Many banks still suffer from chronic underinvestment in the analytical tools required for measuring risk, while others are still figuring out how to translate data into key decisions used in everything from the loan-approval process to executive pay practices.

Those were the findings of a recent survey of 19 global financial institutions by the Risk Management Association and the consulting firm Oliver Wyman, which found that firms with the best track record of risk management had made early commitments to state, and stick to, their defined-risk appetites. The laggards undermined their own efforts on this front by failing to get senior executives to rally around the cause, by straying from "acceptable" geographic or product bounds, or by compromising the role of risk management in their organizations.

RMA Research Director Mark Zmiewski spoke with American Banker about why banks must communicate their risk appetites, and how they can turn analysis into action. A condensed version of the interview follows.

What are the biggest risk management challenges banks still face?
One is the investment in the data capture and the quality of data that's available, and the resources that are available at a bank to aggregate and benchmark that information across the entire institution. [Another is determining] risk-adjusted measures to drive business decisions and for compensation purposes. More banks are in the midst of doing it, or attempting to do it, and that goes hand in hand with your ability to capture the right data and come up with the right analytics.

For banks that have the data, what is the next step?
It sounds simple, but it's really all about how you internally and externally communicate your risk and what your risk tolerance is. [Banks] clearly haven't done as good a job as is now being required of them by regulators, by politicians, by accounting entities, by the stock market.

Where are they falling short in that regard?
It's less of an issue of understanding how much risk you're willing to take, and more a question of what metrics you use to explain that to employees, shareholders and others. Banks are in business to take on risk, so the question becomes: Are you rewarded for taking those risks and are the risks appropriate? [Banks are still] trying to quantify risks through hard analytics, or even just qualitatively describing risks, so that throughout an organization it is understood. A lot of the energy is going into that effort to just articulate the risk.

How can banks "articulate" their risk appetite?
You can be very mechanical about it, very analytical, and express it in terms of how much in earnings you have at risk or are willing to risk. You can express it in terms of [acceptable] writeoffs, or the impact on earnings per share. You also can express it — and clearly those we've seen and feel are doing a good job at it are doing this — by matching the mathematical assessments with qualitative measurements. They're the ones saying, "These are the types of businesses or products that we do or do not want to be involved in." They are common-sense measures that people can grasp. You can generate all the numbers in the world, but [banks need] ways to translate those numbers into words that people can really understand.

Does the appetite need to be fluid to account for different legs of the credit or economic cycle?
Well, there's one school of thought that says it should be broad enough and inclusive enough that it stands the test of time, like your core values — they don't fluctuate in good or bad times.

Did you come away from this survey feeling up or down about the industry's progress?
I think it should give us hope. It should be very positive from the standpoint that what [this crisis] has caused institutions to do is carry on a dialogue with many different constituents. There's a discussion now around what is acceptable, what's unacceptable, are we making good decisions to be in certain lines of businesses or to offer certain types of products, and do they fit with who we as the organization want to be.

Then the discussion is cutting across areas beyond risk management?
In having a conversation about risk appetite you're having a conversation about a lot of different things. It is a key connector for governance issues, data gathering, risk-adjusted weightings, compensation and so on. What we found is you could have all the numbers and all the measurement systems in place and reports available for people to use, but it's really the application of the risk organization's capabilities that really makes things work.

So culture matters?
That really became apparent in our survey. Those with strong, actively managed risk cultures seemed to perform a little bit better in the crisis so far. Those with strong capabilities but perhaps less intensive cultures, they readily admitted that they should have done better. The missing piece was the translation of the capabilities into the decisions. That's where risk culture comes into play.

Sounds like a lofty goal.
The thing about risk management is, there really is no definitive end point to it, with scheduled deliverables where we can check off the boxes and say we're done. It's really a journey.