![Scatter plot of risk culture score against adjusted CET1 ratio [bps] Notes: Four values greater than −200 bps are present with no relationship to the risk culture score (black). These outliers will be winsorised to −200 bps, which corresponds to the variable's 5% quantile.](https://www.researchgate.net/profile/Sebastian-Fritz-Morgenthal/publication/327601279/figure/fig2/AS:670019759390736@1536756567686/Scatter-plot-of-risk-culture-score-against-adjusted-CET1-ratio-bps-Notes-Four-values_Q320.jpg)
Content uploaded by Sebastian Fritz-Morgenthal
Author content
All content in this area was uploaded by Sebastian Fritz-Morgenthal on Sep 12, 2018
Content may be subject to copyright.
Delivered by Publishing Technology to: julie simkins
IP: 185.24.85.49 On: Mon, 22 Feb 2016 18:44:06
Copyright: Henry Stewart Publications
© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 1 71–84 Journal of Risk Management in Financial Institutions 71
Does risk culture matter? The relationship
between risk culture indicators and stress
test results
Received: 3rd December, 2015
Sebastian Fritz-Morgenthal
is a partner at LEADVISE Reply, a management consultancy boutique, and a lecturer in risk management and regulation at Frankfurt
School of Finance and Management. He holds a diploma in physics from the University of Hamburg and a PhD in nuclear physics from
JW-Goethe-University, Frankfurt.
Frankfurt School of Finance & Management, Sonnemannstraße 9-11, 60314 Frankfurt am Main, Germany
E-mail: Sebastian.g.fritz@gmx.de
Julia Hellmuth
is an account manager at SEB AG, client coverage — corporates, with focus on multinational corporations. She holds an MSc in finance
with focus on risk management.
E-mail: juliahellmuth@hotmail.de
Natalie Packham
is an assistant professor of quantitative finance at Frankfurt School of Finance & Management. She holds an MSc in computer science
and a PhD in quantitative finance. Natalie is a member of the GARP Research Fellowship Advisory Board.
E-mail: n.packham@fs.de
Abstract A strong risk culture is generally thought to be valuable to an institution as it is
said to strengthen the institution’s resilience. Can this claim be substantiated? In our research,
we show that quantitative and qualitative risk culture indicators can be identified. Using a
comprehensive dataset comprising 81 European banks, two scores are developed: a score for
risk culture based on risk culture indicators, and a stress test score based on the 2014 ECB
stress test outcome. Two hypotheses are tested: first, is there a relationship between the risk
culture score and stress indicators (in this case, derived from the 2014 ECB stress test)? The
results confirm that a relatively better stress test result corresponds to a better risk culture
of a financial institution: two quantitative ratios, the leverage ratio and a variable quantifying
adjustments derived from the AQR, entail significant explanatory power. Secondly, which
individual risk culture indictors best explain the individual results of the ECB stress test?
The qualitative factors showing a high significance are ‘governance’ and ‘other effects’,
which include, for example, one-off effects.
Keywords: risk culture, stress testing, regulatory requirements, risk framework, financial
institutions, AQR
Delivered by Publishing Technology to: julie simkins
IP: 185.24.85.49 On: Mon, 22 Feb 2016 18:44:06
Copyright: Henry Stewart Publications
Fritz-Morgenthal, Hellmuth and Packham
72 Journal of Risk Management in Financial Institutions Vol. 9, 1 71–84 © Henry Stewart Publications 1752-8887 (2016)
INTRODUCTION
In the aftermath of the 2008 financial crisis,
regulators and industry identified four major
shortcomings of the existing f inancial system and
its regulatory framework1:
(1) the identification and measurement of risk has
big gaps;
(2) the capital and liquidity of banks is too low;
(3) ailing institutions are non-resolvable; and
(4) risk governance and culture seem to be weak.
Significant public resources were used for the rescue
of banks to avoid an uncontrollable financial crisis
and global recession. To avoid this for the future, the
regulatory framework needed a major overhaul.
EMIR,2 Basel 2.5 and 3 and the respective EU
legislation (ie CRD IV3) cover the first two issues.
Trading has to be cleared via central counterparties
(CCPs) or at least registered via a standard protocol.
More types of risk are included in the regulatory
framework (eg incremental default risk in trading
book, interest rate risk in the banking book, conduct
risk), minimum capital requirements are increased,
the composition of capital is strengthened, and
additional minimum liquidity requirements are
established via the introduction of liquidity coverage
ratio (short-term) and net stable funding ratio (mid-
term), respectively.
With too-big-to-fail rules, such as the Banking
Recovery and Resolution Directive (BRRD4) in
the EU, banks should be transformed into resolvable
institutions without causing major repercussions to
the financial markets. This is achieved by bailing-in
equity and debt holders and — additionally if needed
— splitting the ailing bank into parts (eg rump bank
and bridge bank, asset sale), all of which should be
executable without the use of taxpayers’ money.
A better measurement of risk, higher capital
and liquidity cushions and a better resolvability
do not necessarily improve the risk management
of a bank. One is tempted to say that this can be
achieved only if an appropriate risk culture is in
place. In contrast to risk types, a formal definition
of risk culture is difficult. Without a formal
definition, the identification and measurement of the
quality of risk culture seems to be barely possible.
The frequently used bon mot: ‘I know it is good risk
culture when I see it’5 can certainly not ser ve as a
formal def inition.
Besides the established concept of segregation
of duties between taking risks, monitoring and
oversight of risks and auditing risks6 (usually called
the ‘three lines of defence’ model), regulators have
implemented rules to sanction the excessive risk-
taking behaviour of bankers and senior managers in
the financial industry. One example is the regulation
of bankers’ salaries and bonus caps at 100 per cent
of the base salary within the EU (part of CRD IV;
further directive given by the EBA7). In fact, recent
research shows that the regulation of bonus payments
is a necessary condition to achieve an alignment
of risk incentives.8 Another example is the reversal
in burden of proof for the senior management of
an institution. Regulators no longer need to prove
lack of controls in case of a breach of rules, but
senior managers have to prove that they have done
everything they could to ensure the rule-consistent
behaviour of their staff. Lack of control has become
a criminal offense in some EU countries such as
Germany9 and the UK.10 Both types of rules work
under the assumption that sanctioning individual
misbehaviour will improve the risk culture of the
whole enterprise.
How can risk culture be identified and measured?
In our view, the aim of a good risk culture is not
to avoid taking risks in general, since this would
abrogate the overall banking business model. Instead,
risk culture is about taking those valuable risks a
financial institution is able to bear, to assess and, as
a result, manage these risks in a way appropriate for
the specific bank and its stakeholders. Consequently,
banks should be able to choose their individual,
optimal risk levels and methods to handle these
risks such that a profitable and sustainable business
strategy can be achieved.11
In 2013, the Financial Stability Board (FSB)
published a framework for assessing risk culture from
a supervisory perspective.12 The FSB puts four areas
into focus:
(1) the top;
(2) accountability;
(3) effective communication and challenge; and
(4) incentives.
Delivered by Publishing Technology to: julie simkins
IP: 185.24.85.49 On: Mon, 22 Feb 2016 18:44:06
Copyright: Henry Stewart Publications
Does risk culture matter?
© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 1 71–84 Journal of Risk Management in Financial Institutions 73
A 2014 survey of EY on 52 banks adds a solid three
lines of defence framework and a risk appetite
statement in all business lines to the list of effective
indicators for good risk culture.13 These areas can
be assessed as part of external audit or supervisory
review work. It is, however, a challenge to identify,
assess, measure and compare such indicators from
publicly available information.
The Group of Thirty proposes a framework for bank
culture and governance.14 Values and ethics as well as
conduct and behaviour provide the input, reputation
and trust the outcome. Based on their analysis, the
group draws the conclusion that risk culture can be
strengthened by shifting toward long-term economic
goals, embedding and challenging quantitative methods
in risk management, governed by strong oversight from
an adequately qualified executive and supervisor y board.
Sheedy and Griff in15 present an approach
to measure risk culture in institutions by using
structured questionnaires and mapping them against
the specifically developed Macquarie University Risk
Culture Scale. They find a variance of risk culture
within an individual institution as well as between
institutions. The analysis does not, however, map
the variance in risk culture as defined by their scale
towards an independent measure such as risk costs,
P&L volatility, sensitivity towards stress scenarios, etc.
Andrew W. Lo16 suggests developing ‘an
empirically based methodology for predicting
individual and group behaviour to some degree as a
function of observable systematic and idiosyncratic
factors’. Finding and calibrating such a function is
difficult in practice, however, if possible at all.
We choose a different approach. We define a
number of risk culture indicators (RCIs), which —
based on publications such as the ones mentioned
above6,11–14 — we deem to be relevant for identifying
the quality of risk culture in a specific bank from a
top-down perspective. For each bank, we extract a
bank-specific score for each indicator from the bank’s
published reports. For validating these individual RCI
scores, we map them against the output of a common
event for all banks in the sample, namely the result of
the Comprehensive Assessment on Eurozone banks
which was executed by ECB and EBA between
November 2013 and October 2014.
Our approach to deriving RCI scores and stress
test scores is described in detail in the next section.
In the following section, we present the results of
our quantitative analysis. We conclude in the final
section.
STRESS TEST AND RISK CULTURE
SCORES
The analysis puts a focus on the 81 ECB stress-tested
banks within the countries of Austria, Belgium,
Estonia, Finland, France, Germany, Latvia, Lithuania,
Luxemburg, the Netherlands, Slovakia and Slovenia.
We have excluded the banks of stressed countries
with regard to support by the EFSF or other EU
mechanisms in the years 2013/2014 (Greece, Ireland,
Italy, Portugal, Spain and Cyprus) and where a
significant number (if not all) of the participating
banks had quite extreme stress test results. Further,
we have excluded Malta (only one bank, which is a
subsidiary of Deutsche Bank) as well as Poland and
Ukraine, both of which are not part of the Eurozone.
In order to build the risk culture score and the stress
test score, we applied methods that are well established
in other f ields, see Cohen et al.17 or Hofstede et al.18
Risk culture score
The RCIs are derived manually and assessed
from publicly available annual reports, disclosure
reports and corporate social responsibility (CSR)
reports published by the evaluated banks. The
primary reason for using this data basis is its public
availability and — although to a somewhat lesser
extent — comparability. For the overall evaluation a
five-level scale ranging from one to five was applied.
Every subcategory was ‘rated’ in accordance with
this five-level scale. A score grade of five indicates a
very good result, four a good, three indicates an
average or neutral result, two a rather weak and one
a bad result. The sum of the individual RCI scores
yields the risk culture score per bank.
The RCIs to assess the degree of risk culture
present in a f inancial institution comprise the
following nine subcategories:
(1) regulatory requirements;
(2) business strategy;
(3) governance;
(4) portfolio;
(5) employees;
Delivered by Publishing Technology to: julie simkins
IP: 185.24.85.49 On: Mon, 22 Feb 2016 18:44:06
Copyright: Henry Stewart Publications
Fritz-Morgenthal, Hellmuth and Packham
74 Journal of Risk Management in Financial Institutions Vol. 9, 1 71–84 © Henry Stewart Publications 1752-8887 (2016)
(6) risk strategy;
(7) reputation;
(8) other effects; and
(9) cultural indicators.
The specific characteristics of each RCI and associated
score value are shown in Table 1.19 Distributional
properties for each RCI in our sample are shown in
Figure 1.
Figure 1: Box-whisker-plots for risk culture indicators
Notes: The boxes capture the interquartile range of the data separated by the median, which is shown in white (the median of
‘OtherEffects’ is 3). The whiskers capture the remaining data, with outliers plotted as dots. Outliers are defined as observations that lie
beyond 1.5 times the interquartile range.
RegulatoryRequirem
Strategy
Governance
Portfolio
Employees
RiskStrategy
Reputation
OtherEffects
CulturalIndicators
1 2 3 4 5
Table 1: Specification of risk culture indicators
Category Main characteristics
1 Regulatory requirements Level of concordance with basic regulatory requirements with regard to risk management.
2 Business strategy Check whether the bank has a well-defined, sustainable business and risk strategy so
that potential risks can be identified.
3 Governance Categorises if appropriate senior management to operate the business and an adequate
supervisory authority to govern the bank are in place.
4 Portfolio Considers selected balance sheet related figures assumed as relevant artefacts for the
quality of a bank’s risk culture.
5 Employees Measures average completed training hours of employees and employee fluctuation.
6 Risk strategy Checks if appropriate risk governance and processes as eg committees are in place and
what different risks are considered as relevant for the specific bank. Also the handling of
individual risks is taken into account.
7 Reputation Asks if banks make a statement about their reputation and related risks. Litigations and
their transparent disclosure are scored.
8 Other effects One-off effects/events related to risk management and risk culture are considered.
9 Cultural indicators Behavioural indicators and attitudes recognisable in the reports.
Delivered by Publishing Technology to: julie simkins
IP: 185.24.85.49 On: Mon, 22 Feb 2016 18:44:06
Copyright: Henry Stewart Publications
Does risk culture matter?
© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 1 71–84 Journal of Risk Management in Financial Institutions 75
Figure 2: Box-whisker-plots for stress test indicators
Notes: The boxes capture the interquartile range of the data separated by the median shown in white. The whiskers capture the
remaining data, with outliers plotted as dots. Outliers are defined as observations that lie beyond 1.5 times the interquartile range.
Stress test data and stress test score
For each institution, the risk culture score is
compared to the corresponding specific stress test
results using the publicly available stress test data
and results from the European Central Bank (ECB)
published in October 2014.20 In addition, a stress
test score is derived by a similar approach to the risk
culture score, with individual stress test indicators
per bank placed in categories ranging from one to
five.21 Again, the sum of all stress test indicators
provides the overall stress test score per bank.
To determine individual stress indicators and
the respective aggregated stress test score, we have
chosen the following variables from the results of the
ECB Comprehensive Assessment22:
(1) net prof it, respectively total loss divided by
total assets;
(2) CET1 capital divided by total assets;
(3) total risk exposure divided by total assets;
(4) CET1 ratio;
(5) leverage ratio;
(6) N PE ratio;
(7) aggregated adjustments due to the outcome of
the AQR;
(8) AQR-adjusted CET1 ratio;
(9) adjusted CET1 ratio after baseline scenario;
CET1CapTotAssets
CET1Ratio
LevRatio
NPERatio
AQRadjCET1Ratio
CET1afterAdveScen
To
tRiskExpTotAssets
0.0 0.2 0.4 0.6 0.8
NetProfitTotAssets
AggregCapShortfallMEUR
AdjCET1RatioBps
AdjBaselineScenBps
AggregAdjAdverseScenBps
−0.15 −0.10 −0.05 0.00
−2000 −1500 −1000 −500 0
0 200 400 600 800
(10) aggregate adjustments due to the outcome of
the adverse scenario of the joint EBA ECB
stress test to lowest capital level over three-year
period;
(11) adjusted CET1 ratio after adverse scenario; and
(12) capital shortfall (for the score, the shortfall enters
as follows: yes = 1, no = 5).
Distributional properties of the stress indicators are
shown in Figure 2.
RELATIONSHIP BETWEEN STRESS
TEST OUTCOME AND RISK
CULTURE
Model
As the stress test and risk culture data are obtained
from different sources, a natural question that arises
lies in understanding the relationship between the
data. One would expect or hope that a financial
institution with an established risk culture would
also perform well in stress testing, and vice versa.
The individual stress test and risk culture indicators
as well as the corresponding scores developed in the
previous section serve as the input data in order to
analyse the respective relationships in a quantitative
Delivered by Publishing Technology to: julie simkins
IP: 185.24.85.49 On: Mon, 22 Feb 2016 18:44:06
Copyright: Henry Stewart Publications
Fritz-Morgenthal, Hellmuth and Packham
76 Journal of Risk Management in Financial Institutions Vol. 9, 1 71–84 © Henry Stewart Publications 1752-8887 (2016)
way. More specifically, two linear models are
postulated:
RCS = α + ∑
i = 1
n
βi Xi
ST + εRCS, (1)
where RCS denotes the risk culture score, X1
ST, ... , Xn
ST
are the stress test indicators, α, β1 , ... , βn are the
coeff icients that determine the relationship and εRCS
is a random variable describing those contributions
to the risk culture score that are not determined by
the stress test indicators. Likewise,
STS = α + ∑
i = 1
m
βi Xi
RC + εSTS, (2)
where STS denotes the stress test score, X1
RC , ... , Xm
RC
are the RCIs, α, β1 , ... , βm are the coefficients that
determine the relationship and εSTS is the stress
test specific component not described by the RCIs.
To ease notation, we use the same notation for the
coeff icients in equations (1) and (2).
Three questions are of main interest:
• Which of the explanatory variables have
significant coefficients, that is, p-values of 0.1 or
below?
• Are the coefficients associated with the significant
explanatory variables economically feasible?
• What is overall statistical fit of the model,
expressed by the coefficient of determination R2?
Recall that the p-value associated with coefficient
βi serves to accept or reject the hypothesis that the
true coefficient is 0. More specifically, the p-value
denotes the probability of attaining a coefficient
as extreme (away from 0) as observed under the
assumption that there is no relationship between the
explanatory variable and the dependent variable
(the respective score). Significance of coefficients
is the key criterion to identifying explanatory
variables: even if an explanatory variable does not
explain a lot of variability, a high significance
indicates the presence of a statistical relationship
between the independent and the explanatory
variable under consideration.
The coeff icient of determination R2 determines
whether the model is suitable for forecasting or for
predicting the scores of further financial institutions
given the explanatory data.
Results
Risk culture score
Some of the stress test indicators to be used as
potential explanatory variables for the risk culture
score are highly correlated (ie have correlations
greater than 0.9; see Table 2), so in order to
eliminate multicollinearity effects, the ‘AQR
adjusted CET1 ratio’ and the ‘Adjusted CET1 after
adverse scenario’ are eliminated, but one needs to
understand the ‘CET1 ratio’ to be a proxy for the
two variables. Also, the ‘CET1Capital to total assets
ratio’ is eliminated from the analysis due to the high
correlation with the ‘Leverage ratio’.
Next, the analysis of the data indicates that the
‘adjusted CET1 ratio expressed in bps’ has a number
of outliers. These are shown in Figure 3. The
institutions associated with the outliers are
• Argenta Banken Verzekeringsgroep (Belgium);
• Norddeutsche Landesbank-Girozentrale
(Germany);
• Landwirtschaftliche Rentenbank (Germany);
• SID — Slovenska izvozna in razvojna banka
(Slovenia).
Table 2: Correlations among some of the stress-testing variables that act as explanatory variables for the risk culture
score
CET1Ratio LevRatio AQRadjCET1Ratio CET1CapTotAssets CET1afterAdveScen
1.0 0.2459 0.9964 0.2066 0.9187 CET1Ratio
1.0 0.2306 0.9494 0.4301 LevRatio
1.0 0.1882 0.9267 AQRadjCET1Ratio
1.0 0.3773 CET1CapTotAssets
1.0 CET1afterAdveScen
Notes: Correlations greater than 0.9 are bold.
Delivered by Publishing Technology to: julie simkins
IP: 185.24.85.49 On: Mon, 22 Feb 2016 18:44:06
Copyright: Henry Stewart Publications
Does risk culture matter?
© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 1 71–84 Journal of Risk Management in Financial Institutions 77
The difference between the CET1 ratio and the
adjusted CET1 ratio is a result of the assessment
of each bank’s loan book by the respective
national competent authority. Since the basis of
the assessment is figures that are signed off by the
respective external audit firms of the banks, one
would rather expect small downward adjustments
from the assessments. Each of the four outlier
institutions has specific reasons for its respective high
downward adjustment. For further reference, we
refer to the four banks’ individual disclosure of the
ECB Comprehensive Assessment results.
Because of the distorting nature of outliers
in least-squares estimation, the variable
AdjCET1RatioBps is winsorised to −200bps, ie the
overshooting data points are truncated to −200bps,
where the truncation level corresponds to the
variable’s 5 per cent quantile.
The regression results are shown in Table 3.
Model (1) shows the results when all stress test
indicators are included (except for those dropped
because of high correlation). Model (2) shows the
result when eliminating all insignificant variables
except AggregCapShortfallMEUR, which denotes
40
30
20
10
0
CultureScore
−500 −400 −300 −200 −100 0
AdjCET1RatioBps
Figure 3: Scatter plot of risk culture score against adjusted CET1 ratio [bps]
Notes: Four values greater than −200 bps are present with no relationship to the risk culture score (black). These outliers will be
winsorised to −200 bps, which corresponds to the variable’s 5% quantile.
the amount of capital shortfall in case the institution
fails the stress test. This variable serves as a control
variable for passing or failing the stress test and is
therefore retained in the regression.
The results from Model (2) indicate two potential
quantitative drivers for risk culture:
(1) higher leverage ratio and
(2) lower relative total risk exposure.
Both outcomes correspond on average to a higher
risk culture score. Hence, our analysis suggests that
banks with a better risk culture are represented
by a better overall capitalisation as well as a lower
overall total risk exposure. The coefficients of the
significant indicators can be interpreted as follows:
on average, an increase of the leverage ratio by one
percentage point corresponds to an increase of the
risk culture score of approximately 0.3219 points.
On the other hand, increasing the relative risk
exposure by 10 percentage points corresponds to a
risk culture score that is lower by 0.4519 points.
Our analysis therefore supports the regulatory
authority’s approach to using the leverage ratio for banks
Delivered by Publishing Technology to: julie simkins
IP: 185.24.85.49 On: Mon, 22 Feb 2016 18:44:06
Copyright: Henry Stewart Publications
Fritz-Morgenthal, Hellmuth and Packham
78 Journal of Risk Management in Financial Institutions Vol. 9, 1 71–84 © Henry Stewart Publications 1752-8887 (2016)
Table 3: Regression of risk culture score on stress test
indicators
Dependent variable:
CultureScore
(1) (2)
Const 28.88** 27.87**
(1.285) (0.8270)
[0.0000] [0.0000]
NetProfitTotAssets (1) −23.34
(25.31)
[0.3595]
TotRiskExpTotAssets (3) −5.202 −4.519*
(3.302) (2.585)
[0.1196] [0.0845]
CET1Ratio (4) −7.046
(7.900)
[0.3755]
LevRatio (5) 44.95** 32.19**
(19.14) (13.01)
[0.0217] [0.0156]
NPERatio (6) −25.78*
(14.27)
[0.0751]
AdjCET1RatioBps (8) −0.01375
(0.0087)
[0.1193]
AdjBaselineScenBps (9) −0.003810
(0.0038)
[0.3198]
AggregAdjAdverse
ScenBps (10)
0.0003688
(0.002258)
[0.8707]
AggregCapShortfall
MEUR (12)
0.002746 0.004023
(0.003939) (0.003466)
[0.4880] [0.2494]
R20. 164913 0. 081082
Notes: Numbers in parentheses following the variable names
correspond to the numbers assigned in the section on ‘Risk
culture score’. Standard errors are shown in parentheses;
p-values are shown in brackets. Model (1) contains all stress
test indicators except some that are highly correlated with other
variables. Model (2) contains only those stress test indicators that
remain significant when controlling for the capital shortfall, which
indicates in particular the success or failure of the stress test.
* and ** indicate significance at the 10% and 5% level, respectively.
as an additional regulatory metric combined with an
improved measurement of risk exposure — both being
introduced as part of Basel 3/CRD IV legislation.
The coeff icient of determination R2 is small in
both models, at 15 per cent and 8 per cent, so that
only little of the variation in the risk culture score is
explained by the factors from the stress test.
Stress test score
In the second model, the stress test score is regressed
against the nine RCIs. The results are given in
Table 4. This model has no issues with multicollinearity,
so all nine categories are included in the regression
analysis. Both (1) governance and (2) OtherEffects
are significant at the 5 per cent level.
In addition, the factor ‘CulturalIndicators’ is
nearly significant at the 10 per cent level, but a closer
analysis reveals that there is one outlier distorting the
result: Deutsche Bank has a high cultural indicator,
while at the same time achieving only a low stress
test score. When eliminating Deutsche Bank
(models (4), (5) and (6)) from the sample,
‘CulturalIndicators’ becomes insignificant. The results
for ‘Governance’ and ‘OtherEffects’ remain stable
throughout. A higher outcome in either of these
factors corresponds to a higher stress test score.
Having an appropriate, experienced and responsible
governance structure in place represents a good
indicator for an appropriate risk culture for the sample
under consideration. The relationship between the
stress test score and governance shows a positive
coeff icient between 2.5 and 3.0, which can be
interpreted as follows: an institution with a one grade
higher governance score (which ranges between
1 and 5) has, on average, a stress test score that is
2.5–3.0 points higher. This is indeed a very strong
result. This result supports the current regulatory
approach to strengthening governance structures of
financial institutions (eg FSB categories for an adequate
risk culture23). The current efforts of banks to optimise
their governance structures, especially with focus on
the management board to enhance the institutions’ risk
culture are supported by the results of our analysis. One
dare say that a better experienced senior management
together with an adequate supervisory body improves
the bank’s overall risk assessment.
Our analysis supports the interpretation that
negative one-off effects (which result in a low
‘OtherEffects’ score) are a valid representation of a
rather weak risk culture and hence a negative stress
Delivered by Publishing Technology to: julie simkins
IP: 185.24.85.49 On: Mon, 22 Feb 2016 18:44:06
Copyright: Henry Stewart Publications
Does risk culture matter?
© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 1 71–84 Journal of Risk Management in Financial Institutions 79
result. A possible interpretation is that banks, which
have as yet no adequate risk culture in place, need
to find an appropriate way to establish an adequate
risk management framework as well as to implement
a corresponding risk culture. Such a period, where
implementation of a risk strategy is still in f lux, shows
volatilities in the process landscape of a company.
Additionally, uncertainty plays a role and thus, one-off
effects occur. They also appear if a financial institution
is still engaged in solving the leftovers from the
financial crisis, such as banks still dealing with bailout
payments or other rescue plans and their reduction,
respectively. Nevertheless, the determinant may be
difficult to apply for explicit improvements for a
bank’s risk culture besides the aforementioned aspects.
As before, the coefficient of determination R2 is
too small in all models to make the model suitable
for prediction.
Table 4: Regression of stress test score on risk culture indicators
Dependent variable:
stress test score
(1) (2) (3) (4)
w/o DB
(5)
w/o DB
(6)
w/o DB
Const 29.43** 30.85** 26.05** 27.29** 29.57** 26.06**
(8.017) (5.455) (4.675) (8.097) (5.474) (4.594)
[0.0005] [0.0000] [0.0000] [0.0012] [0.0000] [0.0000]
RegulatoryRequirem −0.1641 −0.00763
(1.089) (1.087)
[0.8907] [0.9944]
Strategy −0.7760 −0.5762
(1.333) (1.330)
[0.5623] [0.6662]
Governance 2.888** 2.856** 2.451* 2.840** 2.922** 2.664**
(1.385) (1.300) (1.291) (1.375) (1.290) (1.274)
[0.0407] [0.0311] [0.0614] [0.0427] [0.0264] [0.0398]
Portfolio 1.282 0.9661
(1.870) (1.869)
[0.4950] [0.6069]
Employees 0.04346 0.1854
(0.7839) (0.7844)
[0.9559] [0.8138]
RiskStrategy 0.3339 0.6793
(1.498) (1.507)
[0.8243] [0.6535]
Reputation −0.3603 −0.3100
(0.6625) (0.6586)
[0.5883] [0.6393]
OtherEffects 2.053* 2.193** 1.709* 1.696 1.924* 1.540*
(1.113) (0.9626) (0.9276) (1.132) (0.9706) (0.9158)
[0.0692] [0.0255] [0.0693] [0.1388] [0.0511] [0.0967]
CulturalIndicators −2.443 −2.613 −2.017 −1.907
(1.841) (1.576) (1.852) (1.630)
[0.1889] [0.1014] [0.2800] [0.2456]
R20.1269 0.1104 0.078 0.1142 0.0985 0.0820
Notes: Standard errors are shown in parentheses; p-values are shown in brackets. Model (1) contains all risk culture factors. Model (2)
resp. (3), contains those risk culture factors that remain significant at the 11, resp. 10, per cent level. Eliminating Deutsche Bank from
the sample, which is an outlier in ‘CulturalIndicators’, reveals that CulturalIndicators is indeed insignificant. Significance and coefficients
of ‘Governance’ and ‘OtherEffects’ are stable throughout. * and ** indicate significance at the 10% and 5% level, respectively.
Delivered by Publishing Technology to: julie simkins
IP: 185.24.85.49 On: Mon, 22 Feb 2016 18:44:06
Copyright: Henry Stewart Publications
Fritz-Morgenthal, Hellmuth and Packham
80 Journal of Risk Management in Financial Institutions Vol. 9, 1 71–84 © Henry Stewart Publications 1752-8887 (2016)
CONCLUSIONS
In this study, we derive a number of results
regarding a financial institution’s risk culture. First,
we develop a score for risk culture based on nine
RCIs, including governance, strategy, risk strategy,
reputation and others, with data from financial
institutions’ publicly available information. Secondly,
we study the relationship of the RCIs and stress test
indicators derived from the recent ECB stress test
results. Our main findings are as follows.
We find significant relationships between the risk
culture score and the stress indicators, and likewise
there are significant relationships between stress
test scores and the RCIs. The coefficients of the
significant indicators confirm that a relatively better
stress test result corresponds to a better risk culture
of a financial institutions.
More specif ically, we find two quantitative
indicators and two qualitative indicators that entail
significant explanatory power for a bank’s individual
outcome of the ECB stress test and its risk culture
represented by nine categories. On average, a
higher leverage ratio as well as a lower risk exposure
(expressed relative to total assets) correspond to
a greater risk culture score. On the other hand,
banks with a better governance indicator achieved
a pronounced greater stress test score, and further
effects that cannot be attributed to any of the other
eight RCIs, such as one-off events, have a negative
impact on the stress test score.
In particular, the link between governance and
the stress test score is interesting: one aspect of
governance lies in the fact that senior management
can def ine and exert inf luence on a firm’s corporate
culture; the importance of corporate culture has
been noted by Lo,16 who studies the role of culture
in the financial industr y, eg ‘Corporate culture is
clearly a relevant factor in financial failure, error and
malfeasance’.
The analysis provides a starting point for
understanding which RCIs imply a strong or a weak
risk culture of a f inancial institution, respectively.
Although the results do not allow for a causal
interpretation,24 our findings provide evidence that
current regulatory action targets the appropriate
indicators — increasing leverage ratios as well as
targeting risk exposure relative to balance sheet
size — and one may therefore hope that these actions
will indeed help shape a more resilient financial system.
Risk culture is a vast field affecting various
management disciplines such as strategic focus,
financial discipline and balance sheet management,
but also employee motivation, and incentive
schemes. The findings above may help to establish
and strengthen banks’ risk cultures in the interest of
a sustainable business model, the overall industry,
the customers and, last but not least, the economy. It
may also help auditors and regulators to focus their
assessments.
Our analysis, as a snapshot of the current linkages
between risk culture and stress testing on European
banks, provides a starting point for further research
and analysis. The main challenge for determining
the risk culture score was the assessment of all
81 banks based on their public reports. Because the
information generation was a manual process, it
cannot be ruled out that some variability entered
the scores, due to individual judgment and selective
perception or different usages of language and
wording in the reports. Nonetheless, the results of
our analysis are strong enough to warrant some noise
in the data generated. Furthermore, the focus of the
data analysis was, mainly due to the AQR focus,
loan oriented. Assets and methodological approaches
not related to the banks’ credit portfolios are only
taken into consideration to a limited extent. Business
models of non-lending banks are therefore possibly
not as well represented.
Even though we suspect that a comparative
analysis of remuneration policies, on IT strategy
as well as on audit strategy, would provide helpful
insights on the specif ic risk culture, we have not
covered it as part of our analysis. The reason is that
we could not find enough comparable information
in the publicly disclosed material of the banks. An
analysis of the respective bank-internal documents,
however, would probably provide the information
needed to be used for RCIs.
Further, we would like to mention Goodhart’s
law25 — if certain RCIs are accepted as measures
for good risk culture, banks might be tempted to
optimise these indicators rather than to improve on
the inherent risk culture of their own institution.
Hence, more research on RCIs and their potential
interaction with the idiosyncratic risk profile — as
Delivered by Publishing Technology to: julie simkins
IP: 185.24.85.49 On: Mon, 22 Feb 2016 18:44:06
Copyright: Henry Stewart Publications
Does risk culture matter?
© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 1 71–84 Journal of Risk Management in Financial Institutions 81
measured via RWA and stress test outcomes is
needed.
In summary, our research gives empirical
evidence that risk culture matters. It also shows
that more research is needed. We have the technical
and methodological means to measure and manage
the culture of a corporation or, as Andrew W. Lo16
states: ‘[…] thanks to advances in the behavioral
and social sciences, big data, and human resources
management, for the first time in regulatory
histor y, we have the intellectual means to construct
behavioral risk models.’
References and notes
1 FSB (2009) ‘Improving f inancial regulation:
report of the Financial Stability Board to
G20 leaders’, Financial Stability Board, Basel,
available at: http://www.financialstabilityboard.
org/wp-content/uploads/r_090925b.pdf ?page_
moved=1 (accessed 6th November, 2015).
2 EC (n.d.) ‘Derivatives/EMIR’, European
Commission, Brussels, available at: http://
ec.europa.eu/finance/financial-markets/derivatives/
index_en.htm (accessed 1st November, 2015).
3 EC (2011) ‘Capital requirements regulation
and directive — CRR/CRD IV’, European
Commission, Brussels, available at: http://ec.europa.
eu/finance/bank/regcapital/legislation-in-force/
index_en.htm (accessed 21st October, 2015).
4 BRRD (Banks Recovery and Resolution
Directive) (2014), ‘Directive 2014/59/EU of the
European Parliament and of the Council of
15 May 2014’, available at: http://eur-lex.europa.
eu/legal-content/EN/TXT/?uri=celex:32014L0059
(accessed 21st October, 2015).
5 This refers to a statement by US Supreme Court
Justice Potter Stewart from 1964, available at:
http://blogs.wsj.com/law/2007/09/27/the-
origins-of-justice-stewarts-i-know-it-when-i-
see-it/ (accessed 21st October, 2015).
6 EBA (2011) ‘EBA guidelines on internal
governance’, paras 33–37, 27th September, European
Banking Authority, London, available at: https://
ww w.eba.europa.eu/documents/10180/103861/
EBA-BS-2011-116-final-EBA-Guidelines-on-
Internal-Gover nance-(2)_1.pdf (accessed
8th November, 2015).
7 EBA (n.d.) ‘Regulation and policy on
remuneration’, European Banking Authority,
London, available at: https://www.eba.europa.
eu/regulation-and-policy/remuneration
(accessed 21st October, 2015).
8 Bannier, C., Feess, E. and Packham, N. (2013)
‘Competition, bonuses, and risk-taking in the
banking industry’, Review of Finance, Vol. 17,
pp. 653–690
9 dejure.org (2014) ‘Kreditwesengesetz KWG §54a
— Strafvorschriften’, available at: https://dejure.
org/gesetze/KWG/54a.html (accessed
21st October, 2015).
10 Bank of England (2015) ‘Prudential Regulation
Authority sets out how it will hold senior
managers accountable for failure to meet its
requirements’, Bank of England, London,
available at: http://www.bankofengland.co.uk/
publications/Pages/news/2015/029.aspx
(accessed 21st October, 2015).
11 Stulz, R. (2014) ‘Governance, risk management,
and risk-taking in banks’, Finance Working Paper
No. 427/2014, European Corporate Governance
Institute (ECGI), Ohio State University, available
at: http://papers.ssrn.com/sol3/papers.cfm?abstract_
id=2457947 (accessed 27th October, 2015).
12 FSB (2013) ‘Guidance on supervisory
interaction with financial institutions on risk
culture’, Consultative Paper, 18th November;
final publication 7th April 2014, Financial
Stability Board, Basel, available at: http://
www.financialstabilityboard.org/wp-content/
uploads/140407.pdf (accessed 2nd December
2015).
13 EY (2014) ‘2014 risk management survey of
major financial institutions: shifting focus —
risk culture at the forefront of banking’, EY.com ,
available at: http://www.ey.com/Publication/
vwLUAssets/ey-shifting-focus-risk-culture-at-
the-forefront-of-banking/$FILE/ey-shifting-
focus-risk-culture-at-the-forefront-of-banking.
pdf (accessed 2nd December, 2015).
14 Group of Thirty (2014) ‘Banking conduct and
culture: a call for sustained and comprehensive
reform’, Group of Thirty, Washington, DC, also
available at: http://group30.org/images/PDF/
BankingConductandCulture.pdf (accessed
2nd December, 2015).
Delivered by Publishing Technology to: julie simkins
IP: 185.24.85.49 On: Mon, 22 Feb 2016 18:44:06
Copyright: Henry Stewart Publications
Fritz-Morgenthal, Hellmuth and Packham
82 Journal of Risk Management in Financial Institutions Vol. 9, 1 71–84 © Henry Stewart Publications 1752-8887 (2016)
15 Sheedy, E. and Griffin, B. (2015) ‘Risk
governance, structures and behavior: a view
from inside’, Working Paper, Macquarie
University, Sydney; see also ‘Empirical analysis
of risk culture in financial institutions: interim
report’, available at: http://www.lse.ac.uk/
accounting/CARR/events/Sheedy-Risk-
Culture-Paper-Nov-14.pdf (accessed 21st
October, 2015).
16 Lo, A. W. (2015) ‘The Gordon Gekko effect:
the role of culture in the financial industry’,
17th July, Massachusetts Institute of Technology
(MIT), Sloan School of Management, National
Bureau of Economic Research (NBER),
available at: http://papers.ssrn.com/sol3/
papers.cfm?abstract_id=2615625 (accessed
8th November, 2015).
17 Cohen, J., Cohen, P., West, S. G. and Aiken, L. S.
(2003) ‘Applied multiple regression/correlation
analysis for the behavioral sciences’, 3rd edn,
Lawrence Erlbaum, Mahwah, NJ.
18 Hofstede, G., Neuijen, B., Ohayv, D. D. and
Sanders, G. (1990) ‘Measuring organizational
cultures: a qualitative and quantitative study
across twenty cases’, Administrative Science
Quarterly, Vol. 35, pp. 286–316.
19 A more detailed description of the RCIs is given
in the Appendix. Full details on how the risk
culture score was derived are available from the
authors upon request.
20 ECB (2015) ‘Comprehensive assessment’,
European Central Bank, Frankfurt, available
at: https://www.bankingsupervision.europa.eu/
banking/comprehensive/html/index.en.html
(accessed 21st October, 2015).
21 The assignment to categories was chosen to yield
a distribution of 8, 20, 25, 20 and 8 institutions
in the categories ranging from 1 to 5.
22 ECB (2013) ‘Note comprehensive
assessment October 2013’, European Central
Bank, Frankfurt, available at: https://
www.ecb.europa.eu/pub/pdf/other/
notecomprehensiveassessment201310en.pdf
(accessed 27th October, 2015).
23 FSB (2014) ‘Guidance on supervisory interaction
with f inancial institutions on risk culture’, Financial
Stability Board, Basel, available at: http://www.
financialstabilityboard.org/publications/c_131118.
pdf (accessed 21st October 2015).
24 For a causal interpretation, that is, to conclude
for example that a better governance leads to a
better stress test outcome, one would need to
monitor changes over time.
25 Danielsson, J. (2002) ‘The emperor has no clothes:
limits to risk modeling’, Journal of Banking &
Finance, Vol. 26, No. 7, pp. 1273–1296.
Delivered by Publishing Technology to: julie simkins
IP: 185.24.85.49 On: Mon, 22 Feb 2016 18:44:06
Copyright: Henry Stewart Publications
Does risk culture matter?
© Henry Stewart Publications 1752-8887 (2016) Vol. 9, 1 71–84 Journal of Risk Management in Financial Institutions 83
APPENDIX: DETAILED DESCRIPTION
OF RISK CULTURE INDICATORS
Main Sub-category Sub-category 1 Sub-category 2 Sub-category 3
Regulatory
requirements
Obvious regulatory failings
(bivariate 1 or 5)
Responsibility distribution concerning
risk management
Disclosure report is published (pillar 3)
(bivariate 1 or 5)
Implementation process of Basel 3 in
2013 (bivariate 1 or 5)
Strategy Focusing on specific products, regions
and/or client segments; strategy is
identifiable
Decreasing risky portfolios and
leftovers from the financial crisis
Long-term orientation or rather
short-term/sustainable strategy
Dividend payout ratio
Special, risk-related majority holdings
in subsidiaries (bivariate 1 or 5)
Governance Board Number of board members in relation
to total assets
Experience of board members
Risk-related board position: other
responsibilities of CRO
Supervisory committee (SC) Number of SC members in relation to
total assets
Composition of SC
Relationship between board and SC
Portfolio % of subordinated debt
Distribution of portfolio according to
rating categories
Development of collateral
Comparatively low or no securitisation
and cascading securitisation
% of overdues (<90 days)
Default (>90 days) numbers of credit
portfolio
% of off-balance positions and
derivatives
Realised impairments in comparison
to expected impairments (bivariate
1 or 5)
Impairment level (at least 60 days
past due)
Employees Number of trainings
Size of risk department (if info is
available), may include compliance
department
Fluctuation in numbers of employees
(Contd...)
Delivered by Publishing Technology to: julie simkins
IP: 185.24.85.49 On: Mon, 22 Feb 2016 18:44:06
Copyright: Henry Stewart Publications
Fritz-Morgenthal, Hellmuth and Packham
84 Journal of Risk Management in Financial Institutions Vol. 9, 1 71–84 © Henry Stewart Publications 1752-8887 (2016)
Main Sub-category Sub-category 1 Sub-category 2 Sub-category 3
Risk strategy Risk committees Credit risk/counterparty risk
(bivariate 1 or 5)
Market risk (bivariate 1 or 5)
Liquidity risk (bivariate 1 or 5)
Operational risk (bivariate 1 or 5)
Other risks (bivariate 1 or 5)
Strategy according to different risk
classes
Methodology of risk assessment Internal rating processes
Database history (bivariate 1 or 5)
Difference regulatory capital vs.
economic capital
Other aspects (eg number of different
rating approaches used, ...)
Risk measures used (pillar 1): eg VaR
encompassing confidence level
Credit risk/
counterparty risk
Market risk
Liquidity risk
Operational risk
Other risks
Processes are known, followed and
understandable
ICAAP (pillar 2) (bivariate 1 or 5)
Reputation Statements concerning reputational
factors provided by the banks itself
Compliance risks that may destroy
reputation (bivariate 1 or 5)
Legal issues and connected penalty
fees
Other effects
Cultural indicators Behavioural principles Described in guidelines so that they
have to be followed
No guidelines needed making people
acting risk aware (bivariate 1 or 5)
What topics are highly relevant for the
bank (eg materiality analysis)
Appropriate compliance culture is in
place
Market departments are sensitive with
regard to risk management
Policies in place concerning anti-money
laundering, KYC, embargos, conflicts
of interest; whistle-blowing system in
place
Volatility in net result
# of using wording ‘risk averse’, ‘risk
culture’ and ‘conservative’ in AR
Mission statement is published
(bivariate 1 or 5)
