Bank Risk Management Guidelines (Revised)

Bank Supervision Directorate May 2010
Bank Risk Management Guidelines (Revised)
National Bank of Ethiopia

1. INTRODUCTION
   Risk-taking is an inherent element of banking and, indeed, profits are in part the reward for successful risk taking. In contrary, excessive, poorly managed risk can lead to distresses and failures of banks. Risks are, therefore, warranted when they are understandable, measurable, controllable and within a bank’s capacity to withstand adverse results. Although underdeveloped, the banking system in Ethiopia has witnessed a significant expansion over the past few years. The National Bank of Ethiopia (NBE) believes such growth should be matched to strong risk management practices. As a result, the NBE has revised the risk management framework it issued in 2003 to all banks so as to incorporate latest developments in the area. This revised document, consistent with international standards and best practices, is expected to provide minimum risk management (risk identification, measurement, monitoring and control) standards for all banks operating in the country. It covers the most common and interrelated risks facing banks in the country, namely, credit, liquidity, market and operational risks. The guidelines are thus expected to assist risk-based supervision and contribute towards safety and soundness of the banking system. In order to implement the Guidelines properly, all banks that do not currently have risk management structure shall immediately set up such structure that shall concentrate fully on the risk management functions (see Annex III) preferably reporting directly to the board/its risk management committee for independence. At the outset, the risk manager and his/her team shall be expected to establish comprehensive risk management program. This program, as will be detailed in the document, should at least contain:

• active board and senior management oversight;
• adequate policies, procedures and limits;
• adequate risk monitoring and management information system; and

Bank Supervision Directorate May 2010

• adequate internal control.
  The program shall be acceptable to and approved by the NBE. To this end, all banks shall submit copies and conduct walkthrough presentations of their programs to the Bank. The NBE shall also review the adequacy of implementation of the risk management program of each bank through off-site analysis and on-site examinations. It shall also conduct risk assessment visits to banks, as may be required. Updates to the risk management programs shall also be submitted to the NBE within 15 days from their effective dates. The rest of these guidelines are divided into four sections. Section 2 deals with credit risk management guidelines, while sections 3 through 5 are concerned with liquidity risk management, market risk management, and operational risk management guidelines, respectively.

2. CREDIT RISK MANAGEMENT GUIDELINES
   2.1 Introduction
   Experiences elsewhere in the world suggest that the key risk in a bank has been credit risk. Indeed, failure to collect loans granted to customers has been the major factor behind the collapse of many banks around the world. Banks need to manage credit risk inherent in the entire portfolio as well as the risk in individual credits or transactions. Additionally, banks should be aware that credit risk does not exist in isolation from other risks, but is closely intertwined with those risks. Effective credit risk management is the process of managing an institution’s activities which create credit risk exposures, in a manner that significantly reduces the likelihood that such activities will impact negatively on a bank’s earnings and capital. Credit risk is not confined to a bank’s loan portfolio, but can also exist in its other assets and activities. Likewise, such risk can exist in both a bank’s on-balance sheet and its off-balance sheet accounts.
   2.2 Board and Senior Management Oversight
   2.2.1 Board Responsibilities
   The board of directors is responsible for reviewing and approving a bank’s credit risk strategy and policies. Each bank should develop a strategy that sets the objectives of its credit-granting activities and adopts the necessary policies and procedures for conducting such activities. The board shall:

• approve broad business strategies and policies that govern or influence the management
  of credit risk of the bank;

Bank Supervision Directorate May 2010

• set out the banks’ tolerance for credit risk in the context of types of credits, economic
  sectors, geographical locations, currencies, and maturities 1 ;
• establish goals for credit quality, earnings and growth;
• clearly define credit-related delegation of authority and approval levels;
• ensure that senior management has a full understanding of the credit risk incurred by the
  bank;
• ensure that the bank’s management adopts procedures to ensure that the objectives of
  the strategy and policies are achieved;
• ensure that credit risk is adequately measured, monitored and controlled;
• effectively communicate the strategies and policies to all relevant bank personnel; and
• periodically re-evaluate significant credit risk management policies as well as overall
  business strategies that affect the credit risk exposure of the bank.
  The board of directors shall also be responsible for monitoring compliance with the credit risk management strategy. This is usually accomplished through periodic reporting of management and internal auditors. The reports shall provide sufficient information to satisfy the board of directors that a bank is complying with its credit risk management policies and NBE directives. The board shall review loans in line with NBE directives on provisions. Moreover, the board of directors shall:
• conduct/require independent reviews of credit operations to assess whether the bank’s
  policies and procedures are being properly followed on ongoing basis;
• review exposures and policies regarding credit to related parties as defined by the NBE
  directives;
• review exposures and policies regarding credit to companies controlled by the bank
  through ownership or management structure;
• review all credit exposures that are in excess of the credit approval authority delegated to
  management;
• review all restructured exposures;
• review trends in portfolio quality and the adequacy of the bank’s provision for credit
  losses;
• specify the content and frequency of management reports to the board on credit risk
  management; and
• ensure compliance with all relevant laws, regulations and NBE directives.
  2.2.2 Management Responsibilities
  Senior management has the responsibility for implementing the credit risk strategy approved by the board of directors and for developing policies and procedures for identifying, measuring, monitoring and controlling credit risk. Such policies and procedures should address credit risk in all of the bank’s activities at both the individual credit and portfolio levels. Senior

Types of credit might also include identifying target markets and the overall characteristics the bank seeks in its credit portfolio (including levels of diversification and concentration tolerances).

Bank Supervision Directorate May 2010 management must ensure that there is a periodic independent internal or external assessment of the bank’s credit management functions. Management of each bank shall:

• develop procedures and practices that facilitate the implementation of the broad credit
  risk management strategy and policies adopted by the board;
• undertake the management of credit risk in accordance the delegated authority
  developed by the board;
• develop measures that will facilitate the measurement, monitoring and control of credit
  risk;
• implement a system of internal controls that will serve as an effective check over the
  measures used to manage credit risk;
• ensure that internal audit reviews the credit risk management system on an on-going
  basis;
• monitor the quality of the credit portfolio and ensure that the portfolio is classified in
  line with the NBE Directives on Provisioning, uncollectible exposures written off and loan losses provisions are accounted in line with the NBE requirements;
• ensure that internal audit reviews are conducted on an ongoing basis and assess the
  credit portfolio and credit risk management system;
• develop lines of communication to ensure the timely dissemination of credit risk
  management policies and other credit risk management information to all individuals involved in the process; and
• develop an effective system of reporting to the board on issues related to the
  management of credit risk.

2.3 Policies, Procedures and Limits
2.3.1 Credit Policies
The foundation for effective credit risk management is the identification of existing and potential risks in the bank’s credit products and credit activities. This creates the need for development and implementation of clearly defined policies, formally established in writing, which set out the credit risk philosophy of the bank and the parameters under which credit risk is to be controlled. Measuring the risks attached to each credit activity permits a platform against which the bank can make critical decisions about the nature and scope of the credit activity it is willing to undertake. A cornerstone of safe and sound banking is the design and implementation of written policies and procedures related to identifying, measuring, monitoring and controlling credit risk. Credit policies establish the framework for lending and guide the credit-granting activities of the bank. The policies should be designed and implemented with consideration for internal and external factors such as the bank’s market position, trade area, staff capabilities and technology; and should particularly establish targets for portfolio mix and exposure limits to single counterparties, groups of connected counterparties, industries or economic sectors, geographic regions and specific products. Effective policies and

Bank Supervision Directorate May 2010 procedures enable a bank to: maintain sound credit-granting standards; monitor and control credit risk; properly evaluate new business opportunities; and identify and administer problem credits. Credit policies need to contain, at a minimum:

• a credit risk philosophy2
  governing the extent to which the bank is willing to assume credit risk;
• general areas of credit in which the bank is prepared to engage or is restricted from
  engaging;
• clearly defined and appropriate levels of delegation of approval, and provision or write￾off authorities; and
• sound and prudent portfolio concentration limits.
  The basis for an effective credit risk management process is the identification and analysis of existing and potential risks inherent in any product or activity. Consequently, it is important that banks identify the credit risk inherent in all the products they offer and the activities in which they engage. This is particularly true for those products and activities that are new to the bank where risk may be less obvious and which may require more analysis than traditional credit-granting activities. Although such activities may require tailored procedures and controls, the basic principles of credit risk management will still apply. All new products and activities should receive board approval before being offered by the bank.
  2.3.2 Credit Analysis and Approval Process
  Prior to entering into any new credit relationship, consideration shall be given to the integrity and reputation of the party as well as their legal capacity to assume the liability. Banks need to understand to whom they are granting credit. Therefore, prior to entering into any new credit relationship, a bank shall become familiar with the borrower or counterparty and be confident that they are dealing with an individual or organization of sound repute and creditworthiness. In particular, strict policies shall be in place to avoid association with individuals involved in criminal activities. Establishing sound, well-defined credit-granting criteria is essential to approving credit in a safe and sound manner. In order to conduct an effective credit-granting program, banks shall receive sufficient information to enable a comprehensive assessment of the risk profile of the counterparty. Depending on the type of credit exposure and the nature of the credit relationship with the counterparty, the factors to be considered and documented in credit granting include:
• purpose of the credit and sources of repayment;
• borrower’s repayment history and current capacity to repay, based on historical financial
  trends and future cash flow projections under various scenarios;

The credit risk philosophy is a statement of principles and objectives that outline a bank’s willingness to assume credit risk. It will vary with the nature and complexity of its business, the extent of other risks assumed, its ability to absorb losses and the minimum expected return acceptable for a specific level of risk.

Bank Supervision Directorate May 2010

• terms and conditions of the credit including covenants designed to limit changes in the
  future risk profile of the borrower;
• adequacy and enforceability of collateral or guarantees under various scenarios;
• current risk profile of the counterparty (including the nature and aggregate amounts of
  risk), and sensitivity to economic and market developments, especially for major exposures; and
• borrower’s business expertise and management capability.
  Occasionally, banks may participate in loan syndications or other such loan consortia. In such cases, undue reliance should not be placed on the risk analysis performed by the lead underwriter or external credit assessors. Rather, syndicate participants should perform their own risk analysis prior to committing to the syndication. Such analysis should be conducted in the same manner as directly sourced loans. In order to maintain a sound credit portfolio, a bank must have a clearly established process in place for approving new credits as well as extensions or renewal and refinancing of existing credits. Approvals should be made in accordance with the bank’s written guidelines and granted by the appropriate level of management. There should be a clear audit trail documenting the approval process and identifying the individual(s) and/or committee(s) making the credit decision. Each credit proposal should be subject to careful analysis by a qualified credit analyst with expertise commensurate with the size and complexity of the transaction. An effective evaluation process establishes minimum requirements for the information on which the analysis is to be based as listed above. The information received will be the basis for any internal evaluation or rating assigned to the credit and its accuracy and adequacy is critical to management making appropriate judgments about the acceptability of the credit.
  2.3.3 Authority for Loan Approval
  Banks must develop a corps of credit analysts who have the experience, knowledge and background to exercise prudent judgment in assessing, approving and managing credit. A bank’s credit approval process should establish accountability for decisions taken and designate the individuals who have authority to approve credits or changes in credit terms. Depending upon its size and nature, credit may be approved through individual authority, joint authorities or through a committee. Approval authorities should be commensurate with the expertise of the individuals involved and the delegation of authority should include, as a minimum:
• the absolute and/or incremental credit approval authority being delegated;
• the provision or write –off authority being delegated;
• the officers, positions or committees to whom authority is being delegated;
• the ability of recipients to further delegate risk approval and write-off authority; and
• the restrictions, if any, placed on the use of delegated risk approval and write-off
  authorities.

Bank Supervision Directorate May 2010
The degree of delegation of authority will depend on a number of variables, including:

• the bank’s credit risk philosophy;
• the quality of the credit portfolio;
• the degree of market responsiveness required;
• the types of risks being assessed; and
• the experience of lending officers.
  2.3.4 Related Party Transactions
  A potential area of abuse arises from granting credit to related parties, whether companies or individuals3 . Consequently, it is important that banks grant credit to such parties on an arm’s-length basis and that the amount of credit granted is suitably monitored. Such controls are most easily implemented by requiring that the terms and conditions of such credits not be more favorable than credit granted to non-related borrowers under similar circumstances and by imposing absolute limits on such credits. The bank’s credit-granting criteria should not be altered to accommodate related companies and individuals. Material transactions with related parties should be subject to the prior approval of the board of directors (excluding board members with conflicts of interest), and reported to the banking supervisory authorities.
  2.3.5 Lending to Connected Parties
  Banks should have credit granting procedures in place that identify connected counterparties as a single obligor which means aggregating exposures to groups of counterparties (corporate or non-corporate) that exhibit financial interdependence by way of common ownership, common control, or other connecting links (for example, common Management, familiar ties). Identification of connected counterparties requires a careful analysis of the impact of the above factors (e.g. common ownership and control) on the financial interdependence of the parties involved.
  2.3.6 Credit Limits and Credit Concentration
  To ensure diversification, exposure limits are needed in all areas of the bank’s activities that involve credit risk. Banks should establish credit limits for individual counterparties and groups of connected counterparties that aggregate different types of on and off balance sheet exposures. Such limits are frequently based on internal risk ratings that allow higher exposure limits for counterparties with higher ratings. Under no circumstance can limits established by banks be higher than regulatory limits set by NBE. Limits should also be established for particular industries or economic sectors, geographic regions specific products, a class of security, and group of associated borrowers. Credit Concentration

Related parties can include the bank’s subsidiaries and affiliates, its major (owning 2% and above) shareholders, directors and senior management, and their direct and related interests, as well as any party that the bank exerts control over or that exerts control over the bank.

Bank Supervision Directorate May 2010
Credit concentration can occur when a bank’s portfolio contains a high level of direct or indirect credits to:

• a single counterparty;
• a group of related counter parties;
• an industry;
• a geographical region;
• a type of credit facility (i.e. overdrafts); and
• a class of collateral.
  Excessive concentration renders a bank vulnerable to adverse changes in the area in which the credit is concentrated and to violations of statutory and regulatory limits. Sound and prudent risk management involves the minimization of concentration risk by diversifying the credit portfolio. At a minimum, credit diversification policies should:
• be stated clearly
• include goals for portfolio mix;
• place exposure limits on single counter parties and groups of associated counter parties,
  key industries or economic sectors, geographical regions and new or existing products; and
• be in compliance with NBE statutory and regulatory limits on large exposures.
  In considering potential credits, banks must recognize the necessity of establishing provisions for identified and expected losses in line with the NBE directives on provisions and holding adequate capital to absorb unexpected losses. These considerations should factor into credit-granting decisions as well as the overall portfolio risk management process.
  2.3.7 Credit Risk Mitigation
  A number of techniques are available to banks to assist in the mitigation of credit risk. Collateral and guarantees are the most commonly used. Notwithstanding the use of various mitigation techniques individual credits transactions should be entered into primarily on the strength of the borrower’s repayment capacity. Banks should also be mindful that the value of collateral might well be impaired by the same factors that have led to the diminished recoverability of the credit. Banks should have policies covering the acceptability of various forms of collateral, procedures for the ongoing valuation of such collateral, and a process to ensure that collateral is, and continues to be, enforceable and realizable. With regard to guarantees, banks should evaluate the level of coverage being provided in relation to the credit-quality and legal capacity of the guarantor. Banks should be careful when making assumptions about implied support from third parties including government entities. When engaged in interbank transactions, banks often rely on netting agreements as a means of reducing credit risks. It should be noted, however, that such agreements need to be sound and legally enforceable.

Bank Supervision Directorate May 2010
2.4 Measurement, Monitoring and Control
Failure to establish adequate procedures to effectively monitor and control the credit function within established guidelines has resulted in credit problems for many banks around the world. Compromising credit policies and procedures has been another major cause of credit problems. Accordingly, each bank needs to develop and implement comprehensive procedures and information systems to effectively monitor and control the risks inherent in its credit portfolio. These procedures need to define prudent criteria for identifying and reporting potential problem accounts to ensure that such accounts are identified for more frequent review, followed up with appropriate corrective action, adversely classified where appropriate and that provisions are made where necessary. Categorization of the credit portfolio by credit characteristics, risk rating and regular review of individual and groups of credits within the portfolio and independent internal credit inspections or audits are integral elements of effective and prudent portfolio monitoring and control.
2.4.1 Credit Administration Policies
Credit administration is a critical element in maintaining the safety and soundness of a bank. Once a credit is granted, it is the responsibility of the bank to ensure that the credit is properly maintained. This includes keeping the credit file up to date, obtaining current financial information, sending out renewal notices and preparing various documents such as loan agreements. In larger banks4 , the responsibility for credit administration may be split among different departments, but in smaller banks these responsibilities may be assigned to individuals. Where individuals perform such sensitive functions as custody of key documents, entering credit limits into the computer database etc, they should report to managers who are independent of the business origination and credit approval processes. In some cases where this is practically difficult, banks shall devise ways and means by which related risks shall be minimized. In developing credit administration arrangements, banks should ensure:

• the efficiency and effectiveness of credit administration operations, including monitoring
  of credits, maintenance of adequate documentation, observance of contractual obligations and legal covenants and maintenance of collateral, etc.;
• the accuracy and timeliness of information generated by management information
  systems;
• the effectiveness of the segregation of duties;
• the adequacy of controls over all “back office” procedures; and
• compliance with prescribed management policies and procedures as well as applicable
  laws and regulations.
  2.4.2 Credit Files
  The credit files of a bank should include all the information necessary to ascertain the current financial condition of counterparties as well as sufficient information to track the

The NBE considers banks with total assets greater than Birr 9 billion as large, between Birr 3 billion and Birr 9 billion as mid-size, and less than Birr 3 billion as small.

Bank Supervision Directorate May 2010 decisions made and credit history of borrowers. Each credit file needs at a minimum information that:

• identifies the borrower by name and occupation or type of business, and identifies
  guarantors and connected parties;
• provides evidence of the borrower’s legal ability to borrow, financial condition and the
  ability to repay, including the timing and source of repayment;
• describes the terms of the credit obligation, including the purpose of the credit;
• describes and evaluates the collateral, indicating the marketability and/or condition
  thereof; and
• provides a history of the credit, including copies of the most recent credit authorization
  and internal credit reviews and evidence of the level of approval.
  2.4.3 Credit Monitoring Procedures
  Banks need to develop and implement comprehensive procedures and information systems for monitoring the condition of individual counterparties across the bank’s various portfolios. These procedures should define the criteria for identifying and reporting potential problem credits and other transactions to ensure that they are subject to more frequent monitoring, corrective action, and proper classification/provisioning. An effective credit monitoring system will include measures to:
• ensure that the bank understands the current financial condition of the counterparty;
• monitor actual exposures against established limits;
• monitor compliance with existing covenants;
• assess, where applicable, collateral coverage relative to the obligor’s current condition;
• identify contractual payment delinquencies and classify potential problem credits on a
  timely basis;
• determine if payments are being made from the source that was anticipated at the time
  the credit was approved; and
• direct promptly problems for remedial management.
  Specific individuals should be responsible for monitoring credit quality; including ensuring that relevant information is passed to those responsible for assigning internal risk ratings to the credit. In addition, individuals should be made responsible for monitoring on an ongoing basis any underlying collateral and guarantees. Such monitoring will assist the bank in making necessary changes to contractual arrangements as well as maintaining adequate reserves for credit losses. Banks should develop an adequate framework for managing their exposure in off-balance sheet products as a part of overall credit to an individual customer and subject them to the same credit appraisal, limits and monitoring procedures. Banks should classify their off￾balance sheet exposures into three broad categories:
• full risk (credit substitutes) – e.g. standby letters of credit or money guarantees;

Bank Supervision Directorate May 2010

• medium risk (not direct credit substitutes) – e.g. bid bonds, indemnities and warranties;
  and
• low risk – e.g. cash against document (CAD).
  2.4.4 Internal Risk Rating
  An important tool in monitoring the quality of individual credits, as well as the total portfolio, is the use of an internal risk rating system. A well-structured internal risk rating system is a good means of differentiating the degree of credit risk in the different credit exposures of a bank. This will allow more accurate determination of the overall characteristics of the credit portfolio, problem credits, and the adequacy of loan loss reserves. Detailed and sophisticated internal risk rating systems can also be used to determine internal capital allocation, pricing of credits, and profitability of transactions and relationships.
  2.4.5 Stress Testing
  An important element of sound credit risk management involves discussing what could potentially go wrong with individual credits and within the various credit portfolios, and considering this information in the analysis of the adequacy of capital and provisions. This exercise can reveal previously undetected areas of potential credit risk exposure. The linkages between different categories of risk that are likely to emerge in times of crisis should be fully understood. In case of adverse circumstances, there may be a substantial correlation of various risks. Scenario analysis and stress testing are useful ways of assessing areas of potential problems. Stress testing should involve identifying possible events or future changes in economic conditions that could have unfavorable effects on a bank’s credit exposures and assessing the bank’s ability to withstand such changes. Three areas that banks could usefully examine are:
  (i) local or international economic or industry downturns; (ii) market-risk events; and (iii) liquidity conditions. Stress testing can range from relatively simple alterations in assumptions about one or more financial, structural or economic variables, to the use of highly sophisticated financial models. Whatever the method of stress testing used, the output of the tests should be reviewed periodically by senior management and appropriate action taken in cases where the results exceed agreed tolerances. The output should also be incorporated into the process for assigning and updating policies and limits.
  2.4.6 Managing Problem Loans
  Banks must have a system in place for early remedial action on deteriorating credits, managing problem credits and similar workout situations. One reason for establishing a systematic credit review process is to identify weakened or problem credits. A reduction in credit quality should be recognized at an early stage when there may be more options available for improving the credit. Banks must have disciplined

Bank Supervision Directorate May 2010 and vigorous remedial management process, triggered by specific events, that are administered through the credit administration and problem recognition systems. A bank’s credit risk policies should clearly set out how the bank will manage problem credits. Banks should document how various courses of actions should be applied. These include renewal, and extension of impaired credit facilities. The procedures should clearly set out authority limits within the organization that will have responsibility to make such decisions and how standard credit approval practices will be enhanced in the case of impaired credit.
2.4.7 Management Information System and Measuring Credit Risk
Banks should establish management information systems and analytical techniques that enable management to measure the credit risk inherent in all on- and off-balance sheet activities. The effectiveness of a bank’s risk measurement process is highly dependent on the quality of its management information systems since this information is used by the board and management to fulfill their respective oversight roles. Therefore, the quality, detail and timeliness of information are critical. The information system should provide adequate information on the composition of the credit portfolio, including identification of any concentrations of risk. The measurement of risk should take into consideration:

• the specific nature of the credit (loan, guarantee, etc) as well as its contractual and
  financial conditions (maturity, rate, etc.);
• the exposure to potential market movements;
• the existence of collateral or guarantees; and
• the potential for default based on internal risk rating.
  The analysis of credit risk data should be undertaken at an appropriate frequency with the results reviewed against relevant limits. Banks should use measurement techniques that are appropriate to the complexity and level of the risks involved in their activities, based on robust data, and subject to periodic validation. In particular, information on the composition and quality of the various portfolios, including on a consolidated bank basis, should permit management to assess quickly and accurately the level of credit risk that the bank has incurred through its various activities and determine whether the bank’s performance is within the tolerance limits of the credit risk strategy. It is important that banks have a management information system in place to ensure that exposures approaching risk limits are brought to the attention of senior management. All exposures should be included in a risk limit measurement system. The bank’s information system should be able to aggregate credit exposures to individual borrowers and counterparties and report on exceptions to credit risk limits on a meaningful and timely basis.
  2.5 Internal Controls

Bank Supervision Directorate May 2010
Banks must establish a system of independent, ongoing assessment of their credit risk management processes and the results of such reviews should be communicated directly to the board of directors and senior management. The bank should have an efficient internal review and reporting system as an effective oversight mechanism in respect of its credit function. This system should provide the board of directors and senior management with sufficient information to evaluate the performance of account or relationship officers and the condition of the credit portfolio. Internal credit reviews conducted by individuals independent from the business function provide an important assessment of individual credits and the overall quality of the credit portfolio. Such a credit review function can help evaluate the overall credit administration process, determine the accuracy of internal risk ratings and judge how effectively credits are being monitored. The credit review function should report directly to the board of directors, a board committee with audit responsibilities, or senior management without lending authority (e.g., senior management within the risk control function.) The goal of credit risk management is to maintain a bank’s credit risk exposure within parameters set by the board of directors and senior management. The establishment and enforcement of internal controls, operating limits and other practices will help ensure that credit risk exposures do not exceed levels acceptable to the individual bank. Such a system will enable bank management to monitor adherence to the established credit risk objectives. Internal audits of the credit risk processes should be conducted on a periodic basis. They should be used to confirm that :

• credits have been granted in compliance with the bank’s credit policies and procedures;
• periodic reports on all the exposures are available to senior management and are
  submitted to the board;
• weaknesses in the credit risk management process are identified and reported to the
  board; and
• exceptions to established policies and procedures are reported to the board.

3. LIQUIDITY RISK MANAGEMENT GUIDELINES
   3.1 Introduction

Determining what is adequate liquidity for banking organizations has always been a rather subjective and difficult task, because banks rarely have liquidity problems as long as they are viewed as sound and deposit inflows are positive. Failure to properly manage liquidity can quickly result in significant unanticipated losses. The purpose of liquidity management is to ensure that every bank is able to meet fully its contractual commitments. The ability to fund increases in assets and meet obligations as they come due is critical to the ongoing viability of any bank. Therefore, managing liquidity is among the most important activities conducted by banks.

Bank Supervision Directorate May 2010
Sound liquidity management can reduce the probability of serious problems. Indeed, the importance of liquidity transcends the individual bank, since a liquidity shortfall at a single bank can have system-wide repercussions. For this reason, the analysis of liquidity requires the management of the bank not only to measure the liquidity position of the bank on an ongoing basis, but also to examine how funding requirements are likely to evolve under various scenarios, including adverse conditions. Banks should review frequently the assumptions utilized in managing liquidity to determine that they continue to be valid. Since a bank’s future liquidity position will be affected by factors that cannot always be forecasted with precision, assumptions need to be reviewed frequently to determine their continuing validity. These assumptions should be made under the different categories of assets, liabilities and off-balance sheet activities.

3.2 Board and Senior Management Oversight
The prerequisite of an effective liquidity risk management includes a well-informed board, capable management and staff having relevant expertise, and efficient systems and procedures.
3.2.1 Board Oversight
Primarily, it is the duty of the board of directors to understand the liquidity risk profile of the bank and the tools used to manage liquidity risk. The board has to ensure that the bank has necessary liquidity risk management framework and is capable of confronting uneven liqudity scenarios. The board should approve the strategy and significant policies related to overall management of liquidity. Generally, the board shall:

• approve broad business strategies and policies that govern or influence the management
  of liquidity risk of the bank;
• establish tolerance levels in respect of liquidity risk;
• establish clear levels of delegation within the liquidity management function;
• ensure that senior management has a full understanding of the liquidity risk incurred by
  the bank;
• ensure that the bank’s management adopts procedures to enable the achievement of the
  objectives set out in the strategy and policies;
• ensure that liquidity risk is adequately measured, monitored and controlled effectively
  communicate the strategies and policies to all relevant bank personnel;
• Periodically re-evaluate significant liquidity risk management policies as well as overall
  business strategies that affect the liquidity risk exposure of the bank; and
• Ensures compliance with all relevant laws, regulations and NBE directives.
  3.2.2 Senior Management Oversight
  Senior management is responsible for the day-to-day management of the bank’s liquidity. To ensure that the bank has adequate levels of liquidity to meet its on-going operational needs, including at times when there are unusual demands on liquidity, senior management shall:

Bank Supervision Directorate May 2010

• develop procedures and practices that facilitate the implementation of the broad liquidity
  management strategy and policies adopted by the board;
• undertake the management of liquidity risk in accordance with the delegated authority
  developed by the board;
• develop measures that facilitate the measurement, monitoring and control of liquidity
  risk;
• implement a system of internal controls that serve as an effective check over the
  measures used to manage liquidity risk;
• ensure that internal audit reviews the liquidity risk management system on an on-going
  basis;
• ensure compliance with any relevant NBE directives on the management of liquidity risk
• develop effective contingency plans to provide the bank with liquidity under adverse
  conditions;
• develop lines of communication to ensure the timely dissemination of liquidity
  management policies and other liquidity risk management information to all individuals involved in the process; and
• develop an effective system of reporting to the board on issues related to the
  management of liquidity risk.
  The responsibility for managing the overall liquidity of the bank should be placed with a specific, identified group within the bank, normally in the form of an asset liability committee (ALCO) that comprises senior management and the treasury function. The ALCO is charged with ensuring that the bank has enough financial resources to function in a profitable, sound and sustainable manner. This includes the responsibility to ensure that the banks can fund desired levels of asset growth while meeting all liabilities as they become due and without incurring unreasonable cost in doing so. The NBE requires the board of directors of each bank to constitute an ALCO, which establish broad guidelines on the bank’s tolerance for risk, among others. All proceedings of the committee should be properly recorded.
  3.3 Policies and Procedures
  Banks are expected to create policies and procedures to give effect to the liquidity management strategy developed by the board. The policies and procedures should:
• reflect the tolerance limits for liquidity risk established by the board;
• establish the distribution of responsibilities for the management of the various
  components of liquidity risk with a clear statement of the levels of authority necessary to undertake specific functions;
• clearly establish the duties and responsibilities of the bank’s ALCO; and
• cleary set out a contingency measures that are in place to ensure that the banks shall have
  access to adequate liquidity especially in times of crisis.
  Banks should set and regularly review limits on the size of their liquidity positions over particular time horizons. Institutions should analyze the likely impact of different stress scenarios on their liquidity position and set their limits accordingly. Limits should be appropriate to the size, complexity and financial condition of the bank. Management should

Bank Supervision Directorate May 2010 also define the specific procedures and approvals necessary for exceptions to policies and limits. Limits could be set, for example, on the following:

• cumulative cash flow mismatches (i.e., the cumulative net funding requirement as a
  percentage of total liabilities) over particular period – next day, next five days, next month etc. These mismatches should be calculated by taking a conservative view in all possible events, and should include likely outflows as a result of draw down of commitments etc; and
• liquid assets as a percentage of short-term liabilities. Again, there should be a discount
  to reflect possible stress scenarios due to adverse events. The assets included in this category should only be those that are highly liquid – i.e., only cash, cash equivalent or those judged to have a ready market even in periods of stress. There should be a clear indication of the specific procedures and approvals necessary for exceptions to policies, limits and authorizations. Banks are also expected to comply strictly with National Bank of Ethiopia’s minimum requirements on liquid assets holdings and reserve requirements. Banks should not classify assets that are being used as collateral in any form. (i.e. assets that are pledged as security against advances) as liquid assets.
  3.4 Measuring, Monitoring and Control
  3.4.1 Measurement
  At a very basic level, liquidity measurement involves assessing all of a bank’s cash inflows against its outflows to identify the potential for any net shortfalls going forward. This includes funding requirements for off-balance sheet commitments. A number of techniques can be used for measuring liquidity risk, ranging from simple calculations and static simulations based on current holdings to highly sophisticated modeling techniques. As all banks are affected by changes in the economic climate and market conditions, the monitoring of economic and market trends is key to liquidity risk management. An important aspect of managing liquidity is making assumptions about future funding needs. While certain cash inflows and outflows can be easily calculated or predicted, banks must also make assumptions about future liquidity needs, both in the very short-term and for longer time periods. Cash inflows arise from maturing assets, saleable non-maturing assets, access to deposit liabilities, established credit lines that can be tapped etc. These cash inflows must be matched against cash outflows stemming from decrease in liabilities due and settlement of contingent liabilities. Banks should also have some level of preparedness to meet cash outflows that arise from unexpected events. A maturity ladder is a useful device to compare cash inflows and outflows both on a day-to￾day basis and over a series of specified time periods. The analysis of net funding requirements involves the construction of a maturity ladder and the calculation of a cumulative net excess or deficit of funds at selected maturity dates. A bank’s net funding requirements are determined by analyzing its future cash flows based on assumptions of the

Bank Supervision Directorate May 2010 future behavior of assets, liabilities and off-balance-sheet items, and then calculating the cumulative net excess or shortfall over the time frame for the liquidity assessment. In constructing the maturity ladders, a bank has to allocate each cash inflow or outflow to a given calendar date from a starting point, usually the next day. (A bank must be clear about the clearing and settlement conventions and timeframes it is using to assign cash flows to particular calendar dates). As a preliminary step to constructing the maturity ladder, cash inflows can be ranked by the date on which assets mature. Similarly, cash outflows can be ranked by the date on which liabilities fall due, the earliest date a liability holder could exercise an early repayment option, or the earliest date contingencies can be called. Readily marketable assets may be “slotted in” to the earliest point in the maturity ladder at which they could be liquidated. Banks should consider what discount should be applied to assets which are “slotted in” in this way in order to reflect market risks. Significant interest and other cash flows should also be included. In addition, certain assumptions can be made based on past experiences. The difference between cash inflows and cash outflows in each period, the excess or deficit of funds, becomes a starting-point for a measure of a bank’s future liquidity excess or shortfall at a series of points in time. The relevant time frame for active liquidity management can be quite short, including intra￾day cash flows. In particular, the first days in any liquidity problem are crucial to maintaining stability. The appropriate time frame shall depend on the nature of the bank’s business. Bank’s, which are reliant on short-term funding, shall concentrate primarily on managing their liquidity in the very short term (say the period up to five days). Ideally, these banks should be able to calculate their liquidity position on a day-to-day basis for this period. Other banks (i.e., those that are less dependent on the short term funds might actively manage their net funding requirements over a slightly longer period, perhaps one to three months ahead.
3.4.2 Management Information System
Every bank must have adequate information systems for measuring, monitoring, controlling and reporting on liquidity risk. Reports should be provided on a timely basis to the bank’s board of directors, senior management and other appropriate personnel. A strong management information system (MIS) that is flexible enough to deal with various contingencies that may arise is central to making sound decisions related to liquidity. The MIS should be used to check for compliance with the bank’s established policies, procedures and limits and with National Bank of Ethiopia’s prudential requirements on liquidity. The MIS should also enable management to evaluate the trends in the bank’s aggregate liquidity exposure. Assumptions, if any, should be set out clearly so that management can evaluate the validity and consistency of key assumptions and understand the implications of various stress scenarios.
3.4.3 Contingency Planning
Banks should have contingency plans in place that address the strategy for handling unexpected liquidity problem and include procedures for making up cash flow shortfalls in emergency situations. As banks rely less and less on core deposits as a stable funding source

Bank Supervision Directorate May 2010 and rely more on other sources of funding (such as wholesale funding), the need for contingency plans becomes even more critical. An effective contingency plan should establish a strategy and procedures for accessing funds under adverse circumstances. A contingency plan should consist of several components, most important of which is management coordination. The plan should spell out procedures for ensuring that information flows are timely and uninterrupted so as to provide management with the tools to make an informed decision. A strategy should be adopted for managing the behavior of assets and liabilities so as to minimize the effects of mismatched cash inflows and outflows. An attempt should be made to maintain relationships with liability holders and plans should be made for building back-up liquidity. To the extent possible, these back-up facilities should be quantified and the procedures for accessing those facilities pre-defined. Each bank should periodically review its efforts to establish and maintain relationships with depositors and other liability holders to maintain the diversification of liabilities and aim to ensure its capacity to sell assets. A critical component of managing liquidity is assessing market access and understanding various funding options as well as how much funding they can expect to receive from the market, both under normal and adverse circumstances. Senior management needs to ensure that market access is being actively managed by the appropriate staff within the bank.
3.4.4 Stress Testing
For the purpose of anticipating future problems and their solutions, a bank should subject its liquidity position to stress tests. Evaluation of whether a bank is sufficiently liquid depends to a large extent on the behavior of cash flows under different conditions. Banks should therefore examine their liquidity positions under a number of different scenarios. Under each scenario, a bank should try to account for any significant positive or negative liquidity swings that could occur. These scenarios should take into account factors that are both internal (bank-specific) and external (macro-economic and market-related). While liquidity shall typically be managed under “normal” circumstances, the bank must also be prepared to manage liquidity under adverse circumstances.
3.4.5 Foreign Currency Liquidity Management
When foreign currency is used to fund a portion of domestic currency assets, banks need to analyze the market conditions that could affect access to the foreign currency and understand that foreign currency depositors may seek to withdraw their funding more quickly than domestic counterparties. For that reason, banks’ should assess their ability to access alternative sources for repaying foreign currency liabilities. In countries such as Ethiopia, where the national currency does not have external convertibility, maturity mismatches result in higher liquidity risk, since a bank may have difficulty acquiring the necessary amount of foreign currency in a timely manner. A bank should also have a measurement, monitoring and control system for its liquidity positions in major foreign currencies in which it is active. In addition to assessing its

Bank Supervision Directorate May 2010 aggregate foreign currency liquidity needs and the acceptable mismatch in combination with its domestic currency commitments, the institution should also undertake separate analysis of its strategy for each currency individually. Depending on the analysis undertaken above, a bank should, where appropriate, set and regularly review limits on the size of its cash flow mismatches over particular time horizons for foreign currencies in aggregate and for each significant individual currency in which the bank operates.
3.5 Internal Controls
A bank should have an adequate system of internal controls over its liquidity risk management process. They should promote effective and efficient operations, reliable financial and regulatory reporting and compliance with relevant laws, regulations and prudential norms. A fundamental component of the internal control system involves regular independent reviews and evaluations of the effectiveness of the system and where necessary, ensuring that appropriate revisions or enhancements to internal controls are made. An effective system of internal control for liquidity risk includes:

• adequate processes for identifying and evaluating liquidity risk;
• an environment that promotes strong adherence to established policies and procedures ;
  and
• adequate information systems.
  Periodic reviews should be conducted to determine whether the organization complies with its liquidity risk management policies and procedures. Positions that exceed established limits should receive prompt attention of appropriate management and should be resolved according to the process described in approved policies. Periodic reviews of the liquidity management process should also address any significant changes in the nature of instruments acquired, limits and internal controls that have occurred since the last review. The internal audit function should also periodically review the liquidity management process in order to identify any weaknesses or problems. In turn, these should be addressed by management in a timely and effective manner.

4. MARKET RISK MANAGEMENT GUIDELINES
   Two types of market risk factors that could be considered are:

• interest rate risk; and
• foreign exchange risk.
  The above risks are described further below:

Bank Supervision Directorate May 2010
4.1 Interest Rate Risk Management Guidelines
4.1.1 Introduction
The volume of assets and liabilities carried by banks in Ethiopia that cannot be re-priced easily is increasing overtime thereby exposing banks to interest rate risk. Thus this section deals with interest rate risk identification, measurement, monitoring and control principles developed based on best practices. Interest rate risk arises from movements in interest rates. Exposure to this risk in banking book primarily results from timing differences in the re￾pricing of assets and liabilities, both on- and off-balance sheet. In the scenario of rising interest rate, when liabilities re-price faster than assets, interest spread would fall and hence profitability of the bank would be adversely affected. Accepting this risk is a normal part of banking business and can be an important source of profitability. However, excessive interest rate risk can pose a significant threat to banks' earnings and capital base. Changes in interest rates affect banks' earnings by changing their net interest income and the level of other interest-sensitive income and operating expenses. Changes in interest rates also affect the underlying value of the banks' assets, liabilities and off-balance sheet instruments because the present value of future cash flows (and in some cases, the cash flows themselves) change when interest rates change.
4.1.2 Sources of Interest Rate Risk
Banks encounter interest rate risk in several ways. The primary and most often discussed form of interest rate risk arises from timing differences in the maturity (for fixed rate) and repricing (for floating rate) of bank assets, liabilities and off-balance-sheet positions5 .
4.1.3 Effects of Interest Rate Risk
Changes in interest rates can have adverse effects on both banks' earnings and their economic value. This has given rise to two separate, but complementary, perspectives for assessing a bank's interest rate risk exposure. Earnings Perspective: In the earnings perspective, the focus of analysis is the impact of changes in interest rates on accrual or reported earnings. Variation in earnings is an important focal point for interest rate risk analysis because reduced earnings or outright losses can threaten the financial stability of a

5 Although currently not significant for many banks in Ethiopia, Yield Curve Risk can also expose a bank to interest rate risk. Yield curve risk arises when unanticipated shifts of the yield curve have adverse effects on a bank income or underlying economic value. Another important source of interest rate risk (commonly referred to as basis risk), which is not applicable to Ethiopian banks due to absence of markets, arises from imperfect correlation in the adjustment of the rates earned and paid on different instruments with otherwise similar repricing characteristics. When interest rates change, these differences can give rise to unexpected changes in the cash flows and earnings spread between assets, liabilities and off-balance-sheet instruments of similar maturities or repricing frequencies.

Bank Supervision Directorate May 2010 bank by undermining its capital adequacy and by reducing market confidence. The other is Economic Value Perspective: Variation in interest rates can also affect the economic value of a bank's assets, liabilities and off-balance-sheet positions. Thus, the sensitivity of a bank's economic value to fluctuations in interest rates is a particularly important consideration of shareholders and management alike. Embedded losses: The earnings and economic value perspectives focus on how future changes in interest rates may affect a bank’s financial performance. However, when evaluating the level of interest rate risk it is important that a bank should also consider the impact that past interest rates may have on future performance. .
4.1.4 Board and Senior Management Oversight
The board of directors has the ultimate responsibility for understanding the nature and the level of interest rate risk taken by the bank. At minimum the board should:

• approve broad business strategies and policies that govern or influence the management
  interest rate risk of the bank;

• establish the banks’ tolerance for interest rate risk in its operations;

• establish clear levels of delegation within the interest rate risk management function;

• ensure that senior management has a full understanding of the risks incurred by the
  bank;

• ensure that the bank’s management adopts procedures to enable the achievement of the
  objectives set out in the strategy and policies;

• ensure that interest rate risk is adequately measured, monitored and controlled;

• effectively communicate the strategies and policies to all relevant bank personnel;

• periodically re-evaluate significant interest rate risk management policies as well as
  overall business strategies that affect the interest rate risk exposure of the bank; and

• ensure compliance with all relevant regulations and NBE directives.
  The senior management is responsible for ensuring that the bank has adequate policies and procedures for managing interest rate risk on both a long-term and day-to-day basis and that it maintains clear lines of authority and responsibility for managing and controlling this risk. Management should:

• develop procedures and practices that facilitate the implementation of the broad interest
  rate management strategy and policies adopted by the board; and

• undertake the management of interest rate risk in accordance with the delegated
  authority developed by the board.

• develop measures that shall facilitate the measurement, monitoring and control of
  interest rate risk including standards for valuing positions and measuring performance;

• implement a system of internal controls that shall serve as an effective check over the
  measures used to manage interest rate risk;

• ensure that internal audit reviews the interest rate risk management system on an on￾going basis;

• ensure compliance with any relevant NBE Directive on the management of interest rate
  risk;

Bank Supervision Directorate May 2010

• develop lines of communication to ensure the timely dissemination of interest rate risk
  management policies and other interest rate risk management information to all individuals involved in the process; and
• develop an effective system of reporting to the board on issues related to the
  management of interest rate risk.
  4.1.5 Policies and Procedures
  Banks should have clearly defined policies and procedures for limiting and controlling interest rate risk. These policies should be applied at bank level, as appropriate, to other units of the bank. Such policies and procedures should:
• reflect the tolerance limits for liquidity risk established by the board;
• identify quantitative parameters that define the level of interest rate risk acceptable for
  the bank; where appropriate, such limits should be further specified for certain types of instruments, portfolios and activities and should be reviewed periodically and revised as needed; and
• delineate lines of responsibility and accountability over interest rate risk management
  decisions and should clearly define authorized instruments, hedging strategies and position-taking opportunities. There should be a clear indication of the specific procedures and approvals necessary for exceptions to policies, limits and authorizations. Products and activities that are new to the bank should undergo a careful pre-acquisition review to ensure that the bank understands their interest rate risk characteristics and can incorporate them into its risk management process. Thus prior to introducing a new product, hedging, or position-taking strategy, management should ensure that adequate operational procedures and risk control systems are in place. The board or its appropriate delegated committee should also approve major hedging or risk management initiatives in advance of their implementation. Proposals to undertake new instruments or new strategies should at least contain the following features:
• a description of the relevant product or strategy (including characteristics related to
  interest rates);
• an identification of the resources required to establish sound and effective interest rate
  risk management of the product or activity;
• an analysis of the reasonableness of the proposed activities in relation to the financial
  condition and capital levels; and
• the procedures to be used to measure monitor and control the risks of the proposed
  product or activity.
  4.1.6 Measurement, Monitoring and Control
  In general, but depending on the complexity and range of its activities, a bank should have interest rate risk measurement systems that assess the effects of rate changes on both

Bank Supervision Directorate May 2010 earnings and economic value. These systems should provide meaningful measures of the bank's current levels of interest rate risk exposure and should be capable of identifying any excessive exposures that might arise. Measurement systems should:

• assess all material interest rate risk associated with a bank's assets, liabilities and off￾balance-sheet positions;
• utilize generally accepted financial concepts and risk measurement techniques; and
• have well documented assumptions and parameters.
  4.1.6.1 Measurement Methods
  The following are commonly used measurement techniques for interest rate risk exposure. Depending on the complexity of their business, banks may use one or more of the methods discussed below or may even opt for other acceptable ways of measuring such risk.

a) Gap analysis: The simplest techniques for measuring a bank's interest rate risk exposure begin with a maturity/repricing schedule that distributes interest-sensitive assets, liabilities and off-balance-sheet positions into “time bands” according to their maturity (if fixed rate) or time remaining to their next repricing (if floating rate). These schedules can be used to generate simple indicators of the interest rate risk sensitivity of both earnings and economic value to changing interest rates. When this approach is used to assess the interest rate risk of current earnings, it is typically referred to as gap analysis. The size of the gap for a given time band – that is, assets minus liabilities plus off-balance-sheet exposures that reprice or mature within that time band – gives an indication of the bank's repricing risk exposure. b) Maturity/Repricing: schedule can also be used to evaluate the effects of changing interest rates on a bank's economic value by applying sensitivity weights to each time band. Typically, such weights are based on estimates of the assets and liabilities that fall into each time-band, where duration is a measure of the percent change in the economic value of a position that shall occur given a small change in the level of interest rates. Duration-based weights can be used in combination with a maturity/repricing schedule to provide a rough approximation of the change in a bank's economic value that would occur given a particular set of changes in interest rates. c) Simulation Techniques: Banks may employ more sophisticated interest rate risk measurement systems than those based on simple maturity/repricing schedules such as, simulation techniques which typically involve detailed assessments of the potential effects of changes in interest rates on earnings and economic value by simulating the future path of interest rates and their impact on cash flows. In static simulations, the cash flows arising solely from the current on-and off-balance sheet positions are assessed. In a dynamic simulation approach, the simulation builds in more detailed assumptions about the future course of interest rates and expected changes in a bank's business activity over that time. These more sophisticated techniques allow for dynamic interaction of payments streams and interest rates, and better capture the effect of embedded or explicit options. Regardless of the measurement system, the usefulness of each technique depends on the validity of the underlying assumptions and the accuracy of the basic methodologies used to

Bank Supervision Directorate May 2010 model interest rate risk exposure. In designing interest rate risk measurement systems, banks should ensure that the degree of detail about the nature of their interest-sensitive positions is commensurate with the complexity and risk inherent in those positions. For instance, using gap analysis, the precision of interest rate risk measurement depends in part on the number of time bands into which positions are aggregated. Clearly, aggregation of positions/cash flows into broad time bands implies some loss of precision. In practice, the bank must assess the significance of the potential loss of precision in determining the extent of aggregation and simplification to be built into the measurement approach. When measuring interest rate risk exposure, one further aspect call for more specific comment6 : the treatment of those positions where behavioral maturity differs from contractual maturity. Positions such as savings and time deposits may have contractual maturities or may be open-ended, but in either case, depositors generally have the option to make withdrawals at any time. These factors complicate the measurement of interest rate risk change when interest rates vary.
4.1.6.2 Limits
The goal of interest rate risk management is to maintain a bank's interest rate risk exposure within self-imposed parameters over a range of possible changes in interest rates. A system of interest rate risk limits and risk taking guidelines provides the means for achieving that goal. Such a system should set boundaries for the level of interest rate risk for the bank and where appropriate, should also provide the capability to allocate limits to individual portfolios, activities or business units. Limit systems should also ensure that positions that exceed certain predetermined levels receive prompt management attention. An appropriate limit system should enable management to control interest rate risk exposures, initiate discussion about opportunities and risks and monitor actual risk taking against predetermined risk tolerances. Limits should be consistent with overall approach to measuring interest rate risk. Aggregate interest rate risk limits clearly articulating the amount of interest rate risk acceptable to the bank should be approved by the board of directors and re-evaluated periodically. Such limits should be appropriate to the size, complexity and capital adequacy of the bank as well as its ability to measure and manage risk. Depending on the nature of a bank's activities and its general sophistication, limits can also be identified with individual business unit, portfolios, instrument types or specific instruments. The level of detail of risk limits should reflect the characteristics of the bank's activities including the various sources of interest rate risk to which the bank is exposed.
4.1.6.3 Stress Testing
The risk measurement system should also support a meaningful evaluation of the effect of changes in interest rate that negatively affect the bank’s conditions. Stress testing should be

In principle, one may also add the treatment of positions denominated in different currencies. This, however, is not applicable to Ethiopian banks at present since they are not allowed to borrow or lend in foreign currency.

Bank Supervision Directorate May 2010 designed to provide information on the kinds of conditions under which the bank's strategies or positions would be most vulnerable and thus may be tailored to the risk characteristics of the bank. Possible stress scenarios might include abrupt changes in the general level of interest rates, changes in the volatility of market rates. In addition, stress scenarios should include conditions under which key business assumptions and parameters break down. The stress testing of assumptions used for illiquid instruments and instruments with uncertain contractual maturities is particularly critical to achieving an understanding of the bank's risk profile. In conducting stress tests, special consideration should be given to instruments or markets where concentrations exist as such positions may be more difficult to liquidate or offset in stressful situations. Banks should consider “worst case” scenarios in addition to more probable events. Management and the board of directors should periodically review both the design and the results of such stress tests, and ensure that appropriate contingency plans are in place.
4.1.7 Management Information System
Banks must have adequate information systems for measuring, monitoring, controlling and reporting interest rate exposures. Reports must be provided on a timely basis to the board of directors, senior management and, where appropriate, individual business line managers. An accurate, informative, and timely management information system is essential for managing interest rate risk exposure, both to inform management and to support compliance with board policy. Reporting of risk measures should be regular and should clearly compare current exposure to policy limits. In addition, past forecasts or risk estimates should be compared with actual results to identify any modeling shortcomings. Reports detailing the interest rate risk exposure of the bank should be reviewed by senior management and the board on a regular basis. While the types of reports prepared for the board and for various levels of management shall vary based on the bank's interest rate risk profile, they should, at a minimum include the following:

• summaries of the bank's aggregate exposures;
• reports demonstrating the bank's compliance with policies and limits;
• results of stress tests including those assessing breakdown in key assumptions and
  parameters; and
• summaries of the findings of reviews of interest rate risk policies, procedures, and
  the adequacy of the interest rate risk measurement systems, including any findings of internal and external auditors and consultants.
  4.1.8 Internal Controls
  Banks should have adequate internal controls to ensure the integrity of their interest rate risk management process which (as an integral part of the bank’s overall internal control) promote effective and efficient operations, reliable financial and regulatory reporting, and compliance with National Bank of Ethiopia’s prudential requirements. An effective system of internal control for interest rate risk includes:
• a strong control environment;

Bank Supervision Directorate May 2010

• an adequate process for identifying and evaluating risk;
• the establishment of control activities such as policies, procedures and
  methodologies;
• adequate information systems; and
• continual review of adherence to established policies and procedures.
  With regard to control policies and procedures, attention should be given to appropriate approval processes, exposure limits, reconciliation, reviews and other mechanisms designed to provide a reasonable assurance that the bank's interest rate risk management objectives are achieved. Banks should ensure that all aspects of the internal control system are effective, including those aspects that are not directly part of the risk management process. In addition, an important element of a bank's internal control system over its interest rate risk management process is regular evaluation and review. This includes ensuring that personnel are following established policies and procedures, as well as ensuring that the procedures that were established actually accomplish the intended objectives. The frequency and extent to which a bank should re-evaluate its risk measurement methodologies and models depends, in part, on the particular interest rate risk exposures created by holdings and activities, the pace and nature of interest rate changes, and the pace and complexity of innovation with respect to measuring and managing interest rate risk. Banks, particularly those with complex risk exposures, should have their measurement, monitoring and control functions review on a regular basis by an independent party (such as an internal or external auditor). Such a reviewer should consider the following factors in making the risk assessment:
• the quantity of interest rate risk, e.g.
  o the volume and price sensitivity of various products, and o the vulnerability of earnings, economic value and capital under differing rate changes; and
• the quality of interest rate risk management, e.g.
  o whether the bank’s internal measurement system is appropriate to the nature, scope, and complexities of the bank and its activities, o whether the bank has an independent risk management unit responsible for the design and administration of the risk measurement, monitoring and control functions, o whether the board of directors and senior management is actively involved in the risk control process, o whether internal policies, controls and procedures concerning interest rate risk are well documented and complied with, o whether the assumptions of the risk measurement system are well documented, data accurately processed, and data aggregation is proper and reliable, and o whether the organization has adequate staffing to conduct a sound risk management process.

Bank Supervision Directorate May 2010
Banks should ensure that internal audit reviews and evaluates the interest rate risk management function.
4.2 Foreign Exchange Rate Risk Management
4.2.1 Introduction
Exposure to this risk mainly occurs during a period in which the bank has a foreign currency open position, both on- and off-balance sheet, in spot markets. It is a risk of volatility due to a mismatch, and may cause a bank to experience losses as a result of adverse exchange rate movements during a period in which it has an open on or off-balance sheet position in an individual foreign currency. Movements in exchange rates may adversely affect the value of a bank's foreign currency open positions. Currently, banks are allowed to take open positions in foreign currencies subject to regulatory limits set by the NBE. The potential for loss arises

Bank Supervision Directorate May 2010 from the process of revaluing foreign currency positions in Birr terms. When banks have an open position in a foreign currency (where assets in a currency do not equal liabilities in that currency), the process of revaluation normally shall result in a gain or loss. The gain or loss is the difference between the aggregate change in the Birr equivalent value of assets denominated in the foreign currency and the aggregate change in the value of liabilities and capital denominated in that currency. Whether the bank incurs a gain or a loss depends upon both the direction of the exchange rate change and whether the bank is net long or net short in the foreign currency. When the bank has a net long position in the currency, revaluation shall produce a gain if the value of the currency increases. A loss results if the value of the currency decreases. Conversely, a net short position shall produce a loss if the foreign currency’s value increases. A gain results if it decreases.
4.2.2 Board and Senior Management Oversight
The Board of Directors is ultimately responsible for the bank's exposure to foreign exchange risk and the level of risk assumed. The board should:

• approve broad business strategies and policies that govern or influence the management
  of foreign exchange rate risk of the bank;
• establish tolerance levels in respect of foreign exchange rate risk;
• establish clear levels of delegation within the foreign exchange management function;
• ensure that senior management has a full understanding of the foreign exchange rate risk
  incurred by the bank;
• ensure that the bank has adequate human and physical resources for the management of
  foreign exchange rate risk ;
• establish a proper organizational structure for foreign exchange rate risk management
  function;
• establish clear levels of delegation for issues related to the management of foreign
  exchange rate risk management;
• ensure that the bank’s management adopts procedures to enable the achievement of the
  objectives set out in the strategy and policies;
• ensure that foreign exchange risk is adequately measured, monitored and controlled
• effectively communicate the strategies and policies to all relevant bank personnel; and
• periodically re-evaluate significant risk management policies as well as overall business
  strategies that affect the foreign exchange rate risk exposure of the bank. Senior management is responsible for the day-to-day management of the bank’s exposure to foreign exchange risk. Senior management should:
• develop procedures and practices that facilitate the implementation of the broad foreign
  exchange rate risk management strategy and policies adopted by the board;
• undertake the management of foreign exchange rate risk in accordance with the
  delegated authority developed by the board;

Bank Supervision Directorate May 2010

• develop measures that shall facilitate the measurement, monitoring and control of
  foreign exchange rate risk;
• implement a system of internal controls that shall serve as an effective check over the
  measures used to manage foreign exchange rate risk;
• ensure that internal audit reviews the foreign exchange rate risk management system on
  an on-going basis;
• ensure compliance with any relevant NBE directives on the management of foreign
  exchange rate risk;
• develop lines of communication to ensure the timely dissemination of foreign exchange
  risk management policies and other foreign exchange rate risk management information to all individuals involved in the process; and
• develop an effective system of reporting to the board on issues related to the
  management of foreign exchange rate risk.
  4.2.3 Policies and Procedures
  Banks should have written policies governing activities in foreign currencies. The purpose of these written policies is to communicate the expectations of senior management and the board of directors to the management and staff. The policies should be reviewed and approved by the board of directors. For management and control purposes, banks must make a clear distinction between foreign currency exposure resulting from dealing and trading operations and exposures due to a more traditional banking business involving on and off-balance-sheet exposures denominated in a foreign currency. Currency risk management involving dealing/trading operations must be an information-intensive, day-in/day-out process under close scrutiny by senior management and a risk management committee. In general, policies and procedures should:
• reflect the tolerance limits for foreign exchange risk established by the board;
• determine, within the limitation set by law, the types of foreign exchange products and
  services that the bank shall provide and the intended scope of dealing activity;
• adequately measure, monitor and control foreign exchange risk;
• establish limits to govern various aspects of the management of the foreign exchange
  operations including:
  o net open position limits by currency, and for all currencies combined at the end of the day (overnight limit) and at any time during the day (intra-day limit), using an acceptable aggregation method, o limits on counterparty exposure, and o settlement limits, (both outright and within the context of counterparty exposure limits); and
• establish rules for accounting standards that should be used in revaluing foreign currency
  positions and the frequency with which such revaluations should be undertaken for management and accounting purposes.

Bank Supervision Directorate May 2010
There should be a clear indication of the specific procedures and approvals necessary for exceptions to policies, limits and authorizations. For accounting purposes, revaluations generally should be performed at the time of any required periodic reporting to the National Bank of Ethiopia. For management information purposes, more frequent revaluations should be performed, depending on the size and relevance of the foreign currency positions. Finally, the policies should establish revaluation standards that preclude the deferral of losses on foreign exchange positions for internal reporting purposes.
4.2.3 Measuring Monitoring and Control
The potential loss that an open position might produce should be estimated. To directly estimate loss potential, management determines the size of the loss that would be incurred should the exchange rate moves against the bank's open position. To make this estimate, management makes one or several assumptions about potential adverse exchange rate movements. It computes the loss that would be incurred by revaluing the banks open position at this hypothetical exchange rate. The size of the potential loss produced in this manner is subjected to a limit. The limit might be expressed in terms of the nominal amount of the loss, or in terms of a certain percentage of a benchmark, such as projected earnings or total capital. Normally, management’s principal goal is to provide strong assurance that foreign exchange losses shall not substantively diminish the total earnings of the bank.
4.2.4 Management Information System
Accurate and timely information systems are critical to the management of foreign currency positions, and for ensuring compliance with relevant risk limits. Banks should devote the resources necessary to generating such information. Standardized reports should be designed to communicate the information regarding open foreign exchange positions, liquidity positions and counterparty exposures. Positions and exposures should be prepared and verified by persons not responsible for transacting foreign currency business. At the minimum, reports available should include:

• net overall and intra-day positions by currency;
• maturity distribution by currency of foreign currency assets, liabilities and off-balance
  sheet contracts;
• outstanding contracts by settlement date and currency;
• total value of outstanding contracts, at spot rate;
• profit and loss, totals and comparison to previous day’s;
• market value of off-balance sheet accounts;
• aggregate dealing limits; and
• limit or line excesses.
  .
  4.2.5 Internal Controls

Bank Supervision Directorate May 2010
Banks should implement a system of internal controls to ensure that their arrangements for managing foreign exchange rate risk are working effectively. The system should ensure that the bank’s foreign exchange activities are undertaken within the prescribed risk tolerance limits, and that all established procedures, and practices are being followed. The internal audit function of the bank should review and assess the foreign exchange risk management process. It shall also be necessary for management to establish and implement procedures governing the conduct and practices of foreign exchange traders/dealers. The internal audit should ensure that foreign exchange traders/dealers observe their instructions and the code of behavior required of them and that accounting procedures meet the necessary standards of accuracy, promptness and completeness. The board audit committee can greatly enhance the quality of reports and the reasonableness of foreign exchange risk management information supplied to the board, the management and the NBE.
5. OPERATIONAL RISK MANAGEMENT GUIDELINES
5.1 Introduction
Operational risk includes the exposure to loss resulting from the failure of a manual or automated system to process, produce or analyze transactions in an accurate, timely and secure manner. This risk therefore is imbedded in all of the bank's operations, including those supporting the management of other risks. Managing operational risk is an important feature of sound risk management practice in any bank. The exact approach chosen by an individual bank shall depend on a range of factors, including its size and sophistication and

Bank Supervision Directorate May 2010 the nature and complexity of its activities. The most important types of operational risk involve breakdowns in internal systems and controls and corporate governance. Such breakdowns can often lead to financial losses through error, fraud or inefficiency. Other aspects of operational risk include major failure of information technology systems or events such as natural and other disasters. As banks become more reliant on technology to support various aspects of their operations, the potential failure of a technology based system is of growing concern in the context of the management of operational risk. Operational risk can also give rise to reputational and legal risks as the types of failures outlined above can result in damage to an institution’s reputation and/or legal action by regulators or customers. A computer system’s failure within a bank, for example, can result in damage to its reputation and could also lead to the imposition of fines or other actions by regulators if the failure causes the bank to be in breach of laws or regulations. Thus, for the purpose of these Guidelines, IT, legal, regulatory, strategic, reputational, and systemic risks are all categorized under operational risk
5.2 Board and Senior Management Oversight
5.2.1 The Board
The Board of directors should address operational risk explicitly as a distinct and controllable risk to the bank's safety and soundness. Failure to address operational risk, which is present in virtually all banking transactions and activities, may greatly increase the likelihood that some risks shall go unrecognized and uncontrolled. The board should:

• approve broad business strategies and policies that govern or influence the management
  of operational risk of the bank;
• approve an operational risk strategy and policies;
• establish clear levels of delegation within business units for the effective management of
  operational risk;
• ensure that senior management has a full understanding of the operational risk faced by
  the bank;
• ensure that the bank’s management adopts procedures to enable the achievement of the
  objectives set out in the strategy and policies for the management of operational risk;
• ensure that operational risk is adequately monitored and controlled;
• effectively communicates the strategies and policies to all relevant bank personnel; and
• periodically re-evaluate significant risk management policies as well as overall business
  strategies that affect the operational risk exposure of the bank.
  5.2.3 Senior Management
  Senior management is responsible for the day-to-day management of the bank’s exposure to operational risk. Senior management should:
• develop procedures and practices that facilitate the implementation of the broad
  operational risk management strategy and policies adopted by the board;

Bank Supervision Directorate May 2010

• undertake the management of operational risk in accordance with the delegated authority
  developed by the board;
• develop measures that shall facilitate the measurement, monitoring and control of
  operational risk;
• implement a system of internal controls that shall serve as an effective check over the
  measures used to manage operational risk;
• ensure that internal audit reviews the operational risk management arrangements on an
  on-going basis;
• ensure compliance with any relevant NBE directives on the management of operational
  risk;
• develop lines of communication to ensure the timely dissemination of operational risk
  management policies and other operational risk management information to all individuals involved in the process; and
• develop an effective system of reporting to the board on issues related to the
  management of operational risk.
  The primary responsibility for management of operational risk remains with individual business units. Business area managers are expected to ensure that appropriate operational risk control systems are in place.
  5.3 Policies and Procedures
  Management must translate the operational risk management strategy established by the board of directors into policies, processes and procedures that can be implemented and verified. In general, policies and procedures should:
• reflect the general philosophy in respect of operational risk as established by the board.
• adequately measure, monitor and control operational risk;
• establish clear responsibilities and levels of authority among management staff and
  business units for the management of operational risk;
• ensure that the measures adopted for the management of operational risk are appropriate
  in light of the nature of the banks products, services and operational culture and practices; and
• establish effective business continuity plans to ensure a quick an effective resumption of
  business following a disruption of service or activities All banks should also have policies, processes and procedures to control or mitigate operational risk. Banks should assess the costs and benefits of alternative risk limitation and control strategies and should adjust their operational risk exposure using appropriate strategies, in light of their overall risk profile. If necessary, new arrangements should be created to assist in the identification, measurement, monitoring and control of operational risk. In addition, there should be a formal new product review process involving business, risk management and internal control functions. There should be a clear indication of the specific procedures and approvals necessary for exceptions to policies, limits and authorizations.

Bank Supervision Directorate May 2010
5.4 Measurement Monitoring and Control
Risk identification is critical for the subsequent development of viable operational risk measurement, monitoring and control. Effective risk identification considers both internal factors (such as the complexity of the bank's structure, the nature of the bank's activities, the quality of personnel, organizational changes and employee turnover) and external factors (such as fluctuating economic conditions, changes in the industry and technological advances) that could adversely impact on the bank’s earnings and capital. Measuring operational risk requires both estimating the probability of an operational loss event and the potential size of the loss. Banks should engage in tracking operational risk data. Such information is fundamental to measuring, monitoring, and controlling operational risk exposure. For any reliable measurement system, data would need to be collected in order to develop general measures of operational risk. For the data collected to be useful, the breadth, history and integrity of the data have to be commensurate with the bank's operational risk profile and approach to managing risk. To measure operational risk, banks need to identify the underlying operational risk drivers or factors. The approach of identification generally followed is to decompose operational risk into those risks that are closely related to internal processes, people and systems and those that are more related to the external environment. 5.5Monitoring All banks should implement a system to monitor, on an on-going basis, operational risk exposures and loss events by major business lines. Banks should monitor operational losses directly, and should analysis each occurrence and a description of the nature and causes of loss provided to senior managers and the board of directors. Ongoing monitoring activities offer the advantage of quickly detecting and correcting deficiencies in the policies, processes and procedures for managing operational risk. The frequency of monitoring should reflect the risks involved and the frequency and nature of changes in the operating environment. Monitoring is most effective when the system of internal control is integrated into the bank's operations and produces regular reports. The results of these monitoring activities should be included in management and board reports, as should compliance reviews performed by internal or external audit. A good management information system should be able to capture and report operational risk.
5.6 Internal Controls
In mitigating or reducing operational risk, the value of internal controls is very critical. Internal controls should be seen as the major tool for managing operational risk. The controls cited include the full range of control activities such as segregation of duties, clear management reporting lines and adequate operating procedures. In most cases, operational risk events are associated with internal control weaknesses or lack of compliance with existing internal control procedures.

Bank Supervision Directorate May 2010
Control activities should be designed and implemented to address the risks that the bank has identified. Control processes and procedures should be established and all banks should have a system in place for ensuring compliance with documented set of internal policies concerning the risk management system. Principal elements of this should include:

• top-level reviews of the bank's progress towards the stated objectives;
• checking for compliance with management controls;
• policies, processes and procedures concerning the review, treatment and resolution of
  non- compliance issues; and
• a system of documented approvals and authorizations to ensure accountability to an
  appropriate level of management.
  To be effective, control activities should be an integral part of the regular activities of the bank and should involve all levels of personnel in the bank, including both senior management and business unit personnel. Controls that are an integral part of the regular activities enable quick responses to changing conditions and avoid unnecessary costs. An effective internal control system requires that there be appropriate segregation of duties and that personnel in the bank are not assigned responsibilities which may create a conflict of interest. Assigning such conflicting duties to individuals or a team may enable them to conceal losses, errors or inappropriate actions. Therefore areas of potential conflicts of interest should be identified, minimized and subject to careful independent monitoring and review. Activities of internal auditors also form an important element of operational risk management. In ensuring good internal controls, internal auditors would need to be proactive in dealing with the bank's operational weaknesses. In particular, the identification of potential problems, the independent validation of business management’s self￾assessments and the tracking of problem situation and the progress towards resolving the problems should form major functions of the internal audit. An important role is also ascribed to external auditors, whose duties include reviewing the internal controls, operating procedures and systems, management information systems of the bank and preparing management letters that, among others, disclose deficiencies in internal control systems. External auditors should perform an assessment of operational risk to ensure that this risk is managed in a consistent way across the bank.
  ANNEX I: DEFINITIONS
  Credit risk is the potential that a bank borrower or counterparty will fail to meet its obligations in accordance with agreed terms. Liquidity risk is the risk that a bank cannot meet payment obligations in a timely and cost￾effective manner.

Bank Supervision Directorate May 2010
Market risk is the potential that changes in the market rates/process may have an adverse impact on the bank’s financial condition. In other words, it is the risk that the bank’s earnings or capital position will be affected by fluctuations in interest rate and foreign exchange rate. Interest rate risk refers to volatility in net interest income and the economic value of a bank’s assets, liabilities, and capital and off-balance sheet financial instruments. Foreign exchange risk results from changes in exchange rate between Birr (Ethiopia’s domestic currency) and currencies of the rest of the world. Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. IT risk arises from any potential adverse outcome, impairment, loss, violation, failure or disruption in the performance of business functions or processes due to the use of or reliance on technology. Exposure to this risk can result from among others, systems flaws, software defects and network vulnerabilities. Legal risk is the risk arising from the potential that unenforceable contracts, lawsuits, or adverse judgments can disrupt or otherwise negatively affect bank’s operations or conditions. Regulatory risk is the risk of being downgraded, fined, suspended, license revoked, etc arising from failure to comply with regulatory requirements or directives. Strategic risk refers to the potential negative impact on a bank’s earnings and capital that can arise in circumstances where decisions taken by the organization or the manner in which business strategies are executed result in losses or missed opportunities for the organization to remain relevant in the marketplace as a profitable and viable business entity. Reputational risk arises from negative publicity, be it true or not, regarding a bank’s business practices. Systemic risk refers to the danger that problems in a single financial institution might spread and, in extreme situations, such contagion could disrupt the normal functioning of the entire financial system.
ANNEX II: COMPREHENSIVE RISK MANAGEMENT PROGRAM
There is no single risk management system that would fit for all banks. Consequently, the NBE requires each bank to develop its own comprehensive risk management system tailored to its needs and circumstances. This risk management system, however, should at least cover the most common risks, indicated in these Guidelines. Moreover, each risk management system should include the following:

Bank Supervision Directorate May 2010

3.1 Risk Identification: In order to manage risks, risks must first be identified. Almost
every product and service offered by banks has a unique risk profile composed of multiple risks. For example, at least four types of risks are usually present in most loans: credit risk, interest rate risk, liquidity risk and operational risk. Risk identification should be a continuing process and risk should be understood at both the transaction and portfolio levels.
3.2 Risk Measurement: Once the risks associated with a particular activity have been
identified, the next step is to measure the significance of each risk. Each risk should be viewed in terms of its three dimensions: size, duration and probability of adverse occurrences. Accurate and timely measurement of risk is essential to effective risk management systems.
3.3 Risk Control: Following risk identification and measurement banks should control or
minimize risks. There are basically three ways to control significant risks, or at least minimize their adverse consequences: avoiding or placing limits on certain activities/risks, mitigating risks and/or offsetting risks. It is a primary management function to balance expected rewards against risks and the expenses associated with controlling risks. Banks should establish and communicate risk control mechanisms through policies, standards and procedures that define responsibility and authority.
3.4 Risk Monitoring: Banks need to establish a management information system (MIS)
that accurately identifies and measures risks at the inception of transactions and activities. It is equally important for management to establish an MIS to monitor significant changes in risk profiles. In general, monitoring risks means developing reporting systems that identify adverse changes in the risk profiles of significant products, services and activities and monitoring changes in controls that have been put in place to minimize adverse consequences.
ANNEX III: BASIC ELEMENTS OF A SOUND RISK MANAGEMENT SYSTEM
Sound risk management system of each bank should at least contain the following elements:
3.1 Board and Senior Management Oversight
3.1.1 Board Oversight
Boards of directors have ultimate responsibility for the level of risk taken by their banks.

Bank Supervision Directorate May 2010
Accordingly, they should approve the overall business strategies and significant policies of their organizations, including those related to managing and taking risks and should ensure that senior management is fully capable of managing the activities that their banks conduct. All members of board of directors are responsible for understanding the nature of the risks significant to their organizations and for ensuring that the management is taking the steps necessary to identify, measure, monitor and control these risks. The level of technical knowledge required of directors may vary depending on the particular circumstances at the bank. Consequently, what is most important is for directors to have a clear understanding of the types of risks to which their banks are exposed and to receive regular reports that identify the size and significance of the risks in terms that are meaningful to them. Directors should take steps to develop an appropriate understanding of the risks their banks face, possibly through briefings from auditors and experts. Using this knowledge and information, directors should provide clear guidance regarding the level of exposures acceptable to their banks and have the responsibility to ensure that senior management implements the procedures and controls necessary to comply with adopted policies.
3.1.2 Senior Management Oversight
Senior management is responsible for implementing strategies in a manner that limits risks associated the bank’s activities. Management should therefore be fully involved in the activities of their banks and possess sufficient knowledge of all major business lines to ensure that appropriate policies, controls and risk monitoring systems are in place and that accountability and lines of authority are clearly delineated. Senior management is also responsible for establishing and communicating a strong awareness of and need for effective internal controls and high ethical standards. Meeting these responsibilities requires senior managers of a bank to demonstrate a thorough understanding of developments in the financial sector and a detailed knowledge of the activities their bank conducts, including the nature of the internal controls necessary to limit the related risks.
3.2 Policies and Procedures
The board of directors and senior management should tailor their risk management policies and procedures to the types of risks that arise from the activities of the bank. Once the risks are properly identified, the bank’s policies and procedures should provide detailed guidance for the day-to-day implementation of broad business strategies and should include limits designed to shield the bank from excessive and imprudent risks. While all banks should have policies and procedures that address their significant activities and risks, the coverage and level of detail embodied in these documents shall vary among banks. Management is expected to ensure that policies and procedures address material areas of risk to a bank and that they are modified when necessary to respond to significant changes in the activities or business conditions of the bank.
3.3 Measurement, Monitoring and Control
Effective risk monitoring requires banks to identify and measure all material risk exposures. Consequently, risk-monitoring activities must be supported by information systems that provide senior managers and directors with timely and accurate reports on the financial condition, operating performance and risk exposure of the bank on consolidated basis.

Bank Supervision Directorate May 2010
The sophistication of risk monitoring and MIS should be consistent with the complexity and diversity of the bank’s operations. Every bank must have a set of management and board reports to support risk measuring and monitoring activities. These reports may include balance sheets and income statements, a watch list for potentially troubled loans, a report of overdue loans, simple interest rate risk report and other relevant reports. Banks are expected to have risk monitoring and management information systems in place that provide directors and senior management with a clear understanding of the banks’ risk exposures.
3.4 Internal Controls
A bank’s internal control structure is critical to the safe and sound functioning of the bank, in general and to its risk management, in particular. Establishing and maintaining an effective system of controls, including the enforcement of official lines of authority and the appropriate separation of duties is one of management’s more important responsibilities. Indeed, appropriately segregating duties is a fundamental and essential element of a sound risk management and internal control system. Failure to implement and maintain an adequate separation of duties can constitute an unsafe and unsound practice and possibly lead to serious losses or otherwise compromise the financial integrity of the bank. Serious lapses or deficiencies in internal controls including inadequate segregation of duties may warrant supervisory action, including formal enforcement action. When properly structured, a system of internal controls promotes effective operations and reliable financial and regulatory reporting, safeguards assets and helps to ensure compliance with relevant laws, regulations and institutional policies. Given the importance of appropriate internal controls to banks, the results of audits or reviews, conducted by an internal auditor or other persons, should be adequately documented, as should include management’s responses to them. In addition, communication channels should exist that allow findings to be reported directly to the board’s Audit Committee.
3.5 The Risk Manager
The primary responsibility of understanding the risks run by a bank and ensuring that the risks are appropriately managed should clearly be vested with the board of directors. The board should set limits by assessing the bank’s risk and risk-bearing capacity. At the organizational level, overall risk management should be assigned to an independent Risk Manager that preferably reports directly to the board risk management committee. The Risk Manager must be sufficiently independent of the business lines in order to ensure an adequate separation of duties and the avoidance of conflicts of interest. The Risk Manager takes full responsibility for evaluating the overall risks faced by the bank and determining the level of risks that shall be in the best interest of the bank. The functions of the Risk Manager should essentially be to identify, measure, monitor and control the risks undertaken by the bank. The risk management function provides independent oversight of the management of risks inherent in banks. The risk manager should be a member of the management team (but not part of internal audit). He/she should not detract line managers from the primary responsibilities of managing risk in their respective business units. In general, the risk manager shall ensure that effective processes are in place for:

Bank Supervision Directorate May 2010

• identifying current and emerging risks;
• developing risk assessment and measurement systems;
• establishing policies, practices and other control mechanisms to manage risks;
• developing risk tolerance limits for senior management and board approval;
• monitoring positions against approved risk tolerance limits; and
• reporting results of risk monitoring to senior management and board.
  . In broad terms, the risk manager shall:
• ensure that all risks assumed by the bank (old or emerging) are identified, measured
  (where possible), transferred (e.g. by insurance), avoided, and/or controlled/mitigated (e.g. by a limit structure). These risks include business risks, such as credit, which are an inherent part of banking, and non-business risks (e.g. operational risk) which is incidental to business in banks;
• ensure that responsibility for day-to-day risk management is handled by a relevant
  manager (e.g. the credit manager), whose remit is clear and comprehensive; the risk manager will assign responsibility (liaising as appropriate with the chief executive officer) for any risks that are not being covered by the existing organizational structure;
• identify any risks which transcend organizational boundaries and ensure effective liaison
  and coordination is in place. Business resumption plans are an example of this;
• identify and put in place measures for dealing with risks in one area which shalll have an
  impact on other parts of the bank. For example, term lending by credit and marketing in a bank funded by short-term deposits will have interest rate and liquidity management impacts on the treasury function;
• ensure that all new business initiatives area subject to comprehensive risk assessment
  before roll out;
• provide technical support to and be member of key risk committees, such as ALCO.
  He/she shall also attend meetings of the credit committee and any other committee that there may be;
• collate the aggregate risk position of the bank from various line functions and focus on
  high risk areas for corrective action by responsible risk owners; and
• report to the risk management committee of the board.
  There must be no combination with internal audit, which has to remain separate with its own reporting line to the audit committee of the board.
  3.6 Contingency Planning
  Notwithstanding all the efforts that may be made to identify, measure, monitor and control risk, it is always possible that an event or events may occur that were not contemplated at the time a risk management framework was developed. Contingency planning is therefore an essential component of effective risk management. The process starts with the assumption that an unexpected event can occur at any time and as banks develop their various risk management systems, they are expected to give due consideration to the occurrence of such an unexpected event. Effective contingency planning requires banks to have arrangements in

Bank Supervision Directorate May 2010 place that shall allow them to recover as soon as possible after the occurrence of an event and be in a position to resume acceptable levels of service. Achieving these objectives shall minimize the impact that the event shall have on the bank’s earnings, capital and reputation. Contingency planning is relevant to all of the risk covered in these guidelines but is most important in the context of the management of liquidity and operation al risk.
ANNEX IV: OFF-BALANCE SHEET RISKS
4.1 Introduction
As part of their operations, banks get involved in originating financial contracts that may result in the acquisition of assets and liabilities at some future date, under certain conditions. Generally accepted accounting principles do not consider these contracts in themselves to be assets or liabilities and therefore do not recognise them on the face of the balance sheet but rather off balance sheet. Off Balance sheet items are diverse in nature and purpose and may include letters of credit (L/C), unused loan commitments, guarantees, acceptances and performance bonds. The most common off balance sheet instruments are defined below;
4.2 Letters of Credit (L/Cs)
An L/C is defined broadly as a letter addressed by a bank on behalf of a buyer of merchandise to a seller, authorising him/her to draw drafts up to a stipulated amount under specified terms and undertaking conditionally or unconditionally to provide payments for drafts drawn. Letters of credit are the most widely used instrument to finance foreign exchange transactions. The risk common in L/C activity stems from breach of contract terms or obligations by the concerned parties and can take the form of operational risk. The common types of letters of credit are the commercial documentary LC and the standby LC.
4.2.1 Commercial documentary Letter of Credit
This is commonly used to finance a commercial contract for the shipment of goods from seller to buyer. A commercial documentary LC is a letter addressed by a bank (issuing bank) on behalf of its customer, a buyer of merchandise, to a seller (beneficiary) authorising the seller to draw drafts up to a stipulated amount under specific terms and undertaking to provide eventual payment for drafts drawn. Commercial L/Cs are issued in either irrevocable or revocable form. An irrevocable LC cannot be changed without the agreement of all parties. A revocable LC on the other hand, can be cancelled or amended by the issuing bank anytime without notice or agreement of the beneficiary.
4.2.2 Standby Letter of credit
A standby LC guarantees payment to the beneficiary by the issuing bank in the event of default or non-performance by the buyer (bank’s customer). A standby LC could also cover

Bank Supervision Directorate May 2010 performance of a construction contract, serve as an assurance to a bank that the seller shall honour his obligations. A standby LC typically is unsecured and is payable against a simple statement of default or non-performance.
4.3 Guarantees, Acceptances and Performance Bonds
An undertaking by a bank (the guarantor) to stand behind the current obligations of a third party and to carry out these obligations should the third party fail to do so guarantees, acceptances and performance bonds are regarded as direct credit substitutes with credit risk equivalent to that of a loan.
4.4 Undrawn Loan/Overdraft Facilities
An unconditional commitment to lend when the borrower makes a request under the facility. This category includes commitments for which the bank has already charged a commitment fee or other consideration or otherwise has a legally binding commitment. Unused credit facilities involve credit and liquidity risks unless there is evidence to show that the unused commitment shall never be drawn. However, the bank retains absolute discretion to withdraw the commitment in case of credit deterioration.
4.5 Inherent Risks in Off-Balance Sheet Business
Off-Balance sheet business to banks means exposure to several risks. The bank must have basic understanding of the risks associated with off-balance sheet business which, in principle, are not different from on-balance sheet business and should in fact be regarded as an integral part of the bank's overall risk profile. The major risks associated with off balance sheet business are summarized below:
4.5.1 Foreign Exchange Risk
Off balance sheet activities can either reduce or increase exposure to exchange rate changes. In managing foreign exchange risk, banks must constantly monitor their foreign exchange positions whether arising from off or on balance sheet business.
4.5.2 Interest Rate Risk
Off balance sheet activities have an impact on interest rate risk exposure entered into as a hedge against on balance sheet interest rate exposure. Furthermore, some individual transactions may be undertaken to increase net interest rate exposures. In such cases, this may lead to an increase in interest rate as well as credit risk. Interest rate risk measurement and control calls for banks to perform sensitivity analyses so that management can estimate the effect of a given change in interest rates.
4.5.3 Liquidity Risk
Risk that a bank shall not be able to obtain the necessary funds to meet its obligations as they fall due e.g., maturing deposits, drawings under approved facilities. The bank may therefore be unable to obtain funds from the market at competitive rates which may convey

Bank Supervision Directorate May 2010 wrong signals that the bank is facing serious problems.
4.5.4 Credit risk
Risk that one or more counterparties might fail to perform on- of off-balance sheet obligation e.g., guarantees, non-cash covered L/Cs.
4.5.5 Operational risk
Risk that inadequate information systems or operational controls e.g., accounting, funds transfer and financial controls shall lead to breaches, fraud or unforeseen catastrophe that shall negatively affect the bank.
4.6 Risk Management for Off-Balance Sheet Business
Banks run the risk of losses arising from failure to apply adequate control mechanisms regarding off balance sheet items. The main objective is to ensure that bank's management is controlling the above risks through:
4.6.1 Correct policies and procedures
Banks should have formal written policies on proper internal controls e.g., stating goals and strategies, setting limits at various levels, dual control, segregation of duties, separation of function and sanctioning of exposure limits as well as audit, risk control and MIS. Because credit exposures vary in line with foreign exchange and interest rate movements, it is necessary to regularly revalue the exposures.
4.6.2 Well defined limits
Banks should set working limits e.g., exposure limits, approval limits and should ensure that they are being followed. Compliance to statutory and regulatory requirements of the National Bank of Ethiopia should be monitored as well.
4.6.3 Adequate MIS
Banks should have proper information and accounting systems to enable checking and reconciliation procedures to be carried out on a routine basis for early detection of potential loss.
ANNEX V: FUNCTIONAL RISK MATRIX
5.1 Introduction
A bank's business activities present various combination and concentrations of credit, liquidity, interest rate, foreign exchange and operational risks depending on the nature and scope of the particular activity. The preparation of a Functional Risk Matrix helps identify the complex interdependencies of financial risks. A sample Functional Risk Matrix is presented at the end of this section.

Bank Supervision Directorate May 2010
5.2 Functional Areas
The most common functional areas in a banks business are:

• Lending Operations
• Treasury Activities (asset/liability management)
• Investment Operations
• Retail Banking Activities
• Payments Systems
• Management Information Systems
  The above functional areas are derived from key business activities. However, these areas may further be broken down into major product lines of banks. Banks need to draw-up a list of their own functional areas depending on the structure of their balance sheets, off-balance sheet items and major income sources. In addition, management’s strategic plans, new products and other new or expanding business activities have to be considered.
  5.3 Type and Level of Inherent Risk in Functional Areas
  After the functional areas and preferably, the product lines therein, are identified, the type and level of risk inherent in those activities and products should be described. Banks should ensure that all relevant types of risk in each functional area are appropriately captured. For example, lending operations shall normally expose a bank to credit risk and to such other risks as liquidity and interest rate. Functional Risk Matrix The table below is an example of Functional Risk Matrix:
  Functional Area/Product I N H E R E N T R I S K S Lines Credit Liquidity Interest Rate Foreign Exchang e Operation al Other s 1 Lending Operations
• Commercial loans
• Mortgage loans
• Agricultural loans
• Consumer loans
  √
  √
  √
  √
  √
  √
  √
  √
  √
  √
  √
  √
  √
  √
  √
  √
  2 Treasury Activities √ √ √
  3 Investment Operations √ √ √
  4 Retail Banking √ √ √
  5 Payments Systems √ √ √

Bank Supervision Directorate May 2010
6 MIS √
7 Other Areas
8 Other Products

MAIN REFERENCES
1 Basel Committee on Banking Supervision

• Principles for the Management of Credit Risk (September 2000)
• Sound Practices for Managing Liquidity in Banking Organizations
  (February 2000)
• Principles for the Management and Supervision of Interest Rate Risk (January

• Sound Practices for the Management and Supervision of Operational Risk
  (December 2001)
  2 World Bank’s Bank Supervision Guidelines
• Foreign Exchange Management
• Credit Portfolio Evaluation
  3 Canadian Deposit Insurance Corporation (CDIC) Standards of Sound Business and Financial Practices 4 Office of the Comptroller’s Handbook (USA) 5 Federal Reserve System’s Commercial Bank Examination Manual 6 Australian Prudential Regulatory Authority
• Risk Management Systems in Banks
  7 Guidelines Reserve Bank of India Risk Management Systems in Banks (October 1999)

8. Hennie Van Greuning.Sonja Brajovic Bratanovic Analyzing Banking Risk
   (November 1999)