This kind of change is doomed to fail unless there is full commitment and support from banks’ senior officers and management. Indeed, without adequate governance and a clear ‘tone from the top’ there is no chance of success. 4/6  As I like to point out in many of my interventions, governance is always a precondition for any significant change to occur within an organisation, but of course it is just a precondition. Evidently, other elements must be implemented in order to tackle appropriately the management and control of non-financial risk. One initial element relates to the involvement of the Board, which should consider nonfinancial risk management as part of their regular monitoring, instead of simply reacting to emerging issues if controls fail. Just like in the case of traditional risks, the Board must include non-financial risk inside their risk appetite framework; obviously this implies that they should be able to understand the nature of these risks, in order to discriminate and rank their importance. Of course, the role of the Board cannot function without the right input from both first and second lines of defence. In this regard, it is important that, apart from owning and managing risk, the first line assesses key infrastructure areas, such as IT and operations, where most operational failures occur. The culture of the bank should also emphasise that first-line areas should also take responsibility for non-financial risk management, rather than focusing entirely on revenue or cost management.
15/11/2019  Opening remarks 11th edition of the European SSM Roundtable/International Bankers Forum Margarita Delgado Deputy Governor  Good Morning and welcome to Banco de España for this 11th edition of the European SSM Roundtable, organised by the International Bankers Forum (IBF). The topic for today’s roundtable is the management of non-financial risk. This is an issue which is always in the spotlight and, at the same time, is quite hard to tackle. The concept of risk is continuously used in banking regulation. A quick search in the CRR1 or CRR2 text will reveal that it is mentioned nearly 1,500 times in each. Banks are certainly familiar with the regulatory requests to understand, measure, hedge, control, assess, address or mitigate risk. I believe it is fair to say that any firm that has survived the crisis and its long aftermath, without public support, has been largely successful in fulfilling these risk-related tasks. Of course, supervisors are also permanently concerned about risk; to some extent, it is what we are paid for. Still, I believe both banks and supervisors tend to feel rather comfortable when we assess financial risk. Don’t misinterpret me. We are perfectly aware of the consequences that a mismanagement of financial risk can entail, but we tend to look at financial risk in a more natural and intuitive way. Things get a lot stickier when we look at non-financial risk. What is the nature of non-financial risk? And what makes it different from more traditional financial risk?