Shaky financial times leave only the most stable business models standing. Mark Phillips spoke to Protiviti top guns about damaged corporate reputations, regulatory pressures and the role of internal audit going forward.

The current financial crisis is a good example of what can happen when the inherent risks associated with aggressive, growth-oriented market strategies are discounted, ignored or never even considered.

Industry losses from sub-prime mortgages are expected to reach as much as $US400 billion ($620 billion), with at least one in four of the risky home loans going into default. The root causes are many – breakdowns in time-tested underwriting standards, failures to provide or obtain adequate disclosures, excess reliance on flawed rating agency assessments of structured products, to name a few.

But not every financial institution played the sub- prime game recklessly. Some firms identified the sources of significant risk as early as 2006 and had as much as a year to evaluate the magnitude of the risk and implement cost-effective plans to reduce their exposure.

Sceptical of rating agency assessments, others devel oped their own in-house expertise to assess credit qual ity. Some even tested their assessments by selling a small percentage of assets to obtain reliable pricing data points. These and other actions resulted in a sig nificant redirection of market focus and gave the firms a seat in the ring when the proverbial music stopped, leaving their unfortunate competitors standing for all to see and scrutinise.

The firms that succeeded in minimising their losses protected enterprise value by engaging in sub-prime lending with an appropriate assessment of the under lying risk and took action to reduce their exposure when it was practical to do so. Not surprisingly, some financial institutions did not engage in sub-prime lending at all – their underwriting standards did not permit the practice.

Reputational risk

The bottom line is that firms that instigated steps to protect their balance sheets or honoured the pru dent constraints imposed by their longstanding internal practices and processes have placed them selves in a strong competitive position relative to their weakened peers. Those firms that placed enormous bets on the sub-prime market have destroyed enterprise value that took them years to build. It will almost certainly take years for them to recover, rebuild the lost value and restore lustre to their tarnished reputations.

Of course, the finance sector is not alone in the dangers it faces with regards to reputational risk, but in the context of today’s financial turmoil, it is worth noting that a PwC study conducted as far back as 2004 pointed to a gap between the pro cesses designed to keep financial services organi sations in line with their regulatory obligations and the policies that are needed to protect and add value to the business.

“Financial services organisations that fail to recog nise and close the gap between the box-ticking approach to compliance and the totality of risks they run are extremely vulnerable to reputational risk,” the PricewaterhouseCoopers study stated. It found that less than a fifth of respondents considered awareness of compliance-related risk to be high across all parts of the business. Fewer than a quarter were very confident that their organisation was in full com pliance with regulatory requirements and internal codes and policies.

“Reputational risk is priceless,” says US-based Joseph Tarantino, president and CEO of Protiviti, a global consulting and internal audit firm specialising in risk and advisory services. “When a business deals with the public and is reliant on public and investor confidence, it is hard to put a value on it. However, in any risk assessment of an organisation that relies on public confidence, reputational risk is always one of the top five risks faced.

“What it comes down to is senior management putting in place effective control and risk manage ment structures to provide them with a level of com fort that the company’s reputation is being protected at every step of the way – from both operating and internal oversight standpoints.

“Management needs input that the corporate direc tives, policies and direction that have been laid out are effectively operating in the way intended.

“As there are frequently also environmental risks to reputation that may not be in their control, it is incum bent on them to be informed and then nimble in being able to respond rather than to react to such matters.”

Transparency

In Australia, the recent example of ANZ bank around the Opes Prime securities lending has been charac terised as one where perhaps even board members were not aware of the full extent of the business activities conducted within the organisation.

“With regards to reputational risk,” says Protiviti Australia managing director Gary Anderson, “while regulations have not required companies to publicly disclose what their risks are and what they are doing about them, the issues around ANZ will have height ened directors’ awareness that they absolutely need transparency on what business activities and trans actions the organisation is really entering into.

“This is where internal audit and risk manage ment are some of the most powerful tools,” Ander son says. “The more experienced directors of larger companies, in particular, are very diligently digging into what is happening in their organisations and putting management under a lot of pressure through independent reviews.

“There are, perhaps, a lot of small- and mid-sized companies where that level of rigour has not been applied in the past, but I think all directors will be demanding a lot more transparency going forward.

Scenario modelling

“Most companies have also traditionally done a fair amount of modelling of scenarios as part of their strategic planning or risk assessment process. They have built models where they forecast exchange rates, labour rates, inflation, equity prices and so on,” says Anderson.

“Now, in extreme economic conditions, the underlying integrity of those models is being tested. I know of a number of companies that are placing a greater emphasis on those models being indepen dently assessed – to determine how robust they are in terms of their underlying assumptions and if they have pushed scenarios to an extreme that perhaps people did not think was possible. Clearly, as the financial crisis demonstrates, these scenarios do have to be played out.”

Increased regulation

In wake of the seriousness of global economic con ditions, it was perhaps inevitable that a call for greater regulation of the financial markets would be made. As noted on page 8 of this issue of Risk Man agement, members of governance body Chartered Secretaries Australia are calling for increased debate on the international regulation of global financial markets. But is such a move appropriate, or are we in danger of creating an even more onerous version of Sarbanes-Oxley – possibly for little positive effect?

“There is a sentiment in the market for more regu lation and more consistent regulation around financial markets companies,” Tarantino acknowledges.

“Clearly the banking sector is heavily regulated, and so is insurance, although that is more decen tralised. The regulation authorities in the States have been with the states, as opposed to the Federal Gov ernment, and, as such, some would suggest that reg ulation of the insurance sector is not as strong as with the banking industry.

“Certain other segments of financial services, such as the investment banking industry, are not as regulated, and as a result of recent events the two remaining investment banks, Morgan Stanley and Goldman Sacs, have become banks. There is also the hedge fund industry, which is not regulated, and holds billions of billions of dollars in assets and, to a large extent, finance companies like GMAC (the finance arm of US car giant General Motors) are also not regulated.

“It is premature to draw any analogy between what may happen to SOX, as we just do not know what is going to evolve. But a desire to have more oversight and more consistent oversight over enti ties performing comparable activities is probably a reasonable expectation.”

Internal controls

He rejects any suggestion that growing regulatory pressures have the potential to stretch corporate resources to the point where they actually engender a box-ticking approach to compliance, pointing out that more regulation has forced organisations to implement new procedures and controls.

“As a result of Sarbanes-Oxley and clearly com ing out of this financial crisis, the internal audit function will take on a heightened role. Not in any tick-the-box context, but as a key component of cor porate governance structure and internal controls,” Tarantino says.

“In any organisation where there are strong entity- level controls there would also be a view of the inter nal audit function being an advisor to senior management as opposed to a tick-the-box function. Sound corporate governance practices demand a strong internal audit function – one with a level of indepen dence and objectivity and that provides consultative advice and oversight to senior management.”

Financial bailout

It has been noted by many industry observers (and politicians and angry taxpayers) that one of the ironies of the current financial situation is that it has – arguably of necessity – created a political para dox. After all, is it not something of a contradiction for governments to bail out at taxpayer’s expense – and in some cases actually guarantee – financial institutions in a capitalist/free market environment?

“Some would view it as an inherent conflict within that context”, Tarantino concedes, “but what has transpired is more a reaction towards restoring investor confidence and governments taking action they feel is appropriate in order to stabilise the mar ket. It is not something, I think, that they would assert would last forever, but one aimed at allowing businesses and financial institutions to interact and do business with each other.

“From the US standpoint, there is also significant change in the way the crisis is being handled from when (in 1989) the Resolution Trust Corporation was estab lished (as a consequence of the savings and loan crisis of the 1980s). In this case the Government is effectively following the European model by investing capital into these entities to allow them to continue to operate and manage their assets. The feeling is that this will help to preserve more value within the asset pools such that taxpayers may not have to bear a disproportionate amount of the cost of the whole bailout.”