A. When Does a Board Risk Committee Help Increase Shareholder Wealth?

Adams et al. (Reference Adams, Ragunathan and Tumarkin2021) examine an extremely large sample of public firms from 1996 to 2010 and find that boards have an average of three to four committees. Boards of public firms typically establish audit, compensation, corporate governance, and nominating committees. Sometimes boards of public firms have additional committees, but if they do, they have few of them. For instance, the board of directors of Microsoft has an environmental, social, and public policy committee. Microsoft’s board does not have a committee focused on its cloud operations or Windows, although the profits generated from these activities are worth hundreds of billions of dollars. JPMorgan Chase’s board has committees similar to those of Microsoft’s, but it also has a risk committee. JPMorgan Chase does not have a committee for its asset management or customer finance divisions.

There are at least four reasons why firms do not have more standing committees and why they do not have standing committees charged with responsibilities related to their operating divisions. First, firms are run by management, and the board’s role is not to second-guess day-to-day operating decisions. If Microsoft’s board had a committee monitoring its cloud activities, the committee might find it difficult to avoid interfering with management and could make it harder for the firm to pursue its overall strategy. Second, board members have fiduciary duties, including a duty of care that requires them to be informed about and responsible for the board’s decisions rather than delegating them to others. As a result, issues debated in a committee must still be considered by the full board, which necessarily limits the range of issues that can be handled by a committee. Third, board members have limited time. If directors devote attention to one issue, they necessarily have less time for others. Moreover, requiring directors to spend more time on board matters makes it more difficult to attract members with diverse skills and experience, potentially reducing board effectiveness. Fourth, committees can reduce board engagement and hinder communication among directors (Adams et al. (Reference Adams, Ragunathan and Tumarkin2021)). Effective communication is critical for board functioning (Malenko (Reference Malenko2014)). Committees may form cliques that reduce information sharing, encourage block voting, and allow members to withhold information from the full board.

Committees are especially useful for specialized tasks that the full board is unequipped to handle and/or would find inefficient to address in a plenary session. For example, the audit committee oversees a company’s financial reporting processes, internal controls over financial reporting, and financial statement audits (SEC (2003)). The board cannot fulfill its responsibilities if it cannot rely on a firm’s financial statements. However, the board can delegate much of the work to ensure that the process of producing financial statements is reliable. The audit committee can then report its efforts to the board, and the full board does not need to be familiar with the technical accounting details.

A risk committee can perform specialized tasks similar to those of an audit committee. Just as accounting generates metrics used to assess firm performance, risk management generates risk metrics essential for evaluating firm risk and whether management is pursuing a commonly agreed-upon strategy. To assess whether a bank’s risk-taking is consistent with its business model and strategy, the board must rely on management’s representations of risk, typically conveyed through risk metrics. A board committee can ensure that the data and risk representations are reliable. Therefore, an individual board member does not have to know the details required by a committee to be comfortable with the data and risk representations.

Every board relies on metrics produced by a firm’s accounting process. For example, accounting data inform the board about a bank’s leverage, asset composition, and loan performance. Banks that primarily lend to small firms and individuals generate metrics such as loan losses and internal loan ratings. Because these metrics can typically be evaluated through the audit process, a risk committee is not necessary to ensure their reliability for the board.

Large and complex banks are in a different situation. Forward-looking risk metrics are essential for them to manage risk and for the board to evaluate management’s risk-taking. For instance, a bank that makes markets in derivatives relies on more complex risk metrics to understand the risks of such activities. Another example is the ubiquitous value-at-risk (VaR) measure, which represents the maximum loss for a given confidence level (Jorion (Reference Jorion2007)). The accounting function does not produce such metrics. Further, there is no standardized rulebook, like GAAP, for producing such risk metrics. For risk metrics to be helpful to management and the board, they must be reliable across the bank according to similar rules; thus, a centralized risk function is generally required. The usefulness of the metrics depends, in part, on the quality of the risk management function; therefore, the board must monitor it. Furthermore, assessing the risk for certain banks requires evaluating risks that are difficult to quantify. For instance, the risk of two otherwise identical banks might be quite different if risk limits are monitored differently and compliance with those limits varies. Similarly, the assessment of risk metrics might differ across banks with different cultures. In addition, for a complex bank, monitoring risk metrics and risk management functions is time-consuming and requires expertise. Finally, having the audit committee perform these tasks may reduce its effectiveness in fulfilling its traditional responsibilities.Footnote ³

Therefore, a board risk committee is helpful for large and complex banks focused on shareholder wealth maximization. It must ensure that the metrics are reliable and consistent with the firm’s strategy. The committee must be confident that the risk metrics cover all risks material to the bank. It must ensure that processes exist to produce the metrics and that the bank stays within the established limits for the metrics. When relevant metrics are produced as part of the accounting process, a risk committee is not necessary. In other words, simple banks do not need a risk committee. As a bank increases in size and complexity, we expect the establishment of a risk committee to maximize shareholder wealth.

With both audit and risk committees, there is no concern about usurping the functions of management, since the board cannot perform its functions without relying on the metrics these committees focus on. If management resists deeper probing of these metrics, it may signal to the board that the metrics are unreliable. These committees are expected to probe because management may have incentives to withhold information from the board.

Bank boards set policies regarding risk-taking. In recent years, the policy for large banks has been formulated through risk appetite statements (International Institute of Finance (2011)). These statements define the level of risk that the board considers appropriate for a bank. With a more traditional bank, it is typically straightforward to ensure that management’s risk-taking is within the limits prescribed by the board. However, with more complex and larger institutions, bank-wide metrics can hide risk-taking, which could be inconsistent with the board’s risk appetite for the bank. Therefore, to ensure that the board has an unbiased and accurate assessment of a bank’s risk, the board or a risk committee must probe deeper to ensure that risk is monitored adequately and that risk metrics capture excessive risk-taking.

Given its business model, a bank’s optimal risk level maximizes shareholder wealth within regulatory and legal constraints (Stulz (Reference Stulz2016)). The board plays a key role in setting the target risk level and ensuring that the bank’s risk does not deviate from it. Suppose that a bank’s board has been operating without a risk committee. Perhaps the functions of the risk committee were performed either by the audit committee, as the relevant metrics were primarily accounting-based, or by the full board. As the bank becomes larger and more complex, the board concludes that a risk committee is needed. With greater confidence in risk metrics and the process that produces them due to the presence of a risk committee, the board may become more comfortable with the bank taking additional risks within regulatory and legal constraints.

Finally, we expect banks to be more likely to adopt risk committees if mismanaging risk is particularly costly. Banks with larger equity cushions may be less likely to establish a board risk committee if the cushion substitutes for risk management investments.

B. Why Would a Bank Board Not Have an Effective Risk Committee?

As discussed in Section II.A, a board may rationally choose not to have a risk committee because it would not maximize shareholder wealth. Other factors may discourage its establishment or effectiveness. It is well known that boards can fail to do their jobs (Jensen (Reference Jensen1993)). One reason is that entrenched management unduly influences the board. If the CEO is entrenched, she may prefer that the board not have a risk committee, as the committee may constrain her actions. We refer to this perspective as the entrenchment hypothesis. However, if the CEO is entrenched and has co-opted the board, the risk committee would likely be co-opted as well and may not pose a threat to management. In this case, the committee’s role would be merely window-dressing. Hence, if management is entrenched, the bank may lack a risk committee or have an intentionally ineffective one.

A risk committee could be ineffective because the board rubber-stamps management decisions (Fluck and Khanna (Reference Fluck and Khanna2008)). Such a board does not gather information independently and simply approves management’s proposals. Similarly, a rubber-stamping risk committee simply endorses management’s recommendations instead of independently assessing risks and making informed decisions regarding them. This behavior often stems from the board’s lack of incentives to collect information or effectively monitor management. Consequently, a rubber-stamping risk committee provides no greater benefit to the bank than having no risk committee. The predictions of the entrenched management hypothesis are similar to those of the rubber-stamping hypothesis: in both cases, management faces no effective risk committee oversight. However, Fluck and Khanna (Reference Fluck and Khanna2008) argue that shareholders may benefit when the board does not collect information because the board’s inaction may prompt management to share more information. Hence, ultimately, monitoring may be more effective because the board receives more information, assuming that it uses that information. Alternatively, a board that frequently aligns with management can be considered friendly. Shareholders may benefit from a friendly board to the extent that management will be more willing to seek help and advice from it (Adams and Ferreira (Reference Adams and Ferreira2007)). Evidence that a risk committee independently seeks information suggests that it is not merely a rubber-stamping entity.

The board may lack information and may not know that a risk committee could benefit shareholders. In this case, a board may eventually introduce a risk committee as it learns about its value. A board that experiences more risk issues, such as unforeseen adverse developments or outcomes that endanger the bank, would be more likely to introduce a risk committee. We refer to this perspective as the learning hypothesis. Based on this hypothesis, banks with more adverse risk experiences should be more likely to adopt a risk committee.

Institutional investors generally exert greater influence than individual retail investors and often use this influence to encourage management actions that enhance shareholder wealth.Footnote ⁴ Hence, banks with higher institutional ownership should be better informed about the benefits of a board risk committee.

C. Impact of a Mandated Risk Committee

Suppose that a board without a risk committee is required by law to establish one. Adding a committee could hinder shareholder value if the board had previously decided against one because it believed that it would not enhance value. In this case, the board might prefer a passive risk committee so that its addition would make no difference. However, because various risk committee tasks are mandated by the DFA and regulators monitor the risk committee (for instance, by reviewing the minutes of committee meetings), there are limits to how passive the risk committee can be. In any case, if the board had previously concluded that a board risk committee was unnecessary, there would be no reason to expect that a newly established committee would affect the bank’s risk-taking.

In cases of entrenched management, imposing a board risk committee on management that does not want one may not reduce bank risk, as there are good reasons to believe that CEO power does not typically lead to greater risk-taking. For instance, the CEO might want a “quiet life” (Bertrand and Mullainathan (Reference Bertrand and Mullainathan2003)), in which case the bank would take too little risk. In fact, many studies find that entrenched CEOs take less risk than CEOs whose incentives are better aligned with shareholders (John, Litov, and Yeung (Reference John, Litov and Yeung2008), Kumar and Rabinovitch (Reference Kumar and Rabinovitch2013), Saunders, Strock, and Travlos (Reference Saunders, Strock and Travlos1990)). If entrenched management takes too little risk, it is unlikely that a risk committee will force management to take even less risk. In related cases involving a rubber-stamping board, a risk committee may be established, but it simply rubber-stamps management decisions and would not reduce bank risk.

Finally, a board may fail to establish a risk committee when one would be appropriate, even if it seeks to maximize shareholder value. In this case, imposing a risk committee could be helpful. However, again, there is no reason to expect that doing so would reduce risk. The board might choose to take more risks with more information.

A. The Dodd–Frank Act Mandate

The DFA requires large publicly traded banks to establish a board risk committee. By limiting this mandate to publicly traded banks, Congress signaled that the primary motivation is corporate governance: the lack of such a committee constitutes a governance failure detrimental to shareholders. Implicitly, the assumed failure of governance leads banks to take on more risk than would be optimal for shareholders, and as a result, leads banks to create potential systemic risk. The DFA mandate goes beyond merely requiring certain banks to have a risk committee. It requires the committee to review risk-management policies, oversee the operation of the risk-management framework, and ensure that the risk-management framework remains appropriate. The mandate also describes the elements required for an appropriate risk-management framework, including processes and systems to i) establish managerial and employee responsibility for risk management, ii) ensure the independence of the risk-management function, and iii) integrate risk management into the compensation structure. While the mandate appears quite intrusive, it does not entrust the committee with risk management, a managerial function, but rather with overseeing risk management processes and systems.

While one might argue that the DFA only requires firms to follow good governance practices for risk management, it is a “one-size-fits-all” solution. As a result, it may include requirements inappropriate for certain types of banks. The downside of the “one-size-fits-all” DFA solution is that it imposes costs on those banks that would not have chosen to meet these specific requirements on their own because doing so would not have been economically worthwhile or would have destroyed shareholder wealth.

B. Banks With and Without a Risk Committee Over Time

In this section and the next, we use a sample constructed as follows: We first collect data on publicly traded U.S. financial institutions from 2003 to 2018. We start with a list of savings and loans holding companies (SLHCs), BHCs, and commercial banks from the PERMCO-RSSD link table provided by the Federal Reserve Bank of New York.Footnote ⁵ The DFA risk committee mandate applies directly to public BHCs with assets above $10 billion.Footnote ⁶ BHCs are regulated by the Federal Reserve. The Office of the Comptroller of the Currency (OCC) requires commercial banks with assets exceeding $50 billion that are not BHCs to comply with the DFA board risk committee mandate and may extend this requirement to banks with assets as low as $10 billion, effectively bringing these banks under the DFA mandate.Footnote ⁷ Section I of the Supplementary Material describes the samples and data used in all the analyses in this study.

We obtain financial data for each financial institution. For SLHCs and BHCs, we use data from the FR Y-9C reports, which are filed quarterly by all BHCs. The data for commercial banks are from quarterly FFIEC 0031 (call) reports. In addition, we include quarterly data from Compustat Fundamentals Bank files. The sample is merged with the CRSP daily files to obtain stock return data. We then merge the resulting data set with risk committee and director data from BoardEx. We supplement the BoardEx data with DEF 14A filings from SeekEdgar.Footnote ⁸ Although BoardEx data begin in 2000, coverage is limited until 2003, so our sample starts in 2003. Requiring BoardEx data reduces the sample size for some analyses.

In Table 1, we show in column 1 the number of banks in our sample for each year, depending on whether they have all the data used in our analyses. The number of banks that meet our sampling criteria falls from 475 in 2003 to 206 in 2018. Next, we report the fraction of banks with risk committees by year in column 2. This ratio for our whole sample is 0.051 in 2003. It increases dramatically over our sample period, peaking in 2018 at 0.714.

TABLE 1Bank Sample by Year and Risk Committee

TABLE 1 Long description

The table is structured with seven columns. Column 1 lists the year. Columns 2 and 3 represent All Banks (N and Fraction). Columns 4 and 5 represent Large Banks (N and Fraction). Columns 6 and 7 represent Small Banks (N and Fraction).

* 2003: All Banks N 475, Fraction 0.051; Large Banks N 65, Fraction 0.200; Small Banks N 410, Fraction 0.027.

* 2004: All Banks N 458, Fraction 0.068; Large Banks N 62, Fraction 0.290; Small Banks N 396, Fraction 0.033.

* 2005: All Banks N 469, Fraction 0.085; Large Banks N 59, Fraction 0.373; Small Banks N 410, Fraction 0.044.

* 2006: All Banks N 399, Fraction 0.103; Large Banks N 61, Fraction 0.393; Small Banks N 338, Fraction 0.050.

* 2007: All Banks N 378, Fraction 0.119; Large Banks N 55, Fraction 0.455; Small Banks N 323, Fraction 0.062.

* 2008: All Banks N 361, Fraction 0.144; Large Banks N 56, Fraction 0.482; Small Banks N 305, Fraction 0.082.

* 2009: All Banks N 367, Fraction 0.281; Large Banks N 58, Fraction 0.690; Small Banks N 309, Fraction 0.204.

* 2010: All Banks N 346, Fraction 0.324; Large Banks N 59, Fraction 0.712; Small Banks N 287, Fraction 0.244.

* 2011: All Banks N 316, Fraction 0.402; Large Banks N 56, Fraction 0.786; Small Banks N 260, Fraction 0.319.

* 2012: All Banks N 316, Fraction 0.437; Large Banks N 63, Fraction 0.794; Small Banks N 253, Fraction 0.348.

* 2013: All Banks N 319, Fraction 0.476; Large Banks N 64, Fraction 0.891; Small Banks N 255, Fraction 0.373.

* 2014: All Banks N 322, Fraction 0.509; Large Banks N 69, Fraction 0.957; Small Banks N 253, Fraction 0.387.

* 2015: All Banks N 277, Fraction 0.585; Large Banks N 69, Fraction 0.942; Small Banks N 208, Fraction 0.466.

* 2016: All Banks N 274, Fraction 0.591; Large Banks N 73, Fraction 0.945; Small Banks N 201, Fraction 0.463.

* 2017: All Banks N 272, Fraction 0.618; Large Banks N 75, Fraction 0.947; Small Banks N 197, Fraction 0.492.

* 2018: All Banks N 206, Fraction 0.714; Large Banks N 86, Fraction 0.953; Small Banks N 120, Fraction 0.542.

* Total: All Banks N 5,555; Large Banks N 1,030; Small Banks N 4,525.

Next, we focus on large banks (assets over $10 billion). We assume that the DFA mandate applies to these banks, either because they are BHCs or because of the OCC policy. As expected from our framework, these banks are much more likely to have risk committees than small banks. In 2003, only 20% of large banks have a risk committee. The percentage of large banks with such committees has exceeded 45% since 2007. Starting in 2014, over 90% of large banks have a board risk committee.Footnote ⁹ Not surprisingly, the number of large banks increases during our sample period, whereas the number of small banks falls sharply. However, the percentage of small banks with risk committees increases by more than 19 times over our sample period. At the end of our sample period, 54.2% of small banks have a risk committee.

To examine the determinants of banks’ adoption of risk committees prior to the DFA mandate, we focus on 2006 to avoid influences from discussions surrounding the DFA’s adoption and the GFC. In Table 2, we compare banks with a risk committee in 2006 to banks without one using bank characteristics from the same year. The Appendix provides detailed definitions of all the variables used in this and the next section. We show the correlations among the variables in Section II, Table IA2 in the Supplementary Material.

TABLE 2Descriptive Statistics for 2006

TABLE 2 Long description

A table titled Descriptive Statistics for 2006. It is divided into three main sections: Banks with a Risk Committee A (N = 32), Banks with No Risk Committee B (N = 303), and Differences A minus B. Each group includes columns for N, Mean, and Median.

Key data points include:

* Total assets ($billions): Group A Mean 95.984, Group B Mean 5.597, Difference 90.387 (significant at 0.01 level).

* Complexity: Group A Mean 0.736, Group B Mean 0.653, Difference 0.083 (significant at 0.01 level).

* C and I loans/assets: Group A Mean 0.121, Group B Mean 0.097, Difference 0.024 (significant at 0.05 level).

* Real estate/assets: Group A Mean 0.439, Group B Mean 0.499, Difference minus 0.060 (significant at 0.05 level).

* Deposits/assets: Group A Mean 0.658, Group B Mean 0.700, Difference minus 0.042 (significant at 0.01 level).

* Tier 1 ratio: Group A Mean 10.096, Group B Mean 11.853, Difference minus 1.757 (significant at 0.01 level).

* Equity volatility: Group A Mean 0.216, Group B Mean 0.248, Difference minus 0.032 (significant at 0.01 level).

* R O A: Group A Mean 0.149, Group B Mean 0.156, Difference minus 0.007 (significant at 0.05 level).

* R O E: Group A Mean 1.170, Group B Mean 1.268, Difference minus 0.098 (significant at 0.1 level).

* Institutional ownership: Group A Mean 0.479, Group B Mean 0.308, Difference 0.171 (significant at 0.01 level).

* Crisis return: Group A Mean minus 0.239 (N = 29), Group B Mean minus 0.254 (N = 199), Difference 0.015.

Other metrics listed include Trading/assets, Market-to-book, Annual stock return, Tail risk, Loan loss/assets, Nonperforming loans/assets, Duality, Entrenchment, Board financial expertise, and R C risk expertise.

As discussed in Section II, based on the shareholder wealth maximization hypothesis, we expect banks with risk committees to be larger, more complex, and have lower equity cushions. Table 2 shows that banks with risk committees are much larger than those without. Following Laeven and Levine (Reference Laeven and Levine2007), we measure complexity (Complexity) as one minus the absolute difference between net interest income and other operating income divided by total operating income. Table 2 shows that banks with risk committees are more complex than others. Consistently, these banks have more C&I loans and trading assets and fewer deposits. In addition, banks with risk committees have a lower equity cushion because they have a lower Tier 1 ratio.

The entrenchment hypothesis predicts that a bank board beholden to the CEO is less likely to have a risk committee, as the CEO is expected to value managerial discretion. We use the co-option measure from Coles et al. (Reference Coles, Daniel and Naveen2014) to measure entrenchment. This measure (Entrenchment) is the fraction of board members appointed after the appointment of the current CEO. We find no difference in Entrenchment between banks with risk committees and those without. Another measure of CEO power is Duality, defined as 1 if the CEO also serves as chairman of the board, and 0 otherwise (Adams, Almeida, and Ferreira (Reference Adams, Almeida and Ferreira2005)). The value of Duality does not differ between banks with and without board risk committees.

With respect to variables that are informative about the learning hypothesis, we consider the board’s financial expertise, since boards with greater financial expertise already possess the knowledge and experience relevant to risk oversight, making additional learning about risk committees less necessary. We measure the board’s financial expertise, Board Financial Expertise, following Minton et al. (Reference Minton, Taillard and Williamson2014). There is no difference in Board Financial Expertise between boards with and without risk committees. As discussed, we expect banks with a risk committee to have greater institutional ownership (Institutional Ownership). We find that banks with risk committees have substantially higher average Institutional Ownership than other banks (48% vs. 31%). However, this difference is likely attributable to the larger size of banks with risk committees, as institutional ownership tends to increase with firm size. As noted earlier, we expect a bank’s adverse risk experiences to enhance its board’s learning about risk management. We compute the stock return for the 1998 crisis, following Fahlenbrach, Prilmeier, and Stulz (Reference Fahlenbrach, Prilmeier and Stulz2012). This measure, Crisis Return, captures the stock drawdown during the 1998 crisis. We expect banks with larger drawdowns to be more aware of the potential benefits of a risk committee, given their more adverse experience. However, we find no difference in Crisis Return between banks with risk committees and those without.

To assess the relation between bank characteristics and the existence of a risk committee more directly, we estimate linear regression models in which the dependent variable RC indicates whether a bank has a risk committee in 2006. The regression results are reported in Panel A of Table 3.Footnote ¹⁰ The sample for these regressions consists of all publicly traded banks with required data available, regardless of their total asset values. We use firm characteristics measured in 2005 to predict whether a bank has a risk committee in 2006. All regressions include Total Assets, Complexity, the interaction of Total Assets and Complexity, Tier 1 Ratio, and Market-to-Book as regressors. We then add selected regressors in columns 1 through 4. In column 5, we include all regressors. The number of observations varies across columns as we use all banks with available data for each specification. For instance, some banks lack data for certain variables because they are not covered by BoardEx or did not exist in 1998.

TABLE 3Probability of Having a Risk Committee in 2006

TABLE 3 Long description

The table is divided into two vertical sections: Panel A and Panel B.

Panel A: Existence of a Risk Committee.

This panel measures the probability of having a risk committee in 2006 across five models.

* Complexity sub 2005: Coefficients range from -0.139 to -0.009.

* Total assets sub 2005: Coefficients range from -0.070 to 0.088.

* Complexity sub 2005 times total assets sub 2005: Shows significant positive coefficients in Model 1 (0.231), Model 3 (0.185), and Model 5 (0.223).

* Tier 1 ratio sub 2005: Consistently negative and significant across all models, ranging from -0.006 to -0.018.

* Market-to-book sub 2005: Negative coefficients, significant in Model 2 (-0.036) and Model 4 (-0.052).

* Other variables include Entrenchment, Duality, Institutional ownership, Board financial expertise, and Crisis return.

* Number of observations: Ranges from 229 to 369.

* Pseudo R super 2: Ranges from 0.18 to 0.23.

Panel B: Risk Committee Expertise.

This panel measures risk expertise within the committee in 2006.

* Complexity sub 2005: Coefficients range from -0.072 to -0.025.

* Total assets sub 2005: Negative coefficients, significant in Model 5 (-0.070).

* Complexity sub 2005 times total assets sub 2005: Significant positive coefficients in Model 1 (0.100), Model 3 (0.087), and Model 5 (0.131).

* Tier 1 ratio sub 2005: Small negative coefficients, significant in Model 2 and Model 3.

* Market-to-book sub 2005: Consistently negative but non-significant coefficients.

* Number of observations: Ranges from 229 to 361.

* Pseudo R super 2: Ranges from 0.13 to 0.24.

As expected and consistent with the shareholder wealth maximization hypothesis, we find that larger, more complex banks and those with lower equity cushions are more likely to have a risk committee. In column 1, the coefficient on the interaction between Total Assets and Complexity is significantly positive, whereas the coefficient on Tier 1 Ratio is significantly negative. Based on the entrenchment hypothesis, we expect the coefficients on Entrenchment and Duality to be significantly negative. However, neither coefficient is statistically significant. In column 2, we add Institutional Ownership, but its coefficient is not statistically significant. However, the interaction between Complexity and Total Assets is also not significant. We then add Board Financial Expertise in column 3, and its coefficient is not statistically significant. The interaction between Complexity and Total Assets is again significant. We add Crisis Return to the regression reported in column 4, and it is not significant. The interaction between Complexity and Total Assets is also not significant; however, the sample size is much smaller because Crisis Return is available for fewer banks. When we include all the variables in column 5, we find that the interaction between Complexity and Total Assets, Tier 1 Ratio, and Market-to-Book has significant coefficients. We also find that Entrenchment and Board Financial Expertise have significant negative coefficients. The coefficient on Entrenchment supports the entrenchment hypothesis. In contrast, the coefficient on Board Financial Expertise runs counter to the learning hypothesis, which predicts that a board with greater financial expertise is more likely to understand the potential benefits of a board risk committee. However, a board with greater financial expertise may be able to address risk-related issues more effectively in plenary sessions, reducing the need for a separate risk committee.

Panel A of Table 3 does not consider risk committee expertise. We expect that the reasons that motivate boards to have a risk committee also motivate them to have risk expertise on the committee. Consequently, we expect the predictions of the shareholder wealth maximization hypothesis to hold when accounting for risk expertise. We construct a variable that proxies for the risk expertise of the risk committee, RC Risk Expertise. This variable is the fraction of risk committee members (excluding those who also serve on the audit committee) who have prior outside risk committee-related experience, outside CFO or treasurer experience, or an MBA or a master’s degree in finance. A bank whose risk committee has no members with risk expertise is assigned the same RC Risk Expertise value as a bank without a risk committee. The number of observations decreases because we cannot obtain the necessary information to construct RC Risk Expertise for all banks. The loss of observations differs across columns because the data requirements differ across them. Table 3, Panel B, presents the regression results, where we replace the dependent variable RC with RC Risk Expertise. The interaction of Complexity and Total Assets has a positive and significant coefficient in the same columns as in Panel A. Tier 1 Ratio has a negative and significant coefficient in columns 2 and 3. The coefficient on Market-to-Book is never statistically significant. Neither Entrenchment nor Board Financial Expertise is significant.

A comparison of Panels A and B of Table 3 indicates that Panel B fully supports the shareholder wealth maximization hypothesis.Footnote ¹¹ In contrast, Panel A reports a significant negative coefficient on Entrenchment, suggesting a role for managerial entrenchment. These results can be reconciled by noting that entrenchment can make a bank less likely to establish a board risk committee; however, conditional on having one, entrenchment does not appear to reduce its risk expertise. In other words, the observed level of risk expertise within the board risk committee is consistent with the shareholder-value-maximization hypothesis, although the evidence does not rule out the possibility that entrenchment deters the formation of such committees.

A. The Performance of Banks During the GFC and Board Risk Committees

There is extensive literature on bank performance during the GFC. We do not aim to explain bank performance during the GFC; instead, we investigate whether banks that met the DFA threshold before the GFC and had a board risk committee differ in risk and performance from banks that met the threshold but did not have a board risk committee. In 2006, 24 of the 61 banks in our sample that meet the DFA threshold of $10 billion in assets have a risk committee. To assess whether these banks perform differently and have different risk levels during the GFC, we control for variables that capture bank differences. We also include an indicator for the year 2008, which means that we effectively use year fixed effects. In regressions of performance and risk measures on these control variables, if they capture differences among banks exceeding $10 billion in assets, the coefficient on an indicator variable for whether a bank has a risk committee measures the effect of having a risk committee on the dependent variable.

The dependent variables include two risk measures, three performance measures, two real outcome measures, and one combined performance–risk measure. The risk variables are annual stock return volatility (Equity Volatility) and Tail Risk, which is the negative of the average stock return on the 5% worst return days during a year. The performance variables are ROA, ROE, and Annual Stock Return. The real outcomes are loan losses relative to total assets (Loan Loss/Assets) and nonperforming loans relative to total assets (Nonperforming Loans/Assets). The variable that combines performance and risk is the Sharpe Ratio, defined as the excess stock return over the risk-free rate divided by the standard deviation of the stock return.Footnote ¹²

Table 4, Panel A, reports our regression estimates where the dependent variables are measured in 2007 and 2008, and the independent variables are for 2006 (except for an indicator variable for 2008). We have 77 observations, as we lose observations because of data requirements. The independent variables include Board Financial Expertise, Crisis Return, Complexity, Total Assets, Tier 1 Ratio, Market-to-Book, Entrenchment, Duality, Year₂₀₀₈ (an indicator variable for the year 2008), and Institutional Ownership. The test variable in the regression is an indicator for whether a bank had a risk committee in 2006 (RC₂₀₀₆). Its coefficient is never significant for risk measures or real outcomes. It is significantly negative for ROA. There is no evidence that banks with risk committees in 2006 performed better or had less risk during the GFC. In Table IA4 in the Supplementary Material, we estimate the same regression with the addition of Deposits/Assets, Securities/Assets, C&I Loans/Assets, Real Estate/Assets, and ROE. We do not include a measure of trading assets because trading assets are extremely highly correlated with Total Assets. We omit these variables from the regressions that we highlight because they can be considered direct outputs of risk management policies. Including them does not change our conclusions. In Panel B of Table 4, we replace RC with RC Risk Expertise as our test variable. The results are similar, except that ROA is not significantly related to RC Risk Expertise.

TABLE 4Crisis Performance Regressions

TABLE 4 Long description

A regression table titled Crisis Performance Regressions. The table has 8 numbered columns representing dependent variables: 1 Equity Volatility, 2 Tail Risk, 3 R O A, 4 R O E, 5 Annual Stock Return, 6 Loan Loss over Assets, 7 Nonperforming Loans over Assets, and 8 Sharpe Ratio.

Panel A: Existence of a Risk Committee.

* R C sub 2006: Shows a significant negative correlation with R O A at -0.012.

* Board financial expertise sub 2006: Significant negative correlation with R O E at -0.509 and Sharpe Ratio at -0.069; significant positive correlation with Loan Loss over Assets at 0.019.

* Complexity sub 2006: Significant positive correlation with R O A at 0.033.

* Total assets sub 2006: Significant negative correlations with R O A at -0.009 and R O E at -0.082; significant positive correlation with Sharpe Ratio at 0.006.

* Tier 1 ratio sub 2006: Significant negative correlations with R O A at -0.003 and Loan Loss over Assets at -0.002; significant positive correlations with Annual Stock Return at 0.037 and Sharpe Ratio at 0.009.

* Market-to-book sub 2006: Significant negative correlations with Equity Volatility at -0.075, Tail Risk at -0.013, R O A at -0.013, and Nonperforming Loans over Assets at -0.023; significant positive correlations with R O E at 0.115, Annual Stock Return at 0.102, and Sharpe Ratio at 0.016.

* Year sub 2008: Shows high significance across all metrics, notably Equity Volatility at 0.571 and Tail Risk at 0.104.

* Number of observations is 77 for all columns. Adjusted R-squared values range from 0.12 to 0.70.

Panel B: Risk Committee Expertise.

* R C risk expertise sub 2006: No statistically significant correlations shown.

* Board financial expertise sub 2006: Similar trends to Panel A, with significant negative correlation with R O E at -0.460 and Sharpe Ratio at -0.064.

* Total assets sub 2006: Significant negative correlations with R O A at -0.010, R O E at -0.081, and Nonperforming Loans over Assets at -0.011.

* Market-to-book sub 2006: Highly significant across most columns, including Equity Volatility at -0.092 and Sharpe Ratio at 0.016.

* Year sub 2008: Remains highly significant across all columns.

* Number of observations is 77. Adjusted R-squared values range from 0.12 to 0.70.

In summary, the coefficients on RC₂₀₀₆ in Panel A of Table 4 are not significant, except for the negative coefficient in the regression in which the dependent variable is ROA. In Panel B of Table 4, the test variable is RC Risk Expertise, and none of its coefficients are statistically significant. Therefore, our evidence does not support the view that large banks without a risk committee in 2006 would have experienced lower risk, better performance, or improved real outcomes during the crisis if they had a risk committee. In other words, if the DFA requirement was motivated by the view that excessive risk-taking caused the GFC and that a board risk committee would reduce such risk-taking through improved governance, our evidence does not support this view.

B. Do Banks Have Lower Risk After Being Required to Adopt a Risk Committee?

We examine differences in risk and performance between large banks with and without board risk committees from 2003 to 2018. We use a DiD regression format, where treatment is the introduction of a risk committee. We include a bank in the sample for the first time whose assets exceed the DFA threshold. During the sample period, a large bank with a risk committee either introduced a risk committee voluntarily or was forced to introduce one because of the DFA. We assume that banks that introduce a risk committee before 2010 do so voluntarily, and those that introduce it in 2010 or later do so involuntarily due to the DFA mandate. We further assume that all banks with assets in excess of $10 billion have to introduce one as a result of the DFA if they do not have one in 2010, since the OCC effectively extended the DFA requirement to banks that are not part of holding companies. Our approach suffers from a potential endogeneity issue in that banks can choose when to meet the DFA mandate as long as they introduce a risk committee before the deadline.Footnote ¹³ We use an indicator variable, RC Before 2010, which equals 1 for every year that a bank that introduced a risk committee before 2010 has a risk committee. RC After 2010 is an indicator variable that equals 1 for each year a bank that introduced a risk committee in or after 2010 has a risk committee. We use bank and year fixed effects. However, to identify bank fixed effects, we must exclude banks that enter the sample period with a risk committee.

Table 5 presents the regression results. In Panel A, the test variables are the risk committee indicator variables. RC After 2010 is not statistically significant for any of the risk, real outcomes, or performance variables. Therefore, there is no evidence that banks that had to introduce a risk committee because of the DFA have less risk afterward. We find more nuanced results for RC Before 2010. It is negatively associated with Tail Risk, ROE, and Annual Stock Return but positively associated with Equity Volatility. In Panel B, we use RC Risk Expertise variables as our test variables. RC Risk Expertise Before 2010 is negatively associated with Nonperforming Loans/Assets. The coefficient on RC Risk Expertise Before 2010 of −0.005 is economically significant. Going from zero risk expertise to RC Risk Expertise of 0.5 would be associated with lower Nonperforming Loans/Assets of 0.25% when Nonperforming Loans/Assets for banks with a risk committee is at its mean value of 0.5% in 2006. Furthermore, we find that the Sharpe Ratio is positively associated with RC Risk Expertise Before 2010. RC Risk Expertise Before 2010 is not associated with Tail Risk or performance measures. In contrast, RC Risk Expertise After 2010 is positively associated with Loan Loss/Assets, suggesting greater risk, and with ROA and ROE, suggesting better performance. Since neither ROA nor ROE is risk-adjusted, the better performance could reflect greater risk. The results in Table 5 are not sensitive to the regressors. Table IA5 in the Supplementary Material shows that regressions using only the risk committee indicators and fixed effects yield similar coefficients on those indicators.

TABLE 5Performance Regressions: Full Sample Period

TABLE 5 Long description

A complex statistical table divided into two main sections: Panel A (Risk Committee Before 2010) and Panel B (Risk Committee Expertise Before 2010).

The table features 8 numbered columns representing dependent variables:

1. Equity Volatility

2. Tail Risk

3. R O A

4. R O E

5. Annual Stock Return

6. Loan Loss/Assets

7. Nonperforming Loans/Assets

8. Sharpe Ratio

Panel A examines independent variables including R C after 2010 sub t minus 1, R C before 2010 sub t minus 1, Complexity, Total assets, Tier 1 ratio, Market-to-book, Entrenchment, Duality, Institutional ownership, and Board financial expertise. Notable results in Panel A show R C before 2010 sub t minus 1 has a coefficient of 0.067 (p-value 0.033) for Equity Volatility and -0.009 (p-value 0.041) for Tail Risk. Total assets shows a strong negative correlation with Sharpe Ratio (-0.032, p-value 0.001).

Panel B examines similar independent variables with a focus on R C risk expertise. R C risk expertise after 2010 sub t minus 1 shows a significant positive correlation with R O A (0.007, p-value 0.030) and R O E (0.109, p-value 0.028).

Both panels include fixed effects for Bank and Year, with 653 observations each. Within R-squared values range from 0.02 to 0.37 across the different models.

In conclusion, the analysis in this section provides no evidence to support the hypothesis that banks forced to adopt a board risk committee have lower risk. In contrast, we find that banks with a risk committee introduced before 2010 have lower risk. This evidence is stronger when we use the risk committee’s risk expertise as our risk committee measure. Banks whose board risk committees were introduced before 2010 and have greater risk expertise exhibit lower nonperforming loans and a higher Sharpe ratio. To the extent that a higher Sharpe ratio indicates that a bank is less likely to take excessive risk, our results support the view that voluntarily establishing a board risk committee with greater risk expertise helps curb excessive risk-taking.

A. The Sample of Interviews

To develop the potential sample of interviewees, we started with a list of all U.S. publicly traded firms whose proxies indicated that the firm had a board committee whose name included the word “risk” as of November 2016 and had an SIC code in the 6000 group. After retrieving company information and the names of the chairs of the board committees with the word “risk” in their titles, we identified 203 firms. We conducted 19 interviews with risk committee chairs from these firms, ensuring that none of these committees included the word “audit” in the name (e.g., “risk and audit” committee). This approach is consistent with other interview studies on board committees, including, for example, Clune, Hermanson, Tompkins, and Ye (Reference Clune, Hermanson, Tompkins and Ye2014). Of these 19 firms, 14 were depository institutions: 10 commercial banks and 4 savings institutions. We refer to this subsample as banks. Our investigation focuses on these 14 banks. The median market capitalization of the participating firms is $3.2 billion, and the mean is $19.27 billion. The median asset size is $17.7 billion. Of the 19 participating firms, 12 met the DFA requirement of having a risk committee. In 2006, only the four largest banks had risk committees.

The interviews were conducted in 2017 by one coauthor via phone (14), videoconference (2), or face-to-face (3). We used the semi-structured interview method as advised by Radcliffe (Reference Radcliffe2010) and others. We recorded each interview and sent it to a professional service for transcription to ensure accuracy. To promote candor in the interview, we agreed to write the paper in such a way that neither the interviewee nor the financial institution would be identifiable. Furthermore, we sent the interviewees a draft of the paper prior to submission for publication so that they could verify their anonymity. The average interview length was 132 minutes, and we believe that the number of interviews was appropriate, as there were few new insights gained from the last few interviewees.Footnote ^{14 ,} Footnote ¹⁵

B. Risk Committee Charters

A risk committee charter, approved by the board, is essentially a written “job description” for the risk committee. We reviewed the charters of the risk committees of the participating financial institutions available to us (12 of 14), and they consistently emphasize the oversight role of the risk committee. In all cases, the CRO reports to the risk committee in some form.Footnote ¹⁶ The charters we reviewed clarify that the risk committee has an oversight or monitoring role and no management role. Instead, they focus on overseeing risk management frameworks, processes, and metrics.

C. Why Do Boards Have Risk Committees?

Twelve of our 19 interviewees were aware of some of the history underlying the formation of their risk committees. Eight stated that the committee was voluntary and/or existed before the DFA. Even on boards that formed a risk committee because of the DFA, no interviewee told us that they would revert to housing risk in the audit committee if the mandate were lifted.

Quotes from interviewees at banks with voluntary risk committees generally support the shareholder wealth maximization hypothesis. Consistent with this hypothesis, the following quote recognizes the value of a dedicated risk committee as a bank becomes larger and more complex. In particular, the metrics overseen by an audit committee and a risk committee are different. Furthermore, the audit committee does not have the capacity in terms of both time and committee qualifications to provide an appropriate focus on risk:

D. Assessing Risk Metrics and Risk Management Processes

Risk committee chairs view the tasks of the risk committee as quite different from those of the audit committee and believe that different skills are involved. As discussed in Section II, risk metrics are forward-looking. Risk chairs are also acutely aware that there is no rule book for risk metrics. These differences are exemplified by the following quote:

Given the differences in the responsibilities inherent in the audit and risk committees, our interviewees generally reasoned that the portfolio of skills available to each committee should be different. When we asked the interviewees for their views on their actual or desired skill sets on the risk committee, diversity of thought and skills/experience was a common theme:

In sum, our interviewees serving on risk committees recognized that their responsibilities differed sufficiently in nature from those on the audit committee and, therefore, warranted a different skill portfolio to fulfill their risk oversight responsibilities. This observation is consistent with the shareholder wealth maximization hypothesis. Furthermore, it contradicts the rubber-stamping hypothesis to staff the risk committee with members who have a portfolio of qualifications that empower them to effectively conduct their oversight responsibilities.

E. How Does the Committee Acquire Information?

Eighteen of our interviewees responded to a question about who they primarily interact with at the firm, and all stated that they interact primarily with the CRO. For 15 of the 18 interviewees, these interactions were both in-person and by phone. These interactions are inconsistent with the view of rubber-stamping boards proposed by Fluck and Khanna (Reference Fluck and Khanna2008). With that view, a rubber-stamping board free-rides on information collection, but here we find that the risk committee chairs actively collect information from the banks without going through the CEOs.

A common theme among the interviewees is the importance of having a good relationship with the CRO. As reflected in the quote below, the importance of a healthy relationship is fundamental because it promotes relevant information being communicated from the CRO to the risk committee chair promptly:

CEOs can be reluctant to allow board members to interact directly with employees without their presence, especially if they want the board to serve as a rubber stamp. No interviewee discussed situations in which the CEO erected obstacles to direct interactions with risk function personnel. Our interviewees were largely confident that their processes resulted in the committee discussing the “right” issues with the “right” information.Footnote ²⁰

F. The Interactions of the Risk Committee with Management and Regulators

Suppose a risk committee operates in a manner that maximizes shareholder wealth subject to legal and regulatory constraints. In that case, it will not only monitor the execution of the bank’s approved risk policies but also act in an advisory capacity to management. Furthermore, the risk committee’s processes should promote a relationship with regulators that results in meeting regulatory constraints while simultaneously pursuing a level of risk consistent with maximizing shareholder wealth. In this section, we examine how our interviewees interact with management, how they balance the monitoring versus advisory roles of the risk committee, and how they interact with regulators.

G. Monitoring and Time Constraints

We used two LLMs, GPT-5-Mini (GPT) and Gemini-2.5-Flash (Gemini), to extract quantitative information from the 14 transcripts concerning the monitoring and advisory roles of the risk committees and their use of time. The prompts used for the two LLMs and the exact questions asked are reproduced in Section IV of the Supplementary Material. We report the results in Figures 1 and 2. For each question, we report the ratio of positive answers to the total number of positive and negative answers, separately for each LLM and averaged across both LLMs. We also provided the LLMs with the option to conclude that the transcript contained no evidence. Figures IA1 and IA2 in Section IV of the Supplementary Material report the percentage of transcripts for each question with no clear evidence for each LLM.

FIGURE 1Risk Committee Monitoring

Figure 1 reports the percentage of bank risk committee interviewees that large language models classify, with clear evidence, as agreeing with five questions related to the committee’s monitoring role. We use two models, Gemini 2.5 Flash and GPT-5 Mini, which were instructed to read each interview transcript and answer “Yes,” “No,” or “No Evidence” to each question. The exact questions and prompts are listed in Section IV of the Supplementary Material. For each question, we report the percentage of interviewees classified as agreeing by each model, along with the average between the two.

FIGURE 1 Long description

A horizontal bar chart titled Percentage of Risk Committees Agrees. The x-axis measures percentage from 0 percent to 100 percent in 10 percent increments. The y-axis lists five categories. Each category has a cluster of three bars: a dark blue bar for Average, a purple bar for Gemini-2.5-Flash, and a light blue bar for G P T-5-Mini.

* R C interactions with employees below C R O without C R O forward slash C E O present: Average is approximately 65 percent, Gemini is 63 percent, G P T is 67 percent.

* R C interactions with C R O without C E O present: All three bars reach 100 percent.

* R C sessions with C R O without C E O present: Average is approximately 86 percent, Gemini is 83 percent, G P T is 89 percent.

* R C chair meeting with regulators without C E O present: Average is 60 percent, Gemini is 57 percent, G P T is 63 percent.

* C R O reports to R C: Average is 63 percent, Gemini is 67 percent, G P T is 60 percent.

FIGURE 2Risk Committee’s Use of Time

Figure 2 reports the percentage of bank risk committee interviewees that large language models classify, with clear evidence, as agreeing with five questions related to the committee’s use of time. We use two models, Gemini 2.5 Flash and GPT-5 Mini, which were instructed to read each interview transcript and answer “Yes,” “No,” or “No Evidence” to each question. The exact questions and prompts are listed in Section IV of the Supplementary Material. For each question, we report the percentage of interviewees classified as agreeing by each model, along with the average between the two.

FIGURE 2 Long description

The chart titled Percentage of Risk Committees Agrees features five categories on the vertical axis and a percentage scale from 0 to 100 percent on the horizontal axis. Each category contains three bars: Average (dark blue), Gemini 2.5 Flash (purple), and G P T 5 Mini (light blue).

* Regulatory tasks time-consuming: G P T 5 Mini shows 100 percent agreement, Gemini 2.5 Flash shows approximately 64 percent, with an Average of 82 percent.

* Sufficient time for emerging issues: G P T 5 Mini shows 75 percent, Gemini 2.5 Flash shows 38 percent, with an Average of 57 percent.

* Sufficient time for non-routine issues: G P T 5 Mini shows 75 percent, Gemini 2.5 Flash shows 42 percent, with an Average of 58 percent.

* Chair or members give regular advice to C R O: G P T 5 Mini shows 100 percent, Gemini 2.5 Flash shows 92 percent, with an Average of 96 percent.

* Chair spends significant time on R C outside meetings: G P T 5 Mini shows 77 percent, Gemini 2.5 Flash shows 62 percent, with an Average of 69 percent.

Across all categories, G P T 5 Mini consistently classifies a higher percentage of interviewees as agreeing compared to Gemini 2.5 Flash.

Starting with the risk committee’s monitoring role, we first ascertained whether the committee chair or members communicated directly with employees reporting to the CRO without the involvement of the CRO or CEO. Few transcripts provided clear evidence on this point (six for GPT and eight for Gemini). Among those with substantive answers, 65% indicated that RC chairs engaged in such communications. We then asked whether the risk committee chair or members interacted with the CRO outside board meetings without the CEO’s involvement on issues other than the committee agenda. Almost all transcripts contained answers, and 100% of the answers were positive. A majority of risk committees, but not all, have executive sessions with the CRO that exclude the CEO. Moreover, a majority of risk committees hold meetings between the risk committee chair and regulators without the CEO present. Finally, we asked whether the CRO reports to the risk committee. On average, 63% of the responses were positive. The evidence in Figure 1 supports the active monitoring role of most risk committees in that they can pursue issues without being constrained by the CEO or even the CRO.

We then turn to the risk committee’s use of time. Our first question was whether the tasks mandated by regulators were time-consuming. The average answer is yes for 82% of the transcripts. We then asked whether the committee allocates sufficient time during meetings to discuss new or developing issues. Interestingly, there is disagreement between the LLMs. GPT finds 38% of the yes answers, and Gemini finds 75%. We then ask whether the committee allocates sufficient time to discuss nonroutine issues. The result is similar to that of the previous question. Additionally, there is strong evidence that the chair or committee regularly advises the CRO. Finally, we ask whether the risk committee chair spends substantial time on risk committee matters outside of committee meetings. Again, we find strong positive evidence. The evidence in Figure 2 shows that regulatory matters are time-consuming; however, the evidence on whether these matters prevent the risk committee from discussing unexpected risk issues or issues expected to become important in the future is unclear. A direct reading of the transcripts suggests that the regulatory burden varies substantially across banks. In particular, the regulatory burden is viewed as much more constraining for banks subject to stress tests.