IT helps banks strengthen their risk management

IT helps banks strengthen their risk management

Zatni Arbi, Columnist, Jakarta

zatni@cbn.net.id

I remember listening to a lecture by Professor Seiji Naja of the
University of Hawaii in the late 1980s. He asked the audience how
the way the Japanese regarded their banks differed from the way
the Americans treated theirs.

The witty academic went on to say that the Japanese used their
bank as a place to deposit their money and let it grow, while the
Americans looked at theirs as an institution that they could rob
at any time when they needed money.

"That is why the Japanese are better off than the Americans,"
he said. It was during the time that Japan's economy was at one
of its highest peaks and property prices on the beautiful
Hawaiian islands were skyrocketing because Japanese were arriving
in hordes on property buying sprees.

It turns out that Indonesians also have a unique use for their
banks: They are the institutions from which they can steal money
in staggering amounts and do not have to feel disgraced by it. In
Bahasa Indonesia, the phrase for this type of activity is
membobol bank. It literally means "to break through the walls of
the bank," and has increasingly become a common phrase in our
daily conversation.

Each time a gang of crooks -- which invariably include one or
more insiders and, not infrequently, high-ranking executives --
steal billions or even trillions of rupiah from a bank, we the
customers may not immediately feel the impact. Therefore, in most
cases we tend to read the news with a somewhat detached attitude,
forgetting that the banks could use these funds to improve the
quality of their services.

The funds could be used to add new ATMs or even introduce new
delivery channels that would give us more banking convenience.

They could also use the funds to train their tellers or even
raise their salaries so that we might enjoy much faster and more
professional services from more cheerful bank employees.

Better still, they could channel the funds to SMEs as loans
and enable them to develop their businesses.

It is strange that our banks can still be ripped off so easily
today, one right after the other, while all over the world the
banking industry has been undergoing sweeping reform.

Today, banks are required to build an internal capability to
manage their risks properly. Risk is an integral part of any type
of business. More often than not, the higher the risk, the better
the return. However, to ensure survivability, all the risks have
to be well managed, and the banks are no exception.

In the banking industry, in particular, at least three kinds
of risk have to be managed: Credit, market and operational risks.
There is also what they call "legal" risk. The fact that our
banks can still be ripped off so easily shows that operational
risk management in our major banks still has a long way to go. It
also shows that they do not have an effective early warning
system in place.

Perhaps the most important initiative in the global banking
reform is the Basel II Accord. It deals with issues that include
risk management. The worldwide deadline for compliance with Basel
II principles has been set at 2006. In Indonesia, according to
deputy director of the directorate for banking research and
regulation at Bank Indonesia (the central bank) SWD Murni Astuti,
our banks have been given until March 2004 to come up with their
individual plans for implementing the accord.

Incidentally, Murni was speaking at a recent seminar on risk
management organized by PT Berca Hardayaperkasa at Shangri-la
hotel, Central Jakarta.

What is interesting about the Basel II Accord is that
technology is its fourth pillar -- the other three being minimum
capital requirements for the various types of risk, supervisory
review of institutions' capital adequacy and internal assessment
processes, and market discipline and mandatory public disclosure.

The fact that banks have become one of the industries that
depend so heavily on technology is absolutely understandable.
Banks even compete with each other by implementing the latest and
most innovative technologies that they can get hold of.

Convenient delivery channels -- ATMs, Internet banking, mobile
banking, which we now take for granted -- would not have been
possible without the use of advanced technologies. However, the
fact that risk management has been made possible by information
technology may not be as widely known.

"Banks have to deal with a lot of data," said Sanjeev Shukla,
Senior Consultant at I-flex Consulting, one of the speakers at
the seminar. In their databases, the banks maintain data on
customer accounts, on their credit card activities, on
remittances, you name it. The database should have a level of
detail -- granularity -- that will allow staff to explore the
data until they obtain the data they are seeking.

Besides the transactional data, banks now have to feed
themselves with market data from Standard & Poors, Reuters and
other data providers. To manage credit risks, they also have to
use data on industrial sectors so that they will be able to
determine the level of exposure that they should have to a
particular industry.

The seminar featured a presentation and demonstration of a
dedicated solution for banks that wish to strengthen their risk
management with information technology (IT). Called Reveleus, and
developed by I-flex Consulting, the modular solution offers tools
and analytics that banks can use to ensure that their risk
management infrastructure complies with Basel II.

An interesting aspect about the presentation was that the
argument that the IT industry is passive was simply unsupported.
As the Basel II-based Reveleus solution demonstrates, the
industry still has a lot of opportunities to come up with highly
focused products and services. Granted, much as the people at I-
flex or other vendors -- including Peoplesoft, which also offers
solutions for Basel II compliance -- have a keen eye for an
opportunity, industry participants will also have to sharpen
their ability to identify specific requirements that they can
fill. And then continue to grow their business.

As to membobol bank, we still have to brace ourselves. Surveys
carried out by Bank Indonesia in 2000 and 2002 revealed that
major Indonesian banks were already aware of the need for proper
risk management. Commitment to the principles is a different
story. No matter how sophisticated the quantitative model for
risk management the banks use, it will not mean much without
commitment by the management -- and the banking authorities.