ERM for Banks and Insurers: Trends, Systemic Risk, and CIBC's CRO Playbook

Book: Enterprise Risk Management: From Incentives to Controls
Author: James Lam
ISBN: 978-1-118-41361-6

For Banks, Risk Management Is the Product

GE Capital’s Gary Wendt put it bluntly: get risk wrong and nothing else matters. Financial institutions manage other people’s money. Trust is the business. Expected losses are a normal cost line, which is why annual reports brag about risk committees and limits.

But the industry keeps moving. Post-2008 capital rules and exam standards rose sharply. Survival now means adapting business models and upgrading risk capabilities continuously.

Four Trends Reshaping Finance

Consolidation shrank U.S. FDIC-insured banks from 14,500 in 1984 to about 6,100 by 2012. The top 10 banks’ asset share doubled to roughly 60%. Insurance brokers consolidated too. Mergers promised scale and one-stop shopping. Integration of culture and systems often disappointed. KPMG found 83% of deals failed to boost shareholder returns.

Deregulation cuts both ways. Competition and customer choice improve. Weak players die. The U.S. savings and loan crisis showed how fast bad deregulation plus rate volatility plus weak controls becomes a taxpayer bill. Good outcomes included ALM units, adjustable-rate mortgages, risk-based capital in 1988, and bad-bank structures in Japan later.

Competition from mutual funds with checking features, online banks, and non-bank lenders eroded bank deposit share from 49% of household liquid assets in 1980 to 23% by 1998. Credit cards and mortgages moved off bank balance sheets. Soft insurance markets in the 1990s strained underwriters while investment returns masked underwriting weakness.

Convergence broke Glass-Steagall walls. Citigroup’s 1998 birth mixed banking, insurance, and securities. Diversification benefits come with conflict-of-interest and integration headaches.

Risk by Sector and Across Sectors

Depository institutions live on credit quality and net interest margin. Fee businesses add operational risk in cash and securities processing.

Securities firms take underwriting, market-making, proprietary, margin lending, and settlement risks.

Insurers face actuarial risk (premiums vs claims) and investment risk, plus reinsurer counterparty credit and messy agent distribution incentives.

Cross-sector needs include:

• Aggregated counterparty exposure and default likelihood
• On- and off-balance sheet market risk measurement with VaR, scenarios, simulation
• Leverage and liquidity-aware risk views (10-day VaR alone is not enough)
• Economic capital attribution for risk-adjusted profitability and transfer decisions

Systemic Risk and 2008

Financial firms link through trading, FX, derivatives, reinsurance, and syndication. One large failure can cascade. Regulators focus on system stability. Managers should map interdependencies, plan exits, and watch volatility and liquidity early warnings.

Lam walks the housing bubble arc: subprime lending, securitization, AAA ratings on bad collateral, Fannie/Freddie and investment bank MBS issuance, price drops, Bear Stearns and Lehman, AIG CDS surprises. Northern Rock’s bank run and global credit freeze followed.

Dodd-Frank (2010) aimed at consumer protection, trading limits, ratings reform, disclosure, and tougher scrutiny of the largest firms. Section 165 mandates board risk committees with risk experts for big bank holding companies. The Volcker Rule limits proprietary trading and certain hedge fund ownership. SEC disclosure rules expanded compensation and governance transparency.

Skeptics like Arthur Wilmarth argue the same agencies that missed past crises still oversee complex institutions. Bank executives surveyed doubt regulation alone prevents another global meltdown.

Case Study: CIBC

Canada’s CIBC ($270 billion assets, 20.5% ROE in 2000) bought Wood Gundy in 1988 to expand capital markets and structured derivatives. The 1994 Dey Report pushed listed firms to make boards own risk. Basel 1996 trading rules added pressure.

Dr. Robert Mark joined in 1994 as treasurer overseeing market, operational, and trading book credit risk. Promoted to CRO in 2000, he told the board he would make material changes. Within a year, none of his inherited team held the same roles. Compensation parity with business lines was required to attract talent.

Committees set policies and limits. Risk worked with businesses but stayed independent. Mark favored debate: business and risk in the same room, disagreeing openly.

1998 brought two wins. CIBC was among the first banks approved to use internal models under Basel market risk rules, saving large regulatory capital amounts. When summer 1998 rare liquidity and correlation signals appeared, they cut limits 33% before global markets broke. Losses hurt but 98%+ came from exposures already on a top-10 risk list.

Challenges remained: linking pay to risk-adjusted returns and fitting entrepreneurial culture into centralized reporting. CIBC aggregated market VaR and credit VaR and joined Canadian and industry operational loss data initiatives.

My Take

Chapter 16 is part industry survey, part crisis autopsy, part CRO case study. Lam’s theme: financial firms cannot treat risk as static best practice. Yesterday’s edge is today’s baseline.

The S&L and 2008 narratives are reminders that deregulation without risk infrastructure is a loan against future bailouts.

CIBC’s 1998 limit cut is the actionable lesson. Early weird signals plus willingness to throttle revenue beat heroic post-loss memos.

If you work outside finance, skim the sector sections anyway. Treasury, pension, and capital markets activities inside corporates face the same cross-sector checklist.

Previous: Previous: Three Stages of Business Risk (Chapter 15)
Next: Next: ERM for Energy Firms (Chapter 17)