Outsourcing risk and Madoff

One of the key issues of the financial crisis was banks not knowing the value of their assets. This lack of insight has numerous reasons, but to me the main ones are: too much focus on short term profit, not being able to understand your own financial products anymore and inadequate control over your back-end business partners. In this post I want to put some of my thoughts on this last topic: the importance of monitoring the ‘health’ of the other financial institutions the bank does business with. Banks got hit by Madoff and Leman Brothers because they did not appreciate the risk they ‘imported’ by extending their value chain beyond their own borders.

This issue was broad to my attention again in n a recent interview of Z24 (Dutch internet news channel) with the Chief Risk Officer of Fortis Bank Netherlands (3 billion revenue 2008, 184 billion in assets. In this interview the risk management practises of the bank were discussed and the CRO stated that the board is closely involved with all new product introductions, and determines how new products fit into the risk profile of the bank.

If so much attention goes into risk analysis, even at board level, how can it be that Madoff and Lehman Brothers were not detected earlier? As said in the beginning of this post play a lack of insight in de risk profile of the whole value chain and an underestimation of the ‘risk dynamics’ an important role. And looking at the value chain also means outsourcing as the times are long gone that banks ‘produced’ all their financial products and services themselves.

The term ‘outsourcing’ is however typically used for situations were internal employees and assets are transferred/sold to an external party. This means that outsourcing is not the perfect term in this situation, but looking from a risk management perspective is it not that relevant whether your relationship with the business partner is based on acquiring, purchasing or outsourcing. In all cases does the bank ‘import’ risk by dealing with an external vendor.

The point I want to make is that banks pay a fair amount of attention to new product introductions and selecting a new business partner to outsource internal activities to or buy services & products from. This means that most banks will have done some kind of due diligence before signing contracts with Madoff and Lehman Brothers. What many banks failed to do is to monitor these partners adequately and adjust their risk profile and control strategy accordingly (and in case of Madoff do a proper due diligence at all as it was a Ponzi scheme from the start). Financial institutions have been outsourcing various back office activities and buying complex products and services from others and lost in many cases the overview of the risks within their value chain.

Even though some financial institutions have business relationships with hundreds of partners is the control strategy of most banks still very much oriented towards the internal activities. This despite that in some cases more risk is ‘imported’ than produced by the financial institution itself. This immaturity is reflected in the control strategy for external partners. Most organisations do not get much further than a ‘right to audit’ and (miss-)using SAS70 statements to get some insight in the control maturity of its partners (more on SAS70 here and here). To make matters worse are the education curriculum’s for risk managers and auditors also paying inadequate attention to the ‘financial supply chain’. Risk and audit managers learn how to control the internal organisation and learning how to exercise control over external partners is dealt with in maybe 10-15% of the course time.

I expect this to change soon however as financial institutions and their clients are not waiting for a Madoff 2.0.