Financial Institutions Are Rethinking Enterprise Risk

Intro:
Hello there
Before we get started, I want to ask you to follow the On Aon Podcast.

That way, you’ll never miss an episode and you can keep getting access to Aon’s top thought leadership.

If you are listening on mobile, just click follow. If you’re on a desktop, hop over to Spotify or Apple podcasts and follow us there.

Whether your interest is human capital, risk capital, global insight or industry insight, On Aon has a new episode every week that brings you the latest thinking from our firm.

Stay ahead of the curve and follow us wherever you get your podcasts now.

Now let’s get back to the show.

On this week’s Industry Insight Episode, we have Dan Butler, Aon’s EMEA Financial Institutions Industry leader, and David Cowan, EMEA Head of Advisory for Non-Financial and Credit Risk, discussing how banks have changed in their approach to managing key risks.

Daniel Butler:
Hello there and welcome to this Industry Insight episode of the On Aon podcast. I'm Daniel Butler and I'm the Financial Institution's industry leader in the EMEA region of Aon.

In today's episode, we're going to take a look at how financial institutions like banks are evolving the way they look at risk management.

It's really important to understand that banks simply aren't trying to eliminate risk. They have to take risk to trade. They need risk in order to have returns. But also recognition that in today's environment, there's an element of risk in every business decision.

And therefore what banks need to do is understand well enough to make better decisions about where to invest, where to transform, and how to grow. So, our conversation today will explore how the Enterprise Risk Management frameworks are evolving from identifying and managing downside risks towards helping leaders make more informed, strategic decisions.

And I'd like to have with me today my colleague David Cowan, who heads up our advisory for operational risk and credit across Aon. Welcome, David.

David Cowan:
Hey Dan. Great to be here. Thanks for inviting me along.

Daniel Butler:
So let's crack on. So banks have always been in the business of managing risk, as I said. So what do you see now? What's really changing about the role that enterprise risk — ERM — is playing in helping banks make strategic decisions?

David Cowan:
You're right. And banks have always managed risk. That's the core of their business.

What's really changing, I think, is how the Enterprise Risk Management Framework and teams show up and start to integrate into the banking conversation. If you think back to the Basel days when it all first started, historically, enterprise risk management, operational risk, they're always seen as a kind of brake pedal. Just slow things down, making sure everything's within the reg limits, make sure compliance is done.

And usually ending up with a no at the end of it if it's too risky, right? Now that's essential. You gotta do that, right? You have to do it. But it's mostly defensive.

I think what we're starting to see emerge from the practices as ERM becomes a hot topic again is they're becoming a much more strategic partner. Risk teams are involved in the conversations earlier. You know, which markets, which segments, where are you gonna grow, how to allocate capital, instead of looking backwards.

So, it's that forward looking view. It's almost as if ERM has turned from looking in the past to looking into the future, right? And I think leaders are starting to look at capital, stress tests, and analytics in a much more forward-looking strategic view as well, especially how it behaves under different conditions.

So, you've got leaders that are historically looking backwards, starting to look forwards. You're using more tools that have been developed over a period of time And the key thing is — and one of the major topics — is resilience. This is where this really comes in. And there's been a lot of debate around what resilience is, a lot of debate about will we be able to sustain our bank if something happens. But really, resilience is about understanding your risk appetite. It's giving you the confidence to say, if I have a resilient bank, where do I deploy the capital? When there is a downside, how do I take the risks under stress?

I feel much safer if I've managed resilience. So you're more confident about taking the risks and not saying no.

So I would say it's moving from purely protection into being in a source of insight that really shapes the bank, how it competes, how it grows, what differentiates itself. It's not just there to say, is this safe? It's saying what's the best risk adjusted way to grow?

Resilience ERM, it isn't about the ability to recover. It's about confidence. And it can go beyond protecting the organization and actually give leaders the confidence to act.

So, that's how I would address that question, Dan, but you're right. Taking risks, risk-measured ways.

Daniel Butler:
And where are you seeing the risk-insight influence decisions around growth, investment, transformation and capital?

David Cowan:
There's number of big areas, but probably four of them that come to mind straight away. The growth and portfolio decisions that we mentioned in the first part of the discussion there.

Banks are using ERM tools like scenario analysis, concentration metrics, risk-adjusted return measures. And they're using those to look at the sectors, the regions, the client segments to double down on. So, they're not looking now, the ERM framework, the ERM teams are not looking at these sectors and saying, no, you can't go in there.

They're saying go in there with this in mind, or double down on something that's really starting to grow, but be aware of this on the side thing.

So it's no longer a no. The analysis, the tools, the concentrations are allowing the ERM teams to stop chasing volume in metrics, it's starting to chase volume. They're saying which portfolios hold up best across multiple scenarios, not just a bad case. So it's giving the leaders greater insight.

I think the second thing is investment and transformation. So if you about large-scale historic technology implementation and transformation programs, they were really justified in the past on is this going to increase the top line? Are we going to make more money out of this, right? So risk is starting to come into these programs and saying, is it going to modernize what we're doing? Is it going to make things faster and safer? Is it going to improve our cyber resilience? Is it going to reduce our operational risk and conduct risk?

So those are risk benefits. And they've been quantified around the investment decision, not just a side benefit that comes out of the project. So the scale of the transformation, they're being brought in earlier.

I think the third thing we're seeing is capital and funding allocation. This is critical for a bank to operate, right? Risk is central to how the banks decide to deploy scarce capital. And I think the boards really started this very early on and it's starting to accelerate forward.

So, the boards are asking for every unit of capital we've got, where are the best risk-adjusted returns? And how does that look under stress? And that's the key part. How does that look under stress?

Historically, we'd be looking at the Bank of England stress test, we'd be looking at internal stress tests. But ERM teams are looking at this more holistically around the capital allocation. And things like climate change, these emerging risks, regulatory change, it's bringing a much clearer lens to how people and teams are deploying capital on a risk-adjusted basis, but also two years down the line, is the environment going to change? Are there things that we haven't thought about when we're deploying that?

And then finally, and this links back to the resilience question, is confidence. If you've got confidence in the bank to go out and execute, if you can trust the risk department to be able to give you these insights and leaders have these insights at their fingertips, they're going to be much more confident, much more comfortable taking bold moves, entering a new market, launching a new product, or pivoting a business model, because these things have been thought through holistically, right? All of the risks around it are measured, monitored, controls, there's analytics around it. But if you deploy with confidence, you grow faster, right?

So the real shift is that risk insight isn't sitting on the sidelines anymore. It's sitting at the center and it's looking outwards, it's looking forward, and it's in the strategic conversations about growth, investment, transformation, capital, and helping banks take better risks, better decisions, just not less risk. And I think that's the key point nowadays.

Daniel Butler:
Yeah, I love that. I think this confidence thing, people forget how banking is about confidence. As we live in today's world where everyone can at the click of a switch, switch an account, runs on banks are so much easier as we saw in some of the U.S. cases and a few years ago, there's gonna be another.

So it's that the spotlight on risk management has never been higher and the focus as you say, Dave, never be more important.

So I guess moving forward, we've got to change how we think about risk, particularly non-financial risk. So what do you think in terms of all the sort of cyber, technology, AI, third party, op-resilience, that I guess the problems in the past of as banking has evolved, particularly on the global side, as you pointed out, in terms of almost a silo. You've got to tick these boxes from a compliance perspective. How are the best banks evolving and to be more mature in this area, whilst at the same time, they've obviously still got to face off to all the regulatory and other stakeholder compliance?

David Cowan:
We could do a whole podcast series on that question, right? From the very start, you bring out cyber, you bring out technology, AI, people, third party, op-resilience. This just illustrates all of the risks that the banks have got facing them immediately, right? And they are deep, wide, massive topics. But I also agree with what you just said as well, which is speed, right? All of these things are magnifying the speed of change that are happening at the turn of a dial at the turn of a dime.

So I think when you take a really big step back and look at non-financial risk today, you look at cyber, technology change, AI, people, third parties, the big shift isn't that they no longer show up at one time, right? So, back in the day, you had a cyber hack. It was a technology, it was a security problem. Nowadays these risks are really interconnected. So not only is the speed of change because of the technology you have, the speed of change is the transmission of the risk through the system as well. So, an outage isn't just an IT problem. Somebody didn't switch off the server by accident. It just isn't a security problem, right? They become customer, regulatory and reputational issues as well, very quickly. And to that fact, you look at losses, they become reported in the media almost as they happen. And this is a huge worry for banks, right?

But the goal isn't to remove that uncertainty. Right. It's to understand the nature of this interconnected risk landscape well enough to make better decisions. You can't legislate all of the complexity away. You have to live with it. You can't add one more policy, one more control, because it transmits across the spaces where there's no controls. There's no policy. So understanding is fundamental at the beginning.

I think the real challenge though lies not just in identifying the individual risks, but the interactions and how they affect the business. If we go back 10 years, the mantra was always trying to get the first line involved in understanding the risk. I think it's now the first line has to tell and has to be involved in the risk decisions themselves and explain how their business operates to ERM. So the direction of information is changing and evolving as well.

This interconnection is really what matters for strategy and where resilience needs to be built. It can't be bolted on afterwards. That's a thought. And if we think about the technology programs we talked about earlier, having the risk teams in there at the beginning, just with surveying the landscape and thinking about what's going on, that's the key part. As you said, breaking down silos, right? I think we're starting to see that change.

And there's one large international bank that we work with who's actually made that change quite substantially? They've used their Enterprise Risk Framework and their analytics to completely reframe how they think about non-financial risk and insurance. Instead of treating the insurance as a static annual purchase that kind of sits off to the side that nobody really knows about, and then once a year they open the door and there's this thing called an insurance policy that sits off the side, they're integrating that from day one in the insurance framework. They're challenging the operational risk. They're challenging the technology risks. And then they're saying, I can retain that, or I have to retain it, or I can transfer it and I want to transfer it. And that really lines up with the broader risk appetite of the organization.

That shift is breaking down the silos. It's breaking down the silos between risk, business, and insurance. And it's making sure the transfer strategy and the risk strategy is a direct extension of how they manage and take risk, not an afterthought.

So as we interconnect the risks, we need to interconnect the way we think about how we're going to transfer, monitor, manage, mitigate, control them as well.

Daniel Butler:
That's a fantastic example. Perhaps, I know we can't give away too many details, perhaps you could just give us bit more color around the, why do you think that banks managed to get to do that? Banks tend to being big buyers of insurance. And as you said, a lot of the buyers tend to look at this as a cost. What do you think the characteristics of that bank enabled it to make that sort of innovative step?

David Cowan:
I think the first step that made them innovative and different was while they do operate in silos, all banks do, they aren't as siloed as other banks. And they really care about how risk is expressed in the business. So if you look at their enterprise risk framework, they understand and they're very close to the business already. So I think that was the first thing that helped them. The second thing is they are open and honest about how they express their risks.

So if they quantify something, they quantify it in a way that can be communicated across the organization. I think the third thing that's really important to them is the value. So they're not transferring and buying insurance. They're continuously looking at the value of the products they're buying. They're continually questioning themselves and challenging themselves around: is this the right product and fit for us as our business evolves? Is the value of this product correct for us. And by value, we're not meaning price in the marketplace. We're meaning can they quantify and explain to the board why they're buying certain limits when the news article may be increasing cyber risk, AI, North Korean hackers.

So having everything together on one piece of paper that says we are doing this because we believe we're strong enough in cyber to retain a certain amount of risk. But if it gets really bad, which we think it may do in X, Y, and Z, we're going to transfer this amount. So having that full interconnected view of the business helps them have an interconnected view of how they transfer insurance and risk into the insurance market.

Andrew Cunningham:
Brilliant. Everything you just said there, Jill, I was thinking they're all conversations that we're having over in EMEA. So yeah. The broader strategic question, I guess, that we get into is that so many of these cost drivers are linked to chronic health conditions.

Should employers really be thinking differently about what success looks like when it comes to medical plans? You know, are we beginning to see or we're already seeing a shift from managing healthcare costs to proactively managing workforce health?

Daniel Butler:
That sounds really exciting. So what about the future, Dave? That's very hard to look in a crystal ball beyond a few weeks at the moment with all the volatility in the marketplace. But if we were to fast forward, dare I say it, three or five years, would be the aspects of the strongest ERM frameworks?

David Cowan:
If I were to sit here and take a punt, which you're asking me to do, AI, again we can't have a podcast nowadays without talking about AI, right? And that's a great example, right? It crystallizes all of the risks we're talking about just now.

So everybody is looking at this at the moment as the risk to manage, right? I would take a different view if you're looking through the ERM frameworks. I would see AI being used as a tool to help manage, right? So help manage the risks, help understand the risks. There's huge programs going in to implement all of this. But I think I would challenge everybody on the podcast to do one thing today, which is to go to your own internal AI system and do a very practical test. I would say take your AI tool, ask it to take the persona of a first-line business leader, and then ask it to describe from that perspective where your current policies have friction for the first line, where there's overlaps in the policies for that business leader, and then just take the information out, right? Just today. Take that information out and see where you're causing problems in the organization just now.

Now that information I think will be done automatically as we go down five years, right? So we will have AI implemented into the risk system and helping shape our horizon scanning. Helping shape the interconnected nature of risks, monitoring that for us. Helping shape the conversations with the business.

Every risk professional in the ERM department needs to talk to the frontline, but not everybody has that experience. AI can help us have those conversations. So I think the best ERM frameworks will adopt these practices, will adopt the tools that they have around them, but fundamentally it will help break down the silos. So the ERM frameworks will be organized around having better communication between the business, I think.

Daniel Butler:
Great, so in terms of summaries here, and our listeners both who work in and outside the financial institution industry should remember from discussion we've had today?

David Cowan:
So I think the one thing I want people to take away is that... There's many, Dan, but I think that the critical one is that risk and opportunity, they're two sides of the same coin. I know you hear that all the time, but it is fundamentally correct, right? So again, historically risk management and ERM in particular, it's really been mainly protection. It's been defensive. How do we stop bad things happening? How do we stay out of trouble? How do we meet the regulations, right?

That's still essential. It's always going to be essential. It's always how banks and financial institutions are managed by regulators, but it's not enough. If you're moving forward, really just doing that is treading water, right?

The real competitive advantage is coming from understanding your risks well enough to take better, bolder decisions than your peers. And it goes back to that confidence thing again, right? If you've got the confidence to do that and your risk department's giving you the confidence to do that. Then you're in a much better place, right?

So whether you're in a bank or a completely different sector, the question isn't how do we eliminate uncertainty? It's how do we build resilience and insight that gives us the confidence to move faster where it matters and to say no where it doesn't, right.

So if listeners remember that ERM is ultimately about enabling smarter decision making, not just adding controls, then I think we've landed the right message.

Daniel Butler:
Yeah, and think that's also, as you said, David, I think there's been recognition that ERM does need to be more agile. I think there's an opportunity here. Changes I think we've seen is that better-managed banks know when to listen as well. So, it's actually been recognizing their part in the ecosystem and recognizing which of their other sort of third partners they need to be aligned to and engaged with because it's a constant war against all the challenges. I totally echo that.

So, listen, that's all our show for today. Thank you all for listening and thank you, David, for helping us through this really important topic today.

In the coming months, we'll have more episodes on industry topics, including autonomous vehicles. And don't forget, you can find out more about how Aon works with financial institutions to make better decisions or talk to a representative from Aon about your enterprise risk management needs by heading over to Aon.com.

But until next time, thank you very much.

Outro:
Thanks for getting all the way to the end of this week’s episode. The views shared today are for general information only and are not advice on your specific situation. Don’t forget to like, subscribe and share On Aon wherever you get your podcasts — and visit Aon.com to find out more about us.

We’ll be back next week with our Global Insight, where we’ll be looking at how businesses can navigate the constantly changing political environment.