Risk Management Guidelines for Banks and Financial Institutions 2010

ugust, 2010
RISK MANAGEMENT GUIDELINES FOR
BANKS AND FINANCIAL INSTITUTIONS, 2010 Directorate of Banking Supervision Bank of Tanzania Dar es Salaam August, 2010

Risk Management Guidelines for Banks and Financial Institutions, 2010 2
TABLE OF CONTENTS PAGE
1.0 RISK MANAGEMENT GUIDELINES --------------------------------------------------- 5
1.1 INTRODUCTION -------------------------------------------------------------------------------------------- 5
1.2 OBJECTIVES AND RISK DESCRIPTIONS ------------------------------------------------------------------ 5
1.3 RISK MANAGEMENT PROGRAMMES -------------------------------------------------------------------- 7
1.4 RISK MANAGEMENT -------------------------------------------------------------------------------------- 7
1.5 RISK MANAGEMENT FRAMEWORK ---------------------------------------------------------------------- 8
1.5.2 Active Board and Senior Management Oversight ------------------------------------------- 8
1.5.3 Adequate Policies, Procedures and Limits ------------------------------------------------------- 9
1.5.4 Adequate Risk Measurement, Monitoring and Management Information Systems ---- 10
1.5.5 Adequate Internal Controls ----------------------------------------------------------------------------- 11
1.5.6 Role of Risk Management Function ----------------------------------------------------------------- 12
1.5.7 Independent Review --------------------------------------------------------------------------------------- 13
1.5.8 Integration of Risk Management --------------------------------------------------------------------- 14
1.5.9 Contingency Planning ------------------------------------------------------------------------------------- 14
2.0 CREDIT RISK MANAGEMENT GUIDELINES ----------------------------------------- 15
2.1 INTRODUCTION ------------------------------------------------------------------------------------------ 15
2.2 BOARD AND SENIOR MANAGEMENT’S OVERSIGHT ------------------------------------------------ 16
2.2.1 Board Oversight ----------------------------------------------------------------------------------------------- 16
2.2.2 Senior Management Oversight------------------------------------------------------------------------ 17
2.3. POLICIES, PROCEDURES AND LIMITS ----------------------------------------------------------------- 18
2.3.1 Credit Strategy------------------------------------------------------------------------------------------------- 18
2.3.2 Policies ------------------------------------------------------------------------------------------------------------- 18
2.3.3 Procedures ------------------------------------------------------------------------------------------------------- 19
2.3.4 Limit setting ------------------------------------------------------------------------------------------------------ 23
2.4 RISK MEASUREMENT, MONITORING AND MANAGEMENT INFORMATION SYSTEM --------------- 23
2.4.1 Measurement and Monitoring ------------------------------------------------------------------------- 23
2.4.2 Management Information System ------------------------------------------------------------------- 28
2.5 INTERNAL CONTROLS ----------------------------------------------------------------------------------- 29
2.5.1 Risk Review ------------------------------------------------------------------------------------------------------- 29
3.0 LIQUIDITY RISK MANAGEMENT GUIDELINES -------------------------------------- 30
3.1 INTRODUCTION ------------------------------------------------------------------------------------------ 30
3.2 BOARD AND SENIOR MANAGEMENT OVERSIGHT -------------------------------------------------- 31
3.2.1 Board Oversight ----------------------------------------------------------------------------------------------- 31
3.2.2 Senior Management Oversight------------------------------------------------------------------------ 32
3.2.3 Liquidity Management Structure --------------------------------------------------------------------- 32
3.3 POLICIES, PROCEDURES AND LIMITS ------------------------------------------------------------------ 33
3.3.1 Liquidity Risk Strategy --------------------------------------------------------------------------------------- 33
3.3.2 Liquidity Policies ----------------------------------------------------------------------------------------------- 34
3.3.3 Procedures and Limits -------------------------------------------------------------------------------------- 35
3.4 RISK MEASUREMENTS, MONITORING AND MANAGEMENT INFORMATION SYSTEM -------------- 35
3.4.5 Measurement and Monitoring of Liquidity Risk ------------------------------------------------ 36
3.4.6 Foreign Currency Liquidity Management -------------------------------------------------------- 40
3.4.7 Managing Market Access ------------------------------------------------------------------------------- 40
3.4.8 Review of Assumptions Utilized in Managing Liquidity ------------------------------------- 41
3.4.9 Management Information System ------------------------------------------------------------------- 41
3.5 INTERNAL CONTROLS ----------------------------------------------------------------------------------- 42
4.0 MARKET RISK MANAGEMENT GUIDELINES ---------------------------------------- 44

Risk Management Guidelines for Banks and Financial Institutions, 2010 3
4.1 INTRODUCTION ------------------------------------------------------------------------------------------ 44
4.2 BOARD AND SENIOR MANAGEMENT OVERSIGHT --------------------------------------------------- 44
4.2.2 Board Oversight ----------------------------------------------------------------------------------------------- 44
4.2.3 Senior Management Oversight------------------------------------------------------------------------ 45
4.3 POLICIES, PROCEDURES AND LIMITS ------------------------------------------------------------------ 46
4.3.1 Risk Management Strategy ----------------------------------------------------------------------------- 46
4.3.2 Risk Management Policies ------------------------------------------------------------------------------- 46
4.3.3 Risk Management Procedures ------------------------------------------------------------------------- 47
4.4 RISK MEASUREMENT, MONITORING AND MANAGEMENT INFORMATION SYSTEM -------------- 47
4.4.1 Processes and Systems------------------------------------------------------------------------------------ 47
4.4.2 Interest Rate Risk Measurement and Monitoring --------------------------------------------- 49
4.4.3 Foreign Exchange Risk Measurement and Monitoring ------------------------------------ 52
4.4.4. Hedging of Foreign Exchange Risk ------------------------------------------------------------------ 52
4.4.5 Stress Testing ---------------------------------------------------------------------------------------------------- 53
4.4.6 Management Information System ------------------------------------------------------------------- 54
4.5 INTERNAL CONTROLS ----------------------------------------------------------------------------------- 55
4.5.3 Lines of Responsibility and Authority ---------------------------------------------------------------- 55
5.0 OPERATIONAL RISK MANAGEMENT GUIDELINES --------------------------------- 58
5.1 INTRODUCTION ------------------------------------------------------------------------------------------ 58
5.2 BOARD AND SENIOR MANAGEMENT OVERSIGHT -------------------------------------------------- 60
5.2.2 Board Oversight ----------------------------------------------------------------------------------------------- 60
5.2.3 Senior Management Oversight------------------------------------------------------------------------ 61
5.3 POLICIES, PROCEDURES AND LIMITS ------------------------------------------------------------------ 62
5.3.4 Business Continuity and Disaster Recovery Plan ---------------------------------------------- 62
5.4 RISK MEASUREMENT, MONITORING AND MANAGEMENT INFORMATION SYSTEM --------------- 63
5.5 INTERNAL CONTROLS ----------------------------------------------------------------------------------- 67
6.0 STRATEGIC RISK MANAGEMENT GUIDELINES ------------------------------------- 69
6.1 INTRODUCTION ------------------------------------------------------------------------------------------ 69
6.2 BOARD AND SENIOR MANAGEMENT OVERSIGHT -------------------------------------------------- 71
6.3 POLICIES, PROCEDURES AND LIMITS ------------------------------------------------------------------ 72
6.4 RISK MEASUREMENT, MONITORING AND MANAGEMENT INFORMATION SYSTEM --------------- 73
6.4.1 Identification, Measurement and Monitoring of Strategic Risk ------------------------ 73
6.5 STRATEGIC RISK CONTROL ----------------------------------------------------------------------------- 74
7.0 COMPLIANCE RISK MANAGEMENT GUIDELINES --------------------------------- 76
7.1 INTRODUCTION ------------------------------------------------------------------------------------------ 76
7.2 BOARD AND SENIOR MANAGEMENT OVERSIGHT -------------------------------------------------- 77
7.2.1 Board Oversight ----------------------------------------------------------------------------------------------- 77
7.2.2 Senior Management Oversight------------------------------------------------------------------------ 78
7.3 POLICIES, PROCEDURES AND LIMITS ------------------------------------------------------------------ 79
7.5 INTERNAL CONTROLS ----------------------------------------------------------------------------------- 82
8.0 MAPPING OF INHERENT RISKS ONTO FUNCTIONAL AREAS/ACTIVITIES ---------- 83

Risk Management Guidelines for Banks and Financial Institutions, 2010 4 ABBREVIATIONS ALCO Asset/Liability Management Committee BOT Bank of Tanzania CFP Contingent Funds Plan MIS Management Information System RMGs Risk Management Guidelines RMP Risk Management Program SWOT Strengths, Weaknesses, Opportunities and Threats

Risk Management Guidelines for Banks and Financial Institutions, 2010 5
1.0 RISK MANAGEMENT GUIDELINES
1.1 Introduction
1.1.1 In the course of conducting banking business, banks and
financial institutions (hereinafter referred to as ‘institutions’) assume risks in order to realize returns on their investments. On the other hand, risks assumed have the potential to wipe out expected returns and may result into losses to the institutions. These losses could be either expected or unexpected. Expected losses are those that an institution knows with reasonable certainty will occur (e.g. the expected default rate of loan portfolio) and are typically reserved for in some manner. Unexpected losses are those associated with unforeseen events (e.g. losses due to a sudden downturn in economy, falling interest rates, natural disasters, or human action such as terrorism). Institutions rely on their capital as a buffer to absorb such losses.
1.1.2 Due to this fact, the need for effective risk management
framework in institutions cannot be over emphasized. Through effective risk management framework, institutions will be able to optimize their risk-return trade off.
1.2 Objectives and Risk Descriptions
1.2.1 Objectives
1.2.1.1 Bank of Tanzania (BOT) has legitimate interest in ensuring that
institutions operate in a safe and sound manner. This goal can be largely attained if institutions effectively manage their risks.
1.2.1.2 To enhance risk management practices among institutions, BOT
has decided to issue ‘Risk Management Guidelines for Banks and Financial Institutions’ (RMGs). The RMGs are based on international best practices in risk management. All institutions are therefore required to observe these guidelines in the course of conducting their businesses.
1.2.1.3. Issuance of RMGs is also in line with BOT’s intention of becoming
increasingly risk-focused in conducting onsite examinations and offsite surveillance. In conducting risk focused supervision, rating of an institution’s performance will take into account, among other factors, its risk management framework and ability to manage risks. Institutions are therefore, expected to become more risk-focused and their internal audit function should be risk￾focused in order to ensure robustness, efficiency and effectiveness of risk management systems and practices.

Risk Management Guidelines for Banks and Financial Institutions, 2010 6
1.2.2 Risk Description
1.2.2.1 These guidelines cover six most common risks in banking i.e.
credit, liquidity, market, operational, strategic and compliance risks. Description of these risks is as follows:
(a) Credit Risk: Credit risk arises from the potential that an obligor is either unwilling to perform on an obligation or its ability to perform such obligation is impaired resulting in economic loss to the institution. (b) Liquidity Risk: Liquidity risk is the potential for loss to an institution arising from either its inability to meet its obligations as they fall due or to fund increases in assets without incurring unacceptable cost or losses. Liquidity risk includes inability to manage unplanned decreases or changes in funding sources. Liquidity risk also arises from the failure to recognize or address changes in market conditions that affect the ability to liquidate assets quickly and with minimal loss in value. (c) Market Risk: Market risk is the risk of losses in on and off balance sheet positions as a result of adverse changes in market prices i.e. interest rates, foreign exchange rates, equity prices and commodity prices. Market risk exists in both trading and banking book. A trading book consists of positions in financial instruments and commodities held either with trading intent or in order to hedge other elements of the trading book. (d) Operational Risk: Operational risk is the current and prospective risk to earnings and capital arising from inadequate or failed internal processes, people and systems or from external events. (e) Strategic Risk: Strategic risk is the current and prospective impact on earnings, capital, reputation or good standing of an institution arising from poor business decisions, improper implementation of decisions or lack of response to industry, economic or technological changes. This risk is a function of the compatibility of an organization’s strategic goals, the business strategies developed to achieve these goals, the resources deployed to meet these goals and the quality of implementation. (f) Compliance Risk: Compliance risk is the current or prospective risk to earnings, capital and reputation arising from violations or non-compliance with laws, rules,

Risk Management Guidelines for Banks and Financial Institutions, 2010 7 regulations, agreements, prescribed practices, or ethical standards, as well as from incorrect interpretation of relevant laws or regulations. Institutions are exposed to Compliance risk due to relations with a great number of stakeholders, e.g. regulators, customers, counter parties, as well as, tax authorities, local authorities and other authorized agencies.
1.3 Risk Management Programmes
1.3.1 Institutions may have different risk management systems
depending on their sizes and complexity. Due to this, BOT requires each institution to prepare a comprehensive Risk Management Programme (RMP) tailored to its needs and circumstances under which it operates. The RMPs should be reviewed at least annually. It is expected that RMPs prepared by institutions should at minimum cover the six risks contained in these guidelines:
1.4 Risk Management
1.4.1 Risk Management is a discipline at the core of every institution
and encompasses all the activities that affect its risk profile. Risk management as commonly perceived does not mean minimizing risk; rather the goal of risk management is to optimize risk-reward trade-off. This can be achieved through putting in place an effective risk management framework which can adequately capture and manage all risks an institution is exposed to. Risk Management entails four key processes:
1.4.2 Risk Identification: In order to manage risks, an institution must
identify existing risks or risks that may arise from both existing and new business initiatives for example, risks inherent in lending activity include credit, liquidity, interest rate and operational risks. Risk identification should be a continuing process, and should occur at both the transaction and portfolio level.
1.4.3 Risk Measurement: Once risks have been identified, they should
be measured in order to determine their impact on the institution’s profitability and capital. This can be done using various techniques ranging from simple to sophisticated models. Accurate and timely measurement of risk is essential to effective risk management systems. An institution that does not have a risk measurement system has limited ability to control or monitor risk levels. An institution should periodically test to make sure that the measurement tools it uses are accurate. Good risk measurement systems assess the risks of both individual transactions and portfolios.

Risk Management Guidelines for Banks and Financial Institutions, 2010 8
1.4.4 Risk Control: After measuring risk, an institution should establish
and communicate risk limits through policies, standards, and procedures that define responsibility and authority. Institutions may also apply various mitigating tools in minimizing exposure to various risks. Institutions should have a process to authorize exceptions or changes to risk limits when warranted.
1.4.5 Risk Monitoring: Institutions should put in place an effective
management information system (MIS) to monitor risk levels and facilitate timely review of risk positions and exceptions. Monitoring reports should be frequent, timely, accurate, and informative and should be distributed to appropriate individuals to ensure action, when needed.
1.5 Risk Management Framework
1.5.1 A risk management framework encompasses the scope of risks to
be managed, the process/systems and procedures to manage those risks and the roles and responsibilities of individuals involved in risk management. The framework should be comprehensive enough to capture all risks an institution is exposed to and have flexibility to accommodate any change in business activities. Key elements of an effective risk management framework are:
(a) active board and senior management oversight; (b) adequate policies, procedures and limits; (c) adequate risk measurement, monitoring and management information systems; and (d) comprehensive internal controls.
1.5.2 Active Board and Senior Management Oversight
1.5.2.1 Boards of directors have ultimate responsibility for the level of risk
taken by their institutions. Accordingly, they should approve the overall business strategies and significant policies of their institutions, including those related to managing and taking risks, and should also ensure that senior management is fully capable of managing the activities that their institutions conduct. While all boards of directors are responsible for understanding the nature of the risks significant to their institutions and for ensuring that management is taking the steps necessary to identify, measure, monitor, and control these risks, the level of technical knowledge required of directors may vary depending on the particular circumstances at the institution.

Risk Management Guidelines for Banks and Financial Institutions, 2010 9
1.5.2.2 Directors should have a clear understanding of the types of risks
to which their institutions are exposed and should receive reports that identify the size and significance of the risks in terms that are meaningful to them. In addition, directors should take steps to develop an appropriate understanding of the risks their institutions face, possibly through briefings from auditors and experts external to the institution. Using this knowledge and information, directors should provide clear guidance regarding the level of exposures acceptable to their institutions and have the responsibility to ensure that senior management implements the procedures and controls necessary to comply with adopted policies.
1.5.2.3 Senior management is responsible for implementing strategies in
a manner that limits risks associated with each strategy and that ensures compliance with laws and regulations on both a long￾term and day-to-day basis. Accordingly, management should be fully involved in the activities of their institutions and possess sufficient knowledge of all major business lines to ensure that appropriate policies, controls, and risk monitoring systems are in place and that accountability and lines of authority are clearly delineated. Senior management is also responsible for establishing and communicating a strong awareness of and need for effective internal controls and high ethical standards. Meeting these responsibilities requires senior managers of an institution to have a thorough understanding of banking and financial market activities and detailed knowledge of the activities their institution conducts, including the nature of internal controls necessary to limit the related risks.

1.5.3 Adequate Policies, Procedures and Limits
1.5.3.1 An institution's directors and senior management should tailor
their risk management policies and procedures to the types of risks that arise from the activities the institution conducts. Once the risks are properly identified, the institution's policies and its more fully articulated procedures provide detailed guidance for the day-to-day implementation of broad business strategies, and generally include limits designed to shield the institution from excessive and imprudent risks. While all institutions should have policies and procedures that address their significant activities and risks, management is expected to ensure that they are modified when necessary to respond to significant changes in the institution's activities or business conditions.
1.5.3.2 To ensure that, an institution's policies, procedures, and limits are
adequate, the same should at minimum address the following:

Risk Management Guidelines for Banks and Financial Institutions, 2010 10 (i) policies, procedures, and limits should provide for adequate identification, measurement, monitoring, and control of the risks posed by its significant activities; (ii) policies, procedures, and limits should be consistent with complexity and size of the business, the institution's stated goals and objectives, and the overall financial strength of the institution; (iii) policies should clearly delineate accountability and lines of authority across the institution's activities; and (iv) policies should provide for the review of activities new to the institution to ensure that the infrastructures necessary to identify, monitor, and control risks associated with an activity are in place before the activity is initiated.
1.5.4 Adequate Risk Measurement, Monitoring and Management
Information Systems
1.5.4.1 Effective risk monitoring requires institutions to identify and
measure all material risk exposures. Consequently, risk monitoring activities must be supported by information systems that provide senior managers and directors with timely reports on the financial condition, operating performance, and risk exposure of the institution, as well as with regular and sufficiently detailed reports for line managers engaged in the day-to-day management of the institution's activities.
1.5.4.2 Institutions should have risk monitoring and management
information systems in place that provide directors and senior management with a clear understanding of the institution's positions and risk exposures.
1.5.4.3 In order to ensure effective measurement and monitoring of risk
and management information systems, the following should be observed:
(a) the institution's risk monitoring practices and reports address all of its material risks; (b) key assumptions, data sources, and procedures used in measuring and monitoring risk are appropriate and adequately documented and tested for reliability on an on￾going basis; (c) reports and other forms of communication are consistent with the institution's activities, structured to monitor

Risk Management Guidelines for Banks and Financial Institutions, 2010 11 exposures and compliance with established limits, goals, or objectives and, as appropriate, compare actual versus expected performance; and d) reports to management or to the institution's directors are accurate and timely and contain sufficient information for decision-makers to identify any adverse trends and to evaluate adequately the level of risk faced by the institution.
1.5.5 Adequate Internal Controls
1.5.5.1 An institution's internal control structure is critical to its safe and
sound functioning generally and to its risk management system, in particular. Establishing and maintaining an effective system of controls, including the enforcement of official lines of authority and the appropriate separation of duties such as trading, custodial, and back-office is one of management's more important responsibilities.
1.5.5.2 Indeed, appropriately segregating duties is a fundamental and
essential element of a sound risk management and internal control system. Failure to implement and maintain an adequate separation of duties can constitute an unsafe and unsound practice and possibly lead to serious losses or otherwise compromise the financial integrity of the institution. Serious lapses or deficiencies in internal controls, including inadequate segregation of duties, may warrant supervisory action.
1.5.5.3 When properly structured, a system of internal controls promotes
effective operations and reliable financial and regulatory reporting, safeguards assets, and helps to ensure compliance with relevant laws, regulations, and institutional policies. Internal controls should be tested by an independent internal auditor who reports directly either to the institution's board of directors or its audit committee. Given the importance of appropriate internal controls, the results of audits or reviews, whether conducted by an internal auditor or by other personnel, should be adequately documented, as should management's responses to them.
1.5.5.4 In order to ensure the adequacy of an institution's internal
controls and audit procedures, the following should be observed:
(a) the system of internal controls is appropriate to the type and level of risks posed by the nature and scope of the institution's activities;

Risk Management Guidelines for Banks and Financial Institutions, 2010 12 (b) the institution's organizational structure establishes clear lines of authority and responsibility for monitoring adherence to policies, procedures, and limits; (c) reporting lines provide sufficient independence of the control areas from the business lines and adequate separation of duties throughout the institution such as those relating to trading, custodial, and back-office activities; (d) official institutional structures reflect actual operating practices; (e) financial, operational, and regulatory reports are reliable, accurate, and timely; wherever applicable, exceptions are noted and promptly investigated; (f) adequate procedures exist for ensuring compliance with applicable laws and regulations; (g) internal audit or other control review practices provide for independence and objectivity; (h) internal controls and information systems are adequately tested and reviewed; the coverage, procedures, findings, and responses to audits and review tests are adequately documented; identified material weaknesses are given appropriate and timely high level attention; and management's actions to address material weaknesses are objectively verified and reviewed; and (i)the institution's audit committee or board of directors reviews the effectiveness of internal audits and other control review activities on a regular basis.
1.5.6 Role of Risk Management Function
1.5.6.1 Institutions should put in place a setup that supervises overall risk
management responsible for overseeing management of risks inherent in their operations. Such a setup could be in a form of risk manager, committee or department depending on the size and complexity of the institution. Overall risk management function should be independent from those who take or accept risks on behalf of the institution.
1.5.6.2 The risk management function is responsible for ensuring that
effective processes are in place for:
(i) identifying current and emerging risks;

Risk Management Guidelines for Banks and Financial Institutions, 2010 13 (ii)developing risk assessment and measurement systems; (iii) establishing policies, practices and other control mechanisms to manage risks; (iv) developing risk tolerance limits for Senior Management and board approval; (v) monitoring positions against approved risk tolerance limits; and (vi) reporting results of risk monitoring to Senior Management and the board.
1.5.6.3 However, it must not be construed that risk management is only
restricted to individual(s) responsible for overall risk management function. Business lines are equally responsible for the risks they are taking. Because line personnel, more than anyone else, understand the risks of the business, such a lack of accountability can lead to problems.
1.5.7 Independent Review
1.5.7.1 Institutions should ensure that there is an independent person(s)
responsible for reviewing the effectiveness of, and adherence to, the institution’s risk management policies and practices. These could be internal auditor, external auditors or any other person(s) who should be independent from risk taking units and should report directly to the board or its designated committee. To be effective the independent reviewer(s) should have sufficient authority, expertise and corporate stature so that the identification and reporting of their findings could be accomplished without hindrance. Such an independent reviewer should consider, among others, the following:
(a) whether the institution's risk management system is appropriate to the nature, scope, and complexity of the institution and its activities; (b) whether the institution has an independent risk management function; (c) whether the board of directors and senior management are actively involved in the risk management process; (d) whether policies, controls and procedures concerning risk management are well documented and complied with;

Risk Management Guidelines for Banks and Financial Institutions, 2010 14 (e) whether the assumptions of the risk measurement system are valid and well documented, data accurately processed, and data aggregation is proper and reliable; and (f) whether the institution has adequate staffing to conduct a sound risk management process.
1.5.8 Integration of Risk Management
1.5.8.1 Risks must not be viewed and assessed in isolation, not only
because a single transaction might have a number of risks but also one type of risk can trigger other risks. Since interaction of various risks could result in diminution or increase in risk, the risk management process should recognize and reflect risk interactions in all business activities as appropriate. While assessing and managing risk the management should have an overall view of risks the institution is exposed to. This requires having a structure in place to look at risk interrelationships across the institution.
1.5.9 Contingency Planning
1.5.9.1 Institutions should have a mechanism to identify stress situations
ahead of time and plans to deal with such unusual situations in a timely and effective manner. Stress situations to which this principle applies include risks of all types. For instance contingency planning activities include disaster recovery planning, public relations damage control, litigation strategy, responding to regulatory criticism, liquidity crisis, etc. Contingency plans should be reviewed regularly to ensure they encompass reasonably probable events that could impact the institution. Plans should be tested as to the appropriateness of responses, escalation and communication channels and the impact on other parts of the institution.

Risk Management Guidelines for Banks and Financial Institutions, 2010 15
2.0 CREDIT RISK MANAGEMENT GUIDELINES
2.1 Introduction
2.1.1 Credit risk arises from the potential that an obligor is either
unwilling to perform on an obligation or its ability to perform such obligation is impaired resulting in economic loss to the institution. Credit risk arises from on balance sheet claims such as loans and overdrafts as well as off balance sheet commitments such as guarantees, letters of credit, and derivative instruments. For most institutions, loans are the largest and most obvious source of credit risk.

2.1.2 In addition, an institution may also be exposed to credit risk when
dealing with foreign exchange operations. This may arise when a domestic borrower involved in export business fails to compete in foreign markets due to domestic currency appreciation and thus resulting in inability to repay the domestic loan.
2.1.3 In an institution’s portfolio, losses stem from outright default due
to inability or unwillingness of a customer or counter party to meet commitments in relation to lending, trading, settlement and other financial transactions. Alternatively, losses may result from reduction in portfolio value due to actual or perceived deterioration in credit quality. Credit risk emanates from an institution’s dealing with individuals, corporate, financial institutions or a sovereign.
2.1.4 Credit risk not necessarily occurs in isolation. The same source
that endangers credit risk for the institution may also expose it to other risk. For instance a bad portfolio may attract liquidity problems.
2.1.5 Common sources of credit problems are:
(a)Credit concentrations: these are viewed as any exposure where the potential losses are large relative to the institution’s capital, its total assets or, where adequate measures exist, the institution’s overall risk level. This may be in the form of single borrowers or counterparties, a group of connected counterparties, and sectors or industries, such as trade, agriculture, etc or in the form of common or correlated factors e.g. the Asian crisis demonstrated how close linkages among emerging markets under stress situations and correlation between market and credit risks as well as between those risks and liquidity risk, can produce widespread losses;

Risk Management Guidelines for Banks and Financial Institutions, 2010 16 (b)Credit process issues: Many credit problems reveal basic weaknesses in the credit granting and monitoring processes. While shortcomings in underwriting and management of credit exposures represent important sources of losses in institutions, many credit problems would have been avoided or mitigated by a strong internal credit process.
2.2 Board and Senior Management’s Oversight
2.2.1 Board Oversight
2.2.1.1 The board of directors has a critical role to play in overseeing the
credit-granting and credit risk management functions of the institution. It is the overall responsibility of institution’s board to approve institution’s credit risk strategy and significant policies relating to credit risk and its management which should be based on the institution’s overall business strategy. To keep them current, the overall strategy as well as significant policies have to be reviewed by the board, at least annually. The responsibilities of the board with regard to credit risk management shall, inter alia, include :
(a) describing the institution’s overall risk tolerance in relation to credit risk; (b) ensuring that institution’s significant credit risk exposure is maintained at prudent levels and consistent with the available capital; (c) setting up the overall lending authority structure and explicitly delegate credit sanctioning authority, where appropriate, to senior management and the credit committee; (d) ensuring that top management as well as individuals responsible for credit risk management possess sound expertise and knowledge to accomplish the risk management function; (e) ensuring that the institution implements sound fundamental principles that facilitate the identification, measurement, monitoring and control of credit risk; (f) ensuring that appropriate plans and procedures for credit risk management are in place;

Risk Management Guidelines for Banks and Financial Institutions, 2010 17 (g) ensuring that internal audit reviews the credit operations to assess whether or not the institution’s policies and procedures are adequate and being adhered to; (h) reviewing exposures to insiders and their related parties, including policies related thereto; (i) ratifying exposures exceeding the level of the management authority delegated to management and be aware of exposures that, while worthy of consideration ,are not within the ambits of existing credit policies of the institution; (j) reviewing trends in portfolio quality and the adequacy of institution’s provision for credit losses; and (k) outlining the content and frequency of management report to the board on credit risk management.
2.2.2 Senior Management Oversight
2.2.2.1 Management of institutions is responsible for implementing
institution’s credit risk management strategies and policies and ensuring that the procedures are put in place to manage and control credit risk and the quality of credit portfolio in accordance with these policies. The responsibilities of the Senior Management with regard to credit risk management shall include:
(a) developing credit policies and credit administration procedures as a part of overall credit risk management framework for approval by the board; (b) implementing credit risk management policies; (c) ensuring the development and implementation of appropriate reporting system with respect to the content, format, and frequency of information concerning the credit portfolio and the credit risk to permit the effective analysis and the sound and prudent management and control of existing and potential credit risk exposure; (d) monitoring and controlling the nature and composition of the institution’s portfolio; (e) monitoring the quality of credit portfolio and ensuring that portfolio is soundly and conservatively valued, uncollectible exposure written off and probable losses adequately provided for;

Risk Management Guidelines for Banks and Financial Institutions, 2010 18 (f) establishing internal controls including putting in place clear lines of accountability and authority to ensure effective credit risk management process; and (g) developing lines of communications to ensure the timely dissemination of credit risk management policies, procedures and other credit risk management information to all individuals involved in the process.

2.3. Policies, Procedures and Limits
2.3.1 Credit Strategy
2.3.1.1 The very first purpose of institution’s credit strategy is to determine
the risk appetite of the institution. Once it is determined the institution could develop a plan to optimize return while keeping credit risk within predetermined limits. The institution’s credit risk strategy thus should spell out:
(a) the institution’s plan to grant credit based on various client segments and products, economic sectors, geographical location, currency and maturity; (b) target market within each lending segment and level of diversification/concentration; and (c) pricing strategy.
2.3.1.2 It is essential that institutions give due consideration to their target
market while devising credit risk strategy. The credit procedures should aim to obtain an in depth understanding of the institution’s clients, their credentials & their businesses in order to fully know their customers.
2.3.1.3 The strategy should provide continuity in approach and take into
account cyclic aspect of country’s economy and the resulting shifts in composition and quality of overall credit portfolio. While the strategy would be reviewed periodically and amended, as deemed necessary, it should be viable in long term and through various economic cycles.
2.3.2 Policies
2.3.2.1 Credit policies establish framework for the making of investment
and lending decisions and reflect an institution’s tolerance for credit risk. To be effective, policies should be communicated in a timely fashion, and should be implemented through all levels of the institution by appropriate procedures. Any significant deviation/exception to these policies must be communicated to

Risk Management Guidelines for Banks and Financial Institutions, 2010 19 the senior management/board and corrective measures should be taken. At minimum credit policies should include:
(a) general areas of credit in which the institution is prepared to engage or is restricted from engaging such as type of credit facilities, type of collateral security, types of borrowers, geographical areas or economic sectors on which the institution may focus on; (b) detailed and formalized credit evaluation/ appraisal process, administration and documentation; (c) credit approval authority at various hierarchy levels including authority for approving exceptions such as credit extension beyond prescribed limits; (d) concentration limits on single counterparties and groups of connected counterparties, particular industries or economic sectors, geographical areas and specific products. Institutions should ensure that their own internal exposure limits comply with any prudential limits or restrictions set by BOT; (e) authority for approval of allowance for probable losses and write-offs; (f) credit pricing; (g) roles and responsibilities of units/staff involved in origination and management of credit; (h) guidelines on management of problem loans; and (i) the credit policy should explicitly provide guidance for internal rating systems including definition of each risk grade; criteria to be fulfilled while assigning a particular grade, as well as the circumstances under which deviations from criteria can take place.
2.3.2.2 In order to be effective, credit policies must be communicated
throughout the institution, implemented through appropriate procedures, and periodically revised to take into account changing internal and external circumstances.
2.3.3 Procedures
2.3.3.1 Credit Origination

Risk Management Guidelines for Banks and Financial Institutions, 2010 20
2.3.3.1.1 Establishing sound, well-defined credit-granting criteria is
essential to approving credit in a safe and sound manner. The criteria should set out who is eligible for credit and for how much, what types of credit are available, and under what terms and conditions the credits should be granted.
2.3.3.1.2 Institutions must receive sufficient information to enable a
comprehensive assessment of the true risk profile of the borrower or counterparty. At minimum, the factors to be considered and documented in approving credits must include:
(a) the purpose of the credit and source of repayment; (b) the integrity and reputation of the borrower or counterparty; (c) the current risk profile (including the nature and aggregate amounts of risks) of the borrower or counterparty and its sensitivity to economic and market developments; (d) the borrower’s repayment history and current capacity to repay, based on historical financial trends and cash flow projections; (e) a forward-looking analysis of the capacity to repay based on various scenarios; (f) the legal capacity of the borrower or counterparty to assume the liability; (g) for commercial credits, the borrower’s business expertise and the status of the borrower’s economic sector and its position within that sector; (h) the proposed terms and conditions of the credit, including covenants designed to limit changes in the future risk profile of the borrower; and (i) where applicable, the adequacy and enforceability of collateral or guarantees.
2.3.3.1.3 Once credit-granting criteria have been established, it is essential
for the institution to ensure that the information it receives is sufficient to make proper credit-granting decisions. This information may also serve as the basis for rating the credit under the institution’s internal rating system.
2.3.3.1.4 Institutions need to understand to whom they are granting credit.
Therefore, prior to entering into any new credit relationship, an

Risk Management Guidelines for Banks and Financial Institutions, 2010 21 institution must become familiar with the borrower or counterparty and be confident that they are dealing with an individual or organization of sound repute and creditworthiness. In particular, strict policies must be in place to avoid association with individuals involved in fraudulent activities and other crimes. This can be achieved through a number of ways, including asking for references from known parties, accessing credit reference bureau, and becoming familiar with individuals responsible for managing a company and checking their personal references and financial condition. However, an institution should not grant credit simply because the borrower or counterparty is familiar to them or is perceived to be highly reputable.
2.3.3.1.5 Institutions should have procedures to identify situations where, in
considering credits, it is appropriate to classify a group of borrowers as connected counterparties and, thus, as a single borrower. This would include aggregating exposures to groups of accounts, corporate or non-corporate, under common ownership or control or with strong connecting links (for example, common management, family ties).
2.3.3.1.6 In loan syndications, participants should perform their own
independent credit risk analysis and review of syndicate terms prior to committing to the syndication. Each institution should analyze the risk and return on syndicated loans in the same manner as other loans.
2.3.3.1.7 Institutions should assess the risk/return relationship in any credit as
well as the overall profitability of the account relationship. Credits should be priced in such a way as to cover all of the embedded costs and compensate the institution for the risks incurred. In evaluating whether, and on what terms, to grant credit, institutions need to assess the risks against expected return, factoring in, to the greatest extent possible, price and non-price (e.g. collateral, restrictive covenants, etc.) terms. In evaluating risk, institutions should also assess likely downside scenarios and their possible impact on borrowers or counterparties. A common problem among institutions is the tendency not to price a credit or overall relationship properly and therefore not receive adequate compensation for the risks incurred.
2.3.3.1.8 In considering potential credits, institutions must recognize the
necessity of establishing provisions for expected losses and holding adequate capital to absorb risks and unexpected losses. The institution should factor these considerations into credit￾granting decisions, as well as into the overall portfolio monitoring process.

Risk Management Guidelines for Banks and Financial Institutions, 2010 22
2.3.3.1.9 Institutions can utilize credit risk mitigants such as collateral,
guarantees, and credit derivatives or on balance sheet netting to help mitigate risks inherent in individual credits. However, credit transactions should be entered into primarily on the strength of the borrower’s repayment capacity. Credit risk mitigants should not be a substitute for a comprehensive assessment of the borrower or counterparty, nor can it compensate for insufficient information. It should be recognized that any credit enforcement actions (e.g. foreclosure proceedings) typically eliminate the profit margin on the transaction. In addition, institutions need to be mindful that the value of collateral may well be impaired by the same factors that have led to the diminished recoverability of the credit.
2.3.3.1.10 Institutions should have policies covering the acceptability of
various forms of collateral, procedures for the ongoing valuation of such collateral, and a process to ensure that collateral is, and continues to be, enforceable and realizable. With regard to guarantees, institutions should evaluate the level of coverage being provided in relation to the credit-quality and legal capacity of the guarantor. Institutions should only factor explicit guarantees into the credit decision and not those that might be considered implicit such as anticipated support from the government.
2.3.3.2 Approving New Credits and Extension of Existing Credits
2.3.3.2.1 In order to maintain a sound credit portfolio, an institution must
have an established formal evaluation and approval process for the granting of credits. Approvals should be made in accordance with the institution’s written guidelines and granted by the appropriate level of management. There should be a clear audit trail documenting that the approval process was complied with and identifying the individual(s) and/or committee(s) providing input as well as making the credit decision.
2.3.3.2.2 Each credit proposal should be subject to careful analysis by a
credit analyst with expertise commensurate with the size and complexity of the transaction. An effective evaluation process establishes minimum requirements for the information on which the analysis is to be based. There should be policies in place regarding the information and documentation needed to approve new credits, renew existing credits and/or change the terms and conditions of previously approved credits. The information received will be the basis for any internal evaluation or rating assigned to the credit and its accuracy and adequacy is critical to management making appropriate judgments about the acceptability of the credit.

Risk Management Guidelines for Banks and Financial Institutions, 2010 23
2.3.3.2.3 An institution’s credit-granting approval process should establish
accountability for decisions taken and designate who has the authority to approve credits or changes in credit terms.
2.3.3.2.4 A potential area of abuse arises from granting credit to
connected and related parties, whether companies or individuals. Consequently, it is important that institutions grant credit to such parties on an arm’s-length basis and that the amount of credit granted is monitored. Such controls should be implemented by requiring that the terms and conditions of such credits not be more favourable than credit granted to non-related borrowers under similar circumstances and by imposing strict limits on such credits.
2.3.3.2.5 Transactions with related parties should be subject to the
approval of the board of directors. Any board member who stands to benefit from that transaction should not be part of the approval process.
2.3.4 Limit setting
2.3.4.1 An important element of credit risk management is to establish
exposure limits for individual borrowers and counterparties and group of connected counterparties that aggregate in a comparable and meaningful manner different types of exposures, both in the banking and trading book as well as on and off balance sheet. Institutions are expected to develop their own limit structure while remaining within the exposure limits set by BOT. The size of the limits should be based on the credit strength of the counterparty, genuine requirement of credit, economic conditions and the institution’s risk tolerance. Limits should also be set for respective products, activities, specific industry, economic sectors and/or geographic regions to avoid concentration risk.
2.3.4.2 Credit limits should be reviewed regularly at least annually or
more frequently if counterparty’s credit quality deteriorates. All requests of increase in credit limits should be substantiated.
2.4 Risk Measurement, Monitoring and Management Information
System
2.4.1 Measurement and Monitoring
2.4.1.1 Institutions should have methodologies that enable them to
quantify the risk involved in exposures to individual borrowers or counterparties. Institutions should also be able to analyze credit risk at the product and portfolio level in order to identify any

Risk Management Guidelines for Banks and Financial Institutions, 2010 24 particular sensitivities or concentrations. The measurement of credit risk should take account of (i) the specific nature of the credit (loan, derivative, etc.) and its contractual and financial conditions (maturity, interest rate, etc); (ii) the exposure profile until maturity in relation to potential market movements; (iii) the existence of collateral or guarantees; and (iv) the potential for default based on the internal risk rating. The analysis of credit risk data should be undertaken at an appropriate frequency with the results reviewed against relevant limits. Institutions should use measurement techniques that are appropriate to the complexity and level of the risks involved in their activities, based on robust data, and subject to periodic validation.
2.4.1.2 Institutions’ management should conduct periodic stress tests of
its major credit risk concentrations and review the results of those tests to identify and respond to potential changes in market conditions that could adversely impact their performance.
2.4.1.3 Credit Administration
2.4.1.3.1 Credit administration is a critical element in maintaining the
safety and soundness of an institution. Once a credit is granted, it is the responsibility of the business function, often in conjunction with a credit administration support team, to ensure that the credit is properly maintained. This includes keeping the credit file up to date, obtaining current financial information, sending out renewal notices and preparing various documents such as loan agreements.
2.4.1.3.2 In developing their credit administration areas, institutions should
ensure:
(a) the efficiency and effectiveness of credit administration operations, including monitoring documentation, contractual requirements, legal covenants, collateral, etc; (b) the accuracy and timeliness of information provided to management information systems; (c) the adequacy of controls over all back office procedures; and (d) compliance with prescribed policies and procedures as well as applicable laws and regulations.
2.4.1.3.3 For the various components of credit administration to function
appropriately, senior management must understand and demonstrate that it recognizes the importance of this element of monitoring and controlling credit risk.

Risk Management Guidelines for Banks and Financial Institutions, 2010 25
2.4.1.3.4 The credit files should include all of the information necessary to
ascertain the current financial condition of the borrower or counterparty as well as sufficient information to track the decisions made and the history of the credit.
2.4.1.3.5 Institutions need to develop and implement comprehensive
procedures and information systems to monitor the condition of individual credits and single obligors across the institution’s various portfolios. These procedures need to define criteria for identifying and reporting potential problem credits and other transactions to ensure that they are subject to more frequent monitoring as well as possible corrective action, classification and/or provisioning.
2.4.1.3.6 An effective credit monitoring system will include measures to:
(a) ensure that the institution understands the current financial condition of the borrower or counterparty; (b) ensure that all credits are in compliance with existing covenants; (c) follow up of customer’s utilization of the approved credit lines; (d) ensure that projected cash flows on major credits meet debt servicing requirements; (e) ensure that, where applicable, collateral provides adequate coverage relative to the obligor’s current condition; and (f) identify and classify potential problem credits on a timely basis.
2.4.1.3.7 Institutions need to enunciate a system that enables them to
monitor quality of the credit portfolio on day-to-day basis and take remedial measures as and when any deterioration occurs. Such a system would enable an institution to ascertain whether loans are being serviced as per facility terms, the adequacy of provisions, the overall risk profile is within limits established by management and compliance of regulatory limits. Establishing an efficient and effective credit monitoring system would help senior management to monitor the overall quality of the total credit portfolio and its trends. Consequently, the management could fine tune or reassess its credit strategy /policy accordingly before encountering any major setback. The institutions credit policy should explicitly provide procedural guideline relating to

Risk Management Guidelines for Banks and Financial Institutions, 2010 26 credit risk monitoring. At the minimum it should lay down procedures relating to:
(a) the roles and responsibilities of individuals responsible for credit risk monitoring; (b) the assessment procedures and analysis techniques (for individual loans & overall portfolio); (c) the frequency of monitoring; (d) the periodic examination of collaterals and loan covenants; (e) the frequency of site visits; (f) the identification of any deterioration in any loan.
2.4.1.4 Internal Risk Rating and Provisioning
2.4.1.4.1 An important tool in monitoring the quality of individual credits,
as well as the total portfolio, is the use of an internal risk rating system. A well-structured internal risk rating system is a good means of differentiating the degree of credit risk in the different credit exposures of an institution. This will allow more accurate determination of the overall characteristics of the credit portfolio, concentrations, problem credits, and the adequacy of loan loss reserves. In determining loan loss reserves, institutions should ensure that BOT classifications criteria are the minimum.
2.4.1.4.2 Typically, an internal risk rating system categorizes credits into
various classes designed to take into account the gradations in risk. Simpler systems might be based on several categories ranging from satisfactory to unsatisfactory; however, more meaningful systems will have numerous gradations for credits considered satisfactory in order to truly differentiate the relative credit risk they pose. In developing their systems, institutions must decide whether to rate the riskiness of the borrower or counterparty, the risks associated with a specific transaction, or both.
2.4.1.4.3 Internal risk ratings are an important tool in monitoring and
controlling credit risk. In order to facilitate early identification, the institution’s internal risk rating system should be responsive to indicators of potential or actual deterioration in credit risk e.g. financial position and business condition of the borrower, conduct of the borrower’s accounts, adherence to loan covenants, value of collateral, etc. Credits with deteriorating

Risk Management Guidelines for Banks and Financial Institutions, 2010 27 ratings should be subject to additional oversight and monitoring, for example, through more frequent visits from credit officers and inclusion on a watch list that is regularly reviewed by senior management. The internal risk ratings can be used by line management in different departments to track the current characteristics of the credit portfolio and help determine necessary changes to the credit strategy of the institution. Consequently, it is important that the board of directors and senior management also receive periodic reports on the condition of the credit portfolios based on such ratings.
2.4.1.4.5 The ratings assigned to individual borrowers or counterparties at
the time the credit is granted must be reviewed on a periodic basis and individual credits should be assigned a new rating when conditions either improve or deteriorate. Because of the importance of ensuring that internal ratings are consistent and accurately reflect the quality of individual credits, responsibility for setting or confirming such ratings should rest with a credit review function independent of that which originated the credit concerned. It is also important that the consistency and accuracy of ratings is examined periodically by a function such as an independent credit review group.
2.4.1.5 Managing Problem Credits
2.4.1.5.1 The institution should establish a system that helps identify
problem loan ahead of time when there may be more options available for remedial measures. Once the loan is identified as problem, it should be managed under a dedicated remedial process.
2.4.1.5.2 Responsibility for such credits may be assigned to the originating
business function, a specialized workout section, or a combination of the two, depending upon the size and nature of the credit and the reason for its problems. When an institution has significant credit-related problems, it is important to segregate the workout function from the credit origination function. The additional resources, expertise and more concentrated focus of a specialized workout section normally improve collection results.
2.4.1.5.3 A problem loan management process encompasses the
following basic elements:
(a) Negotiation and follow-up: Proactive effort should be taken in dealing with obligors to implement remedial plans, by maintaining frequent contact and internal records of follow-up actions. Often rigorous efforts made at an early stage prevent institutions from litigations and loan losses.

Risk Management Guidelines for Banks and Financial Institutions, 2010 28 (b) Workout remedial strategies: Sometimes appropriate remedial strategies such as restructuring of loan facility, enhancement in credit limits or reduction in interest rates help improve obligor’s repayment capacity. However, it depends upon business condition, the nature of problems being faced and most importantly obligor’s commitment and willingness to repay the loan. While such remedial strategies often bring up positive results, institutions need to exercise great caution in adopting such measures and ensure that such a policy must not encourage obligors to default intentionally. The institution’s interest should be the primary consideration in case of such workout plans. It is important that competent authority approves such workout plans before their implementation. (c) Review of collateral and security documents: Institutions have to ascertain the loan recoverable amount by updating the values of available collateral with formal valuation. Security documents should also be reviewed to ensure the completeness and enforceability of contracts and collaterals/guarantees. (d) Status Report and Review: Problem credits should be subject to more frequent review and monitoring. The review should update the status and development of the loan accounts and progress of the remedial plans. Progress made on problem loans should be reported to the senior management.
2.4.2 Management Information System
2.4.2.1 The effectiveness of an institution’s credit risk measurement
process is highly dependent on the quality of management information systems. The information generated from such systems enables the board and all levels of management to fulfill their respective oversight roles, including determining the adequate level of capital that the institution should be holding. Therefore, the quality, detail and timeliness of information are critical. In particular, information on the composition and quality of the various portfolios, including on a consolidated basis, should permit management to assess quickly and accurately the level of credit risk that the institution has incurred through its various activities and determine whether the institution’s performance is meeting the credit risk strategy.
2.4.2.2 It is also important that institutions have a management
information system in place to ensure that exposures approaching risk limits are brought to the attention of senior management. All exposures should be included in a risk limit

Risk Management Guidelines for Banks and Financial Institutions, 2010 29 measurement system. The institution’s information system should be able to aggregate credit exposures to individual borrowers and counterparties and report on exceptions to credit risk limits on a meaningful and timely basis.
2.4.2.3 Institutions should have information systems in place that enable
management to identify any concentrations of risk within the credit portfolio. The adequacy of scope of information should be reviewed on a periodic basis by business line managers, senior management and the board of directors to ensure that it is sufficient to the complexity of the business.
2.5 Internal Controls
2.5.1 Risk Review
2.5.1.1 Institutions must establish a mechanism of independent, ongoing
assessment of credit risk management process. The purpose of such review is to assess the credit administration process, the accuracy of credit rating including adequacy of provisions for losses, and overall quality of credit portfolio. All facilities should be subjected to risk review at least quarterly. The results of such review should be properly documented and reported directly to the board, or its sub-committee.
2.5.1.2 Institutions should conduct credit review with updated
information on the obligor’s financial and business conditions, as well as conduct of account. Exceptions noted in the credit monitoring process should also be evaluated for impact on the obligor’s creditworthiness. Credit review should also be conducted on a consolidated group basis to factor in the business connections among entities in a borrowing group.
2.5.1.3 As stated earlier, credit review should be performed on quarterly
basis, however more frequent review should be conducted for new accounts where institutions may not be familiar with the obligor, and for classified or adverse rated accounts that have higher probability of default.

Risk Management Guidelines for Banks and Financial Institutions, 2010 30
3.0 LIQUIDITY RISK MANAGEMENT GUIDELINES
3.1 Introduction
3.1.1 Liquidity risk is the potential for loss to an institution arising from
either its inability to meet its obligations as they fall due or to fund increases in assets without incurring unacceptable cost or losses.
3.1.2 Liquidity risk is considered a major risk for institutions. It arises when
the cushion provided by the liquid assets are not sufficient enough to meet maturing obligations. In such a situation institutions often meet their liquidity requirements from the market. However conditions of funding through the market depend upon liquidity in the market and borrowing institution’s creditworthiness. Accordingly, an institution short of liquidity may have to undertake transactions at heavy cost resulting in a loss of earnings or in worst case scenario, the liquidity risk could result in bankruptcy of the institution if it is unable to undertake transactions even at current market prices.
3.1.3 Institutions with large off-balance sheet exposures or institutions,
which rely heavily on large corporate deposits, have relatively high level of liquidity risk. Further, institutions experiencing a rapid growth in assets should have major concerns for liquidity.
3.1.4 Liquidity risk should not be seen in isolation, because financial
risks are not mutually exclusive and liquidity risk is often triggered by consequences of other financial risks such as credit risk, interest rate risk, foreign exchange risk, etc. For instance, an institution increasing its credit risk through asset concentration may be increasing its liquidity risk as well. Similarly a large loan default or changes in interest rate can adversely impact an institution’s liquidity position. Further, if management misjudges the impact on liquidity of entering into a new business or product line, the institution’s strategic risk would increase.
3.1.5 An incipient liquidity problem may initially reveal in the institution's
financial monitoring system as a downward trend with potential long-term consequences for earnings or capital. Given below are some early warning indicators that may not necessarily always lead to liquidity problem for an institution; however, these have potential to ignite such a problem. Consequently, management needs to watch carefully such indicators and exercise further scrutiny/analysis wherever it deems appropriate. Examples of such internal indicators are:
(a) A negative trend or significantly increased risk in any area or product line;

Risk Management Guidelines for Banks and Financial Institutions, 2010 31 (b) Concentrations in either assets or liabilities; (c) Deterioration in quality of credit portfolio; (d) A decline in earnings performance or projections; (e) Rapid asset growth funded by volatile large deposit; (f) A large size of off-balance sheet exposure; and (g) Deteriorating third party evaluation about the institution.
3.1.6 Liquidity risk management involves not only analyzing institutions
on and off-balance sheet positions to forecast future cash flows, but also how the funding requirement would be met. The latter involves identifying the funding market the institution has access to, understanding the nature of those markets, evaluating institutions current and future use of the market and monitor signs of confidence erosion.
3.1.7 The formality and sophistication of risk management processes
established to manage liquidity risk should reflect the nature, size and complexity of an institution’s activities. Sound liquidity risk management employed in measuring, monitoring and controlling liquidity risk is critical to the viability of any institution. Institutions should have a thorough understanding of the factors that could give rise to liquidity risk and put in place mitigating controls.
3.2 Board and Senior Management Oversight
3.2.1 Board Oversight
3.2.1.1 The prerequisites of an effective liquidity risk management
include an informed board, capable management, staff having relevant expertise and efficient systems and procedures. It is primarily the duty of board of directors to understand the liquidity risk profile of the institution and the tools used to manage liquidity risk. The board has to ensure that the institution has necessary liquidity risk management framework and the institution is capable of dealing with uneven liquidity scenarios. The board should approve the strategy and significant policies related to the management of liquidity. Generally speaking responsibilities of the board include:
(a) providing guidance on the level of tolerance for liquidity risk;

Risk Management Guidelines for Banks and Financial Institutions, 2010 32 (b) appointing senior managers who have ability to manage liquidity risk and delegate to them the required authority to accomplish the job; (c) continuously monitoring the institution's performance and overall liquidity risk profile through reviewing various reports; and (d) ensuring that senior management takes the steps necessary to identify, measure, monitor and control liquidity risk.
3.2.2 Senior Management Oversight
3.2.2.1 Senior management is responsible for the implementation of
sound policies and procedures keeping in view the strategic direction and risk appetite specified by the board. To effectively oversee the daily and long-term management of liquidity risk, senior managers should:
(a) develop and implement procedures and practices that translate the board's goals, objectives, and risk tolerances into operating standards that are well understood by institution personnel and consistent with the board's intent; (b) adhere to the lines of authority and responsibility that the board has approved for managing liquidity risk; (c) oversee the implementation and maintenance of management information and other systems that identify, measure, monitor, and control the institution's liquidity risk; and (d) establish effective internal controls over the liquidity risk management process and ensure that the same is communicated to all staff.
3.2.3 Liquidity Management Structure
3.2.3.1 The responsibility for managing the overall liquidity of the
institution should be delegated to a specific, identified group within the institution. This may be in the form of an Asset Liability Committee (ALCO) comprised of senior management or the treasury function.
3.2.3.2 Since liquidity management is a technical job requiring
specialized knowledge and expertise, it is important that responsible officers not only have relevant expertise but also have a good understanding of the nature and level of liquidity

Risk Management Guidelines for Banks and Financial Institutions, 2010 33 risk assumed by the institution and the means to manage that risk.
3.2.3.3 It is critical that there be close links between those individuals
responsible for liquidity and those monitoring market conditions, as well as other individuals with access to critical information. This is particularly important in developing and analyzing stress scenarios.
3.3 Policies, Procedures and Limits
3.3.1 Liquidity Risk Strategy
3.3.1.1 Each institution should have an agreed liquidity strategy for the
day-to-day management of liquidity. The strategy should set out the general approach the institution will have to liquidity, including various quantitative and qualitative targets. This strategy should address the institution’s goal of protecting financial strength and the ability to withstand stressful events in the market place.
3.3.1.2 The liquidity risk strategy defined by board should enunciate
specific policies on particular aspects of liquidity risk management, such as:
(a) Composition of Assets and Liabilities: The strategy should outline the mix of assets and liabilities to maintain liquidity. Liquidity risk management and asset/liability management should be integrated to avoid high costs associated with having to rapidly reconfigure the asset liability profile from maximum profitability to increased liquidity. (b) Diversification and Stability of Liabilities: A funding concentration exists when a single decision or a single factor has the potential to result in a significant and sudden withdrawal of funds. Since such a situation could lead to an increased risk, the board of directors and senior management should specify guidance relating to funding sources and ensure that the institution has diversified sources of funding day-to-day liquidity requirements. An institution would be more resilient to tight market liquidity conditions if its liabilities were derived from more stable sources. To comprehensively analyze the stability of liabilities/funding sources the institution need to identify:
(i)liabilities that would stay with the institution under any circumstances;

Risk Management Guidelines for Banks and Financial Institutions, 2010 34 (ii) liabilities that run-off gradually if problems arise; and (iii) liabilities that run-off immediately at the first sign of problems. (c) Managing Liquidity in different currencies: The institution should have a strategy on how to manage liquidity in different currencies. (d) Dealing with liquidity disruptions: The institution should put in place a strategy on how to deal with the potential for both temporary and long-term liquidity disruptions. The strategy should take into account the fact that in crisis situations access to interbank market could be difficult as well as costly.
3.3.1.3 The liquidity strategy must be documented in a liquidity policy,
and communicated throughout the institution. The strategy should be evaluated periodically to ensure that it remains valid.
3.3.2 Liquidity Policies
3.3.2.1 Board of directors should ensure that there are adequate
policies to govern liquidity risk management process. While specific details vary across institutions according to the nature of their business, the key elements of any liquidity policy include:
(a) general liquidity strategy (short- and long-term), specific goals and objectives in relation to liquidity risk management, process for strategy formulation and the level within the institution it is approved; (b) roles and responsibilities of individuals performing liquidity risk management functions, including structural balance sheet management, pricing, marketing, contingency planning, management reporting, lines of authority and responsibility for liquidity decisions; (c) liquidity risk management tools for identifying, measuring, monitoring and controlling liquidity risk (including the types of liquidity limits and ratios in place and rationale for establishing limits and ratios); and (d) contingency plan for handling liquidity crises.
3.3.2.2 To be effective the liquidity policy must be communicated down
the line throughout the institution. It is important that the board and senior management ensure that policies are reviewed at least annually and when there are any material changes in the

Risk Management Guidelines for Banks and Financial Institutions, 2010 35 institution’s current and prospective liquidity risk profile. Such changes could stem from internal circumstances (e.g. changes in business focus) or external circumstances (e.g. changes in economic conditions).
3.3.2.3 Reviews provide the opportunity to fine-tune the institution’s
liquidity policies in light of the institution’s liquidity management experience and development of its business. Any significant or frequent exception to the policy is an important barometer to gauge its effectiveness and any potential impact on institution’s liquidity risk profile.
3.3.3 Procedures and Limits
3.3.3.1 Institutions should establish appropriate procedures, processes
and limits to implement their liquidity policies. The procedural manual should explicitly narrate the necessary operational steps and processes to execute the relevant liquidity risk controls. The manual should be periodically reviewed and updated to take into account new activities, changes in risk management approaches and systems.
3.4 Risk Measurements, Monitoring and Management Information
System
3.4.1 Besides the institutional structure discussed earlier, an effective
liquidity risk management include systems to identify, measure, monitor and control its liquidity exposures. Management should be able to accurately identify and quantify the primary sources of an institution's liquidity risk in a timely manner. To properly identify the sources, management should understand both existing as well as future risk that the institution can be exposed to. Management should always be alert for new sources of liquidity risk at both the transaction and portfolio levels.
3.4.2 Key elements of an effective risk management process include
an efficient MIS to measure, monitor and control existing as well as future liquidity risks and reporting them to senior management and the board of directors.
3.4.3 As far as information system is concerned various units related to
treasury activities and risk management function should be integrated. Furthermore, management should ensure proper and timely flow of information among front office, back office and middle office in an integrated manner; however, their reporting lines should be kept separate to ensure independence of these functions.

Risk Management Guidelines for Banks and Financial Institutions, 2010 36
3.4.4 Periodic reviews should be conducted to determine whether the
institution complies with its liquidity risk policies and procedures. Positions that exceed established limits should receive prompt attention of appropriate management and should be resolved according to the process described in approved policies. Periodic reviews of the liquidity management process should also address any significant changes in the nature of instruments acquired, limits, and internal controls that have occurred since the last review.
3.4.5 Measurement and Monitoring of Liquidity Risk
3.4.5.1 An effective measurement and monitoring process is essential for
adequately managing liquidity risk. At a very basic level, liquidity measurement involves assessing all of an institution’s cash inflows against its outflows to identify the potential for any net shortfalls going forward. This includes funding requirements for off-balance sheet commitments. A number of techniques can be used for measuring liquidity risk, ranging from simple calculations and static simulations based on current holdings to highly sophisticated modeling techniques. As all institutions are affected by changes in the economic climate and market conditions, the monitoring of economic and market trends is key to liquidity risk management.
3.4.5.2 An important aspect of managing liquidity is making
assumptions about future funding needs. While certain cash inflows and outflows can be easily calculated or predicted, institutions must also make assumptions about future liquidity needs, both in the very short-term and for longer time periods. One important factor to consider is the critical role an institution’s reputation plays in its ability to access funds readily and at reasonable terms. For that reason, institution staff responsible for managing overall liquidity should be aware of any information (such as an announcement of a decline in earnings or a downgrading by a rating agency) that could have an impact on market and public perceptions about the soundness of the institution.
3.4.5.3 An effective liquidity risk measurement and monitoring system
not only helps in managing liquidity in times of crisis but also optimize return through efficient utilization of available funds. Discussed below are some commonly used liquidity measurement and monitoring techniques that may be adopted by the institutions.
3.4.5.3.1 Contingency Funding Plans (CFP)

Risk Management Guidelines for Banks and Financial Institutions, 2010 37
3.4.5.3.1.1 In order to develop comprehensive liquidity risk management
framework, institutions should have in place plans to address stress scenarios. Such a plan commonly known as CFP is a set of policies and procedures that serves as a blue print for an institution to meet its funding needs in a timely manner and at a reasonable cost. A CFP is a projection of future cash flows and funding sources of an institution under market scenarios including aggressive asset growth or rapid liability erosion. To be effective it is important that a CFP should represent management’s best estimate of balance sheet changes that may result from a liquidity or credit event. A CFP can provide a useful framework for managing liquidity risk both short term and in the long term. Further, it helps to ensure that a financial institution can prudently and efficiently manage routine and extraordinary fluctuations in liquidity. The scope of the CFP is discussed in more detail below. For day-to-day liquidity risk management integration, liquidity scenarios will ensure that the institution is best prepared to respond to an unexpected problem. In this sense, a CFP is an extension of ongoing liquidity management and formalizes the objectives of liquidity management by ensuring:
(a) a reasonable amount of liquid assets are maintained; (b) measurement and projection of funding requirements during various scenarios; and (c) management of access to funding sources.
3.4.5.3.1.2 It is not always that liquidity crisis shows up gradually. In case of a
sudden liquidity stress, it is important for an institution to seem organized, candid, and efficient to meet its obligations to the stakeholders. Since such a situation requires a spontaneous action, institutions that already have plans to deal with such situation could address the liquidity problem more efficiently and effectively. A CFP can help ensure that institution management and key staff are ready to respond to such situations. Institution liquidity is very sensitive to negative trends in credit, capital, or reputation. Deterioration in the institution’s financial condition (reflected in items such as asset quality indicators, earnings, or capital), management composition, or other relevant issues may result in reduced access to funding.
3.4.5.3.1.3 The sophistication of a CFP depends upon the size, nature,
complexity of business, risk exposure, and institutional structure. To begin, the CFP should anticipate all of the institution's funding and liquidity needs by:

Risk Management Guidelines for Banks and Financial Institutions, 2010 38 (a) Analyzing and making quantitative projections of all significant on and off balance sheet funds flows and their related effects; (b) Matching potential cash flow sources and uses of funds; and (c) Establishing indicators that alert management to a predetermined level of potential risks.
3.4.5.3.1.4 The CFP should project the institution's funding position during
both temporary and long-term liquidity changes, including those caused by liability erosion. The CFP should explicitly identify, quantify, and rank all sources of funding by preference, such as:
(a) Reducing assets;
(b) Modification or increasing liability structure; and (c) Using other alternatives for controlling balance sheet changes.
3.4.5.3.1.5 The CFP should include asset side as well as liability side strategies
to deal with liquidity crises. The asset side strategy may include; whether to liquidate surplus money market assets, when to sell liquid or longer-term assets etc. While liability side strategies specify policies such as pricing policy for funding, the institution/dealer who could assist at the time of liquidity crisis, policy for early redemption request by retail customers, etc. A CFP should also indicate roles and responsibilities of various individuals at the time of liquidity crises and the management information system between management, ALCO, traders, and others.
3.4.5.3.1.6 This outline of the scope of a good CFP is by no means
exhaustive. Institutions should devote significant time and consideration to scenarios that are most likely given their activities.
3.4.5.3.2. Maturity Ladder
3.4.5.3.2.1 A maturity ladder is a useful device to compare cash inflows and
outflows both on a day-to-day basis and over a series of specified time periods. The number of time frames in such maturity ladder is of significant importance and up to some extent depends upon the nature of institution’s liabilities or sources of funds. Institutions, which rely on short term funding, will concentrate primarily on managing liquidity on very short term. Whereas, other institutions might actively manage their net

Risk Management Guidelines for Banks and Financial Institutions, 2010 39 funding requirement over a slightly longer period. In the short term, institution’s flow of funds could be estimated more accurately and also such estimates are of more importance as these provide an indication of actions to be taken immediately. Further, such an analysis for distant periods will maximize the opportunity for the institution to manage the gap well in advance before it crystallizes. Consequently, institutions should use short time frames to measure near term exposures and longer time frames thereafter. It is suggested that institutions calculate daily gap for next one or two weeks, monthly gap for next six months or a year and quarterly thereafter. While making an estimate of cash flows, the following aspects need attention:
(a) the funding requirement arising out of off- balance sheet commitments also need to be accounted for; (b) many cash flows associated with various products are influenced by interest rates or customer behavior. Institutions need to take into account behavioral aspects instead of contractual maturity. In this respect past experiences could give important guidance to make any assumption; (c) some cash flows may be seasonal or cyclical; and (d) management should also consider increases or decreases in liquidity that typically occur during various phases of an economic cycle.
3.4.5.3.2.2 While the institutions should have liquidity sufficient enough to
meet fluctuations in loans and deposits, as a safety measure institutions should maintain a margin of excess liquidity. To ensure that this level of liquidity is maintained, management should estimate liquidity needs in a variety of scenarios.
3.4.5.3.3 Liquidity Ratios and Limits
3.4.5.3.3.1 Institutions may use a variety of ratios to quantify liquidity. These
ratios can also be used to create limits for liquidity management. However, such ratios would be meaningless unless used regularly and interpreted taking into account qualitative factors. Ratios should always be used in conjunction with more qualitative information about borrowing capacity, such as the likelihood of increased requests for early withdrawals, decreases in credit lines, decreases in transaction size, or shortening of term funds available to the institution. To the extent that any asset-liability management decisions are based on financial ratios, an institution's asset-liability managers should understand how a ratio is constructed, the range of alternative information that can be

Risk Management Guidelines for Banks and Financial Institutions, 2010 40 placed in the numerator or denominator, and the scope of conclusions that can be drawn from ratios. Because ratio components as calculated by institutions are sometimes inconsistent, ratio-based comparisons of institutions or even comparisons of periods at a single institution can be misleading. Examples of ratios and limits that can be used are:
(a) Liability Concentration Ratios and Limits: Liability concentration ratios and limits help to prevent an institution from relying on too few providers or funding sources. Limits are usually expressed as a percentage of deposits or liabilities; and (b) Other Balance Sheet Ratios: Total loans/total deposits, liquid assets/demand liabilities, borrowed funds/total assets, etc are examples of common ratios used by institutions to monitor current and potential funding levels.
3.4.5.3.3.2 In addition to the statutory limits of liquid assets requirement and
cash reserve requirement, the board and senior management should establish limits on the nature and amount of liquidity risk they are willing to assume. The limits should be periodically reviewed and adjusted when conditions or risk tolerances change. When limiting risk exposure, senior management should consider the nature of the institution's strategies and activities, its past performance, the level of earnings, capital available to absorb potential losses, and the board's tolerance for risk. Balance sheet complexity will determine how much and what types of limits an institution should establish over daily and long￾term horizons. While limits will not prevent a liquidity crisis, limit exceptions can be early indicators of excessive risk or inadequate liquidity risk management.
3.4.6 Foreign Currency Liquidity Management
3.4.6.1 Each institution should have a measurement, monitoring and
control system for its liquidity positions in the major currencies in which it is active. In addition to assessing its aggregate foreign currency liquidity needs and the acceptable mismatch in combination with its domestic currency commitments, an institution should also undertake separate analysis of its strategy for each currency individually.
3.4.7 Managing Market Access
3.4.7.1 Each institution should periodically review its efforts to establish
and maintain relationships with liability holders, to maintain the diversification of liabilities, and aim to ensure its capacity to sell assets.

Risk Management Guidelines for Banks and Financial Institutions, 2010 41
3.4.8 Review of Assumptions Utilized in Managing Liquidity
3.4.8.1 Since an institution’s future liquidity position will be affected by
factors that cannot always be forecast with precision, assumptions need to be reviewed frequently to determine their continuing validity, especially given the rapidity of change in the markets.
3.4.9 Management Information System
3.4.9.1 An effective management information system (MIS) is essential
for sound liquidity management decisions. Information should be readily available for day-to-day liquidity management and risk control, as well as during times of stress. Data should be appropriately consolidated, comprehensive yet succinct, focused and available in a timely manner. Ideally, the regular reports an institution generates will enable it to monitor liquidity during a crisis; such reports would have to be prepared more frequently under a crisis situation. Managers should keep crisis monitoring in mind when developing liquidity MIS. There is usually a trade-off between accuracy and timeliness. Liquidity problems can arise very quickly, and effective liquidity management may require daily internal reporting. Since institution liquidity is primarily affected by large, aggregate principal cash flows, detailed information on every transaction may not improve analysis.
3.4.9.2 The management information system should be used to check
for compliance with the institution’s established policies, procedures and limits and with BOT’s prudential requirements on liquidity. Reporting of risk measures should be done on a timely basis and compare current liquidity exposures with any set limits. The information system should also enable management to evaluate the level of trends in the institution’s aggregate liquidity exposure.
3.4.9.3 Management should develop systems that can capture
significant information. The content and format of reports depend on an institution's liquidity management practices, risks, and other characteristics. Routine reports may include a list of large funds providers, a cash flow or funding gap report, a funding maturity schedule, and a limit monitoring and exception report. Day-to-day management may require more detailed information, depending on the complexity of the institution and the risks it undertakes. Management should regularly consider how best to summarize complex or detailed issues for senior management or the board. Besides, other types of information important for managing day-to-day activities and for understanding the institution's inherent liquidity risk profile include:

Risk Management Guidelines for Banks and Financial Institutions, 2010 42 (a) Asset quality and its trends; (b) Earnings projections; (c) The institution's general reputation in the market and the condition of the market itself; (d) The type and composition of the overall balance sheet structure; and (e) The type of new deposits being obtained, as well as its source, maturity, and price.
3.5 Internal Controls
3.5.1 Institutions should have adequate internal controls to ensure the
integrity of their liquidity risk management process. These internal controls should be an integral part of the institution’s overall system of internal control. They should promote effective and efficient operations, reliable financial and regulatory reporting, and compliance with relevant laws, regulations and institutional policies. An effective system of internal control for liquidity risk includes:
(a) a strong control environment;
(b) an adequate process for identifying and evaluating liquidity risk; (c) the establishment of control activities such as policies and procedures; (d) adequate information systems; and, (e) continual review of adherence to established policies and procedures.
3.5.2 With regard to control policies and procedures, attention should
be given to appropriate approval processes, limits, reviews and other mechanisms designed to provide a reasonable assurance that the institution's liquidity risk management objectives are achieved. Many attributes of a sound risk management process, including risk measurement, monitoring and control functions, are key aspects of an effective system of internal control. Institutions should ensure that all aspects of the internal control system are effective, including those aspects that are not directly
part of the risk management process.

Risk Management Guidelines for Banks and Financial Institutions, 2010 43
3.5.3 In addition, an important element of an institution's internal
control system over its liquidity risk management process is regular evaluation and review. This includes ensuring that personnel are following established policies and procedures, as well as ensuring that the procedures that were established actually accomplish the intended objectives. Such reviews and evaluations should also address any significant change that may impact on the effectiveness of controls. The board should ensure that all such reviews and evaluations are conducted regularly by individuals who are independent of the function being reviewed. When revisions or enhancements to internal controls are warranted, there should be a mechanism in place to ensure that these are implemented in a timely manner.

Risk Management Guidelines for Banks and Financial Institutions, 2010 44
4.0 MARKET RISK MANAGEMENT GUIDELINES
4.1 Introduction
4.1.1 Market risk refers to the risk to an institution resulting from
movements in market prices, in particular, changes in interest rates, foreign exchange rates, equity and commodity prices. Market risk is often propagated by other forms of financial risks such as credit and market liquidity risks. For example, a downgrading of the credit standing of an issuer could lead to a drop in the market value of securities issued by that issuer. Likewise, a major sale of a relatively illiquid security by another holder of the same security could depress the price of the security.
4.1.2 The market risk factors cited above are not exhaustive.
Depending on the instruments traded by an institution, exposure to other factors may also arise. The institution’s consideration of market risk should capture all risk factors that it is exposed to, and it must manage these risks soundly.
4.2 Board and Senior Management Oversight
4.2.1 Effective oversight by an institution's board of directors and senior
management is critical to a sound market risk management process. It is essential that these individuals are aware of their responsibilities with regard to market risk management and that they are capable of performing their roles in overseeing and managing market risk.
4.2.2 Board Oversight
4.2.2.1 The board of directors has the ultimate responsibility for
understanding the nature and the level of market risk taken by the institution. The board should approve broad business strategies and policies that govern or influence the market risk of the institution. It should review the overall objectives of the institution with respect to market risk and should ensure the provision of clear guidance regarding the level of risk acceptable to the institution. The board should also approve policies that identify lines of authority and responsibility for managing market risk exposures.
4.2.2.2 The board should ensure that senior management has sufficient
knowledge and is fully capable of managing market risk including taking the steps necessary to identify, measure, monitor, and control this risk. The board or a specific committee of the board should periodically review information that is

Risk Management Guidelines for Banks and Financial Institutions, 2010 45 sufficient in detail and timeliness to allow it to understand and assess the performance of senior management in monitoring and controlling market risk in compliance with the institution's board-approved policies. In addition, the board or one of its committees should periodically re-evaluate market risk management policies as well as overall business strategies that affect the market risk exposure of the institution.
4.2.2.3 The board of directors should be informed regularly of the market
risk exposure of the institution in order to assess the monitoring and controlling of such risk. Using this knowledge and information, directors should provide clear guidance regarding the level of exposures acceptable to their institution.
4.2.2.4 The board should review market risk policies in order to align
them with significant changes in internal and external environment. In absence of any uneven circumstances, it is expected that board would review these policies at least annually.
4.2.3 Senior Management Oversight
4.2.3.1 Senior management is responsible for developing policies and
procedures for managing market risk on both a long-term and day-to-day basis. It should maintain clear lines of authority and responsibility for managing and controlling this risk. It should implement strategies in a manner that limits risks associated with each strategy and that ensures compliance with laws and regulations. Management is also responsible for:
(a) setting appropriate limits on risk taking; (b) developing standards for valuing positions and measuring performance; (c) comprehensive market risk reporting and management review process; (d) effective internal controls and ethical standards; (e) developing and implementing procedures and practices that translate the board's goals, objectives, and risk tolerances into operating standards that are well understood by institution personnel and consistent with the board's intent; (f) adhering to the lines of authority and responsibility that the board has established for managing foreign exchange risk; and

Risk Management Guidelines for Banks and Financial Institutions, 2010 46 (g) oversee the implementation and maintenance of management information and other systems that identify, measure, monitor, and control the institution's market risk.
4.2.3.2 Market risk reports to senior management should provide
aggregate information as well as sufficient supporting detail to enable management to assess the sensitivity of the institution to changes in market conditions and other important risk factors. Senior management should also review periodically the institution’s market risk management policies and procedures to ensure that they remain appropriate and sound.
4.3 Policies, Procedures and Limits
4.3.1 Risk Management Strategy
4.3.1.1 Every institution should develop a sound and well informed
strategy to manage market risk. The strategy should first determine the level of market risk the institution is prepared to assume. Once its market risk tolerance is determined, the institution should develop a strategy that balances its business goals with its market risk appetite.
4.3.1.2 In setting its market risk strategy, an institution should consider the
following factors:
(a)economic and market conditions and their impact on market risk; (b)whether the institution has the expertise to profit in specific markets and is able to identify, monitor and control the market risk in those markets; and (c)the institution’s portfolio mix and how it would be affected if more market risk was assumed.
4.3.1.3 The institution’s market risk strategy should be periodically
reviewed and effectively communicated to the relevant staff. There should be a process to detect deviations from the approved market risk strategy and target markets. The Board of Directors and senior management should periodically review the institution’s market risk strategy taking into consideration its financial performance and market developments.
4.3.2 Risk Management Policies
4.3.2.1 An institution should formulate market risk policies which should
be approved by the Board. These policies should reflect the

Risk Management Guidelines for Banks and Financial Institutions, 2010 47 strategy of the institution, including its approach to controlling and managing market risk. The Board should approve any changes and exceptions to these policies.
4.3.2.2 Policies should be applied on a consolidated basis and, where
appropriate, to specific subsidiaries, affiliates or units within an institution. The policies should clearly:
(a)prescribe how market risk is measured and communicated to the Board; (b)spell out the process by which the Board decides on the maximum market risk the institution is able to take, as well as the frequency of review of risk limits; (c)delineate the lines of authority and the responsibilities of the Board, senior management and other personnel responsible for managing market risk; (d)set out the scope of activities of the business units assuming market risk; and (e)identify and set guidelines on market risk limit structure, delegation of approving authority for market risk limit setting and limit excesses, capital requirements, and investigation and resolution of irregular or disputed transactions.
4.3.3 Risk Management Procedures
4.3.3.1 An institution should establish appropriate procedures and
processes to implement the market risk policy and strategy. These should be documented in a manual and the staff responsible for carrying out the procedures should be familiar with the content of the manual. The manual should spell out the operational steps and processes for executing the relevant market risk controls. It should also be periodically reviewed and updated to take into account new activities, changes in systems and structural changes in the market. The procedures should cover all activities that are exposed to market risk.
4.4 Risk Measurement, Monitoring and Management Information System
4.4.1 Processes and Systems
4.4.1.1 An institution should establish a sound and comprehensive risk
management process. This should, among other things, comprise:
(a) a framework to identify, measure and monitor market risk;

Risk Management Guidelines for Banks and Financial Institutions, 2010 48 (b) an appropriately detailed structure of risk limits, guidelines and other parameters used to govern market risk taking; (c) an appropriate management information system (MIS) for controlling, monitoring and reporting market risk, including transactions between and with related parties; and (d) accounting policies on the treatment of market risk.
4.4.1.2 An institution should incorporate its market risk management
process into its overall risk management system. This would enable it to understand and manage its consolidated risk exposure more effectively. Where the institution is part of a financial services group, the risk management process should also be integrated with that of the group’s where practicable.
4.4.1.3 The risk management system should be commensurate with the
scope, size and complexity of an institution's trading and other financial activities and the market risks assumed. It should also enable the various market risk exposures to be accurately and adequately identified, measured, monitored and controlled. All significant risks should be measured and aggregated on an institution-wide basis.
4.4.1.4 An institution’s risk management system should be able to
quantify risk exposures and monitor changes in market risk factors (e.g. changes in interest rates, foreign exchange rates, and equity prices) and other market conditions on a daily basis. An institution whose risk levels fluctuate significantly within a trading day should monitor its risk profile on an intra-day basis. The risk management system should, wherever feasible, be able to assess the probability of future losses. It should also enable an institution to identify risks promptly and take quick remedial action in response to adverse changes in market factors.
4.4.1.6 An institution should ensure that its treasury and financial
derivative valuation processes are robust and independent of its trading function. Models and supporting statistical analyses used in valuations and stress tests should be appropriate, consistently applied, and have reasonable assumptions. These should be validated before deployment. Staff involved in the validation process should be adequately qualified and independent of the trading and model development functions. Models and analyses should be periodically reviewed to ascertain the completeness of position data, the accuracy of volatility, valuation and risk factor calculations, as well as the reasonableness of the correlation and stress test assumptions. More frequent reviews may be necessary

Risk Management Guidelines for Banks and Financial Institutions, 2010 49 if there are changes in models or in the assumptions resulting from developments in market conditions.
4.4.1.7 An institution should have a unit dedicated to the management
of market risks. Typically this is the responsibility of the Asset Liability Management Committee (ALCO). ALCO is usually responsible for developing and maintaining appropriate risk management policies and procedures, MIS reporting, limits, and oversight programmes. It should include senior management from each functional area that assumes and manages market risks. ALCO should meet on a frequency that is commensurate with the institution’s business activities. The terms of reference, composition, quorum and frequency of meetings should also be formalized and clearly documented.
4.4.2 Interest Rate Risk Measurement and Monitoring
4.4.2.1 In general, but depending on the complexity and range of
activities of the individual institution, institutions should have interest rate risk measurement systems that assess the effects of rate changes on both earnings and economic value. These systems should provide meaningful measures of an institution's current levels of interest rate risk exposure, and should be capable of identifying any excessive exposures that might arise.
4.4.2.2 Measurement systems should:
(a) assess all material interest rate risk associated with an institution's assets, liabilities, and OBS positions; (b) utilize generally accepted financial concepts and risk measurement techniques; and (c) have well documented assumptions and parameters.
4.4.2.3 As a general rule, it is desirable for any measurement system to
incorporate interest rate risk exposures arising from the full scope of an institution's activities, including both trading and non￾trading sources. This does not preclude different measurement systems and risk management approaches being used for different activities; however, management should have an integrated view of interest rate risk across products and business lines.
4.4.2.4 An institution's interest rate risk measurement system should
address all material sources of interest rate risk including re￾pricing, yield curve, basis and option risk exposures. In many cases, the interest rate characteristics of an institution's largest holdings will dominate its aggregate risk profile. While all of an

Risk Management Guidelines for Banks and Financial Institutions, 2010 50 institution's holdings should receive appropriate treatment, measurement systems should evaluate such concentrations with particular rigor. Interest rate risk measurement systems should also provide rigorous treatment of those instruments, which might significantly affect an institution's aggregate position, even if they do not represent a major concentration. Instruments with significant embedded or explicit option characteristics should receive special attention.
4.4.2.5 A number of techniques are available for measuring the interest
rate risk exposure of both earnings and economic value. Their complexity ranges from simple calculations to static simulations using current holdings to highly sophisticated dynamic modeling techniques that reflect potential future business and business decisions.
4.4.2.6 The simplest techniques for measuring an institution's interest rate
risk exposure begin with a maturity/re-pricing schedule that distributes interest-sensitive assets, liabilities and OBS positions into "time bands" according to their maturity (if fixed rate) or time remaining to their next re-pricing (if floating rate). These schedules can be used to generate simple indicators of the interest rate risk sensitivity of both earnings and economic value to changing interest rates. When this approach is used to assess the interest rate risk of current earnings, it is typically referred to as gap analysis. The size of the gap for a given time band - that is, assets minus liabilities plus OBS exposures that re-price or mature within that time band - gives an indication of the institution's re-pricing risk exposure.
4.4.2.7 A maturity/re-pricing schedule can also be used to evaluate the
effects of changing interest rates on an institution's economic value by applying sensitivity weights to each time band. Typically, such weights are based on estimates of the duration of the assets and liabilities that fall into each time-band, where duration is a measure of the percent change in the economic value of a position that will occur given a small change in the level of interest rates. Duration-based weights can be used in combination with a maturity/re-pricing schedule to provide a rough approximation of the change in an institution's economic value that would occur given a particular set of changes in market interest rates.
4.4.2.8 More sophisticated interest rate risk measurement systems
include Simulation Techniques. Simulation techniques typically involve detailed assessments of the potential effects of changes in interest rates on earnings and economic value by simulating the future path of interest rates and their impact on cash flows. In static simulations, the cash flows arising solely from the institution's

Risk Management Guidelines for Banks and Financial Institutions, 2010 51 current on and off-balance sheet positions are assessed. In a dynamic simulation approach, the simulation builds in more detailed assumptions about the future course of interest rates and expected changes in an institution's business activity over that time. These more sophisticated techniques allow for dynamic interaction of payments streams and interest rates, and better capture the effect of embedded or explicit options.
4.4.2.9 Regardless of the measurement system, the usefulness of each
technique depends on the validity of the underlying assumptions and the accuracy of the basic methodologies used to model interest rate risk exposure. In designing interest rate risk measurement systems, institutions should ensure that the degree of detail about the nature of their interest-sensitive positions is commensurate with the complexity and risk inherent in those positions. For instance, using gap analysis, the precision of interest rate risk measurement depends in part on the number of time bands into which positions are aggregated. Clearly, aggregation of positions/cash flows into broad time bands implies some loss of precision. In practice, the institution must assess the significance of the potential loss of precision in determining the extent of aggregation and simplification to be built into the measurement approach.
4.4.2.10 Estimates of interest rate risk exposure, whether linked to earnings
or economic value, utilize, in some form, forecasts of the potential course of future interest rates. For risk management purposes, institutions should incorporate a change in interest rates that is sufficiently large to encompass the risks attendant to their holdings. Institutions should consider the use of multiple scenarios, including potential effects in changes in the relationships among interest rates (i.e. yield curve risk and basis risk) as well as changes in the general level of interest rates. For determining probable changes in interest rates, simulation techniques could be used. Statistical analysis can also play an important role in evaluating correlation assumptions with respect to basis or yield curve risk.
4.4.2.11 In assessing the results of interest rate risk measurement systems, it
is important that the assumptions underlying the system are clearly understood by risk managers and institution management. In particular, techniques using sophisticated simulations should be used carefully so that they do not become "black boxes", producing numbers that have the appearance of precision, but that in fact are not very accurate when their specific assumptions and parameters are revealed. Key assumptions should be recognized by senior management and risk managers and should be re-evaluated at least annually. They should also be clearly documented and their significance

Risk Management Guidelines for Banks and Financial Institutions, 2010 52 understood. Assumptions used in assessing the interest rate sensitivity of complex instruments and instruments with uncertain maturities should be subject to particularly rigorous documentation and review.
4.4.3 Foreign Exchange Risk Measurement and Monitoring
4.4.3.1 Managing foreign exchange risk requires a clear understanding
of the amount at risk and the impact of changes in exchange rates on this foreign currency exposure. To make these determinations, sufficient information must be readily available to permit appropriate action to be taken within acceptable, often very short, time periods.
4.4.3.2 Institutions may use various techniques to measure exposure to
foreign exchange risk. One approach could be through setting limits on the size of the net open position in each currency in which the institution is authorized to have exposure and the aggregate of all currencies. This may be expressed as a percentage of core capital or total assets. Other approaches could be through the use of ratios such as:
(a) foreign currency assets to foreign currency liabilities; (b) change in net open position; (c) growth in international assets/liabilities; and (d) growth in off-balance sheet business.
4.4.4. Hedging of Foreign Exchange Risk
4.4.4.1 The use of hedging techniques is one means of managing and
controlling foreign exchange risk. In this regard, many different financial instruments can be used for hedging purposes; the most commonly used, however, are derivative instruments. Examples include forward foreign exchange contracts, foreign currency futures contracts, foreign currency options, and foreign currency swaps.
4.4.4.2 Each institution should consider which techniques are
appropriate for the nature and extent of its foreign exchange risk activities, the skills and experience of management, and the capacity of foreign exchange risk reporting and control systems.
4.4.4.3 Financial instruments used for hedging are not distinguishable in
form from instruments that may be used to take risk positions. Before using hedging products, institutions must ensure that they understand the hedging technique and that they are satisfied

Risk Management Guidelines for Banks and Financial Institutions, 2010 53 that the instrument meets their specific hedging needs in a cost￾effective manner.
4.4.4.4 Further, the effectiveness of hedging activities should be
assessed not only on the basis of the technical attributes of individual transactions, but also in the context of the overall risk exposure of the institution resulting from a potential change in asset/liability mix and other risk exposures such as credit and foreign exchange risks. For example, foreign exchange swaps involve the replacement of foreign exchange risk by credit risk (the risk that the counterparty to the swap may be unable to fulfill its obligations).
4.4.4.5 In this context, hedging activities need to take place within the
framework of a clear hedging strategy, the implications of which are well understood by the institution under varying market scenarios. In particular, the objectives and limitations of using hedging products should be uniformly understood, so as to ensure that hedging strategies result in an effective hedge of an exposure rather than the unintentional assumption of additional or alternate forms of risk.
4.4.4.6 Before an institution is engaged in derivative instruments, either
for hedging or position-taking, it must ensure that appropriate policies and procedures, as well as the capability to implement them are in place.
4.4.5 Stress Testing
4.4.5.1 The market risk management process should, where appropriate,
include regular scenario analysis and stress tests. An institution may choose scenarios based on either analyzing historical data or empirical models of changes in market risk factors. The objective should be to allow the institution to assess the effects of sizeable changes in market risk factors on its holdings and financial condition. Hence, scenarios chosen could include low probability adverse scenarios that could result in extraordinary losses. Scenario analysis and stress tests should be both quantitative and qualitative.
4.4.5.2 Scenario analysis and stress testing should, as far as possible, be
conducted on an institution-wide basis, taking into account the effects of unusual changes in market and non-market risk factors. Such factors include prices, volatilities, market liquidity, historical correlations and assumptions in stressed market conditions, the institution’s vulnerability to worst case scenarios or the default of a large counterparty and maximum cash inflow and outflow assumptions.

Risk Management Guidelines for Banks and Financial Institutions, 2010 54
4.4.5.3 Scenario analysis and stress testing would enable the Board and
senior management to better assess the potential impact of various market-related changes on the institution’s earnings and capital position. The Board and senior management should regularly review the results of scenario analyses and stress testing, including the major assumptions that underpin them. The results should be considered during the establishment and review of policies and limits. Depending on the potential losses projected by the scenario analysis and stress tests and the likelihood of such losses occurring, the Board and senior management may consider additional measures to manage the risks or introduce contingency plans.
4.4.6 Management Information System
4.4.6.1 An accurate, informative, and timely management information
system is essential for managing market risk exposure, both to inform management and to support compliance with board policy. Reporting of risk measures should be regular and should clearly compare current exposure to policy limits. In addition, past forecasts or risk estimates should be compared with actual results to identify any shortcomings.
4.4.6.2 Reports detailing the market risk exposure of the institution should
be reviewed by the board on a regular basis. While the types of reports prepared for the board and for various levels of management will vary based on the institution’s market risk profile, they should, at a minimum include the following:
(a) summaries of the institution's aggregate market risk exposures (i.e. interest rate and foreign exchange exposures); (b) results of stress tests for market risk including those assessing breakdowns in key assumptions and parameters; (c) foreign exchange exposure reports by currency and in aggregate; (d) maturity distribution by currency of foreign currency denominated assets and liabilities including off balance sheet contingencies; (e) summaries of the findings of reviews of market risk policies, procedures, and the adequacy of the interest rate risk measurement systems, including any findings of internal and external auditors or any other independent reviewer; (f) list of outstanding contracts amounts by settlement date and currency both spot and forward;

Risk Management Guidelines for Banks and Financial Institutions, 2010 55 (g) reports demonstrating compliance with internal policies and prudential limits on market risk including exceptions; and (h) daily foreign exchange operations gain/loss, in comparison with previous day’s results.
4.5 Internal Controls
4.5.1 Institutions should have adequate internal controls to ensure the
integrity of their market risk management process. These internal controls should be an integral part of the institution's overall system of internal controls. They should promote effective and efficient operations, reliable financial and regulatory reporting, and compliance with relevant laws, regulations and institutional policies. An effective system of internal controls for market risk should ensure that:
(a) there is a strong control environment; (b) an adequate process for identifying and evaluating risk is in place; (c) there are adequate control tools such as policies, procedures and methodologies; and (d) there is an effective management information system.
4.5.2 Limits for market risks that are consistent with the maximum
exposures authorized by the Board and senior management should be set. An independent risk management function should be established, with the responsibility for defining risk management policies, setting procedures for market risk identification, measurement and assessment, and monitoring the institution's compliance with established policies and market risk limits. It should also ensure that market risk exposures are reported in a timely manner to the Board and senior management. Risk management staff should be separate from and independent of position-taking staff. Institutions should have their measurement, monitoring and control functions reviewed on a regular basis by an independent party. It is essential that any independent reviewer ensures that the institution's risk measurement system is sufficient to capture all material elements of market risk, whether arising from on- or off￾balance sheet activities.
4.5.3 Lines of Responsibility and Authority

Risk Management Guidelines for Banks and Financial Institutions, 2010 56
4.5.3.1 Care should be taken to ensure that there is adequate
separation of duties in key elements of the risk management process to avoid potential conflicts of interest. Management should ensure that sufficient safeguards exist to minimize the potential that individuals initiating risk-taking positions may inappropriately influence key control functions of the risk management process such as the development and enforcement of policies and procedures, the reporting of risks to senior management, and the conduct of back-office functions. The nature and scope of such safeguards should be in accordance with the size and structure of the institution. They should also be commensurate with the volume and complexity of market risk incurred by the institutions and the complexity of its transactions and commitments.
4.5.3.2 Although the controls over market risk will vary among institutions
depending on the nature and extent of their activities, the key elements of any control program are well-defined procedures governing:
(a) organizational controls to ensure that there exists a clear and effective segregation of duties between those persons who initiate transactions and those who are responsible for operational functions such as arranging prompt and accurate settlement, and timely exchanging and reconciliation of confirmations, or account for market activities; (b) procedural controls to ensure that:
(i) transactions are fully recorded in the records and accounts of the institution; (ii) transactions are correctly settled; and (iii) unauthorized dealing is promptly identified and reported to management; (c) controls to ensure that market activities are monitored frequently against the institution's market risk, counterparty and other limits and that excesses are reported; and (d) controls to ensure institution’s compliance with applicable laws and regulations.
4.5.3.3 Independent audits are a key element in managing and
controlling an institution's market risk management program. Each institution should use them to ensure compliance with, and the integrity of, the market risk policies and procedures.

Risk Management Guidelines for Banks and Financial Institutions, 2010 57 Independent audits should, over a reasonable period of time, test the institution's market risk management activities in order to:
(a) ensure market risk management policies and procedures are being adhered to; (b) ensure effective management controls over market positions; (c) verify the adequacy and accuracy of management information reports regarding the institution's market risk management activities; (d) ensure that personnel involved in market risk management are provided with accurate and complete information about the institution's market risk policies and risk limits and have the expertise required to make effective decisions consistent with the risk management policies.
4.5.3.4 Assessments of the market risk operations should be presented to
the institution's board of directors for review on a timely basis. Identified material weaknesses should be given appropriate and timely high level attention and management's actions to address those weaknesses should be objectively verified and reviewed.

Risk Management Guidelines for Banks and Financial Institutions, 2010 58
5.0 OPERATIONAL RISK MANAGEMENT GUIDELINES
5.1 Introduction
5.1.1 Globalization of financial services, together with increased
financial innovation, are making the activities of institutions and their risk profiles (i.e. the level of risk across an institution’s activities and/or risk categories) more complex. Due to these developments, operational risk is becoming more pronounced. Examples of these developments include:
(a) The increased use of highly automated technology which has the potential to transform risks from manual processing errors to system failure risks, as greater reliance is placed on automated systems; (b) Growth of e-banking brings with it potential risks (e.g. internal and external fraud and system security issues) that are not yet fully understood; (c) Acquisitions, mergers, and consolidations bringing the risk of system incompatibility and loss of staff morale; (d) Engagement in risk mitigation techniques (e.g. collateral and derivatives) by institutions to optimize their exposure to market risk and credit risk, but which in turn may produce other forms of risk (e.g. legal risk); and (e) Growing use of outsourcing arrangements and the participation in clearing and settlement systems, which can mitigate some risks but can also present other significant risks to institutions.
5.1.2 The diverse set of risks resulting from the above developments
can be grouped under the heading of ‘operational risk’, which is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.
5.1.3 Operational risk is a term that has a variety of meanings within
the banking industry. Whatever the exact definition, a clear understanding by institutions of what is meant by operational risk is critical to the effective management and control of this risk category. It is also important that the definition considers the full range of material operational risks facing the institution and captures the most significant causes of severe operational losses.
5.1.4 Operational risk may arise from a number of sources as follows:

Risk Management Guidelines for Banks and Financial Institutions, 2010 59 (a) People: Events that may result into substantial loss include frauds like intentional misreporting of positions, employee theft, insider dealings, robbery, forgery, cheque kiting, and damage from computer hacking. Some of the contributing factors are as follows:
(i) Lack of adequate skills and knowledge; (ii) Inadequate training and development; (iii) Improperly aligned compensation schemes and incentives; (iv)Lack of understanding of performance standards or expectations; and (v) Inadequate human resource control (including supervision and segregation of incompatible duties) (b) Internal processes and systems: Business disruption and system failures such as hardware and software failures, telecommunication problems, and utility outages, data entry errors, collateral management failures, unapproved access given to client accounts, non-client counterparty misperformance, and vendor disputes are examples of operational risk resulting from internal processes and systems. Some of the contributing factors are as follows:
(i) Damage to physical assets;
(ii) Inadequate or obsolete technology; (iii) Lack of proper documentation; (iv) Lack of or inadequate policies, procedures and controls; (v) Poor management information system; and (vi) Lack of or inadequate contingent plans. (c) External events: Terrorism, vandalism, earthquakes, fires and floods are examples of events that may cause operational risk in an institution.
5.1.5 It is clear that operational risk differs from other risks in that it is
typically not directly taken in return for an expected reward, but exists in the natural course of corporate activity, and that this affects the risk management process. At the same time, failure to properly manage operational risk can result in a misstatement of

Risk Management Guidelines for Banks and Financial Institutions, 2010 60 an institution’s risk profile and expose the institution to significant losses.
5.2 Board and Senior Management Oversight
5.2.1 Failure to understand and manage operational risk, which is
present in virtually all transactions and activities, may greatly increase the likelihood that some risks will go unrecognized and uncontrolled. Board and senior management are responsible for creating an organizational culture that places high priority on effective operational risk management and adherence to sound operating controls. Operational risk management is most effective where an institution’s culture emphasizes high standards of ethical behaviour at all levels of the institution. The board and senior management should promote an organizational culture, which establishes through both actions and words the expectations of integrity for all employees in conducting the business of the institution.
5.2.2 Board Oversight
5.2.2.1 Boards of directors have ultimate responsibility for the level of
operational risk taken by their institutions. The board of directors should approve the implementation of an institution-wide framework to explicitly manage operational risk as a distinct risk to the institution’s safety and soundness. The board should provide senior management with clear guidance and direction regarding the principles underlying the framework and approve the corresponding policies developed by senior management.
5.2.2.2 An operational risk framework should be based on an
appropriate definition of operational risk, which clearly articulates what constitutes operational risk in that institution. The framework should cover the institution’s tolerance for operational risk, as specified through the policies for managing this risk and the institution’s prioritization of operational risk management activities, including the extent of, and manner in which, operational risk is transferred outside the institution. It should also include policies outlining the institution’s approach to identifying, assessing, monitoring and controlling/mitigating the risk. The degree of formality and sophistication of the institution’s operational risk management framework should be commensurate with the institution’s risk profile.
5.2.2.3 The board is responsible for establishing a management structure
capable of implementing the institution’s operational risk management framework. Since a significant aspect of managing operational risk relates to the establishment of strong internal controls, it is particularly important that the board

Risk Management Guidelines for Banks and Financial Institutions, 2010 61 establishes clear lines of management responsibility, accountability and reporting. In addition, there should be separation of responsibilities and reporting lines between operational risk control functions, business lines and support functions in order to avoid conflict of interest. The framework should also articulate the key processes the institution needs to have in place to manage operational risk.
5.2.2.4 The board should review the framework regularly to ensure that
the institution is managing the operational risks arising from external market changes and other environmental factors, as well as those operational risks associated with new products, activities or systems. This review process should also aim to assess industry best practice in operational risk management appropriate for the institution’s activities, systems and processes. If necessary, the board should ensure that the operational risk management framework is revised in light of this analysis, so that material operational risks are captured within the framework.
5.2.3 Senior Management Oversight
5.2.3.1 Management should translate the operational risk management
framework established by the board of directors into specific policies, processes and procedures that can be implemented and verified within the different business units. Senior management should clearly assign authority, responsibility and reporting relationships to encourage and maintain this accountability and ensure that the necessary resources are available to manage operational risk effectively. Moreover, senior management should assess the appropriateness of the management oversight process in light of the risks inherent in a business unit’s policy.
5.2.3.2 Senior management should ensure that institution activities are
conducted by qualified staff with the necessary experience, technical capabilities and access to resources, and that staff responsible for monitoring and enforcing compliance with the institution’s risk policy have authority and are independent from the units they oversee. Management should ensure that the institution’s operational risk management policy has been clearly communicated to staff at all levels in units that are exposed to material operational risks.
5.2.3.3 Senior management should also ensure that the institution’s
remuneration policies are consistent with its appetite for risk. Remuneration policies which reward staff that deviate from policies (e.g. by exceeding established limits) weaken the institution’s risk management processes.

Risk Management Guidelines for Banks and Financial Institutions, 2010 62
5.2.3.4 Particular attention should be given to the quality of
documentation controls and to transaction-handling practices. Policies, processes and procedures related to advanced technologies supporting high transactions volumes, in particular, should be well documented and disseminated to all relevant personnel.
5.3 Policies, Procedures and Limits
5.3.1 The institution should put in place an operational risk
management policy. The policy should, at minimum, include:
(a) The strategy given by the board of the institution; (b) The systems and procedures to institute effective operational risk management framework; and (c) The structure of operational risk management function and the roles and responsibilities of individuals involved.
5.3.2 The policy should establish a process to ensure that any new or
changed activity, such as new products or systems conversions, will be evaluated for operational risk prior to its implementation. It should be approved by the board and documented. The management should ensure that it is communicated and understood throughout in the institution. The management also needs to place proper monitoring and control processes in order to have effective implementation of the policy. The policy should be regularly reviewed and updated, to ensure it continues to reflect the environment within which the institution operates.
5.3.3 Institutions should also establish policies for managing the risks
associated with outsourcing activities. Outsourcing of activities can reduce the institution’s risk profile by transferring activities to others with greater expertise and scale to manage the risks associated with specialized business activities. However, an institution’s use of third parties does not diminish the responsibility of the board of directors and management to ensure that the third-party activity is conducted in a safe and sound manner and in compliance with applicable laws. Outsourcing arrangements should be based on robust contracts and/or service level agreements that ensure a clear allocation of responsibilities between external service providers and the outsourcing institution. Furthermore, institutions need to manage residual risks associated with outsourcing arrangements, including disruption of services.
5.3.4 Business Continuity and Disaster Recovery Plan

Risk Management Guidelines for Banks and Financial Institutions, 2010 63
5.3.4.1 For reasons that may be beyond an institution’s control, a severe
event may result in the inability of the institution to fulfill some or all of its business obligations, particularly where the institution’s physical, telecommunication, or information technology infrastructures have been damaged or made inaccessible. This can, in turn, result in significant financial losses to the institution, as well as broader disruptions to the financial system through channels such as the payments system. This requires that institutions establish disaster recovery and business continuity plans that take into account different types of plausible scenarios to which the institution may be vulnerable, commensurate with the size and complexity of the institution’s operations.
5.3.4.2 Institutions should identify critical business processes, including
those where there is dependence on external vendors or other third parties, for which rapid resumption of service would be most essential. For these processes, institutions should identify alternative mechanisms for resuming service in the event of an outage. Particular attention should be paid to the ability to restore electronic or physical records that are necessary for business resumption. Where such records are backed-up at an off-site facility, or where an institution’s operations must be relocated to a new site, care should be taken that these sites are at an adequate distance from the impacted operations to minimize the risk that both primary and back-up records and facilities will be unavailable simultaneously.
5.3.4.3 Institutions should periodically review their disaster recovery and
business continuity plans so that they are consistent with their current operations and business strategies. Moreover, these plans should be tested periodically to ensure that the institution would be able to execute the plans in the unlikely event of a severe business disruption.
5.4 Risk Measurement, Monitoring and Management Information
System
5.4.1 Risk identification is paramount for the subsequent development
of a viable operational risk monitoring and control system. Effective risk identification considers both internal factors (such as the institution’s structure, the nature of the institution’s activities, the quality of the institution’s human resources, organizational changes and employee turnover) and external factors (such as changes in the industry and technological advances) that could adversely affect the achievement of the institution’s objectives.
5.4.2 In addition to identifying the most potentially adverse risks,
institutions should assess their vulnerability to these risks. Effective

Risk Management Guidelines for Banks and Financial Institutions, 2010 64 risk assessment allows the institution to better understand its risk profile and most effectively target risk management resources.
5.4.3 Amongst the possible tools that may be used by institutions for
identifying and assessing operational risk are:
(a) Self Risk Assessment: an institution assesses its operations and activities against a menu of potential operational risk vulnerabilities. This process is internally driven and often incorporates checklists and/or workshops to identify the strengths and weaknesses of the operational risk environment. (b) Risk Mapping: in this process, various business units, organizational functions or process flows are mapped by risk type. This exercise can reveal areas of weakness and help prioritize subsequent management actions. (c) Risk Indicators: risk indicators are statistics and/or metrics, often financial, which can provide insight into an institution’s risk position. These indicators are to be reviewed on a periodic basis (such as monthly or quarterly) to alert institutions to changes that may be indicative of risk concerns. Such indicators may include the number of failed trades, staff turnover rates and the frequency and/or severity of errors and omissions. Threshold/limits could be tied to these indicators such that when exceeded, could alert management on areas of potential problems. (d) The use of data on an institution’s historical loss experience could provide meaningful information for assessing the institution’s exposure to operational risk and developing a policy to mitigate/control the risk. An effective way of making good use of this information is to establish a framework for systematically tracking and recording the frequency, severity and other relevant information on individual loss events. Institutions may also combine internal loss data with external loss data (from other institutions), scenario analyses, and risk assessment factors.
5.4.4 Depending on the scale and nature of the activity, institutions
should understand the potential impact on their operations and their customers of any potential deficiencies in services provided by vendors and other third-party or intra-group service providers, including both operational breakdowns and the potential business failure or default of the external parties. The board and management should ensure that the expectations and obligations of each party are clearly defined, understood and enforceable. The extent of the external party’s liability and

Risk Management Guidelines for Banks and Financial Institutions, 2010 65 financial ability to compensate the institution for errors, negligence, and other operational failures should be explicitly considered as part of the risk assessment. Institutions should carry out an initial due diligence test and monitor the activities of third party providers, especially those lacking experience of the banking industry’s regulated environment, and review this process (including re-evaluations of due diligence) on a regular basis. For critical activities, the institution may need to consider contingency plans, including the availability of alternative external parties and the costs and resources required to switch external parties, potentially on very short notice.
5.4.5 Control activities are designed to address the operational risks
that an institution has identified. For all material operational risks that have been identified, the institution should decide whether to use appropriate procedures to control and/or mitigate the risks, or bear the risks. For those risks that cannot be controlled, the institution should decide whether to accept these risks, reduce the level of business activity involved, or withdraw from this activity completely.
5.4.6 Some significant operational risks have low probabilities but
potentially very large financial impact. Moreover, not all risk events can be controlled e.g. natural disasters. Risk mitigation tools or programmes can be used to reduce the exposure to, or frequency and/or severity of such events. For example, insurance policies can be used to externalize the risk of “low frequency, high severity” losses which may occur as a result of events such as third-party claims resulting from errors and omissions, physical loss of securities, employee or third-party fraud, and natural disasters.
5.4.7 However, institutions should view risk mitigation tools as
complementary to, rather than a replacement for, thorough internal operational risk control. Having mechanisms in place to quickly recognize and rectify legitimate operational risk errors can greatly reduce exposures. Careful consideration also needs to be given to the extent to which risk mitigation tools such as insurance truly reduce risk, or transfer the risk to another business sector or area, or even create a new risk e.g. legal or counterparty risk.
5.4.8 Investments in appropriate processing technology and
information technology security are also important for risk mitigation. However, institutions should be aware that increased automation could transform high-frequency, low-severity losses into low-frequency, high-severity losses. The latter may be associated with loss or extended disruption of services caused by internal factors or by factors beyond the institution’s immediate

Risk Management Guidelines for Banks and Financial Institutions, 2010 66 control e.g. external events. Such problems may cause serious difficulties for institutions and could jeopardize an institution’s ability to conduct key business activities. Institutions should therefore establish disaster recovery and business continuity plans that address this risk.
5.4.9 An effective monitoring process is essential for adequately
managing operational risk. Regular monitoring activities can offer the advantage of quickly detecting and correcting deficiencies in the policies, processes and procedures for managing operational risk. Promptly detecting and addressing these deficiencies can substantially reduce the potential frequency and/or severity of a loss event.
5.4.10 In addition to monitoring operational loss events, institutions
should identify appropriate indicators that provide early warning of an increased risk of future losses. Such indicators (often referred to as key risk indicators or early warning indicators) should be forward-looking and could reflect potential sources of operational risk such as rapid growth, the introduction of new products, employee turnover, transaction breaks, system downtime, and so on. When thresholds are directly linked to these indicators an effective monitoring process can help identify key material risks in a transparent manner and enable the institution to act upon these risks appropriately.
5.4.11 The frequency of monitoring should reflect the risks involved and
the frequency and nature of changes in the operating environment. Monitoring should be an integrated part of an institution’s activities. The results of these monitoring activities should be included in regular management and board reports, as should compliance reviews performed by the internal audit and risk management functions.
5.4.12 Senior management should receive regular reports from
appropriate areas such as business units, the operational risk management office and internal audit. The operational risk reports should contain internal financial, operational, and compliance data, as well as external market information about events and conditions that are relevant to decision making. Reports should be distributed to appropriate levels of management and to areas of the institution on which concerns may have an impact. Reports should fully reflect any identified problem areas and should motivate timely corrective action on outstanding issues. To ensure the usefulness and reliability of these reports, management should regularly verify the timeliness, accuracy, and relevance of reporting systems and internal controls in general. Management may also use reports prepared by external sources (auditors, supervisors) to assess the usefulness

Risk Management Guidelines for Banks and Financial Institutions, 2010 67 and reliability of internal reports. Reports should be analyzed with a view to improving existing risk management performance as well as developing new risk management policies, procedures and practices.
5.4.13 In general, the board of directors should receive sufficient higher￾level information to enable them to understand the institution’s
overall operational risk profile and focus on the material and strategic implications for the business.
5.5 Internal Controls
5.5.1 Internal control system should be established to ensure
adequacy of the risk management framework and compliance with a documented set of internal policies concerning the risk management system. Principle elements of this could include, for example:
(a) Top-level reviews of the institution's progress towards the stated objectives; (b) Checking for compliance with management controls; (c) Policies, processes and procedures concerning the review, treatment and resolution of non-compliance issues; and (d) A system of documented approvals and authorizations to ensure accountability to the appropriate level of management.
5.5.2 Although a framework of formal, written policies and procedures
is critical, it needs to be reinforced through a strong control culture that promotes sound risk management practices. Board and senior management are responsible for establishing a strong internal control culture in which control activities are an integral
part of the regular activities of an institution. Controls that are an
integral part of the regular activities enable quick responses to changing conditions and avoid unnecessary costs.
5.5.3 Operational risk can be more pronounced where institutions
engage in new activities or develop new products (particularly where these activities or products are not consistent with the institution’s core business strategies), enter unfamiliar markets, and/or engage in businesses that are geographically distant from the head office. It is therefore important for institutions to ensure that special attention is paid to internal control activities including review of policies and procedures to incorporate such conditions.

Risk Management Guidelines for Banks and Financial Institutions, 2010 68
5.5.4 Institutions should have in place adequate internal audit
coverage to verify that operating policies and procedures have been implemented effectively. The board (either directly or indirectly through its audit committee) should ensure that the scope and frequency of the audit programme is appropriate to the risk exposures. Audit should periodically validate that the institution’s operational risk management framework is being implemented effectively across the institution.
5.5.5 To the extent that the audit function is involved in oversight of the
operational risk management framework, the board should ensure that the independence of the audit function is maintained. This independence may be compromised if the audit function is directly involved in the operational risk management process. The audit function may provide valuable input to those responsible for operational risk management, but should not itself have direct operational risk management responsibilities.
5.5.6 An effective internal control system also requires existence of
appropriate segregation of duties and that personnel are not assigned responsibilities which may create a conflict of interest. Assigning such conflicting duties to individuals, or a team, may enable them to conceal losses, errors or inappropriate actions. Therefore, areas of potential conflict of interest should be identified, minimized, and subjected to careful independent monitoring and review.
5.5.7 In addition to segregation of duties, institutions should ensure that
other internal practices are in place as appropriate to control operational risk. Examples of these include:
(a) Close monitoring of adherence to assigned risk limits or thresholds; (b) Maintaining safeguards for access to, and use of, institution’s assets and records; (c) Ensuring that staff have appropriate expertise and training; (d) Identifying business lines or products where returns appear to be out of line with reasonable expectations e.g. where a supposedly low risk, low margin trading activity generates high returns that could call into question whether such returns have been achieved as a result of an internal control breach; and (e) Regular verification and reconciliation of transactions and accounts.

Risk Management Guidelines for Banks and Financial Institutions, 2010 69
6.0 STRATEGIC RISK MANAGEMENT GUIDELINES
6.1 Introduction
6.1.1 Strategic risk is the current or prospective risk to earnings and
capital arising from adverse business decisions, improper implementation of decisions, or lack of responsiveness to changes in the business environment, both internal and external. This risk is a function of the compatibility of an institution’s strategic goals, the business strategies developed and resources employed to achieve strategic goals, and the quality of implementation of those goals.
6.1.2 Strategic risk can arise from two main sources: external and
internal risk factors. External risk factors are difficult for the institution to control or that the institution has no control over, and affect or deter the realization of the goals determined in the strategic plan. Such factors include:
(a) Competition - a strategic plan and business plan must be in line with current and anticipated future competition. Competitive factors must be taken into consideration in the institution’s pricing practices and when developing new products. (b) Change of target customers - changes in demographics and consumer profiles may affect the customer base, earnings and capital funding of an institution. (c) Technological changes – an institution may face risks from changing technology because its competitors can develop more efficient systems or services at lower costs. The institution should ensure that the level of technology in use is sufficient to retain its customer base. (d) Economic factors - global, regional or national economic conditions affect the level of profits of an institution. Thus, continual assessment and monitoring of economic trends and forecasts are needed. (e) Regulations – changes in laws and regulations of the supervisor, tax authorities, local authorities and other authorized agencies may affect the implementation of strategic and business plans established to meet the institution’s goals; and may require adjustments to the plans in order to ensure compliance.

Risk Management Guidelines for Banks and Financial Institutions, 2010 70
6.1.3 Internal risk factors are controllable by the institution but can
affect or deter the implementation of the strategic plan. Such factors include:
(a) Organizational structure – it is important for the implementation of strategic and business plans, and in meeting overall goals in the most efficient manner, for the institution to establish an understandable organizational structure. An institution should have an organizational structure consistent with its plans and that prevents conflicts of interest among its directors, managers, shareholders and staff. (b) Work processes and procedures – these factors enable timely and accurate implementation of business plans. The Board and Directors should establish responsibilities and clear guidelines, policies and procedures in order to prevent deficiencies in internal controls. (c) Personnel – the success of accomplishing strategic and business plan is dependent on the knowledge, experience, and vision of the Board, management and staff. The staff should have the necessary expertise and training to conduct their assignments in an efficient and effective manner. Lack of competent and sufficient staff levels can increase risk exposures, impair financial performance and damage the institution’s reputation. (d) Information - adequate, appropriate, accurate and timely information will provide a clear understanding of the institution and its market place, thereby positively affecting the formulation of strategic and business plans, and management decisions. (e) Technology – technology systems should serve and support complex transactions and all customers’ needs, as well as maintain the competitiveness and support of new business lines.
6.1.4 Risk mitigation factors help in the implementation of a strategic
plan. Such factors include a qualified Board of Directors, adequate preparation of strategic and business plans, quality personnel and their ongoing training, an effective risk management system, adequate access to information, and timely and efficient introduction of new products or services.
6.1.5 Strategic risk, if not adequately managed, may gradually
manifest itself in different units of an institution. It has a tendency of attaching itself in the ‘institutional culture’ and might not easily

Risk Management Guidelines for Banks and Financial Institutions, 2010 71 be recognized. It can further affect an institution’s position in the market e.g. through falling share of the target market.
6.2 Board and Senior Management Oversight
6.2.1 Board Oversight
6.2.1.1 The board of directors is responsible for the strategic direction of
the institution. The vision and mission of the institution should reflect the direction to which the institution is heading in the medium to long term. It is the overall responsibility of the board to provide the strategic direction documented in a strategic plan setting out in clear terms objectives and goals in all major areas of the institution’s business. On the basis of the approved strategic plan, the board should, among others, set up corporate governance structure which clearly indicates lines of responsibilities and accountability; establish communication channels appropriate for effective implementation of the plans, approve strategic risk management policies and ensure that senior management is sufficiently qualified and experienced.
6.2.1.2 A strategic plan is a document reflecting the mission and
strategic goals of an institution, generally for a period of at least four years. A good strategic plan must be clear, consistent with goals, flexible, and adjustable to changes in the environment. A strategic plan should contain, at least the following:
(a)Analysis of the external environment in which the institution operates, including the PEST analysis; (b)Critical review of the institutional performance including SWOT analysis; (c)Institution’s strategic goals and objectives; (d)Description of the institution’s risk management system; (e)Mission, goals and operating plans for each of the institution’s units; and (f)Institution’s quantitative projection of financial statements for the planning period.
6.2.1.3 The Board should be knowledgeable about the institution’s
market, economic and competitive conditions and ensure that the strategic plan is implemented effectively and reviewed at least annually. They should receive relevant reports that are accurate and timely, and can be appropriately used in the decision making process.

Risk Management Guidelines for Banks and Financial Institutions, 2010 72
6.2.2 Senior Management Oversight
6.2.2.1 Management of an institution is responsible for implementing the
institution’s approved strategic and business plans. Creation of adequate conditions for implementation, including the design and adoption of a strategic risk management policy, procedures, as well as duties and responsibilities of different units is the most critical step towards effective implementation of the strategic and business plans. Of importance in the effective implementation of the strategic plan is the whole architecture of the internal infrastructure including an effective organizational structure, quality personnel, robust budgeting processes, availability of resources, effective and timely management information systems, and monitoring and control systems that accomplish the business goals in an effective and efficient manner.
6.2.2.2 Thus management must translate the strategic goals into
attainable operational goals, prioritizing them in terms of their strategic importance. Strategic goals should be cascaded down into smaller executable bits assigned to different business units within the overall set up of the institution.
6.2.2.3 The plans and objectives should be compatible with the nature,
size and the complexity of the institution and the activities it performs as well as the market of the institution’s operations.
6.3 Policies, Procedures and Limits
6.3.1 Strategic risk management should be based on an approved
Strategic Risk Management Policy, which is in compliance with the institution’s overall policy of risk management. The strategic risk management policy should provide general guidelines to strategic risk management. The policy should contain at least the following:
(a)Definition of strategic risk;
(b)Sources of strategic risk (external and internal risk factors); (c)Risk mitigation factors to strategic risk; (d)Manner of managing strategic risk; (e)Institution’s accepted tolerance for strategic risk exposure.

Risk Management Guidelines for Banks and Financial Institutions, 2010 73
6.4 Risk Measurement, Monitoring and Management Information
System
6.4.1 Identification, Measurement and Monitoring of Strategic Risk
6.4.1.1 An effective measurement and monitoring process is essential for
adequately managing strategic risk. Identification and measurement of strategic risk can be determined through strategic planning, the preparatory process of a strategic plan and the reasonableness of a strategic plan. Both the strategic plan and the operational plans and budget should be consistent with the business scope, complexity, external environment and internal factors of the institution, including its size and resources.
6.4.1.2 Management should fully participate and carefully decide on
the basis of information that business and strategic plans are feasible and appropriate. Management should ensure good communication and cooperation between all employees and departments involved in the strategic planning process.
6.4.1.3 The goals of the operational plans should be consistent with the
strategic plan and overall objectives of the institution as well as allocation of budget. The institution should set goals, such as the quality of credit portfolio, that are consistent with its capacity, current market share, and competitive environment.
6.4.1.4 An institution should periodically evaluate actual performance
against the strategic plan in order to monitor and adjust its plans appropriately and consistently with changes. The evaluation should be measurable, and with adequate frequency.
6.4.1.5 An effective measurement and monitoring process is essential for
adequately managing strategic risk. To assess the adequacy and appropriateness of strategic risk monitoring and reports, as well as the information system of the institution, each business unit must consider the following factors:
(a)Contents of the reports submitted to inform decisions at higher level; (b)Frequency of the reports; (c)Presentation styles of the should facilitate understandability; (d)The reports should highlight material risks and strategies mounted to counter them.
6.4.2 Management Information System

Risk Management Guidelines for Banks and Financial Institutions, 2010 74
6.4.2.1 For effective monitoring of strategic risk, a robust management
information system (MIS) should be in place. MIS supports the implementation of the strategic plan, through the following:
(a)Provides, collects, and processes data; (b)Reduces operating cost; (c) Enhances communication among staff; and (d)MIS should enable the institution to identify and measure its strategic risk on a timely manner and generate data and reports for use by the board and management.
6.4.2.2 The effectiveness of risk monitoring depends on the ability to
identify and measure all risk factors, and must be supported by appropriate, accurate and timely MIS with analysis and decision making. Therefore, management must develop and upgrade its information system to identify and measure risks in an accurate and timely manner.
6.4.2.3 The MIS should be consistent with the complexity and diversity of
the institution’s business operations. For example, large institution with many complex transactions should have a reporting system and risk monitoring system that can measure the overall risk level. It should have ability to collect, store and retrieve both internal and external data including financial data; economic condition data, the competition data, technology and regulatory requirements.
6.4.2.4 MIS should ensure timely and continuous monitoring and control
of strategic risk, as well as reporting to the board and senior management on the implementation of the strategic risk management process. Accordingly, MIS should provide proper information and data on the institution’s business activities.
6.4.2.5 Effective MIS must be adequately supportive of objectives, goals,
and provisions of the services provided by the institution, be able to timely report in a desirable format, and appropriately specify information access levels.
6.5 Strategic Risk Control
6.5.1 The Board and senior management should monitor market
changes and advancements in technology, to determine new services or products that maintain the institution’s competitiveness and allow timely responses to customers’ needs.

Risk Management Guidelines for Banks and Financial Institutions, 2010 75 Offering new services or products, however, may increase the risk to the institution if proper considerations are not taken. Therefore, the Board and senior management must carefully formulate a strategic plan for all new products.
6.5.2 In order to effectively fulfill strategic plan, an institution should:
(a)Review performance of senior management against set goals at least annually. The review should determine if performance is satisfactory and management is capable of achieving the goals. (b)Establish a policy or plan for management succession. The policy or plan should be reviewed at least annually, be consistent with the organizational structure and job descriptions, and cover the necessary training and minimum qualifications for each position and career path. (c)Monitor and control performance of outsourcing arrangements. (d)Set compensation guidelines and methods for management and employees. The compensation should be appropriate to the financial standing of the institution. (e)Set a training plan and adequately budget for training. It should also have staff retention plan to retain capable individuals who have the proper knowledge and understanding of the institution’s business and operations.

Risk Management Guidelines for Banks and Financial Institutions, 2010 76
7.0 COMPLIANCE RISK MANAGEMENT GUIDELINES
7.1 Introduction
7.1.1 Compliance risk is the current or prospective risk to earnings and
capital arising from violations or non-compliance with laws, rules, regulations, agreements, prescribed practices, or ethical standards, as well as from the possibility of incorrect interpretation of effective laws or regulations. Institutions are exposed to Compliance risk due to relations with a great number of stakeholders, e.g. regulators, customers, counter parties, as well as, tax authorities, local authorities and other authorized agencies.
7.1.2 Compliance risk arises from the necessity of the institution to
conduct its businesses in conformity with the business and contractual legal principles applicable in each of the jurisdictions where the institution conducts its business, as well as, when there is a possibility that the institution’s failure to meet legal requirements may result in unenforceable contracts, litigation, or other adverse consequences. Compliance risk can lead to licenses revocation, fines and penalties, payment of damages, deteriorating position in the market, reduced expansion potential, and lack of contract enforceability. Compliance risk can also lead to a diminished reputation, also known as Reputation risk, arising from an adverse perception of the image of the institution by customers, counter parties, shareholders, or regulators. This affects the institution’s ability to establish new relationships, services or products, or service existing relationships. This risk may also expose the institution to administrative, civil and criminal liability, financial loss or a decline in its customer base. 7 .1.3 Compliance risk is difficult to measure, but it can be defined, understood and controlled within the institution’s capacity and its readiness to confront non-compliance. Compliance risk can occur whether deliberate or unintentional.
7.1.4 Appropriate actions for the institution to take in mitigating
compliance risk would include: reducing exposures of sources of compliance risk, an appropriate compliance risk management process and putting in place an effective compliance function in the institution.
7.1.5 The institution should identify sources of compliance risk. For
instance, common sources of Compliance risk are:
(a) Violations or noncompliance with laws and regulations and prescribed standards;

Risk Management Guidelines for Banks and Financial Institutions, 2010 77 (b)Lack of or inadequate compliance with contractual obligations and other legal documentation; (c)Inadequate identification of rights and responsibilities between the institution and its customers; (d)Complaints by customers and other counterparties; (e)Harming the interests of third parties; (f) Litigation procedures, potential exposure (including cost of litigation) and nature of pending or threatened litigation; (g)Involvement in money laundering, insider trading, violation of taxation rules, forgery and damage from computer hacking by the institution, its intermediaries or its customers; and/or (h) Limited knowledge and postponed response by management to implement legal and reputation risk management.
7.2 Board and Senior Management Oversight
7.2.1 Board Oversight
7.2.1.1 The Board should be aware of the major aspects of the
institution's compliance risk as a separate risk category that should be managed. The Board of directors of an institution is responsible for the following:
(a) defining the compliance risk management system and ensure that the system is aligned with overall business activities; (b) approving compliance risk management policy that provides the senior management with clear guidelines and procedures for managing compliance risk; (c) establishing a management structure capable of implementing the institution's compliance risk management process; and (d) periodically reviewing the institution's compliance risk management policy to ensure proper guidance is provided for effectively managing the institution’s compliance risk.
7.2.1.2 The Board should ensure that the institution's compliance risk
management system is subject to implementation by the senior management and a qualified compliance officer/staff, and

Risk Management Guidelines for Banks and Financial Institutions, 2010 78 reviewed by an effective and comprehensive internal audit function.
7.2.2 Senior Management Oversight
7.2.2.1 Senior management is responsible for running the institution on a
day-to-day basis, to manage and monitor the institution's overall risk environment. Senior management is therefore responsible for the effective management of the institution’s compliance risk including:
(a) Implementing the compliance risk management system approved by the Board; (b) Establishing an effective organizational structure for compliance risk management, and be in regular contact with employees that are directly responsible for conducting compliance risk management (institution’s compliance staff and lawyers); (c) Ensuring that all employees are working in order to protect the institution's reputation; (d) Ensuring that sufficient human and technical resources are devoted for compliance risk management; and (e) Ensuring ongoing compliance training that covers compliance requirements for all business lines, particularly when entering new markets or offering new products.
7.2.2.2 The size of the institution and the complexity of its business
activities dictate the scope of the compliance function and staffing requirements (number and competencies) of a compliance function unit. Not all compliance responsibilities are necessarily carried out by a compliance unit. Compliance responsibilities may be exercised by staff in different departments or all compliance responsibilities may be conducted by the compliance unit/department.
7.2.2.3 Regardless of how the compliance function is organized within
the institution, it should be independent, with sufficient resources and clearly specified activities. The compliance staff, especially the head of compliance, should not be in a position where there may arise a conflict of interest between their compliance responsibilities and any other responsibilities they may have.
7.2.2.4 The head of compliance function may or may not be a member
of senior management. If the head of compliance function is a

Risk Management Guidelines for Banks and Financial Institutions, 2010 79 member of senior management, he or she should not have direct business line responsibilities. If the head of compliance function is not a member of senior management, he or she should have a direct reporting line to a member of senior management who does not have direct business line responsibilities.
7.2.2.5 Compliance risk should be included in the risk assessment
methodology of the internal audit function, and an audit program that covers the adequacy and effectiveness of the institution’s compliance function should be established, including testing of controls commensurate with the perceived level of risk. This principle implies that the compliance function and the internal audit function should be separate to ensure that the activities of the compliance function are subject to independent review. However, the audit function should keep the head of compliance informed of any audit findings related to compliance.
7.3 Policies, Procedures and Limits
7.3.1 Institutions should put in place adequate policies and
procedures for managing compliance risk. Compliance policy should explain the main processes by which compliance risk is to be identified and managed through all levels of the institution’s organizational structure. The policy should also define the compliance function as an independent function, with specific roles and responsibilities of the compliance staff, and detailing the compliance officer’s communication methods with the management and staff in the various business units.
7.3.2 Compliance risk management policy should be part of the
overall risk management policy of the institution, and should precisely determine all important processes and procedures in minimizing the institution’s compliance risk exposure. The policy should be clearly formulated and in writing. The policy must contain, at least the following:
(a) Definition of compliance risk;
(b) Objectives of compliance risk management; (c) Procedures for identifying, assessing, monitoring, controlling and managing compliance risk; (d) Well defined authorities, responsibilities and information flows for compliance risk management at all management levels; and

Risk Management Guidelines for Banks and Financial Institutions, 2010 80 (e) Clear statement of the institution’s accepted tolerance for compliance risk exposure.
7.3.3 Procedures for compliance risk should contain at a minimum:
(a) Definition of the required legal documents establishing the collateral on loans for clients. These also include verification, by the institution's legal expert, of the legitimacy of the collateral on the basis of the available documentation. (b) Definition of standard procedures for foreclosures. (c) Standardized contracts for similar institution’s products, clients, and other services with third parties. The terms or conditions of a contract should be confirmed by the institution's legal expert. Special attention should be paid to the procedures for changing the terms of a signed contract. The institution's legal expert should also confirm annexes to any contract. (d) Legal due diligence of the institution’s major clients and counterparties, vendors and outsourcing companies. (e) Documentation standards for all initiated court proceedings against or on behalf of the institution. Permanent and accurate information and documents of the institution’s effectiveness in court proceedings is also needed. Institution's legal experts should keep a list of all court proceedings with their opinion on the possible result of the case, as well as, a list of court cases that in the name of the institution are lead by outside attorneys. In addition, the institution should separately retain data describing the types of claims for which the institution has usually initiated litigation and in which cases the institution was sued. (f) Definition of the major mitigating actions to compliance risk (e.g., through reviewing contract terms by experienced lawyers, restricted dealings to reputable counterparts, placing limits on exposure to legal interpretations, etc.). (g) Clear documentation standards for the institution’s shareholders. (h) Documentation standards for all decisions made by the Bank of Tanzania in respect of the institution and written communications between the Bank of Tanzania and the institution (i) Procedures for safeguarding of original legal documents. (j) Regular compliance checks.

Risk Management Guidelines for Banks and Financial Institutions, 2010 81
7.4 Risk Measurement, Monitoring and Management Information
System
7.4.1 Identification, Measurement and Monitoring of Compliance
Risk
7.4.1.1 An effective measurement and monitoring process is essential for
adequately managing compliance risk. In order to understand its compliance risk profile an institution should identify the sources of compliance risk that it is exposed to and assess its vulnerability to these risks. If a new compliance risk is not recognized, the institution's legal experts may never thoroughly review the existing contracts. Thus, the institution should identify and assess the Compliance risk inherent in all existing or new, rules, procedures, internal processes, activities, contracts and court cases.
7.4.1.2 The institution needs to define the appropriate approach to
assessing each identified source of risk. There are various tools used for identifying and assessing compliance risk, such as:
(a) Self-Assessment - An institution assesses its operations and activities against a list of potential risk vulnerabilities. This process is internally driven and often incorporates checklists to identify the strengths and weaknesses of the compliance risk environment. (b) Risk Indicators - Risk indicators are statistics or matrices that can provide insight into an institution’s risk position. Such indicators may include the volume and/or frequency of law violations, frequency of complains, number of initiated litigation procedures, payments of damages, fines and court expenses, unfavorable court verdicts or number of finalized court cases on a periodical basis, and frequency of actual or suspected fraud or money laundering activities. These indicators should provide good incentives, tying risk to capital to desirable improvement in the compliance function. (c) Risk Mapping - In this process, various departments or units are outlined by risk types (for example credit unit/department can be outlined by the risk of the lack of contract enforcement or incorrect interpretation of the agreements). This exercise can disclose areas of weakness and help to identify priorities for management action.
7.4.1.3 The institution should consider ways to measure compliance risk
by using performance indicators, such as the increasing number

Risk Management Guidelines for Banks and Financial Institutions, 2010 82 of: customer complaints, corrective measures taken against the institution, or litigation procedures as a result of noncompliance with laws and regulations.
7.4.1.4 Compliance risk can also be measured by regular legal reviews
on different institution’s products and services, and their relevant documentation in order to ensure that all contracts are in conformity with laws and regulations. This review may take place on each transaction individually or may cover the legal adequacy of standardized documentation and procedures.
7.4.1.5 Institutions are responsible for monitoring their compliance risk
profiles on an on-going basis by reviewing defined compliance risk indicators in order to provide management with early warning. Monitoring should be an integrated part of an institution's activities. The results of these monitoring activities should be included in regular management and Board reports.
7.4.1.6 Institutions should have processes and procedures in place to
control compliance risk. There should also be a constant review of the institution’s progress towards meeting legal objectives, and checking for compliance with policies and procedures and defined duties and responsibilities.
7.4.2 Management Information System
7.4.2.1 For effective monitoring of compliance risk, a robust
management information system (MIS) should be in place. MIS should enable the institution to identify and measure its compliance risk on a timely manner and generate data and reports for use by the board and management;
7.4.2.2 The effectiveness of risk monitoring depends on the ability to
identify and measure all risk factors, and must be supported by appropriate, accurate and timely MIS with analysis and decision making. Therefore, management must develop and upgrade its information system to identify and measure risks in an accurate and timely manner. The MIS should be consistent with the complexity and diversity of the institution’s business operations.
7.4.2.3 The institution should establish a database of its legal documents.
This database should contain at least: type of legal documents (contracts, memorandum of understanding, etc.), period of document validation, and responsible department/unit for document enforcement.
7.5 Internal Controls

Risk Management Guidelines for Banks and Financial Institutions, 2010 83
7.5.1 Institutions should have proper internal control systems that
integrate compliance risk management into its overall risk management process. The audit of compliance risk management should be incorporated into the annual plan of the Internal Audit function.
7.5.2 The Internal Audit function should, within its scope of operations,
cover the following aspects of compliance risk management:
(a) Verifying that compliance risk management policies and procedures have been implemented effectively across the institution; (b) Assessing the effectiveness of controls for mitigating fraud and risks to reputation; (c) Determining that senior management takes appropriate corrective actions when compliance failures are identified; (d) Ensuring that the scope and frequency of the audit plan/program is appropriate to the risk exposures; (e) Determining the level of senior management compliance with Bank of Tanzania directives; (f)Monitoring compliance risk profiles on an on-going basis; and (g) Analyzing the timeliness and accuracy of compliance risk reports to senior management and board of directors.
8.0 MAPPING OF INHERENT RISKS ONTO FUNCTIONAL
AREAS/ACTIVITIES
8.1 Activities in which institutions engage entail a number of inherent
risks such as credit, liquidity, market, operational, strategic and compliance risks. The level and type of risks inherent in a certain activity depend on the nature and scope of such activity. Moreover, one risk may cut across various functional areas and on the other hand, one activity may have a number of inherent risks. It is also common for one risk to trigger another risk. There is a need, therefore, for institutions to prepare a functional risk matrix to ensure that all relevant risks inherent in their activities are captured.
8.2 Most common activities performed by institutions include
lending, treasury, investments, foreign exchange, deposit mobilization, etc. For the purpose of preparing functional risk

Risk Management Guidelines for Banks and Financial Institutions, 2010 84 matrix, these activities could be derived from the institution’s balance sheet, off-balance sheets items, and major sources of income, organization structure, business plan for new and expanding activities or products and/or any other activities within the institution. Below is a sample of Functional Risk Matrix:
Sample Functional Risk Matrix Functional Area/Activity Inherent Risks Credit Liquidity Market Operational Strategic Compliance

1. Lending X
2. Deposit mobilization X

Treasury and Investment
Activities:
-investment in debt securities X
-placements in other institutions X
-liquidity management X
-Equity Investments X
-Foreign exchange trading X
4.
Management information system X
5. Banking operations X