Credit Regimes, Risk Management, and the Value of Stress Testing

The Conversation That Started This

Some years ago, we listened to a conversation between a lead regulator and a senior bank manager that went like this:

At the time, we thought the solution was simple: implement a contingency plan. Write, follow, and commit to credit policies and procedures that state: “If certain macroeconomic variables or portfolio characteristics or performance measures break certain thresholds, we’ll stop making new loans, reduce exposure, cut lines, whatever.”

It seemed rather obvious. But…

Alas, what the managers heard—and maybe what the regulator implied—was “they want us to show large losses,” i.e., replicate crisis-level loss rates. And they were off to the races.¹

Refresher: The Three Steps of Risk Management

Risk management is:

1. Asking what could go wrong,
2. Estimating what could be lost if the bad situation occurs, and
3. Deciding, today, what to do about it—through either immediate or contingent actions—to reduce those potential losses.

Immediate actions (the “pre” in “prevention”) either reduce the likelihood of a bad event occurring or mitigate losses if the event does occur, e.g., avoiding marginal credits or buying insurance, like credit default swaps or synthetic risk transfers.

Contingent actions don’t affect upfront probabilities of the bad stuff happening but do involve plans—or more precisely, policies and procedures that determine how to act should the harm arise. That’s why you practiced fire drills in school, remember?

“So what are you going to do about it?” is the best motto for risk management. The Clash’s Guns of Brixton captures its essence, especially with respect to contingency planning: “When they kick in your front door, how you gonna come? With your hands in the air, or…”

The Data Shows How Much Time Banks Wasted Last Time

Look at the historical relationship between CRE balances and charge-off rates:

Historical Relationship Between CRE Balances and Charge-Off Rates

After charge-off rates exceeded their good-time levels, balances continued to grow for 18 months at the same rate as in the past. As everyone who does commercial loss forecasting knows, charge-offs tend to lag defaults by about a year-or-so, on average. That means defaults were increasing at least 18 months to two years before balances started to decrease.

Around two years. That’s not a narrow window. That’s an enormous opportunity to act—to tighten credit standards like max LTVs, reduce concentrations, cut lines, increase reserves—that went almost entirely unused.

Here’s the problem: bankers often see their portfolios deteriorating before the macroeconomic data catches up. Delinquencies tick up, watch lists grow, and line-of-business managers start hearing from borrowers—all before the unemployment rate or GDP figures reflect what’s happening on the ground. But the stress testing scenarios that banks receive from third-party providers are built on macro data, so those scenarios may still look relatively benign when the bank’s own portfolio is already flashing gentle warnings.

When that happens, banks shouldn’t wait for the next third-party scenario release to tell them what their own indicators might be, well, indicating. They should adjust scenarios downward through their economic forecasting committees, or apply qualitative overlays to modeled results using the trend information they’re seeing in real time. (This is how we build qualitative adjustment frameworks.) The models are tools. The bank’s own intelligence about its own portfolio is the early warning system.

But banks shouldn’t stop there. They should take advantage of the early warning and act. Of course, there is an opportunity cost to tighter credit if events remain stable or turn positive, but that’s the cost of avoiding possible ruinous losses.

How Regulators Blew a Once-in-a-Lifetime Opportunity

We do think regulators had (and have) a penchant for their supervised banks to show relatively large forecasted losses—as proof that the banks’ pro forma financial statements map to acceptable capital ratios. But in a crisis it’s never about capital.

In that regard, the supervisors blew a great—possibly a once-in-a-lifetime—opportunity to more closely tie regulatory stress testing to actionable risk management.

This doesn’t hold for the largest banks—the SIFIs—where stress tests are appropriately tied to risk appetite statements and examiners request contingency plans. But it does for everyone else. Smaller firms might hear, “Oh, you might have to adjust your capital plan if some ratio is below some threshold,” but the contingent plans seem to revolve around answering, “How would you adjust your capital plan?” and not “What would you do?”

To an outside observer, that certainly seems to be missing the point.

Rather than asking, “How can you live with these losses?” we think the Fed should ask, more directly, “How can you prevent or mitigate losses if bad stuff, like this scenario, begins to unfold—so you don’t have to live with the losses?”

In this regard, a bank that simply complies with its regulator(s) is also missing its best chance of being prepared for the inevitable downturn.²

Credit Losses Behave in Regimes

Before we go further, it’s worth naming the structural feature of credit losses that makes all of this matter: they don’t move gradually. They exist in regimes.

For virtually every credit portfolio, the loss pattern is the same: long stretches where losses are negligible—single basis points, sometimes negative after recoveries—punctuated by sharp transitions to a regime where losses are severe, driven by macroeconomic conditions that cause damage to accumulate quickly. There is no gentle middle ground where losses are “moderate” for an extended period. They’re bimodal; they’re not normal (get it?).

Historical CRE Charge-Off Rates: Good Times and Bad Times

Look at the CRE charge-off history above.³ The red and blue regions aren’t artistic choices—they represent genuinely different regimes. In “good” times, losses barely register. In “bad” times, they are severe. The transition between them is abrupt.

This regime structure has critical implications: (1) historical averages don’t cut it, and (2) the only way to evaluate the real risk embedded in a credit portfolio is stress testing. In the good-time regime, current performance tells you almost nothing about what the portfolio will do when conditions shift. A CRE portfolio with zero net charge-offs today can produce devastating losses 18 months from now. You cannot see that risk by looking at current delinquency rates, current charge-offs, or current reserve levels. You can only see it by asking “what if?” That’s exactly what stressing test does.

We once spoke with a banker in Montana at a bank under $10 billion in assets. When we mentioned what we did, he said they didn’t need to stress test because they knew all their borrowers. We asked two questions: Do you know what affects all those borrowers at the same time—and how? And: Do you know that Montana mortgage loss rates during the crisis were kind of like Sunbelt levels? He did not. Knowing your borrowers is not the same as understanding systematic risk. And systematic risk—the kind that hits every borrower in your portfolio simultaneously—is exactly what a stress test is designed to measure.

This is why stress testing is not a compliance exercise. It is the only analytical tool that lets a bank evaluate the consequences of a regime shift before the shift happens. And it is why not stress testing—or stress testing without acting on the results—is negligence.

Where Can Risk Management and Supervision Make a Difference?

Given that credit losses exist in regimes, risk management and bank supervision can theoretically do three things:⁴

1. Reduce losses in good times.
2. Extend good times / delay bad times.
3. Reduce losses in bad times.

Let’s take them in order.

Can Risk Management Reduce Losses in Good Times?

For any decently run bank or portfolio, not much, and this is the regime structure at work. In good times, for many portfolios, losses tend to be in the single basis points. Heck, during some quarters net losses are even negative—when recoveries are greater than previously anticipated.

In good times, there isn’t much need for risk management any more than a decent swimmer needs a life jacket in a pool or while floating down a lazy river. It seems a challenge to lose money when the economy is humming along… unless you’re particularly foolish.⁵ In those situations, supervisors may save the foolhardy, but it is at a cost of not providing fresh examples and cautionary tales for everyone else.

For any semi-competent institution, if risk management and supervision do reduce idiosyncratic losses in good times—and if that’s all they do—it’s unlikely that the costs are worthwhile. The gross losses available to avoid are simply too small (in the basis points) to justify the expense.

In fact, we think this is exactly why Private Credit has been fooled by its own success. PC’s entire track record has been built during the good-time regime. Strong performance in a regime where almost nobody loses money is not evidence of superior credit judgment. It’s evidence of favorable conditions, i.e., low rates and oceans of liquidity.

Minimal Effects of Risk Management During Good Times

Can Risk Management or Supervision Delay Bad Times?

Probably not—and the attempt may make things worse. It is difficult for banks to delay bad times, individually or collectively. It may be possible for the Fed to try do so through monetary policy by, say, reducing interest rates—to attempt to stimulate economic activity and keep the good times rolling, but the cost tends to be higher inflation, i.e., fewer defaults but the money you get paid back isn’t worth as much as when you lent it.

Bad times will arise. King Canute demonstrated to his courtiers that even a king cannot command the tides to stop—and neither can regulators, risk managers, or central bankers command the credit cycle to hold. Moreover, there are exogenous shocks, like terror attacks and droughts, that can’t be prevented, and unfortunately, there are endogenous shocks that—when the Fed and politicians forget their Hippocratic Oaths, and as we’ve seen too often, snatch defeat from the jaws of victory.

Note that there is also the risk that attempting to delay bad times might increase the severity of losses in bad times. (One example is when central bank activities exacerbate bubbles. 2008, anyone?) Using our swimming analogy, we don’t think it’s wise to tell folks that they can swim better without life jackets, especially when there are rapids ahead or when a perfectly acceptable portage exists.

The Challenges and Risks of Delaying Bad Times

Can Risk Management Soften Bad Times?

This is where it matters—and it’s the only place it matters. If risk management doesn’t provide much of a benefit in good times and doesn’t delay the onset of bad times, then its only remaining value is to decrease the severity of adverse consequences when the regime shifts.⁶

The Potential to Reduce Losses During Bad Times

For banks, this means preparation: stress testing the portfolio under adverse scenarios as granularly as possible, identifying where the concentrations and vulnerabilities are, and—critically—deciding in advance what actions to take when early warning indicators trip. For supervisors, it means holding banks accountable not just for producing large forecasted losses but for having credible, actionable contingency plans that reduce actual losses. (It’s all there in SR 12-7.)

Mitigating this systematic risk, which by definition all banks face, is the most important task for both risk managers and their supervisors, especially the ones concerned with safety and stability of the financial system. Not being prepared for bad times—when the tools to prepare exist and are already being paid for—is negligence. We think there is substantial room for improvement, and we also think that it’s not that hard.

Why isn’t it that hard? Because stress testing and loss forecasting already sit at the center of a bank’s risk management infrastructure—or they should. Look at the diagram below. Every phase of the loan life cycle—origination, account management, collection—feeds into and is informed by stress and loss forecast models. And the outputs flow directly to the functions that need them most: financial reporting (including CECL/ALLL), regulatory reporting, board-level risk appetite, concentration risk management, loan valuation, and ALM. Loss forecasting is the hub (or could be). It’s the one analytical framework that is integrated, unifying, evidence-based, forward-looking, and comprehensive. If you’ve already built the models, the incremental cost of using them to drive contingency planning is low. The infrastructure is there. (Well, it may be there if you built your risk data warehouse from your cleansed loss forecasting models developmental data set.) The issue is whether anyone acts on what stress testing is telling them.

Stress Testing as the Integrating Framework for Risk Management

There’s another reason it’s not that hard—and this one is underappreciated. We have a saying: if the data is good enough for modeling, then it’s good enough for everything else.

The converse is not true.

The cheapest path to a clean data infrastructure is to build it for loss forecasting first. The byproduct of good model development is clean data, and, in fact, that clean data may be more valuable than the models themselves. We’ll have more to say about why data infrastructure fails at most banks in a separate piece, but the short version is: the people who build the data systems and the people who need the data for credit decisions operate in different silos with different incentives, and nobody owns the problem end-to-end. Stress testing is the forcing function that can—with a little luck—break those silos.

Re-forming the infrastructure (by putting the decision-relevant “I” into “IT”) will provide the maximum benefit of reducing losses in bad times, but when that’s not a top priority, an organization can still improve it risk profile by taking precautions and developing contingency plans and actions based upon its stress test results: the more segmented by borrower and loan characteristics and geography, the better

The Bottom Line

Banks are wasting excellent and obvious opportunities to prevent and mitigate potential losses, especially given that the marginal cost of the third step of risk management (deciding what to do about it) is relatively low compared to the second step (estimating losses via fairly expensive models and stress testing platforms).

We’ve talked about this previously, so note that while employment is part of the Fed’s dual mandate, the Fed seems to overemphasize unemployment as a predictive variable for both C&I losses and CRE losses: by definition, correlated but lagging doesn’t provide an early warning, and therefore doesn’t help with risk management.

At Spero Risk, we create value by intersecting business and modeling silos—by adding quantitative discipline to the business side and business discipline and insights to modeling.

Finally, for the love of the Lord and all that is sacred, if you’re a politician, please, please, please note that the best way to avoid bad times is to follow Mark Knopfler’s advice, and Don’t Crash the Ambulance.