Argyle conversation: David Kimm, CRO & Treasurer, TD Ameritrade

Transcription

1 Argyle conversation: David Kimm, CRO & Treasurer, TD Ameritrade January 1, 1970 Full conversation available for download here. PETER DE BOER: To set the stage for this conversation, can you please provide some background information on TD Ameritrade and your position there? DAVID KIMM: TD Ameritrade is the industry leader in online trading, currently averaging about 400 thousand trades a day across our suite of products and clients. We started out in Omaha about 36 years ago, with a business model that focused on pioneering the discount brokerage model for the self-directed trader. Since then we have evolved our business through acquisition and organic growth, and now we focus on the active trader as well as long-term investors. In addition, with the acquisition of TD Waterhouse five years ago, we are the third-largest independent Registered Investment Advisor (RIA) custodian in the country. About 18 months ago, I was brought in as chief risk officer and treasurer for TD Ameritrade to establish a risk function that previously had not existed. We made the decision, which I think was a very perceptive one, to bring together the majority of control and oversight functions under me. In addition to treasury on the control side, I m responsible for operational risk, risk planning and analysis, compliance, the internal control assessment programs and internal audit. In addition, the business unit risk functions dually report to me as do the operations functions which manage our margin portfolio, stock loan business, and trading and settlement activities. TD Ameritrade s design is for the chief risk officer role to bring together all of these typically disparate organizations into a single group. This allows us to make decisions more efficiently, and align our structures and priorities, in ways that would not be possible if a group of peers from separate areas were attempting to negotiate a collective view of risk solutions. From a risk standpoint whether it be operational risk, credit risk or market risk where do you spend the majority of your time? TD Ameritrade has an uncommon business model in that we are an agency-only firm, with a value proposition that reduces potential conflicts of interest. When people think about us as a material force in the marketplace there is an assumption that we basically look like a Merrill Lynch in microcosm, but we actually don t. We don t have anything other than distribution and custody in our business model. A core part of TD Ameritrade s value proposition in the marketplace is our open architecture platform, so we don t manufacture products. We are an agency execution firm, so we don t do principal trading, we don t do proprietary trading, we don t have capital markets activities, and we don t make markets. The list of things that we don t do is, in many respects, longer than the list of things that we do. These points of strategic differentiation uniquely shape our risk environment. Since we don t take proprietary positions we effectively eliminate market risk, so that risk pillar is something we needn t worry about. From a credit risk perspective we are entirely a collateralized lender, almost exclusively Reg T margin. Just as with other broker/dealers we rely on the assets we hold on our books to offset the loans, so our credit risk, even though we have just under $10 billion in the margin portfolio, is actually pretty small. The place where I spend a lot of my time from a risk perspective is the development and execution of an operational risk framework. When I got here a formal operational risk organization wasn t part of the organizational structure, but now we ve created a very strong central group and defined TD Ameritrade s operational risk framework. We ve begun to build the fundamental capabilities and tools for managing it, beginning to aggregate data and perspectives from across the firm, and are working with our business partners to implement it in the environment. As you might expect, there s a lot of education that goes along with this, a lot of dialogues to help people understand their operational risks and TD Ameritrade s risk appetite as they more specifically focus on key risks as a central part of their business management structures. page 1 / 5

2 How do you define operational risk as it relates to your business? One of the early things that I did here was define our current risks, emerging risks, areas where we don t have risk, and risk-mitigation factors. When you look at our business it s very clear that the vast majority of our client interactions are through an automated channel. Ninety percent of interactions are either on the web or through the IVR platform. With that model the broad operational risk landscape starts to resolve into some clear areas of primary focus. Our single largest operational risk category is technology platform stability, applications stability and availability, and information security. Human capital is the second of our eight operational-risk focus areas. Financial risk is the third area. Business process meaning back-office operations and trade execution settlement clearing processes, processes around new product reviews and approvals, and processes around client interactions is another. Regulatory compliance is the fifth area, and one that is top of mind for everyone these days. Those five are what we view as our primary operational risks. Then there are three secondary risks: legal, vendor and implementation. Legal risk is in the secondary risk category because by policy we do not take legal risk; legal risk occurs as a derivative of the other activities that we perform. We very specifically will never accept legal risk as a component of a business decision if we re not covered from a legal perspective we simply will not perform those activities. Vendor, similarly, is a secondary and derivative risk. And implementation is a secondary risk because it s periodic. Whether it s a major change to our environment, such as the data center migration that we completed last year, or an acquisition, implementation risk is episodic and based on discrete decisions. At TD Ameritrade we re focused on making sure there is literacy around our primary risks. As we translate those risks down to the business level, we want to make sure that the businesses are thinking about their key risks and key activities against a single consistent framework, and then looking at the primary controls that are in place. We want to avoid creating an overly broad and complex conversation, as this has the potential to distract us from the things that are most important. We want to make sure we ve got the blocking and tackling, the basic concepts and most significant risks, covered early on. Everything else will evolve from there. As you mentioned, these operational procedures didn t exist before you arrived. What resources did you pull from in order to create this framework? It was a combination of past experience and practice. Many of the things that we re applying are relatively common in terms of the broad concepts around risk management. What s unique here is that we didn t have an existing structure or view on operational risk. We ve had the ability to bring in some really great people with experience at broker/dealers, banks and other financial services firms, who have built these structures for other entities. They ve gone through the painful fits and starts of trying to evolve these things over time. We ve done some work with Deloitte+Touche as an external point of comparison to define what best practice means today, and move directly to implementing those structures without having to go through the trial and error. How do you track the primary and secondary operational risks that you ve identified? Over the past year we have installed a suite of products to help us manage risk through-out the organization, which will be the backbone of our risk management infrastructure. It will provide structures to link financial, operational and other risks together on a common platform. It allows us to build an integrated assessment structure, which we think will be both efficient and helpful. In addition, we have developed a set of internal tools for managing some of the more important tangible aspects of risk. We ve created an issue-tracking and remediation database which we populate with regulatory exam findings, audit findings, and internal items and track these items through their completion cycle to make sure that we are focused on the things that we know we need to improve. We ve linked a loss tracking and management structure to the GL/P&L to ensure that there is visibility into where operational losses are appearing in the environment since there s no more direct link to a risk or control problem than where you re losing money. We want to make sure that we can track those events/issues back to their root cause and begin the appropriate remediation processes. page 2 / 5

3 The firm s internal control assessment program, which supports our SOX and 342 certifications, is already on the enterprise risk platform so using this to aggregate and manage our overall risk structure is both logical and complementary. TD Ameritrade s internal risk assessment program, focused on the eight operational risk categories, is in separate modules, and each will link together to create a comprehensive overall assessment. We ve been able to bring all of our key stakeholders to a common understanding of our objectives for using the same framework in a complementary way. In my view it is extremely important to be able to have conversations with our business partners based on a single view of the risk hierarchy rather than having a compliance risk perspective versus an operational risk perspective versus an audit risk perspective. Is there anything specific from a regulatory standpoint that you re trying to mitigate over the next 12-to-24 months? For all of us in the financial services industry and particularly the securities brokerage firms that are owned by or have a major shareholder affiliation with a bank holding company the landscape is quite dynamic. It s quite a challenge to try to anticipate, especially now that regulators that have not previously been part of our domain are becoming part of our landscape. TD Ameritrade, for example, is 43% owned by the Toronto Dominion (TD) Bank. Through various acquisitions they have become a much larger presence in the United States, and the Federal Reserve Bank of New York is becoming much more interested in looking at all of their subsidiaries and affiliates. From a Federal Reserve Bank perspective, TD Ameritrade is viewed as a subsidiary due to TD Bank owning more than 25% of its equity even though we re a completely separate, publically traded entity. We are very sensitive to maintaining good relationships with all regulators. Perhaps the largest regulatory uncertainty is what the new rules and regulations required by Dodd-Frank will actually encompass. There is the prospect that some of the new regulations could require quite sweeping changes across the financial services industry, and TD Ameritrade intends to continue being an active participant in the rule-making process, including submitting comment letters on matters which are of concern to the firm. Of course, there will also be new areas of focus for the SEC and FINRA. For example, in SEC Chairperson Mary Schapiro s speech to the SIFMA Legal and Compliance Annual Seminar in March she mentioned the SEC will be expanding its risk management examinations from issues- like new product review and model validation- to also evaluating firms overall enterprise risk management processes and structures, including whether there is a clear culture of compliance. She also referenced potential new requirements for automation review polices and enhanced standards for automated systems capacity, security and resilience. The next year or two will be quite dynamic, and we will need to carefully monitor how the regulatory environment is evolving. Are there certain metrics that you use to assess trading activity that help gauge the overall economy? The economy is always a tricky question. We re more focused on trying to gauge the health of our clients. For us, given that much of our revenue comes from trading activities, volatility is a good thing. From a revenue-generation perspective higher VIX generally results in higher trading activity, which for us is a positive. Given our history in that business we believe we have a very good set of controls around those clients. We understand their patterns and activities, and we are pretty adept at managing the risk in that space. As we also look at the long-term investor we re trying to make sure that we re applying a consistent discipline to understanding them, recognizing that as a primarily self-directed firm we don t provide personalized advice to any of our clients, nor do we recommend securities. As we track the client and business metrics we continue to think about how to bring together the right combination of client, financial, operational and risk information to form well-rounded bases for both strategic and tactical decision making under conditions of uncertainty. We re never going to have all the facts we would like, so developing the best fact set available to support informed business judgment, rather than a hard logical conclusion, is important. page 3 / 5

4 Do you categorize your client base in terms of riskiness, and is the collateralized lending based on that? Margin lending is fundamentally based on a combination of individual security and client portfolio characteristics. We review margin-eligible equities earnings, liquidity, volatility and capitalization characteristics to determine the relevant margin maintenance requirements at the security level. We then make individual account adjustments based on the client s concentration, portfolio diversification, and quality. We think we ve got a pretty tight review and management process at that level. We ve had very minimal loss experience through the whole financial crisis. As we think about our clients and the evolution of our client value propositions we are striving to become smarter at understanding who they are not only financially but also behaviorally. The whole issue of behavioral segmentation of clients is something that s been kicking around, particularly in marketing spheres, for a number of years. It s a little unclear how practical that is in its application, but the more we know about our clients behaviors the more we re able to relate them to the products and services TD Ameritrade has available. Behavioral and predictive models also allow us to identify the moments that matter and to engage with our clients and prospects in a timely and effective way. As an enterprise, we ve staked out a corporate mission to be The Better Investment Firm for Today s Investor. We view it as a journey. As soon as you think you re the best, you re about to get knocked off the pedestal. We want to make sure TD Ameritrade is an organization that s focused on continual improvement, both in what we deliver as client value and from a management-process perspective. Do you have clients outside the U.S.? We are almost exclusively a U.S. domestic broker/dealer. We have very small registered broker-dealers in Singapore and Australia, both of which were part of the acquisition of thinkorswim Group, Inc last year. Beyond that, our international aspirations are limited. We have conversations with TD, which has inter-national entities, about ways in which we might be able to find some joint opportunities. But at present we think we have a tremendous opportunity domestically, so that s where our focus is. Chief risk officer is a relatively new role, especially outside of the financial world. Do you think we ll see chief risk officers become more prominent across non-financial industries? I do. As we look back over the last two years, many organizations that had risk officers somewhere within their structure have elevated those positions to the C-level. Also, the traditional or historical view of the risk person has shifted. Certainly in financial services firms, risk managers were typically people who came out of quantitative disciplines and had a very model-focused risk perspective. As the chief risk officer role continues to evolve it s taking on broader and more strategic roles within many firms. The people I know who are really good chief risk officers don t necessarily come from risk-specific backgrounds. In my case, I spent the first 10 years of my career as a retail broker and manager. Then at Paine Webber I was placed into my first CFO role. For the last 20 years of my career, I ve been in a variety of CFO and COO positions. While I m not a quantitative risk person at core, I have been responsible for almost every function within a major broker/dealer and have a good understanding of how the pieces fit and where the friction and breakage typically occur. I m able to apply that background to help manage risk from a process perspective, a structural perspective and a business perspective. Ultimately, good risk management and good business management should fundamentally apply the same disciplines. Aside from TD Ameritrade, are there other companies that you think have done an especially noteworthy job at risk management? Looking back at the last few years, the firm that really stands out is Goldman Sachs. Risk is embedded in the fabric of how Goldman is managed; it s not an adjunct to the conversation. Every decision brings together a perspective of the risk and opportunity in the decision, and then a dialogue around whether to accept or mitigate that risk. If we re able to achieve that same level of harmonization in TD Ameritrade s conversations I think we will have done a very good job of getting to a place where risk management and business management are both effective and page 4 / 5

5 Powered by TCPDF ( complementary. page 5 / 5