Credit Suisse didn't altogether learn its risk management lessons during the financial crisis of 2008/09, risk specialist Nir Kossovsky tells finews.asia. And he's not a fan of separating the asset management unit where the trouble began.

Nir Kossovsky, Greensill demonstrates that Credit Suisse’s risk management was weak or failed even. Is this a surprise given the fact that risk management has been a regulatory issue and ramped up in banks?

It’s unfortunate that Credit Suisse’s risk management process wasn’t already organized in a way that mitigated reputation risk after the financial sector’s reputational crisis of 2008. Reputation risk is one of eight named statutory perils.

Differing from compliance or regulatory risk, reputation risk – economic damage from disappointed stakeholders – is best mitigated through an enterprise-wide combination of intelligence gathering, risk management triage, communications, and risk financing all overseen by a reputation risk-savvy committee of the board.

Would you describe this as a systemic failure or a failure of individuals within Credit Suisse?

It’s always possible that a group of individuals «went rogue» and purposefully failed to conform to specific Credit Suisse controls.

«Reputational crises trigger financial losses through a range of cascading perils»

But given that the issue here is that the underlying assets of certain securities weren’t what customers, creditors, investors and regulators expected – which is essentially the same issue the led to a financial collapse in 2008 – the failure was systemic at the level of enterprise reputation risk governance and management.

Where do you pinpoint the main problems after having gathered critical intelligence within Credit Suisse?

Our advisory work typically exposes the root cause to be siloed knowledge, authority, and accountability. Such impediments are mitigated in an organization with a well-developed reputation risk governance and management apparatus.

Credit Suisse faces a cascade of financial, legal, and reputational damage. How does this compare to the subprime crisis?

Reputational crises trigger financial losses through a range of cascading perils including angry disappointed customers, investors, and regulators who litigate, customers who walk away, employees who become disengaged, creditors who raise the cost of capital, investors who shun the stock, and so forth.

«Over the past few weeks, CS’s reputation rank slipped from 77th to 84th among 134 peer banks»

As to the subprime collapse, history is not quite repeating itself, but it certainly rhymes. In proportions, however, there is no reason at present to think this is a widespread issue.

Before Greensill, what was Credit Suisse's reputation?

Let me respond with the same quantitative rigor that enables us to ensure reputation risk parametrically and arbitrage equity portfolios on the basis of «reputation premium.» Over the past few weeks, CS’s reputation rank slipped from 77th to 84th among 134 peer banks.

Just before the Covid-19 crash in early February 2020, it ranked 74th. Currently, and typical of a crisis, its reputation value metrics are impaired, and its reputational value volatility is higher.

«Reputation risk is the greatest threat to ESG value»

However, CS’s reputational value has been volatile for a number of years. Even during a relatively stable period between the fall of 2018 and February 2020, it declined slowly from its peak value in late January 2018.

It is not clear to us right now how different CS’s current reputational value volatility is relative to its long history. When triggered by a major event, it is our practice to judge a material change in a firm’s reputational value only after a 20-week observation period.

You say Credit Suisse could have avoided this – or at least mitigated it. How?

Reputation risk is the greatest threat to ESG value, yet most ESG-focused companies naively defend their reputations with marketing rather than preempt costly perils with governance and risk management.

Getting granular, institutions such as CS need an integrated reputation group to implement an enterprise-wide strategy. Focusing its efforts on intelligence gathering and analysis, this group must mark for managerial triage the discrepancies between stakeholder expectations and operational reality—what we call reputation risk. Stakeholders will appreciate and value a credible and convincing story of reputation risk management if it is authenticated by a trusted 3rd party through attestations, opinions, or insurances.

Does the CEO or other top managers need to step down?

Reputation value restoration for institutions is a four-step process. CS leadership must own the failure and apologize for failing to meet stakeholder expectations. Leadership must acknowledge that it has identified where its risk management processes failed.

«These three steps will stem the reputational hemorrhage»

It must prove that it has changed those processes—meaning, implemented a robust authenticated reputation risk governance and management program. These three steps will stem the reputational hemorrhage. To fully restore its reputation, it must explain how it is sharing these authenticated new governance and management processes—perhaps in some form of industry-standard combined with a warranty or insurance – so that others do not fall into the same trap.

Credit Suisse should dismiss individuals only if they are so closely associated with the failed processes that in the minds of stakeholders their presence discounts the authenticity of CS’s new reputation risk governance and management systems.

Credit Suisse seems to follow a tactic of isolating the problem by spinning off asset management. Is this the right way?

It is an unusual strategy in a market where institutional investors value ESG. Many financial services firms ranging from Apollo Global Management to Morgan Stanley are going the other way and actually bulking up their asset management businesses.

«I think Credit Suisse could greatly benefit from structural and operational changes»

The purpose is to present themselves to investors as low-risk asset managers rather than high-risk bankers. The prize, a higher earnings multiple, is the expected reward for an authentic reputation risk management story. I think Credit Suisse could greatly benefit from structural and operational changes that reduced their risk profile.

Nir Kossovsky is CEO Steel City Re, a Pittsburgh, PA-based insurer of reputation risks. He is an expert in measuring reputation and in tailoring insurance solutions.