Guidelines for Developing Risk Management Framework for Individual Risk Elements in Banks

GUIDELINES FOR DEVELOPING RISK MANAGEMENT FRAMEWORK FOR INDIVIDUAL RISK ELEMENTS IN BANKS
1.0 INTRODUCTION
1.1 Banks are exposed to various risks in pursuit of their business objectives. The
basic ones include credit, market, liquidity, and operational risks. Failure to adequately manage these risks exposes banks not only to losses, but may also threaten their survival as business entities thereby endangering the stability of the financial system.
1.2 In view of the foregoing and in line with the global recognition of the
imperative of effective risk management and control systems in banks, the CBN provides Guidelines to enable banks develop their respective strategy for managing each risk element as part of the overall strategy for evolving efficient risk management systems. These guidelines, which are organized by risk category, are flexible in the sense that banks can adapt them in line with the size and complexity of their business. The adoption of the guidelines will also facilitate banks’ preparation for the implementation of the New Basel Capital Accord in due course. The Guidelines should be read in conjunction with the generic “Guidelines for the Development of Risk Management Processes” issued in December 2005.
2.0 POLICY STATEMENT
2.1 It is the overall responsibility of the Board and Management of each bank to
ensure that adequate policies are put in place to manage and mitigate the adverse effects of all risk elements in its operations.
2.2 Each bank should develop and implement appropriate and effective systems
and procedures to manage and control its risks in line with its risk management policies.
2.3 Each bank should submit a copy of its Risk Management Framework (RMF)
highlighting its assessment of each risk element and any amendments

thereto, to the Central Bank of Nigeria and the Nigeria Deposit Insurance Corporation for appraisal.
2.4 Banks should submit periodic reports/returns in respect of their risk
management processes (RMP) as they relate to individual risk elements in their respective banks to the regulatory authorities as may be required from time to time.
3.0 KEY ELEMENTS OF RISK MANAGEMENT PROCESS
3.1 The key elements of an effective risk management process should encompass
the following:
a. Risk Management Structure with Board and Senior Management Oversight as an integral element; b. Systems and procedures for risk identification, measurement, monitoring and control; and
c. Risk Management Framework Review Mechanism.
4.0 RISK MANAGEMENT STRUCTURE
4.1 A sound Risk management structure is important to ensure that the bank’s
risk exposures are within the parameters set by the Board. Such structure should be commensurate with the size, complexity and diversity of the bank’s activities. The risk management structure should facilitate effective board and senior management oversight and proper execution of risk management and control processes. At the minimum, the structure should contain the following:
4.2 Board
4.2.1 The Board should be responsible for establishing the bank’s overall strategy
and significant policies relating to the management of individual risk elements to which it is exposed. At the minimum, the Board’s responsibilities should include the following:
4.2.2 Defining the bank’s overall strategic direction and tolerance level for each
risk element.

4.2.3 Ensuring that the bank maintains the various risks facing it at prudent levels.
4.2.4 Ensuring that senior management as well as individuals responsible for
managing individual risks facing the bank possess sound expertise and knowledge to accomplish the risk management function.
4.2.5 Ensuring that the bank implements sound fundamental principles that
facilitate the identification, measurement, monitoring and control of all risks facing it.
4.2.6 Ensuring that appropriate plans and procedures for managing individual risk
elements are in place.
4.3 Board Risk Management Committee (BRMC)
4.3.1 The Board Risk Management Committee (BRMC) should be responsible for
ensuring adherence to the bank’s risk management policy and procedures as set out by the board as well as review the bank’s risk strategy for appraisal by the board.
4.3.2 In order to secure the independence of the BRMC, the Chairman of the
Board shall not be a member of the committee in line with the Code of Corporate Governance for Banks in Nigeria.
4.3.3 Membership of the BRMC shall include at least two (2) non-executive
directors, one of whom should be an independent director. One of the non￾executive directors shall serve as Chairman.
4.3.4 The MD/CEO shall be a member of the BRMC in order to complement his
oversight role as the Chief Executive Officer of the bank.
4.4 Senior Management
4.4.1 Senior management is responsible for the implementation of risk policies
and procedures in line with the strategic direction and risk appetite specified by the board.
4.2.3.2 For the effective management of risks facing a bank, senior management
should at the minimum be responsible for:
¾ The development and implementation of procedures and practices that translate the board's goals, objectives, and risk tolerances into operating standards that are well understood by the bank’s personnel.

¾ Establishing lines of authority and responsibility for managing individual risk elements in line with the Board’s overall direction. ¾ Risk identification, measurement, monitoring and control procedures. ¾ Establishing effective internal controls over each risk management process. ¾ Ensuring that the bank’s risk policies, appetite and tolerance are well documented and clearly communicated throughout the bank such that staff at all levels will be responsible for identifying with the bank’s declared priority of risk management by recognizing real and anticipated risks in their normal course of duty and taking appropriate action. This will ensure that the bank’s risk management culture is sustained throughout its operations.

4.5 Risk Management Committee
4.5.1 A Risk Management Committee at the operational level which has
responsibility for driving the risk management function should be headed by a suitably qualified officer of top management cadre. The Committee shall be responsible for the review of the bank’s risk management frameworks, identification of lapses and suggestion of corrective measures through the examination of balance sheet structure, portfolio limits and distribution, target markets/products, using macro economic data, environmental assessment and in-house statistics. The Committee shall have a reporting relationship to the Board Risk Management Committee in accordance with the Code of Corporate Governance for Banks in Nigeria Post Consolidation. Members of the Committee should, at the minimum, comprise the heads of relevant departments/units such as Operations, Treasury, Internal Audit/Inspection, Human Resources and Legal.
4.6 Risk Management Function
4.6.1 The Risk Management function should ensure effective management of the
significant risks inherent in the operations of the bank. For each of the risks, the arrangements should cover the following areas, among others:

a) Establishment of systems and procedures relating to risk identification, measurement and control and monitoring of loan and investment portfolio quality and early warning signals. b) Ensuring that risk remains within the boundaries established by the Board. c) Ensuring that business lines comply with risk parameters and prudential limits established by the Board. d) Remedial measures to address identified deficiencies and problems. e) Stress testing of the credit portfolio. f) Risk reporting.
5.0 RISK MANAGEMENT PROCESSES FOR INDIVIDUAL RISK
ELEMENTS
5.1 CREDIT RISK
5.1.1 Banks should have Credit Risk Management Procedures that are holistic. At
the minimum, they should cover formulation of overall credit strategy, credit origination, administration, analysis, measurement and control. They should also include the risk review process and procedures for managing problem credits.
5.1.2 Formulation of Credit Strategy
5.1.2.1 The first step in developing the bank’s credit strategy should be the
determination of its risk appetite. Thereafter, the bank should develop a plan to optimize return while keeping credit risk within the predetermined limits. Specifically, the credit risk strategy should clearly outline the following:
a) The bank’s plan to grant credit based on various client segments and products, economic sectors and geographical location. b) Target market within each lending segment, preferred level of diversification/concentration. c) Pricing strategy.

5.1.2.2 The strategy should provide continuity in approach and should be
reviewed and amended periodically as deemed necessary.
5.1.2.3 The strategy should indicate credit risk identification methods. Credit risk
identification methods include, amongst others, review of macro-economic indicators, thematic reviews, statistical modeling, data mining, internal credit policies and procedures, etc.
5.1.3 Credit Origination
5.1.3.1 Banks must operate within a sound and well-defined criteria for new credits
as well as the expansion of existing credits. Credits should be extended within the target markets and lending strategy of the institution. The key feature of credit origination should be the assessment of the risk profile of the customer/transaction.
5.1.3.2 Banks should develop procedures that adequately capture salient issues
regarding the borrower’s industry; macro economic factors; purpose of the credit; source of repayment; track record and repayment history of the borrower; repayment capacity of the borrower; the proposed terms and conditions and covenants; adequacy and enforceability of collaterals; and appropriate authorization for the borrowing.
5.1.4 Credit Administration
5.1.4.1 The credit administration function is basically a back office activity that
supports and controls the extension and maintenance of credit. A typical credit administration unit should perform the functions of credit documentation, monitoring and maintenance of credit files, collateral and security documents as well as ensuring that loan disbursement and repayment conform to laid down policies.
5.1.5 Measuring Credit Risk.
5.1.5.1 The measurement of credit risk is of vital importance in credit risk
management. Banks should adopt qualitative and quantitative techniques to measure the risk inherent in their credit portfolio.

5.1.5.2 To measure the credit risk, banks should establish a credit risk rating
framework across all types of credit activities.
5.1.5.3 Among other things, the rating framework should incorporate the
measurement of business risk (i.e. industry characteristics, competitive position, management, etc.), and financial risk (i.e. financial condition, profitability, capital structure, present and future cash flows, etc.).
5.1.5.4 The credit rating framework should be designed to also serve as a tool for
monitoring and controlling risk inherent in individual credits as well as in credit portfolios of a bank or a business line.
5.1.5.5 The risk rating should categorize all credits into various classes on the
basis of underlying credit quality.
5.1.5.6 Risk ratings should be assigned at the inception of lending, and reviewed
at least annually. Additionally, banks should review ratings whenever adverse events occur. The risk ratings generated should be subjected to review and validation by a superior officer.
5.1.5.7 As part of portfolio monitoring, banks should generate reports on credit
exposure by risk grades. Adequate trend analysis should also be conducted to identify any deterioration in credit quality. Banks may establish limits for risk grades to highlight concentration in particular rating bands. It is important that the consistency and accuracy of ratings is examined periodically by a function such as a separate credit review group.
5.1.6 Managing Problem Credits
5.1.6.1 Banks should establish a system that helps identify problem loans ahead of
time when there may be more options available for remedial measures. Once a problem loan is identified, it should be managed under a dedicated remedial process.

5.1.6.2 Banks should clearly set out how they will manage their problem credits.
Responsibility for such credits may be assigned to the originating business function, a specialized workout section, or a combination of the two, depending upon the size and nature of the credit and the reason for its problems.
5.2 MARKET RISK
5.2.1 Each bank should put in place a set of systems and procedures appropriate
to the size and complexity of its operations for identifying, measuring monitoring and controlling market risk.
5.2.2 Identifying Market Risk
5.2.2.1 In identifying the overall market risk of a bank, a detailed analysis of assets
and liabilities should be conducted to assess the overall balance sheet structure of the bank.
5.2.2.2 Some of the common market risks in the Nigerian financial environment
include interest rate, foreign exchange and equity price risks.
5.2.3 Measuring Market Risk
5.2.3.1 Accurate and timely measurement of market risk is necessary for proper
risk management and control.
5.2.3.2 Each bank should evolve measurement processes which are capable of
identifying and quantifying market risk factors that affect the value of traded and non-traded portfolios, income stream and other business activities using all available data.
5.2.3.3 Each bank may use acceptable techniques to measure its market risks.
However, such techniques should depend on the nature, size and complexity of the business as well as data availability and integrity.
5.2.3.4 The measurement system in each bank should make it possible to:

a) assess all material market risk factors associated with its assets, liabilities and off balance sheet positions b) utilise generally accepted financial concepts and risk measurement techniques; and c) have well documented assumptions and parameters.
5.2.3.5 Regardless of the measurement system, the usefulness of each technique
depends on the validity of the underlying assumptions and accuracy of the basic methodologies used to model risk exposure. There is therefore, the need for periodic stress testing of the assumptions and accuracy of the basic methodologies used to model risk exposures in order to quantify the potential impact on the business. In addition, the integrity and timeliness of data relating to current positions are key elements of the risk measurement system.
5.3 OPERATIONAL RISK
5.3.1 Each bank should put in place an appropriate set of systems and procedures
for identifying, measuring, monitoring and controlling its operational risk.
5.3.2 Operational Risk Identification
5.3.2.1 Each Bank should identify the operational risk inherent in all types of
transactions, products, activities, processes and systems. Banks should also ensure that before new products, activities, processes and systems are introduced or undertaken, the operational risk inherent in them is subjected to adequate assessment procedures.

5.3.2.2 Each bank should ensure that its operational risk identification process is
robust and should be capable of considering potential risks.
5.3.3 Operational Risk Measurement
5.3.3.1 Banks should establish the processes necessary for measuring operational
risks inherent in their operations. These processes should, at the minimum, require that:

a. banks have ability to estimate the probability of the occurrence of an operational loss event and its potential impact. This entails an evaluation of group wide operational risk through a business impact analysis; and b. banks put in place effective internal reporting practices and systems that are consistent with the scope of operational risk defined by supervisors and the banking industry.
5.3.3.2 In order for its operational risk measurement process to be effective, each
bank should have in place experienced staff and an appropriate systems infrastructure that can identify and gather operational risk data.
5.3.3.3 Banks should consider establishing Key Risk Indicators (KRIs) in order to
make the process of monitoring operational risks very robust. It is very important to establish triggers for the KRIs. A trigger indicates the value of the KRI beyond which the potential for the occurrence of the risk is very high. All breaches of the trigger should be reported to senior management for timely corrective action.
5.4 LIQUIDITY RISK
5.4.1 Liquidity Risk Management Procedures should be comprehensive and
holistic. At the minimum, they should cover formulation of overall liquidity strategy, risk identification, measurement, monitoring and control process.
5.4.2 Formulation of Liquidity Strategy
5.4.2.1 Banks should formulate liquidity policies approved by the Board of Directors.
While specific details vary across institutions according to the nature of their business, the key elements of any liquidity policy should include:
a. Determining the bank’s risk appetite and tolerance levels. Specifically, the liquidity risk strategy should clearly outline the following:
i. Composition of assets and liabilities to maintain liquidity.
While the Board should provide the broad policy objective and

strategic focus, the management should stipulate the proportion of each asset and liability component (i.e. asset/liability mix) that the bank should hold at all times to maintain the required level of liquidity for its operations.
ii. Diversification and Stability of Liabilities. The Board of
Directors and senior management should provide guidance relating to funding sources and ensure that the bank have diversified sources of funding day-to-day liquidity requirements and the determination of the stability of the liabilities/funding sources.
iii. Access to Inter-bank Market. The liquidity risk management
strategy should indicate the ability of the bank to obtain funds in inter-bank and other wholesale markets as those markets constitute important sources of liquidity. However, in formulating such strategy, each bank should recognize the fact that its ability to access funds from these markets could be seriously impaired during crisis situations. b. Developing general liquidity strategy (short- and long-term), specific goals and objectives in relation to liquidity risk management, process for strategy formulation and the level within which it is approved;
c. Defining the roles and responsibilities of individuals performing
liquidity risk management functions, including structural balance sheet management, pricing, marketing, contingency planning, management reporting, lines of authority and responsibility for liquidity decisions; d. Designing a Contingency Funding Plan (CFP) to enable banks meet their funding needs under different stress scenarios. The CFP is a set of policies and procedures that serves as a blue print for a bank to meet its funding needs in managing liquidity risk in a timely manner and at a reasonable cost. The CFP should project the future cash flows and funding sources of a bank under different market scenarios including aggressive asset growth and/or rapid liability erosion. To be effective, it is important that a CFP should represent management’s best estimate of balance sheet changes that may result from a liquidity

or credit event. The CFP should be comprehensive in scope covering both asset and liability strategies. e. The strategy should provide continuity in approach and should be reviewed and amended periodically as deemed necessary. There should therefore be periodic stress testing of the assumptions underlying the liquidity strategy, the results of which should be reviewed and analyzed to evaluate the impact on the business.
5.4.3 Identifying Liquidity Risk
5.4.3.1 An effective mechanism should be put in place by banks for proper
identification of liquidity risks through early warning indicators, which include the following:
a) a negative trend or significantly increased risk in any area or product line; b) concentrations in either assets or liabilities; c) deterioration in quality of credit portfolio; d) a decline in earnings performance or projections; e) rapid asset growth funded by volatile large deposit; f) a large size off-balance sheet exposure relative to capital; and g) a deteriorating third party evaluation about the bank
5.4.4 Measuring Liquidity Risk
5.4.4.1 An effective measurement system is essential for adequate management of
liquidity risk. Consequently, banks should institute systems that enable them to capture liquidity risk ahead of time so that appropriate remedial measures could be prompted to avoid any significant losses. Some commonly used liquidity measurement techniques are outlined below:
a. Cash Flow Projections a.1 At the minimum, banks should adopt flow measures to determine their cash position. The cash flow projection should estimate a bank’s inflows and outflows and net position (GAP) over a time horizon. The behavioral GAP report should use short-time frames to measure near term exposures and longer time frames thereafter. It is suggested that banks calculate daily GAP

for next one or two weeks, monthly Gap for next six months or a year and quarterly thereafter. b. Liquidity Ratios and Limits
I. Banks may use a variety of ratios to quantify liquidity. These ratios can also
be used to create limits for liquidity management. However, where ratios are used, they must be in conjunction with more qualitative information. The bank's asset-liability managers should understand how a ratio is constructed, the range of alternative information that can be placed in the numerator or denominator, and the scope of conclusions that can be drawn from ratios.
II. In addition to the statutory limits of liquid assets and cash reserve
requirements, the board and senior management should establish limits on the nature and amount of liquidity risk they are willing to assume. The limits should be periodically reviewed and adjusted when conditions or risk tolerances change.
III. In order to have effective implementation of policies and procedures, banks
should institute limits for risk. Balance sheet complexity should be used to determine how much and what types of limits a bank should establish over daily and long-term horizons. While limits will not prevent a liquidity crisis, limit exceptions can be early indicators of excessive risk or inadequate liquidity risk management.
6.0 MONITORING OF INDIVIDUAL RISK ELEMENTS
6.1 Each bank should establish risk monitoring processes to evaluate the
performance of the bank’s risk strategies/policies and procedures in mitigating individual risks being encountered.
6.2 The Monitoring process should at the minimum cover understanding the
bank’s exposure to individual risk elements, ensuring compliance and assessing the adequacy of each risk measurement system.
6.3 At the minimum, the following reports should be generated on a regular
basis:

¾ Summaries of the bank’s exposure to individual risk elements; ¾ Report of compliance with policies and the limit set by the Board and Management as well as regulatory requirements; ¾ Summaries of findings of risk reviews of policies and procedures relating to individual risk elements as well as the adequacy of risk measurement system, including any findings of internal/external auditors or consultants.

6.4 The reports should reflect all identified problem areas and set appropriate
time limit for corrective actions.
6.5 Breaches or exceptions to limits should be promptly reported to appropriate
authorities, using appropriately set policy on reporting procedure for breaches and actions to be taken.

6.6 Report detailing bank’s exposure to individual risk elements should be
reviewed by the board on a regular basis.
7.0 CONTROLLING INDIVIDUAL RISK ELEMENTS
7.1 Establishing and maintaining an effective system of internal control,
including the enforcement of official lines of authority and appropriate segregation of duties, is one of Management’s most important responsibilities. The bank’s internal control structure should, therefore, ensure the effectiveness of the process relating to the management of individual risk elements.

7.2 Persons responsible for risk monitoring and control procedures should be
independent of the functions they review. Key elements of internal control process include internal audit and review, and an effective risk limit structure.

7.3 Internal audit processes should include the need for each bank to review
and validate each step of individual risk measurement process or technique. External auditors or consultants can also be used for the review.
7.4 The review should take into account the following:-
a. Appropriateness of the bank’s individual risk measurement systems given the nature, scope and complexity of the bank’s activities; b. Accuracy or integrity of data being used in risk modelling;
c. Reasonableness of scenarios and assumptions; and
d. Validity of risk measurement calculations.
7.5 The control processes should also include determining and abiding by the
bank’s overall risk appetite and exposure limit in relation to its risk strategy.
7.6 Risk limits for business units should be compatible with the institution’s
strategies, risk management systems and risk tolerance.
7.7 Each risk taking unit must have procedures that are used to monitor
activities to ensure that they remain within approved limits at all times.
7.8 The report of regular independent reviews and evaluation of the system of
internal control should be forwarded to the supervisory authorities periodically.

8.0 RISK MANAGEMENT SYSTEM REVIEW MECHANISM
8.1 Each bank should develop a mechanism for assessing and reviewing its risk
management policies, processes and procedures for individual risk elements, at least quarterly, based on the main findings of the monitoring reports and the results of analysis of developments arising from external market changes and other environmental factors. The results of such review should be properly documented and reported to the Board for consideration and approval.
8.2 Each bank should carry out a self-assessment of its risk management
framework for each risk element and assign appropriate rating as regards the

quality of its systems and procedures. Such scores should be measured against industry, regulatory and international benchmarks.
9.0 SUPERVISORY FRAMEWORK
9.1 GUIDELINES AND POLICIES
9.1.1 The CBN will issue guidelines to banks to develop their respective risk
management policies and strategies.
9.1.2 The Supervisory Authorities will consider and assess the adequacy of each
bank’s risk management policies and strategies.
9.1.3 Banks will be required to review their risk management policies and strategies
on a regular basis as the need arises.
10.0 FRAMEWORK FOR ASSESSING THE ADEQUACY OF INDIVIDUAL BANK’S RISK
MANAGEMENT POLICY
10.1 The Supervisory Authorities, in assessing the adequacy of a bank’s risk management
system, will focus on the following, among others:
i) the bank’s size and nature of operations; ii) the bank’s standing in the market; iii) the bank’s Corporate Governance Environment in the area of :
¾ Calibre of directors;
¾ Effectiveness of supervision by the Board; ¾ Role of Board Risk Management Committee ¾ Commitment of senior management to compliance and corporate ethics ¾ Integrity, competence and independence of risk management functions ¾ Systems capabilities ¾ Loss database and Loss Reporting iv) the quality of the bank’s policies and systems for managing bank’s specific risks.

10.2 ON- AND OFF-SITE MONITORING OF BANKS’ COMPLIANCE WITH THEIR RISK
MANAGEMENT POLICIES

10.2.1 Regular reviews of periodic returns from banks will give a good indication of banks’
compliance with their policies and implementation of the strategies.
10.2.2 Examiners, at routine visits to the banks, will give their opinion as to whether the
operations of banks are being carried out in accordance with the banks’ risk management policies.
10.2.3 Ad-hoc verification spot checks will be conducted as and when necessary.

GLOSSARY
CREDIT RISK
Credit risk arises from the potential that an obligor is either unwilling to perform an obligation or its ability to perform such obligation is impaired, resulting in loss to the bank. In addition to direct accounting loss, credit risk should be viewed in the context of other economic exposures which include opportunity costs, transaction costs and expenses associated with non-performing assets over and above the accounting loss. MARKET RISK Market Risk is the risk that the value of on- and off-balance sheet positions of a bank will be adversely affected by movements in market rates or prices such as interest rates, foreign exchange rates, equity prices, credit spreads and/or commodity prices resulting in a loss to earnings and capital. Some of the common market risks in our environment include the following:
¾ INTEREST RATE RISK
Interest rate risk arises when there is a mismatch between positions, which are subject to interest rate adjustment within a specified period. Interest rate risk is usually assessed from two perspectives; Earnings perspective which focuses on the impact of variation in interest rate on accruals or reported earnings, and economic value perspective which reflects the impact of fluctuation in the interest rates on economic value of a financial institution. The interest rate risk also includes risks associated with the term structure of interest rates and basis risk. Basis Risk is also known as spread risk and it arises when a bank prices its assets and liabilities using different interest rate basis. On the other hand, risks associated with term structure of interest rates are also known as yield curve risk. The impact of shifts in the yield curve on earnings is evaluated using stress tests. ¾ FOREIGN EXCHANGE RISK Foreign exchange risk is the current or prospective risk to earnings and capital arising from adverse movements in currency exchange rates. Foreign

exchange risk may also arise as a result of exposures of banks to interest rate risk arising from the maturity mismatching of foreign currency positions.

¾ EQUITY PRICE RISK
Equity price risk is the risk to earnings or capital resulting from adverse changes in the value of equity related portfolios of a financial institution. The price risk could relate to changes in the overall level of equity prices or with price volatility that is determined by firm specific characteristics. OPERATIONAL RISK Operational Risk is the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. Operational risk is present in virtually all banking transactions and activities. LIQUIDITY RISK Liquidity risk is the potential loss to a bank arising from either its inability to meet its obligations as they fall due or to fund increases in assets without incurring unacceptable cost or losses. Liquidity risk should not be seen in isolation, because financial risks are not mutually exclusive and liquidity risk is often triggered by consequences of other bank risks such as credit, market and operational risks. KEY RISK INDICATOR A key risk indicator is a risk item that has been assessed to be important given all relevant factors. This indicator is used to monitor exposure to risks and could be quantitative or qualitative in nature. It should be forward looking in order to serve as an effective risk mitigant.