MISSING PIECES
How risk management failures contributed to the subprime mess.
By Avital Louria Hahn

As signs of subprime trouble were mounting in early 2007, Morgan Stanley’s fixed-income traders made a bet that matters would worsen and built a US$2 billion short position on the sector. As a hedge, they bought US$14 billion worth of investment-grade mortgage-backed securities for 20 cents on the dollar.

These triple-A securities did not draw their designation from superior credits. Rather, they were backed by super-senior, mezzanine triple-B mortgage bonds that had been engineered and repackaged into triple-A credits. In theory, these were reasonably sound investments, which despite the market deterioration their steep discount implied, were expected to hold up as a hedge.

But by December, a perfect storm had gathered. With real estate in free fall, investors avoided mortgage-backed securities like the plague, fleeing low- and high-grade securities alike. Morgan Stanley’s hedge collapsed, triggering a US$9.6 billion write down. The loss was not only staggering, it was also grossly underestimated—nearly triple the US$3.7 billion forecast a month earlier by Colm Kelleher, Morgan Stanley’s newly appointed CFO.

“When these guys stress tested the position, they didn’t envision being able to have this much defaults,” said Kelleher in a fourth quarter conference call in December. John Mack, Morgan Stanley’s chairman and CEO, said the “embarrassing” loss was due to an error in judgment in the fixed income group and “a failure to manage that risk appropriately.”

Mack’s words pretty much sum up Wall Street’s response to the subprime crisis last year. With few exceptions, like Goldman Sachs, bank after bank missed the warnings, resulting in a collective U.S. loss that by press time topped US$100 billion. “Everyone involved was caught flat footed,” says Jess Varughese, managing partner of Milestone Advisors. “CFOs who had previously been right on the money and conservative came out with numbers, only to be embarrassingly corrected three weeks later.”

Could the crisis have been averted? Should these CFOs have known what was happening at their enormous banks and been better prepared? Some analysts have claimed that CFOs were not responsible. Others disagree. “Finance is their bailiwick,” says Professor Richard Sylla of New York University’s Stern School of Business. Associate research director of SNL Financial, Eric Fitzwater, agrees. “CFOs should have known there was a distinct possibility the mortgage market was going to stall, at least,” he says.

The Business of Risk

This is not the first time banks underestimated problems, of course. Just think of the tech bubble, Long Term Capital Management, and the savings-and-loans crisis for a quick refresher. But today’s banks are different from the institutions of seven years ago. They have grown in size and complexity, with huge derivatives and securitization businesses. They routinely make bets with their own money. Arguably, most banks today are in the business of taking risks.

In fact, most have sophisticated quantitative programs and armies of risk monitors (JP Morgan has 700.) But somehow few systems worked properly. In some banks, risk and finance did not fully communicate. In other cases, the risk function was not visible enough in the corporate structure. “Some of the symptoms we are seeing are [the result of] short cuts, lack of accountability, and instances where we think there is a need for enhanced communications between risk, financial control, and operations,” says Miles Everson, head of the risk advisory practice at PricewaterhouseCoopers.

Not surprisingly, banks are now evaluating and strengthening their finance and risk structures, with the CFO’s role extending to risk management. There is even talk of merging the functions. For now, two main structures are emerging. Some banks that did not have risk report to the CFO, like Morgan Stanley, do now. Others are keeping risk separate but appointing a chief risk officer who reports directly to the CEO.

In addition, banks are reevaluating metrics and retooling scenario planning. Whether these changes will prevent future disasters remains to be seen. The biggest risk, says NYU’s Sylla, is that banks “will be cautious for a while and then some other boom will come along and everyone will jump on it.”

Merrill’s Peril

As these changes continue to unfold, it is instructive to examine the casualties. While most of Wall Street was affected, it was the hits taken at the two giants—Merrill Lynch and Citibank—as well as the bullet dodged at Goldman Sachs that offer a glimpse into how risk was handled for better and for worse. In addition, says Jim Kristie, editor and associate publisher of Directors & Boards, “Looking at Citigroup et al, the question nags: Can a company become too big and complex for any one individual to lead—and for a board to oversee?”

On paper, for example, Merrill was doing many things right. According to its 2006 annual report, the CFO—Jeffrey Edwards at the time—headed the risk oversight committee and was charged with establishing risk tolerance levels, authorizing changes in the firm’s risk profile and putting in place proper risk management processes. But in reality the structure had problems. Risk was not integrated under one set of eyes. It was split between a credit risk officer and a market risk officer, both of whom reported to the CFO, who in turn reported to the CEO.

That may work at Goldman, where decisions are made collectively among executives. But at firms with a strong willed CEO, as Merrill Lynch had, it can backfire. Former CEO Stan O’Neal was the only executive on the board, holding the titles of CEO, chairman, and until recently, president. As in many U.S. banks, the CFO was not on the board, a corporate governance demerit according to Peter Hahn of the Cass School of Business in London.

People close to Merrill say that even if Edwards saw the risk, contradicting O’Neal was a dangerous game. “Either you did what he wanted or you were out,” says a Merrill employee. Ironically, it was O’Neal, a former Merrill CFO, who drove the firm to take more risk with its own capital. Relieved of his job in November along with Edwards, O’Neal had also overseen the US$1.2 billion acquisition of subprime mortgage originator First Franklin in late 2006 as the sector was deteriorating.

Merrill may have also become addicted to the enormous fees it collected from underwriting collaterized debt obligations (CDOs), which reached US$700 million in 2006. Because CDO investors demanded the lower-credit, higher-yielding slices of the securities, Merrill did not have enough of a market for the investment grade tranches and began keeping them on its books. Its pre-crisis holdings peaked at an only partly hedged US$41 billion. That could be due to the high cost of insurance, says Tanya Azarchs, banking analyst at S&P. “By the time people realized what was happening, it was too late to do anything,” she says.

Merrill’s new CEO John Thain has changed the risk structure by integrating market and credit risk and naming a former Goldman global risk officer, Noel B. Donohoe, as co-chief risk officer. Donohoe shares the responsibility with Edmond N. Moriarty, formerly Merrill’s chief credit officer, who was appointed chief risk officer in September 2007. Both report directly to Thain. In addition, Thain instituted weekly risk meetings and changed the compensation structure from one that encouraged risky bets to one that reflects “firm results first”, according to Thain’s presentation at a Citigroup financial services conference in January.

Big Isn’t Always Better

For Citigroup, the subprime crisis simply accelerated a downward slide. With investors calling for its breakup long before the crisis, the bank’s US$20 billion subprime-related losses and its battered structured investment vehicles further exposed the difficulties managing this complex institution. In fact, in addition to taking on to its balance sheet as much as US$43 billion in CDOs, Citi had US$100 billion in SIVs (structured investment vehicles).

Internally, the finance function has been in flux for some time. Two CFOs in a row—Todd Thomson and Sallie Krawcheck—were replaced in short order. And it wasn’t until last March that the bank hired what one corporate governance scholar calls a “professional CFO”—American Express’s Gary Crittenden. But by then it was too late to fix the problems. Indeed, in an analyst call in October, Crittenden conceded that Citigroup’s massive CDO losses had to do with failure to properly monitor the value of the bank’s CDO holdings until it was too late to hedge or sell them. Collaboration “between the credit-risk team and the market-risk team was not as strong as it needed to be," he said. "We have to have more integration between the way those teams operate."

Like Merrill, Citi’s CDO losses were disclosed gradually. A US$5.9 billion third-quarter hit predicted in November became US$11 billion in December. CEO Charles Prince, who in the summer said that Citi would “keep dancing” as long as the music played, resigned. The bank named its institutional client group head Vikram Pandit as CEO in December and took corrective steps, including splitting the role of CEO and chairman. These steps did not prevent a fall in the bank’s capital ratio to 7.3 percent from its 8 percent target, triggering a downgrade from Moody’s Investors Service.

Overall, the risk function at Citi lacked visibility or direct lines to the top. Former CRO David Bushnell reported to Vice Chairman Lewis Kaden, who had been a chief administrative officer, one of the structures that corporate governance gurus say is not strong enough. Just prior to his retirement in November, Bushnell served as both risk officer and chief administrative officer, reporting to Prince. In November, the bank named Citigroup risk veteran Jorge A. Bermudez as chief risk officer, reporting directly to Pandit. Citi also formed an advisory committee of senior leaders from across the company that will provide input on ways to strengthen risk management processes. The group meets weekly with the CEO often present.

Crittenden, meanwhile, has said he would centralize the treasury functions to “facilitate the allocation of capital to our highest growth and return opportunities.” He is also in charge of conducting an ongoing review of the bank, including headcount, to increase efficiencies. A second, one-time review of the banks’ business is underway and is headed by Pandit; that review will yield results that may include a breakup—a scenario under which Crittenden might be tapped to head a division.

What’s Luck Got To Do With It?

Not every bank considers 2007 a disaster year. JP Morgan Chase, Credit Suisse, and Deutsche Bank all emerged relatively unscathed from the crisis. Lehman Brothers, a big player in mortgages with an estimated inventory of US$80 billion in mortgage-related securities, also skirted major pain, returning16.6 percent on capital in 2007—largely thanks to a revamping of its risk management system after the 1997 Asian crisis.

Still, it was Goldman that got the Street’s attention. In December 2006, Goldman’s CFO David Viniar assembled senior people from every group connected with the subprime sector, including the controller division, the mark-to-market group, mortgage desk, and market, credit and counterparty risk. For 10 days earlier, the firm had mortgage-related losses on its P&L and discussion revolved around the firm’s long holdings in the sector. The consensus at the end of the meeting was that “we’d rather be short than long,” says a person close to Goldman.

“Goldman Sachs is an example of a CFO looking at the situation and saying ‘I’m uncomfortable,’” says Milestone Advisors’ Varughese.

At Goldman, risk management falls under the CFO. Liquidity risk reports to the CFO via the treasurer. The heads of credit risk, market risk, operational risk, and the controller all report to the CFO, who reports to the co-chief operating officers and the CEO.

The lines of authority and teamwork proved to be key in the past year. The subprime risk was flagged at Goldman via the firm’s controller, who had noticed millions of dollars in losses on the firm’s P&L and alerted Viniar. Viniar then spoke with the credit risk group and called the December ’06 meeting. In addition, Goldman’s controllers have authority over traders when it comes to risk, and can stop them from making a trade—without going up and down a bureaucratic ladder.

Goldman suffered some, relatively minor pain—a US$1.5 billion hit on loans to private-equity firms in the third quarter. Still, it remains to be seen whether Goldman will completely dodge the fallout, which includes lawsuits that are expected to multiply in the coming months as well as regulatory probes. Already, some are accusing it of protecting itself while continuing to peddle risky securities to investors (Goldman maintains it sold only high-grade securities once it began to unwind its position.)

A Changed Landscape?

While Goldman’s structure has remained the same, other banks have been changed by the crisis, at least temporarily. Merrill’s CEO Thain, for example, has said the bank will exit the subprime-related securitization business. Citigroup may get broken up and there is talk about Bear Stearns getting sold. In addition, many banks are now answerable to sovereign wealth funds from the Middle East and Asia. At Citi, for example, Crittenden helped secure US$7.5 billion from Abu Dhabi Investment Authority.

As for the bank CFO, there is reason to believe that the role will be strengthened and that risk monitoring will improve. “CFOs have to upgrade their skills and become more understanding of risk management,” says Varughese.

And going forward, adds Jennifer Meiselman Salzman, director of BDO Consulting, “as CFO you [will] have responsibility to look deeper and understand what kinds of securities are on your books.”

Avital Louria Hahn is senior editor at CFO in the U.S.