of respondents considered risk analytics and
achieve a holistic view of risk. reporting to be extremely or very challenging,
Further magnifying this challenge is the 88 percent said it is at least somewhat challeng-
demand by regulators for additional data ing, an increase from 71 percent in 2012.
and reporting by asset managers. In Europe,
the Alternative Investment Fund Managers Regulatory compliance
Directive (AIFMD) established detailed
With greater scrutiny from regulators, 48
requirements for reporting liquidity, risk
percent of investment management respon-
profiles, and leverage. US pension funds are
dents considered regulatory compliance to
now subject to accounting regulatory changes
be extremely or very challenging, up from
that have prompted a need for significant
29 percent in 2012. Investment management
enhancements in data quality and analysis.
firms have been subjected to a variety of new
Additionally, recent remarks by a member of
regulatory requirements. The SEC is paying
the Board of Governors of the Federal Reserve
greater attention to investment managers and
in the United States point to the focus of
funds including introducing expanded stress
both the FSB and the FSOC on assessing the
testing, more robust data reporting require-
magnitude of liquidity and redemption risk
ments, and increased oversight of the largest
within the asset management sector as a tool
institutions.101 In 2014, the SEC also amended
for macro-prudential regulation.100 This will
its rules to require a floating net asset value for
require many asset managers to invest in their
institutional prime money market funds.102 In
capabilities around liquidity risk measurement
Europe, the AIFMD introduced new regula-
and monitoring.
tions governing the marketing of funds and
Some institutions have invested in data
deal structure for private equity and hedge
warehouses in an effort to improve the avail-
funds operating in the European Union.103
ability and quality of risk data, but have faced
These and other new regulations affect
the challenge of making sure the data placed
a wide range of risk management issues for
into them are “clean” and accurate. Some
investment management firms.
organizations have not implemented error-
detection processes or assigned responsibil-
Governance and accountability
ity for data quality when creating their data
Regulators expect investment management
warehouses. As a result, data governance is
firms to implement strong governance of their
emerging as an important focus for invest-
risk management programs.104 Investment
ment managers, and some organizations have
management firms need to clearly define the
created a chief data officer position to help
roles, responsibilities, and decision-making
address it.
authority across the three lines of defense to
With the increasing complexity of risk data
help ensure there are no ambiguities that can
infrastructure and the focus of regulators on
40
create gaps in control or a duplication of effort. the world. The SEC announced that one of its
In particular, stand-alone investment manage- examination priorities for 2015 would be to
ment firms may need to reexamine the role assess the risks to retail investors including
of the boards of directors of their funds, their such issues as fee selection, sales practices,
committee structure, and the process in place suitability of investment recommendations,
to identify and escalate key risks. and products offered by alternative investment
companies.105 In January 2015, the OCC issued
Compliance risk a handbook for use by its examiners regard-
management program ing conflicts of interest among banks that offer
Investment management firms should have investment management services.106 In Europe,
a rigorous program in place to identify and the Markets in Financial Instruments Directive
manage evolving compliance risks. The objec- (MiFID) II requires that investment firms put
tive of a compliance risk management program in place organizational and administrative
is to help ensure the firm is in compliance with procedures with a view to taking “all reason-
regulatory guidelines and is making consistent able steps” to prevent conflicts of interest.107 In
and accurate disclosures related to business an effort to increase transparency for clients, in
practices and conflicts of interest. Firms should December 2014, the European Securities and
periodically evaluate the effectiveness of their Markets Authority (ESMA) recommended to
compliance program including examining such the EU Commission that portfolio managers
issues as the following: governance and the use only be able to accept broker research where
of the three lines of defense risk governance they pay for it directly or from a research
model; supporting infrastructure (including account funded by a specific charge to their
human resources, business processes, and tech- clients.108 In the United Kingdom, the Financial
nology); management of third-party providers; Services Authority requires that investment
the organization’s risk culture; management of management firms must manage conflicts of
conflicts of interest; strength of internal con- interest fairly and that their boards of directors
trols; accuracy and consistency of disclosures must establish effective frameworks to identify
and communications; integration of compli- and control conflicts of interest.109
ance risk management with ERM; and the Conflicts of interest can affect nearly all
understanding by the organization and its per- aspects of investment management includ-
sonnel of how fiduciary duty is implemented. ing product development, client on-boarding,
portfolio management, personal trading, and
Investment compliance monitoring managing service providers. Investment man-
Investment management firms can benefit agement firms may need to enhance their pro-
from an investment compliance monitoring cesses to identify, record, analyze, and disclose
program. Such a monitoring program can help conflicts of interest. Since conflicts of interest
identify and address any breakdowns in con- can arise as regulations change and a firm’s
trols used to comply with regulatory require- products and strategies evolve, it is helpful to
ments, operational inefficiencies regarding conduct a compliance review at least annually
trade monitoring, inconsistent or inadequate to identify any new conflicts of interest that
processes used to monitor client portfolios, may have arisen.
and inconsistent data usage or poor processes
to integrate new data. Client on-boarding
In Deloitte’s experience, many compliance
Conflicts of interest violations can be traced back to the client on-
Reducing conflicts of interest among boarding process. “Know your customer” and
investment management and other financial customer classification requirements are incor-
institutions is a priority for regulators around porated into numerous regulations including
41
MiFID II, European Market Infrastructure making, trade implementation and monitor-
Regulation (EMIR), the Dodd-Frank Act, ing, exposure management, and performance
and the Foreign Account Tax Compliance evaluation. Institutions should examine the
Act (FATCA). In August 2014, the Financial oversight of their models and the responsibili-
Crimes Enforcement Network (FinCEN) ties, policies, and procedures; validate mod-
published proposed rules that would enhance els; employ ongoing monitoring programs;
customer due diligence requirements to iden- and increase the rigor of their process for
tify and verify the identity of an institution’s developing models.
customers and beneficial owners.110
As investment management firms and Extended enterprise risk
their products become more complex, it can
Managing the risks from third-party service
be difficult and time-consuming to moni-
providers across the extended enterprise is a
tor whether guidelines have been followed as
growing concern. Third-party service provider
new clients are acquired. In some institutions,
oversight was considered to be extremely or
business functions or lines of business may
very challenging for the investment manage-
be segregated, making it difficult to access
ment risk function by 41 percent of respon-
complete information on client accounts.
dents, almost double the 21 percent in 2012.
Investment management firms need an inte-
Third parties can pose risks for many dif-
grated structure that provides clear authority
ferent risk types such as cyber, financial, credit,
for and transparency into decision-making;
legal, strategic, operational, and business
cross-functional participation in product
continuity. Adverse events in any of these areas
development; a strong technology infrastruc-
can damage a firm’s reputation, undermining
ture that supports analytics and monitoring
its ability to attract and retain clients and assets
of client and product profitability; and strong
under management. The potential negative
governance and oversight of the on-boarding
impacts of a risk event at a third party can
process. Given the complexity of the task, insti-
quickly extend to an institution’s reputation
tutions can benefit from automated compli-
and are only magnified today as social media
ance systems that work in tandem with strong
and globalization catapults news around the
manual oversight when setting up accounts for
world at lightning speed.
new clients.
The impact of third parties on cyber
security is a particular concern. Cyber threats
Cybersecurity
continue to increase, and third parties are
Cybersecurity has been an increasing focus
often their point of entry. One analysis across
of regulators that supervise institutions of
multiple industries found that attackers gained
all types, including investment management
access through third-party systems in 40 per-
firms. (See “Operational risk” section for a
cent of data breaches.112
discussion of this issue.)
There are a number of reasons for the
increased focus on extended enterprise risk.
Model risk
Although the use of third parties by investment
Regulators are scrutinizing the models used
management firms is not new, it has become
by financial institutions including investment
increasingly pervasive and complex as the
managers. The SEC charged several entities of
emergence of unbundled services has created
one firm with securities fraud for concealing
more diverse options to outsource specific
a significant error in the computer code of the
functions or sub-functions. As firms continue
quantitative investment model that it used to
to search for efficiency and focus on their core
manage client assets.111
competencies, the expanded use of third par-
Model risk can arise in a number of dif-
ties is appealing to more areas of the business.
ferent areas, including investment decision
42
Managing the risks posed by third parties The SEC’s 2014 examinations focused on
is also more complex than ever before. Third cybersecurity and encompassed vendors that
parties may in turn subcontract some of their have access to an institution’s networks, cus-
services to additional providers, making it dif- tomer data, or other sensitive information.115
ficult for investment management firms to gain The Financial Industry Regulatory Authority
visibility into the risk management practices (FINRA) announced that outsourcing will be
of these sub-service providers (also referred to a priority area of review for its 2015 examina-
as “fourth parties”) and raising the potential tions, including an analysis of due diligence
for concentration risk if several of their third and risk assessment of third-party provid-
parties use common sub-service providers. ers and the supervision of activities that are
Adding to the complexity, more intermedi- outsourced.116 The COSO framework stresses
aries that distribute funds, such as broker/ that organizations retain full responsibility for
dealers, are also becoming service providers managing the risks associated with engaging
by employing an omnibus accounting model third parties and must implement a program
in which they maintain account information to evaluate the effectiveness of their system of
and transaction histories for their customers internal control over the activities performed
through sub-accounting systems and charge by their service providers.117
for these services. Finally, even when an The foundation of an effective program is
investment management firm has a third-party to consider how the institution’s existing risk
relationship with an affiliated entity within the management governance and strategy can
same parent company, it must still take steps to be leveraged to enhance transparency and
assess the effectiveness of the affiliated entity’s accountability for third-party risk. The board
risk management program and controls, of directors and the executive committee
keeping in mind the potential for conflicts should be actively involved in overseeing the
of interest. strategy and direction of the effort. In develop-
Regulatory authorities have increased their ing a third-party risk management strategy,
attention to third-party risk. For investment challenges include clearly defining roles and
management operations that are subsidiaries responsibilities for managing third-party risks
of banks, the Federal Reserve and the OCC are across the three lines of defense, assigning
focused on the risks posed by these relation- responsibility for leading the program, and
ships in such areas as consumer protection and ensuring accountability.
business continuity.113 US banking regulators Some organizations focus only on specific
expect that effective risk management of third- aspects of third-party relationships, such
party relationships will include written con- as procurement. But investment manage-
tracts and plans that outline the bank’s strategy, ment operations need to develop a holistic
identify the inherent risks of the activity, and approach to extended enterprise risk that
detail how the bank selects, assesses, and encompasses the entire lifecycle of third-
oversees the third party. The SEC has required party relationships from initial procurement
investment companies to designate a chief through contracting, service-level agreements,
compliance officer who reports to the board of implementation, metrics, monitoring, and
directors, and one of their duties is to oversee off-boarding. Considering the risk manage-
the compliance programs of the organization’s ment aspects associated with each of these
service providers.114 The SEC has also focused stages in the lifecycle of third-party relation-
on the omnibus and intermediary fee payment ships may lead institutions to rethink their
models to assess “distribution in guise” con- current approaches. For example, in selecting
flicts as well as board and fund management and evaluating potential vendors, selection
oversight of these arrangements. criteria should include not only cost but also
such issues as the provider’s risk management
43
program and transparency. Ongoing monitor- each of its third parties and the cost, both in
ing should encompass the effectiveness of the time and money, to monitor and manage the
vendor’s risk management program and how risks associated with each relationship.
they are managing emerging risks.
Institutions can benefit from having estab- Resourcing
lished processes and a set schedule with which
Resourcing of the investment management
to assess these risks. Most respondents at
risk management function was considered to
institutions providing investment management
be extremely or very challenging by 33 percent
services said they review the risks from their
of respondents (roughly similar to 29 percent
relationships with different types of vendors
in 2012). Managing resource constraints is a
at least annually: administrators (89 percent),
perennial issue and investment management
technology vendors (75 percent), custodians
organizations are increasingly shifting to risk-
(68 percent), distributors (65 percent), transfer
based resourcing, which allocates resources
agents (62 percent), and prime brokers (73
to key areas based on strategic risk assess-
percent). The type of vendor relationship that
ments. This approach can maximize impact
is least often subjected to an annual review is
and value by taking a holistic view of where
consultants (55 percent).
the organization faces the greatest risk and
Institutions should create an inventory of
where additional resources can help meet its
all their third-party relationships and develop
strategic goals. It can also identify gaps in skills
a formal process to assess and rank them based
and inform hiring decisions to more effectively
on the importance of the services provided and
manage key risk areas.
the risks associated with each relationship. As
part of this examination, the assessment should
identify the material, non-public information Risk governance
about the institution and the personal identify- Many investment management firms are
ing information regarding customers that each examining the role of the board of directors
third party has access to. in overseeing risk, including which issues and
Leading practices, including the OCC decisions should be referred to the full board.
framework, include segmenting third-party They are also considering which management
providers based on risk rankings such as low, committees should be established to manage
medium, high, and critical. Although it is risk and how to implement an effective process
important for institutions to focus on criti- to identify and escalate key risks. While 24
cal relationships, an effective third-party risk percent of respondents said risk governance
management program should evaluate and is extremely or very challenging for their
oversee to some extent the risks posed by all investment management function, 85 percent
third parties. Institutions should assess the described it as at least somewhat challenging.
trade-offs between the level of risk posed by
44
LEADING PRACTICES IN INVESTMENT MANAGEMENT

As is true across other parts of the financial services industry, the risk management practices of asset
management firms are evolving and under increasing scrutiny. Some of the leading practices and other
important areas for investment management firms to consider include:
Governance
• Reexamining and fine-tuning the mandate and responsibilities of boards of directors and the
structure of management committees to help increase their effectiveness in overseeing and
managing risks
• Identifying key risks and implementing effective oversight, including appropriate escalation and
reporting practices
• Reviewing the three lines of defense and the roles and responsibilities of each
Behavior
• Promoting risk culture by establishing clear business practices, guidance, and oversight mechanisms
• Reviewing methods to identify new and changing conflicts of interest
• Enhancing client on-boarding processes to help promote regulatory compliance and risk
management in an increasingly complex global environment
Execution
• Implementing a comprehensive extended enterprise risk management program that allows for more
effective risk management of third-party providers
• Enhancing investment compliance monitoring to improve risk identification, increase operational

efficiencies, and improve the client experience
• Conducting trade analytics to improve overall monitoring and surveillance and to identify areas of
improvement
Infrastructure
• Strengthening the overall effectiveness of data management as a key enabler for risk management
and reporting
• Increasing the maturity of cyber risk programs to accommodate the evolving threat landscape and
integrating cyber risk oversight into the extended enterprise (third-party providers)
• Addressing the limitations of aging infrastructure to more effectively manage risk in an increasingly
complex and global operating environment
45
Management of key risks
W HEN asked to assess how their institu-

tion manages risk overall, 75 percent
of respondents felt it was extremely or very
stresses since the global financial crisis to chal-
lenge the belief that institutions are managing
risk effectively.
effective, similar to the results in 2012. The Respondents were most likely to consider
reason may be that there have been no major their institution extremely or very effective
Figure 15. How effective do you think your organization is in managing each of the following types
of risks?
Credit 92%
Asset and liability 89%
Liquidity 89%
Counterparty 80%
Market 80%
Property and casualty* 76%
Regulatory/compliance 76%
Budgeting/financial 73%
Mortality* 73%
Morbidity* 70%
Country/sovereign 68%
Reputation 66%
Lapse* 61%
Strategic 60%
Operational 56%
Catastrophe* 56%
Systemic 55%
Geopolitical 47%
*Asked of respondents at institutions that provide insurance or reinsurance services.
Note: Figures represent the percentage of respondents rating their organization effective or very effective in managing each
type of risk.
46
in managing more traditional risk types such

as credit (92 percent), asset and liability (89
“We expect that not only
percent), liquidity (89 percent), counterparty
(80 percent), and market (80 percent). For
do we need to continue
these risk types, institutions typically have to improve our ability to
more well developed risk methodologies, data,
and infrastructure. In addition, regulatory manage risk but also, maybe
requirements and expectations are well defined
and understood. more importantly, we have
Fifty-six percent of respondents consid-
ered their institution to be extremely or very to improve our ability to
effective in managing operational risk, which
reflects the fact that operational risk is a demonstrate that we have
diverse risk type firms find difficult to define
and measure.
managed the risk. You can
Respondents also gave lower ratings as
being extremely or very effective to several
add the best internal controls
other risk types: country/sovereign (68 percent), in the world but if you didn’t
reputation (66 percent), strategic (60 percent),
systemic (55 percent), and geopolitical (47 have the documentation to
percent). These risk types are newer, and as a
result there are fewer accepted methodologies prove the controls exist, it
and tools, risk data may not be available, and
regulatory expectations are less clearly defined. doesn’t mean anything.”
Respondents were asked which three risk
types they believed would increase the most in —— Director of enterprise risk management, insurance
importance to their institution over the next

two years. Given the depth and breadth of States, banks have abundant liquidity and some
regulatory change, it was not surprising that have sought to improve earnings and increase
the risk type most often ranked among the returns by extending credit to borrowers with
top three was regulatory/compliance risk (51 lower credit quality.
percent) (figure 16).
The risk type cited next most often as Credit risk
increasing in importance was cybersecurity
Regulators are expecting financial institu-
risk (39 percent). Although many respondents
tions to closely monitor their credit exposures,
expected cybersecurity risk would be one of
which can be a formidable task. The credit risk
the risks to increase most in importance over
issue most often rated as extremely or very
the next two years, only 42 percent felt their
challenging by respondents was obtaining suf-
institution is extremely or very effective in
ficient, timely, and accurate credit risk data (33
managing it.
percent). This issue poses a greater challenge at
Although credit risk is a mature risk type,
small institutions (46 percent) than at mid-size
there are a number of reasons that may explain
(35 percent) or large institutions (25 percent).
why 26 percent of respondents felt it would
Institutions need to aggregate their risk data
be one of the risk types to increase the most
and calculations across the enterprise to gain
in importance over the next two years. Credit
a consolidated view of overall credit risk, and
risks are cyclical, and there are increased
this was the area cited next most often. Thirty-
concerns over the economic slowdown in
one percent of respondents said consistently
Europe and emerging markets. In the United
47
Figure 16. Over the next two years, which three risk types do you think will increase the most in
their importance for your business?
Regulatory/compliance 51%
Cybersecurity 39%
Strategic 28%
Credit 26%
Data integrity 23%
Operational 19%
Liquidity 17%
Market 16%
Asset and liability 14%
Reputation 12%
Business continuity/IT security 10%
Note: Only the highest-rated risk types are shown. Figures reflect the percentage of respondents who ranked each risk type in
the top three.
aggregating the results of credit risk calculations was obtaining sufficient, timely, and accurate
across portfolios and business areas is extremely market risk data (23 percent), followed by
or very challenging. aligning market risk management with over-
These activities are especially demanding all ERM program (20 percent). In contrast to
for larger institutions that have multiple lines credit risk, only 12 percent of respondents
of business and operate in numerous geo- considered aggregating the results of market risk
graphic markets. The degree of difficulty ramps data calculations across portfolios and business
up after mergers, when an institution must areas to be extremely or very challenging in
integrate the acquired institution’s data, which managing market risk.
may not be in a comparable format and may
cover a different time period than its existing Liquidity risk
credit risk data.
Respondents reported greater challenges
in managing liquidity risk. Regulators have
Market risk focused on this issue due to the liquidity dif-
Market risk is a mature risk type with ficulties many institutions experienced during
generally well-developed methodologies, and the global financial crisis. Since these regula-
relatively few respondents considered specific tory requirements are relatively recent, many
issues to be challenging. The issue most often institutions have less mature infrastructure and
considered to be extremely or very challenging
48
procedures for liquidity risk than for credit and institutions, conducting the sophisticated
market risk. analyses and forecasts is complex. The issue
The two issues cited most often as extremely cited most often as extremely or very challeng-
or very challenging concerned complying with ing for asset liability management was ability
Basel III liquidity requirements: investment to model on a dynamic basis the impact on net
in operational and other capabilities to com- interest income of changing interest rates and
ply with the Basel III NSFR (40 percent) and changing balance sheet (29 percent).
investment in operational and other capabilities Obtaining asset liability risk data is also a
to comply with the Basel III LCR (31 percent) challenge at some institutions. The issue rated
(figure 17). third most often by respondents as extremely
Roughly one-third of respondents said that or very challenging was obtaining sufficient,
developing a credible set of systemic and idiosyn- timely, and accurate asset and liability data (24
cratic liquidity stress scenarios is extremely or percent).
very challenging. Finally, risk data was also a
concern, with 31 percent of respondents saying Operational risk
that obtaining sufficient, timely, and accurate
Operational risk is a difficult risk to
risk data is extremely or very challenging.
measure and manage, with a wide range of
potential operational risk events and where
Asset liability management loss data are not easily available. Operational
Although asset liability management risk is an area of focus both for regulators and
has been a longstanding process at many the industry.
Figure 17. How challenging is each of the following for your organization in managing liquidity risk?
Investment in operational and other capabilities to comply

with the Basel III NSFR (Net Stable Funding Ratio) 40%
Developing a credible set of systemic and

32%
idiosyncratic liquidity stress scenarios
Obtaining sufficient, timely, and accurate risk data 31%
Investment in operational and other capabilities to comply

31%
with the Basel III LCR (Liquidity Coverage Ratio)
The quantification of the liquidity stress scenarios 27%
Controlling the consumption of liquidity on a daily basis

23%
across the whole firm
Cash flow forecasting 22%
Establishing and then monitoring

18%
liquidity risk appetite
Establishing a contingency funding plan 16%
Managing any other key balance sheet ratios, e.g.,

15%
customer loans/customer deposits
49
“I see the need for more focus business disruption and system failures (74
percent up from 46 percent); and execution,
on operational risk, including delivery, and process management (74 percent
up from 45 percent).
reputation and litigation risks. When it comes to operational risk meth-
odologies, respondents most often considered
In response, we need to do them to be extremely or very well developed
at their institution for risk assessments (60 per-
better modeling—perhaps cent), internal loss event data/database (48 per-
cent), risk and capital modeling (45 percent),
thinking about it in a different and key risk indicators (42 percent) (figure 18).
way than we have in the Some methodologies received much lower

ratings. Only one-third of respondents felt
traditional sense of managing that their institution’s external loss event data/
database is extremely or very well developed,
operations risk.” and 30 percent said the same about causal
event analysis.
—— Senior risk officer, banking Most respondents considered their organi-
zation to be extremely or very effective in man-
aging the more traditional types of operational
Respondents most often said their institu- risk types such as legal (70 percent), regulatory/
tion places an extremely or very high priority compliance (67 percent), and tax (66 percent).
on managing three types of operational risk In contrast, fewer respondents considered their
events: clients, products, and business prac- institution to be extremely or very effective
tices (74 percent up from 52 percent in 2012); at managing other types of risks including
Figure 18. How well developed are each of the following operational risk management
methodologies at your organization?
Risk assessments 60%
Internal loss event data/database 48%
Risk and capital modeling 45%
Key risk indicators 42%
Scenario analysis 34%
External loss event data/database 33%
Scorecards 32%
Causal event analysis 30%
Note: Figures represent the percentage of respondents identifying each item as extremely or very well developed.
50
third-party (44 percent), data integrity (40 Forty-two percent of respondents felt their
percent), and model (37 percent). institution is extremely or very effective in
managing cybersecurity, roughly similar to the
Cybersecurity percentage who said the same about manag-
Cybersecurity is an operational risk type ing third-party risk (44 percent). Third-party
that has become a high priority for financial and cybersecurity risk are sometimes closely
institutions and regulators. The number and related since there have been security breaches
extent of cyber attacks have shown “expo- involving third parties that have affected the
nential growth”118 according to one corporate confidentiality of customer information.
security chief, with the financial services Respondents at large institutions (63 per-
industry as a top target.119 In response, double- cent), which have more resources to devote
digit increases in bank security budgets are to safeguarding their data and information
expected in the next two years.120 Once seen as systems, were more likely to consider their
only an IT issue, the impacts of cyber attacks organization to be extremely or very effective
can spread across the organization and affect in this area than those at mid-size (35 percent)
business lines, operations, legal, and communi- or small institutions (25 percent).
cations, among other areas. With their wide-
spread impacts, cybersecurity events also pose Regulatory risk
significant reputational risks to a company.
The wave of change since the global finan-
With the increase of major hacking inci-
cial crisis has constituted the most far-reaching
dents, from both criminal enterprises and
revision of regulatory requirements in decades,
potentially state-sponsored actors, cybersecu-
significantly increasing compliance require-
rity has been a major focus for regulators. In
ments. The era of regulatory reform is far
February 2015, the SEC’s Office of Compliance
from over, with additional proposals from the
Inspections and Examinations released the
Basel Committee and with final rules still to be
results of its examinations in 2014 of cyber-
established for many provisions of the Dodd-
security practices at more than 100 registered
Frank Act in the United States and for the
broker-dealers and investment advisers.121
CMU and the EU Regulations and Directives
In the same month, FINRA published its
in Europe.
recommendations on effective cybersecurity
The impacts of these more stringent regula-
practices, based on its 2014 examinations of
tory requirements are significant for many
member firms.122 FINRA has announced that
institutions, including higher capital require-
cybersecurity will again be one of its examina-
ments, restrictions on business activities,
tion priorities in 2015.123
additional documentation for regulators, and
Given the increasing regulatory require-
new standards on risk data and infrastructure.
ments and the potential reputational damage
Regulators are also turning their attention to
that can result from a data breach, financial
qualitative issues, such as risk culture and the
institutions need a comprehensive cyberse-
effectiveness of internal controls.
curity program. Among the leading practices
One result of all these regulatory require-
for such a program are that it places a priority
ments has been increased costs. When asked
on threats with the greatest potential impact
about the impacts of regulatory reform on
and on safeguarding sensitive data and critical
their institution, respondents most often men-
infrastructure; implements a formal written
tioned noticing an increased cost of compliance
plan to respond to cybersecurity incidents;
(87 percent up from 65 percent in 2012) (figure
conducts penetration testing; has dedicated
19). Other impacts cited often were main-
personnel; and periodically reviews the firm’s
taining higher capital (62 percent up from 54
cyber insurance strategy.
percent in 2012) and adjusting certain products,
51
“For global organizations, a huge challenge is trying to

manage responses to regulations across different regulators
and jurisdictions. While we tend not to see regulators
totally contradicting one another, the pace of regulatory
change is often quite different in different regions, and that
makes things more challenging for us.”
—— Senior risk officer, banking
lines, and/or business activities (60 percent up The impacts of examinations and enforce-
from 48 percent). ment actions were also mentioned by many
Many respondents are concerned that respondents: regulators’ increasing inclination
compliance costs will continue to escalate. to take formal and informal enforcement actions
Considering the potential impact on their (53 percent) and more intrusive and intense
organization of supervisory and regula- examinations (49 percent).
tory processes, respondents were most often New regulatory requirements have not
extremely or very concerned about issues only increased costs, they have also limited the
related to cost: tighter standards or regulations ability of many institutions to generate rev-
that will raise the cost of doing existing business enues. Reflecting this new reality, 43 percent of
(72 percent) and growing cost of required docu- respondents said they were extremely or very
mentation and evidence of program compliance concerned over new restrictions or prohibitions
(60 percent). on profitable activities that will require a signifi-
cant change in business model or legal structure.
Figure 19. Which of the following impacts on your organization have resulted from regulatory
reform in the major jurisdictions where it operates?
87%
Noticing an increased cost of compliance
65%
62%
Maintaining higher capital
54%
Adjusting certain product lines and/or 60%

business activities 48%
35%
Maintaining higher liquidity
37%
7%
No significant impacts 2014 2012
13%
52
Risk management information

systems and technology
T HE global financial crisis underscored the

need for risk data that are accurate, timely,
consistent, and aggregated across the enter-
the OCC’s heightened standards, and MiFIR,
among other regulations.
Complying with these requirements is an
prise. Since then, risk data have been a priority arduous task for some institutions. For exam-
for regulators. ple, many Eurozone banks encountered dif-
In 2013, the Basel Committee issued its ficulties in providing the accurate, timely data
BCBS 239 paper, which emphasizes that banks required by the ECB’s asset quality review.126
need systems capable of producing aggregated When asked about the challenges facing their
risk data for all critical risks during times of institution, many respondents said that risk
stress or crisis.124 Banks must also fully docu- information systems and technology infrastruc-
ment and validate their aggregation capabilities ture (62 percent) and risk data (46 percent) are
and reporting practices. G-SIBs must comply extremely or very challenging.
by January 1, 2016, and BCBS 239 suggests that In response to these stricter requirements,
supervisors apply the same rules to domestic many financial institutions have undertaken
systemically important banks (D-SIBs). major data remediation and infrastructure pro-
CCAR’s stress tests require banks to grams. Progress has been made, but significant
aggregate risk data across regions and lines of work remains to be done at many institutions.
business.125 There are also stricter requirements Less than half of the respondents rated their
for data quality and aggregation in various institution as extremely or very effective in any
capital and liquidity requirements, Solvency II, area of risk data and infrastructure, although
“The three biggest challenges in risk management today

are 1) having the right data and technology in place to
help measure risk quickly and efficiently, 2) producing and
monitoring MIS reporting that can effectively help identify
risks on a timely basis, ideally with warnings before they
are a problem, and 3) managing the very high demand for
resources, which are increasingly hard to find and expensive
to pay for.”
—— Senior risk officer, banking
53
the ratings improved since 2012: data manage- Forty-eight percent of respondents said they
ment/maintenance (39 percent compared to are extremely or very concerned about risk
20 percent in 2012), data process architecture/ technology adaptability to changing regulatory
workflow logic (35 percent compared to 23 requirements, an increase from 40 percent in
percent) and data controls/checks (31 percent 2012, while 46 percent of respondents said the
roughly similar to 33 percent in 2012). same about lack of integration among systems,
The pace of regulatory change places addi- up from 31 percent in 2012 (figure 20).
tional demands on risk technology systems.
Figure 20. How concerned is your organization about each of the following issues for
its risk management information technology systems?
Risk technology adaptability to changing 48%

regulatory requirements
Lack of integration among systems 46%
Lack of flexibility to extend the 35%

current systems
Inability to respond to time-sensitive and 34%

ad-hoc requests
Inability to integrate risk analytics from 31%

multiple risk systems
Risk data quality and management 28%
High cost of maintenance and vendor fees 28%
Lack of performance for more frequent and

timely reporting 27%
Lack of integrated risk and finance reporting

for economic capital optimization 25%
Out-of-date methodologies 25%
Inability to source required functionality from 21%

a single vendor
Constraints in aggregation and reporting of 18%

risk analytics due to batch processing times
Lack of product and asset class coverage 18%
Lack of aggregation of trading and 17%

banking books
Lack of cross-asset-class risk calculations 17%
Inability to capture increasing volumes 15%
Note: Figures represent the percentage of respondents that were extremely or very concerned about each issue.
54
Conclusion
The era of regulatory reform sparked by

the global financial crisis has become the new
normal. There has been an ongoing series of
new regulations affecting risk governance,
capital adequacy, liquidity, stress testing, and
prohibitions on proprietary trading, among
other areas. Institutions are being required to
enhance their capabilities for managing opera-
tional risk, with both regulators and manage-
ment especially concerned about the impacts
of hacking and other types of cyber attacks.
Regulators are also focusing on the quali-
tative aspects of risk management. They are
looking beyond quantitative measures of mar-
ket, credit, and liquidity risk to assess whether
institutions have created a culture that encour-
ages employees to take appropriate risks and
that promotes ethical behavior more broadly.
In this effort, it is essential that incentive com- board of directors and senior management,
pensation schemes are aligned with an institu- including implementing an ERM program
tion’s risk appetite. and creating a CRO position. They will
Success in all these areas depends on now need to broaden their perspective to
quality risk data and effective information consider how they can manage conduct risk
systems. Yet, developing accurate, aggregated by embedding a risk culture throughout
risk data on a timely basis remains a chal- their organization that encourages ethical
lenge. Measurement can be especially difficult behavior by employees. Keys to this effort
for some risk types, such as operational risk, will be the board of directors and senior
and for qualitative issues, such as risk culture. management communicating the value the
Deloitte’s Global risk management survey indi- organization places on treating customers
cates there has been progress in many of these fairly and also having incentive compensa-
areas. But with the regulatory expectations tion practices that reward ethical behavior
being ratcheted up continually, institutions will and appropriate risk-taking.
need to keep pace by regularly upgrading their
risk management capabilities: • As regulators rely more on stress tests
to assess capital adequacy and liquidity,
• Many institutions have implemented institutions will need to improve their stress
strong risk governance at the level of their testing capabilities and attract personnel
55
with the required skills and experience. The Financial institutions are adjusting to
talent shortage noted in this survey will the new environment for risk management.
make this an ongoing challenge. Most institutions will need to enhance their
risk management programs to stay current—
• More effective management of operational improving analytical capabilities, investing in
risks, especially cybersecurity, will be risk data and information systems, attracting
essential. Institutions will not only need risk management talent, fostering an ethical
to improve their IT security processes, but culture, and aligning incentive compensation
also their processes for selecting vendors practices with risk appetite. They will find
and assessing their security procedures. that business strategies and models must be
reassessed in response to changed regulations
• Institutions will need to reassess their risk more often than before. Perhaps most impor-
data and information systems. Many insti- tant, institutions will need to develop the flex-
tutions will need to improve their access to ibility to respond nimbly to the “new normal”
high-quality and timely risk data as well as risk management environment of unceasing
their ability to quickly aggregate risk data regulatory change.
across lines of business and geographies.
56
Endnotes
1. About the term “leading practice”: For 6. Neil Irwin, “Job growth looks great;
purposes of this paper, we consider industry wage growth, less so,” New York Times,
practices to fall into a range, from leading January 9, 2015, http://www.nytimes.
to lagging. Some industry practices may com/2015/01/10/upshot/job-growth-
be considered leading practices, which are looks-great-wage-growth-less-so.html.
generally looked upon favorably by regulators, 7. Office for National Statistics, “Statistical
industry professionals, and observers due to Bulletin: Quarterly national accounts, quarter
the potentially superior outcomes the practice 4 (Oct to Dec) 2014,” March 31, 2015, http://
may attain. Other approaches may be consid- www.ons.gov.uk/ons/dcp171778_398239.pdf.
ered prevailing practices, which are seen to be
widely in use. At the lower end of the range are 8. eurostat, “Flash estimate for fourth quarter
lagging practices, which generally represent of 2014,” February 13, 2015, http://ec.europa.
less advanced approaches and which may result eu/eurostat/documents/2995521/6625198/2-
in less-than-optimal outcomes. Items reflected 13022015-AP-EN.pdf/6f7a18eb-0b2a-466b
as leading practices herein are based on survey -b444-4d240889a723.
feedback and the editor’s and contributors’ 9. Economist, “Easing means squeezing,”
experience with relevant organizations. January 31, 2015, http://www.economist.com/
2. Percentages total to more than 100 news/finance-and-economics/21641271-
percent since respondents could quantitative-easing-has-both-good-and-
make multiple selections. bad-implications-europes-banks-easing.
3. Neil Irwin, “How a rising dollar is creat- 10. Jonathan Soble, “Japan’s economy expands,
ing trouble for emerging economies,” but less than expected,” New York Times,
New York Times, March 16, 2015, http:// February 15, 2015, http://www.nytimes.
www.nytimes.com/2015/03/17/upshot/ com/2015/02/16/business/japans-economic-
how-a-rising-dollar-is-creating-trouble- growth-weaker-than-expected.html.
for-emerging-economies.html?hp&action 11. Mark Magnier, Lingling Wei, and Ian Tal-
=click&pgtype=Homepage&module=seco ley, “China economic growth is slowest in
nd-column-region&region=top-news&WT. decades,” Wall Street Journal, January 19,
nav=top-news&_r=1&abt=0002&abg=1. 2015, http://www.wsj.com/articles/china-gdp-
4. Bureau of Economic Analysis, “National growth-is-slowest-in-24-years-1421719453.
income and product accounts: Gross do- 12. Board of Governors of the Federal Reserve
mestic product: Fourth quarter and System, “Comprehensive capital analysis
annual 2014 (third estimate),” March 27, and review 2015: Summary instructions
2015, https://www.bea.gov/newsreleases/ and guidance,” October 2014, http://
national/gdp/gdpnewsrelease.htm; GDP www.federalreserve.gov/newsevents/
projections in this section are from Global press/bcreg/bcreg20141017a1.pdf.
Economic Prospects, The World Bank Group,
13. Deloitte Center for Financial Services,
January 2015, http://www.worldbank.org/
2015 Banking Outlook, 2015, http://www2.
en/publication/global-economic-prospects.
deloitte.com/us/en/pages/regulatory/
5. Tami Luhby, “2014 is best year for job gains banking-regulatory-outlook-2015.html.
since 1999,” CNN Money, December 5,
14. Board of Governors of the Federal Reserve
2014, http://money.cnn.com/2014/12/05/
System, “Capital plan and stress test rules,”
news/economy/november-jobs-report/.
October 17, 2014, http://www.gpo.gov/fdsys/
pkg/FR-2014-10-27/pdf/2014-25170.pdf.
57
15. Deloitte EMEA Centre for Regulatory Strategy, 23. The Economist Intelligence Unit, “Bank-
“Top 10 for 2015: Our outlook for financial ing stress tests will not turn the euro
markets regulation,” 2015, http://www2.de- zone around,” December 15, 2014, http://
loitte.com/global/en/pages/financial-services/ gfs.eiu.com/Article.aspx?articleType=
articles/regulatory-top-ten-for-2015.html. rf&articleid=72579791&secId=5.
16. Basel Committee on Banking Supervision, 24. Thomas Atkins and Stefano Bernabei
Fundamental review of the trading book: A “After stress tests, tougher questions com-
revised market risk framework, October 2013, ing for Europe’s banks from ECB,”
http://www.bis.org/publ/bcbs265.pdf. Reuters, December 1, 2014, http://
17. For a detailed discussion of structural www.reuters.com/article/2014/12/01/
reform in banking in Europe, please see the us-ecb-regulator-idUSKCN0JF25K20141201.
2014 report by Deloitte’s EMEA Centre for 25. David Milliken and Huw Jones, “Britain
Regulatory Strategy, Structural reform of warns of tougher bank stress tests ahead,”
EU banking: Rearranging the pieces, http:// Reuters, December 16, 2014, http://uk.reuters.
www2.deloitte.com/content/dam/Deloitte/uk/ com/article/2014/12/16/uk-britain-banks-
Documents/financial-services/deloitte-uk-fs- stress-idUKKBN0JU0IW20141216.
structural-reform-eu-banking-april-14.pdf. 26. James Eyers, “Banks have more to do to
18. Matt Scuffham and Steve Slater, “UK banks prepare for crisis, warns APRA,” Sydney Morn-
urge regulator to speed up ringfencing ing Herald, November 7, 2014, http://www.
rules,” Reuters, January 6, 2014, http://www. smh.com.au/business/banking-and-finance/
reuters.com/article/2015/01/06/us-banks- banks-have-more-to-do-to-prepare-for-
britain-lloyds-idUSKBN0KF1M620150106. crisis-warns-apra-20141107-11ihw0.html.
19. European Commission, Proposal for a 27. Economist, “Into the burning building,”
regulation of the European parliament January 10, 2015, http://www.economist.
and of the council on structural measures com/news/britain/21638136-aviva-trying-
improving the resilience of EU credit institu- expand-troubled-market-burning-building.
tions, January 29, 2014, http://old.eur-lex. 28. Nathaniel Popper, “Goldman Sachs
europa.eu/LexUriServ/LexUriServ.do? investments test the Volcker Rule,” New
uri=COM:2014:0043:FIN:EN:PDF. York Times, January 21, 2015, http://
20. Gunnar Hökmark, Draft report on the proposal dealbook.nytimes.com/2015/01/21/
for a regulation of the European parliament goldman-investments-are-testing-volcker-rule/.
and of the council on structural measures 29. Deloitte, The final Volcker Rule: What does it
improving the resilience of EU credit institutions, mean for banking institutions?, 2013, http://
Committee on Economic and Monetary Affairs, www2.deloitte.com/global/en/pages/financial-
European Parliament, December 22, 2014, services/articles/the-final-volckerrule.html.
http://www.europarl.europa.eu/sides/getDoc.
do?pubRef=-%2f%2fEP%2f%2fNONSGML 30. Peter Eavis, “Fed’s delay of parts of Volcker
%2bCOMPARL%2bPE-546.551%2b02%2b Rule is another victory for banks,” New York
DOC%2bPDF%2bV0%2f%2fEN; Financial Times, December 19, 2014, http://dealbook.
Services UK blog, “EU bank structural nytimes.com/2014/12/19/feds-delay-of-parts-
reform—progress, of sorts,” Deloitte, January 9, of-volcker-rule-is-another-victory-for-banks/.
2015, http://blogs.deloitte.co.uk/financialser- 31. A detailed discussion of the compliance issues
vices/2015/01/eu-bank-structural-reform.html. related to the Volcker Rule is provided in
21. Stephanie Armour and Ryan Tracy, “Big Deloitte’s report, The Volcker Rule compliance
banks to get higher capital requirement,” monitoring program, 2014, http://www2.
Wall Street Journal, April 8, 2014, http:// deloitte.com/content/dam/Deloitte/us/
www.wsj.com/articles/SB100014240527 Documents/risk/us-aers-volcker-rule.pdf.
02303456104579489643124383708. 32. European Commission, Proposal for a regula-
22. Michael Flaherty and Howard Schneider, tion of the European parliament and of the
“Fed considers using bank stress tests for council on structural measures improving
crisis prevention,” Reuters, October 16, 2014, the resilience of EU credit institutions.
http://www.reuters.com/article/2014/10/17/ 33. Mary Williams Walsh, “‘Too big to fail’
us-usa-fed-banks-idUSKCN0I51VI20141017. on financial regulators’ agenda again,”
New York Times, January 21, 2015, http://
dealbook.nytimes.com/2015/01/21/
regulators-delve-into-too-big-to-fail-tag/.
58
34. Stephen J. Lubben, “Do ‘living wills’ 44. Deloitte, Capital markets union: Positive
for banks even make sense?,” New first steps, February 19, 2015, http://blogs.
York Times, August 11, 2014, http:// deloitte.co.uk/financialservices/2015/02/
dealbook.nytimes.com/2014/08/11/ capital-markets-union.html.
do-living-wills-for-banks-even-make-sense/. 45. Deloitte EMEA Centre for Regulatory Strategy,
35. Deloitte EMEA Centre for Regulatory Strategy, Top 10 for 2015: Our outlook for financial
Top 10 for 2015: Our outlook for financial markets regulation, 2015, http://www2.deloitte.
markets regulation, 2015, http://www2.deloitte. com/global/en/pages/financial-services/
com/global/en/pages/financial-services/ articles/regulatory-top-ten-for-2015.html.
articles/regulatory-top-ten-for-2015.html. 46. Jonathan Weisman and Eric Lipton,
36. Financial Services UK blog, “Resolvabil- “In new congress, Wall St. pushes to
ity: Breaking down the barriers,” Deloitte, undermine Dodd-Frank reform,” New
September 8, 2014, http://blogs.deloitte. York Times, January 13, 2015, http://
co.uk/financialservices/2014/09/resolvability- www.nytimes.com/2015/01/14/business/
breaking-down-the-barriers.html. economy/in-new-congress-wall-st-pushes-
37. Martin Arnold, “Bank settlements hit $56bn to-undermine-dodd-frank-reform.html.
in most expensive year on record,” Financial 47. Victoria McGrane and Ryan Tracy, “Small
Times, December 26, 2014, http://www. banks score gains in lifting regulation,” Wall
ft.com/intl/cms/s/0/baa2d2c0-89c2-11e4- Street Journal, February 2, 2015, http://www.
9dbf-00144feabdc0.html#axzz3PTZdZiPy; wsj.com/article_email/small-banks-score-
Chiara Albanese, David Enrich, and Katie gains-in-lifting-regulation-1422904294-lMy-
Martin, “Citigroup, J.P. Morgan take brunt of QjAxMTE1MjAwMjIwNDIzWj.
currencies settlement,” Wall Street Journal, 48. Economist, “Financial-transaction
November 12, 2014, http://www.wsj.com/ taxes: Still kicking,” January 31, 2015,
articles/banks-reach-settlement-in-foreign- http://www.economist.com/news/
exchange-rigging-probe-1415772504. finance-and-economics/21641258-
38. Bank for International Settlements, “Proposals new-life-bad-idea-still-kicking.
to improve the operational risk capital frame- 49. Nathaniel Popper and Peter Eavis, “On Wall St.,
work release by the Basel Committee,” October rules on capital humble banks and shrink pay,”
6, 2014, http://www.bis.org/press/p141006.htm. New York Times, February 19, 2015, http://
39. Bank for International Settlements, “Revi- www.nytimes.com/2015/02/20/business/deal-
sions to the standardised approach for credit book/new-rules-transform-wall-st-banks.html.
risk: Basel Committee issues consultative 50. Ibid.
document,” December 22, 2014, http://
www.bis.org/press/p141222a.htm. 51. Nicole Perlroth, “JPMorgan and other
banks struck by hackers,” New York Times,
40. John Heltman, “Ready or not, here August 27, 2014, http://www.nytimes.
comes Basel IV,” Bloomberg, December com/2014/08/28/technology/hackers-
8, 2014, http://www.americanbanker. target-banks-including-jpmorgan.html.
com/news/law-regulation/ready-or-not-
here-comes-basel-iv-1071503-1.html. 52. James Titcomb, “Could your bank be the
next victim of a cyber attack?” Telegraph,
41. Davis Polk, “Dodd-Frank progress report,” October 19, 2014, http://www.telegraph.
December 1, 2014, http://www.davispolk.com/ co.uk/finance/newsbysector/banksand-
dodd-frank-progress-report-december-2014/. finance/11170888/Could-your-bank-be-
42. Economist, “It takes 28 to tango,” February the-next-victim-of-a-cyber-attack.html.
21, 2015, http://www.economist.com/news/ 53. William Dudley, “Ending too big to fail,”
finance-and-economics/21644199-new-plan- remarks at the Global Economic Policy Forum,
help-firms-find-funding-it-takes-28-tango. Federal Reserve Bank of New York, Novem-
43. James Kanter and Jenny Anderson, “Europe ber 7, 2013, http://www.newyorkfed.org/
proposes a capital markets union,” New York newsevents/speeches/2013/dud131107.html.
Times, February 18, 2015, http://www.nytimes. 54. Financial Stability Board, Thematic review on
com/2015/02/19/business/international/eu- risk governance: Peer review report, February
rope-proposes-a-capital-markets-union.html. 12, 2013, http://www.financialstabilityboard.
org/wp-content/uploads/r_130212.pdf.
59
55. Financial Services UK blog, “FCA business sometimes be be termed “insurance compa-
plan: What firms can expect from the FCA in nies” (even if they also provide other types
2015–2016,” Deloitte, March 25, 2015, http:// of financial services) and institutions that
blogs.deloitte.co.uk/financialservices/2015/03/ provide investment management services
fca-business-plan-2015-16.html. will sometimes be be termed “investment
56. Daniel K. Tarullo, member of the Federal management companies” (even if they also
Reserve Board of Governors, “Good compli- provide other types of financial services).
ance, not mere compliance,” remarks at 65. Deloitte, Forward look: Top regulatory
Federal Reserve Bank of New York Confer- trends for 2015 in insurance, 2015, http://
ence on reforming culture and behavior in www2.deloitte.com/us/en/pages/regulatory/
the financial services industry,” October insurance-regulatory-outlook-2015.html.
20, 2014, http://www.federalreserve.gov/ 66. In the 2012 survey, respondents were
newsevents/speech/tarullo20141020a.htm. asked how much time their board
57. Emily Glazer and Christina Rexrode, “As of directors spends on risk manage-
regulators focus on culture, Wall Street ment compared to five years ago.
struggles to define it,” Wall Street Journal, 67. Neil Roland, “Banks excelling at risk-
February 1, 2015, http://www.wsj.com/ governance but hindered by skill gaps, OCC
articles/as-regulators-focus-on-culture-wall- official says,” FS Core, March 23, 2015.
street-struggles-to-define-it-1422838659.
68. Among the 28 survey respondents in the
58. Victoria McGrane and Andrew Ackerman, “US United States and Canada, 82 percent (23
regulators revive work on incentive-pay rules,” respondents) were from the United States.
Wall Street Journal, February 16, 2015, http://
www.wsj.com/articles/u-s-regulators-revive- 69. For a discussion of the Federal Reserve’s EPS
work-on-incentive-pay-rules-1424132619. for US banks, see Deloitte’s report, Final look: A
practical guide to the Federal Reserve’s enhanced
59. Monetary Authority of Singapore, “MAS prudential standards for domestic banks,
to give legislative effect to financial advi- 2014, http://www2.deloitte.com/content/
sory industry review proposals,” October dam/Deloitte/us/Documents/audit/us-aers-
2, 2014, http://www.mas.gov.sg/News- deloitte-eps-domestic-final-02-12042014.pdf.
and-Publications/Media-Releases/2014/
MAS-to-give-Legislative-Effect-to-Financial- 70. For a discussion of the Federal Reserve’s EPS
Advisory-Industry-Review-Proposals.aspx. for foreign banking organizations, see Deloitte’s
report, Final look: A practical guide to the
60. Richard W. Holloway and Wen Yee Lee, Federal Reserve’s enhanced prudential standards
“Recommendations of the financial advi- for foreign banks, 2014, http://www2.deloitte.
sory industry review panel in Singapore,” com/content/dam/Deloitte/us/Documents/
Milliman, January 25, 2013, http://www. audit/us-aers-eps-foreign-02-12042014.pdf.
milliman.com/insight/Periodicals/asia-ealert/
Recommendations-of-the-Financial-Advisory- 71. Official Journal of the European Union,
Industry-Review-Panel-in-Singapore/#. “Directive 2013/36/EU of the Euro-
pean Parliament and of the Council,
61. Hong Kong Monetary Authority, “Treat Article 76,” June 26, 2013, http://eur-lex.
customers fairly charter launching ceremony,” europa.eu/LexUriServ/LexUriServ.do?u
press release, October 28, 2013, http://www. ri=OJ:L:2013:176:0338:0436:EN:PDF.
hkma.gov.hk/eng/key-information/
press-releases/2013/20131028-4.shtml. 72. Deloitte Center for Financial Services, Bank
board risk governance, Deloitte University
62. Emily Glazer and Christina Rexrode, “What Press, 2015, http://d2mtr37y39tpbu.cloudfront.
banks are doing to improve their culture,” net/wp-content/uploads/2015/02/DUP_1072_
Wall Street Journal, February 2, 2015, http:// Bank-Board-Risk-Governance_MASTER1.pdf.
blogs.wsj.com/moneybeat/2015/02/02/what-
banks-are-doing-to-improve-their-culture/. 73. The phrase “CRO or equivalent
position” is shorted to “CRO” in
63. Emily Glazer and Christina Rexrode, the remainder of the report.
“As regulators focus on culture, Wall
Street struggles to define it.” 74. Percentages total to more than 100
percent since respondents could make
64. Percentages total to more than 100 percent multiple selections. These percentages are
since some institutions provide more than based on respondents at institutions that
one type of service. In the report, institu- have a CRO or equivalent position.
tions that provide insurance services will
60
75. For a discussion of the evolution of the risk com/~/media/Files/NewsInsights/Publica-

appetite concept and its practical applications/2014/12/TLAC-An-Additional-Capital-
tion, see Deloitte’s Establishing risk appetite Requirement-for-G-SIBs-FIA-120814.pdf.
statements for stronger risk management, 85. Jack Ewing, “Basel banking chief expects
December 22, 2014, http://deloitte.wsj.com/ fine-tuning of risk rules,” New York Times,
riskandcompliance/2014/12/22/establishing- December 5, 2014, http://dealbook.nytimes.
risk-appetite-statements-for-stronger- com/2014/12/05/basel-banking-chief-expects-
risk-management/ and Risk appetite in the fine-tuning-of-risk-rules/; Reuters, “Basel
financial services industry: A requisite for risk watchdog wants standardized assessment of
management today, 2014, http://www2.deloitte. banks’ capital,” December 22, 2014, http://
com/content/dam/Deloitte/ie/Documents/ www.reuters.com/article/2014/12/22/us-banks-
FinancialServices/investmentmanagement/ regulations-idUSKBN0K017O20141222.
us_aers_grrs_riskappetite_03102014.pdf.
86. Huw Jones, “Basel watchdog flags
76. The Senior Supervisors Group (SSG) is shake-up of bank capital calculations,”
composed of the staff of supervisory agencies Reuters, November 12, 2014, http://
from ten countries and the European Union: www.reuters.com/article/2014/11/12/
the Canadian Office of the Superintendent basel-banks-idUSL6N0T23FL20141112.
of Financial Institutions, the European
Central Bank Banking Supervision, the French 87. Victoria McGrane and Ryan Tracy, “Fed to
Prudential Control and Resolution Authority, hit biggest US banks with tougher capital
the German Federal Financial Supervisory surcharge,” Wall Street Journal, September
Authority, the Bank of Italy, the Japanese Fi- 9, 2014, http://www.wsj.com/articles/
nancial Services Agency, the Netherlands Bank, feds-tarullo-says-fed-board-will-unveil-
the Bank of Spain, the Swiss Financial Market systemically-important-financial-institution-
Supervisory Authority, the United Kingdom’s surcharge-rule-soon-1410211114.
Prudential Regulatory Authority, and, in the 88. Swiss Finance Institute, The extra cost of Swiss
United States, the Office of the Comptroller banking regulation, February 2014, http://
of the Currency, the Securities and Exchange www.swissfinanceinstitute.ch/the_extra_cost_
Commission, and the Federal Reserve. cost_of__swiss_banking_regulation.pdf.
77. Senior Supervisors Group, Risk manage- 89. Bloomberg Brief, “Financial regula-
ment lessons from the banking crisis of tion: Asia-Pacific region special,” July
2008, October 21, 2009, https://www.sec. 31, 2014, http://www.bloombergbriefs.
gov/news/press/2009/report102109.pdf. com/content/uploads/sites/2/2014/08/
78. Senior Supervisors Group, Observations on PRINT-FinReg_Asia-Pacific.pdf.
developments in risk appetite frameworks 90. Among the survey participants, 48 percent
and IT infrastructure, December 23, 2010, are subject to Basel II/III regulatory capital
http://www.newyorkfed.org/newsevents/ requirements, while an additional 7 percent
news/banking/2010/an101223.pdf. are not subject to these requirements but have
79. Financial Stability Board, Principles for an voluntarily adopted them. The survey results in
effective risk appetite framework, November this section on Basel II/III are based on respon-
2013, http://www.financialstabilityboard. dents at institutions that are subject to Basel
org/wp-content/uploads/r_131118.pdf. II/III requirements or have adopted them.
80. The survey results in this section are based 91. Bank for International Settlements, “Basel
on respondents at institutions that use the III: The liquidity coverage ratio and liquidity
three lines of defense risk governance model. risk monitoring tools,” January 2013, http://
www.bis.org/publ/bcbs238.htm; Bank for
81. Neil Roland, “Banks excelling at risk- International Settlements, “Annex 1: Summary
governance but hindered by skill gaps, OCC description of the LCR,” January 6, 2013,
official says,” FS Core, March 23, 2015. http://www.bis.org/press/p130106a.pdf.
82. Joe Rennison, “Stress, tested,” Risk 92. Bank for International Settlements, “Basel III:
Magazine, August 2014. The net stable funding ratio,” October 2014,
83. The survey results in this section are based on http://www.bis.org/bcbs/publ/d295.htm.
respondents at institutions using stress testing. 93. Ibid.
84. Shearman & Sterling LLP, “TLAC: An ad- 94. The full form of the US Liquidity Coverage
ditional capital requirement for G-SIBs,” Rule will apply to all Basel III advanced
December 8, 2014, http://www.shearman. approach banks (that is, depository institution
61
holding companies with $250 billion or more 106. Office of the Comptroller of the Currency,
in total assets or $10 billion or more in foreign “Asset Management Comptroller’s Handbook:
exposure and any consolidated depositary Conflicts of interest,” January 2015, http://www.
institutions with assets of $10 billion or more). occ.gov/publications/publications-by-type/
95. Emily Stephenson and Douwe Mi- comptrollers-handbook/conflictofinterest.pdf.
edema, “U.S. regulators adopt tighter rules 107. European Securities and Markets Author-
for banks’ cash needs,” Reuters, September ity, Final Report: ESMA’s technical advice
3, 2014, http://www.reuters.com/ar- to the commission on MiFID II and MiFIR,
ticle/2014/09/03/us-financial-regulations- December 19, 2014, http://www.esma.
liquidity-idUSKBN0G1P620140903. europa.eu/system/files/2014-1569_final_re-
96. Ibid. port_-_esmas_technical_advice_to_the_com-
mission_on_mifid_ii_and_mifir.pdf.
97. Deloitte, Forward look: Top regulatory
trends for 2015 in banking, 2015. 108. Deloitte, MiFID II: Product governance
and unbundling dealing commission,
98. Seb Cohen and Francesco Nagari, Rethinking January 16, 2015, http://blogs.deloitte.co.uk/
the response: A strategic approach to regulatory financialservices/2015/01/mifid-ii.html.
uncertainty in European insurance, Deloitte
LLP, 2013, https://www2.deloitte.com/content/ 109. Financial Services Authority, Conflicts of
dam/Deloitte/uk/Documents/financial-servic- interest between asset managers and their
es/deloitte-uk-rethinking-the-response.pdf. customers, November 2012, http://www.fsa.gov.
uk/static/pubs/other/conflicts-of-interest.pdf.
99. Bloomberg Brief, “Financial regula-
tion: Asia-Pacific region special,” July 110. DavisPolk, “FinCEN’s proposed rule to
31, 2014, http://www.bloombergbriefs. enhance customer due diligence require-
com/content/uploads/sites/2/2014/08/ ments for financial institutions,” September
PRINT-FinReg_Asia-Pacific.pdf. 30, 2014, http://www.davispolk.com/
fincen%E2%80%99s-proposed-rule-enhance-
100. Daniel K.Tarullo, “Advancing macroprudential customer-due-diligence-requirements-finan-
policy objectives,” speech at the Office of cial-institutions-%E2%80%93-comments/.
Financial Research and Financial Stability
Oversight Council’s 4th Annual Conference 111. Securities and Exchange Commission,
on Evaluating macroprudential tools: “SEC charges AXS Rosenberg Entities for
Complementarities and conflicts, January concealing error in quantitative investment
30, 2015, http://www.federalreserve.gov/ model,” February 3, 2011, http://www.sec.
newsevents/speech/tarullo20150130a.htm. gov/news/press/2011/2011-37.htm.
101. May Jo White, “Chairman’s address at 112. Ponemon Institute LLC, 2013 cost of data
SEC Speaks 2014,” February 21, 2014, breach study: Global analysis, benchmark
http://www.sec.gov/News/Speech/Detail/ research sponsored by Symantec and inde-
Speech/1370540822127#.VPsR_-Eeo4s. pendently conducted by Ponemon Institute
LLC, May 2013. Analysis performed on 277
102. Securities and Exchange Commission, companies globally in 16 industry sectors after
“SEC adopts money market fund reform those companies experienced the loss or theft
rules,”July 23, 2014, http://www.sec. of protected personal data, https://www4.
gov/News/PressRelease/Detail/PressRe- symantec.com/mktginfo/whitepaper/053013_
lease/1370542347679#.VPtmheEeo4s. GL_NA_WP_Ponemon-2013-Cost-of-a-
103. Nicholas Elliott, “AIFMD complicates pursuit Data-Breach-Report_daiNA_cta72382.pdf.
of capital,” Wall Street Journal, July 23, 113. Federal Reserve, “Guidance on managing
2014, http://blogs.wsj.com/riskandcompli- outsourcing risk,” Division of Banking
ance/2014/07/23/the-morning-risk-report- Supervisions and Regulation, Division of
aifmd-complicates-pursuit-of-capital/. Consumer and Community Affairs, and
104. Financial Industry Regulatory Authority, Board of Governors of the Federal Reserve
“2015 regulatory and examination priorities System, December 5, 2013, http://www.
letter,” January 6, 2015, https://www.finra. federalreserve.gov/bankinforeg/srletters/
org/web/groups/industry/@ip/@reg/@guide/ sr1319a1.pdf; Office of the Comptroller of the
documents/industry/p602239.pdf. Currency, OCC Bulletin 2013-29, October 30,
2013, http://www.occ.gov/news-issuances/
105. Ibid.
bulletins/2013/bulletin-2013-29.html.
62
114. Securities and Exchange Commission, 120. Daniel Huang, Emily Glazer, and Danny Yad-
“Final rule: Compliance programs of ron, “Financial firms bolster cybersecurity bud-
investment companies and investment gets,” Wall Street Journal, November 17, 2014,
advisers,” February 5, 2004, http://www.sec. http://www.wsj.com/articles/financial-firms-
gov/rules/final/ia-2204.htm#P54_5275. bolster-cybersecurity-budgets-1416182536.
115. Office of Compliance Inspections and 121. Office of Compliance Inspections and
Examinations, “OCIE Cybersecurity Initia- Examinations, “Cybersecurity examination
tive,” Securities and Exchange Commission, sweep summary,” Securities and Exchange
April 15, 2014, http://www.sec.gov/ocie/ Commission, February 3, 2015, http://www.
announcement/Cybersecurity+Risk+Ale sec.gov/about/offices/ocie/cybersecurity-
rt++%2526+Appendix+-+4.15.14.pdf. examination-sweep-summary.pdf.
116. Financial Industry Regulatory Authority, 122. The National Law Review, “SEC and
“2015 regulatory and examination priorities FINRA issue results of cybersecurity
letter,” January 6, 2015, https://www.finra. examinations,” February 18, 2015, http://
org/web/groups/industry/@ip/@reg/@guide/ www.natlawreview.com/article/sec-and-finra-
documents/industry/p602239.pdf. issue-results-cybersecurity-examinations.
117. Committee of Sponsoring Organizations 123. Financial Industry Regulatory Authority,
of the Treadway Commission, Internal “2015 regulatory and examination priorities
Control—Integrated Framework, May letter,” January 6, 2015, https://www.finra.
2013, http://www.coso.org/ic.htm. org/web/groups/industry/@ip/@reg/@guide/
118. Vikram Bhat and Lincy Francis Therattil, documents/industry/p602239.pdf.
Transforming cybersecurity: New approaches 124. Deloitte, From principles to practicalities:
for an evolving threat landscape, Deloitte Addressing Basel risk data aggregation and
LLP, 2014, http://www2.deloitte.com/ reporting requirements, 2013, http://
us/en/pages/financial-services/articles/ www2.deloitte.com/us/en/pages/
dcfs-transforming-cybersecurity.html. regulatory/basel-risk-data-aggregation-and-
119. Mandiant, “Not your average cybercriminal: reporting-requirements.html?nc=1.
A look at the diverse threats to the financial 125. Rennison, “Stress, tested.”
services industry,” September 23, 2013, 126. Deloitte EMEA Centre for Regulatory Strategy,
as cited in Deloitte’s infographic “Trans- Top 10 for 2015: Our outlook for financial
forming cybersecurity: New approaches markets regulation, 2015, http://www2.deloitte.
for an evolving threat landscape.” com/global/en/pages/financial-services/
articles/regulatory-top-ten-for-2015.html.
63
Contacts
Global Financial Services Industry Leadership
Chris Harvey Cary Stier

Global managing director Global leader, Investment Management
Global Financial Services Industry Global Financial Services Industry
Deloitte Touche Tohmatsu Limited Deloitte Touche Tohmatsu Limited
+44 20 2007 1829 +1 203 708 4642
[email protected] [email protected]
Jim Reichbach Survey editor

Global leader, Banking & Securities
Edward T. Hida II, CFA
Global leader, Risk & Capital Management
+1 212 436 5730
[email protected]
+1 212 436 4854
[email protected]
Neal Baumann
Global leader, Insurance
+1 212 618 4105
[email protected]
64
Contributors
Australia Luxembourg
Kevin Nixon Marcos Lichtfous
Partner Partner
Deloitte Australia Deloitte Luxembourg
+61 2 9322 7555 +35 2 45145 4876
Canada New Zealand

Leon Bloom Richard Kirkland
Partner Partner
Deloitte Canada Deloitte New Zealand
+1 416 601 6244 +64 4 470 3711
France United Kingdom

Michel Guidoux Zeshan Choudhry
Senior manager Partner
Deloitte France Deloitte UK
+33 1 55 61 66 90 +44 20 7303 8572
Marc Van Caeneghem Clifford Smout

Partner Partner
Deloitte France Deloitte UK
+33 1 55 61 65 88 +44 20 7303 6390
Germany David Strachan

Partner
Jöerg Engels
Deloitte UK
Partner
+44 20 7303 4791
Deloitte Germany
[email protected]
+49 211 8772 2376
[email protected]
Steven Swain
Partner
Japan Deloitte UK
Tsuyoshi Oyama +44 20 7007 4255
Partner [email protected]
Deloitte Japan
+819098344302
[email protected]
65
Vishal Vedi Simon Fisher

Partner Partner
Deloitte UK Deloitte US (Deloitte & Touche LLP)
+44 20 7303 6737 +1 212 436 5907
Irena Gecas-McCarthy
United States Principal
Deloitte US (Deloitte & Touche LLP)
Lakshmanan Balachander
+1 212 436 5316
Principal
[email protected]
+1 212 436 5340
Richard Godfrey
[email protected]
Principal
A. Scott Baret
+1.973.602.6270
Partner
[email protected]
+1 212 436 5456
Derek Hodgdon
[email protected]
Senior manager
Alexandre Brady
+1.617.437.2210
Principal
[email protected]
+1 415 783 5413
Olga Kasparova
[email protected]
Director
Craig Brown
+1 617 437 2812
Director
[email protected]
Deloitte US(Deloitte & Touche LLP)
+1.212.436.3356
Dilip Krishna, CFA
[email protected]
Director
Michele Crish
+1 212 436 7939
Director
[email protected]
+1 212 436 2053
Robert Maxant
[email protected]
Partner
Robert Dicks
+1 212 436 7046
Principal
[email protected]
Deloitte US (Deloitte Consulting LLP)
+1 973 602 6160
[email protected]
Michael Fay
Principal
+1 617 437 3697
[email protected]
66
Contacts
Risk & Capital Management
Argentina Belgium
Claudio E. Fiorillo Arno De Groote
Partner Partner
Deloitte Argentina Deloitte Belgium
+54 11 4320 2700, Ext. 8138 +32 2 800 24 73
Raul Antonio Malvestiti Yves Dehogne

Director Partner
Deloitte Argentina Deloitte Belgium
+54 11 43202700 + 32 2 800 20 45
Gustavo Fabian Serenelli Brazil

Director
Anselmo Bonservizzi
Deloitte Argentina
Partner
+54 11 43202700
Deloitte Brazil
[email protected]
+55 11 5186 6033
[email protected]
Australia
Timothy Oldham Luiz Fernando Ferreira Dias
Partner Partner
Deloitte Australia Deloitte Brazil
+61 293 225 694 +55 11 5186 6247
Austria Rodrigo Mendes Duarte

Partner
Kurt Blecha
Deloitte Brazil
Partner
+55 11 5186 6206
Deloitte Austria
[email protected]
+43 1 537 00 5800
[email protected]
Marcello de Francesco
Partner
Dominik Damm
Deloitte Brazil
Partner
+55 11 5186 6871
Deloitte Austria
[email protected]
+43 1 537 00 5400
[email protected]
67
Gustavo Amaral de Lucena Cyprus

Partner Alexis Agathocleous
Deloitte Brazil Partner
+55 11 5186 6438 Deloitte Cyprus
[email protected] +35 72 5868710
[email protected]
Elias Zoghibi
Partner Panicos Papamichael
Deloitte Brazil Partner
+55 11 5186 6469 Deloitte Cyprus
[email protected]
Canada
Leon Bloom Finland
Partner Lasse Ingstrom
Deloitte Canada Partner
+1 416 601 6244 Deloitte Finland
[email protected]
Chile
Christian Duran France
Partner Marc Van Caeneghem
Deloitte Chile Partner
+56 02 2729 8276 Deloitte France
[email protected] +33 1 55 61 65 88
[email protected]
Fernando Gaziano
Partner
Germany
Deloitte Chile
+56 02 729 8281 Jöerg Engels
[email protected] Partner
Deloitte Germany
China + 49 211 8772 2376
[email protected]
Alvin Ng
Partner Michael Cluse
Deloitte China Director
+86 10 85207333 Deloitte Germany
[email protected] +49 211 8772 2464
[email protected]
Columbia
Elsa Mena Greece
Partner Alexandra Kostara
Deloitte Columbia Partner
+57 1 426 2060 Deloitte Greece
[email protected]
68
Maria Smirniotaki Italy

Partner Stefano Appetiti
Deloitte Greece Partner
+30 210 678 1100 Deloitte Italy
[email protected]
Iceland
Arni Jon Arnason Antonio Arfè
Partner Partner
Deloitte Iceland Deloitte Italy
+354 580 3035 +39 02 83323020
India Pierluigi Brienza

Partner
Abhay Gupte Deloitte Italy
Senior director +39 06 47805412
Deloitte India [email protected]
+91 22 6681 0600
[email protected] Paolo Gianturco
Partner
Indonesia Deloitte Italy
Brian Johannes Indradjaja +39 02 83323131
Technical advisor [email protected]
Deloitte Indonesia
+62 21 2992 3100; Ext. 33590 Lorenzo Manganini
Deloitte Italy
Ireland +39 02 83323265
[email protected]
John McCarroll
Partner Luigi Mastrangelo
Deloitte Ireland Partner
+35 31417 2533 Deloitte Italy
[email protected]
Colm McDonnell
Partner
Japan
Deloitte Ireland
+35 31417 2348 Tsuyoshi Oyama
Deloitte Japan
Martin Reilly +81 90 9834 4302
Deloitte Ireland
+35 31417 2212 Kenya
[email protected] Julie Akinyi Nyangaya
Partner
Deloitte Kenya
+254 20 4230234
[email protected]
69
Luxembourg The Netherlands

Laurent Berliner Ton Berendsen
Partner Partner
Deloitte Luxembourg Deloitte The Netherlands
+352 45145 2328 +31 882884740
Martin Flaunet Twan Kilkens

Partner Partner
+35 2 451 452 334 +31 882885219
Marco Lichtfous Eelco Schnezler

Partner Director
+35 2 45145 4876 +31882885220
Jean Philippe Peters New Zealand

Partner
Richard Kirkland
Deloitte Luxembourg
Director
+35 2 45145 2276
Deloitte New Zealand
[email protected]
+64 4 470 3711
[email protected]
Xavier Zaegel
Partner
Deloitte Luxembourg Nigeria
+35 2 45145 2748 Joseph Olofinsola
Deloitte Nigeria
Malaysia +234 19041733
[email protected]
Fazlin Hanoum Ilhan
Director
Deloitte Malaysia Philippines
+60 3 7723 6575 Diane Yap
Deloitte Philippines
Mexico +63 2 581 9000
[email protected]
Carlos Perez
Partner
Deloitte México Poland
+52 55 50806444 Ext. 6444 Adam Kolaczyk
Deloitte Poland
+48 22 5110858
[email protected]
70
Zbigniew Szczerbetka South Africa

Partner Wayne Savage
Deloitte Poland Partner
+48 22 5110799 Deloitte South Africa
[email protected]
Dariusz Szkaradek
Partner Catherine Stretton
Deloitte Poland Director
+48 (22) 5110331 Deloitte South Africa
[email protected]
Portugal
Joao Gomes Ferreira South Korea
Partner Seung Woo Lee
Deloitte Portugal Partner
+351 210427601, ext. 5101 Deloitte South Korea
[email protected]
Vitor Viana Lopes
Partner
Spain
Deloitte Portugal
+351 210422553, ext. 4053 Rafael Campo Bernad
Deloitte Spain
Goncalo Nogueira Simoes +4 915 145000, Ext. 1488
Deloitte Portugal
+351 210422551, ext. 4051 Taiwan
[email protected] Thomas Wan
Partner
Singapore Deloitte Taiwan
Hansel Quek +886 2 25459988, ext. 6869
Director [email protected]
Deloitte Singapore
Risk Services Thailand
+65 6800 2745 Somkrit Krishnamra
Deloitte Thailand
Tse Gan Thio +66 2676 5700; Ext. 11522
Executive director [email protected]
Deloitte Singapore
Risk Services
Turkey
+65 6216 3158
[email protected] Tuba Inci
Partner
Deloitte Turkey
+90 212 366 60 47
[email protected]
71
Hasan Kilic Vishal Vedi

Partner Partner
Deloitte Turkey Deloitte UK
+90 212 366 60 65 +44 20 7303 6737
United Arab Emirates United States

Aejaz Ahmed A. Scott Baret
Partner Partner
Deloitte United Arab Emirates Deloitte US (Deloitte & Touche LLP)
+966 1 282 8400 +1 212 436 5456
Edward Hida II, CFA
Fadi Sidani Partner
Partner Deloitte US (Deloitte & Touche LLP)
Deloitte United Arab Emirates +1 212 436 4854
+971 4 376 8888 [email protected]
[email protected]
Robert Maxant
United Kingdom Partner
Zeshan Choudhry
+1 212 436 7046
Partner
[email protected]
Deloitte UK
+44 20 7303 8572
Alok Sinha
[email protected]
Principal
Hubert Justal
+ 1 415 783 5203
Director
[email protected]
Deloitte UK
+44 20 7007 0484
[email protected] Vietnam
Nam Hoang
Steve Swain Partner
Partner Deloitte Vietnam
Deloitte UK +84 4 6288 3568
+44 20 7007 4255 [email protected]
[email protected]
72
Follow @DU_Press
Sign up for Deloitte University Press updates at DUPress.com.
About Deloitte University Press

Deloitte University Press publishes original articles, reports and periodicals that provide insights for businesses, the public sector and
NGOs. Our goal is to draw upon research and experience from throughout our professional services organization, and that of coauthors in
academia and business, to advance the conversation on a broad spectrum of topics of interest to executives and government leaders.
Deloitte University Press is an imprint of Deloitte Development LLC.
About Deloitte
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network
of member firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also
referred to as “Deloitte Global”) does not provide services to clients. Please see www.deloitte.com/about for a detailed description of the
legal structure of Deloitte Touche Tohmatsu Limited and its member firms.
Deloitte provides audit, tax, consulting, and financial advisory services to public and private clients spanning multiple industries. With a
globally connected network of member firms in more than 150 countries, Deloitte brings world-class capabilities and high-quality service
to clients, delivering the insights they need to address their most complex business challenges. Deloitte has in the region of 210,000
professionals, all committed to becoming the standard of excellence.
This publication contains general information only, and none of Deloitte Touche Tohmatsu Limited, its member firms, or their related
entities (collectively, the “Deloitte network”) is, by means of this publication, rendering professional advice or services. No entity in the
Deloitte network shall be responsible for any loss whatsoever sustained by any person who relies on this publication.
© 2015. For information, contact Deloitte Touche Tohmatsu Limited.

Global Risk Management

Uploaded by

Copyright:

Available Formats

Global Risk Management

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Global Risk Management

Uploaded by

Copyright:

Available Formats

Global risk management

survey, ninth edition

About the editor

Andrew Brooks Stuart Shroff

Michelle Dahl Jeanne-marie Smith

About Deloitte’s financial services industry practice

Introduction: Economic and business environment | 6

Enterprise risk management | 22

Sector spotlight: Banking | 31

Sector spotlight: Insurance | 35

Sector spotlight: Investment management | 39

Management of key risks | 46

Asset liability management | 49

Regulatory risk | 51

Risk management information systems and technology | 53

Dear colleague, practice. In the area of capital adequacy, almost

W E are pleased to present the ninth edi-

T HE global financial crisis was the catalyst

Introduction: Economic and

D ELOITTE’S Global risk management

Continuing regulatory reform In 2014, the US Federal Reserve announced

great promise as a capital tool, a risk-sensitive

ABOUT THE SURVEY

Note: Percentages total more than 100% since

Graphic: Deloitte University Press | DUPress.com

Analysis by asset size

• Small institutions—institutions with total assets of less than US$10 billion

• Large institutions—institutions with total assets of US$100 billion or more

Role of the board of directors “With regard to changes

Approve the enterprise-level statement 89%

Review regular risk management reports on the 86%

Review and approve overall risk management 84%

Review and approve the organization’s formal 83%

Review corporate strategy for alignment with the risk 80%

Monitor risk appetite utilization including

Monitor new and emerging risks 71%

Review individual risk management policies, e.g., for 69%

Review incentive compensation plans to 63%

Conduct executive sessions with the 61%

Help establish and embed the risk culture of the 60%

Review management’s steps to remediate any

Define risk management reporting lines 41%

Review the charters of management-level 37%

Figure 5. Does your organization currently have a CRO or equivalent?

an organization. Our risk events such as market, credit, or operational

Defining risk appetite for strategic risk 55%

Defining risk appetite for reputational risk 55%

Defining risk appetite for operational risk 38%

Allocating the risk appetite among different 37%

Translating the risk appetite for individual risk types into

Integrating stress testing results when defining

Gaining the active participation of business units in

Complying with regulatory expectations regarding

Graphic: Deloitte University Press | DUPress.com

Enterprise risk management

A N ERM program is designed to provide

Figure 7. Does your organization have an ERM program or equivalent?

2008 2010 2012 2014

Graphic: Deloitte University Press | DUPress.com

Increasing regulatory requirements and 79%