APRA Chair Wayne Byres - Speech to the 2020 Forum of the Risk Management Association

Watching out for swans

Thank you for the invitation to again be part of this year’s forum. 

If ever there was a year when risk managers proved their worth, this was it. We began 2020 battling a once-in-a-century bushfire catastrophe and end it in the midst of the greatest global health crisis since the Spanish Flu, and the most serious economic downturn since the Great Depression. From a Black Summer to a black swan, it’s been a very testing year.

The origin of the black swan metaphor dates back hundreds of years to when western Europeans believed all swans were white – because in western Europe they were. Writing on the mythology of black swans in 2016, author and biologist Tim Low notes that “in medieval Europe, unicorns had more credibility.” Yet in 1697, Dutch explorers charting the coast of what’s now Western Australia discovered that the existence of black swans was rather less impossible than Europeans had presumed.

The field of risk management is replete with references to “black swan” events: events that are high impact, but completely unexpected. COVID-19 is often regarded as such – how often have you heard the term “unprecedented” to describe the events of 2020? Yet the regular occurrence of “black swan” events – well beyond the frequency suggested by the tail of a statistically convenient normal distribution – means we all need to be ready for the unexpected. 

That is not a particularly insightful comment. It is, however, producing a subtle but important shift in regulatory thinking. 

To illustrate the point, in the post-GFC period, the emphasis of the international reforms was on strengthening the global financial system. Now, the narrative is how to improve its resilience. A perusal of APRA speeches and announcements over time shows a much greater emphasis on resilience in more recent times as well.

What is behind this shift? Put simply, it is possible to be strong, but not resilient. Your car windscreen is a great example – without doubt it is a very strong piece of glass, but one small crack and it is irreparably damaged and ultimately needs to be replaced. That is obviously not the way we want the financial system to be. We want a system that is able to absorb shocks, even from so-called “black swan” events, and have the means to restore itself to full health.

In saying that, financially strong balance sheets undoubtedly help provide resilience, and safeguarding financial strength will certainly remain the cornerstone of prudential regulation and supervision. But it is not the full story. So with that in mind, let me offer some quick reflections on the past year, and what it has revealed about opportunities for the resilience of the financial system to be further improved.

Capital

I’ll start with capital which, as I said, remains the cornerstone of prudential regulation for banks and insurers. Thankfully, Australia went into 2020 with financial firms that were soundly capitalised. That was a product of years of steady capital build, especially for banks, reflecting the lessons of a previous “black swan” – the global financial crisis.

On the whole, that capital strength has served its purpose well. It has instilled confidence in the health of financial firms, and provided comfort that the inevitable losses flowing from the severe economic shock can be absorbed without jeopardising their underlying viability.

What we have seen, however, is that the capital framework could possibly be improved in a couple of areas to make the system more resilient. The first is a relook at the buffer framework, to make it easier to use capital buffers without unintended consequences. And a second, related issue is the role of Additional Tier 1 instruments (AT1) in providing loss absorbing capacity. Experience over the past year has raised questions as to whether these instruments are capable of providing the loss absorbing capacity they are designed to achieve. 

A redesign of the buffer framework is an important part of our next package of bank capital reforms, which we hope to release for consultation next week. Capital buffers are built up in good times to be used when needed, and we will be proposing to make buffers a more prominent part of the capital framework going forward. The role and impact of AT1 instruments is being discussed internationally, and while we will not be proposing any changes in our consultation package next week, we will be watching how this broader debate plays out. 

Beyond regulation, another opportunity relates to capital planning. Stress tests have formed an important tool in our risk management arsenal, giving us confidence there is sufficient capital held within the industry, as well as aiding our guidance on dividends. To be truly valuable, however, firms need to conduct regular and varied stress tests, rather than rely on a single scenario or result, and ensure they are better integrated with recovery planning. As important as it is to understand the ability to absorb losses, it only answers half the question: true resilience also requires a credible plan to restore the loss absorbing capacity after it has been utilised. 

Liquidity

Liquidity has been another area of prudential focus. Given the extreme market volatility earlier in the year, that was not surprising for banks, but the issue also came unexpectedly to the fore for the superannuation sector with the Government’s decision to temporarily implement an expanded early release scheme.

The Reserve Bank intervened early and strongly as COVID-19 took hold to make sure the financial system as a whole had plenty of funding and liquidity. But that did not mean there weren’t challenges for individual firms and funds. The superannuation sector, used to a stream of steady and predictable cash flows, had to grapple with a large, sudden and unexpected outflow. Banks benefited from that outflow from superannuation into household deposits, but on the other hand had to deal, for example, with a strong demand to redeem negotiable certificates of deposit (NCDs) well before their contractual maturity. 

At the heart of the challenges experienced are behavioural assumptions that did not hold up. Risk management and prudential regulation, however, are both built on behavioural assumptions. The Liquidity Coverage Ratio, for example, is built on assumptions of likely stressed outflows over a one-month time horizon. But what about when those assumed stress flows prove inadequate? And what about liquidity needs sitting just beyond the one-month window? Both are issues on which we need to reflect on and consider whether – without seeking to raise requirements – we can adjust the framework to make the system more resilient to liquidity stress.  

Credit risk

When it comes to credit risk, provisioning has been bolstered but we are yet to see much in the way of actual losses despite the scale of the economic shock. That reflects three key factors: (i) the strengthening of credit practices in the past decade following the GFC, (ii) the unprecedented and coordinated government intervention in response to COVID-19, and (iii) the impact of loan deferrals and similar programs (e.g. rental holidays provided by landlords). Together, these factors will mean some credit losses we might have otherwise expected will be avoided altogether, and some will be delayed. Hopefully, it will be a lot of the former and not so much of the latter, but we just don’t know yet – so a cautious approach to provisioning continues to be warranted.

For the credit risk manager, therefore, the key issue is not what has happened so far, but what is yet to come. And it is not just a matter of which businesses get back on their feet after an economic shutdown. It is also a question of the structural changes that will persist post-COVID. For example:

• new ways of working leading to fundamental shifts in the value of office space; 
  
   
• reduced attractiveness of central business districts as places to work and shop;
  
   
• digitisation and shifts in business models favouring some businesses and industries over others;
  
   
• less need for business travel, with negative flow-on effects to associated industries; and 
  
   
• possible population shifts away from major cities towards suburban or regional and rural areas. 

None of these possibilities is necessarily negative or undesirable of itself. Yet even if we don’t yet know the details, I think we can say with confidence there will be change, and with change there will inevitably be winners and losers. As risk managers, your credit risk policies, portfolio limits and underwriting practices will need to respond. Your risk models will also need to be re-examined. However, it is important you think about the big shifts occurring in a way that doesn’t involve simply avoiding the risk. One of APRA’s guiding philosophies has been to make sure our prudential response to the crisis continues to promote the flow of credit. Everyone needs to play their role to avoid the collective action problem that would arise from risk aversion taking hold across the board – we will all end up worse off and make the system less resilient if we all seek to avoid risk altogether.

Operational and cyber risks

On the operational front, COVID-19 has been a real-world test of operational risk management practices. Whether it has been the shift to remote working, the rapid switch to digital delivery of services, or the operational strains that have come from a need to rapidly ramp up activity levels (such as for the need to process early-release-of-superannuation monies), I’m pleased to say the financial sector has done a good job. From the community’s perspective, the system has operated pretty seamlessly despite the disruption COVID-19 caused.

Of course, whether the virus is technically a “black swan” event is debatable. Its arrival was certainly a surprise, and its impact massive. Yet given SARS in 2003, H1N1 (swine flu) in 2009, and MERS in 2013, risk managers should not have been caught off guard by the emergence of a pandemic. Indeed, in Australia we have had prudential guidance on pandemic planning for more than a decade, and it has proved its worth over the past year. 

What’s important now is that we don’t rest on our laurels. The system has been operationally resilient, but like a swan (black or white) gliding across a lake, the apparent calm on the surface has belied a frenzy of activity below as boards, managers, technicians and frontline staff scrambled to find urgent responses to unexpected issues. In managing these risks at scale and at speed, new risks have sometimes been created that also need to be mitigated against and managed. 

It’s a similar story on cyber security. As my colleague Geoff Summerhayes observed in a speech last week, in prioritising their ability to keep operating, many of the firms we regulate needed to make compromises to their normal protocols. That was necessary, but these short cuts and process over-rides create risks, and not all have been subsequently addressed. It’s essential these gaps are identified and plugged as quickly as possible.

Overall, the positive outcomes so far on the operational front have been a combination of long-term planning and investment, on-the-spot ingenuity and judgement, and an element of luck. To make the system resilient to future shocks, we need to minimise our reliance on the latter, and make sure the very many valuable lessons from the past year are built into our contingency planning for the future. We will be updating our prudential standards in this area to provide an important foundation for this. 

A truly resilient system should not need compromises in operational and cyber security controls to be able to continue to provide its services in the face of a crisis. That should be our collective goal.

People

For all its procedures, technology and infrastructure, financial services – and prudential supervision – are still ultimately dependent on people. The human cost of the crisis has been significant, with a major investment in supporting staff wellbeing being needed across the board. 

While there have been some definite wins from an extended period of remote working – such as the breakdown of geographic and hierarchical barriers and a significant degree of innovation and creativity – the past year has negatively impacted communication, collaboration and social interaction, made organisational culture improvements more challenging, and resulted in diminished capacity for human capital development. All of this would be tolerable if the disruption was short, and things quickly went back to normal. But that is not going to happen. 

Obviously, this is an audience of risk managers, not human resource experts. But the people-related risks from the extended period of disruption are very real. They will impact on organisational performance, operational controls, and risk culture – all critical to good risk management and organisational resilience. So to perhaps state the obvious, as risk managers you need to very much have them in your sights.

Climate

Finally, as summer returns again and those of us on the east coast have just experienced our first heatwave, we are reminded that 2020 was not just a year of COVID-19. The start of 2020 was marked by multiple natural catastrophes: the Black Summer bushfires, followed by extreme storms and floods. Looking ahead, the latest State of the Climate 2020 report from the CSIRO and Bureau of Meteorology paints a stark picture: warming temperatures; an increase in extreme fire weather; a drier continent in areas of greatest population density; changing rainfall patterns with more intense heavy rainfall events; rising sea levels; and increasing acidification of the oceans around Australia. 

It is impossible for these events, and the changing government policies, investor preferences and community expectations that accompany them, not to have financial consequences. The Bank of International Settlements (BIS) has recently called the issue out internationally, with its report titled The Green Swan: central banking and financial stability in the age of climate change.

At APRA, we have not sought to prescribe how climate-related risks should be managed, but we most definitely see a thorough understanding of climate-related risks as essential for a resilient financial system. Whether it is insurers underwriting weather events and physical risks, a bank lending to finance business development, or superannuation trustees investing for long-term return, climate-related risks need to be factored into decision-making and risk management. Our plans to release a Prudential Practice Guide on managing climate-related financial risks, and undertake a vulnerability assessment, are designed to avoid being caught off-guard on this front.

Concluding remarks

Describing an event as a “black swan” might seem a bit of creative imagery, but there are dangers in portraying negative events as incredibly rare: it is too easy to use it as an excuse for failing to prepare. Moreover, the preponderance over time of so-called “black swan” events – like the real black swans themselves – show that they are not really a rarity. 

The exact nature of each event might differ, but the frequency with which the unexpected comes along shows why we need to do all we can to build resilience. We do not know where or when the next big disruptive event will come from, but we know it will inevitably come. Nor can we hope to predict the precise scenario – we just know we need to be ready for sudden, severe and unexpected events. 

After all, if we’ve learnt anything over the past year, it’s to expect the unexpected!