Risk Management Guidelines for Microfinance Institutions

NATIONAL BANK OF ETHIOPIA
MICROFINANCE INSTITUIONS SUPERVISION DIRECTORATE RISK MANAGEMENT GUIDLEIES for MICROFINANCE INSTITITTIONS (FINAL)

September 2010

Table of Contents

Page

1. General Back Ground on Risk Management
   Guideline for MFIs 1
   1.1 Introduction 1
   1.2 Objectives 1
   1.3 Risk Management Programs 1
   1.4 Risk Management Process 2
   1.5 Basic Elements of Risk Management Framework 3
2. Strategic Risk management Guideline 10
3. Credit Risk Management Guideline 14
4. Liquidity Risk Management Guideline 28
5. Interest Rate Risk Management Guideline 35
6. Operational Risk Management Guidelines 43
7. Mapping of Inherent Risk onto Functional Risk matrix 49

Risk Management Guidelines (RMGs) for Microfinance Institutions

1. General Background
   1.1 Introduction

1.1.1 Risk taking is an inherent element and integral part of financial services in
general and of microfinance in particular and, indeed, profits are in part the reward for successful risk taking in business. On the other hand, excessive and poorly managed risk can lead to losses and thus endanger the safety and soundness of microfinance institutions and safety of microfinance institution’s depositors. Consequently, microfinance institutions may fail to meet its social and financial objectives. This implies that proactive risk management is essential to the long term sustainability of microfinance institutions (MFIS).
1.1.2 Therefore, it is believed that effective risk management allows MFIs to
capitalize on new opportunities and to minimize threats to their financial viability. Accordingly, the National Bank of Ethiopia place significant emphasis on the adequacy of an institution’s management of risk.
1.1.3 Microfinance institutions consciously take risk as they perform their role of
financial intermediation in the economy. Consequently, they are exposed to a spectrum of risks, which include credit risk, interest rate risk, liquidity risk, and operational risk. Managing these risks is essential for their survival and sustainability.
1.1.4 Rather than focusing on current or historical financial and operational
performance management and regulators now focus on an organization’s ability to identify and manage future risks as best predictor of long term success of financial institutions.
1.2 Objectives
1.2.1 National Bank of Ethiopia (NBE) has legitimate interest in ensuring that
microfinance institutions operate in a safe and sound manner. This goal can be largely achieved it microfinance institutions effectively manage their risks.
1.2.2 Therefore, NBE puts forward for the purpose of providing guidelines to
all microfinance institutions on risk standards that shall be expected of risk management framework at any microfinance institution.
1.2.3 The purpose of this document is to provide a risk management
framework to all licensed microfinance institutions operating in Ethiopia. This framework sets out the minimum risk identification, measurement, monitoring and control system that shall be put in place by microfinance institutions. Accordingly, this risk management guideline is issued to enhance risk management practice among microfinance institutions.
1.2.4 The guidelines are in line with internationally accepted risk

management principles and best practices as they heavily draw on microfinance institutions risk management. All institutions are therefore required to observe these guidelines in the course of designing their risk management system and conducting their business.
1.2.5 RMGs is also inline with NBE’s intention of following risk based
supervisory approach in supervising the financial institutions of the country in general and that of microfinance institutions in particular. In conducting risk focused supervision, rating of MFI’s performance will take in to account, among other things, its risk management framework and ability to manage risks.
1.2.6 Therefore, Microfinance institutions are expected to become more risk
focused and their internal audit function should gradually introduce risk based internal audit to ensure effectiveness of risk management practices.
1.3 Risk Management Programs
1.3.1 The process of risk management should be commensurate with the size
and complexity of the institution. While the types and degree of risks in microfinance institutions may vary up on a number of factors such as size, complexity, business activities, volume etc., these guidelines cover the most common risks in microfinance institutions namely, Strategic Risk, Credit Risk, Liquidity risk, Interest Rate Risk and Operational Risk.
1.3.2 Therefore, NBE requires each microfinance institution to prepare a
comprehensive Risk management Program (RMP) tailored to its needs and circumstances under which it operates.
1.3.3 There is no single risk management system that would fit for all
microfinance institutions. Consequently, NBE requires each microfinance institution to develop its own comprehensive risk management system tailored to its needs and circumstances. Their risk management program, however, should at a minimum cover the following most common risks:
a. Strategic risk b. Credit risk
c. Liquidity risk
d. Interest rate risk e. Operational risk
1.4 Risk management Process
1.4.1 Risk management is a continual process of systematically identifying,
measuring, monitoring and managing risks in the organization.
1.4.2 Risk Management is a discipline at the core of every institution and
encompasses all the activities that affect its risk profile. Risk management as commonly perceived does not mean minimizing risk; rather the goal of risk management is to optimize risk-reward trade-off. This can be achieved through putting in place an effective risk management framework

which can adequately capture and manage all risks an institution is exposed to. Risk Management entails four key processes. Regardless of the risk management program, each risk management program should include the following:

a. Risk Identification: The first step in risk management is to identify risk. In order to manage risks, risks must first be identified. Almost every product and service offered by microfinance institutions has a unique risk profile composed of multiple risks. For example, at least four types of risks are usually present in most lending activities: credit risk, interest rate risk, liquidity risk and operational risk. Risk identification should be a continuing process and risk should be understood at both the transaction and portfolio levels. b. Risk Measurement: Once the risks associated with a particular activity have been identified, the next step is to measure the significance of each risk. Risks should be measured in order to determine their impact on the MFI’s profitability and capital. Each risk should be viewed in terms of its three dimensions: size, duration and probability of adverse occurrences. Accurate and timely measurement of risk is essential to effective risk management systems.
c. Risk Control: Following risk identification and measurement,
microfinance institutions should control or minimize risks. There are basically three ways to control significant risks, or at least minimize their adverse consequences: avoiding or placing limits on certain activities/risks, mitigating risks and/or offsetting risks. It is a primary management function to balance expected rewards against risks and the expenses associated with controlling risks. Microfinance institutions should establish and communicate risk control mechanisms through policies, standards and procedures that define responsibility and authority. d. Risk Monitoring: Microfinance institutions need to establish a management information system (MIS) that accurately identifies and measures risks at the inception of transactions and activities. It is equally important for management to establish MIS to monitor significant changes in risk profiles. In general, monitoring risks means developing reporting systems that identify adverse changes in the risk profiles of significant products, services and activities and monitoring changes in controls that have been put in place to minimize adverse consequences.

1.5 Basic Elements of Risk management Framework
1.5.1 A risk management framework encompasses the scope of risks to be
managed, the process/systems and procedures to manage those risks and the roles and responsibilities of individuals involved in risk management. The framework should be comprehensive enough to capture all risks an institution is exposed to and have flexibility to accommodate any change in business activities. Sound risk management system of each microfinance institution should at least contain the following key elements of a sound risk management system:
a) active board and senior management oversight; b) adequate policies, procedures and limits; c) adequate risk measurement, monitoring and management information systems; and d) comprehensive internal controls.
1.5.2 Active Board and Senior Management Oversight
1.5.2.1 Board :
a. Reviewing and approving organizational structure and controls b. Reviewing that management is qualified and competent
c. Reviewing and approving policies of major activities
d. Boards of directors have ultimate responsibility for the level of risk taken by their microfinance institutions. Accordingly, they should approve the overall business strategies and significant policies of their organizations, including those related to managing and taking risks. e. Ensuring that the microfinance institution maintains the various risks facing it at prudent levels. f. Ensuring that senior management as well as individuals responsible for managing individual risks facing the microfinance possesses sound expertise and knowledge to accomplish the risk management function. g. Ensuring that the microfinance institutions implements sound fundamental principles that facilitate the identification, measurement, monitoring and control of all risks facing it. h. Ensuring that appropriate plans and procedures for managing individual risk elements are in place.
i. Obtaining reasonable assurance that the institution is in control on a
regular basis
1.5.2.2 Senior Management Oversight:
Senior management is responsible for the implementation of risk policies and procedures keeping in view the strategic direction and risk appetite

specified by the board. For an effective management of risks facing a microfinance institution, senior management should at the minimum be responsible for:
a. The development and implementation of procedures and practices that translate the board's goals, objectives, and risk tolerances into operating standards that are well understood by microfinance institution personnel. b. Establishing lines of authority and responsibility for managing individual risk elements in line with the Board’s overall direction.
c. Risk identification, measurement, monitoring and control procedures.
d. Establishing effective internal controls over each risk management process. e. Ensuring that the MFI’s risk management processes are properly documented and adequate awareness about same created amongst the generality of staff so as to make risk management a part of the corporate culture of the microfinance institution.
1.5.3 Adequate Policies1
, Procedures 2 and Limits
1.5.3.1 The board of directors and senior management should tailor their risk
management policies and procedures to the types of risks that arise from the activities of the microfinance institution. Once the risks are properly identified, the microfinance institution’s policies and procedures should provide detailed guidance for the day-to-day implementation of broad business strategies and should include limits designed to shield the microfinance institution from excessive and imprudent risks.
1.5.3.2 While all microfinance institutions should have policies and procedures
that address their significant activities and risks, the coverage and level of details in these documents will vary among microfinance institutions Management is expected to ensure that policies and procedures address material areas of risk to a microfinance institution and that they are modified when necessary to respond to significant changes in the activities or business conditions of the microfinance institution.
1.5.3.3 To ensure that, an institution's policies, procedures, and limits are
adequate, the same should at minimum address the following:
a. policies, procedures, and limits should provide for adequate identification, measurement, monitoring, and control of the risks posed by its significant activities;

1 Policies are written statements of the institution’s commitment to pursue certain objectives and results. Policies often set standards (e.g. of risk tolerance) and recommends courses of action. They also express the institution’s underlying mission, values and principles. 2 Procedures are step by step processes, programs and practices that impose order on the institution’s pursuit of its objectives, defining how daily activities are to be carried out. They should be consistent with the underlying policies.

b. policies, procedures, and limits should be consistent with complexity and size of the business, the institution's stated goals and objectives, and the overall financial strength of the microfinance institution;
c. policies should clearly delineate accountability and lines of authority
across the institution's activities; and d. policies should provide for the review of activities new to the institution to ensure that the infrastructures necessary to identify, monitor, and control risks associated with an activity are in place before the activity is initiated.
1.5.4 Adequate Measurement, Monitoring and Control :
1.5.4.1 Effective risk monitoring requires microfinance institutions to identify
and measure all material risk exposures. Consequently, risk-monitoring activities must be supported by information systems that provide senior managers and directors with timely and accurately reports on the financial condition, operating performance and risk exposure of the microfinance institution, as well as with regular and sufficiently detailed reports for line managers engaged in the day to day management of the institution’s activities.
1.5.4.2 The sophistication of risk monitoring and MIS should be consistent with
the complexity and diversity of the microfinance institution’s operations. Every microfinance institution must have a set of management and board reports to support risk measuring and monitoring activities. Microfinance institutions are expected to have risk monitoring and management information systems in place that provide directors and senior management with a clear understanding of the microfinance institutions’ risk exposures.
1.5.4.3 In order to ensure effective measurement and monitoring of risk and
management information systems, the following should be observed:
a) the institution's risk monitoring practices and reports address all of its material risks; b) key assumptions, data sources, and procedures used in measuring and monitoring risk are appropriate and adequately documented and tested for reliability on an on-going basis; c) reports and other forms of communication are consistent with the institution's activities, structured to monitor exposures and compliance with established limits, goals, or objectives and, as appropriate, compare actual versus expected performance; and d) reports to management or to the institution's directors are accurate and timely and contain sufficient information for decision-makers to identify any

adverse trends and to evaluate adequately the level of risk faced by the institution.
1.5.5 Adequate Internal Controls
1.5.5.1 A microfinance institution’s internal control structure is critical to the
safe and sound functioning of the microfinance institution, in general and to its risk management, in particular. Establishing and maintaining an effective system of controls, including the enforcement of official lines of authority and the appropriate separation of duties is one of management’s more important responsibilities.
1.5.5.2 Indeed, appropriately segregating duties is a fundamental and
essential element of a sound risk management and internal control system. Failure to implement and maintain an adequate separation of duties can constitute an unsafe and unsound practice and possibly lead to serious losses or otherwise compromise the financial integrity of the microfinance institution. Serious lapses or deficiencies in internal controls including inadequate segregation of duties may warrant supervisory action, including formal enforcement action.
1.5.5.3 When properly structured, a system of internal controls promotes
effective operations and reliable financial and regulatory reporting, safeguards assets and helps to ensure compliance with relevant laws, regulations and institutional policies. Given the importance of appropriate internal controls to microfinance institutions, the results of audits or reviews, conducted by an internal auditor or other persons, should be adequately documented, as should include management’s responses to them. In addition communication channels should exist that allows findings to be reported directly to the board’s Audit Committee.
1.5.6 Role of Risk Management Function
1.5.6.1 The primary responsibility of understanding the risks run by a
microfinance institution and ensuring that the risks are appropriately managed should clearly be vested with the board of directors. The board should set limits by assessing the microfinance institution’s risk and risk￾bearing capacity. At the organizational level, overall risk management should be assigned to an independent Risk Management Committee or Risk Manager that reports directly to the board. The Risk Management Committee or the Risk Manager must be sufficiently independent of the business lines in order to ensure an adequate separation of duties and the avoidance of conflicts of interest.
1.5.6.2 Depending on the size and complexity of the activities of the MFI, the
Risk Management Committee or the Risk Manager shall take full responsibility for evaluating the overall risks faced by the microfinance institution and determining the level of risks that will be in the best

interest of the microfinance institution. The functions of the Risk Management Committee or Risk Manager should essentially be to identify measure, monitor and control the risks undertaken by the microfinance institution.
1.5.7 Integration of Risk Management
1.5.7.1 Risks must not be viewed and assessed in isolation, not only because a
single transaction might have a number of risks but also one type of risk can trigger other risks. Since interaction of various risks could result in diminution or increase in risk, the risk management process should recognize and reflect risk interactions in all business activities as appropriate. While assessing and managing risk the management should have an overall view of risks the institution is exposed to. This requires having a structure in place to look at risk interrelationships across the institution.
1.5.8 Contingency Planning
1.5.8.1 Notwithstanding all the efforts that may be made to identify measure,
monitor and control risk, it is always possible that an event or events may occur that were not contemplated at the time a risk management framework was developed. Contingency planning is therefore an essential component of effective risk management. The process starts with the assumption that an unexpected event can occur at any time and as microfinance institutions develop their various risk management systems, they are expected to give due consideration to the occurrence of such an unexpected event. Effective contingency planning requires microfinance institutions to have arrangements in place that will allow them to recover as soon as possible after the occurrence of an event and be in a position to resume acceptable levels of service. Achieving these objectives will minimize the impact that the event will have on the microfinance institution’s earnings, capital and reputation. Contingency planning is relevant to all of the risk covered in this guideline but is most important in the context of the management of liquidity and operational risk.
1.5.9 National Bank of Ethiopia Review
1.5.9.1 All microfinance institutions shall submit a copy of their comprehensive
risk management system including the mandate and membership of their risk management committees or risk managers to the National Bank of Ethiopia.

1.5.9.2 Microfinance Institutions Supervision Directorate function of National
Bank of Ethiopia shall review the adequacy of the risk management system of each microfinance institution through off-site analysis and on￾site examinations. When found necessary, the NBE may also conduct risk assessment visits to microfinance institutions.
1.5.9.3 Updates to the risk management systems shall also be submitted to the
NBE within 3 months from effective date.

2. Strategic Risk Management Guidelines
   2.1 Introduction
   2.1.1 Strategic risk refers to the potential negative impact on a microfinance
   institution’s earnings and capital that can arise in circumstances where decisions taken by the organization or the manner in which business strategies are executed result in losses or missed opportunities for the organization to remain relevant in the marketplace as a profitable and viable business entity.
   2.1.2 It relates to a microfinance institution’s ability to effectively, efficiently
   and prudently respond to business opportunities in a manner that reflects a strong vision and the ability to employ the resources necessary to achieve organizational goals in a profitable and sustainable manner. One of the most understated and underestimated risks within MFIs is the risk of having an inadequate structure or body to make effective decision (which is Governance risk, which is one of critical strategic risks)
   2.2 Board and Senior Management Oversight
   The Board
   2.2.1 The board of directors is ultimately responsible for the development of
   the vision and broad strategies to ensure that the organization achieves its corporate objectives in a profitable, prudent and sustainable manner. The overall responsibility of strategic risk management lies on the board of directors. The Board should:
   a. develop a corporate vision and broad strategies that are viable and sustainable in light of the economic and business environment in which the microfinance institution operates; b. ensure that the microfinance institution’s strategic planning and implementation processes are subject to the requirements of a strong risk management framework;
   c. approve a business plan that supports the achievement of the
   microfinance institution’s vision and broad strategies; d. ensure that adequate levels of financial resources are put in place to support on-going and new strategic initiatives pursued by the microfinance institution e. ensure that the organization acquires the appropriate human and physical resources to support attainment of its corporate strategies and objectives;

f. establishes an organizational structure that facilitates the execution of its business plan; g. establishes clear levels of responsibility for the execution of the business plan; h. ensure that adequate levels of financial resources are put in place to support on-going and new strategic initiatives pursued by the microfinance institution and that such initiatives are unlikely to have an unduly negative impact on the microfinance institution’s earnings and capital;
i. effectively communicates the organization’s broad strategies to all
relevant microfinance institution personnel; and j. Periodically re-evaluate its broad organizational strategies. Senior Management
2.2.2 The senior management is responsible for ensuring that the
operational processes necessary to support the achievement of the vision and broad strategies are developed and implemented consistently throughout the organization. Senior management should:
a. develop a business plan that supports the achievement of the microfinance institution’s vision and broad strategies; b. provide the board with relevant and up-to-date economic, business and market data as a critical input to the process of developing strategies and initiatives;
c. ensure that appropriate risk management frameworks are developed
and implemented to manage all programs and initiatives developed to give effect to strategies developed by the board; d. ensure that appropriate measures are taken to mitigate possible downside consequences of new business initiatives; e. ensure that the organization’s vision and supporting strategies, programs and initiatives are effectively communicated throughout the organization; f. ensure that all staff have a firm understanding of the implications of existing and new strategies, programs and initiatives for their work; g. ensure that all staff have a firm understanding of the organization’s culture including it’s general tolerance for risks in all areas of its operations and role played by relevant risk management practices to measure, monitor and control such risks; and h. develop mechanism to provide periodic reports to the board on the program in achieving implementing the organizations broad strategies and objectives.

2.3 Policies and Procedures
2.3.1 It is important for microfinance institutions to develop and implement
appropriate policies and procedures for the effective management of strategic risk. Such policies and procedures should give effect to the achievement of vision and strategic objectives established by the board and should facilitate the management of strategic risk in a manner consistent with the implementation framework devised by senior management.
2.3.2 Policies and procedures should:
a. establish the mechanisms to effectively manage the risk inherent in each area of business activity; b. establish the distribution of responsibilities for the management of the risks inherent in the various lines of activity undertaken by the microfinance institution;
c. Establish a framework for the review of the areas of business in
which the microfinance institution is engaged and should establish the criteria that will form the basis of such reviews; d. Establish a framework and mechanisms for the on-going analysis of the economic and business environment in which the microfinance institution operates in order to continually assess the relevance of the microfinance institution’s vision and strategies to that environment; and e. Establish a framework for the periodic review of the adequacy and appropriateness of the resources employed by the microfinance institution in light of the lines of business in which it is engaged and the prevailing economic, business and technological environment relevant to such lines of business.

2.4 Measurement, Monitoring and Control
2.4.1 Microfinance institutions should have systems that provide useful and
relevant information to the board and senior management in light of the organization’s chosen strategies, business plan, products and services.
2.4.2 The system should provide the following information;
a. General macro economic information such as actual and projected:

• economic growth rates

• employment data,

• inflation data

• foreign exchange rates with major trading currencies for the Birr
  b. General industry information such as:

• Performance of main competitors

• General trends on profitability in the industry

• Information on new entrants, actual and prospective

• Number and size of mergers and acquisitions in the industry

• Incidence of non- microfinance institution financial institutions
  starting to provide similar products and services to certain segments of the microfinance institution’s customer base
  c. Product information such as:

• Profitability associated with different products and services currently
  provided by the microfinance institution;

• Risks of losses or the occurrence of events that could result in negative
  exposure for the microfinance institution, linked to existing products and services;

• Enhancements to existing resources that are necessary to maintain
  current products and services at a competitive level;

• New technological developments that could lead to obsolescence of
  existing products or services offered by the microfinance institution; and

• Changing customer preferences in relation to existing products and
  services offered by the microfinance institution.
  2.5 Internal Controls
  2.5.1 Strong and effective internal controls are essential for a robust
  framework for the management of strategic risk.
  2.5.2 An effective system for internal controls should include:
  a. Establishing clear lines of authority for the execution of organizational strategies and initiatives; b. Effective arrangements for the avoidance of conflicts of interest in the execution of the strategies and initiatives; and
  c. Effective reporting mechanisms.
  2.5.3 MFI’s internal audit function should among other things, perform
  periodic checking on whether the strategic risk management system is properly implemented and the established policies and control procedures in respect of risk management are complied with.
  2.6 Business Continuity management
  2.6.1 Have in place a flexible strategic planning process that addresses its
  goals and objectives

2.6.2 Periodically review and update the business plans and strategies to
reflect changes in the organization’s personnel and in the strategic risks that the organization might face.
3. Credit Risk Management Guidelines
3.1 Introduction
3.1.1 Credit risk is the financial exposure resulting from a microfinance
institution’s dependence on another party (counterparty) to perform an obligation as agreed. It is the risk to earnings or capital due to borrower’s late and non repayment of loan obligation. Credit risk encompasses both the loss of income resulting from the MFI’s inability to collect an anticipated interest earnings as well as the loss of principal resulting from loan defaults. Microfinance institutions need to manage the credit risk inherent in the entire portfolio as well as the risk in individual credits or transactions. Additionally, microfinance institutions should be aware that credit risk does not exist in isolation from other risks, but is closely intertwined with those risks.
3.1.2 An effective and sound credit risk management is critical to the
stability of an institution. Effective credit risk management is the process of managing an institution’s activities which create credit risk exposures, in a manner that significantly reduces the likelihood that such activities will impact negatively on a microfinance institution’s earnings and capital. Credit risk is not confined to a microfinance institution’s loan portfolio, but can also exist in its other assets and activities. Likewise, such risk can exist in both a microfinance institution’s on-balance sheet and its off-balance sheet accounts.
3.1.3 Effective approaches to managing credit risk in MFIs include:
a. Active oversight by board and senior management, well designed borrower screening, careful loan structuring, close monitoring clear collection procedures etc. To avoid rapid spread and potential of significant loss, delinquency should be understood and addressed promptly. b. Good portfolio reporting that accurately reflects the status and monthly trends in delinquency, including a portfolio at risk aging
schedule and separate reports by product, sector, loan officer,
branch etc.
c. Following up concentration of credit

3.2 Board and Senior Management Oversight
Board
3.2.1 The board of directors is has the critical role and ultimate
responsibility for reviewing and approving a microfinance institution’s credit risk strategy and policies. Each microfinance institution should develop a strategy that sets the objectives of its credit-granting activities and adopts the necessary policies and procedures for conducting such activities.
3.2.2 The board should ensure that it :
a. approves broad business strategies and policies that govern or influence the management of credit risk of the microfinance institution. b. sets out the microfinance institutions’ tolerance for credit risk in the context of types of credits, economic sectors, geographical locations, currencies, and maturities 3 ;
c. establishes goals for credit quality, earnings and growth;
d. establishes clear levels of delegation within the credit risk management function; e. ensures that senior management as well as individuals responsible for credit risk management posses sound expertise and knowledge to accomplish the credit risk management function; f. ensures that the microfinance institution’s management adopts appropriate plans and procedures for credit risk management; g. ensures that credit risk is adequately measured, monitored and controlled and effectively communicates the strategies and policies to all relevant microfinance institutions personnel; h. Periodically re-evaluate significant credit risk management policies as well as overall business strategies that affect the credit risk exposure of the microfinance institution.
3.2.3 The board of directors is also responsible for monitoring compliance
with the credit risk management strategy. This is usually accomplished through periodic reporting of management and internal auditors. The reports must provide sufficient information to satisfy the board of directors that a microfinance institution is complying with its credit risk management policies and NBE directives. The board should review loans in line with NBE directives on provisions.
3.2.4 Moreover, the Board of Directors should:

3 Types of credit might also include identify target markets and the overall characteristics the microfinance institution seeks in its credit portfolio (including levels of diversification and concentration tolerances.

a. Ensure that internal audit reviews the credit operations to asses whether or not the institutions policies and procedures are adequate and being addressed to; b. require independent reviews of credit operations to assess whether the microfinance institution’s policies and procedures are being properly followed on ongoing basis;
c. review exposures and policies regarding credit to related parties as
defined by the NBE directives; d. review exposures and policies regarding credit to corporations or other legal entities controlled by the microfinance institution through ownership or management structure; e. review all credit exposures that are in excess of the credit approval authority delegated to management f. review all restructured exposures; g. review trends in portfolio quality and the adequacy of the microfinance institution’s provision for credit losses; h. specify the content and frequency of management reports to the board on credit risk management; and
i. Ensure compliance with all relevant regulations and NBE directives.
3.2.5 The board is also responsible for the selection and retention of senior
management capable of managing the credit activities of the microfinance institution and seeing that such activities are performed within the NBE regulations, the risk strategy, policies and tolerances approved by the board. Management Responsibilities
3.2.6 Management of the institution is responsible for implementing the
credit risk management strategies and policies approved by the board of directors and also ensure that the procedures are put in place to manage and control credit risk and quality of credit portfolio. Such policies and procedures should address credit risk in all of the microfinance institution’s activities at both the individual credit and portfolio levels. Senior management must ensure that there is a periodic independent internal or external assessment of the microfinance institution’s credit management functions.
3.2.7 Management of each Microfinance institution should:
a. develop credit policies, procedures and practice as apart of overall credit management framework for approval by the board; b. implement credit risk management policies
c. undertake the management of credit risk in accordance the
delegated authority developed by the board;

d. develop measures that will facilitate the measurement, monitoring and control of credit risk; e. implement a system of internal controls that will serve as an effective check over the measures used to manage credit risk; f. ensure that internal audit reviews the credit risk management system on an on-going basis; g. monitor the quality of the credit portfolio and ensure that the portfolio is classified in line with the NBE Directive on Provisioning, uncollectible exposures written off and loan losses provisions are accounted in line with the NBE requirements; h. ensure that internal audit reviews are conducted on an ongoing basis and assess the credit portfolio and credit risk management system;
i. develop lines of communication to ensure the timely dissemination of
credit risk management policies and other credit risk management information to all individuals involved in the process; and j. develop an effective system of reporting to the board on issues related to the management of credit risk.

3.3 Credit Policies and Procedures
3.3.1. At a minimum the credit policy should include:
a. detailed credit evaluation and appraisal process, administration and documentation; b. Credit approval authority at various hierarchy levels, including authority for approving exceptions;
c. Risk identification, assessment, measurement, monitoring and
control; d. Risk acceptance criteria; e. Credit origination, credit administration and loan documentation procedures; f. Roles and responsibilities of units/staff involved in origination of credit; g. Authority for approval of allowance for probable losses and write-offs h. Guidelines on large credit exposures and connected lending;
i. Guidelines for management of problem loans including the
institution’s loan portfolio aging and loan provisioning system j. Credit pricing k. The institution’s plan to grant credit based on various client segment and products, economic sectors, geographical location and maturity
l. sound and prudent portfolio concentration limits.
3.3.2 In order to be effective, credit policies must be communicated
throughout the institution, implemented through appropriate procedures, and periodically revised to take into account changing internal and external circumstances

Credit Risk management Committee
3.3.3 The credit risk management strategy of a microfinance institution
should be articulated in a policy approved by the board of directors. For that purpose, each microfinance institution should establish a board level committee to address issues relating to credit policy and procedures, and to analyze, manage and control credit risk on an institution-wide basis.

Credit Philosophy
3.3.4 The foundation for effective credit risk management is the identification
of existing and potential risks in the microfinance institution’s credit products and credit activities. This creates the need for development and implementation of clearly defined policies, formally established in writing, which set out the credit risk philosophy of the microfinance institution and the parameters under which credit risk is to be controlled. Measuring the risks attached to each credit activity permits provides a platform against which the microfinance institution can make critical decisions about the nature and scope of the credit activity it is willing to undertake.
3.3.5 A cornerstone of safe and sound microfinance institution is the
design and implementation of written policies and procedures related to identifying, measuring, monitoring and controlling credit risk. Credit policies establish the framework for lending and guide the credit-granting activities of the microfinance institution.
3.3.6 The policies should be designed and implemented with consideration
for internal and external factors such as the microfinance institution’s market position, trade area, staff capabilities and technology; and should particularly establish targets for portfolio mix and exposure limits to single counterparties, groups of connected counterparties, industries or economic sectors, geographic regions and specific products.
3.3.7 Effective policies and procedures enable a microfinance institution to:
maintain sound credit-granting standards; monitor and control credit risk; properly evaluate new business opportunities; and identify and administer problem credits.
3.3.8 The basis for an effective credit risk management process is the
identification and analysis of existing and potential risks inherent in any product or activity. Consequently, it is important that microfinance institutions identify the credit risk inherent in all the products they offer and the activities in which they engage.
3.3.9 This is particularly true for those products and activities that are new
to the microfinance institution where risk may be less obvious and

which may require more analysis than traditional credit-granting activities. Although such activities may require tailored procedures and controls, the basic principles of credit risk management will still apply. All new products and activities should receive board approval before being offered by the microfinance institution. Credit Analysis and Approval Process
3.3.10 Prior to entering into any new credit relationship, consideration
should be given to the integrity and reputation of the party as well as their legal capacity to assume the liability. Microfinance institutions need to understand to whom they are granting credit. Therefore, prior to entering into any new credit relationship, a microfinance institution must become familiar with the borrower or counterparty and be confident that they are dealing with an individual or organization of sound repute and creditworthiness. In particular, strict policies must be in place to avoid association with individuals involved in criminal activities.
3.3.11 Establishing sound, well-defined credit-granting criteria is essential
to approve credit in a safe and sound manner. In order to conduct an effective credit-granting program, microfinance institutions must receive sufficient information to enable a comprehensive assessment of the risk profile of the counterparty.
3.3.12 Depending on the type of credit exposure and the nature of the
credit relationship with the counterparty, the factors to be considered and documented in credit granting include:
a. purpose of the credit and sources of repayment; b. borrower’s repayment history and current capacity to repay, based on historical financial trends and future cash flow projections under various scenarios;
c. terms and conditions of the credit including covenants designed
to limit changes in the future risk profile of the borrower; d. adequacy and enforceability of collateral or guarantees under various scenarios; e. current risk profile of the counterparty (including the nature and aggregate amounts of risk), and sensitivity to economic and market developments; and f. borrower’s business expertise and management capability.
3.3.13 In order to maintain a sound credit portfolio, a microfinance
institution must have a clearly established process in place for approving new credits as well as extensions or renewal and refinancing of existing credits. Approvals should be made in accordance with the microfinance institution’s written guidelines and granted by the appropriate level of management. There

should be a clear audit trail documenting the approval process and identifying the individual(s) and/or committee(s) making the credit decision.
3.3.14 Each credit proposal should be subjected to careful analysis by a
qualified credit risk officer with expertise commensurate with the size and complexity of the transaction. An effective evaluation process establishes minimum requirements for the information on which the analysis is to be based as listed above. The information received will be the basis for any internal evaluation or rating assigned to the credit and its accuracy and adequacy is critical to management making appropriate judgments about the acceptability of the credit. Authority for Loan Approval
3.3.15 In order to maintain a sound credit portfolio, a banking institution
must have am established formal evaluation and approval process for granting of credits.
3.3.16 Approval should be made with written guidelines and granted by
appropriate level of management
3.3.17 Each credit approval should be subject to careful analysis with
expertise commensurate with the size and complexity of the transaction. There should be policies in place regarding the information and documentation needed to approve new credits, renew existing credit and/or change the terms and conditions of previously approved credits.
3.3.18 A microfinance institution’s credit approval process should establish
accountability for decisions taken and designate the individuals who have authority to approve credits or changes in credit terms. Depending upon its size and nature, credit may be approved through individual authority, joint authorities or through a committee.
3.3.19 Approval authorities should be commensurate with the expertise of
the individuals involved and the delegation of authority should include, as a minimum:
a. the absolute and/or incremental credit approval authority being delegated; b. the provision or write –off authority being delegated;
c. the officers, positions or committees to whom authority is being
delegated; d. the ability of recipients to further delegate risk approval and write￾off authority; and

e. the restrictions, if any, placed on the use of delegated risk approval and write-off authorities.
3.3.20 The degree of delegation of authority will depend on a number of
variables, including:
a. the microfinance institution’s credit risk philosophy; b. the quality of the credit portfolio;
c. the degree of market responsiveness required;
d. the types of risks being assessed; and e. the experience of lending officers.
3.3.21 Incase where lending authority is assigned to the loan originating
function, there should be compensating process and measures to ensure adherence to lending standards. There should be periodic review of lending authority assigned to officers. Credit Limits and Credit Concentration
3.3.22 To ensure diversification, exposure limits are needed in all areas of
the microfinance institution’s activities that involve credit risk. Microfinance institutions should establish credit limits for individual counterparties and groups of connected counterparties that aggregate different types of on and off balance sheet exposures. Under no circumstance can limits established by microfinance institutions be higher than regulatory limits set by NBE. Limits should also be established for particular industries or economic sectors, geographic regions specific products, a class of security, and group of associated borrowers. Credit Concentration
3.3.23 Credit concentration can occur when a microfinance institution’s
portfolio contains a high level of direct or indirect credits to:
a. a single counterparty; b. an industry/sector;
c. a geographical region;
d. a type of credit facility and e. a class of collateral.
3.3.24 Excessive concentration renders a microfinance institution
vulnerable to adverse changes in the area in which the credit is concentrated and to violations of statutory and regulatory limits. Sound and prudent risk management involves the minimization of concentration risk by diversifying the credit portfolio. At a minimum, credit diversification policies should:

a. be stated clearly b. include goals for portfolio mix;
c. place exposure limits on single counter parties, key industries or
economic sectors, geographical regions and new or existing products; and d. be in compliance with NBE statutory and regulatory limits on single exposures.
3.3.25 In considering potential credits, microfinance institutions must
recognize the necessity of establishing provisions for identified and expected losses in line with the NBE directives on provisions and holding adequate capital to absorb unexpected losses. These considerations should factor into credit-granting decisions as well as the overall portfolio risk management process. Credit Risk Mitigation
3.3.26 A number of techniques are available to microfinance institutions to
assist in the mitigation of credit risk. Group collateral and guarantees are the most commonly used. Various forms of other collateral and guarantees (Including physical collateral, personal guarantees etc.) could also be used. Notwithstanding the use of various mitigation techniques individual credits transactions should be entered into primarily on the strength of the borrower’s repayment capacity. Microfinance institutions should also be mindful that the value of collateral might well be impaired by the same factors that have led to the diminished recoverability of the credit.
3.3.27 Microfinance institutions should have policies covering the
acceptability of various forms of collateral, procedures for the ongoing valuation of such collateral, and a process to ensure that collateral is, and continues to be, enforceable and realizable. With regard to guarantees, microfinance institutions should evaluate the level of coverage being provided in relation to the credit-quality and legal capacity of the guarantor. Microfinance institutions should be careful when making assumptions about implied support from third parties including government entities.
3.4 Risk Measurement, Monitoring and Control
3.4.1 Failure to establish adequate procedures to effectively monitor and
control the credit function within established guidelines has resulted in credit problems for many microfinance institutions. Compromising credit policies and procedures has been another major cause of

credit problems. Accordingly, each microfinance institution needs to develop and implement comprehensive procedures and information systems to effectively monitor and control the risks inherent in its credit portfolio. These procedures need to define prudent criteria for identifying and reporting potential problem accounts to ensure that such accounts are identified for more frequent review, followed up with appropriate corrective action, adversely classified where appropriate and that provisions are made where necessary.
3.4.2 Categorization of the credit portfolio by credit characteristics, risk
rating and regular review of individual and groups of credits within the portfolio and independent internal credit inspections or audits are integral elements of effective and prudent portfolio monitoring and control.
3.4.3 Good portfolio reporting that actually reflects the status and monthly
trends in delinquency including portfolio at risk aging schedule and separate reports by loan product. Credit Administration Policies
3.4.3 Credit administration is a critical element in maintaining the safety
and soundness of a microfinance institution. Once a credit is granted, it is the responsibility of the microfinance institution to ensure that the credit is properly maintained. This includes keeping the credit file up to date, obtaining current financial information, sending out renewal notices and preparing various documents such as loan agreements.
3.4.4 In larger microfinance institutions, the responsibility for credit
administration may be split among different departments, but in smaller microfinance institutions these responsibilities may be assigned to individuals. Where individuals perform such sensitive functions as custody of key documents, entering credit limits into the computer database e.t.c, they should report to managers who are independent of the business origination and credit approval processes.
3.4.5 In developing credit administration arrangements, microfinance
institutions should ensure:
a. the efficiency and effectiveness of credit administration operations, including monitoring of credits, maintenance of adequate documentation, observance of contractual obligations and legal covenants and maintenance of collateral, etc.; b. the accuracy and timeliness of information generated by management information systems;
c. the effectiveness of the segregation of duties;

d. the adequacy of controls over all “back office” procedures; and e. compliance with prescribed management policies and procedures as well as applicable laws and regulations. Credit Files
3.4.5 The credit files of a microfinance institution should include all the
information necessary to ascertain the current financial condition of counterparties as well as sufficient information to track the decisions made and credit history of borrowers. Credit Monitoring Procedures
3.4.6 Microfinance institutions need to develop and implement
comprehensive procedures and information systems for monitoring the condition of individual counterparties across the microfinance institution’s various portfolios. These procedures should define the criteria for identifying and reporting potential problem credits and other transactions to ensure that they are subject to more frequent monitoring, corrective action, and proper classification/provisioning.
3.4.7 An effective credit monitoring system will include measures to:
a. ensure that the microfinance institution understands the current financial condition of the counterparty; b. ensure that all credits are in compliance with existing covenants;
c. follow up of custom’s utilization of the approved credit lines;
d. ensure that projected cash flows on major credits meet debt servicing requirements; e. ensure, where applicable, collateral coverage provides adequate coverage relative to the obligator’s current condition; f. determine if payments are being made from the source that was anticipated at the time the credit was booked; g. identify and classify potential problem credits on a timely basis; and h. direct promptly problems for remedial management.
3.4.8 Specific individuals should be responsible for monitoring credit
quality, including ensuring that relevant information is passed to those responsible for assigning internal risk ratings to the credit. In addition, individuals should be made responsible for monitoring on an ongoing basis any underlying collateral and guarantees. Such monitoring will assist the microfinance institution in making necessary changes to contractual arrangements as well as maintaining adequate reserves for credit losses.

Stress Testing
3.4.9 An important element of sound credit risk management involves
discussing what could potentially go wrong with individual credits and within the various credit portfolios, and factoring this information into the analysis of the adequacy of capital and provisions. This exercise can reveal previously undetected areas of potential credit risk exposure.
3.4.10 The linkages between different categories of risk that are likely to
emerge in times of crisis should be fully understood. In case of adverse circumstances, there may be a substantial correlation of various risks. Scenario analysis and stress testing are useful ways of assessing areas of potential problems.
3.4.11 Stress testing should involve identifying possible events or future
changes in economic conditions that could have unfavorable effects on a microfinance institution’s credit exposures and assessing the microfinance institution’s ability to withstand such changes. Three areas that microfinance institutions could usefully examine are: (i) economic or industry downturns; (ii) market-risk events; and (iii) liquidity conditions.
3.4.12 Whatever the method of stress testing used, the output of the tests
should be reviewed periodically by senior management and appropriate action taken in cases where the results exceed agreed tolerances. The output should also be incorporated into the process for assigning and updating policies and limits. Managing Problem Credits
3.4.13 Microfinance institutions should establish a system that helps
identify problem loans a head of time when there may be more options available for remedial measures. Microfinance institutions must have disciplined and vigorous remedial management process, triggered by specific events, that are administered through the credit administration and problem recognition systems. Once the loan is identified as problem, it should be managed under a dedicated remedial process.
3.4.15 A microfinance institution’s credit risk policies should clearly set out
how the microfinance institution will manage problem credits. Microfinance institutions should document how various courses of actions should be applied. These include renewal, and extension of impaired credit facilities. The procedures should clearly set out the level of officers within the organization that will have responsibility

to make such decisions and how standard credit approval practices will be enhanced in the case of impaired credit. Management Information Systems
3.4.16 The effectiveness of a microfinance institution’s risk measurement
process is highly dependent on the quality of its management information systems since this information is used by the board and management to fulfill their respective oversight roles. Microfinance institutions should establish management information systems and analytical techniques that enable management to measure the credit risk inherent in all on- and off-balance sheet activities.
3.4.17 The information system should provide adequate information on the
composition of the credit portfolio, including identification of any concentrations of risk.
3.4.18 The analysis of credit risk data should be undertaken at an
appropriate frequency with the results reviewed against relevant limits. Microfinance institutions should use measurement techniques that are appropriate to the complexity and level of the risks involved in their activities, based on robust data, and subject to periodic validation.
3.4.19 In particular, information on the composition and quality of the
various portfolios, including on a consolidated microfinance institution basis, should enable the board and all levels of management to fulfill their respective roles. Therefore, the quality, detail and timeliness of information are critical to assess quickly and accurately the level of credit risk that the microfinance institution has incurred through its various activities and determine whether the microfinance institution’s performance is within the tolerance limits of the credit risk strategy.
3.4.20 Microfinance institutions should monitor actual exposures against
established limits. It is important that microfinance institutions have a management information system in place to ensure that exposures approaching risk limits are brought to the attention of senior management.
3.4.21 All exposures should be included in a risk limit measurement
system. The microfinance institution’s information system should be able to aggregate credit exposures to individual borrowers and counterparties and report on exceptions to credit risk limits on a meaningful and timely basis.
3.4.22 The adequacy of scope of information should be reviewed on a
periodic basis the board of directors should ensure that it is sufficient to the complexity of the business of the MFI.

3.5 Internal Controls
3.5.1 Microfinance institutions must establish a system of independent,
ongoing assessment of their credit risk management processes and the results of such reviews should be communicated directly to the board of directors and senior management.
3.5.2 The microfinance institution should have an efficient internal review
and reporting system as an effective oversight mechanism in respect of its credit function. This system should provide the board of directors and senior management with sufficient information to evaluate the performance of account officers and the condition of the credit portfolio.
3.5.3 Internal credit reviews conducted by individuals’ independent from the
business function provide an important assessment of individual credits and the overall quality of the credit portfolio. Such a credit review function can help evaluate the overall credit administration process, determine the accuracy of internal risk ratings and judge how effectively credits are being monitored.
3.5.4 The credit review function should report directly to the board of
directors, a committee with audit responsibilities, or senior management without lending authority (e.g., senior management within the risk control function.)
3.5.5 The goal of credit risk management is to maintain a microfinance
institution’s credit risk exposure within parameters set by the board of directors and senior management. The establishment and enforcement of internal controls, operating limits and other practices will help ensure that credit risk exposures do not exceed levels acceptable to the individual microfinance institution. Such a system will enable microfinance institution management to monitor adherence to the established credit risk objectives. Internal audits of the credit risk processes should be conducted on a periodic basis. They should be used to confirm that:
a. credits have been granted in compliance with the microfinance institution’s credit policies and procedures, b. periodic reports on all the exposures are available to senior management and are submitted to the board;
c. weaknesses in the credit risk management process are
identified and reported to the board; and d. exceptions to established policies and procedures are reported to the board.

4. Liquidity Risk Management Guidelines
   4.1 Introduction

4.1.1 Microfinance institutions should properly manage its liquidity taking in to
account the complex aspects of sound asset and liability management.
4.1.2 Liquidity is considered a major risk for microfinance institutions. Liquidity
risk is the risk of being unable to meet commitments, repayments and withdrawals at the correct time and place. The purpose of liquidity management is to ensure that every microfinance institution is able to meet fully its contractual commitments.
4.1.3 The ability to fund increases in assets and meet obligations as they come
due is critical to the ongoing viability of any microfinance institution. Therefore, managing liquidity is among the most important activities conducted by microfinance institutions.
4.1.4 Sound liquidity management can reduce the probability of serious
problems. Indeed, the importance of liquidity transcends the individual microfinance institution, since a liquidity shortfall at a single microfinance institution can have system-wide repercussions. For this reason, the analysis of liquidity requires the management of the microfinance institution not only to measure the liquidity position of the microfinance institution on an ongoing basis, but also to examine how funding requirements are likely to evolve under various scenarios, including adverse conditions.
4.1.5 Microfinance institutions should review frequently the assumptions utilized
in managing liquidity to determine that they continue to be valid. Since a microfinance institution’s future liquidity position will be affected by factors that cannot always be forecasted with precision, assumptions need to be reviewed frequently to determine their continuing validity. These assumptions should be made under the different categories of assets, liabilities and off-balance sheet activities.
4.1.6 Since financial risks are not mutually exclusive, liquidity risk may not be
seen in isolation. Liquidity risk can be trigged by many other factors such as credit risk and or any other risk.

4.2 Board and Senior Management Oversight
Board of Directors
4.2.1 The board of directors is responsible for approving and reviewing the
liquidity risk management strategy and policies of the microfinance institution. Each microfinance institution should develop a strategy that sets the objectives of ensuring that the microfinance institution at all times, has adequate levels of liquidity to meet its operational needs and should

adopt the necessary policies and procedures to achieve this objective. At a minimum, the board should:
a. Understand the nature and level of institution’s liquidity risk; b. At all time be informed of the institution’s liquidity risk;
c. approve broad business strategies, policies, guidelines and internal
control and limits for managing and monitoring liquidity; d. establish tolerance levels in respect of liquidity risk; e. establish clear levels of delegation within the liquidity management function; f. ensure that the microfinance institution’s management adopts procedures to enable the achievement of the objectives set out in the strategy and policies; g. ensure that the management measures, monitors and controls liquidity risk; h. effectively communicate the strategies and policies to all relevant microfinance institution personnel;
i. ensure that the liquidity management framework is regularly reviewed;
j. ensure that the management information systems are in place which can adequately measure, monitor, control and report liquidity risk; k. ensures compliance with all relevant proclamations, regulations and NBE directives. Role of Management
4.2.2 The management is responsible for the day-to-day management of the
microfinance institution’s liquidity. To ensure that the microfinance institution has adequate levels of liquidity to meet its on-going operational needs, including at times when there are unusual demands on liquidity, senior management should; a. Establish and implement procedures, guidelines, internal control and practices that facilitate the implementation of the broad liquidity management strategy and policies adopted by the board; b. undertake the management of liquidity risk in accordance with the delegated authority developed by the board;
c. Prudently manage and control liquidity in accordance with the policy;
d. ensure that the techniques employees measure accurately, continually and consistently with the institution’s current liquidity, and estimate its projected liquidity e. implement a system of internal controls that will serve as an effective check over the measures used to manage liquidity risk; f. ensure that internal audit reviews the liquidity risk management system on an on-going basis; g. ensure compliance with any relevant NBE Directive on the management of liquidity risk;

h. prepare effective contingency plans to provide the microfinance institution with liquidity under adverse conditions;
i. develop lines of communication to ensure the timely dissemination of
liquidity management policies and other liquidity risk management information to all individuals involved in the process; and j. develop an effective system of reporting to the board on issues related to the management of liquidity risk. k. Review, periodically, the institutions liquidity strategies, policies and procedures
4.2.3 Depending on the size and complexity of the institution, the responsibility
for managing the overall liquidity of the microfinance institution should be placed with a specific, identified group within the microfinance institution, normally in the form of an asset liability committee (ALCO) that comprises senior management and the treasury function. The ALCO is charged with ensuring that the microfinance institution has enough financial resources to function in a profitable, sound and sustainable manner. This includes the responsibility to ensure that the microfinance institutions can fund desired levels of asset growth while meeting all liabilities as they become due and without incurring unreasonable cost in doing so.
4.2.4 Depending on the size and complexity of the institution ,NBE may require
the board of directors of each microfinance institution to constitute an ALCO, which shall establish broad guidelines on the microfinance institution’s tolerance for risk, among others. All proceedings of the committee should be properly recorded.
4.3 Liquidity Risk Management Policies and Procedures
4.3.1 Microfinance institutions are expected to create policies and procedures to
give effect to the liquidity management strategy developed by the board. The policies and procedures should:
a. reflect the tolerance limits for liquidity risk established by the board; b. establish the distribution of responsibilities for the management of the various components of liquidity risk with a clear statement of the levels of authority necessary to undertake specific functions;
c. clearly establish the duties and responsibilities of the microfinance
institution’s Asset Liability Management Committee (ALCO); and d. clearly set out a contingency measures that are in place to ensure that the microfinance institutions will have access to adequate liquidity especially in times of crisis.
4.3.2 Microfinance institutions should set and regularly review limits on the
size of their liquidity positions over particular time horizons. Institutions

should analyze the likely impact of different stress scenarios on their liquidity position and set their limits accordingly.
4.3.3 Limits should be appropriate to the size, complexity and financial
condition of the microfinance institution. Management should also define the specific procedures and approvals necessary for exceptions to policies and limits. Limits could be set, for example, on the following:
a. cumulative cash flow mismatches (i.e., the cumulative net funding requirement as a percentage of total liabilities) over particular period – next day, next five days, next month etc. These mismatches should be calculated by taking a conservative view of marketability of liquid assets, with a discount to cover price volatility and any drop in price in the event of a forced sale, and should include likely outflows as a result of draw down of commitments etc. b. liquid assets as a percentage of short-term liabilities. Again, there should be a discount to reflect price volatility. The assets included in this category should only be those that are highly liquid – i.e., only those in which there is judged to be a ready market even in periods of stress.
4.3.4 There should be a clear indication of the specific procedures and approvals
necessary for exceptions to policies, limits and authorizations.
4.3.5 Microfinance institutions are also expected to comply strictly with NBE’s
minimum requirements on liquid assets holdings and reserve requirements. Microfinance institutions should not classify assets that are being used as collateral in any form. (i.e. assets that are pledged as security against advances) as liquid assets.
4.4 Measuring, Monitoring and Controlling liquidity Risk
Measurement
4.5.1 At a very basic level, liquidity measurement involves assessing all of a
microfinance institution’s cash inflows against its outflows to identify the potential for any net shortfalls going forward. This includes funding requirements for off-balance sheet commitments. As all microfinance institutions are affected by changes in the economic climate and market conditions, the monitoring of economic and market trends is key to liquidity risk management.

MIS
4.4.2 Every microfinance institution must have adequate information systems for
measuring, monitoring, controlling and reporting on liquidity risk. Reports should be provided on a timely basis to the microfinance institution’s board of directors, senior management and other appropriate personnel. A strong management information system (MIS) that is flexible enough to deal with various contingencies that may arise is central to making sound decisions related to liquidity. The MIS should be used to check for compliance with the microfinance institution’s established policies, procedures and limits and with NBE’s prudential requirements on liquidity.
4.4.3 The MIS should also enable management to evaluate the trends in the
microfinance institution’s aggregate liquidity exposure. Assumptions if any should be set out clearly so that management can evaluate the validity and consistency of key assumptions and understand the implications of various stress scenarios. Determining Funding Needs
4.4.4 An important aspect of managing liquidity is making assumptions about
future funding needs. While certain cash inflows and outflows can be easily calculated or predicted, microfinance institutions must also make assumptions about future liquidity needs, both in the very short-term and for longer time periods. Cash inflows arise from maturing assets, saleable non-maturing assets, access to deposit liabilities, established credit lines that can be tapped etc.
4.4.5 These cash inflows must be matched against cash outflows stemming from
decrease in liabilities due and settlement of contingent liabilities. Microfinance institutions should also have some level of preparedness to meet cash outflows that arise from unexpected events.
4.4.6 The management of the MFIs shall put in place mechanisms that assist in
identification of problems in order to explore ways and means of raising additional fund of the right size and amount
4.4.7 An institution shall base its liquidity management process on the following
a. preparation of cash flow projections; and assumptions made in cash flow projections shall be clear and documented and shall be subject to review to determine the validity of underlying factors; b. The cash flow projections should estimate the institution’s inflows and outflows and net position (gap) over a time horizon. It is suggested that MFIs calculate daily, weekly and monthly gap for next six months or a year and quarterly thereafter.
c. maintenance of a stock of readily available quality liquid assets in line
with the cash flow projections; d. MFIs may use variety of ratios to quantify liquidity;

e. measurement and control of the institution’s funding requirements which shall involve the process of assessing cash flows against the institution’s outflows to identify the potential for any shortfall; f. managing access to funds in the market g. Contingency plans to handle liquidity crisis shall be in place h. Using branch procedures to limit unexpected increase in cash needs.
i. Anticipating the potential cash requirements of new product
introductions or seasonal variations in deposits and withdrawals. Contingency Planning
4.4.8 An effective contingency plan should establish a strategy and procedures
for accessing funds under adverse circumstances. A contingency plan should consist of several components, most important of which is management coordination. The plan should spell out procedures for ensuring that information flows are timely and uninterrupted so as to provide management with the tools to make an informed decision.
4.4.9 A strategy should be adopted for managing the behavior of assets and
liabilities so as to minimize the effects of mismatched cash inflows and outflows. An attempt should be made to maintain relationships with liability holders and plans should be made for building back-up liquidity. To the extent possible, these back-up facilities should be quantified and the procedures for accessing those facilities pre-defined. Stress Testing
4.4.10 For the purpose of anticipating future problems and their solutions, a
microfinance institution should subject its liquidity position to stress tests. Evaluation of whether a microfinance institution is sufficiently liquid depends to a large extent on the behavior of cash flows under different conditions. Microfinance institutions should therefore examine their liquidity positions under a number of different scenarios. Under each scenario, a microfinance institution should try to account for any significant positive or negative liquidity swings that could occur. These scenarios should take into account factors that are both internal (microfinance institution-specific) and external (market-related).
4.4.11 While liquidity will typically be managed under “normal” circumstances, the
microfinance institution must also be prepared to manage liquidity under adverse circumstances.
4.5 Internal Controls
4.5.1 A microfinance institution should have an adequate system of internal
controls over its liquidity risk management process. They should promote

effective and efficient operations, reliable financial and regulatory reporting and compliance with relevant laws, regulations and prudential norms.
4.5.2 A fundamental component of the internal control system involves regular
independent reviews and evaluations of the effectiveness of the system and where necessary, ensuring that appropriate revisions or enhancements to internal controls are made.
4.5.3 An effective system of internal control for liquidity risk includes:
a. adequate processes for identifying and evaluating liquidity risk; b. an environment that promotes strong adherence to established policies and procedures ; and
c. adequate information systems.
4.5.4 Periodic reviews should be conducted to determine whether the
organization complies with its liquidity risk management policies and procedures. Positions that exceed established limits should receive prompt attention of appropriate management and should be resolved according to the process described in approved policies.
4.5.5 Periodic reviews of the liquidity management process should also address
any significant changes in the nature of instruments acquired, limits and internal controls that have occurred since the last review.
4.5.6 The internal audit function should also periodically review the liquidity
management process in order to identify any weaknesses or problems. In turn, these should be addressed by management in a timely and effective manner.

5. Interest Rate Risk Management Guidelines
   5.1 Introduction
   5.1.1 Interest rate risk is the exposure of microfinance institutions financial
   condition to adverse movements in interest rates. Accepting this risk is a normal part of microfinance institutions business and can be an important source of profitability and shareholder value. However, excessive interest rate risk can pose a significant threat to microfinance institutions' earnings and capital base. Changes in interest rates affect microfinance institutions' earnings by changing their net interest income and the level of other interest-sensitive income and operating expenses.
   5.1.2 Changes in interest rates also affect the underlying value of the
   microfinance institutions' assets, liabilities and off-balance sheet instruments because the present value of future cash flows (and in some cases, the cash flows themselves) change when interest rates change. The National Bank of Ethiopia, therefore, requires microfinance institutions to have an effective risk management process that maintains interest rate risk within prudent levels based on proper identification of the sources and effects of interest risk.
   5.2 Board and Senior Management Oversight
   Board Oversight
   5.2.1 The board of directors has the ultimate responsibility for understanding the
   nature and the level of interest rate risk taken by the microfinance institution. At minimum the board should:
   a. Approve broad business objectives, strategies and policies that govern or influence the management interest rate risk of the microfinance institution. b. Establish the microfinance institutions’ tolerance for interest rate risk in its operations
   c. Establish clear levels of delegation within the interest rate risk
   management function d. Ensure that senior management has a full understanding of the risks incurred by the microfinance institution e. Ensure that the microfinance institution’s management adopts procedures to enable the achievement of the objectives set out in the strategy and policies. f. Ensure that interest rate risk is adequately measured, monitored and controlled g. Effectively communicate the strategies and policies to all relevant microfinance institution personnel. h. Putting in place measures to hedge against interest rate movements

i. Periodically re-evaluate significant interest rate risk management
policies as well as overall business strategies that affect the interest rate risk exposure of the microfinance institution. j. Ensure compliance with all relevant regulations and NBE directives. Senior Management
5.2.2 The senior management is responsible for ensuring that the microfinance
institution has adequate policies and procedures for managing interest rate risk on both a long-term and day-to-day basis and that it maintains clear lines of authority and responsibility for managing and controlling this risk. Senior management is responsible for;

a. Developing and implementing procedures and practices that translate the business policy band strategic direction set by the board into operating standards that are well understood by the institution’s personnel; b. Ensuring adherence to the lines of authority and responsibility that the board has established for measuring, managing, and reporting interest rate risk;
c. Develop measures that will facilitate the measurement, monitoring
and control of interest rate risk including standards for valuing positions and measuring performance; d. Implement a system of internal controls that will serve as an effective check over the measures used to manage interest rate risk; e. Ensure that internal audit reviews the interest rate risk management system on an on-going basis; f. ensure compliance with any relevant NBE Directive on the management of interest rate risk; g. Develop lines of communication to ensure the timely dissemination of interest rate risk management policies and other interest rate risk management information to all individuals involved in the process; and h. Maintain a comprehensive interest rate risk reporting an interest rate risk management review process.
5.3 Policies and Procedures
5.3.3 Microfinance institutions must have clearly defined policies and procedures
for limiting and controlling interest rate risk. These policies should be applied at microfinance institution level, as appropriate, to other units of the microfinance institution. Such policies and procedures should:
a. Delineate lines of responsibility and accountability over interest rate risk management decisions and should clearly define authority instruments;

b. reflect the tolerance limits for liquidity risk established by the board;
c. Identify quantitative parameters that define the level of interest rate risk
acceptable for the microfinance institution. Where appropriate, such limits should be further specified for certain types of instruments, portfolios and activities and should be reviewed periodically and revised as needed; and d. delineate lines of responsibility and accountability over interest rate risk management decisions and should clearly define authorized instruments, hedging strategies and position-taking opportunities;
5.3.4 There should be a clear indication of the specific procedures and approvals
necessary for exceptions to policies, limits and authorizations.
5.3.5 Products and activities that are new to the microfinance institution should
undergo a careful pre-acquisition review to ensure that the microfinance institution understands their interest rate risk characteristics and can incorporate them into its risk management process. Thus prior to introducing a new product, hedging, or position-taking strategy, management should ensure that adequate operational procedures and risk control systems are in place.
5.3.6 The board or its appropriate delegated committee should also approve
major hedging or risk management initiatives in advance of their implementation. Proposals to undertake new instruments or new strategies should contain these features:
a. a description of the relevant product or strategy (including characteristics related to interest rates); b. an identification of the resources require;
c. to establish sound and effective interest rate risk management of
the product or activity; d. an analysis of the reasonableness of the proposed activities in relation to the financial condition and capital levels; and e. The procedures to be used to measure monitor and control the risks of the proposed product or activity.
5.4 Measurement, Monitoring and Control Interest Rate Risk
5.4.1 Accurate and timely measurement of interest rate risk is necessary for
proper interest rate risk management and control of MFIs. In general, depending on the complexity and range of its activities, a microfinance institution should have interest rate risk measurement systems that assess the effects of rate changes on both earnings and economic value. These systems should provide meaningful measures of the microfinance institution's current levels of interest rate risk exposure and should be capable of identifying any excessive exposures that might arise.

5.4.2 Measurement systems should:
a. Provide meaningful measures of the institution’s current levels of interest rate risk exposures; b. assess all material interest rate risk associated with a microfinance institution's assets, liabilities and off-balance-sheet positions;
c. utilize generally accepted financial concepts and risk measurement
techniques; d. have well documented assumptions and parameters; and e. be capable of identifying excessive exposures that may arise. Measurement Methods
5.4.3 A number of techniques are available for measuring the interest arte
exposure of both earning and economic value. Their complexity ranges form simple calculations to static simulations.
5.4.4 Gap Analysis: The simplest techniques for measuring a microfinance
institution's interest rate risk exposure begin with a maturity/re-pricing
schedule that distributes interest-sensitive assets, liabilities and off￾balance-sheet positions into “time bands” according to their maturity (if
fixed rate) or time remaining to their next re-pricing (if floating rate). These schedules can be used to generate simple indicators of the interest rate risk sensitivity of both earnings and economic value to changing interest rates. When this approach is used to assess the interest rate risk of current earnings, it is typically referred to as gap analysis. The size of the gap for a given time band – that is, assets minus liabilities plus off-balance￾sheet exposures that re-price or mature within that time band – gives an indication of the microfinance institution's re-pricing risk exposure.
5.4.5 Duration: Duration is a measure of the percentage change in economic
value of a position that will occur given a mall change in the level of interest rates. A maturity/re-pricing schedule can also be used to evaluate the effects of changing interest rates on a microfinance institution's economic value by applying sensitivity weights to each time band. Typically, such weights are based on estimates of the assets and liabilities that fall into each time-band, where duration is a measure of the percent change in the economic value of a position that will occur given a small change in the level of interest rates. Duration-based weights can be used in combination with a maturity/repricing schedule to provide a rough approximation of the change in a microfinance institution's economic value that would occur given a particular set of changes in market interest rates.
5.4.6 Simulation Technique: Microfinance institutions may employ more
sophisticated interest rate risk measurement systems than those based

on simple maturity/repricing schedules such as, simulation techniques which typically involve detailed assessments of the potential effects of changes in interest rates on earnings and economic value by simulating the future path of interest rates and their impact on cash flows. Limits
5.4.7 The goal of interest rate risk management is to maintain a microfinance
institution's interest rate risk exposure within self-imposed parameters over a range of possible changes in interest rates. A system of interest rate risk limits and risk taking guidelines provides the means for achieving that goal. Such a system should set boundaries for the level of interest rate risk for the microfinance institution and where appropriate, should also provide the capability to allocate limits to individual portfolios, activities or business units. Stress Testing
5.4.8 The risk measurement system should also support a meaningful evaluation
of the effect of stressful market conditions on the microfinance institution. Stress testing should be designed to provide information on the kinds of conditions under which the microfinance institution's strategies or positions would be most vulnerable and thus may be tailored to the risk characteristics of the microfinance institution. Possible stress scenarios might include abrupt changes in the general level of interest rates, changes in the relationships among key market rates (i.e., basis risk), changes in the slope and the shape of the yield curve (i.e., yield curve risk), changes in the volatility of market rates. In addition, stress scenarios should include conditions under which key business assumptions and parameters break down.
5.4.9 The stress testing of assumptions used for illiquid instruments and
instruments with uncertain contractual maturities is particularly critical to achieving an understanding of the microfinance institution's risk profile. In conducting stress tests, special consideration should be given to instruments or markets where concentrations exist as such positions may be more difficult to liquidate or offset in stressful situations. Microfinance institutions should consider “worst case” scenarios in addition to more probable events. Management and the board of directors should periodically review both the design and the results of such stress tests, and ensure that appropriate contingency plans are in place.

Management information system
5.4.10 Microfinance institutions must have adequate information systems for
measuring, monitoring, controlling and reporting interest rate exposures. Reports must be provided on a timely basis to the board of directors,

senior management and, where appropriate, individual business line managers.
5.4.11 An accurate, informative, and timely management information system is
essential for managing interest rate risk exposure, both to inform management and to support compliance with board policy. Reporting of risk measures should be regular and should clearly compare current exposure to policy limits. In addition, past forecasts or risk estimates should be compared with actual results to identify any modeling shortcomings.
5.4.12 Reports detailing the interest rate risk exposure of the microfinance
institution should be reviewed by senior management and the board on a regular basis. While the types of reports prepared for the board and for various levels of management will vary based on the microfinance institution's interest rate risk profile, they should, at a minimum include the following:
a. summaries of the microfinance institution's aggregate exposures; b. reports demonstrating the microfinance institution's compliance with policies and limits;
c. results of stress tests including those assessing breakdown in key
assumptions and parameters; and d. summaries of the findings of reviews of interest rate risk policies, procedures, and the adequacy of the interest rate risk measurement systems, including any findings of internal and external auditors and retained consultants.
5.5 Internal Controls
5.5.1 Microfinance institutions should have adequate internal controls to ensure
the integrity of their interest rate risk management process which (as an integral part of the microfinance institution’s overall internal control) promote effective and efficient operations, reliable financial and regulatory reporting, and compliance with NBE’s prudential requirements. An effective system of internal control for interest rate should ensure that:
a. there is a strong control environment; b. An adequate process for identifying and evaluating risk;
c. There are adequate control tools such as policies, procedures and
methodologies; d. There is effective management information systems; and e. There is continual review of adherence to established policies and procedures.

5.5.2 With regard to control policies and procedures, attention should be given to
appropriate approval processes, exposure limits, reconciliation, reviews and other mechanisms designed to provide a reasonable assurance that the microfinance institution's interest rate risk management objectives are achieved.
5.5.3 Microfinance institutions should ensure that all aspects of the internal
control system are effective, including those aspects that are not directly
part of the risk management process.
5.5.4 In addition, an important element of a microfinance institution's internal
control system over its interest rate risk management process is regular evaluation and review. This includes ensuring that personnel are following established policies and procedures, as well as ensuring that the procedures that were established actually accomplish the intended objectives.
5.5.5 The frequency and extent to which a microfinance institution should re￾evaluate its risk measurement methodologies and models depends, in part,
on the particular interest rate risk exposures created by holdings and activities, the pace and nature of market interest rate changes, and the pace and complexity of innovation with respect to measuring and managing interest rate risk.
5.5.6 Microfinance institutions, particularly those with complex risk exposures,
should have their measurement, monitoring and control functions review on a regular basis by an independent party (such as an internal or external auditor). Such a reviewer should consider the following factors in making the risk assessment:
¾ The quantity of interest rate risk, e.g.

• The volume and price sensitivity of various products;

• The vulnerability of earnings and capital under differing rate changes
  including yield curve twists; and

• The exposure of earnings and economic value to various other forms
  of interest rate risk, including basis and opportunity risk. ¾ The quality of interest rate risk management, e.g.

• Whether the microfinance institution’s internal measurement system is
  appropriate to the nature, scope, and complexities of the microfinance institution and its activities;

• Whether the microfinance institution has an independent risk control
  unit responsible for the design and administration of the risk measurement, monitoring and control Functions;

• Whether the board of directors and senior management is actively
  involved in the risk control process;

• Whether internal policies, controls and procedures concerning interest
  rate risk are well documented and complied with;

• Whether the assumptions of the risk measurement system are well
  documented, data accurately processed, and data aggregation is proper and reliable; and

• Whether the organization has adequate staffing to conduct a sound
  risk management process.
  5.5.7 Microfinance institutions should ensure that internal audit reviews and
  evaluates the interest rate risk management function.

6. Operational Risk Management Guidelines
   6.1 Introduction
   6.1.1 Operational risk is the risk of direct or indirect loss resulting from
   inadequate or failed internal processes, people and systems or from external events or unforeseen catastrophes. It includes the exposure to loss resulting from the failure of a manual or automated system to process, produce or analyze transactions in an accurate, timely and secure manner. Operational risk therefore is imbedded in all of the microfinance institution's operations, including those supporting the management of other risks.
   6.1.2 Managing operational risk is an important feature of sound risk
   management practice in any microfinance institution. The exact approach chosen by an individual microfinance institution will depend on a range of factors, including its size and sophistication and the nature and complexity of its activities.
   6.1.3 Common operational risks in MFIs include the following:
7. The MIS system does not correctly reflect loan tracking, e.g. information
   on amount disbursed, payment received, current status of outstanding balance, aging of loan by portfolio outstanding etc..
8. Lack of effectiveness and insecurity of management information system
   in general and the portfolio management system in particular e.g. software does not have internal safety features, inaccurate MIS and untimely reports.
9. Inconsistencies between the loan management system data and the
   accounting system data.
10. Treating rescheduled loan as on-site loans
11. Lack of portfolio related fraud controls
12. Loan tracking information is not adequate, e.g. no aging of portfolio
    outstanding, inadequate credit histories etc.

6.1.4 The most important types of operational risk could also involve breakdowns
in internal systems and controls and corporate governance. Such breakdowns can often lead to financial losses through error, fraud or inefficiency. Other aspects of operational risk include major failure of information technology systems or events such as natural and other disasters. As microfinance institutions become more reliant on technology to support various aspects of their operations, the potential failure of a technology based system is of growing concern in the context of the management of operational risk.
6.1.5 Operational risk can also give rise to reputational and legal risks as the
types of failures outlined above can result in damage to an institution’s

reputation and/or legal action by regulators or customers. A computer systems failure within a microfinance institution, for example, can result in damage to its reputation and could also lead to the imposition of fines or other actions by regulators if the failure causes the microfinance institution to be in breach of laws or regulations.
6.2 Board and Senior Management Oversight
Board oversight
6.2.1 The Board of directors should address operational risk explicitly as a
distinct and controllable risk to the microfinance institution's safety and soundness. Failure to address operational risk, which is present in virtually all microfinance institution transactions and activities, may greatly increase the likelihood that some risks will go unrecognized and uncontrolled. The board should:
a. approve broad business strategies and policies that govern or influence the management of operational risk of the microfinance institution; b. approve an operational risk strategy and policies;
c. establish clear levels of delegation within business units for the
effective management of operational risk the foreign exchange management function; d. ensure that senior management has a full understanding of the operational risk faced by the microfinance institution; e. ensure that the microfinance institution’s management adopts procedures to enable the achievement of the objectives set out in the strategy and policies for the management of operational risk; f. ensure that operational risk is adequately monitored and controlled; g. effectively communicates the strategies and policies to all relevant microfinance institution personnel; and h. Periodically re-evaluate significant risk management policies as well as overall business strategies that affect the operational risk exposure of the microfinance institution. Management
6.2.2 Senior management is responsible for the day-to-day management of the
microfinance institution’s exposure to operational risk. Senior management should:
a. Develop procedures and practices that facilitate the implementation of the broad operational risk management strategy and policies adopted by the board.

b. Undertake the management of operational risk in accordance with the delegated authority developed by the board.
c. Develop measures that will facilitate the measurement, monitoring and
control of operational risk. d. Implement a system of internal controls that will serve as an effective check over the measures used to manage operational risk. e. ensure that internal audit reviews the operational risk management arrangements on an on-going basis. f. ensure compliance with any relevant NBE Directive on the management of operational risk. g. Develop lines of communication to ensure the timely dissemination of operational risk management policies and other operational risk management information to all individuals involved in the process. h. Develop an effective system of reporting to the board on issues related to the management of operational risk.
6.2.3 The primary responsibility for management of operational risk remains with
individual business units. Business area managers are expected to ensure that appropriate operational risk control systems are in place.
6.3 Policies and Procedures
6.3.1 Management must translate the operational risk management strategy
established by the board of directors into policies, processes and procedures that can be implemented and verified. In general, policies and procedures should:
a. Reflect the general philosophy in respect of operational risk as established by the board. b. Adequately measure, monitor and control operational risk.
c. Establish clear responsibilities and levels of authority among
management staff and business units for the management of operational risk. d. Ensure that the measures adopted for the management of operational risk are appropriate in light of the nature of the microfinance institutions products, services and operational culture and practices. e. Establish effective business continuity plans to ensure a quick an effective resumption of business following a disruption of service or activities.
6.3.2 All microfinance institutions should also have policies, processes and
procedures to control or mitigate operational risk. Microfinance institutions should assess the costs and benefits of alternative risk limitation and control strategies and should adjust their operational risk exposure using

appropriate strategies, in light of their overall risk profile. If necessary new arrangements should be created to assist in the identification, measurement, monitoring and control of operational risk; In addition, there should be a formal new product review process involving business, risk management and internal control functions.
6.3.3 There should be a clear indication of the specific procedures and approvals
necessary for exceptions to policies, limits and authorizations.
6.4 Measurement Monitoring and Control
6.4.1 Risk identification is critical for the subsequent development of viable
operational risk measurement, monitoring and control. Effective risk identification considers both internal factors (such as the complexity of the microfinance institution's structure, the nature of the microfinance institution's activities, the quality of personnel, organizational changes and employee turnover) and external factors (such as fluctuating economic conditions, changes in the industry and technological advances) that could adversely impact on the microfinance institution’s earnings and capital.
6.4.2 Measuring operational risk requires both estimating the probability of an
operational loss event and the potential size of the loss. Microfinance institutions should engage in tracking operational risk data. Such information is fundamental to measuring, monitoring, and controlling operational risk exposure. For any reliable measurement system, data would need to be collected in order to develop general measures of operational risk. For the data collected to be useful, the breadth, history and integrity of the data have to be commensurate with the microfinance institution's operational risk profile and approach to managing risk.
6.4.3 To measure operational risk, microfinance institutions need to identify the
underlying operational risk drivers or factors. The approach of identification generally followed is to decompose operational risk into those risks that are closely related to internal processes, people and systems and those that are more related to the external environment. Evidence of operational risk can therefore be associated with the prevalence of the following events (not all inclusive list) in any microfinance institution. Monitoring
6.4.4 All microfinance institutions should implement a system to monitor, on an
on-going basis, operational risk exposures and loss events by major business lines. Microfinance institutions should monitor operational losses directly, and should analysis each occurrence and a description of the nature and causes of loss provided to senior managers and the board of

directors. Ongoing monitoring activities offer the advantage of quickly detecting and correcting deficiencies in the policies, processes and procedures for managing operational risk.
6.4.5 The frequency of monitoring should reflect the risks involved and the
frequency and nature of changes in the operating environment. Monitoring is most effective when the system of internal control is integrated into the microfinance institution's operations and produces regular reports. The results of these monitoring activities should be included in management and board reports, as should compliance reviews performed by internal or external audit. A good management information system should be able to capture and report operational risk.
6.5 Internal Controls
6.5.1In mitigating or reducing operational risk, the value of internal controls is very critical. Internal controls should be seen as the major tool for managing operational risk. The controls cited include the full range of control activities such as segregation of duties, clear management reporting lines and adequate operating procedures. In most cases, operational risk events are associated with internal control weaknesses or lack of compliance with existing internal control procedures.
6.5.2 Control activities should be designed and implemented to address the risks
that the microfinance institution has identified. Control processes and procedures should be established and all microfinance institutions should have a system in place for ensuring compliance with documented set of internal policies concerning the risk management system. Principal elements of this should include:
a. top-level reviews of the microfinance institution's progress towards the stated objectives; b. checking for compliance with management controls;
c. policies, processes and procedures concerning the review,
treatment and resolution of non- compliance issues; and d. a system of documented approvals and authorizations to ensure accountability to an appropriate level of management.
6.5.3 To be effective, control activities should be an integral part of the regular
activities of the microfinance institution and should involve all levels of personnel in the microfinance institution, including both senior management and business unit personnel. Controls that are an integral
part of the regular activities enable quick responses to changing conditions
and avoid unnecessary costs.

6.5.4 An effective internal control system requires that there be appropriate
segregation of duties and those personnel in the microfinance institution are not assigned responsibilities which may create a conflict of interest. Assigning such conflicting duties to individuals or a team may enable them to conceal losses, errors or inappropriate actions. Therefore areas of potential conflicts of interest should be identified, minimized and subject to careful independent monitoring and review.
6.5.5 Activities of internal auditors also form an important element of operational
risk management. In ensuring good internal controls, internal auditors would need to be proactive in dealing with the microfinance institution's operational weaknesses. In particular, the identification of potential problems, the independent validation of business management’s self￾assessments and the tracking of problem situation and the progress towards resolving the problems should form major functions of the internal audit.
6.5.6 An important role is also ascribed to external auditors, whose duties include
reviewing the internal controls, operating procedures and systems, management information systems of the microfinance institution and preparing management letters that, among others, disclose deficiencies in internal control systems. External auditors should perform an assessment of operational risk to ensure that this risk is managed in a consistent way across the microfinance institution.

7. Mapping of Inherent Risk onto Functional Risk Matrix
   7.1 Activities in which microfinance institutions engage entail a number of
   inherent risks such as credit, liquidity, interest rate, and operational risks. The level and type of risks inherent in a certain activity may depend on the nature and scope of such activity. Moreover, one risk may cut across various functional areas and on the other hand, one activity may have a number of inherent risks. It is also common for one risk to trigger another risk. Therefore, there is a need for institutions to prepare a functional risk matrix to ensure that all relevant risks in their activities are captured. A sample Functional Risk Matrix is presented at the end of this section. Functional Areas
   7.2 The most common functional areas in a microfinance institutions business
   include lending Operations, treasury/fund Activities (asset/liability management), investment operations, retail Microfinance institutions activities, Payments Systems, MIS etc.
   7.3 The above functional areas are derived from key business activities.
   However, these areas may further be broken down into major product lines of microfinance institutions. Microfinance institutions need to draw-up a list of their own functional areas depending on the structure of their balance sheets and major income sources. In addition, management’s strategic plans, new products and other new or expanding business activities have to be considered.
   7.4 After the functional areas and preferably, the product lines therein, are
   identified, the type and level of risk inherent in those activities and products should be described. Microfinance institutions should ensure that all relevant types of risk in each functional area are appropriately captured. For example, lending operations will normally expose a microfinance institution to credit risk and to such other risks as liquidity and interest rate.

Functional Risk Matrix
The table below is an example of Functional Risk Matrix:
Functional Area/Activity Inherent Risks Credit Liquidity Interest Rate Operational Others 1 Lending Operations
1.1 Group lending
1.2 individual lending
1.3 other
√
√

√
√
√
√

√
√

2. Treasury/fund
   Management

√ √ √
3. Savings √ √ √
4. Investment Operations √

√

√
5. Payments Systems √

√

√
6. MIS

√
7. Other Areas

8. Other Products