Managing Risk with Key Risk and Performance Indicators

July 17, 1938, aviator Douglas Corrigan, a.k.a Wrong Way Corrigan, departed from Brooklyn, New York, for a cross-country trip to California.

KRI/KPI are metrics that management monitor and predict the state of certain events: both the chance or the likelihood that the event might happen, the potential consequences if the risk event does happen, and similarly, the chance or likelihood that it will not happen. KRIs/KPIs are early warning signs that certain events or trends might impact a bank’s ability to achieve its goals.

Think of them, if you will, as road signs on a path to a destination, a goal. They tell you whether you are heading in the direction you want to go and whether you may ultimately get where you are going. Moreover, they may warn you that the direction you are headed is the wrong one, whether the goal you originally set is achievable anymore, or if it is, whether the decision to achieve it is a wise one. Lastly, they point out potential perils on the path and, in many cases, point them out in time while action can still be taken to avoid them.

Key risk indicators and key performance indicators are derived from a number of sources. A primary source is regulatory authorities as measures of compliance with applicable regulations (e.g., capital, CRE loans to Capital). KRIs/KPIs are also derived from the Bank’s Strategic Business Goals and its Risk Appetite Statement, as well as its Policies.

What they recognized was that the Net Absorption Rate trend, as well as the Vacancy Rate trend indicated that office space in the market was filling and that additional space might be needed, either through conversion of retail/warehouse space to commercial office space, rehabilitation of older commercial space or the construction of new commercial office buildings. Rental rates were also improving. The charts below show these indicators, which were being tracked by the Bank.

If the Bank does this, there are some internal and external data (KRI/KPI) that it might track to manage credit risk related to these loans. This might include some leading KRI-based market data (commercial rental rates and occupancy rates, for example), peer performance data, and internal data (Volumes of loans, risk/control ratings, loans made as exceptions to policy, etc.). These are included in the chart below.

Management may also want to track ongoing exceptions, such as the failure of borrowers to provide financial statements and tax returns. These are good leading indicators of potential future problems. They will also want to track lagging indicators, changes in delinquencies, Watchlist, and Classified loans.

The chart below will show you that the Bank was not meeting its ADC loan growth goal at the time it undertook these initiatives or in the first couple of quarters. So, it loosened its underwriting and administrative controls, waived guarantors, for example, approved loans as exceptions to debt-service-coverage limits, etc., and took on larger and perhaps more risky loan types with higher LTVs, more financial risk, and the numbers began to improve. Things seemed to be working.

Things were going so well, in fact, that they increased their Risk Appetite for these loans so they could originate more of them, easing underwriting and credit administration controls and exceeding the new limit in the process. Risk Control ratings plummeted. Management might have a difficult time explaining to regulators how the Bank is taking on more risk while at the same time easing credit controls. The Board might be asking that question as well if they are not distracted by the short-term earnings improvements.

A different view of the issue is illustrated below. Over 8 quarters, financial risk ratings climbed while risk and control ratings dropped. The Bank was taking on greater risk because of loosening or weakening its credit administration controls and changing risk limits in its risk appetite statement and Loan Policy.

There is nothing here that says the decisions were bad, either to loosen controls to generate more ADC loans or to strengthen those same controls later and curtail risk once limits had been breached and peer data indicated that they were also cutting back. You would need to follow results a bit longer and track the loan problems (i.e., delinquencies, Watchlist, classified, charge-offs, etc.) to determine if the decisions ultimately were good or bad. But that is just the point.

Key Risk and Key Performance indicators are not designed to tell you a specific answer at a specific point in time. They are designed to tell you when things are going according to plan or not, and if not, where you might look for the reasons that they are not. They tell you whether some of the assumptions that underlay your strategic business and risk decisions are proving to be true or are moving in an entirely different direction.

To use KRI/KPI effectively, the Bank must track leading and lagging indicators, and it must use data internal to the Bank and external data related to the market and economic conditions it is operating in. It is also important to benchmark the performance of those KRI/KPI to the strategic plan objectives and assumptions, the risk appetite statement, policy limits, peer bank performance, and of course, regulatory limits.

Because as the immortal Donald Rumsfeld once said, “As we know, there are known knowns; there are things we know we know. We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns — the ones we don’t know we don’t know.” Wait, is that a signpost ahead. Good Luck.