Bank of America Executive Explains the Frontlines of Enterprise Risk Management
"Bank of America wants to be the most admired company in the world and one key to getting there is excellence in risk management," Dan Wheeler of Bank of America told Fletcher School students and faculty in a speech on "Managing Enterprise Risk in a Global Financial Marketplace" last week. Wheeler, who serves as Country Risk Executive in the bank’s Enterprise Credit and Market Risk department, came to Fletcher on November 7 as part of the International Business Program’s Global Speakers Series.
He explained that risk management means understanding and controlling risks, not eliminating them entirely and that risk is always taken in context with reward. "It is unacceptable to say no to a risk without looking at the reward." Nor is risk management confined to a specific department – "All individuals at all levels within the company are responsible for managing risk," he said.
Wheeler explained how Bank of America’s risk management strategy is shaped by its position in the financial services sector, how the company integrates risk management into its businesses and operations, and how it controls country risk.
Following a run of extraordinary consolidation in the banking sector, Bank of America has become one of the world’s largest banks, and its size has become a central issue in its success and approach to risk management, Wheeler explained. "Size generates significant earnings and allows you to do a lot of things to serve customers and reward shareholders. But with size comes complexity, and with complexity comes risk," he said.
"Size is good from a diversity perspective - we make our earnings and take our risks in multiple businesses and places, reducing our exposure to any one risk," Wheeler explained. The flexibility inherent in the bank’s size also helps in risk management. He pointed out, "When you are the size we are, you can take the decision to walk away from a business that is not an acceptable risk. We are big enough not to be trapped by any single business."
Wheeler explained that risk management occurs through a combination of structure and process. The end result is that "All lines of business and their partners participate in and understand our risk governance practices," he said.
Bank of America’s risk management structure builds from a concept of three lines of defense. He explained, "We manage risk with three lines of defense with the first line of defense being the business unit. Behind this front line, support functions such as finance, risk, legal and personnel act as a second line of defense and with audit providing the third and final line of defense.
Within this structure, Wheeler explained that a universal process for risk management is essential. "To manage risk you have to have a process to understand, measure, and control risk," he said.
"We need the process to be able to tell us quickly when we are off track, especially for a very large organization," he said. "We have customer and investor expectations that we must continuously monitor so as not to get off track."
"We make sure our individual business strategies fit with the overall corporate strategy, identify the risks involved, and then find a way to manage the risk from a structural and process perspective." he added.
He stressed the importance of making sure this is understood at all levels in the organization, saying "It is important to connect this process to our associates, and to outline their responsibilities and how their performance will be measured."
Above these specific processes and structures, organizational culture plays a notable role as well. "There is no question that the Bank of America culture is a driver of success. Do the right thing and do things right is a clear mantra within the company." Wheeler said.
While many banks and financial companies have been hit with substantial fines in recent years, Wheeler argued that the relationship between regulation and risk is complex, and that regulation is not a risk per se.
"Regulations unto themselves do not damage the industry, but not following regulations does. We work mightily to make sure our brand isn’t tarnished. How you manage your relationship with regulators can help determine the outcome of any future problems," he explained.
"When you drill down to what regulators want, it is in part to drive ethnical behavior," he said, connecting this to Bank of America’s goal of becoming the most admired company in the world.
While risk is an inherent part of all segments of the banks business, Wheeler explained that risk management systems try to make sure that risks are understood,under control and are not developing beyond the bounds set by the company.
"Each type of transaction has a risk profile which is periodically measured and assessed. "It is fine take a higher level of risk if that is a part of your approved strategy, but that risk has to be consistent and controlled. We get worried when the risk level begins to drift outside of an approved risk strategy," he said.
Bank of America’s diverse international operations also require risk management structures to control exposure to country risk. "There are country limits for different categories of investment, combined with country capital limits [restricting total exposure in a given country], and also notional growth limits, to keep an eye on overly fast growth in foreign countries," Wheeler said.
"Other countries require enhanced due diligence, especially for compliance on issues like anti-money laundering regulations," he explained.
Last spring, Wheeler and his group worked with a team of Fletcher student consultants to measure off-shoring risks as part of the course Field Studies in Global Consulting. "We had an excellent experience resulting in a model that assesses off-shoring risk that has now become a part of our off-shoring process."
