In leaving no stone unturned in an attempt to find a solution, regulators might well inadvertently be stood on the stone that is hiding, at least partly, some of the real causes of the credit crunch – the governance of controls infrastructures and risk management inside financial institutions.
Clearly, a solution has to be found to the over-indulgences of financial markets, particularly to ensure financial stability. This time around, the problems have been driven by subprime and structured products such as collateralised debt obligations. But history tells us that this is not the first – or, likely, the last – time that financial markets will seize up.
Regulation not a cure
Another avalanche of regulation – like the one that followed the end of the dot-com boom – is unlikely in itself to cure the ills of financial instability.
Deloitte research shows that the costs to major financial institutions of implementing the new rules, from Sarbanes-Oxley and Basel II to IFRS, have ballooned by more than 30% in the past three years. Even before the crunch, we estimate the top 100 financial institutions will spend in total an estimated $100bn by 2010.
All this new regulation – and the money spent to comply with it – seems not to have done enough to prevent the malfunctioning of financial markets. Some credit markets are still sclerotic a year after the drying-up of summer 2007.
So why did it happen and what can be done to cure these ills without killing the patient? A recent survey by Deloitte might yield some clues.
One of the principal causes of the credit crunch lies inside financial institutions. Regulation and compliance can only be fully effective if institutions connect their risk management and controls with the governance of the two into a ‘holy trinity’ to prevent excessive risks being accumulated or to identify such accumulation early enough for remedial action to be taken.
Financial institutions are still trying to find the correct balance between risk and reward, but this lack of triangulation between control, risk and governance is, in most cases, a missing link that badly needs joining up.
True, such control and risk management systems tend to set few hearts racing until it is often too late, yet they are increasingly determining the winners and the losers across the global financial services industry. Identifying good practices is often a challenge because the specifics are often lost in a fog of different governance models in various countries. In addition, the emergence of huge and complex conglomerates has given rise in some cases to exponential growth in management complexity.
Our analysis of governance and controls systems shows that upwards of three-quarters of major financial institutions do not have integrated and fully operational systems.
Fragmentation
Further, analysis reveals a worrying fragmentation of responsibility for integrating governance and control functions. The audit committee or board have overall responsibility for governance and compliance systems in less than half of major financial institutions surveyed.
While governance and control systems are clearly still a work in progress, they need to be put right at the top of the corporate agenda since they are likely to play a central role in the individual success or failure of senior executives.
Even financial institutions applying current best practices have a significant way to go before they achieve the optimum return on governance and control investments.
To achieve this, they need to build stronger risk cultures throughout the organisation. Those organisations that get it right are likely to be rewarded with a significant future dividend.
