Differences in risk attitudes among the three lines of defense parties within a bank

(1)

Thesis - final:

Differences in risk attitudes among the three lines of

defense parties within a bank

University of Amsterdam -

Executive Internal Auditing Program

Ingrid Laurier | 6020411 | Amsterdam | 11 July 2014

Thesis supervisor: Willem van Loon

(2)

Differences in risk attitudes among 3LoD parties within a bank | EIAP |Ingrid Laurier |11-07-2014

“Everyone complains about his memory, and no-one complains about his judgment”

—La Rochefoucauld

(3)

Acknowledgements

Foremost, I would like to express my sincere gratitude to my my thesis supervisor Willem van Loon of the University of Amsterdam for mentoring and coaching me. Thank you for the interesting discussions, guidance and feedback that really helped me to enhance the quality of this thesis.

I want to thank Norbert Kouwenberg, Huub van Hout, Bert Ide, Theo Verzijlbergen, Ed van Hecke, Marjolijn de Koeijer, Andre van der Ham and Jan-Gerard Hofland for their support in the distribution of the survey. Furthermore, I would like to thank all 310 employees who participated in the survey for their enthusiasm and response. I would also like to thank the interviewees for the interesting discussions, although they would prefer to stay anonymous.

Many thanks to Violaine Paresi for reviewing my thesis and providing me feedback on both language and content.

Last but not least I am very thankful for the love and support from my parents, family, friends, colleagues, and especially my boyfriend. Thank you for supporting and helping me get through the process of writing my thesis.

Amsterdam, June 2014

(4)

Executive Summary

Based on experience and discussions with colleagues in the field of internal auditing, it can be noted that perception differences on risks exist among different people in an organisation. I am fascinated by this and I would like to explore, using this study, what could be the cause of these differences in risk perceptions between auditor and auditee within the banking sector and if differences in risk perceptions really exist. To do so, this study tries to answer the following main research question: What are the differences in risk attitude between the three lines of defense parties within a bank?

This central question will be answered by the following sub-questions:

1) What theoretical basis exists regarding risk aversion and what is the impact of this psychological bias on individual judgment and decision making?

2) Are there significant differences in risk attitudes among the three lines of defense parties within a bank?

3) What (demographical) factors significantly impact differences in risk attitudes?

Based on the theoretical background it can be derived that individuals are not acting perfectly rational, but rather irrational due to the psychological bias of risk aversion (Kahneman and Tverskey, 1979). The Prospect theory shows that in general people act irrationally regarding risk, “People underweight outcomes that are merely probable in comparison with outcomes that are obtained with certainty” (Kahneman and Tverskey, 1979), which is called risk aversion. Based on the Utility and Prospect Theory, it is shown that individual risk behaviour can differ among individuals (Pratt, 1964). Past scientific research also provides a background for the hypothesis about the factors which may impact the level of an individual’s risk

aversion; demographical background (age, gender, education level, income) and the context (e.g. incentives) (March and Shapira, 1987; Dohmen, 2007; etc).

This means that past scientific theories and studies have already shown that the risk attitudes of individuals can differ as a result of differences in background and context. Past research primarily provides this insight for large populations using panel data, for example for the population of a country. This is one of the first studies that provides insight in the level of risk aversion and the factors which could have impact on this, in the context of an organisation.

The results of this study are received from a validated survey, which measures risk aversion based on the hypothetical choice problem (lottery choices) of Kahneman and Tversky (1979; p. 263; Holt and Laury, 2002). The survey (appendix II) was completed by 310 employees of a Dutch Bank, a group which was broken down into the three lines of defense parties. Because the three lines of defense model is aimed to be implemented by all banks it is used to distinguish uniform parties with different interests within the

organisation (Doughty, 2011; Code Banken, 2009). In order to be able to possibly derive statistical significance from the results, and to compare the risk attitude of employees in the first, second and third line of defense, it is essential to get at least 100 respondents per line of defense (per group). Furthermore the analysis of the results is supported by validation interviews with two employees in the first line, two in the second and two in the third line of defense.

(5)

This study provides interesting new insights in the risk perceptions among the three lines of defense parties in the banking sector. In fact, the results show that there is a significant difference in the level of risk aversion between the three lines of defense parties within the particular bank. The first line of defense is the least risk averse, the second line of defense is the most risk averse and the level of risk aversion of the third line of defense is in between the first and second line.

Next to this, this research also gives more insight into the demographic factors and the context effects which could impact an individual’s level of risk aversion in a bank. The results from the regression analysis show that within this particular bank women are more risk averse than men (though not significant), risk aversion increases as age increases (significant), risk aversion decreases with a higher income (significant) and risk aversion increases with a higher education level (significant). Apart from this, when correcting for these demographical factors, significant differences in the level of risk aversion still exist, which is due to the line of defense in which a person is employed. This can imply that next to demographical background, to a great extend the context, such as incentives, defines someone’s level of risk aversion.

Based on these results and a comprehensive analysis the following takeaways for internal audit can be defined:

• Based on the three lines of defense model, it is shown that perception differences exist among the three lines of defense parties. The interviewees assumed that these differences are desirable in the context of the functioning of the three lines of defense model in a bank. Especially the difference between the first and second line is essential in this, according to the interviewees. This may results in the third line of defense being able to rely on the judgement of the second line.

• The results show that a risk aversion bias exists. To overcome the limitations of the judgment and the irrational behavior within the audit process as a result of risk aversion, the internal auditors should accept that they are biased. Next to this, they could use the following techniques for debiasing:

o challenge each other to think about the problem in another way; o setting clear criteria or a model for decision making and; o implement a clear decision making process (Soll et al, 2013).

• It is important in the communication between the auditor (third line) and auditee (first or second line) that both parties try to understand the way the other party experiences risks and how this can eventually lead to different decisions and conclusions. This will make discussions during the audit process, about risks and the validity of findings, more efficient and reduce the likelihood of escalation.

• Regarding the recruitment policy, it is shown that next to demographic background, context and culture also plays an important role for the level of risk aversion of individuals within a bank. So the recruitment policy should also focus on creating the right context and culture for internal audit. This, for a great extent, influences the behaviour and attracts a certain type of auditor, which eventually impacts the level of risk aversion.

(6)

Table of Content

Acknowledgements ... ii

Executive Summary ... iii

1. Introduction ... 1

1.1. Background ... 1

1.1.1. Different risk perceptions ... 1

1.1.2. Risk aversion ... 1

1.2. Objective and central question of research ... 3

1.3. Methodology ... 3

1.4. Thesis outline ... 4

2. Theoretical background ... 5

2.1. Measuring risk aversion based on the utility and prospect theory ... 5

2.1.1. Utility theory and prospect theory ... 5

2.1.2. Measuring risk aversion ... 7

2.2. Neuropsychological causes and demographical factors that impact risk aversion ... 7

2.2.1. Neuropsychological causes ... 7

2.2.2. The impact of demographical background on individual’s risk aversion ... 8

2.2.2.1. Gender ... 8

2.2.2.2. Age ... 9

2.2.2.3. Education level ... 9

2.2.2.4. Income ... 9

2.3. Summary and conclusion ... 10

3. Risk aversion and internal audit ... 11

3.1. Three lines of defense model ... 11

3.2. The internal audit process and decision making regarding risks... 12

3.3. What influences decision making – nature vs nurture ... 13

3.3.1. Demographical background ... 14

(7)

3.4. Summary and conclusion ... 16

4. Research design ... 17

4.1. Research approach and sample selection ... 17

4.2. Data analysis ... 19

4.3. Hypotheses ... 20

5. Results ... 22

5.1. Descriptive statistics ... 22

5.2. Difference in risk aversion level between three lines of defense parties ... 23

5.3. Factors which causes differences in risk aversion ... 24

6. Analysis – implications for internal audit ... 26

6.1. Difference in risk aversion level between three lines of defense parties ... 26

6.2. Factors which causes differences in risk aversion ... 27

6.3. Implication for internal audit ... 28

6.4. Summary - takeaways for internal audit ... 31

6.4.1. Summary ... 31

6.4.2. Takeaways for internal audit ... 31

7. Conclusion and discussion ... 33

7.1. Conclusion ... 33

7.2. Discussion ... 34

Sources ... 36

Appendices ... i

Appendix I: Survey (ENG) ... ii

Appendix II: Survey (NL) ... v

Appendix III: Structured interview questions (NL) ... ix

Appendix IV: Extensive results in figures and tables... xi

(8)

1. Introduction

1.1. Background

1.1.1. Different risk perceptions

As a consequence of the financial crisis, the increase in regulations, more focus on risk management and controls, and recent scandals such as the Libor-scandal, more attention has been given on the role of the internal audit function. The Institute of Internal Auditors (IIA) describes the role and function of Internal Audit in their standards. The IIA gives the following definition of Internal Auditing:

“Internal Auditing is an independent, objective assurance and consulting activity designed to add value an improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.”( Institute of Internal Auditors, 2013).

This definition describes that the internal auditor is meant to give assurance on the quality of governance, risk management and control processes of an organisation. The assurance role is accompanied by judgment and/or a final rating. To come to a final rating, an internal auditor needs to make decisions after different key phases within the audit process. The audit process exists of the following phases: planning, pre-research, fieldwork, reporting, evaluation and follow up (Driessen and Molenkamp, 2012, pp. 321-371). These decisions need to be discussed with the sponsor or auditee before moving on to the next phase. Key are the discussion on the planning (approval), Terms of Reference and the Work Program with the sponsor, and the adversarial with the auditee in the reporting phase (Driessen and Molenkamp, 2012, pp. 321-371).

Based on personal experience and discussions with colleagues in the field of internal auditing, it was noticed that perception differences on risks exist among different people in an organisation. For example the adversarial of findings many times leads to intense discussion about audit ratings and validity of the finding in the context of risks. The argument of subjectivity of the audit judgment is frequently used by the auditee in such situations.

I am fascinated by the above described situation and I would therefore like to find out what could be the cause of these differences in risk perception between auditor and auditee within organisations and if differences in risk perception really exist.

1.1.2. Risk aversion

Based on psychological research it is known that biases influence individual judgment and decision making (Hilton and Denis, 2001, p. 38). More and more literature and research is focussing on the field of

(9)

tendencies toward irrationality. This discipline assumes that individuals are not acting perfectly rational, but irrational due to psychological biases (Hilton and Denis, 2001, p. 37).

One of these biases is known as loss aversion or risk aversion. Kahneman and Tversky (1979) discovered the following irrational behaviour in decision making: “People underweight outcomes that are merely probable in comparison to outcomes that are obtained with certainty”. This tendency, called the certainty effect, contributes to risk aversion in choices involving sure gains and to risk seeking in choices involving sure losses” (Kahneman and Tversky 1979, p. 263).

Example

Kahnman and Tversky (1979) illustrate this by using the following hypothetical choice problem: 1) Which choice would you prefer?

a) a 25% chance of winning $30,000, with a 75% chance of winning nothing; or b) a 20% chance of winning $40,000

When asked this question, most people choose (b) (Kahneman and Tversky, 1979).

2) Imagine the following: You’re with 4 players in a game, and only one will go to the next round. You are the one who rearched the second round, and face the following choice:

a) a sure win of $30,000; or

b) an 80% chance of winning $40,000

When presented with this choice, most people choose (a) (Kahneman and Tversky, 1979).

The above mentioned outcomes reflect the bias risk aversion: “the tendency to value certainty” (Kahneman and Tversky, 1979). The research performed by Kahneman and Tversky showed that the expected utility theory, which assumes rational decision making, does not fully apply. Based on the utility theory it would be expected that people would have picked (b) in both cases.

Risk attitudes can be different among people, some people are more risk averse than other people, or more risk seeking than others. These differences can be explained by different factors, such as another biases called anchoring (Kahneman and Tversky 1979, p. 286.). However, it can also be influenced by

demographical factors such as gender (Coates and Herbert, 2007) and adulthood (Steinberg, 2008), which results from differences in the hormones testosterone (Coates and Herbert, 2007) and changes in the brain’s socio-emotional and cognitive control system during different stages of life (Steinberg, 2008).

Judgment and decision making is extremely important to the internal audit profession (Wedemeyer, 2010). As a consequence, psychological biases such as risk aversion could impact the quality of the work the internal auditor performs for the organisation and how the different parties in the organisation, auditors and auditees, view risks.

(10)

1.2. Objective and central question of research

Objective

This study will investigate whether differences in risk attitudes exist among different parties within an organisation.

A full research approach would be too complex and time consuming. So this study will primarily focus on the banking industry. The reason to choose a large bank is that the internal audit department is relatively large within banks, because of regulations and the typology of the organisation. This could indicate other parties in the organisation have more experience with internal audit than in most other organisations. A large Dutch bank also contains a large population of the Dutch banking sector, so creates a good population for this study. Apart from this, because the three lines of defense model is implemented by all banks it is easier to distinguish uniform parties with different interests within the organisation.

Earlier research on risk attitudes and risk aversion which has been formed within organisations, shows that people have different risk attitudes (March and Shapira, 1987). No earlier research exists in the field of banking and they did not provide evidence on differences in risk attitudes among three lines of defense parties, including internal auditors (March and Shapira, 1987; Dohmen, 2007; etc).

Central question and sub-questions

The central question of this study will be as follows:

What are the differences in risk attitude between the three lines of defense parties within a bank?

This central question will be answered by the following sub-questions:

4) What theoretical basis exists regarding risk aversion and what is the impact of these psychological bias on individual judgment and decision making?

5) Are there significant differences in risk attitudes among the three lines of defense parties within a bank?

6) What (demographical) factors significantly impact the differences in risk attitudes?

1.3. Methodology

The first sub-question will be answered by a literature study. In this literature study a theoretical background and past research is described in the field of risk aversion.

To answer the second and third questions a survey will be distributed among internal auditors of one large bank in the Netherlands and in addition to this group also to employees of this bank within the first and second line of defense. The decision to focus on one bank is due to the research being too extensive if the full research approach would need to be replicated for different banks. The implications and limitations of this choice are that the external validity of the results could be less. Nevertheless, because of the size of the

(11)

population of this large bank and scientific approach which is used, the significant results of this research should provide interesting insight in the differences in risk perceptions within a bank which might can also be used in the light of other banks. Next to this, it will provide a good basis for further research.

Within the financial sector the control organization is organized based on the 3 lines of defense model (part of the ERM framework). The first line encompasses the front-line office employees who must understand their roles and responsibilities with regard to processing transactions and who must follow a systematic risk process and apply internal controls and other risk responses to treat the risks associated with those

transactions. The second line are the enterprise’s compliance and risk functions that provide independent oversight of the risk management activities of the first line of defence. The third line is internal audit, who reports independently to the senior committee charged with the role of representing the enterprise’s stakeholders concerning risk related issues (Doughty, 2011).

The survey will be based on an already validated survey which measures risk aversion based on the hypothetical choice problems (lottery choices) described by Kahneman and Tversky (1979, p. 263; Holt and Laury, 2002).

The results of the survey will be statistically analyzed by a t-test to distinguish significant differences in risk aversion among the three lines of defense parties within the particular bank. The aim is to obtain results at a minimum of hundred per line of defense, to draw scientific significant conclusions. Apart from this, the significant impact of the demographic factors: age, gender, education and income, and context (e.g. incentives) on the risk preferences of people is analyzed by regression analyses (correlations). The results of the survey will be validated by interviews with internal auditors and employees within the first and second lines of defense.

1.4. Thesis outline

The thesis is organized as follows. The theoretical background on which this research is based and past research in respect to risk aversion, individual judgment and decision making will be discussed in chapter two and three. In chapter four the data and methodology will be discussed extensively. The results of research are presented in chapter five and analyzed in chapter six. Finally, chapter seven revisits the main research questions and discusses the practical- and theoretical relevance of this study, its limitations and its directions for further research.

(12)

2. Theoretical background

This section aims to give an overview of all relevant scientific theories and past research, which the research approach in this paper will be based on. Paragraph 2.1. describes different theories about the psychological bias risk aversion, which are used as the basis for this study. Paragraph 2.2. will give an overview of the demographical factors, resulting from psychological causes, which impact a person’s level of risk aversion.

2.1. Measuring risk aversion based on the utility and prospect theory

Based on the utility theory and the prospect theory different approaches are defined to measure risk aversion. Therefore it is important to first (paragraph 2.1.1.) elaborate on these two theories of risk aversion. Secondly (paragraph 2.1.2.), the most important and well known measurement method for risk aversion is described.

2.1.1. Utility theory and prospect theory

Berkeley (2011) explains that a decision of an individual, based on the economic theory, is constrained by the price and the income of this individual/consumer. The rational consumer will not spend money on an additional unit of goods or service unless its marginal utility is at least equal to or greater than that of a unit of another good or service. The larger the number of goods or services held by an individual, the smaller the marginal utility that is experienced by one extra amount of this good or service. This implies that the total utility diminishes if you buy more of the same good or service. Therefore, the price of a good or service is related to its marginal utility and the consumer will rank his or her preferences accordingly (Berkeley, 2011).

The Expected Utility (EU) theory and the Prospect Theory provide insight in the individual preferences of individuals under uncertainty. The EU theory assumes rational decision making, whereby the expected value (EV) criterion is the rule of choice. This implies that an individual always chooses good/service or the gamble with the highest expected value (Berkeley, 2011).

Example

Two examples of a hypothetical choice problem used in the research of Kahnman and Tversky (1979) are the following:

1) Which choice would you prefer?

a) a 25% chance of winning $30,000, with a 75% chance of winning nothing; or b) a 20% chance of winning $40,000 (Kahneman and Tversky, 1979).

2) Imagine the following: You’re with 4 players in a game, and only one will go to the next round. You are the one who researched the second round, and faces the following choice:

(13)

Differences in risk attitudes among 3LoD parties within a bank | EIAP |Ingrid Laurier |11-07-2014 b) an 80% chance of winning $40,000 (Kahneman and Tversky, 1979).

When we look at these examples again under the EU theory an individual will pick option (b) in both gambles, because:

Preference under Expected Utility theory is b if: = EV(b) - EV(a) > 0

Experimental psychological research by Kahneman and Tversky (1979) has shown that people do not always act rational and found that most people choose (a) instead of (b) both times.

Based on the experiment described above, Kahneman and Tversky (1979) discovered the following irrational behaviour in decision making, called the Prospect Theory: “People underweight outcomes that are merely probable in comparison with outcomes that are obtained with certainty”. This tendency, called the certainty effect, contributes to risk aversion in choices involving sure gains and to risk seeking in choices involving sure losses” (Kahneman and Tversky 1979, p. 263).

This result is shown in figure 1, for which it is important to note that (0,0) is called the reference point. This reference point is comparable to the wealth/income of an individual at the moment of a decision.

Figure 1: Utility function based on Prospect Theory (Kahneman and Tversky, 1979).

A person’s risk attitude is described by the curvature of the utility function. The terms ‘risk averse’ and ‘risk seeking’ within the Prospect Theory technically refer only to the curvature of the utility function. The concavity can be defined using the following metric: whereby U is the utility at point x on the utility function: -u”(x)/u’(x) (Pratt, 1964).

It is possible that one person (i) on point x is more risk averse than another person (k): 𝑅_𝑖𝐴(x) ≥ 𝑅_𝑘𝐴(x). In this example person ( i)’s cash equivalent is smaller (the amount he would like to exchange for risk) than the one of person (k). As a consequence he demands a larger premium (expected monetary value – cash equivalent) at the same risk as the other person, so he would like to pay more for insurance in any situation (Pratt, 1964).

(14)

2.1.2. Measuring risk aversion

Several approaches have been used to assess the importance and nature of risk aversion of individuals, such as gambles, auctions and ranking of subjects (Anderson and Mellor, 2009). However one method is the most widely used and well known, namely the lottery question approach (Kahneman and Tversky, 1979; Holt and Laury, 2002).

The lottery question approach has its origin in the research by Kahneman and Tversky (1979) and is ever since widely used by other researchers, because of the high explanatory value.

The lottery choice approach is designed as follows:

“subjects make 10 choices between Option A or Option B, where each option is a lottery that pays

one of two amounts. In each decision, Option A is the “safe” choice and Option B is “risky,” since Option A has less variability in the payoffs than Option B. The 10 decisions differ in terms of the probability of winning the higher prize in each lottery. In Decision 1, the higher prize is paid if the throw of a 10-sided die is 1 and the lower prize is paid for any other throw of the die. For Decision 2, the higher prize is paid if the result of the die throw is 1 or 2 and the lower prize is paid if the die is 3 through 10. By Decision 9 there is a 90% chance of winning the higher prize, and Decision 10

is a choice between a certain prize in Option A and a certain prize in Option B.”( Anderson,

Mellor, 2009; Holt and Laury, 2002).

Most studies of individual risk aversion are based on validated surveys or field experiments (Kahneman and Tversky, 1979; Holt and Laury, 2002; Anderson and Mellor, 2009). Data in the field experiments is obtained by the use of lottery questions, with real monetary rewards. The same lottery questions are used in externally validated surveys on risk attitudes as hypothetical gambles (Holt and Laury, 2002).

However other measures can also be used such as job certainty, ranking of subjects or a self-assessment

(Anderson and Mellor, 2009; Hartog, Ferrer-i-Carbonell, and Jonker, 2000).

2.2. Neuropsychological causes and demographical factors that impact risk aversion

This section will give an overview of the demographical factors, resulting from psychological causes, which impacts a person’s level of risk aversion. The first paragraph, 2.2.1. describes that risk taking behavior by individuals is influenced by a complex neural network in the brain. Paragraph 2.2.2. focus more on the demographical factors that are influenced by the evolution of the brain, and the decision making by an individual.

2.2.1. Neuropsychological causes

Neuropsychological research provides insight in the field of individual risk taking. Neuropsychological research is done in the field of decision making in a complex and changing environment (under

uncertainty), in which an individual is carefully weighting risks and benefits. This research has shown that risk taking is influenced by the right hemisphere prefrontal activity in the brain, the dorsolateral prefrontal

(15)

cortex (DLPFC) (Knoch, 2006, p. 6469). The exact role of the DLPFC still remains unclear, but repetitive transcranial magnetic stimulation studies have allowed stimulation of the activity of the DLPFC, which promotes risk-taking behaviour or more cautious decision making (Fecteau, 2007).

A number of psychological causes are linked to extreme risk taking, like narcissism, drug abuse or pathological gambling (Fecteau, 2007). Narcissism is:

a dynamic, socially defined construct with two key elements: a positive, inflated, and agentic view of the self; and a self-regulatory strategy to maintain and enhance this positive self-view (Campell, Goodie and Foster, 2004).

Empirical research demonstrated that narcissists are convinced that they are special and unique, more intelligent, more physically attractive, and generally better than others. Because they overstate their abilities and think they are superior, they also make more risky decisions, and therefore are more risk taking (Campell, Goodie and Foster, 2004).

2.2.2. The impact of demographical background on individual’s risk aversion

Only the demographical factors gender, age, education and income, are frequently validated by past research in the field of risk behavior. For this reason the choice was made to focus only on these four demographical factors.

2.2.2.1. Gender

Different studies have found a similar impact of gender on risk behavior: women are more risk averse than men (Dohmen, 2007).

The most well-known research is from Byrnes, Miller, and Schafer (1999). They performed a meta-analysis of 150 studies, whereby the risk taking behaviour of men and women was compared across different domains, such as financial and health risks. Overall men are more risk taking than women, but the magnitude differs among domains. This implies that there are also differences in risk perceptions across domains (Byrnes, Miller, and Schafer, 1999).

The same results have been obtained by Hartog, Ferrer-i-Carbonell and Jonker (2000), Barskey et al (1997), and Donkers et al. (1999).

The hormone testosterone was found to be the main driver behind the differences in risk attitude between men and women (Burnham, 2007). Research by Burnham (2007), shows that men with higher testosterone are more likely to reject money offered to them, if someone else is getting a larger share. Another study, performed at Cambridge by Coates and Herbert (2007), describes the way testosterone and the stress hormone cortisol fluctuate in a group of traders in London. The increasing amount of testosterone of traders who were experiencing winning streaks, lead to a higher propensity for taking risks. The feeling of winning again created a positive-feedback loop. As this proceeded, the effect of the testosterone became toxic, and traders made decisions that were self-defeating. Cortisol, behaved differently, going up with the volatility

(16)

of the market. When the market started to crash, cortisol peaked as well, possibly exaggerating the sell-off (Coates and Herbert, 2007).

2.2.2.2. Age

The paper by Dohmen e.a. (2007) is one of the few studied that examines the impact of the full range of ages on individual willingness to take risks. They show that the unwillingness to take risks, risk aversion, is positively related to age. For women the unwillingness to take risks increases more rapidly with age, than for men. The study is based on data from the social economical panel in Germany. Heads of all households in Germany were asked to fill out the survey, which implies that the ages are included in the research varied from adolescence to adulthood.

Developmental neuroscience studies (Steinberg, 2008) have also found a relationship between adolescence and risk taking. The study by Steinberg (2008) has shown that risk taking increases between childhood and adolescence, as a result of changes in the brain’s socio-emotional system around the time of puberty. This leads to an increase in reward seeking. Risk taking subsequently decreases between adolescence and adulthood because of changes in the brain’s cognitive control system, which improves individuals self-regulation (Steinberg, 2008).

2.2.2.3. Education level

Past research found that individuals are willing to take more risks when they have a higher level of education (Dohmen e.a, 2007; Hartog, Ferrer-i-Carbonell, and Jonker, 2000). These research approaches included both the variables wealth/income and educational level. Since both variables are included in the regression you purely measure the education effect. Both studies, Dohmen e.a. (2007) and Hartog, Ferrer-i-Carbonell, Jonker (2000), show a negative relation between risk aversion and education level.

It can be assumed that education can give people more experience and insight in the decision making process, which can reduce an individual’s risk aversion (Hartog, Ferrer-i-Carbonell, and Jonker, 2000).

2.2.2.4. Income

Past research found that individuals are also willing to take more risks when they have a higher income (Dohmen e.a, 2007; Hartog, Ferrer-i-Carbonell, and Jonker, 2000). This research included both

wealth/income and educational level. Since both variables are included in the regression you can measure purely the income effect. Both research paper, Dohmen e.a. (2007) and Hartog, Ferrer-i-Carbonell, and Jonker (2000), show a negative relation between risk aversion and income.

It can be assumed that higher income or level of wealth can increase the willingness to take risks, because they mitigate the impact of bad outcomes (Hartog, Ferrer-i-Carbonell, and Jonker, 2000).

(17)

2.3. Summary and conclusion

In this section it is shown, based on the Utility and Prospect Theory, that risk behaviour can differ among individuals and is described by his/her utility function. The concavity of this utility function describes a person’s risk aversion or risk taking behaviour (Pratt, 1964).

The Prospect theory shows that in general people act irrational regarding risk, “People underweight outcomes that are merely probable in comparison with outcomes that are obtained with certainty” (Kahneman and Tverskey, 1979), which is called risk aversion.

Most of the literature in the field of risk behaviour is based on validated surveys and field experiment, whereby the most widely-used and well known approach is the lottery question approach by Kahneman and Tverskey (1979) and Holt and Laury (2002).

Based on experimental and survey research the risk taking behaviour by an individual has been found to be influenced by the activity of the neuro-network in the brain (Fecteau, 2007) as well as demographical background (gender, age, educational level and income).

The demographical factors of, gender, age, education level and income are validated by past research in the field of risk taking behaviour and describe the following relationship:

- Women are more risk averse than men, due to the hormone testosterone which is present in greater amounts in men than in women (Dohmen, 2007; Burnham, 2007).

- Risk taking behaviour increases between childhood and adolescence and decreases between adolescence and adulthood, as a result of changes in the brain’s socio-emotional and cognitive control system (Steinberg, 2008).

- Risk taking behaviour increases when individual have a higher education level, which can be the result of more experience and insight in the decision making process (Hartog et al, 2000).

- Risk taking behaviour increases when people have a higher income, because it is assumed that this mitigates the impact of bad outcomes (Hartog et al, 2000).

(18)

3. Risk aversion and internal audit

This section will discuss risk aversion and its relationship with internal audit, especially in the banking sector. First, it is important to provide a better insight in the position of internal audit in a bank and the relationship with other departments and activities. To get this insight, the three lines of defense model is discussed in paragraph 3.1. Apart from this, paragraph 3.2. will discuss the decision making process of the auditor with respect to risks.

The remainder of this section, paragraph 3.3., will focus on the impact of different factors, such as demographical background, incentives and experience, on an individual’s level of risk aversion and the decision making regarding risks.

3.1. Three lines of defense model

Internal audit plays an important role in the Enterprise Risk Management Framework of a financial institution. Specifically in the banking sector the three lines of defense model (see figure 2), is used as part of the Enterprise Risk Management Framework (Doughty, 2011). Although Code Banken (2009) did not use the definition three lines of defense, it prescribes a framework where risk management and internal audit play an important control role. Based on this and expectations of regulators, the three lines of defense model is aimed to be implemented by all banks.

KPMG defines the following view as primary aim of the three lines of defense model:

The three lines of defense model can be used as the primary means to demonstrate and structure roles, responsibilities and accountabilities for decision making, risk and control to achieve effective governance, risk management and assurance (KPMG, 2014)

The first line of defense encompasses the businesses who are responsible for the risk and control environment within the day-to-day operations (KPMG, 2014). The front-line employees are those who must understand their roles and responsibilities with regard to processing transactions. They must follow a systematic risk process and apply internal controls and other risk responses to treat the risks associated with those transactions (Doughty, 2011).

The second line departments are the enterprise’s compliance and risk functions that provide independent oversight of the risk management activities of the first line of defence (Doughty, 2011). They set the companies boundaries by drafting policies and procedures and are responsible for the implementation and monitoring of compliance to these policies and procedures by the first line of defense (KPMG, 2014).

The Third line is internal audit, who reports independently to the audit committee charged with the role of representing the enterprise’s stakeholders relative to risk issues (Doughty, 2011). The IIA gives the following definition of Internal Audit:

“Internal Audit is an independent, objective assurance and consulting activity designed to add value an improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a

(19)

systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.”( Institute of Internal Auditors, 2013).

Figure 2: Three lines of defense model (Doughty, 2011).

3.2. The internal audit process and decision making regarding risks

The internal auditor, as the third line of defense, gives assurance about the control framework of the organisation and the day to day operations of the first and second line of defense. To come to a final conclusion the auditor follows a process, the audit process. The internal auditor judges or estimates risks in different phases of the audit process. Driessen en Molenkamp (2012) distinguish the following phases in this process: 1) planning phase (plan of approach), 2) pre-research phase, 3) fieldwork phase, 4) reporting 5) evaluation phase and 6) follow up phase.

The IIA standards provide guidance and minimum standards regarding all these phases of the audit process. Standard 2200 prescribes that:

“An Internal auditor must develop and document a plan for each engagement, including the engagement’s objectives, scope, timing, and resource allocations” (IIA, 2013).

Regarding the objectives and scope of the engagement the internal auditor needs to define the significant risks related to the activity and the means by which the potential impact of the risk is within the range of or within the acceptable risk appetite of the organisation. Apart from this the internal audit department needs to conduct a preliminary risk assessment on the engagement topic, which results in clear objectives for the engagement (IIA, 2013).

Furthermore, the internal auditors need to set a clear norm, the control framework, which their final judgement on the audit object will be based on. Standard 2210 prescribes that:

(20)

“Adequate criteria are needed to evaluate governance, risk management, and controls. Internal auditors must ascertain the extent to which management and/or the board has established adequate criteria to determine whether objectives and goals have been accomplished. If adequate, internal auditors must use such criteria in their evaluation. If inadequate, internal auditors must work with management and/or the board to develop appropriate evaluation criteria” (IIA, 2013).

To come to a sound opinion about the audit engagement topic a control framework is a pre-condition. The control framework can be seen as the desired control situation.

The result of the fieldwork phase is a set of findings and recommendations. During the fieldwork phase the control framework is compared to the actual situation and the rest/residual risk is identified. Based on the set of findings, the rest risk and professional judgement a final opinion or rating is provided by the auditor. The findings and recommendations including risk ratings are reported to and discussed with management. Together with management an action plan is identified to mitigate the rest/residual risk (Driessen en Molenkamp, 2012, p. 348).

As described the internal auditor assesses the risks and the severity of such risks in different phases of the audit process, specifically during: the preliminary risk assessment, the significant risk identification, the rest risk identification and the final risk rating/opinion. In these different phases discussions are held with the auditee (who is positioned in the first or second line of defense) about outcomes of the audit work in a particular part of the process, such as discussion of the reported findings. Often this leads to intense discussions about audit ratings and validity of the finding in the context of the risks identified. This phenomenon could be the result of different risk perceptions between the auditor and auditee, which may eventually result in other decisions and opinions about risks.

3.3. What influences decision making – nature vs nurture

This decision process conducted by the auditor is often described as professional judgement. Professional judgement is the forming of an opinion by an educated and training person. Figure 3 shows a model of professional judgement, which focuses on a single decision. The model describes that the judgement of an auditor is based on his values, beliefs, expectations (see table 1) and shareable and practical knowledge (tacit). These factors create a certain experience that professional judgement is based on. Professional judgement eventually influences the decision (McDavid and Hawthorn, 2006, p. 454-455).

(21)

Figure 3: Model of professional judgment (McDavid and Hawthorn, 2006, p. 454-455).

Values “Values are statements about what is desirable, what ought to be, in a given situation”.

Beliefs “Beliefs are about what we take to be true—our assumptions about how we know what we know (our epistemologies are examples of beliefs)”.

Expectations “Expectations are assumptions that are typically based on what we have learned and what we have come to”.

Table 1: Definitions values, beliefs and expectations (McDavid and Hawthorn, 2006, p. 454-455).

As the concept of professional judgement describes in theory it is possible that people with another background, training and education could follow another decision making process, because their values, beliefs , expectations and level of experience differ. This can be both a consequence of innate behaviour (nature) and behaviour that is learned (nurture).

3.3.1. Demographical background

Based on someone’s demographic background, such as age, gender, income and education, research has shown that people’s level of risk aversion can differ (for more information, see section 2) (Dohmen, 2007; Burnham 2007; Steinberg, 2008; Hartog et al, 2000).

These demographic factors can be related to the activities in the brain which influence the way we see risks, and act on them (nature) (Steinberg, 2008). Within the decision making process, demographic background can be expressed in someone’s beliefs, values and expectations. This can eventually lead to another decision being made when it comes to risk related decisions (McDavid and Hawthorn, 2006, p. 454-455).

If it can be found that demographic factors impact someone’s level of risk aversion, it would be interesting to study, whether first line of defense employees have another demographic background than those

(22)

motivations play a role in risk taking behaviour. This effect was also identified in the research of March and Shapira (1987).

3.3.2. Incentives

Not only a person’s demographic background set the person’s beliefs, values and expectations. Incentives (context) experience also plays a role (McDavid and Hawthorn, 2006, p. 454-455). Research in the field of managerial risk taking describes the differences in risk taking behavior across individuals and contexts. They identified incentives (targets) as one of the main drivers of managerial risk taking, but also the intrinsic motivation as part of someone’s individual personality plays a role in risk taking behaviour (March and Shapira, 1987).

Berle and Means (1932) introduced the agency problem as a result of the division of ownership and control within organisations (Eisenhardt, 1989). Jensen and Meckling (1976, p. 308) further defined the principal-agent relation. The principal-agent performs certain services for the principal, for which the principle delegates some decision rights to the agent. As a result of this relationship two information asymmetries which play an important role, can be identified: adverse selection and moral hazard. These two information asymmetries are the result of two problems: 1) the problem of risk sharing and 2) the monitoring problem, also called agency problem (Eisenhardt, 1989, p. 58). The risk sharing problem implies that the principal can have a different risk preference from the agent.

Incentive contracts are used to reduce the information asymmetries between principal and agent. Therefore they are also used to influence the asymmetries between risk preferences, namely the risk sharing problem. Even with an incentive contract it is difficult to align the interest of the agent and principle. Some costs are always incurred, such as monitoring costs (principal) and bonding expenditures (agent). These costs are called agency costs (Jensen and Meckling, 1976, p. 308).

Next to incentives, experience can also influence an individual’s decision making regarding risks (see figure 3). Experience is influenced by beliefs, values and expectations, but also by shareable and practical knowledge. Beliefs are based on what we have heard, read or think about a subject. So people develop beliefs about risk taking over time based on what they heard, read or think. Based on these beliefs we derive our values (see table 1). This implies our decisions regarding risks are based on what we experience during life, and not only influenced by demographic background (McDavid and Hawthorn, 2006, p. 454-455).

Based on this assumptions we can derive that because of the differences in beliefs, values, expectations, resulting in different experience, the audit opinion (third line of defense) of the risk identified during the audit process, can be substantially different from the auditee’s opinion (first and second line of defense).

(23)

3.4. Summary and conclusion

Internal audit plays an important role in the Enterprise Risk Management Framework of a financial institution. Specifically in the financial sector the three lines of defense model (see figure 2) is used as part of the Enterprise Risk Management Framework, “to structure roles, responsibilities and accountabilities for decision making, risk and control to achieve effective governance, risk management and assurance (KPMG, 2015). Internal audit is defined as the third line of defense within the three lines of defense model.

The internal auditor forms opinions about risk within different phases of the audit process: preliminary risk assessment, significant risk identification, rest risk identification and the final risk rating/opinion (Driessen and Molenkamp, 2012). In these different phases there are discussions with the auditee (in the first or second line of defense) about outcomes of a particular part of the process, such as discussion of the reported findings. This often leads to intense discussions about audit ratings and validity of the finding in the context of risks. This could be the result of different risk perceptions between the auditor and auditee, which eventually can lead to different decisions and opinions about risks.

Past research, especially in the field of organisations, has found that both incentives and intrinsic motivation play a role in risk taking behaviour among individuals within an organisations (March and Shapira, 1987; Gibbons).

Demographical factors (intrinsic motivation), but also incentives and learning during life (hear, read etc) can influence our values, beliefs, expectations and experiences (McDavid and Hawthorn, 2006). This implies that within a bank the beliefs, values and experiences can differ among individuals within the three lines of defense as a result of a different demographical background as well as incentives (context) and lifetime experience. This could influence their judgment process and decision making.

Based on this assumptions we can derive that because of the differences in beliefs, values, expectations, resulting in different experience, the audit opinion (third line of defense) of the risk identified during the audit process, can be substantially different from the auditee’s opinion (first and second line of defense).

(24)

4. Research design

This section will describe the methodology that is used in this research to answer the main research question: “What are the differences in risk attitude between the three lines of defense parties within a bank?”. First, in paragraph 3.1. the research approach and sample selection is discussed. Second, in paragraph 3.2. the data analysis is explained. Finally, in paragraph 3.3. the hypotheses set in this research are discussed, based on the literature study in section 2 and 3.

4.1. Research approach and sample selection

This study will focus on the banking sector. The reason to choose this sector is that the internal audit department is relatively large within banks, because of laws and regulations and the typology of the organisation. This can indicate that employees in the organisation have more experience with internal audit than in most other organisations. A large Dutch bank also contains a large population of the Dutch banking sector, so creates a good population for this study. Apart from this, because the three lines of defense model is implemented by most banks, it is relatively easy to distinguish uniform parties with different interests within the organisation.

The decision to focus on one bank is due to the research being too extensive if the full research approach would need to be replicated for different banks. The implications and limitations of this choice are that the external validity of the results could be less. Nevertheless, because of the size of the population of this large bank and scientific approach which is used, the significant results of this research should provide

interesting insight in the differences in risk perceptions within a bank which might can also be used in the light of other organizations. Next to this, it will provide a good basis for further research.

Based on this set-up, the population of this research exists of employees within the first, second and third line of a Dutch bank. The first step in the research approach is to measure the risk aversion among these employees and to get information about their demographic background. To measure the level of risk aversion, a validated survey is used which measures risk aversion based on the hypothetical choice problems (lottery choices) of Kahneman and Tversky (1979, p. 263; Holt and Laury, 2002). The approach followed in this research is a replication of the approach of Holt and Laury (2002). The study by Holt and Laury (2002) is one of the most famous in the field of risk aversion and is mentioned by most research papers with risk aversion as object of study. A validated survey means that the survey results are validated with an experiment. If the results in the survey lead to the same results as in the experiment (more

approaching the actual situation) the survey is assumed to be a good tool to measure risk aversion.

The survey, see appendix I and II, exists of 6 demographical questions, such as age, gender, income, education level etc., and 10 lottery questions. The lottery questions are almost identical to each other, only the percentages of chances to win an x amount of euro’s changes. The respondents will experience that at

(25)

some point, they will switch from choosing the safe choice A, to the risky choice B (see table 2). This could be at the first questions, but also in the middle or at the end of the survey.

If someone would take fully rational decisions, the Expected Utility theory would prescribe that from question 5 onward people will choose B. The prospect theory assumes that people act irrationally and prescribes that the degree of risk aversion can differ among people. Also in general people are risk averse (Kahneman and Tversky, 1979).

Question Option A Option B Expected Payoff

differences (EV(A)-EV(B)) 1 1/10 of € 2000, 9/10 of €1600 1/10 of € 4000, 9/10 of €100 1150 2 2/10 of € 2000, 8/10 of €1600 2/10 of € 4000, 8/10 of €100 800 3 3/10 of € 2000, 7/10 of €1600 3/10 of € 4000, 7/10 of €100 450 4 4/10 of € 2000, 6/10 of €1600 4/10 of € 4000, 6/10 of €100 100 5 5/10 of € 2000, 5/10 of €1600 5/10 of € 4000, 5/10 of €100 -250 6 6/10 of € 2000, 4/10 of €1600 6/10 of € 4000, 4/10 of €100 -600 7 7/10 of € 2000, 3/10 of €1600 7/10 of € 4000, 3/10 of €100 -950 8 8/10 of € 2000, 2/10 of €1600 8/10 of € 4000, 2/10 of €100 -1300 9 9/10 of € 2000, 1/10 of €1600 9/10 of €4000, 1/10 of €100 -1650 10 99/100 of € 2000, 1/100 of €1600 99/100 of € 4000, 1/100 of €100 -1965 Table 2: Lottery choice options and expected differences in payoff.

The number of safe choices measure someone’s level of risk aversion (Holt and Laury, 2002). Holt and Laury (2002)’s classification is shown in table 3.

Number of save choices Risk preference classification

0-1 High risk loving

2 Very risk loving

3 Risk loving

4 Risk neutral

5 Slightly risk averse

6 Risk averse

7 Very risk averse

8 Highly risk averse

9-10 Stay in bed

Table 3: Risk aversion classification (Holt and Laury, 2002)

After a pilot survey that was filled by 5 people, the survey (appendix I and II) was distributed among approximately 450 employees of a Dutch Bank, broken down into the three lines of defense parties. In

(26)

order to be able to possibly derive statistical significance from the results, and to compare the risk attitude of employees in the first, second and third line, it is essential to get at least 100 respondents per line of defense (per group).

Furthermore, it is important to make a clear distinction between first, second and third line of defense employees. The following criteria are used to clearly distinguish the employees within the first, second and third line:

1) within the first line of defense employees are selected with direct customer contact;

2) within the second line of defense employees are selected who are responsible for policy setting and perform monitoring activities on first line of defense activities; and

3) within the third line of defense only auditors are selected, and no support or secretary functions. This implies that the first step in the sample selection is a non-random sample. The sample is performed on the employee database of the particular Dutch Bank. Based on the three defined groups of employees, the second step in the sample selection is a random sample of employees within these three groups. The sample was drawn on an internal employee database, which has led to a total of 450 employees who were

surveyed.

4.2. Data analysis

The second step in the research approach is to analyze the data which is obtained based on the survey. First, to answer the research question regarding, if there are significant1 differences in risk attitudes among the three lines of defense parties within a bank?”, an analysis of variance (ANOVA) is used. An analysis of variance is a statistical test to determine whether the population averages of the 3 groups differ from each other.

Secondly, to determine what may be impacting these potential differences: demographical factors and/or context (e.g. incentives); two multiple regression analyses are performed.

The first regression analysis only focuses on the demographical factors which may influence the level of risk aversion of an individual:

Risk aversion = β1Age + β2 Gender + β3Education Level + β4 Income (1)

The regression analysis describes the way age, gender, education level and income impacts an individual’s level of risk aversion. The data which is provided by the survey is input for this regression analysis. Based on the correlation coefficients β, an analysis is made of how strong the relationship between the specific demographical factor and the level of risk aversion is. Furthermore, the direction of this relationship (decrease/increase) will be analyzed.

1

Significant results mean that the results strongly support the hypothesis that the observed effect is not created by chance but by something else.

(27)

In the second regression analysis the factor Three lines of defense (3LoD) is added to the already existing regression analysis.

Risk aversion = β1Age + β2 Gender + β3Education Level + β4 Income + β5 3LoD (2)

Using this regression analysis, β5 will explain if significant differences in risk aversion still exist between the three lines of defense employees when they are controlled by demographical factors. If this leads to significant results for the factor “3LoD”, it can be assumed that context factors such as incentive, and not only demographic factors impact the different risk aversion levels within the three lines of defense.

The regression analysis also provides information about the explanatory value of the regression (R2), and the significants1 (quality of resulted correlations). If the β coefficients are significant, so of appropriate quality, it can be assumed that this particular demographic factor impacts risk aversion. Beforehand, the standard statistical tests are performed on both regressions to assure the quality of the results2.

The results of the survey will be validated by performing six structured interviews with two internal auditors and two employees within the first and two within second line of defense. It is important that these people have experience with internal audit from a managerial perspective, so they are able to answer the questions based on their experience with the audit process. In appendix III the structured interview questions are provided.

4.3. Hypotheses

Based on past research in the field of risk aversion, which is already mentioned in section 2 and 3, five hypotheses can be defined3. These hypotheses will be tested by the two regression analyses described in the last paragraph.

Hypotheses demographical factors (nature)

These hypotheses are already extensively discussed in paragraph 2.2.2. For more background information please refer to page 12 for a summary. Regarding the demographical factors gender, age, education level and income, the following hypotheses will be tested:

Gender

H1: Women are more risk averse than men (Dohmen, 2007; Burnham 2007). Age

H2: Risk taking behaviour increases between childhood and adolescence and decreases between adolescence and adulthood (Steinberg, 2008).

2

To provide the most robust and efficient test results using an (OLS) regression estimation method, the regression models are controlled for heteroskedasticity and autocorrelation, and tested for normality.

3

See for more background information section 2.

(28)

Differences in risk attitudes among 3LoD parties within a bank | EIAP |Ingrid Laurier |11-07-2014 Education

H3: Risk taking behaviour increases when individuals have a higher education level (Hartog et al, 2000).

Income

H4: Risk taking behaviour increases when people have a higher income (Hartog et al, 2000).

Hypothesis Incentives and Experience (Nurture)

Next to the demographical factors (nature) also context (e.g. incentives) can influence an individual’s level of risk aversion. This can be reflected in the factor “3LoD”. For more information about this phenomenon see paragraph 3.3.2. and page 12 for a summary. Based on this the following hypothesis will be tested:

H5: Both incentives and intrinsic motivation play a role in risk taking behaviour among individuals within an organisations (March and Shapira, 1987; Gibbons), and can influences the way people experience risk and act on it (risk attitude).

(29)

5. Results

In this section the results of the in section 4 described research approach are presented. This section primarily focuses on providing an overview of the results. An analysis and description of the implications of these results (for internal audit) are presented in section 6, the analysis. The full versions of tables and figures that show the results are displayed in appendix IV.

5.1. Descriptive statistics

The data for this study was derived from the survey results. After cleaning this data (removing incomplete submissions), the number of total respondents on the survey is 310. This means that based on a total number of 450 surveys send out, the response percentage is considerably high 68,9%. This high response rate is mainly due to the fact that senior management showed their commitment for the research and survey before it was sent to all employees. As shown in the descriptive statistics the number of respondents per line of defense is as follows: number of respondents in the first line of defense is 104, in the second line 102, and in the third line 104 (see appendix IV, table 4 for a reference if necessary).

The level of risk aversion per respondent for the total population is shown in figure 4.

Figure 4: Number of respondents per level of risk aversion (N=310)

The bars show that most people are primarily risk neutral or risk averse, which implies that on average the employees within this bank are relatively risk averse. This is in line with past scientific research that shows humans are on average somewhat risk averse (Kahneman and Tversky, 1979).

Figure 5 shows that the average level of risk aversion (mean) is different between the first, second and third line of defense. The average level of risk aversion in the first line is 4,95 (risk neutral-slightly risk averse) in the second line it is the highest 5,57 (slightly risk averse-risk averse), and the third line’s level of risk

0 50 100 11 9 30 67 46 61 39 14 28 N um be r o f r es po nde nt s

(30)

Differences in risk attitudes among 3LoD parties within a bank | EIAP |Ingrid Laurier |11-07-2014 4,5 5 5,5 6 First line of

defense Second line

of defense Third line of

defense Risk aversion differences 3 LoD

aversion is 5,2 (slightly risk averse). The dispersion of the results (standard deviation) is the largest for the second line (2,18) and the smallest for the third line of defense (1,93), which implies that the third lines of defense is more unanimous than the first and second line of defense on the level of risk aversion (see appendix V table 4 for a reference if necessary).

Figure 5: Average risk aversion levels of first, second and third line of defense, including Risk aversion classification (Holt and Laury, 2002).

5.2. Difference in risk aversion level between three lines of defense parties

To answer the main research question of this paper: What are the differences in risk attitude between the three lines of defense parties within a bank?, it is important to further define the difference in the level of risk aversion among the first, second and third line of defense by a test of the significance4.

The results are shown in appendix IV, table 5 and 6, and are useful as a reference if necessary. First, an Analysis of variance (ANOVA) is performed. An ANOVA is a statistical test to determine whether the population averages (means) of the 3 groups, first, second and third line of defense, differ significantly from each other. The results show that there is a significant difference. It can be concluded that it is 90% sure that the risk aversion level of the three lines of defense parties differ and is most likely not a

coincidence.

Secondly, some statistical tests are performed to identify between which parties the differences in risk aversion levels are most significant (least likely to be a coincidence). These results show that primarily the significance of the ANOVA is due to the difference in risk aversion between the first and second line of

4

Significance means that the results strongly support the hypothesis, and that the observed effect is for “X” % certain and not a result of a coincidence. Number of save choices Risk preference classification

0-1 High risk loving 2 Very risk loving 3 Risk loving

4 Risk neutral

5 Slightly risk averse

6 Risk averse

7 Very risk averse 8 Highly risk averse 9-10 Stay in bed