By James Lacey

Sherlock Holmes once encountered a mystery in which the central clue was a dog that didn't bark. Equally strange has been the recent case of financial institutions, faced with a new regulatory burden, that didn't complain. In January the Federal Reserve Board announced that it would examine and rate the risk management systems of national banks. Since then, says a Fed spokesperson, "There have been no great cries of anguish from the banking community."

Here's one case (diehard free marketers please note) where regulation is a Good Thing, because it legitimizes the status of the regulated. The examinations may help put the shine back on the industry's image, now somewhat tarnished after a handful of derivatives scandals. Says one head of risk management at a money center bank, "This will go a long way towards strengthening the risk management area and the profession as a whole."

These new risk management examinations will focus on active board and senior management oversight; adequate policies, procedures and limits; adequate risk measurement, monitoring and management information systems; and comprehensive internal controls. In addition, the Fed has created a rating system to be factored into the overall assessment of management. (See box for details.)

The effect of a rating less than "2" could be catastrophic to a bank's standing in the derivatives market. Where fault is found, the Fed says it will initiate supervisory activities and make sure critical operational duties are properly segregated and system deficiencies are fixed. The ultimate weapon to ensure compliance will be formal enforcement actions against the bank or the responsible officers and directors.

"It is no longer good enough to examine bank activities by the old line-item methods," states the Fed spokesperson, since "the nature of the banks' business allows them to change their risk profiles virtually overnight." This new rating system, on the other hand, will provide a snapshot of the risk profile.

But are mere examiners really qualified to make judgments in the complex environment of risk management, especially when these institutions employ some of the most esoteric model-based instruments in the universe? Holmes might not find it "elementary," but a number of bank risk personnel assert that lately the Fed has done a great job upgrading the quality of its examination staff. States one bank risk manager, "The examiners we see are very sharp and quite capable of making these kinds of reasoned decisions."

Rating 1 (Strong)-Management effectively identifies and controls all major types of risk posed by the institution's activities. Board and management participate in managing risk and ensure that appropriate policies and limits are in place. These policies are supported by strong risk monitoring and management information systems. Internal controls and audit procedures are comprehensive. Though there may be a few noted exceptions to policies, none are material.

Rating 2 (Satisfactory)-The institution's management is largely effective, but lacking to some modest degree. However, there is a responsiveness and ability to cope successfully with existing and foreseeable exposures that may arise from the institution's business dealings. While there may be some minor problems, they have been recognized and are being addressed. Generally risks are being controlled in a manner that does not require additional or more than normal supervisory attention.

Rating 3 (Fair)-Management practices are lacking in some important ways and therefore require more than normal supervisory attention. Generally such a situation reflects a lack of adequate guidance and supervision by directors and management. Unless addressed these conditions may affect the safety and soundness of an institution.

Rating 4 (Marginal)-Risk management practices generally fail to identify, monitor or control significant risk exposures in many material respects. These deficiencies require immediate and concerted corrective action along with greatly increased supervisory attention.

Rating 5 (Unsatisfactory)-There exists a critical absence of effective risk management practices. The board and senior management are wholly deficient and the entire situation requires immediate and "close" supervisory attention.