RISK MANAGEMENT GUIDELINES

FOR

FINANCIAL SERVICE PROVIDERS REGULATED BY BANK OF ZAMBIA

September 2008

---

TABLE OF CONTENTS

• Short Title...................................................................................................................1
• Objectives...................................................................................................................2
• Definitions...................................................................................................................3
• Application of these Guidelines...................................................................................5
• Risk Management Systems........................................................................................6
  • Risk Management Structure...................................................................................6
  • Basic Elements of a Sound Risk Management System...........................................7
• Operational Risk.......................................................................................................10
  • Board Oversight...................................................................................................10
  • Senior Management Oversight............................................................................10
  • Operational Risk Identification and Measurement..............................................11
  • Risk Monitoring and Management Information Systems.....................................14
  • Risk Assessment and Quantification.................................................................14
  • Risk Monitoring Process...................................................................................15
  • Internal Control System....................................................................................15
  • Business Continuity Management.......................................................................15
• Credit Risk..............................................................................................................17
  • Board Oversight..................................................................................................17
  • Senior Management Oversight...........................................................................19
  • Policies and Procedures.....................................................................................19
  • Credit Risk Management Framework.................................................................20
  • Credit Risk Administration................................................................................23
  • Credit Risk Mitigation......................................................................................23
  • Credit Risk Monitoring and Control.................................................................24
  • Stress Testing....................................................................................................25
  • Credit Risk Review...........................................................................................25
  • Managing Problem Credits...............................................................................25
• Strategic Risk..........................................................................................................26
  • Board Oversight..................................................................................................26
  • Senior Management Oversight...........................................................................27
  • Policies and Procedures.....................................................................................27
  • Limits................................................................................................................27
  • Monitoring Strategic Risk..................................................................................27
  • Internal Controls and Audit...............................................................................28
  • Business Continuity Management.......................................................................28
• Liquidity Risk..........................................................................................................28
  • Board Oversight..................................................................................................28
  • Senior Management Oversight...........................................................................29
  • Liquidity Risk Management Policy....................................................................29
  • Procedures.........................................................................................................30
  • Limits................................................................................................................31
  • Measuring and Monitoring Liquidity Risk.........................................................31
  • Internal Controls and Audit...............................................................................32
  • Contingency Planning.......................................................................................32
• Market Risk.............................................................................................................33
  • Interest Rate Risk Management.........................................................................33
    • Board Oversight..............................................................................................33
    • Senior Management Oversight.......................................................................34
    • Policies and Procedures..................................................................................35
    • Limits.............................................................................................................35
    • Measuring Interest Rate Risk..........................................................................36
    • Monitoring Interest Rate Risk.........................................................................37
    • Interest Rate Risk Control..............................................................................38
    • Internal Controls and Audit............................................................................38
  • Foreign Exchange Risk Management...............................................................39
    • Board Oversight..............................................................................................39
    • Senior Management Oversight.......................................................................39
    • Policies, Procedures and Limits......................................................................40
    • Management Information System...................................................................40
  • Price Risk Management....................................................................................40
    • Board Oversight..............................................................................................40
    • Senior Management Oversight.......................................................................41
    • Policies, Procedures and Limits......................................................................41
    • Measuring and Monitoring Price Risk.............................................................42
    • Management Information System...................................................................42
    • Internal Control and Audit..............................................................................42
• Legal Risk...............................................................................................................43
  • Board Oversight..................................................................................................43
  • Senior Management Oversight...........................................................................43
  • Policies and Procedures.....................................................................................44
  • Measuring Legal Risk........................................................................................44
  • Monitoring Legal Risk and Management Information System...........................44
• Reputational Risk...................................................................................................45
  • Board Oversight..................................................................................................45
  • Senior Management Oversight...........................................................................45
  • Policies and Procedures.....................................................................................45
  • Risk Identification, Measurement and monitoring.............................................45
  • Internal Controls and Audit...............................................................................46

---

1. SHORT TITLE

These Risk Management Guidelines are issued pursuant to Section 125 of the Banking and Financial Services Act, Chapter 387 of the Laws of Zambia. These Guidelines may be cited as the Banking and Financial Services Risk Management Guidelines, 2008.

---

2.0 OBJECTIVES

These Guidelines are issued in line with the Bank of Zambia’s move towards fully implementing a risk based approach to supervision of all Financial Service Providers (FSPs). Under the risk based approach to supervision, the supervisory focus is on ensuring that the management of all FSPs identifies, measure, control and monitor the levels and types of risks assumed. In situations where risk is not properly managed, the Bank of Zambia shall direct management to take appropriate corrective action, which may include reducing exposures, increasing capital, strengthening risk management processes and/or taking other prompt corrective measures.

For institutions belonging to a group, the Bank of Zambia shall determine whether the risks at an individual institution are mitigated or increased by the activities and condition of the entire group.

The objective of risk management is to assess the manner in which the FSP manages all its risks including operational risk, credit risk, market risk, reputational risk and legal risk exposures; understand what drives it, allocate capital against it and identify trends internally and externally that would help predict it.

For the purpose of these guidelines, FSPs refer to commercial banks, financial institutions or financial businesses.

---

3.0 DEFINITIONS

In these Guidelines, unless the context otherwise require -

‘Bank’ shall have the same meaning as contained in the Banking and Financial Services Act;

‘Bank of Zambia’ means the Bank of Zambia established under the Bank of Zambia Act;

‘Board’ means a board of directors of a bank or financial service provider as provided in Section 30 of the Banking and Financial Services Act;

‘Business Continuity Management (BCM)’ is the process that identifies potential impacts that threaten an FSP and provides a framework for building resilience and the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value creating activities. (Business Continuity Institute).

‘Chief Executive Officer’ means the person responsible, under the immediate authority of the board of directors, for the conduct of the business of an institution;

‘Credit Risk’ means the risk to earnings or capital that a counterparty, issuer or borrower will not settle an obligation for full value, either when due or at any time thereafter. (Risk Management for Electronic Banking and Electronic Money Activities. Bank for International Settlements. March 1998).

‘Financial Service Provider’ means a commercial bank, financial institution or financial business;

‘Foreign Exchange Risk’ means the risk to earnings or capital arising from the movement in foreign exchange rates. (Bank Supervision Process, Comptroller’s Handbook, Comptroller of the Currency. April 1996).

‘Internal Control’ means a process effected by the institution’s board of directors, management and other personnel designed to provide reasonable assurance regarding the achievement of objectives such as effectiveness and efficiency of operations, reliability of financial reporting and compliance with applicable laws and regulations;

‘Internal Audit’ means an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations and which helps an organization accomplish its objectives by bringing a systematic, disciplined approach to

evaluate and improve the effectiveness of risk management, control, and governance processes;

‘Interest Rate Risk’ means the exposure to earnings or capital resulting from adverse movements in interest rates;

‘Liquidity Risk’ means the risk that an FSP will not settle an obligation for full value without incurring unacceptable losses

‘Market Risk’ means the risk of losses in on- and off-balance sheet positions arising from movements in market prices, including foreign exchange rates refers. (Risk Management for Electronic Banking and Electronic Money Activities. Bank for International Settlements. March 1998)

‘Operational Risk’ means the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. (Core Principles Methodology. Basle Committee on Banking Supervision. October 2006)

‘Reputation Risk’ means the risk of negative public opinion that result in a critical loss of funding or customers (Risk Management for Electronic Banking and Electronic Money Activities. Bank for International Settlements. March 1998)

‘Risk’ means the chance of something occurring that may have an impact on the achievement of the financial service provider’s desired statutory and strategic objectives, measured in terms of the impact of the event and likelihood of its occurrence;

‘Legal Risk’ means the violations of, non-compliance with laws, rules, regulations, or prescribed practices or when the legal rights and obligations of parties to a transaction are not well established.

‘Strategic Risk’ means the risk to earnings or capital arising from adverse business decisions, improper implementation of those decisions. (Bank Supervision Process, Comptroller’s Handbook. Comptroller of the Currency. April 1996).