Regulators also have a role in assessing risk management at financial  institutions. In particular, oversight of risk management at large financial  institutions is divided among a number of regulatory agencies. GLBA authorizes the  Federal Reserve and OTS to examine the holding company and each  subsidiary in order to: (a) inform the regulator of “the nature of the  operations and financial condition” of the holding company and its  subsidiaries; and (b) inform the regulator of the financial and operational  risks within the holding company system that may threaten the safety and  soundness of the holding company’s bank subsidiaries and the systems for  monitoring and controlling such risks; and (c) monitor compliance with  applicable federal laws. Regulators Identify Areas of Risk and Examine Risk Management Systems, but Their Specific Approaches Vary

The Federal Reserve, FINRA, OCC, OTS, and SEC each identify areas of  risk relating to the large, complex financial institutions they oversee and  examine risk management systems at regulated institutions. However, the  banking and securities regulators take different approaches. SEC and FINRA aggregate  information from officials and staff of the supervised institutions  throughout the year to identify areas of concern across all broker-dealers. The focus of  SEC and FINRA oversight is on compliance with their rules and the  Securities and Exchange Act of 1934. SEC and FINRA conduct horizontal or “sweep” examinations and, for  example, have completed one for subprime mortgages. Banking Regulators Have a Variety of Tools to Address Risk Management Weaknesses

The banking regulators have developed guidance on how they should  communicate their examination findings to help ensure that financial  institutions take corrective actions. Regulators told us that despite these identified weaknesses,  they did not take forceful action—such as changing their assessments— until the crisis occurred because the institutions reported a strong  financial position and senior management had presented the regulators  with plans for change. Some Regulators Identified Weaknesses in Risk Management Systems in a Limited Number of Institutions but Did Not Take Forceful Actions to Address Them until the Crisis Began

In several instances, regulators identified shortcomings in institutions’  oversight of risk management at the limited number of large, complex  institutions we reviewed but did not change their overall assessments of  the institutions until the crisis began in the summer of 2007. Moreover, the examiners said that senior management had  presented them with plans to address the risk management weaknesses. Regulators Identified Weaknesses in Models Used to Calculate Risk but May Not Have Acted on These Findings

Regulators also identified weaknesses in the oversight and testing of risk  models that financial institutions used, including those used to calculate  the amount of capital needed to protect against their risk exposures and  determine the valuation of complex products. We found that regulators had identified numerous weaknesses in stress  testing at large institutions before the financial crisis. However, our limited  review did not identify any instances in which an institution’s lack of  worst-case scenario testing prompted regulators to push forcefully for  institutional actions to better understand and manage risks. Regulators’ Oversight of Institutions’ Risk Management Systems Illustrates Some Limitations of the Current Regulatory System

In this and other work, we identified two specific shortcomings of the  current regulatory system that impact the oversight of risk management at  large, complex financial institutions. First, no regulator has a clear  responsibility to look across institutions to identify risks to overall  financial stability. Even when regulators perform horizontal examinations across  institutions, they generally do not use the results to identify potential  systemic risks. Second, although financial institutions manage risks on an  enterprisewide basis or by business lines that cut across legal entities,  primary bank and functional regulators may oversee risk management at  the level of a legal entity within a holding company. While the regulators periodically conducted horizontal examinations in  areas such as stress testing, credit risk practices, and risk management for  securitized mortgage products, these efforts did not focus on the stability  of the financial system, nor were they used as a way to assess future  threats to that system. Primary Bank and Functional Regulators May Limit Their Oversight of Risk Management to Specific Legal Entities Such As Depository Institutions or Broker- Dealers

Some regulators have noted that the current practice of assessing risk  management at the level of a depository institution or broker-dealer did  not reflect the way most large, complex institutions manage their risks.
Why GAO Did This Study

Financial regulators have an important role in assessing risk management systems at financial institutions. Analyses have identified inadequate risk management at large, complex financial institutions as one of the causes of the current financial crisis. The failure of the institutions to appropriately identify, measure, and manage their risks has raised questions not only about corporate governance but also about the adequacy of regulatory oversight of risk management systems. GAO's objectives were to review (1) how regulators oversee risk management at these institutions, (2) the extent to which regulators identified shortcomings in risk management at certain institutions prior to the summer of 2007, and (3) how some aspects of the regulatory system may have contributed to or hindered the oversight of risk management. GAO built upon its existing body of work, evaluated the examination guidance used by examiners at U.S. banking and securities regulators, and reviewed examination reports and work papers from 2006-2008 for a selected sample of large institutions, and horizontal exams that included additional institutions. In January 2009, GAO designated the need to modernize the financial regulatory system as a high risk area needing congressional attention. Regulatory oversight of risk management at large, financial institutions, particularly at the holding company level, should be considered part of that effort.

What GAO Found

The banking and securities regulators use a variety of tools to identify areas of risk and assess how large, complex financial institutions manage their risks. The banking regulators--Federal Reserve, Office of the Comptroller of the Currency (OCC), and the Office of Thrift Supervision (OTS)--and securities regulators--Securities and Exchange Commission (SEC) and the Financial Industry Regulatory Authority (FINRA)--use somewhat different approaches to oversee risk management practices. Banking examiners are assigned to continuously monitor a single institution, where they engage in targeted and horizontal examinations and assess risks and the quality of institutions' risk management systems. SEC and FINRA identify areas of high risk by aggregating information from examiners and officials on areas of concern across broker-dealers and by monitoring institutions. SEC and FINRA conduct discrete targeted and horizontal examinations. The banking regulators focused on safety and soundness, while SEC and FINRA tended to focus on compliance with securities rules and laws. All regulators have specific tools for effecting change when they identify weaknesses in risk management at institutions they oversee. In the examination materials GAO reviewed for a limited number of institutions, GAO found that regulators had identified numerous weaknesses in the institutions' risk management systems before the financial crisis began. For example, regulators identified inadequate oversight of institutions' risks by senior management. However, the regulators said that they did not take forceful actions to address these weaknesses, such as changing their assessments, until the crisis occurred because the institutions had strong financial positions and senior management had presented the regulators with plans for change. Regulators also identified weaknesses in models used to measure and manage risk but may not have taken action to resolve these weaknesses. Finally, regulators identified numerous stress testing weaknesses at several large institutions, but GAO's limited review did not identify any instances in which weaknesses prompted regulators to take aggressive steps to push institutions to better understand and manage risks. Some aspects of the regulatory system may have hindered regulators' oversight of risk management. First, no regulator systematically looks across institutions to identify factors that could affect the overall financial system. While regulators periodically conducted horizontal examinations on stress testing, credit risk practices, and risk management for securitized mortgage products, they did not consistently use the results to identify potential systemic risks. Second, primary bank and functional regulators' oversee risk management at the level of the legal entity within a holding company while large entities manage risk on an enterprisewide basis or by business lines that cut across legal entities. As a result, these regulators may have only a limited view of institutions' risk management or their responsibilities and activities may overlap with those of holding company regulators.