Remarks by John D. Hawke, Jr. Comptroller of the Currency before the Bank Administration Institute Security, Audit and Compliance Conference Orlando, Florida May 4, 1999 Back near the end of the last century, the United States Navy, without so much as a single modern battleship to its name, ranked eleventh among the world's fighting fleets, behind Turkey and Austria. The Army was even worse off. In 1890 it fielded a total force of 28,000 officers and men, fewer than Bulgaria at the time. Coastal defense consisted of scattered batteries of mostly Civil War-vintage artillery. Other advanced nations must have had a good laugh when they compared notes about America's creaking military machine. But they would have missed the point. Though weak, this army and navy were equal to America's security needs in the 1890s. We had no foreign enemies, and even if we had, the oceans would have kept them safely at bay. Americans were not alarmed to see their coastal guns gathering rust because there was little likelihood that those guns would be needed. In other words, there was appropriate proportionality between any risks to national security and the means available to protect against those risks. Proportionality. That's the basis of effective risk management -- whether it's national security or the safety and soundness of financial institutions that's at stake. Four decades ago, overall risk in the banking system was low. Governmentally imposed ceilings on deposit interest rates, branching restrictions, and limitations on powers and products made banks virtually indistinguishable from one another. Competition among financial providers was muted and genteel. While the biggest corporate borrowers were already turning to the capital markets, the vast majority of credit-seekers had no place else to go except the local bank. Banks could afford to be fussy in deciding who got credit. And they were. Meanwhile, a predictable stream of customer deposits provided bankers with cheap and abundant liquidity. While market-rate instruments such as certificates of deposit and stock market mutual funds had been around for years, they appealed only to a comparative handful of affluent Americans in 1970. The first CDs were sold in minimum denominations of $1 million -- hardly an investment vehicle for the masses. Middle-class savers had to settle for a return on bank deposits that narrowly exceeded the inflation rate -- and, in many years, actually lagged behind it. And of course, demand deposits earned no interest at all. No-cost or low-cost funds meant that bankers had to put their minds to it to lose money. It was a time when loan-to-asset ratios in the 40 percent range -- compared to today's 60 percent -- were not uncommon. And it was a time when some unusually risk-averse bankers saw loan production as almost not worth the effort when, as in early 1970, a one-year Treasury security returned 350 basis points above the Regulation Q passbook ceiling. The loans bankers did make could hardly go wrong on what were then standard terms. As a rule, maturities were short, loan-to-value ratios were low, pricing was stiff, and bankers slept soundly at night. Thus safeguarded and secured, most loans essentially administered themselves. Banks managed asset quality and made loan loss provisions based on trailing measures of credit risk, such as levels and trends in past due and nonperforming loans and loan losses. In other words, in those halcyon days of banking, there was some meaningful proportionality between the amount of risk in the banking system -- low -- and the simple tools bankers used to manage and control it. Occasionally this balance went out of whack. Although competition was already increasing in the 1960s, the domestic loan market of the 1970s was relatively placid. Hungry for bigger returns, some high-rolling bankers ventured into high-risk fields of international lending and foreign currency trading, and speculated heavily in commercial real estate or on the future of interest rates. That kind of activity exposed the weaknesses of haphazard risk management, and a few national banks failed as a result. But they were aberrations. During the 1960s, the ratio of net loan and lease charge-offs at all commercial banks averaged less than two-tenths of 1 percent. Even during the more tumultuous 1970s, it was still less than four-tenths of 1 percent -- a bit more than half of what it is today, in an era of much steadier economic growth. Between 1970 and 1980, there were only 14 national bank failures. That was then. This is now. The new era of risk management for financial providers began around 1980, with deregulation of deposit interest rates, with increased volatility in market interest rates resulting from changes made by the Federal Reserve in its monetary policy procedures, and with the gradual liberalization of constraints on products and services. Since then, bankers, so long protected by government regulation, have had an education in the full meaning of competition. It's been a sobering lesson indeed. More than a thousand banks failed during the 1980s and 1990s. Banks no longer hold the lion's share of America's household financial assets. In 1986, commercial bank deposits outstripped mutual fund assets by more than two-to-one. Today, little more than a decade later, we are well on the way to seeing that relationship reversed. Banks must look to price sensitive, credit sensitive -- and sometimes risky -- wholesale funding to meet their pressing liquidity needs. Competition has profoundly altered the domestic credit market. In 1972, commercial banks provided nearly 75 percent of all U.S. business loans. Last year, the number was down to about 45 percent. The U.S. banking system's loss has been a windfall for investment bankers, commercial finance companies, and foreign banks. Today, it's the capital markets doing most of the cherry-picking. Bankers must scramble for the higher risk customers that remain. These days, even marginal customers can demand and receive preferential terms and pricing that Fortune 500 corporations might have blushed to ask of their banks 20 years ago. The challenge of today's risk environment for bankers is greater today than I have seen in almost 40 years of experience with our financial system. Part of the challenge is understanding the evolving character of risk. To aid in that understanding, I would like to suggest a new analytical distinction: between environmental risk -- risk associated with the long term, macroeconomic changes in the financial world, including the ones I've just described -- and what one might call volitional risk. By definition, environment risk involves trends and issues that bankers must understand and react to, but that are largely beyond their control. We all know that there's no rolling back the clock to the days when government offered bankers sanctuary from the competition of the free marketplace. That genie is out of the bottle for good. By contrast, volitional risk is the risk inherent in individual decisions that individual bankers make every day -- the kind of risk they often can control. When a banker decides to extend a loan based on patently unrealistic financial expectations, he or she is taking on a higher order of volitional credit risk. When a credit officer, bedazzled by the star quality of a fashionable hedge fund, goes ahead with a loan despite being denied access to critical financial information, that loan officer is adding to the institution's volitional risk. When a banker signs off on a deal that includes weak covenants, liberal or no amortization, aggressive advance rates, or over reliance on optimistic enterprise values, and then prices the loan as if it were a solid, investment grade credit, he or she is - -- volitionally -- raising the bank's credit risk profile. While bank regulators must be concerned with the banking system's preparedness to deal with all types of risk, our job requires us to be particularly concerned about volitional risks -- those business decisions that should be subject to some control. And my special concern is that we see continued evidence of credit standards being relaxed, despite the fact that the OCC and our sister agencies have been sounding off about the secular decline in credit underwriting standards for more than two years now. Our examiners are reporting an increasing incidence of structurally deficient loans: loans with elevated leverage ratios; loans based on insufficient documentation; loans whose repayment is dependent on optimistic cash flow projections or recapitalization; loans where personal guarantees of principals have been foregone. The effects have already started showing up. Net charge-offs have been rising over the past three years, despite robust economic growth. Last year, noncurrent loans rose for the first time since the current recovery began. More banks are reporting increases in nonperforming loans -- big increases in some cases. What makes this risk trend particularly worrisome is the absence of proportionality in many banks' ability to manage and control it. In a world of rising risk, one would expect that banks would be devoting significant effort to making their risk management systems more robust. One would expect that, especially after such a long period of economic expansion, banks would be adding to their reserves to help cover the probable losses that will invariably be realized as economic growth slows, as it is bound to do. One would expect that banks would be strengthening their fundamental risk controls -- financial statement analysis, loan review, credit administration, and the information systems that support them -- in order to improve their ability to identify, measure, monitor, and control this rising risk. One would expect that banks would be bolstering and empowering their internal control functions and audit capabilities -- adding expertise, tightening procedures, and ensuring that auditors have the clout they need to get senior management to take heed and, when necessary, to act. One would expect that banks would be augmenting their existing risk control mechanisms with technological innovations, such as risk models, that can be of real value in the context of an effective overall risk management program. I trust that these expectations seem as self-evident -- and as reasonable -- to you as they do to me. Unfortunately, in too many cases, these expectations are not being realized. In too many cases, the fundamentals of risk management are being ignored. Loan loss reserves are falling. Loan review and ongoing credit administration are not getting the attention they deserve. And internal audit functions at some banks are not as strong as they should be to protect banks against the increased risks they face, both as the result of their own business decisions and of forces beyond their control. The effectiveness of banks' internal audit processes has been a matter of concern to the OCC for some time now. Last year we surveyed the examiners of our largest national banks to get their views on how well the banks they supervise were handling internal audit functions. What emerges from this survey is a mixed picture -- itself a matter of concern in the current risk climate. For example, a large number of the national banks in our sample were viewed as understaffed in one or more audit areas. The biggest deficit in audit resources and expertise is reportedly in the Information Technology area -- a critical component of every banking activity. Moreover, our survey reported a high annual level of turnover in bank audit departments -- more than 20 percent in some cases. This kind of mobility could actually be a source of strength to a bank if it reflected the movement of talented auditors into loan production and other front-line functions. Or it could mean that audit personnel are not being fairly compensated or recognized for the work they do, and feel compelled to seek greater recognition elsewhere. The net effect, however, is that many banks are not as well staffed in the audit area as we would like, and that helps to explain why only one-third of the examiners we surveyed rated their bank's audit capability as "good" -- that is, better than simply "adequate." Many reported that, as a result of short-handedness, internal audits had to be deferred or reduced in scope to keep up with the audit schedule -- again, a worrisome trend in a time of increasing risk. All of this may be alarming, but at least it's not mysterious. The growing imbalance between the overall risk profile of the banking system and its internal risk management capacity is the result of a curious mixture of complacency and urgency. Most bankers are quite concerned about current trends in underwriting and the fallout likely to occur if the economy softens. However, you can still find bankers who seem convinced that we have somehow tamed the business cycle, that growth will go on forever, that nothing can go seriously wrong, and that even marginal borrowers -- and dubious deals -- will eventually work out and pay off. In this light, internal audit capacity and credit review seem almost superfluous -- needless frills. Such complacency might have been warranted in the relatively low-risk banking world of the 1970s. It's not warranted now. As one very experienced banker said to me a few days ago, our people have to realize that trees don't grow to the sky. Bankers are simultaneously under extreme pressure these days to maintain loan volume and earnings at their current lofty levels in the face of shrinking market share and increased competition for loans. The current economic expansion has raised expectations perhaps to unreasonable -- and ultimately, I believe, unattainable -- heights. A sober look at history should demonstrate that realizing a 20 percent return on equity year after year is not a goal that can be sustained -- at least not for very long. Yet we are disappointed if new records do not follow one upon the other. Shareholders and equity analysts demand it. Bankers feel compelled to deliver it. And to do that, they cut corners, chip away at functions that don't contribute immediately and directly to the bottom line, and look the other way instead of walking away from some of the one-sided deals that, unfortunately, continue to be consummated. I have heard it argued in response to our admonitions about credit quality that an abundance of liquidity in the system has forced banks to become more competitive in the terms they offer, and that if this implies greater risk, then so be it: after all, bankers are in the business of taking risk. That's wrong. Bungee-jumpers, sky divers and Indy 500 drivers are in the business of taking risk. Bankers are in the business of managing risk. To manage risk effectively, they need to be able to identify, quantify, and control risk. They need to understand the implications of granting exceptions to sound credit policies. And they need to assure that exceptions are occurring in a well-modulated way. To do these things effectively, they need internal audit, loan review, and compliance resources commensurate with the amount of risk they must manage. I can think of no practice more penny wise and pound foolish than to reduce those resources simply because things seem to be going swimmingly right now. Anyone involved in the independent control functions in banks -- loan review, audit, or credit administration -- has a difficult job under the best of circumstances. But internal controls are more urgently needed right now than perhaps at any time in recent memory. Federal Reserve chairmen are fond of saying that the job of the central bank is to pull the punch bowl away just as the party is getting good. Internal controls over bank credit practices serve a very similar purpose. They are an essential safeguard against undue -- even irrational -- exuberance in the loan origination process. As Acting Comptroller Julie Williams told this conference last year, the vigor and independence of bank control procedures, risk management, and early warning systems are matters of primary importance to the OCC in our supervision of the national banking system. And we continue to refine and update our supervisory policies and practices to reflect this emphasis. Since Julie spoke to you, we have issued guidance on loan portfolio management, and have delivered specialized training to our examiners to better enable them to recognize weaknesses in portfolio management processes and systems. In response to reports of increasing numbers of loans with structural weaknesses of the sort that I mentioned earlier, we have provided new training and procedures that have already been of material assistance to examiners in bringing such credits to the early attention of senior bank managers and directors. Just yesterday, the OCC released the latest installment in a series of issuances related to leveraged lending activities, including hedge funds. Yesterday's letter highlights the unique risks associated with today's leveraged lending activities, outlines OCC's risk management expectations for banks that engage in this business, and aims to resensitize bankers to existing OCC policies and guidance. Following up on our internal audit survey of last year, the OCC has launched a study that aims to validate the consistency and quality of our supervision of banks' audit functions. With this information, we should be better able to allocate the right amount of supervisory resources to ensure that the audit function receives the high quality, high level attention it requires during our regular examinations. And in the five months that I have been in office, I have put enormous emphasis on our need to assure that the OCC has the most effective early warning systems we can devise -- to supplement and complement the systems in use at banks. I hope you find it of some reassurance that the OCC is at your side in helping to maintain the safety and soundness of your institutions during these challenging times. All who have an interest in the continued strength of the American economy are counting on the vitality and integrity of banks' internal control functions as the front line of defense in maintaining the health of our financial system. Thank you.