Consultation on Revised SPM Modules CR-S-5, RR-1, and SR-1

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation This module should be read in conjunction with the Introduction and with the Glossary, which contains an explanation of abbreviations and other terms used in this Manual. If reading on-line, click on blue underlined headings to activate hyperlinks to the relevant module. ————————— Purpose To set out the approach which the HKMA will adopt in the supervision of AIs’ strategic risk, and to provide guidance to AIs on the key elements of effective strategic risk management Classification A non-statutory guideline issued by the MA as a guidance note Previous guidelines superseded SR-1 “Strategic Risk Management” (V.1) dated 12.12.07This is a new guideline Application To all AIs Structure

1. Introduction
   1.1 Terminology
   1.2 Background
   1.3 Scope
   1.4 Related legal provisions
   1.5 Implementation
2. Supervisory approach to strategic risk
   2.1 Supervisory objectives
   2.2 Supervisory process
   2.3 Supervisory assessment
   2.4 Application to local banking groups

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation
2.5 Application to foreign bank branches and subsidiaries of banks
incorporated outside Hong Kong
3. Strategic risk management framework
3.1 Overview
3.2 Key components
4. Strategic risk management structure
4.1 Overview
4.2 Role of Board and senior management
4.3 Role of functional departments
4.4 Role of strategic risk management function
5. Strategic risk management process
5.1 Overview
5.2 Strategic planning
5.3 Alignment and change management
5.4 Implementation and monitoring
5.5 Performance evaluation and feedback
6. Other supporting processes
6.1 Planning and management of capital and funding needs
6.2 Management information systems
6.3 Stress-testing and contingency strategies
6.4 Human resources management and development
6.5 Independent reviews and audits
Annex A: Common causes of strategic failure
Annex B: Strategic risk profile – summary of major characteristics by risk
category

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation

1. Introduction
   1.1 Terminology
   1.1.1 This subsection sets out the meanings of strategic risk and other
   related terms used in this module.
   1.1.2 “Strategic risk” means the risk of current or prospective impact
   on an AI’s earnings, liquidity, capital, reputation or standing arising from changes in the environment the AI operates in and from adverse strategic decisions, improper implementation of decisions, or lack of responsiveness to industry, economic or technological changes. It is a function of –

• the compatibility of an AI’s strategic goals;
• the strategies developed to achieve those goals;
• the resources deployed to meet those goals; and
• the quality of implementation.
  The resources needed to implement an AI’s strategies are both tangible and intangible. They include capital and funding, communication channels, staffing and operating systems, delivery networks, and managerial resources and capabilities.
  1.1.3 “Strategic risk management framework” means collectively the
  systems, processes and controls adopted by an AI to identify, assess, monitor, control and report strategic risk.
  1.1.4 “Strategic goal” means a general statement of purpose or a short,
  medium or long term goal set by an AI in line with its corporate mission and values, with a view to achieving desired outcomes in relation to growth, efficiency, survival and control of the environment1 .
  1.1.5 “Strategic objective” means a specific, measurable and time
  assigned objective or target derived from an AI’s strategic goal(s). This includes responsiveness to environmental changes, effective resources management and securing a strong competitive position in the market.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation
1.1.6 “Strategic plan” means a comprehensive plan formulated by an
AI in its strategic planning process. The plan sets out, among other things, the strategies to be implemented by the AI, the manner of implementing those strategies, and the desired outcomes expected of such implementation.
1.1.7 “Strategy” means the approach, method or course of action that
can be taken by an AI to achieve a particular strategic goal or objective. There are typically three levels of strategy (i.e. corporate, business, and operational) that may be employed, the characteristics of which are explained as follows:

• a corporate strategy is concerned with an AI’s overall
  purpose and development, and relates to how the AI’s strategic intent or vision could be achieved. For example, an AI may decide to attain targeted growth through strategic alliances, mergers and acquisitions;
• a business strategy is usually concerned with how an AI can
  gain competitive business advantage, which products or services the AI should offer to customers, or which markets the AI should operate in. This level of strategy relates more to the affairs of particular business units (e.g. development of retail banking business in Chinese Mainland China) than to the AI as a whole; and
• an operational strategy is developed to support or facilitate
  the implementation of corporate and business strategies. Examples include strategies for enhancing organisational efficiency, IT infrastructure and human resources management. Any reference to the term “strategy” in this module embodies the three levels of strategy described above.
  1.1.8 “Strategic decision” means an AI’s decision to implement a
  specific strategy.
  1.2 Background
  1.2.1 An AI’s ability to manage strategic risk is crucial to its survival
  and long range development. Strategic risk management is

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation primarily concerned with how an AI relates itself to the environment it operates in, and the choices it makes in response to changes in the environment and on the deployment of capital and resources in ways that create competitive advantage for the AI as a whole. As strategic decisions affect the future, an inevitable amount of risk and uncertainty is involved. Inadequate strategic planning or improper implementation of strategies may expose AIs to significant business and financial losses, and may also have a knock-on effect on their reputation and market standing.
1.2.2 Moreover, the driving force behind many banking crises
appeared to be a change in the institutional or external environment coupled with a choice of unsuitable strategies by banks. For example, a bank which is facing keen competition may be induced to run greater risks than it can endure to preserve its profitability. The potential dangers of a shift towards higher “risk-return” couplings may not materialise immediately if the business conditions remain favourable. If the economy turns bad, the adverse consequences for such banks are greatly increased, thereby severely affecting their financial conditions and performance.
1.2.3 Many strategic problems could also be directly related to
management and staff issues within an organisation. These may result from the lack of good succession plans for senior management and other key managerial positions, insufficient operational and staff support for new initiatives, inadequate inhouse technical expertise to carry out highly specialised projects, or staff resistance to cultural changes (e.g. changes in working habits, skills and proficiency standards, and traditional beliefs and expectations). If all such issues or changes cannot be successfully managed, they may significantly undermine the effective implementation of strategies.
1.2.4 The HKMA therefore considers it important for AIs to put in place
an effective process for managing strategic risk. This is consistent with Principle 7 15 of the revised “Core Principles for Effective Banking Supervision” issued by the Basel Committee in April 2024 whereby banks are expected to have a

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation comprehensive risk management policies and processes in respect of all material risks (including strategic risk).2
1.2.5 Annex A illustrates some common causes of strategic failure for
AIs’ reference. AIs are expected to bear those examples in mind when structuring their strategic risk management framework.
1.3 Scope
1.3.1 The HKMA recognises that strategic risk is one of those risks for
which no (or only rudimentary) quantification methods exist, and various techniques or tools for managing strategic risk are still evolving. Hence, this module does not attempt to introduce or mandate any specific methodology or technique for measuring or controlling strategic risk. Rather, the guidance provided in this module mainly –

• draws upon the HKMA’s past experiences in supervising
  strategic risk and elaborates on the approach taken;
• sets out risk management practices that AIs are
  recommended to follow; and
• promotes the adoption by AIs of a formalised and structured
  approach to managing strategic risk.
  1.3.2 This module could be read in conjunction with the following
  modules which contain risk management standards that are relevant to strategic risk:
• CG-1 “Corporate Governance of Locally Incorporated
  Authorized Institutions”;
• IC-1 ”General Risk Management Framework Controls”;
• SA-1 “Risk-based Supervisory Approach”;
• IC-5 “Stress-testing”; and
  The relevant information is contained in the Basel Committee paper on “Core Principles Methodology” updated in October 2006.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation

• CA-G-5 “Supervisory Review Process”.
  1.3.3 The HKMA will continue to monitor international developments
  on strategic risk management practices. This module may therefore be subject to revision and additional guidance, as internationally accepted standards and practices on strategic risk management emerge over time.
  1.4 Related legal provisions
  1.4.1 While this module does not have the force of law, the adequacy
  of an AI’s strategic risk management framework has a bearing on the HKMA’s assessment of the AI’s ongoing compliance with the following authorization criteria:
• Para. 10 of the Seventh Schedule to the Banking Ordinance
  requiring AIs to maintain adequate accounting systems and systems of control. These are essential for ensuring the prudent and efficient running of the business, safeguarding the assets of the AI, minimising the risk of fraud, monitoring the risks to which the AI is exposed and complying with legislative and regulatory requirements; and
• Para. 12 of the Seventh Schedule to the Banking Ordinance
  requiring AIs to conduct their business with integrity, prudence and professional competence and in a manner which is not detrimental to the interests of depositors or potential depositors. In assessing compliance with this criterion, the HKMA will take account of, among other considerations, strategic risk issues such as the AI’s general strategy and objectives and its ability to plan ahead as well as its track record, including its ability to deal with external shocks and unexpected contingencies.
  1.4.2 In implementing strategic decisions, AIs should be aware of
  various legal requirements applicable to them under the Banking Ordinance. For example, locally incorporated AIs are required to obtain the MA’s prior approval in the following cases:
• establishment of local branches under §44 (also applicable
  to overseas incorporated AIs incorporated outside Hong Kong);

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation

• establishment of overseas branches and overseas
  representative offices under §49;
• establishment of overseas banking subsidiaries under §51A
  (see CG-4 “Establishment of Overseas Banking Subsidiaries: §51(A)” for more details);
• making any major acquisition and investment under Part 3
  of the Banking (Exposure Limits) Rules (BELR) §87A (see CR-L-5 “Major Acquisitions and Investments: §87ABELR
  Part 3” for more details); and
• becoming a controller of any AI under §70.
  1.4.3 AIs wishing to carry on certain regulated activities specified
  under the Securities and Futures Ordinance should ensure that they comply with all relevant requirements under that Ordinance (e.g. applying to the SFC for becoming a registered institution under section 119) and the Banking Ordinance (e.g. appointing not less than two executive officers under §71D and obtaining the MA’s consent for such officers under §71C). See SB-1 “Supervision of regulated activities of SFC-registered authorized institutions” for more details.
  1.4.4 AIs would also be expected to consult with the HKMA on any
  plans to implement strategies (including major changes to existing strategies) which may have significant effects on their business operations, financial conditions (including capital adequacy) and risk profile, notwithstanding that there may be no statutory requirement to do so. Examples of such cases include undertaking a major expansion of an already highly concentrated property lending portfolio and conducting new lines of business or activities of higher risk in which the AI concerned has no prior experience or expertise.
  1.5 Implementation
  1.5.1 AIs are expected to develop their strategic risk management
  framework consistent with the guidance laid down in this module, and ensure that such a framework is commensurate with the nature, size and complexity of their business and is appropriate for their individual circumstances and needs.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation
1.5.2 Recognising, however, that enhancing an AI’s strategic risk
management capabilities is an ongoing process, the HKMA would not expect every existing AI to be meeting all risk management practices recommended in this module immediately after the module is issued. Nevertheless, they are expected to identify areas where such practices should be applied to their strategic risk management framework, and make steady progress towards applying them within a reasonable timeframe. The HKMA will monitor their progress in enhancing such framework and take into account the progress achieved in determining its supervisory priorities.
1.5.23 Where AIs have adopted a strategic risk management
framework that may not fully align with those recommended practices, they should provide adequate justifications for the approach taken and be able to demonstrate to the HKMA’s satisfaction that alternative measures are in place to control or mitigate strategic risk.
2. Supervisory approach to strategic risk
2.1 Supervisory objectives
2.1.1 Strategic risk is one of the eight inherent risks 3 which the HKMA
has identified as risks to be assessed under its risk-based supervisory process (see SA-1 Risk-based Supervisory Approach” for more details). AIs are required to establish a sound and effective system to manage each of these risks.
2.1.2 The main objectives of the HKMA’s risk-based supervisory
approach in respect of strategic risk are to assess –

• the level and trend of AIs’ strategic risk;
• the adequacy and effectiveness of their strategic risk
  management framework; and
• their strategic risk profile.
  The other seven inherent risks are credit, market, interest rate, liquidity, operational, reputation and legal risks.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation
2.1.3 In the case of locally incorporated AIs, the adequacy of their
capital relative to the level of their strategic risk and the soundness of their strategic risk management framework will also be assessed as part of the SRP (see CA-G-5 “Supervisory Review Process” for more details).
2.1.4 Results of the HKMA’s assessment under paras. 2.1.2 and 2.1.3,
together with the assessment results for other inherent risks, will be used for determining the overall risk profile and supervisory priorities of AIs and, in the case of locally incorporated AIs, their minimum CAR.
2.2 Supervisory process
2.2.1 Under its risk-based supervisory approach, the HKMA exercises
continuous supervision of AIs’ strategic risk through a combination of risk-focused on-site examinations, off-site reviews and prudential meetings.
2.2.2 The HKMA monitors the strategic risk profile of AIs (including
changes in their level and direction of strategic risk) during offsite reviews and prudential meetings, and evaluates the effectiveness of their strategic risk management framework during on-site examinations. In the case of locally incorporated AIs, the HKMA will additionally assess how strategic risk is being dealt with under their corporate governance structure and capital adequacy assessment process, as part of the SRP.
2.2.3 In evaluating AIs’ strategic risk management framework, the
HKMA will adopt a system-based approach that puts the main focus on the systems, processes and controls established by AIs. To facilitate its assessment, the HKMA will obtain relevant information from AIs which may include, but is not limited to, the following:

• management guidelines and written procedures on
  strategic risk management (including planning and budgeting procedures);

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation

• current strategic / business plans 4 and other associated
  implementation plans;
• composition of Board or executive management
  committees and other risk control units responsible for strategic planning and management (including, where applicable, their terms of reference, reporting lines and authorities, and frequency of meetings);
• minutes of Board or committee meetings and discussion
  papers with regard to strategic planning and management;
• performance evaluation reports (actual versus plan);
• results of any independent review or audit relating to
  strategic risk management; and
• other management reports submitted to the Board and
  senior management to facilitate strategic risk management.
  2.2.4 The HKMA will also hold periodic discussions with AIs’ Board and
  senior management (e.g. during annual Board or prudential meetings) to gain insight into their strategic planning and management processes, including –
• latest strategies, business direction and outlook, and plans
  for change in activities or management processes;
• reasons for performance variances; and
• comments on any strategic risk issues or risk management
  weaknesses identified.
  2.2.5 The HKMA will adopt a proportionate approach when applying
  the risk management guidance set out in this module to AIs of varying size and complexity. For example, AIs with small, simple operations will not be expected to have a strategic risk management process as elaborate as those with more complex operations. Nevertheless, they should, at a minimum, be able to Where necessary, the HKMA may agree with individual AIs the manner in which such plans will be reviewed. For example, in cases where the full strategic plan is compiled by the head office of an foreign-owned AI incorporated outside Hong Kong covering other group operations, the AI may present or provide extracts of those parts of the plan relevant to the local operation to the HKMA.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation demonstrate that their strategic risk management process covers the key elements set out in para. 5.1.1, although the procedures and documentation involved can be much more simplified.
2.2.6 If deficiencies are found in an AI’s strategic risk management
framework, the HKMA will enter into discussions with the AI and seek prompt remedial action. Depending on the circumstances of each case, the HKMA may require the AI to take specific actions to mitigate particular concerns (e.g. in respect of an investment or strategy that has gone into problems).
2.2.7 Under §59(2) of the Banking Ordinance, the MA has the power
to require an AI, after consultation with the AI, to provide an auditors’ report on such matters as he may specify for the performance of his functions under the Ordinance. The MA may exercise this power to commission an auditors’ report, for example, when he considers that an independent review of the AI’s strategic risk management framework is warranted.
2.3 Supervisory assessment
2.3.1 This subsection describes the key factors that will be considered
by the HKMA in assessing –

• the level and trend of AIs’ strategic risk;
• the adequacy and effectiveness of their strategic risk
  management framework; and
• their strategic risk profile.
  2.3.2 The HKMA will use a combination of techniques, such as
  qualitative analysis, peer group comparison and supervisory judgement, in its assessment of strategic risk. Level and trend of AIs’ strategic risk
  2.3.3 The HKMA will have regard to the following factors in assessing
  the level and trend of an AI’s strategic risk:
• Compatibility or suitability of the AI’s strategic goals and
  objectives – the HKMA will consider whether –

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation

• the AI’s strategic goals and objectives are compatible
  with its corporate mission and values, culture, business direction and risk tolerance;
• the AI’s financial objectives are consistent with its
  strategic goals; and
• the AI’s strategic decisions are generally prudent
  relative to its size and complexity;
• Responsiveness to changes in the environment – the
  HKMA will assess whether the AI’s strategic decisions are indicative of its responsiveness to changes in the environment (including those developments resulting in technological, economic, competitive or regulatory changes). This assessment will include the timeliness of making such decisions;
• Adequacy of resources in carrying out strategic decisions –
  the HKMA will review whether the AI has adequate resources (both tangible and intangible) for implementing its strategic decisions, including its potential or capability to enter into new markets, businesses, products or services. Such resources relate to capital and funding, staffing and operating systems, communication channels, delivery networks, and managerial resources and capabilities;
• Implementation of strategic decisions – the HKMA will
  determine whether the AI has a successful track record in implementing strategic decisions based on its past performance in respect of –
• offering new products and services;
• shifting of business focuses or re-focusing of business
  initiatives;
• conducting strategic investments, forming joint ventures
  or implementing merger and acquisition plans; and
• meeting business targets for major business units and
  operations (including overseas non-local branches, banking subsidiaries and associates);

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation

• Impact of strategic decisions – the HKMA will consider if
  there has been any strategic decision, or external pressure arising from such decision, that has severely affected the AI’s reputation or financial position or that could not be reversed without significant cost or difficulty. In addition, the HKMA will review if there are any risk mitigating factors that will help reduce the overall impact of adverse market conditions. For example, the AI’s business may be fairly diversified by product, geography and customer demographics; and
• any other warning signals of high potential strategic risk
  specific to the AI concerned.
  2.3.4 The HKMA will adopt a forward-looking approach and take into
  account any significant changes (either arising from institutional or external conditions) in the past year that may affect the direction of an AI’s strategic risk in the coming year (i.e. whether the level of strategic risk is “increasing”, “stable” or “decreasing”). The strategic performance of the AI and its peers will also be compared. Strategic risk management framework
  2.3.5 In assessing the adequacy and effectiveness of an AI’s strategic
  risk management framework, the HKMA will have regard to the following factors:
• the appropriateness of the framework relative to the AI’s
  nature, size and complexity of business;
• the overall effectiveness of the framework, taking into
  account the extent to which the AI has adopted the risk management practices recommended in this module, or other comparable practices that serve similar purposes;
• the appropriateness of the AI’s strategic risk management
  structure (see section 4 for more guidance), including –
• the level of oversight exercised by the Board and senior
  management, and their knowledge and expertise, in strategic planning and management; and

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation

• the level of support provided by the strategic risk
  management function, whether as a standalone or integrated function, and other functional departments;
• the effectiveness of the AI’s strategic risk management
  process (see section 5 for more guidance), including whether –
• there is a sound strategic planning process for
  formulating the AI’s strategic goals and objectives, which should be consistent with its corporate mission and values and stated risk tolerance, and for translating those goals and objectives into a well structured strategic plan for delivery and measurement of desired outcomes;
• the personnel, technology, funding and capital
  resources allocated, and the priority assigned, to the implementation of strategies are compatible;
• the methods of communicating, implementing,
  monitoring and modifying strategies are effective;
• there is a performance evaluation and feedback
  mechanism that checks on the success of strategies implemented and provides recommendations for improvement and further development;
• the effectiveness of other processes for supporting the AI’s
  strategic planning and management (see section 6 for more guidance), including –
• the planning and management of capital and funding
  needs for implementing strategic decisions;
• the availability of management information systems
  (“MIS”) to facilitate environmental analyses and reporting to the Board and senior management on strategic risk issues;
• the use of stress tests, where appropriate, to identify any
  threats posed to the strategic plan in a timely manner;

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation

• the maintenance of policies and procedures for human
  resources management and development to support the AI’s strategic needs; and
• the conduct of independent reviews and audits, where
  necessary, to ensure overall integrity of the strategic risk management process. Strategic risk profile
  2.3.6 Based on the above assessment results, the HKMA will decide
  upon an AI’s strategic risk profile (categorised as “low”, “moderate” or “high”). See Annex B for a summary of major characteristics under each of these risk categories.
  2.3.7 Where necessary, the HKMA will discuss with the AI concerned
  the assessment results on strategic risk, and any issues or concerns arising therefrom.
  2.4 Application to local banking groups
  2.4.1 The HKMA normally expects a local banking group5
  to apply its strategic risk management framework on a group basis, i.e. covering its subsidiaries and overseas non-local branches, and will assess such framework at the group level.
  2.4.2 If, however, any of the subsidiary AIs within a local banking group
  is operating independently with a standalone strategic risk management framework, the HKMA will assess the framework of that AI separately. Under these circumstances, the parent AI needs to demonstrate to the HKMA’s satisfaction that the group has in place adequate controls to monitor the subsidiary AI’s strategic planning and management processes and to ensure that the AI’s strategies are formulated and implemented in line with the group’s strategic goals and objectives. The parent AI also needs to demonstrate what significant impact the subsidiary AI’s activities may have on the group’s operations and financial This refers to a banking group in which the bank holding company is a locally incorporated AI.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation position if such activities are not covered in the group’s strategic plan.
2.5 Application to foreign bank branches and subsidiaries of banks
incorporated outside Hong Kong
2.5.1 In the case of AIs which are branches or subsidiaries of a foreign
bank incorporated outside Hong Kong, the HKMA will not require them to establish and maintain a standalone strategic risk management framework in Hong Kong if all or some of the relevant systems, processes and controls (e.g. strategic planning or conduct of stress tests for strategic risk management purposes) are centrally managed by their group or regional offices.
2.5.2 These AIs should, however, be able to explain and demonstrate
to the HKMA’s satisfaction how their group’s strategic risk management framework is applied to cover their activities (having regard to local strategic issues and environmental conditions), and how such framework is conducted in accordance with risk management practices adopted by their head office or parent bank.
2.5.3 These AIs should also have the primary responsibility of
providing the HKMA with any information, documentation and evidence that the HKMA may require for ascertaining that the relevant systems, processes and controls are acceptable to the HKMA. For example, the HKMA may require a branch or subsidiary AI to provide an independent review or audit report on the integrity of the strategic risk management framework, or any part of the framework, as it relates to the AI.
2.5.4 If the above-mentioned criteria cannot be met, the HKMA will
consider requiring the AI concerned to establish and maintain its own strategic risk management framework in Hong Kong or taking any other appropriate supervisory measures.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation
3. Strategic risk management framework
3.1 Overview
3.1.1 Every AI is expected to develop an appropriate framework for
managing strategic risk, regardless of its size or complexity. The HKMA recognises that there is no single framework which would suit every AI. As such, AIs should focus on developing a strategic risk management framework that fits their risk profile and level of sophistication, and ensure that their strategic risk is consistently and comprehensively identified, assessed, monitored, controlled and reported.
3.1.2 The HKMA does not intend to prescribe the manner in which a
strategic risk management framework should be structured. Therefore, the strategic risk management framework set out in sections 3 to 6 of this module mainly serves to illustrate the key elements of strategic risk management that the HKMA expects to see in such a framework, and provide relevant risk management guidance to AIs. AIs are not precluded from adopting alternative approaches if they can justify that such approaches fulfil similar purposes.
3.2 Key components
3.2.1 An appropriate strategic risk management framework is
expected to have the following components:

• a strategic risk management structure that assigns
  responsibilities to various organisational functions to enable AIs to achieve their strategic goals and objectives while managing the risks involved within an acceptable level;
• a strategic risk management process that includes the
  following key elements:
• strategic planning to enable AIs to more effectively
  anticipate and adapt to change and allow them to be more proactive in shaping their own future;

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation

• alignment and change management, where necessary,
  to ensure that (i) internal resources and processes can cater for changes arising from implementation of new strategies, (ii) relevant individuals responsible for implementation acquire the necessary skills, and (iii) a culture of acceptance of change is present for implementing strategic changes;
• implementation and monitoring to facilitate AIs in
  effectively implementing their strategies and monitoring the progress of implementation;
• performance evaluation and feedback to facilitate AIs in
  taking prompt actions to address deviations of actual results from desired outcomes and provide recommendations for improvement and further development; and
• other supporting processes, including stress-testing,
  planning and management of capital and funding needs, MIS, human resources management and development, and independent reviews and audits.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation
3.2.2 Diagram 1 below provides a graphical presentation of the
components described above.
Diagram 1 : Strategic risk management framework
4. Strategic risk management structure
4.1 Overview
4.1.1 Strategic risk management involves various organisational functions
within an AI, including –

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation

• the Board and senior management overseeing the proper
  set-up and effective functioning of the strategic risk management framework;
• the functional departments (i.e. departments which carry
  out business or operational functions) assisting the Board and senior management in formulating and implementing strategies, and in providing input to the strategic planning and management processes; and
• the strategic risk management function supporting the
  Board and senior management in managing strategic risk and other related processes. Their respective role and responsibilities in strategic risk management are broadly described in this section.
  4.1.2 It is open to AIs how they precisely define their strategic risk
  management structure. Nevertheless, the above-mentioned functions should be present and kept separate, and those charged with specific responsibilities in relation to strategic risk should clearly understand their responsibilities, authority levels and accountability under the strategic risk management framework.
  4.2 Role of Board and senior management
  General
  4.2.1 The ultimate responsibility for managing strategic risk rests with
  the Board. Senior management, on the other hand, is responsible for effective implementation of the strategic risk management framework developed in accordance with the Board’s criteria and standards.
  4.2.2 To adequately discharge their overall responsibility for strategic
  risk, the Board and senior management of an AI are expected to –

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation

• understand the AI’s current and prospective business and
  operating activities and their significance, as well as the AI’s corporate culture, risk profile, financial conditions, systems and controls, and availability of resources (whether tangible or intangible);
• be capable of analysing the AI’s strengths and weaknesses
  and the impact of environmental changes (including key institutional and external factors) on the AI and its ability to develop successful strategies, as well as identifying opportunities and threats for the AI;
• comprehend the potential risks posed to the AI by each
  approved strategy, particularly in respect of those involving expansion through strategic alliances, mergers and acquisitions, or entry into new markets or business activities; and
• be alert to any strategic issues, recognise their strategic
  importance and, where necessary, take prompt actions (e.g. shift strategic focus or modify strategic decisions) to address those issues. Specific responsibilities of the Board
  4.2.3 The Board has specific responsibilities for overseeing an AI’s
  strategic risk management process. These include –
• ensuring that the AI has in place an appropriate strategic
  risk management framework which suits its own circumstances and needs;
• ensuring that the AI’s strategic goals and objectives are set
  in line with its corporate mission and values, culture, business direction and risk tolerance;
• approving the AI’s strategic plan (including strategies
  contained therein) and any subsequent changes, and reviewing the plan (at least annually) to ensure its appropriateness;
• ensuring that the AI’s organisation structure, culture,
  infrastructure, financial means, managerial resources and

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation capabilities, as well as systems and controls are appropriate and adequate to support the implementation of its strategies;

• reviewing high-level reports periodically submitted to the
  Board on the AI’s overall strategic risk profile, and ensuring that any material risks and strategic implications identified from those reports are properly addressed; and
• ensuring that senior management is competent in
  implementing strategic decisions approved by the Board, and supervising such performance on a continuing basis.
  4.2.4 Where appropriate, the Board may consider delegating other
  responsibilities relating to the actual implementation of strategic decisions (e.g. approving and reviewing business and implementation plans) to specialised committees under the Board or other designated management committees. However, the authorities and responsibilities delegated should be clearly defined. Written terms of reference of each delegated committee should also be maintained and updated appropriately. The Board should be conscious that it remains ultimately responsible for those committees’ decisions. Therefore, the Board should establish adequate controls to monitor their performance and to ensure that its directives are properly followed. Specific responsibilities of senior management
  4.2.5 In ensuring effective strategic risk management within an AI,
  senior management should, among other things –
• establish and implement the AI’s strategic risk management
  framework based on criteria and standards set by the Board;
• assist the Board in developing strategies to meet the AI’s
  strategic goals and objectives;
• formulate the AI’s strategic plan and related implementation
  plans (such as business, development and operating plans);
• ensure adequate implementation of the AI’s strategic plan,
  as approved by the Board, through –
• allocation of appropriate resources to undertake all
  required functions and tasks;

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation

• recruitment, training and retention of staff with
  necessary knowledge and skills to meet the AI’s needs;
• clear assignment of authorities and responsibilities to
  appropriate staff with the necessary experience and capabilities;
• proper alignment of internal resources and processes,
  where necessary;
• effective management of changes (such as
  organisational and cultural changes) in case of need;
• ensuring that staff at all levels fully understand their
  individual roles and responsibilities in implementing the plan;
• implement an effective performance evaluation system
  through –
• defining measures for evaluating performance in
  implementing the AI’s strategic plan;
• evaluating and monitoring such performance regularly;
• taking corrective actions when performance is found to
  deviate from desired outcomes;
• conducting performance reviews for further
  enhancement and development; and
• ensure that any strategic issues and material risks arising
  from environmental changes or implementation of the AI’s strategies are reported to the Board on a timely basis.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation
4.3 Role of functional departments
4.3.1 Management of all functional departments6 of an AI involved in
strategic planning and management processes are expected to –

• assist the Board and senior management in formulating
  strategies with regard to areas under their responsibility, and ensure that the strategies for their departmental activities conform to the AI’s strategic goals and objectives;
• ensure that the risk management practices and controls
  within their department are consistent with the AI’s overall strategic risk management framework and that departmental policies, processes, procedures and staff resources are in place to support the framework;
• monitor departmental performance against desired
  outcomes and recommend actions to improve performance, where necessary; and
• report promptly to senior management any potential issues
  or problems identified to have strategic implications for the AI.
  4.4 Role of strategic risk management function
  4.4.1 The strategic risk management function has the key
  responsibility of supporting the Board and senior management in managing an AI’s strategic risk and facilitating change processes that contribute to the AI’s organisational development and continuous improvement.
  4.4.2 The strategic risk management function is expected to be
  particularly involved in the following aspects of an AI’s strategic risk management framework:
  Depending on the nature of strategies to be implemented, these functional departments may include non￾business departments such as IT, human resources and finance. For example, an operational strategy regarding institution-wide IT development / enhancement plans will involve the IT department.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation

• coordinating among functional departments development of
  the strategic plan, including conducting environmental / strategic analyses and formulating strategies for meeting the AI’s strategic goals and objectives;
• identifying, assessing and reporting potential risks posed to
  the AI by its strategies (e.g. expansion into new markets, products or services) and conducting stress tests for strategic planning and risk management purposes as an independent risk control;
• monitoring and evaluating the progress of implementing the
  AI’s strategic plan, conducting independent performance reviews and reporting the progress and review results to the Board and senior management directly;
• ensuring that any issues and implications that may affect
  the successful achievement of the AI’s strategic goals and objectives are addressed in a timely manner;
• assisting senior management and functional departments in
  managing changes (e.g. relating to organisation structure, culture, technology, systems and people) that may need to be made in order to implement the AI’s strategies, and ensuring effective communication of such changes within the AI;
• providing advice and support on opportunities and options
  that may be pursued for the AI’s organisational development and continuous improvement; and
• consolidating reporting to the Board and senior
  management on strategic risk issues.
  4.4.3 Recognising that AIs operate in different ways and may define
  their strategic risk management structure differently, the HKMA does not propose to prescribe the manner in which the strategic risk management function should be structured. Nevertheless, like other independent risk management functions, the strategic risk management function will be more effective if its duties are clearly segregated from AIs’ risk-taking functions. This function may be standalone, centralised or integrated with other risk management or supporting functions (e.g. financial planning and

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation control), depending on how it fits into an AI’s existing management structure and the nature and complexity of its operations. In the case of an AI with small, simple operations, it may be acceptable for such function to be simply taken up by designated staff provided that they have the capability to perform the function and do not assume any incompatible duties (e.g. front-line risk-taking activities).
4.4.4 Where an AI is a branch or subsidiary of a foreign bank
incorporated outside Hong Kong, it is possible that the strategic risk management function is centralised at the head office or group level. To ensure that this centralised function can work effectively and efficiently, the AI should have dedicated staff to provide local support and input to the centralised function and to assist local management in understanding and managing strategic risk.
5. Strategic risk management process
5.1 Overview
5.1.1 An effective strategic management process should include four
key elements:

• strategic planning;
• alignment and change management;
• implementation and monitoring; and
• performance evaluation and feedback.
  5.2 Strategic planning
  General
  5.2.1 Strategic planning is the process whereby AIs determine the
  overall direction and focus of their organisation, establish medium and long term priorities in line with their corporate mission and goals, and translate those priorities into appropriate strategies for achieving stated goals and objectives. This process culminates in the development of a strategic plan and

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation goes beyond, but may be integrated with, AIs’ annual financial planning and budgeting exercise7 .
5.2.2 Strategic planning provides a process for AIs to identify and
assess potential risks posed by their strategic plan, and consider whether they have adequate capacity to withstand the risks. It also facilitates AIs in responding timely to any adverse changes in circumstances (whether internal or external) that may undermine the achievement of their plan or affect their future development.
5.2.3 A strategic planning process has three basic elements:

• a process to set an AI’s strategic goals and objectives;
• a process to evaluate the AI’s strategic position and
  develop appropriate strategies; and
• a process to translate those strategies into a strategic plan.
  Setting of strategic goals and objectives
  5.2.4 In setting strategic goals and objectives, AIs should be guided
  by their corporate mission8 which outlines the broad directions that the AI is to follow, and reflects the vision and values upheld by the AI.
  5.2.5 Strategic goals generally reflect an AI’s aspirations in relation to
  achieving growth and return, efficiency, and competitive advantage within the environment it operates in. Strategic objectives are more specific and measurable, with time assigned targets that are derived from strategic goals. These goals and objectives can both be expressed in financial terms (e.g. targeted loan / deposit growth rates and profit levels) and in non￾financial terms (e.g. improvement in service quality, technological advancements, increase in market share, etc.). An annual budget is a coordinated financial plan used to monitor and control the fulfilment of an AI’s business and financial targets approved for the new financial year. It can be regarded as a subset of, but not a substitute for, the strategic plan. 8 An AI which is part of a banking group, whether local or foreignnon-local, may be subject to the group-wide corporate mission set by their head office or parent bank, as the case may be.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation
5.2.6 AIs should ensure that their strategic goals and objectives are in
line with their corporate mission and values, set in realistic terms, and fit their business nature, risk profile, and scale and complexity of operations.
5.2.7 In setting strategic goals and objectives, AIs should, as far as
possible, identify and take into account the needs and expectations of their major stakeholders 9 . Changes in the environment (e.g. relating to political, legal, economic, social and technological changes)10 may also influence the setting of AIs’ goals and objectives. Where necessary, the implications of such influences for AIs’ strategic decision-making should be analysed.
5.2.8 Strategic goals and objectives set by AIs should be clearly
documented, effectively communicated within the organisation, and subject to the Board’s approval and periodical review. Development of strategies
5.2.9 AIs should have a process for evaluating their strategic position
and developing appropriate strategies to achieve their strategic goals and objectives.
5.2.10 Such a process should be able to provide –

• an understanding of the general banking, business and
  economic environment that an AI operates in, including how major environmental influences will affect the AI’s business and its use of products, technology and delivery channels11;
• an assessment of the AI’s strengths and weaknesses (e.g.
  in terms of its competitive position, market standing and financial performance, organisation and risk management structures, systems and infrastructure for meeting current An AI’s stakeholders normally include its shareholders, directors, customers, employees and other parties such as regulators. For example, there may be increasing pressure on the banking industry to play a socially responsible role. Rapid technological advances may also influence the way banking products and services are delivered. An AI may, through an environmental analysis, highlight various short and long term concerns associated with trends in the wider business, economic and social environment.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation and planned business needs, managerial capacity, resources availability and constraints, etc.); and

• an analysis of the AI’s strategic position and possible
  strategies that can be considered, having regard to its stated goals and objectives and risk tolerance. The depth and coverage of the above analysis should be commensurate with the AI’s scale and complexity of business.
  5.2.11 AIs should identify and develop appropriate strategies on the
  basis of the analysis made under para. 5.2.10 for inclusion in their strategic plan. As explained in para. 1.1.7, such strategies may need to be developed at a corporate, business or operational level, depending on the nature of the strategic goal or objective to be achieved. Sometimes, AIs may need to develop emergent strategies in response to sudden changes in the environment (e.g. reacting to an unanticipated collapse of the stock market or taking advantage of new business opportunities which have been opened up). Therefore, they should have in place adequate procedures to handle such situations and ensure that their strategic planning process is flexible enough to allow for such changes.
  5.2.12 AIs should ensure that strategies adopted –
• are suitable for and compatible with their corporate mission
  and values, strategic goals and objectives, and stated risk tolerance;
• have taken into account the needs and expectations of their
  major stakeholders; and
• are financially and operationally feasible.
  Formulation of strategic plan
  5.2.13 AIs should have a process for formulating and approving the
  strategic plan. This process and all related procedures, including the responsibilities of the Board and senior management and other staff concerned, should be clearly documented, approved by the Board, and subject to periodic review to ensure their appropriateness.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation
5.2.14 Strategic decisions agreed upon during the planning process
should form the basis of the strategic plan. Apart from describing what strategies the AI will take and how the AI will implement them to meet its strategic goals and objectives, the plan may also provide other information, such as the AI’s philosophy towards its business, its growth targets, the extent of its financial risk-taking, and other relevant factors (institutional and environmental) affecting its growth and development. The depth and coverage of the strategic plan should be commensurate with the AI’s scale and complexity of business.
5.2.15 In the case of a local banking group, the strategic plan should be
prepared on a consolidated basis (i.e. including the positions of subsidiaries and overseas non-local branches). Exceptions to this practice should be few, and there should be good reasons for departing from it (see example in para. 2.4.2).
5.2.16 AIs which are branches or subsidiaries of a foreign bank
incorporated outside Hong Kong should have their own strategic plan for strategic risk management purposes if the group’s strategic plan is not adequate to fully reflect their local situation, needs and activities. For example, if an AI is a small branch or subsidiary, its strategies may not be so significant as to affect the group’s position. Thus, it cannot rely on the group’s strategic plan to monitor its strategic risk. Under these circumstances, it should establish its own strategic plan according to the group’s mission, taking into account its local situation, needs and activities.
5.2.17 There are usually business and operating plans providing details
of implementing specific strategies set out in the strategic plan. Where applicable, capital and funding plans may be needed to outline the level of capital and funding required to support current operations, projected growth and strategies to be carried out, anticipated capital expenditures, and use of external capital and funding sources (see subsection 6.1 for more details). Such implementation plans should be reviewed and approved in conjunction with AIs’ strategic planning and budgeting activities.
5.2.18 Effective implementation of strategies would also depend on
whether AIs have adequate management succession plans to avoid disruption in the efficient functioning of the organisation or

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation negative effects on strategic decision-making and to ensure the continuity of managerial services and availability of next-in-line successors whenever the need for them arises.
5.2.19 AIs should ensure that their strategic plan conforms to their
stated risk tolerance and is viable, with necessary resources (e.g. people, systems and IT infrastructure), skills, in-house expertise and managerial capacity to implement the plan. Special attention should be paid to those strategies that may involve intensive resources or higher risk, such as intended launch into new, emerging or unfamiliar markets, significant cross-border acquisition projects, and planned diversification into new products and services in which the AI may lack expertise. Adequate risk assessment should be available to justify the strategies.
5.2.20 The strategic plan usually covers a time period of three to five
years. It should be comprehensive, well documented, properly approved by the Board and effectively communicated within the organisation.
5.2.21 The strategic plan should be periodically reviewed (at least
annually) to update any changing circumstances and ensure that the plan remains appropriate. Any changes to the plan, such as modifying existing strategies or adding new ones, should be subject to the same approval process.
5.3 Alignment and change management
5.3.1 Before implementing their strategies, AIs should ensure that they
have made proper alignment of internal resources and processes and, if necessary, managed all change issues (such as those arising from organisational or cultural changes) to facilitate the achievement of desired outcomes. Interdependencies between processes across departments (e.g. reconciliation of transaction information between front and back offices using a more advanced IT system) should also have been addressed so that they can be properly understood and accounted for during the implementation.
5.3.2 Ensuring proper alignment of internal resources and processes
means, for example, checking to see whether –

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation

• sufficient resources (financial and non-financial) have been
  allocated to undertake the necessary tasks;
• the right people have been put in the right place; and
• the organisation and risk management structure, systems,
  infrastructure and technology etc. are in the right shape to support the new initiatives.
  5.3.3 In case there is a need for change in an area where AIs may
  meet forces of resistance to change (such as organisational restructuring, business process re-engineering or changing of people’s mindset), they should develop a change programme for ensuring a smooth and effective change. Such programme can be designed to suit the needs and circumstances of individual AIs. Nonetheless, senior management should play an active role and act as a leader in the change process.
  5.4 Implementation and monitoring
  5.4.1 To determine whether a strategy will succeed or fail, it depends
  on whether an AI has adequate resources and capability to implement the strategy and whether the AI has the ability to effectively monitor and control the progress of implementation. As such, in addition to strategic planning, AIs should have a process to facilitate the monitoring and control of strategies being implemented.
  5.4.2 Active Board and senior management oversight (re: subsection
  4.2), with the support of the strategic risk management function (re: subsection 4.4), will help ensure effective implementation and control of strategies. In addition, there should be adequate management guidelines and written procedures for implementing strategies and monitoring and reporting the progress of implementation.
  5.4.3 Where AIs have identified strategic issues arising from
  anticipated operational or market changes which may result in a significant adverse impact on their business or financial conditions, such issues should be reported to the Board and senior management in a timely manner, with an assessment of the strategic risk implications and the need for taking remedial

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation actions (such as modifying existing strategies and implementing risk mitigating or contingency measures).
5.4.4 AIs should, where appropriate, conduct stress tests on strategies
being implemented to help identify any possible events or changes in the environment that could adversely alter the original assumptions made in the strategic plan and assess any potential threats to their business, both financially and non￾financially. See subsection 6.3 for more details.
5.4 Performance evaluation and feedback
5.4.1 Comparison of actual performance to desired outcomes serves
as an important check on the success of implementing approved strategies, and allows management to take timely remedial actions to address significant deviations from set targets. Therefore, AIs are expected to develop a performance evaluation system that tracks progress towards achieving both financial and non-financial targets.
5.4.2 In developing the performance evaluation system, AIs should
clearly document the objectives of performance evaluation, the performance indicators or measures to be used (which may be quantitative or qualitative), the identification of areas and methodologies for measuring or evaluating performance, as well as evaluation benchmarks, standards and criteria to be adopted.12
5.4.3 In addition, AIs should establish review processes which focus
on whether actual performance meets expectations, and appropriate techniques and tools to measure / evaluate and monitor performance. AIs should also have in place adequate systems and controls to track performance and report significant variances to the Board and senior management.13 Generally speaking, performance evaluation may cover such areas as financial performance, competitiveness, quality of service, productivity and efficiency, and innovation. Where appropriate, trigger points on key performance indicators could be established for monitoring and reporting purposes such that strategies with trigger points reached would cause the Board to revisit those strategies.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation
5.4.4 The performance evaluation system should be subject to the
Board’s approval and periodic review to ensure that they remain appropriate.
5.4.5 Staff in functional departments and the strategic risk
management function responsible for performance evaluation (see paras. 4.3.1 and 4.4.2 respectively) should have sufficient training, knowledge, skills and expertise, and competence in performing their duties.
5.4.6 Performance evaluation not only helps monitor results but also
provides useful information to make appropriate and timely adjustments to strategies. Therefore, AIs should take into account this information when formulating or reviewing their strategies, and their strategic planning process should allow for such changes.
6. Other supporting processes
6.1 Planning and management of capital and funding needs
6.1.1 Inadequate planning of capital and funding needs is an obstacle
to implementing strategic decisions and can have a disruptive effect on an AI’s operations and its ability to meet strategic goals and objectives. As such, AIs should view such planning as a crucial element of the strategic planning process.
6.1.2 Capital planning should be risk-based and forward-looking, and
take into account such factors as an AI’s current and future capital needs, anticipated capital expenditures, dividend payment forecasts, desirable capital levels, and external capital sources (e.g. available supply of capital and capital raising options).14 All these factors should be addressed in a capital plan that is reviewed and approved by the Board, or a committee delegated by the Board, (at least annually) in conjunction with an AI’s strategic planning and budgeting activities. In the case that acquisition opportunities arise, the capital impact and An AI’s capital should enable it to operate as a going concern and be sufficient to cater for business growth and market stresses.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation funding options should be assessed separately and included in the capital plan.
6.1.3 Apart from capital planning, AIs should ensure that adequate
funding will be available to support their strategic plans. Arrangements should therefore be in place to involve the Asset and Liability Committee early in the strategic planning exercise.
6.1.4 AIs should maintain adequate policies and procedures in respect
of how they manage their capital and funding, and adequate controls to ensure the adequacy and effectiveness of their management processes. See section 4 of CA-G-5 “Supervisory Review Process” and section 5 of LM-2 “Liquidity RiskSound Systems and Controls for Liquidity Risk Management” for more details.
6.2 Management information systems
6.2.1 In a competitive banking environment, the ability to effectively
manage information is crucial to an AI’s ability to remain competitive, introduce new products and services, and achieve desired goals. AIs should therefore ensure that they have sufficient MIS to support their strategic planning and decision making processes.
6.2.2 AIs should ensure that the information generated from their MIS
is accurate, complete and reliable, as the Board and senior management depend on such information to make decisions, monitor risk and measure performance.
6.2.3 MIS needs will change when an AI grows in size, its operations
become more complex or its strategic goals dictate a change in business focus requiring revisions in data collection and presentation. AIs should have a review process to identify such changes to ensure the relevance, usefulness and effectiveness of information provided on a continuing basis.
6.3 Stress-testing and contingency strategies
6.3.1 AIs should employ stress-testing techniques in their strategic
planning and management processes to assess any potential threats to the implementation of their strategies. Stress-testing

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation generally involves identifying possible events or changes in the external environment that could have unfavourable effects on an AI and assessing the AI’s ability to withstand those effects (see IC-5 “Stress-testing” for more guidance).
6.3.2 Stress-testing does not necessarily mean the use of
sophisticated financial modelling tools, but rather focuses on the need for AIs to evaluate in some way the potential impact (both financial and non-financial) different stress scenarios may have on their business. The level of resources devoted to this effort should be commensurate with the nature, scale and complexity of AIs’ business activities.
6.3.3 When AIs conduct stress tests to assess their potential
vulnerability to adverse events or other external factors (e.g. unfavourable economic conditions) and/or their ability to meet current and emerging challenges, the stress scenarios should not be limited to quantitative analyses that compute potential losses or gains. They should also be able to project qualitative outcomes, including actions management might take given certain situations.
6.3.4 The stress-testing results should provide feedback to strategic
decision-making, i.e. determining whether an existing strategy remains appropriate or whether a change to the strategy or reversal of the strategic decision is warranted. For stress-testing outcomes that reflect risk levels which exceed internally established risk tolerances, AIs should consider developing contingency strategies or appropriate, cost-effective risk mitigating strategies. Contingency strategies may include shifting of strategic focus, changing business initiatives and decisions, postponing strategic investment proposals and/or increasing internal capacity and capability. Risk mitigating strategies may include diversifying risk exposures or transferring risk to third parties.
6.4 Human resources management and development
6.4.1 Human resources management has a strategic focus in that it is
involved in gaining commitments to an AI’s goals and shaping its corporate culture. By developing policies to meet future needs, human resources management enables the adoption of

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation a forward-looking approach to deal with change and growth and to anticipate future problems.
6.4.2 Human resources development has a strategic focus as well in
that it deals with the development of staff capabilities to meet an AI’s current and future needs. In particular, it involves matters of how to enhance or widen the skills of employees through training, helping them adapt to changes, enabling them to make better use of their skills and abilities in their current jobs, and preparing them for future jobs.
6.4.3 AIs should maintain adequate policies and procedures for
managing and developing human resources to support strategic developments and implementation. Such policies and procedures generally include –

• developing appropriate policies, processes, oversight
  mechanism and measurement criteria to ensure that the recruitment, training and retention of staff meet the AI’s needs and that adequate staff support is provided to key jobs;
• introducing incentive schemes for motivating staff,
  improving their performance, and attracting and retaining staff with critical skills;
• setting up training and development programmes to ensure
  the provision of, and better align staff capabilities with, required skills; and
• developing management succession plans to cater for staff
  turnover and retirement. This is particularly essential for AIs which anticipate major turnover in senior and middle management, whether due to transfer, resignation or retirement.
  6.5 Independent reviews and audits
  6.5.1 The Board and senior management should, where necessary,
  make use of independent reviews and audits to ensure the integrity and effectiveness of the strategic risk management framework.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation
6.5.2 Such reviews and audits can be conducted by an AI’s internal
auditors or independent external parties (e.g. external auditors) that are qualified to do so, and may also take the form of ad hoc reviews on specified areas. The manner in which these reviews and audits are to be performed (e.g. scope, timing or frequency, and by which party) depends on the judgement of the Board and senior management as to the AI’s individual needs, its size and structure, and the risks inherent in its business.
6.5.3 The results of such reviews and audits, including any issues and
weaknesses identified, should be reported to the Board and senior management directly. Both the Board, or a delegated committee (e.g. Audit Committee), and senior management should be sufficiently engaged in the process to determine whether such reviews and audits are effectively performed (e.g. whether the performing staff are independent and have sufficient authority to perform their duties) and identified issues are timely addressed. ————————— Content Glossary Home Introduction

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation
Annex A : Common causes of strategic failure
A1 Introduction
A1.1 The purpose of this Annex is to provide a list of hypothetical examples illustrating some common causes of strategic failure. The list is compiled for AIs’ reference only, and should not be regarded as a complete list of the possible causes of strategic failure. A1.2 Strategic failure refers to a situation in which the improper formulation or implementation of strategies by a banking institution, or external pressures arising from the implementation of such strategies, have led to significant damage to the institution’s financial position, reputation, competitiveness or business development prospects. Such impact may, in the extreme circumstances, affect the institution’s survival as well. A1.3 It should be noted that strategic failure seldom reflects the effect of a single weakness, but is often the result of two or more, or a combination of, factors. For example, a poorly developed strategy will not lead to strategic failure if the Board disapproves it. Hence, the focus of this Annex is to highlight those factors that may increase the chance of strategic failure rather than presenting each of them as a sole contributor to strategic failure. A2 Common causes of strategic failure A2.1 Planning issues

• Strategic decisions made by an institution are not compatible with
  its risk tolerance level and deviate from its core business activities. For example, the institution is mainly engaged in traditional retail banking business but has decided to boost its profits by starting a fairly large operation conducting high risk proprietary foreign exchange derivatives trading activities in which it has little expertise.
• Strategic decisions made by an institution are based on poor or
  inadequate evaluation of the strategies adopted. For example, the institution has not adequately assessed the need for significant technological enhancements when considering its business strategies.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation

• Strategic decisions made by an institution are imprudent or overly
  aggressive relative to its business size and complexity. For example, the institution aggressively expands its private banking business but has neglected the fact that it does not have a sufficient number of experienced or well-trained relationship managers to handle such expansion.
• Improper diversification strategy is adopted by an institution,
  which disregards the institution’s lack of skills to develop the diversified range of new products and the high set-up costs involved.
• An institution clings onto its old strategies without updating them
  to take account of environmental changes, thus rendering those strategies ineffective and irrelevant. For example, the institution is not aware of changes in its customer behaviour and continually adopts the existing marketing strategy to promote its business.
• Inadequate risk assessment is made before an institution
  launches business in new, unfamiliar markets or offers new products and services. For example, the institution sets up a retail banking operation in an emerging market but has not adequately assessed the regulatory constraints imposed on non-local foreign institutions and the implications of such constraints on the feasibility of such operation.
• A successful institution is over-confident of its past experience
  when making strategic decisions, thereby stifling innovation and reducing flexibility. For example, the institution, being a major player in wholesale lending business, has no intention to explore other viable business strategies (e.g. developing more fee based business). As a result, it has forsaken opportunities to reduce reliance on its wholesale lending business. A2.2 Implementation issues
• An institution is slow in responding to changes in its operating
  environment, and therefore has not adequately considered the need for strategic changes. For example, the trend towards increasing use of internet or e-banking services by customers has been overlooked by the institution, resulting in a loss of

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation competitive advantage over those institutions which have offered those services extensively.

• A strategy is poorly implemented because of the lack of necessary
  operational / functional support (e.g. IT, human resources management, etc.). For example, when a major strategy is being implemented, certain technical officers responsible for implementation (with technical skills which are difficult to replace) resign from the institution suddenly, leaving behind no capable staff to carry on the implementation.
• An institution does not have adequate in-house expertise to
  implement its new strategy. For example, the institution heavily relies on the support of external expertise (e.g. consultancy services) to implement its new strategy. If the external party suddenly stops providing such expertise when the strategy is still being implemented or the expertise provided does not meet the institution’s expectations, this may expose the institution to significant business and financial losses.
• An institution fails to take account of the difficulties in engendering
  change before implementing its new strategies. For example, the institution needs to change staff’s work habits and requires staff to acquire new technical skills for carrying out some new strategies, but ignores the difficulties of bringing about such changes. As a result, the strategies cannot be successfully implemented.
• An institution does not have adequate managerial resources and
  expertise to look after its business operations. For example, most of the members at the Board and senior management levels of the institution are approaching retirement age, and the turnover in the middle management is significant. Without good management succession arrangements, the institution gradually loses its competitive position in the marketplace.
• An institution has lost its competitive advantages through the
  erosion or deterioration of factors that created the advantages to start with. Examples causing such erosion or deterioration include the lack of investment in technology, insufficient investment in developing or enhancing risk management and

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation control systems, and failure to replace primary resources that have run out.

• An institution has not successfully implemented an acquisition
  deal due to various reasons, such as –
• integration problem, clash of culture and management style;
• acquisition price too high;
• departure of key staff or management of the acquired
  company; or
• unrealised promises in generating additional businesses.
• An institution has not successfully implemented a joint venture
  deal due to various reasons, such as –
• poor structuring of the decision-making process at the outset;
• conflict between joint venture partners because of different
  expectations;
• difficulty in finding a reliable joint venture partner; or
• joint venture partners becoming competitors.
• Resources (tangible or intangible) deployed to implement the
  strategies of an institution are inadequate, thus resulting in failure to meet set targets. For example, the institution has implemented a strategy to enhance overall service quality at the branches (due to declining customer base and rising customer complaints) but has failed to recruit a sufficient number of experienced customer service professionals to man the branches.
• Because of inadequate controls to monitor the progress of
  implementing a strategy, an institution has not been able to recognise that a problem has occurred or that the strategy is failing. For example, the institution develops its personal lending strategy based on the assumption that the bankruptcy rate of individuals is below 0.5%. Such assumption is no longer valid with the recent surge in personal bankruptcies. Given no regular review of the strategy and inadequate control over the results of

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation implementation, the institution is unaware that the default rate of its personal lending portfolios increasing rapidly.

Supervisory Policy Manual
SR-1 Strategic Risk Management V.2 – Consultation
Annex B : Strategic risk profile – summary of major characteristics15 by risk
category
Risk category
Low

• The impact of strategic decisions, or
  external pressures arising from such decisions, is expected to nominally affect franchise value.
• Strategic decisions show a continual
  pattern of being made in a sound manner with a history of successful results.
• Strategic decisions are always
  compatible with stated goals and risk tolerance, implemented in an appropriate manner, and continually reflect responsiveness to changes in the environment.
• Strategies are well conceived and
  supported by sound due diligence, effective risk management and control systems, as well as sufficient financial and management resources.
• The Board has always provided
  effective oversight of the planning and implementation of strategic goals, with senior management consistently demonstrating a high level of experience and expertise in carrying out strategic decisions successfully and within stated risk tolerance levels.
• Management has been successful in
  accomplishing past goals, with a history of excellent performance in providing new products and services and evaluating potential and consummated acquisitions.
• Strategic direction and organisational
  efficiency are enhanced by the depth of management talent.
• Strategic goals and risk management
  policies are effectively communicated and consistently applied throughout the organisation.
• Corporate structure and culture, MIS
  and other system infrastructure effectively support strategic direction and initiatives. Moderate
• The impact of strategic decisions, or
  external pressures arising from such decisions, is not expected to significantly affect franchise value.
• Strategic decisions are generally sound
  with due consideration given to all the relevant risks.
• Strategic decisions are usually
  compatible with stated goals and risk tolerance, implemented in a proper manner and exhibit responsiveness to changes in the environment.
• Strategies are supported by adequate
  financial and management resources.
• The quality of due diligence and risk
  management and control systems is consistent with the strategic issues confronting the institution.
• The Board generally provides effective
  oversight of the planning and implementation of strategic goals, with senior management possessing the necessary experience in carrying out strategic decisions within stated risk tolerance levels.
• Management has demonstrated the
  ability to implement past goals, and has a reasonable record in decision making and controls.
• Management has exhibited, for the most
  part, good past performance in
  providing new products and services and evaluating potential and consummated acquisitions.
• Strategic goals and risk management
  policies are appropriately communicated and consistently applied throughout the organisation.
• Corporate structure and culture, MIS
  and other system infrastructure reasonably support strategic direction and initiatives. High
• The impact of strategic decisions, or external
  pressures arising from such decisions, is expected to adversely affect franchise value.
• Strategic goals may be non-existent, poorly
  defined, overly aggressive or incompatible with business direction.
• Emphasis on substantive growth or expansion
  may result in earnings volatility or capital pressure.
• Strategic decisions may be difficult or costly to
  reverse.
• A history of poor strategic decisions on a
  frequent basis continues to expose the institution to negative financial results. This, coupled with a pattern of improper implementation of strategic decisions or frequent lack of responsiveness to changes in the environment, continues to increase the potential for significant financial losses and reputation risk.
• Management or available resources may be
  insufficient to accomplish planned initiatives or to make necessary competitive changes.
• Lack of adequate due diligence, and less than
  effective risk management and control systems, have resulted in deficiencies in management decision-making abilities, and may undermine effective evaluation of resources and commitment to new products and services, or acquisitions.
• The Board has been totally ineffective in
  overseeing strategic decisions and improving the quality of senior management.
• Senior management lacks the experience
  necessary to effectively direct the communication, implementation and modification of strategic plans and maintain consistency with stated risk tolerance levels.
• Management has a track record of poor past
  performance in offering new products and services and evaluating potential and consummated acquisitions.
• Strategic goals and risk management policies
  may not be clearly communicated and consistently applied throughout the organisation.
• Corporate structure and culture, MIS and other
  system infrastructure may be insufficient to support strategic direction or address a changing environment. This Annex is compiled for AIs’ reference only. The characteristics shown are not necessarily all-inclusive, and every characteristic within a risk category does not have to be met in order for an AI to be categorised under that risk category.