Kevin Stiroh: Opening remarks at the GARP Global Risk Forum

Remarks by Mr Kevin Stiroh, Executive Vice President of the Financial Institution Supervision Group of the Federal Reserve Bank of New York, at the Federal Reserve Bank of New York / GARP Global Risk Forum, New York City, 2 November 2016.

The views expressed in this speech are those of the speaker and not the view of the BIS.

Good Morning. I'm Kevin Stiroh, the head of the Supervision Group at the Federal Reserve Bank of New York. I'd like to extend a warm welcome from the Federal Reserve Bank of New York, which is co-hosting the Global Risk Forum with the Global Association of Risk Professionals. I'd like to thank the many organizers of this meeting-as you can imagine, considerable time and resources went into planning this conference and that is what makes it so valuable for the participants and the risk management profession.

First, let me state that my comments today are my own and do not necessarily represent those of the Federal Reserve Bank of New York or the Federal Reserve System.

Looking Back at the Global Risk Forum

When I was asked to speak at today's session, I realized that it's been five years since I served on the planning committee that developed the Global Risk Forum program in 2011. I wondered how our risk priorities and risk management issues have evolved over those five years as the world has changed around us.

Over the period since 2011, we've witnessed a number of fundamental changes in the banking sector:

• The regulatory and supervisory framework has substantially raised requirements and expectations around capital, liquidity and risk management including, for example, more rigorous stress testing and capital surcharges for systemically important firms;
• The macro/finance environment of sluggish growth and low rates is putting pressure on bank business models. We are now in the eighth year of interest rates near zero in the U.S., which has hurt bank profits and affected risk-taking and business model choices.
• Ongoing technological innovations have altered both the opportunities and the threats facing financial institutions. Marketplace lending, distributed ledger, and robo-advisers promise great opportunity, while cyber threats, data privacy issues, and IT-related vendor management issues are legitimate concerns.

With that idea in mind, I thought it would be useful to look at the last five years of this Forum's program in order to identify key themes and common topics. I'd like to discuss three specific issues: systemic risk, governance, and regulatory reform.

First, systemic risk has been a central topic of discussion at each Global Risk Forum over the past five years. Given the acute trauma of the financial crisis and its systemic nature, that is not surprising. I did find it interesting to see how the discussions of systemic risk have shifted over these five years. Initially, the discussions were primarily focused on defining systemic risk, including the underlying shocks and propagation channels. During these initial conversations, the concept of macroprudential supervision was introduced as a means of mitigating systemic risk, but the discussion largely centered on defining what macroprudential supervision might entail, and how it differs from more traditional microprudential supervision. More recently, the systemic risk discussions have become increasingly technical and practical in nature-focusing on the details of the resolution regime, monitoring shadow banking and considering implications of shifting activity, and on actual approaches for conducting macroprudential supervision.

Second, governance has been a frequent topic. Again, this is understandable given its central importance for private sector risk management and the official sector reform agenda. It is interesting that the assortment of discussion topics under the governance agenda item has been remarkably stable over the years. The agendas examined the appropriate roles of the board of directors and senior managers, the degree to which the official sector should prescribe risk management practices and principles, and the need to tailor such expectations depending on an institution's business models and risk profiles. We should also think beyond the traditional governance topics to determine if other key risk types should be covered within these frameworks. I'll return to this latter point.

The third theme is the changing nature of the discussions around regulatory reform. In 2011 and 2012, much of the agenda focused on the "what" and the "how" of the reform package-what should be included in the reforms and how would these mechanisms work in practice. Discussion questions were geared toward concerns about the feasibility of these new policies and regulations, and the need for global coordination and cooperation. In recent years, as you know, the global regulatory community has made significant progress on finalizing the post-crisis reforms and the conversation has naturally shifted to the impact of these regulatory reforms; for example, a desire for consistency across firms, business models and jurisdictions and an assessment of factors driving changes in market liquidity.

In raising these three frequently discussed topics - systemic risk, governance, and regulatory reform-I also wonder what topics have emerged that we are not discussing, but perhaps should be. Since the financial crisis, I think we are all more aware of the importance of actively looking for our blind spots. Gillian Tett, writer for the Financial Times and author of The Silo Effect recently visited the NY Fed, and reminded us to look broadly. In her case, when trying to understand social dynamics, it is important to look not just in the middle of the dance floor, but also at the "non-dancers" outside of the spotlight. In our case, it is what other factors might create either idiosyncratic or systemic distress.

So, with that perspective in mind, I noticed two surprising omissions from prior Global Risk Forum agendas. The first is cybersecurity. Over this time period, there has been an increasing awareness among risk professionals about the constant and present danger that cyber-threats pose to the financial sector. Cyber-threats are a vital concern for the supervisors responsible for the safety and soundness of the financial system and for individual risk managers. In the U.S., the Department of Treasury, our intelligence agencies, financial regulators and supervisors, and risk professionals across the financial sector are working to defend against cyber-attacks and to minimize the potential disruption resulting from a successful attack. U.S. authorities are working to finalize objectives-based supervisory expectations for risk management around cyber threats. I'm encouraged that this year's Forum includes an expert panel on "Technology Risks" that will explore the cyber-threat landscape and approaches to mitigate the associated risks.

A second noteworthy omission relates to a specific component of governance. While some governance topics have been remarkably stable, in my view, risks associated with business misconduct at financial institutions have not received adequate attention in these Forums. Through initiatives like the annual conference on "Reforming Culture in the Financial Services Industry," the New York Fed has been challenging the financial industry to consider the many factors that have contributed to recent, widespread instances of misconduct.

In concert with the industry, I believe that supervisors can help the industry improve governance, culture and behavioral outcomes through supporting the development of effective internal governance regimes, prudent risk management policies, incentives, and strong compliance and control structures, all within a framework of effective oversight from the board of directors. In today's Forum and in the future, I welcome other participants' thoughts on approaches for developing, measuring, and maintaining a strong, ethical culture within the industry.

Conclusion 

As risk professionals, it's important to be forward-looking and to continually ask ourselves: are all risks being captured, measured, and monitored? What is missing? Are we focused on the right areas?

So, here is another question: When we look back at this conference five years from now, what will we view as a major blind spot? I expect there will be issues that we will be surprised we missed, and part of the purpose of discussions like this is to lower the likelihood and impact of those inevitable blind spots.

Thanks for your attention, and I'm looking forward to hearing the discussion throughout the day.