Revolution & evolution: the bank was at risk right at birth. Now Bernard Allorent ensures that BNP Paribas uses risk to advantage

More than 150 years ago, in the midst of revolutionary upheaval, Comptoir National d'Escompte de Paris opened with FRF 20 million (approximately $3.86 million) in assets. In 2000, CNEP's successor, Banque Nationale de Paris, took over Paribas, which was founded 24 years after CNEP; the combined institutions' net income in 2004 was 4,668 million euros; today, 90,000 employees work in 85 countries around the world.

In April 1999 The RMA Journal interviewed BNP Group Risk Manager Edouard Sautter, who retired in 2000. Now, RMA's Maurice H. Hartigan II and Nicholas Hayes interview Bernard Allorent, Chief Risk Officer at BNP Paribas, who took over the position in 2001. Allorent also is an RMA board member.

BNP's Risk Management Division of the institution was created in 1994. Formerly head of the Europe Division of Corporate and Investment Banking, Allorent now rides herd over risks in each of BNP Paribas's core businesses as well as operational risks on an enterprise-wide basis. This article looks at the unique risks of each and how they are integrated into the enterprise, particularly for operational risk. The common denominator for establishing an enterprise view of risk, says Allorent, is economic capital, "since it provides the common metrics for what we do."

Hartigan: In April 1999, The RMA Journal visited with Edouard Sautter, chief risk officer of Banque Nationale de Paris [BNP]. How has the role of CRO changed over the past sly years and what aspects of your background best prepared you to take over that role for BNP Paribas?

Allorent: That interview took place about a year before the merger between BNP and Paribas. Following the merger, the best practices from each institution were combined to create the current Group Risk Management area, which Edouard headed until his retirement. We now have an independent, more integrated risk management function with risk tools developed from an economic capital framework. We also have geared up to meet the requirements of the most advanced options under Basel II and have made Operational Risk Management a formal segment of risk management at the group level. Finally, the bank has grown significantly since the merger. So overall I believe it is fair to say that Group Risk Management at BNP Paribas has undergone a very deep transformation.

This was my first risk management assignment. What I bring to the role of chief risk officer is broad-based experience in corporate and investment banking, together with a career of international assignments. My 11 years in the U.S. were particularly helpful and a very rewarding professional experience.

Hartigan: Let's dig a little deeper into your international experience. What were your responsibilities in the U.S. market?

Allorent: I began my banking career at what was then the Chase Manhattan Bank, and I went through their training program. My first assignment at Chase was in the Expansion and Diversification area. Then I moved to Paris and began working for Paribas. I returned to the U.S. 10 years later to Paribas's New York branch--first as deputy head, then head of the branch, and then head of the U.S. investment banking operation, for which we were grandfathered under the International Banking Act.

The 1980s were a very good time for a foreign bank to be in the U.S. We took full advantage of the emergence of the leveraged buy-out activity. Then one of Paribas's businesses had suffered from the oil crisis of the early 1980s; we were able to rebuild it as a more project-finance-oriented business, which was--and continues to be--very successful. Meanwhile, on the capital markets and investment banking side, the giant bull market in the U.S. was creating remarkable growth. Both situations provided the bank with excellent opportunities.

Hayes: You now also serve on the board of directors at RMA; how did your involvement with the Association come about?

Allorent: RMA is a splendid organization, which I first came to know through participating in a Global Round Table. I found immediate value in getting to know--basically in one meeting--most of my peers in Europe and the U.S. Beyond the networking, I think the issues discussed at these round tables were extremely relevant to all of us--especially to me as a new risk officer.

I had known RMA mostly for its credit-related products and services, but as I got to learn more about the Association, I quickly realized that there was a lot more to it than credit. In particular, BNP Paribas now is involved on the operational risk management side of RMA through our participation in RMA's KRI (key risk indicators) Study, which I believe is of great value to the industry. So I'm pleased to have been asked to join the board of RMA, because I think it's a very high-quality organization that does a lot to help risk managers do their job and improve the way they do it.

Hayes: Large institutions like BNP Paribas have a great breadth of activities. How does your position relate to the institution's various constituencies--the board and the CEO, your colleagues and peers, and the lines of business?

Allorent: I report to Baudouin Prot, our chief executive officer. This gives me independence from the business lines, and such independence supports a healthy risk function in any organization.

I have a fair amount of interaction with our two chief operating officers--Georges de Courcel and Jean Clamon. I also spend a fair amount of time communicating with my internal clients, the heads of the four core businesses of the bank, and the heads of the business lines under them.

The Internal Control and Risk Management Committee--at the board of directors level and chaired by an independent director--meets at least four times a year and reviews our credit, market, and operational risk policies, the measurement frameworks, and the evolving risks in the main portfolios. Apart from risk, this committee also reviews the framework of the Internal Audit and Compliance functions, as well as their main findings.

Much of my time there is spent communicating about Risk Management and its goals and achievements, getting approval for our projects, reporting on them, and delivering at the highest level the correct perception of risks taken by the bank under various scenarios.

Risk Management prepares the monthly Risk Policy committees, which are chaired by the CEO. The CEO also chairs the Steering Committee meetings for what we call our Capital Project, which develops the economic and regulatory capital frameworks for the bank.

Hayes: So you're fairly heavily involved not only in the operational activities of' Risk Management, but also in bringing the Risk Management view to the strategic direction of the bank.

Allorent: We formally participated in the bank's three-year plan that we call Vision 2007, using the tools that we had available at the time. Clearly, we are moving toward an advisory role for senior management and the business lines.

It is critical for a bank to make sure that the goals of the business lines are aligned with risk appetite. Risk Management plays an essential role in this respect. Achieving this goal might result in some tension but this is quite constructive, and it is important for us to be in a dialogue, because the financial goals of all organizations today are quite ambitious. It's essential to the health of the organization to have the voice of Risk Management heard both in strategy plans and the important transactions of the bank.

Hartigan: What tools do you use to ensure a common risk culture throughout your global operations?

Allorent: The main tool is economic capital, since it provides the common metrics for what we do. Naturally, the risk profile of the business lines is driven primarily by risk type; a business line with market risk will have a different profile from a business line that has mostly credit risk. However, common drivers can be found within each risk class. A classic example is the link between the changes in a company's market cap and its asset value, which, in turn, is linked to credit quality. The assessment of the diversification and the concentration effects among the risk categories is key to building a risk measure for a diversified group such as BNP Paribas. So our economic capital framework helps to ensure a consistent view of risk across the different risk silos, taking into account all the interactions, and serves as the foundation of our approach to enterprise risk management.

Hayes: The agendas of many institutions' risk management areas increasingly are filled with managing compliance issues and the attendant information and management requirements. Are the winds of Sarbanes-Oxley howling over BNP Paribas?

Allorent: Yes, as they are all over the world. At BNP Paribas, the compliance function is separate from Risk Management. As a matter of fact, Compliance has been significantly strengthened and a member of the Executive Committee has been put in charge of it.

Obviously, we frequently work together, as Risk Management's mission implies a close look at compliance-with external rules, internal rules, or simply the application of a highly ethical behavior in dealing with our clients. The bank's good reputation is an important consideration to Risk Management and plays into our policy development, the validation of new activities and new products, and the review of individual transactions.

BNP Paribas's values are quite strong, and I personally believe that a well-ingrained ethical culture is better than an overabundance of rules, which can lead to a box-ticking attitude. However, in a large global bank like BNP Paribas, which operates in 85 countries and has very diverse business lines, a set of rules not only is necessary, but must be constantly updated and complemented. Finding the right balance between written rules and our established values is a challenge that we, like other global organizations, seek to meet.

Hartigan: Would you tell us a little more about your approach to reputation risk?

Allorent: It's become commonplace to say that a bank's reputation is its greatest asset. At the same time, the threats to reputation are greater than they've ever been. Part of the threat comes from the ambitious financial performance goals that we all have and part comes from far greater complexity in the global marketplace and in the products we sell-a complexity that only grows each day. That complexity makes it more challenging for Risk Management to ensure that our values remain strong throughout the enterprise.

Institutions also are subject to forces beyond their control. So we must try even harder, and we must understand that reputation risk is everyone's responsibility. We need a strong Compliance function and we need a strong Risk Management function, but eventually it's the culture and the basic attitudes of the people throughout the bank that make the difference. An institution can have all the rules in the world, but it takes just one poorly conceived transaction to ruin the bank's image.

If something does go wrong that is beyond the bank's control, the bank must be ready to explain why it has happened, how the bank became embroiled in the problem, and how it is not something that was planned. This is where it's good to be able to show that there are very strict policies in place.

Hartigan: Your job sounds more difficult than that of some of your counterparts in smaller organizations. Certain business practices that are sanctioned in one market would not be sanctioned in another. How do you continuously train and update your risk managers throughout 85 countries to ensure behavior that is acceptable and appropriate within the risk profile of BNP Paribas?

Allorent: We have formal training programs that deal with the suitability of a transaction and on such issues as money laundering. We explain that employees should always make sure that 1) clients have a need for the product sold to them and 2) clients understand the risk the product contains.

The signals sent from top management as well as from the board aim to give the message that, for this bank, a client relationship in the long term is more important than making a big profit instantly and then perhaps wasting the relationship.

Hayes: What is the role of hedging in risk management?

Allorent: Portfolio management is the responsibility of each core business. Naturally, we work closely with each business--providing the portfolio analysis, highlighting the concentration, and suggesting specific hedging actions or investment opportunities.

In the case of Corporate and Investment Banking, we have a formal quarterly--or more often if needed--meeting of the Exposure Management Committee, which is chaired by Georges de Courcel, a chief operating officer. The business and Risk Management work together to devise hedge strategies, which are then presented to the Committee for approval. Risk Management also can impose specific hedging actions in the daily decisions of the transactional committees.

Hayes: Obviously, each business line has its own unique risks. Let's take a look at the corporate and institutional banking side in Europe and internationally, where Risk Management oversees some 11,000 corporate and investment banking customers as well as 450 financial institution clients. What are some risks that differ from those of other business lines, and what are some of the risk management methods that you use? Also, how do you fit all of these risks into BNP Paribas's overall risk appetite as well as the risk appetite defined for these parts of the business?

Allorent: The client coverage organization of Corporate and Investment Banking sell the business lines' products. Their clients are the large corporates in Europe, the Americas, and Asia. FIG covers the banks, the insurance companies, the brokers, and the funds globally.

These are the areas where we generate the largest amounts of individual risk because we typically aggregate the risks from our credit lines, counterparty risks on the derivatives (which often mean medium- to long-term risks), and new-issue underwriting risk, just to mention the most frequent products or sources of exposure.

Our major risk with large counterparties is excessive credit concentration, at the individual counterparty's level or at the sector or the country level. We regularly review these concentrations, and we use all available techniques to hedge them--from sales in the secondary market to credit default swaps and securitization. We have specific limits by sector, by country, and, naturally, by counterparty. Our credit guidelines tend to contain these excessive concentrations at origination.

Also, the corporate and investment banking business line carries trading risks. They can be large at times or quite complex for some structured activities. Risk Management methods regarding derivatives pricing model testing, approval, or validation are therefore quite specific and critical to the soundness of the infrastructure.

Hayes: Unlike many U.S. banks, BNP Paribas can operate in the retail and consumer and middle-market sectors throughout France and, indeed, many other areas. We know that your U.S. subsidiary--BancWest--continues to grow. What is Risk Management's role in looking at these sectors, both in your home market and in the U.S.? Are there similarities in policies and approaches? Have you learned anything in the U.S. that is applicable in France, or vice versa?

Allorent: There are four main components to our retail business--each has a different history, different practices, and its own "personality."

1. The French retail network.

2. A cluster of finance companies coming from the former Companie Bancaire Group, which was a Paribas affiliate. In particular, Cetelem--the largest European company in the area of consumer finance--and UCB--a residential mortgage loan company--both started in France and have now expanded internationally.

3. BancWest gives the group a strong and growing presence in U.S. and Hawaii.

4. A Middle East/Africa network.

Credit-scoring practices are different in each area, but they borrow best practices from each other, and we've organized a certain convergence in making sure that they are all Basel II compliant.

Commonalities are found largely in the products--mainly, mortgage loans and revolving credits. Bundles, or packages with multiple options, are offered in most places. It's worth noting that revolving credits linked to credit cards are far less widespread in Continental Europe than in the U.S. or the U.K., and Cetelem was a pioneer in introducing them in Europe. Also, equipment leasing is done at BancWest as well as in Europe.

Another common feature is that the risk profile of the retail portfolio is very good, thanks to its selectivity and to its granularity. However, some products may be more exposed to an adverse economic environment, for example:

* Consumer loans offered to the sub-prime market are more sensitive to any deterioration in the business environment than are our more classic retail products.

* When we enter a new consumer loan market, where the data for a solid scoring do not exist yet, we have to build the scoring on data from other markets and then make adjustments based on our experience.

Hayes: The other side of the balance sheet is the liabilities customer deposits that you gather through the retail networks. Do you actively manage the interest and other market risks inherent in the deposit-gathering activity through the asset/liability management and ALCO process?

Allorent: Yes, we do. The center provides strong direction and support to help the entities manage their local currency gapping exposure but the EUR, USD, and GBP exposures are aggregated and managed centrally. The gapping policies are managed in a manner that gives the head office an excellent vision and management of its overall risk.

Another risk is accessibility to medium-term resources and refinancing, which is an issue for BNP Paribas only in certain specific markets.

Consumer Finance, for one, does not generate its own deposits; we need to find funding when we enter, for example, Asian markets, and doing so in local currencies can be a challenge.

Hayes: BNP Paribas Capital and the group's private equity activities seem to be evolving toward a fund management model, in which much of the invested capital comes from external sources while gradually scaling down the proprietary portfolio. What are some risk characteristics of this activity that are of concern to you?

Allorent: BNP Paribas Capital has indeed evolved to a fund management model. The management company is majority-owned by its managers, who have successfully raised funds over the years and generally have provided their shareholders with solid returns. BNP Paribas is an investor in the funds and some times co-invests in specific deals. Following the merger, however, the institution wanted to decrease earnings volatility and the level of capital deployed to these activities, so while BNP Paribas Capital remains linked to BNP Paribas, it is independent; thus, Risk Management is not involved, other than in computing economic capital.

Hartigan: You mentioned having strong experience in areas other than risk management. What do you regard as the defining qualities necessary to properly discharge the functions of a risk manager?

Allorent: Offhand, I can think of three:

1. The ability to have a business mindset.

2. The ability to be equally strong in holding his or her views in front of business lines whose first priority is to generate business, before managing risk.

3. The ability to anticipate. It seems to me that risk management is a lot about anticipation: The ability to analyze what will come out of a specific business transaction or the building of a certain book is quite important.

Hartigan: What role does formal training play at BNP Paribas in the careers of the risk managers? Do you have certain continuing education requirements for your risk managers?

Allorent: We try to appoint risk managers from the business lines that they are going to support, either immediately or distantly, and who can cultivate good dialogue on a daily basis. We then discuss with them both their development goals and those of Risk Management. Our training program is tailored accordingly and is reviewed annually, as training is a formal part of the annual appraisal process.

Hartigan: As you know, RMA is now delivering to our membership a credit risk certification program--a comprehensive examination with 120 very carefully selected questions. We want our members to have a way to ensure the risk competencies of their risk officers and other officers in the bank. Do you think that such a certification would have appeal in Europe and at BNP Paribas in particular?

Allorent: I believe so. It seems to me that this particular certification would quickly become the reference in the industry, and I think the way it's been conceived makes it particularly relevant to risk management organizations in the banks and perhaps elsewhere in the financial industry.

Hayes: You mentioned earlier that BNP Paribas is addressing operational risk management, a new discipline that is evolving rapidly but still has a good ways to go. Could you tell us about BNP Paribas's approach to the identification and management of operational risk today and where you think it's headed?

Allorent: BNP Paribas is moving into what I would call the final development stage of its operational risk management framework. We decided in 2001 to regroup the various existing operational risk activities into a coherent group-wide approach that would allow us to apply for AMA-based (Advanced Measurement Approach) capital calculation under Basel II. We've developed our data, our methodologies, and our tools in the years that followed, and the bank is currently rolling out its approach.

It is changing the way we've worked quite a bit by creating a certain convergence around four operational risk management principles:

* It is risk-profile and tolerance-level driven.

* It is responsibility and accountability oriented.

* It is internal-process centered.

* It relies on a cause-event-effect analysis.

This frames the whole approach that the business lines must take when they look at their operational risks, and it is quite important because it is changing many of the methods that were used before. Operational risk committees meet quarterly to review the risk management data and to issue guidance and monitor the implementation of AMA. These committees are at several levels--from the territories, to the business lines, and up to the Group Executive Committee, which is, in effect, the Group's operational risk committee.

We've worked on key risk indicators with RMA, and we're building on this work to help our businesses refine their KRI framework. Perhaps more than those for other risk categories, operational risk methodologies will need to be tested and refined over the next few years. However, we already have a clear idea of the benefits we will derive from this effort; in particular, it will provide significant input and support to other segments of risk management as well as to the businesses. And, of course, it will help us comply with the mounting burden of regulatory compliance.

We must ensure that the methodologies we are developing will be used beyond the strict needs of operational risk management. If we are successful in this, I believe operational risk management will be a powerful tool to strengthen our enterprise-wide risk management.

Hartigan: It wouldn't be an interview with a global risk manager if we didn't ask you something about Basel II. How much investment in systems, programs, and reporting made over the past three years has been because of Basel?

Allorent: Let me say that Basel has certainly been an accelerator to our investments. However, it's fair to say that we would have made most of these investments anyway. We made the choice in the implementation of our Capital Project to have as many common methodologies as possible between economic and regulatory capital. While the end results of our efforts are naturally different, we've tried to use the same infrastructure in hopes of minimizing the actual cost of Basel II.

I'm especially worried about the implementation cost in Europe, where it looks like we'll have not one compliance effort but the addition of 25 regulatory requirements, since the proposed capital requirement directive is organizing compliance at the level of each entity.

So we have a home-host issue in every country in which we operate in Europe as well as those other countries in which we operate. We are putting great expectations on the concept of the consolidating supervisor.

Hayes: Are you at a point yet in operational risk management where you can point to real payoff's from the application of" this discipline--in terms of reducing the amount of economic capital attributable to this form of risk or in terms of reducing costs, improving quality, or improving productivity within those operations that generate this kind of risk profile?

Allorent: We are still at the pilot stage. But as I mentioned, it's quite important for us to make use of the methodologies beyond the strict requirements of computing capital. We've encouraged the business lines to use these methodologies as a business discipline-when they look at productivity efforts, for example--and we are making progress in this respect. Moreover, already a lot of independent activities have found a natural link to each other, thanks to this framework. For example, our insurance purchase program has been linked to our operational risk profile assessment, and this will optimize our coverage, as well as its cost.

Hayes: We're touched on a good many subjects during the course of this interview. Are there any overarching concerns that you intend to focus on going forward?

Allorent: In 2004, BNP Paribas halved the cost of its credit risk and over the years has achieved on average a cost of risk that is better than the market. Furthermore, our trading operations have yielded good returns, avoiding volatility and P&L accidents. We'd like to do just as well in the next few years. Whether we can do that or not depends on good risk management and, of course, on the overall economic and market environment. As I mentioned before, it's quite important for us to be anticipatory. We are watching the increase in interest rates and the increasing prices of commodities; where these continue to increase will pose a problem for the importing countries. Any brutal decrease will be a problem for the producing countries. So we are trying to include these possibilities in scenarios to help us decide what is reasonable for the bank and what is not.

Another concern is making sure that Risk Management has all the human skills and the tools necessary to fulfill its missions. We mentioned earlier the increasing complexity of products, the increasing complexity of the regulatory environment, the fast-moving economic cycles and the diversity of our markets and activities, and the existence of such factors as terrorism, all of which always figure into the way we plan our endeavors. Risk Management must have the capability to deal with all these challenges.

Contact Maury Hartigan by e-mail at mhartigan@rmahq.org; contact Nicholas Hayes at nhayes@rmahq.org.

Maurice H. Hartigan II is president and CEO of RMA; Nicholas Hayes is director of Global Relations and Market Risk Management at RMA.

COPYRIGHT 2005 The Risk Management Association
COPYRIGHT 2005 Gale Group