It’s the Data, Stupid! The Important Role of Risk Information in the Financial Crisis and Financial Regulation

Recent (2007-09) market events have shaken our economic system to the core. Many of the world’s largest, most respected, and sophisticated Financial Institutions (FIs) would have failed if it were not for an unprecedented level of government intervention in the financial markets and direct public investment in private firms. During the heart of the crisis the most advanced valuation models and risk management systems failed in a spectacular way. Asset classes, markets, standard capital sourcing techniques, and financial management strategies that had previously been regarded as low risk and fail safe—failed.

While the management systems and strategies used by individual financial institutions floundered, the performance of the financial regulatory infrastructure fared no better. Regulatory authorities in the world’s major financial centers failed to forecast and avert the looming catastrophe. Central banks failed to use their substantial rate setting powers to control ballooning consumer and corporate credit excesses and asset bubbles.

Regulatory agencies such as OFHEO and SEC were actively constrained and thwarted by their political masters. And regulatory methodologies, specifically BIS Basel II, designed to ensure banks retained sufficient capital, actually exacerbated the financial crisis and increased the severity of the recession by forcing banks to massively scale back lending just when the economy needed it the most.

Many explanations for the credit crisis have been put forward. These range from artificially low interest rates to under-regulation to principal-agent issues. No doubt all of these macroeconomic factors played a role. The larger and more subtle problem lies in the fact that even though advances in risk management in large financial institutions and regulatory systems were touted to have addressed these types of adverse outside influences, they did not. A number of questions deserve closer examination, including:

• How did outsized losses materialize so suddenly, even though the housing market had been an area of concern for several prior months?
• How was it possible that large, supposedly well-run companies could not estimate their write-downs correctly, leading some to make massive restatements just weeks after disclosing already outsized write-downs?
• Why did the regulatory community as well as the legislative and executive branch of government fail to act in a timely manner to forestall the subprime crisis?
• How can individual financial institutions and regulatory authorities correct these problems with better information management?

A closer examination of the internal operational mechanisms for risk management—especially the technology underpinnings—is necessary to answer many of these questions. Instructive as it is, simply identifying root causes is not satisfactory in itself since the solutions to these problems cannot be found merely in addressing them. Rather, a healthy reset of the entire regulatory system—for which there have been many proposals lately—is required as well.

Many companies reporting these issues had challenges with processing and distributing data to key management stakeholders in a timely manner. [2] In contrast, as quoted from the Senior Supervisor’s Group (SSG) report on recent market turbulences, “Firms that avoided such problems demonstrated a comprehensive approach to viewing firm-wide exposures and risk, sharing quantitative and qualitative information more effectively across the firm and engaging in more effective dialogue across the management team.” [3] Superior enterprise risk management can be benchmarked in terms of the qualities of a firm’s risk policies, methodologies, and infrastructure.[4] Risk information management is a key component of the risk infrastructure, and is a major blind spot in enterprise risk management that every firm in the financial markets is grappling with. Risk management has come a long way toward implementing superior risk methodologies and adopting sophisticated risk policies. The problem of improving the quality of risk information management must be urgently addressed, especially since the industry continues to innovate and expand.

The need for superior information management has only accelerated since the credit crisis. Calls have been heard for the adoption of better risk management techniques and models to address key issues such as liquidity risk and the fact that correlations are not reliable during crises (i.e., the tendency for all risky assets to all fare badly at the worst times). This has led to the increased use and sophistication of dynamic stress testing techniques.[5] For example, firms are incorporating tools into their risk management programs which enable them to calculate risk in the tails from the adverse impact of macroeconomic events. These trends have tended to increase the need for information even further, not just in terms of its availability and quality but also in terms of the flexibility of its usage.

This article will discuss the risk information problems that precipitated the crisis, and will also examine the infrastructural needs that will have to be satisfied if current regulatory proposals are to be effective.

The Impact of Poor Risk Information

Information is integral to all aspects of risk management. Proper risk measurement requires extended, high-quality historical data for modeling. Risk monitoring requires information to be readily available to those charged with ensuring that risk does not exceed that set by policies. Finally, risk mitigation via proper hedging and pricing techniques depends heavily on the timely availability of effective information. A few examples will serve to illustrate the critical role that information plays in these processes.

• Risk Models : Quantitative risk models are used for valuing and calculating the risk of financial securities, including complex derivatives. Models are, however, only stylized representations of real-world behavior which present many sources of risk including that of misspecification – the risk that the model describes the wrong sets of economic circumstances.[6] Model development is an iterative process that uses historical data as a key input. The lack of quality historical data will therefore have a severe adverse effect on this process and can lead to a poorly specified model.

Risk modeling has also been hampered by the enormous complexity inherent in mortgage-backed securities due to the intricate linkage between many parties such as Government Sponsored Entities (e.g., Fannie Mae), commercial and investment banks, hedge funds, bond insurers, and pension funds. In order for models to be properly specified, the underlying data must represent all these interconnections correctly. Since the data has been of very poor quality this has been a persistent challenge.

• Transparency: The importance of making risk transparent has been raised to new levels. To illustrate, consider the fire-sale of Bear Stearns during the week of March 10, 2008, where its funding liquidity dried up over a 48-hour period.[7] The deterioration in Bear Stearns’ condition was precipitated by clients who, lacking transparency into the firm’s liquidity, caused the proverbial run on the bank. In contrast, Lehman Brothers orchestrated a well-executed plan to rapidly bring transparency to its funding liquidity when it found its liquidity position being questioned, saving the firm from Bear Stearns’ fate in the short-term.[8] Lehman’s later demise, proving that its finances were in no better shape than Bear’s, further emphasizes the difference that transparency can make.

Since the governmental “bailouts” of late 2008, the importance of transparency has been raised beyond its effect on a single firm. One estimate by Bloomberg is that the U.S. Government had committed around $7.4 trillion to the rescue of the financial system by late 2008. [9] Given the large amounts of taxpayer money being used to address the issue, the problem of transparency in the use of these funds becomes critical. The ways in which this money will be funneled through the economy are many, and it will be difficult for anyone to have a clear picture of whether or not the money is having the intended effects in the economy, or even whether or not the money is being used for the intended purposes.

Transparency is at its heart an informational issue. As the above examples illustrate, the ability to ensure timely access and dissemination of information has become all-important. To quote Joseph Mason’s testimony to the U.S Senate Committee on the Judiciary, “The market today is struggling to sort out information. Investors will not join back in until information about values and holdings is improved.” [10]

• Risk Monitoring: A firm’s risk profile can change dramatically via changes in the portfolio or market environment, emphasizing the need for frequent risk monitoring. Timeliness is not the only challenge in risk monitoring. Access to risk information must also be carefully controlled. For example, Barings Bank collapsed in 1995 after a trader in its Singapore office executed a large number of trades that were not properly monitored. His unauthorized access to both the front and back office enabled him to circumvent standard procedures and book trades at fictitious prices, leading to large losses for the firm.

Poor quality information can be caused for several reasons:

• Lack of Historical data: As an example, information in structured securities is unavailable simply because these instruments are very recent. The result is that the available data, with no information about the securities’ behavior in adverse markets, has little predictive value.
• Data Completeness: A related but different problem is that data is often not available to a particular firm, even if it is available to others in the market. This is a problem that was seen, for example, in Managed Collateralized Debt Obligations (which are essentially a changing portfolio of fixed-income securities) where details of the portfolio were not available in a timely manner.
• Detailed data: Until very recently, details about structured finance instruments’ underlying securities or loans were not shared with investors, making it impossible for them to properly assess risk. Risk managers had to make do with higher level aggregations. (“Replines” are a good example. ^[11])
• Data Quality: Quality is a complicated subject that deserves its own classification. Quality problems can be caused by:

- Lack of data integrity: This can be a result of reasons ranging from simple keying errors to fraud (recent examples of the latter include fraudulent entries on mortgage credit applications and the gigantic fraud perpetrated by the Bernard Madoff hedge fund). [12]

- Ambiguous meaning of data: Such ambiguity makes comparability of data across business lines or FIs very difficult.

- Lack of timely access to data: Significant delays in data and outdated information may result in ill-timed risk management decisions.

Risk Information and Systemic Risk Regulation

The financial crisis has prompted the Obama Administration to draft and transmit to the U.S. Congress legislation to establish new oversight and regulation of the U.S. financial markets. The Administration’s proposal creates a comprehensive supervisory regime designed to prevent the systemic collapse of the nation’s financial system.

While the final structure of these regulations and the supervisory regime that will enforce them is yet unknown (as of October 2009), its primary purpose is well understood. Regulation is expected to anticipate and prevent a severe and widespread disruption of the national financial system resulting from the failure of one, or a small number of, highly interconnected financial institutions. As proposed, a new systemic risk authority will oversee significant financial institutions and will have the regulatory power to ensure they do not pose a risk to the overall financial system.

The establishment of a new systemic risk authority creates technology and data management challenges for financial regulators. To properly oversee the business activities of systemically significant organizations, regulators will require an unprecedented level of near continuous access to large quantities of detailed trading and position data. Among the most significant new challenges is oversight of the previously unregulated over-the-counter derivatives marketplace and the supporting clearing and settlement systems.

The Obama Administration has identified gaps in the current financial regulatory framework as one of the key factors that contributed to the severity of the 2008 financial market crisis. Regulatory agencies including the U.S. Treasury Department, Federal Reserve, U.S. Securities Exchange Commission (SEC), U.S. Commodity Futures Trading Commission (CFTC), and Federal Deposit Insurance Corporation (FDIC) lack detailed and up-to-date information about the business activities of large, interconnected global banking, insurance, and trading organizations. Regulators had limited oversight over global broker/dealers and hedge funds, and very limited regulatory authority over the global over-the-counter (OTC) derivatives markets where instruments such as credit default swaps and collateralized debt obligations are traded.

Within this regulatory environment many financial organizations accumulated excessively large and highly leveraged positions in structured products and other credit instruments. Traditional regulatory oversight and supervision failed to identify and correct these leverage and asset concentration risks. For example, Bear Stearns and other broker/dealers commonly increased their leverage to almost 50:1 within accounting periods and then reduced leverage ratios to more conservative levels when creating quarterly financial statements for the SEC and the investing public. Oversight systems that rely on backward looking and aggregated financial statement information fail to identify these types of high-risk business activities.

Most importantly, the existing regulatory system did not properly monitor the level of systemic risk that had accumulated in the financial markets. Systemic risk is widely understood to be the probability that the impairment of a large, interconnected, financial operator such as a broker/dealer, money-centered bank, or private fund could cause the collapse of the financial system through a cascading set of events leading to a breakdown in the credit market and the nation’s banking system. Systemic risk is closely related to the counterparty risks embedded in the bilateral derivatives and insurance instruments that trade in the global OTC markets. Current oversight systems and regulatory filings fail to adequately measure both the counterparty risk concentrated within a single business and the interconnected web of counterparty exposures across the overall financial system.

Objectives of the Systemic Risk Regime

The objective of the new regulatory regime is to fill the gaps in the existing system and more thoroughly monitor and manage systemic risk. The systemic risk authority will develop comprehensive and up-to-date insight into the risk-taking activities of systemically significant organizations. Regulators will require detailed and immediate transaction, position, and counterparty data at both the firm and financial system levels. Among the key initiatives are the identification and oversight of systemically significant firms that pose a risk to the overall financial system, and the standardization of OTC derivatives markets on established clearing and settlement systems.

• Oversight of Systemically Significant Firms: Institutions that are deemed “too big to fail” by virtue of their size and interconnectedness will be subjected to more comprehensive supervision. Focus will be on risks posed to the financial system as a whole. Regulators will have the power to impose immediate corrective action when imbalances are identified. These new mandates imply that regulators will be evaluating daily changes at a very granular position level. Regulators will need to evaluate daily changes in counterparty exposures, hedging strategies, collateral, and netting agreements and will also likely need the ability to independently verify a target firm’s internal valuations, enterprise level risk measures, and capital requirements. In addition, regulators will want to independently run stress tests similar to those recently completed under the Troubled Asset Relief Program (TARP) by the U.S. Treasury Department. In order to carry out these supervisory procedures regulators will require up-to-date, detailed, and comprehensive information including short-term funding sources and changes in aggregate positions.
• Oversight of Clearing and Settlement Activities: In order to efficiently regulate the OTC derivatives markets the proposed legislation gives the systemic risk authority the responsibility to monitor payment, clearing, and settlement activities and systems. Regulators are currently working with leading derivatives dealers to move OTC trade clearing and settlement process onto existing systems or entirely new clearing systems, with the immediate objective of reducing systemic counterparty risks inherent in OTC agreements. Since clearing and settlement systems act as a central counterparty to all transactions, regulators will be able to efficiently gather comprehensive and frequent information about the OTC derivatives being traded and the firms involved.

Significant data management and technology challenges must be resolved by the new regulatory regime. Fulfilling all the supervisory objectives will require the deployment of technology systems and processes that do not currently exist within the regulatory system. In many ways the data management and analysis challenges faced by the new regulatory regime are identical to the risk information problems within FIs described earlier. The difference between individual firms and the regulators is the scale of the challenge. With the enactment of legislation, regulators will be asked to analyze the risks of a large number (potentially hundreds) of individual firms.

It is clear that the proposed systemic risk regime will need a comprehensive database for managing the required data. This system will need to meet requirements in five categories: data quantity, complexity, system workload, retrieval/analysis, and security.

• Quantity: Quantity refers to the total amount of data that must be loaded and stored. Given the comprehensiveness and granularity of the information necessary, the total quantity of data will be very large by conventional standards. Regulators will need to manage transaction, position, product, and counterparty data from many firms as well as transaction information from the OTC clearing and settlement system. To ensure the timeliness required for effective oversight, data must be at the daily level and historical data must be stored to support time series analysis.
• Complexity: Derivatives, structured products, and other financial instruments are themselves highly complex, as measured by the number of entities and attributes required to fully describe the underlying information. An additional source of complexity is the counterparty reference data required to describe the many internal legal entities and related firms used by sophisticated global financial institutions. Compounding this complexity is the variability of both the instruments and the legal entity relationship hierarchies. New instruments, investment strategies, and associated legal entities are constantly being created and the supporting data architecture must quickly adapt. The data platform accessed by the systemic risk regime must therefore be designed to manage highly complex instrument, position, transaction, and counterparty data from a wide variety of sources.
• System Workload: The various types of activities performed on the system comprise its workload. This mix of activities can include frequent data loading and extraction, complex analytic queries, and computations across a varying number of simultaneous users. The systemic risk database will need to manage a complex array of different workload types. The system will need to support a large number of users performing a variety of analytics. Due to the “always-on” nature of global markets, the system can never be offline, so all activity such as analysis, queries, and frequent data loading must occur simultaneously.
• Retrieval/Analysis: Regulators will need access to data about specific firms or situations on an ad-hoc basis. The kinds of data included in the request, the levels of aggregation and detail required, and the complexity of the connections involved cannot be predicted. Therefore the database must be capable of meeting these needs in a scalable manner.
• Security: The database will store large quantities of proprietary information about the business strategies and exposures of the target firms. To safeguard the confidence in the system, it is imperative that the regulator protect the underlying data while allowing full access to internal analysts and external regulatory and oversight authorities.

Data Management Recommendations

Based on the data management challenges described above and the primary objectives of the new systemic risk regime, this paper offers the following five key technology, design, and development recommendations:

1. Create a single, integrated, data repository : Integrating transaction, balance sheet, market, financial product, and economic data will enable the systemic risk regime to conduct effective and simultaneous analysis on a large number of targeted organizations. A single fully integrated platform will allow regulators to discern patterns and make connections that are impossible to recognize when the underlying data is fragmented and spread among a large number of separate systems. An integrated platform will support a standard and fair application of regulatory oversight across all targeted firms. In addition, financial industry experience indicates that large, integrated data platforms are significantly less expensive to implement and maintain and lead to more accurate data than an equivalent set of smaller, separate data platforms.
2. Ensure the data platform supports a dynamic and flexible analysis environment : To conduct effective oversight of highly complex financial institutions and the fast moving markets in which they operate, regulatory analysts need a data management platform that supports dynamic ad-hoc analysis of large quantities of detailed data. Static analytic tools inevitably lead to regulatory gaps; recent experience indicates that financial firms will quickly adapt and work around rigid and widely known oversight techniques. Analysts need a data platform and analysis tools that will enable them to quickly develop new models, evaluate large quantities of very detailed data, and ask previously unanticipated questions.
3. Automate the oversight process as much as possible : Automated detection and monitoring tools make the systemic risk oversight regime both more effective and more resource efficient. Advanced pattern detection algorithms and event triggers are commonly used by financial exchanges to scan through large quantities of historical transaction data to detect specific trading patterns and then alert compliance analysts. The same type of technology can be deployed by the systemic risk authority to conduct comprehensive oversight while controlling the number of analysts and significantly lowering the costs. This means that regulatory analysts can concentrate their time more effectively on specific trouble spots as identified by the detection algorithms and event triggers.
4. Build a data management platform that supports continuous 24/7 access : Global financial marketplace is always open. Millions of transactions are executed and new products and strategies are developed and deployed continuously, 24 hours a day, seven days a week. To keep regulatory oversight current and effective the database system needs to load fresh data on a near constant basis while also providing support for ongoing analysis and reporting. The systemic risk authority should only consider deploying data platform technologies with advanced mixed workload capabilities that support 24/7 data access and analysis.
5. Develop a data governance structure : Establishing a formal data governance structure across the financial industry is essential for managing a large data platform shared by many different stakeholders with competing interests. Financial industry experience indicates that a strong data governance structure with well defined data access and modification rules and procedures helps to ensure information assets are efficiently used and adequately maintained.

Conclusion

The lack of good information has been a crucial contributor the financial crisis. While large FIs have made strides in risk management over the past several years, these advances were frustrated by a lack of quality information and technology processes. Solving these problems in individual firms will be critical to the recovery of the financial system.

Information is also critical to a future systemic risk oversight authority. An effective information management system for this new regulatory authority will require a significant commitment of time and resources. While the relevant information technology is currently being employed in varying degrees within the financial services industry itself, the challenges of systemic risk regulations, however, dwarf those within individual firms by their scope and scale.

The information needs of both financial regulators and the financial services industry have a lot in common, and the challenges are many and vast. The good news is solutions are available. Some are being used within the financial industry, while others can be easily adapted from other industries where data management has been a focus for many years. No matter how it is done, it is imperative for regulators and the financial industry to recognize their symbiotic relationship with respect to information, and to work together to solve these needs.

The health of our economic system depends on it.