Before the collapse of Lehman Brothers, I expressed my doubts about the effectiveness of assurance tools developed over the last few decades — usually as a response to a significant crisis — for the very purpose of avoiding another crisis. At that time the latest instrument was the U.S. Sarbanes-Oxley Act of 2002, which came in addition to credit risk management, regulators, external audit, internal audit, Basel II, and other measures. Then the next crisis occurred, continuing a long succession of systemic financial failures. This cycle needs to be broken. Rather than bouncing from one crisis to the next, with new assurance measures tacked on after each incident, we need a proactive, long-term solution that involves substantive change.
In the years leading up to the 2008 crisis, banks extended mortgage loans to customers who eventually weren't able to repay them. Yet mortgages are perhaps the oldest and best-known bank product in existence — financial institutions have hundreds of years' worth of experience assessing whether home mortgage applicants are qualified for the loans they seek. Credit officers must have known that many of these loans were of poor quality, that their risk was limited only as long as house prices kept rising, and that the securitization of these loans did not change their underlying quality.
If these officers knew the loans were problematic, other risk managers, auditors, and regulators should have known as well. And yet no one acted to stop the crisis in the making. For this to occur, something must be really wrong in the assurance world — so wrong that an additional layer of regulation and reporting will not solve it; so wrong that additional ethical screening or capping of CEO compensation will not stop it.
To achieve meaningful reform, political authorities need to establish a task force of assurance specialists, unbiased by any duty to protect their own profession, who can effectively identify the specific assurance failures that resulted in the financial crisis. Based on their findings, the specialists should redesign the assurance world from scratch.
Part of the revised system should include internal audit assessments of whether all necessary controls are in place within financial institutions, with subsequent reporting of any deficiencies to the chief risk officer or other company risk authority. This individual should, in turn, be legally liable for reporting bank risk to the national or international regulator. The quality of reporting should be continuously measured by the discrepancy between the assessed risk and the companies' actual profit/loss. Regulators would then compare the measured discrepancies for all reporting companies and identify risks that are unacceptable for the stability of the financial system.
I envision a system where assurance providers truly help maintain the overall health of financial markets and keep the economy on a more even keel. Let's just hope reforms to this effect, or other transformative changes, are put in place before the next crisis emerges.