A toothless approach to reining in excessive exec pay by Eleanor Bloxham @FortuneMagazine May 31, 2011, 3:56 PM EDT E-mail Tweet Facebook Google Plus Linkedin Share icons By Eleanor Bloxham, contributor FORTUNE — While the banks that managed to survive the financial crisis have largely mended their own balance sheets, they are far from out of the doghouse with regulators. Reports circulated last week that New York attorney general Eric Schneiderman’s office is expanding its probe of bank mortgage operations, which already includes the likes of JPMorgan JPM , Deutsche Bank db , and UBS ubs . To understand the motivations at the banks that has paved the path to this probe, we need look no further than how the banks pay their executives. Whatever changes financial institutions may have made to their risk oversight and compensation programs have been inadequate. That’s clear just from the error-riddled foreclosure processes, which dragged on unimpeded (without even apologies until recently), causing multiple crisis aftershocks. “State attorneys general told five of the nation’s largest banks on Tuesday they face a potential liability of at least $17 billion in civil lawsuits if a settlement isn’t reached to address improper foreclosure practices” a “figure [that] doesn’t cover additional billions of dollars in potential claims from federal agencies,” the Wall Street Journal reported on Wednesday. While there’s been lots of talk from banks and regulators, there’s been far less action to establish sure footing in the risk and compensation arenas at these institutions. The slow pace of change began right after the financial crisis engulfed the banks. President Obama appointed a pay czar (Ken Feinberg), and while caps on pay were instituted, none of the banks delivered any meaningful systemic change. The banks that received TARP funds were obligated to discuss their compensation programs in SEC filings, explaining how their practices did not encourage excessive risk. But rather than actually change compensation, bank compensation committees generally relied on workers inside the bank (i.e. risk management personnel) to bless their existing plans. Having internal workers approve compensation plans won’t do much to change anything other than make a few people unwittingly feel better. What is a risk management person going to say to the CEO who signs his paycheck: “yours is too big, particularly for the risk you’ve taken on”? Yet, a proposed multi-agency rule, including the Office of the Comptroller of the Currency, Federal Reserve, FDIC, National Credit Union Administration, SEC and the Federal Housing Finance Agency, would mandate that risk management personnel be involved in the development of banks’ compensation plans. Granted, this requirement is just one of many within the proposed rule, but it’s a weak response to a problem that is larger than the regulators seem to comprehend. Comments on the multi-agency proposal close at the end of May, and because the issues are so important, regulators need to take a second look. What is appropriate pay, anyway? The proposed rule would require financial institutions to develop a report that outlines “the specific reasons why … the structure of its incentive-based compensation plan does not encourage inappropriate risks.” But what is inappropriate to you or me may seem quite appropriate to the bank next door. And internal management risks too often go unidentified and all compensation programs have their risks. Regulators need to get financial institutions to identify their own internal management risks, how their compensation programs will ameliorate, rather than amplify, those risks, and why those remedies (as opposed to alternatives) are the best approach. Perhaps if financial institutions had gone through this exercise immediately after the crisis, some of the foreclosure mess might have been avoided. Banks would have identified paperwork risks and ensured that the quality of processes mattered as much, if not more, to their employees than the speed of processing. Also, regulators need to recognize that all compensation programs come with risks. Pay too little and you will have trouble hiring top talent. Pay too much, and for the wrong things, and you will attract candidates, but not ones with proper motivations. So instead of pretending compensation programs don’t create risk in some form, regulators should recognize that all programs do. The question to be addressed, however, is whether a bank understands its own programs well enough to identify and minimize the risks. The allure of giving yourself a raise Money can be addictive, just as power and drugs and alcohol and chocolate can be. And excessive compensation can be a potent drug, leading to all kinds of unwanted behavior (See: Rajat Gupta). The proposed rule would require banks to assess whether or not its compensation is excessive. One of the tests to determine whether a bank is giving out excessive compensation would be to examine what peer banks pay their executives. But if everyone is earning vast sums and taking great risks as a result, it doesn’t mean that pay is on target. (Other metrics can be helpful. See “How can we address excessive CEO pay?”) Excessive compensation can also be monitored based on whether a bank is creating long-term economic value, for the bank itself and for its shareholders, employees, customers, and other stakeholders. That would involve measuring the long-term risks versus the rewards of a bank’s financial decisions. While the proposed rule encourages financial institutions to measure their businesses based on the risks they assume and use those measurements in their compensation, they should mandate it instead. Financial institutions are in the business of trading risk for reward. If a manufacturing firm didn’t measure its costs but only its revenues, you’d know something was amiss. The same holds true for banks. How do corporate boards fit in? The requirements related to the role of the board need to be strengthened under this rule. For example, the proposed rule suggests that boards should receive data to perform its compensation oversight but does not provide clear guidance on the kinds of information boards should receive. In addition, the proposed rule says the “board of directors, or a committee thereof, should review and approve the overall goals and purposes of the … incentive-based compensation system and ensure its consistency with the institution’s overall risk tolerance.” The mindset of “review and approve” is one of rubber-stamping, the last thing regulators should be encouraging from boards of directors at financial institutions. No time for a rushed job The proposal aims to have its requirements implemented within a six-month period. While it’s important to move quickly, regulators should heed the admonition “measure twice, cut once” if they desire real change. Now is not the time for rushing but for careful thinking about a sustainable plan. Now is the time to seriously address risk and compensation at financial institutions. The foreclosure crisis has shown that the status quo is untenable. The way forward will require real work. Eleanor Bloxham is CEO of The Value Alliance and Corporate Governance Alliance (http://thevaluealliance.com), a board advisory firm.