
The New Retail Credit Management Function
Ronald J. CathcartThe practice of Retail Risk Management has undergone a significant transformation over the past decade and as we reflect back on some of the changes, we begin to realize just how far we have come. Ten years ago, a great deal of what we did was based entirely on experience and "gut." Today, building on this experience, we have incorporated into our decision-making process a plethora of highly quantitative techniques that allow us to assess and quantify consumer credit far more effectively.
The traditional risk manager was entirely product-focused. When we saw bankruptcies go up in a product such as credit cards, we slammed on the brakes without regard to the returns we were earning. Simple, but effective. Of course, a side effect could well have been to ruin the profitability of a perfectly respectable product--but then, we were looking at risk one-dimensionally.
The traditional approach was transaction-oriented. We made decisions on an account-by-account basis. This account looks shaky. That account looks strong. Get rid of the shaky one. Again, sounds easy enough, except when working with little information, we lost track of how the shaky account might prove profitable in the long run when viewed from the perspective of the entire portfolio.
Judgment ruled in the traditional approach. After all, we had all that experience; we pretty much knew what it was that had to be done. So policies were intuitively determined. Was that a bad thing? Not all together, but what happened when our intuition and experience failed to pick up an emerging trend, as it did with credit cards in the mid '90s.
As traditionalists, we decided whether or not to approve a customer's credit based only on projected losses. Again, we did this because it was what we were familiar with and because it had worked pretty well in the past. Likewise, the scorecards many of us relied on focused only on an approve/decline decision that was based on "off-the-rack" pooled credit data from such entities as Fair, Isaac and Company (FICO). While useful, sole use of such information offered one bank no real competitive advantage over another. In addition, override reasons on low-side scores were formed judgmentally by the traditional risk manager, based on vague reason codes--long-term customer, prospect of generating more business through cross-sell, and so forth
In terms of forecasting defaults, traditional risk management techniques were roll-rate-focused, concentrating on historical delinquency buckets. The roll rate last year was "X," so let's apply it to next years volumes. What happened if the composition of the portfolio shifted? That was a problem for another day. Likewise, collection strategies were uniformly based on account aging, all customers were treated the same. Yet we know that 30 days past due is not alarming for low risk customers and very high risk for others, which led to jumping the gun in some instances and not pulling the trigger fast enough in others.
The traditional approach to risk review was based on "ticking and tying," checking whether or not each loan application was entered correctly. Capital was assigned based on loss rates, irrespective of volatility; a high-loss rate meant more capital, a low loss rate, less. Reserves were based on a fixed number of months' losses.
We were the Guardians of Capital, the Antidote to Regulators, the Inflexible Isolationists. Not so anymore.
The New Risk Manager
Rather than product-focused, the new risk manager is customer- focused. We use portfolio disciplines--we decide what the portfolio should look like and search for complementary correlations. Our policies are established using champion/challenger techniques. We measure the results of decisions made over time, compare them to the results from a control group, and adjust accordingly. This requires highly intensive mathematical analysis and an entirely new professional discipline; in risk management, these were all but unavailable 10 years ago.
We base approve/decline decisions on customer net present value--not only losses but also the timing of those losses, the likelihood of attrition, and the projected revenue streams from each loan. We even include the revenue from other products and incorporate lifetime value. We also spend a great deal of time in the care and feeding of our databases, knowing that our own rich data can be far more predictive of consumer behavior than the off-the-rack variety. We use a multitude of scorecards that are customized to predict very specific behaviors in very specific customer populations. Overrides are empirically based and are statistically justified using control samples and statistical sampling techniques. Reason codes are analyzed relentlessly. These days, we also pay more attention to the high-side overrides--were there other lost opportunities?
Forecasting is based on sophisticated analytical tools. Instead of portfolio-based roll rate analysis, we break the portfolio down into numerous unique cells, calculate the historical roll rate of each, and aggregate the result to better reflect portfolio shifts. We analyze vintage curves and, using regression, project lifetime losses for accounts originated by quarter, by channel, and under numerous specific credit criteria. We rescore our portfolios regularly and use these refreshed scores to model the changing risk profile of our loan portfolios. We use neural networks to identify the variables most predictive of loss and then apply statistical techniques to quantify how confident we are with the results.
Our collection strategies are score-based. Many of the customers who are delinquent in the first month are able to pay. Knowing who they are will determine collection strategies. In addition, risk review is strategic, focused on systems and not loan centers--dealing with the loan origination process rather than the loans themselves. Capital is assigned based on loss volatility. Reserves are subject to econometric stress testing to gauge the effect of a number of economic shocks.
As risk managers today, we have embraced these new tools and disciplines. They provide us with far greater insight and enable us to become more effective members of the management team. But it's not simply a matter of "out with the old, in with the new." State-of-the-art risk management fully integrates the traditional qualities of experience, judgment, intuition, and "gut" combined with today's statistical tools, database management, empirical discipline, and facts. The result is that we have become informed integrators; we are more proactive and more effective members of the team, able to add significant value and lift to the bottom line.
Organizational Requirements
All the best intentions in the world will not deliver a successful program without the organizational framework to support it. This begins with an alignment of risk management with business interests--the product of an open mind on the part of the risk manager and open communication channels with other partners in the business. Risk management needs to be in the middle of the information flow and must have an equal voice on the management team in order to add value early on and to help others understand the ramifications of the decisions that they are making. Most importantly, we must be motivated to generate revenue growth while ensuring that corporate risk/return appetite objectives are met.
At Bank One we have achieved these objectives by making the line of business risk officers a part of the lines of business, while at the same time ensuring that they have a direct reporting relationship to the chief risk officer. (The Bank One structure can be seen in Figure 1.) This ensures that risk managers are fully integrated into each business while, at the same time, ensuring that they maintain a level of objectivity that is a key element of their role.
The intelligent growth of an institution is a shared objective among the many team players, including Risk Management. A fully integrated risk management function is one that optimizes skills and disciplines and sets the stage for growth.
COPYRIGHT 2001 The Risk Management Association
COPYRIGHT 2005 Gale Group