Saudi Arabian Monetary Agency

RIYADH 11169 - SAUDI ARABIA

Deputy Governor

90:0215963
FACSIMILE MESSAGE
16609/BL 710
9 March 1999
المرفقات : ١٦

From : Saudi Arabian Monetary Agency, H.O.
To : All Banks
Attn : General Managers and Managing Directors Sub : Sound Practices for Banks’ Interactions with Highly Leveraged Institutions (HLI)

As you are aware, in September 1998 the near collapse of Long-Term Capital Management, a highly leveraged, hedge fund posed a significant threat to the US financial markets necessitating a major response from the US Banking Supervisory Authorities. Since then there has been global scrutiny of international banks’ exposures to highly leveraged financial institutions in general and hedge funds in particular.

A Task Force established by the Basle Committee on Banking Supervision has completed a study of the risks for banks arising from their dealings with such institutions. The Committee has prepared the attached paper on “Sound Practices for Banks’ Interactions with Highly Leveraged Institutions (HLI)” that aims to encourage development of prudent approaches by banks to the assessment, measurement and risk management of credit exposures to HLIs.

In Saudi Arabia, some Banks may have dealings with institutions that meet the definitions of an HLI or a hedge fund. We expect these exposures to be managed in accordance with the Internal Control Guidelines for Commercial Banks issued by SAMA, and prudent internal credit policies and procedures of your Bank. In issuing this Basle Committee paper to Saudi Banks our expectations are as follows:

1. You should ensure that managers of your Bank’s credit, risk management, and other relevant functions are fully conversant with the best management practices outlined in this paper.
2. The Bank should internalize these practices by ensuring that these are reflected in your credit management and risk management policies and procedures.
3. An internal procedural framework that requires regular identification and monitoring of such exposures and their reporting to senior management should be developed.

Teleg. Address : "MARKAZI" — Telex : 401734-37 — Telephone : 4633000 — Fax. : 4633223

---

While there is no requirement for reporting to the Agency at this time, the Agency will carry out a survey in the near future as a follow-up. If you have any questions or require any clarification you may call Mr. Fahd Al-Mufarrij (466-2305) or Mr. Tariq Javed (466-2532).

Best Regards.

Jammaz Al-Suhaimi

cc: Enclosure

Teleg. Address : "MARKAZI" — Telex : 401734-37 — Telephone : 4633000 — Fax. : 4633223

---

Sound Practices for Banks’ Interactions with Highly Leveraged Institutions

Basle Committee on Banking Supervision
January 1999

---

Preface

In recent years, the activities of highly leveraged institutions (HLIs) have grown in both magnitude and complexity. The scope of the interactions between HLIs and mainstream financial institutions, such as banks and securities firms, has also expanded, emphasising the need for a full understanding and management of the risks generated from these activities. As with other borrowers and counterparties, banks and other financial intermediaries play a key role in allocating credit to HLIs. However, in the case of HLIs this can be particularly challenging given the relative opaqueness of their activities, the significant use of leverage and the dynamic nature of their trading positions and, in some cases, their market impact. The Basle Committee on Banking Supervision recognises that not all banks deal with or have significant exposures to HLIs. Most institutions that do have exposures to HLIs appear to be reviewing and tightening their credit standards for HLIs following the near-collapse of the hedge fund LTCM in September 1998. A key motivation for issuing sound practices is to ensure that improvements in credit standards and risk management processes are “locked in” over time and that the lessons are applied to the management of counterparty credit relationships more generally.

The management of credit risk in respect of HLIs involves the same principles as management of credit risk in general, but must also take account of the particular types of counterparty risk associated with such institutions. The Committee will shortly publish general principles for the management of credit risk. This paper should be seen as complementary to that effort, and is a response to the specific challenges posed by credit risk emanating from interactions with HLIs. The Committee’s review of banks’ dealings with HLIs has revealed that in many cases there has not been an appropriate balance among the key elements of the credit risk management process, with an over reliance on collateralisation of mark-to-market exposures.¹ Insufficient weight was placed on in-depth credit analyses of the HLI counterparties involved and the effective measurement and management of exposures. Moreover, in some cases, competitive forces and the desire to conduct business with certain counterparties may have led banks to make exceptions to their firm-wide credit standards.

Counterparty exposures to HLIs can take a variety of forms, including in particular secured and unsecured credits resulting from off-balance-sheet contracts. The

¹ Banks' interactions with highly leveraged institutions, Basle Committee (BIS), January 1999.

---

2

characteristics and implications of OTC derivatives were analysed by G-10 central banks in 1994. Following that review, the Committee issued risk management guidelines for derivatives that identified the types and sources of risk to counterparties in OTC transactions and reviewed sound risk management practices for each type of risk. In September 1998, the Committee on Payment and Settlement Systems and the Euro-currency Standing Committee published a report on settlement procedures and counterparty risk management related to OTC derivatives, which provides a thorough analysis of the policies and procedures employed by OTC derivatives dealers. Where appropriate, these guidelines will draw on these earlier studies and apply them, together with other recent insights, to the specific risks posed by highly leveraged counterparties.

The Basle Committee is distributing these sound practice standards to supervisors, banks and other interested parties worldwide with the expectation that they will encourage the further development of prudent approaches to the assessment, measurement and risk management of credit exposures to HLIs. The Committee invites the financial industry to assess standards and practices and to react to the recommendations. The Committee encourages supervisors to promote the application of sound practices by banks in their interactions with HLIs. The Committee wishes to emphasise that sound internal risk management, including effective counterparty credit risk management, is essential to the prudent operations of banks. With respect to their involvement with HLIs, it may also contribute significantly to ensuring that HLIs do not assume excessive risks and leverage. Should a major HLI nevertheless default, sound risk management at the counterparty level could contribute considerably to limiting the destabilising effects on markets resulting from, for example, the rapid deleveraging and liquidation of positions. By helping to reduce the potential for stressed-market exposures, sound credit management and monitoring practices by counterparties of HLIs should contribute to greater stability in the financial system as a whole.

I Introduction

This paper sets out sound practice standards for the management of counterparty credit risk inherent in banks’ trading and derivatives activities with highly leveraged institutions (HLIs). Its recommendations are directed at relationships with HLIs, which are defined as large financial institutions that are subject to very little or no direct regulatory oversight as well as very limited public disclosure requirements and that take on significant leverage. For the purpose of this paper, leverage is defined broadly as the ratio between risk, expressed in a common denominator, and capital. Leverage increases HLIs’ exposure to movements in market prices and consequently can expose creditors to significant counterparty risk. Hedge funds are currently the primary example of institutions within this definition but it should be noted that many hedge funds are not highly leveraged, and that other institutions may also have some or all of the attributes of an HLI.

While this paper focuses on the management of credit risk resulting from interactions with HLIs, the issues raised are not unique to interactions with such institutions. However, it is not intended to provide a complete overview of the more general credit management practices. The sound practices set out here specifically address the following areas: (1) establishing clear policies and procedures for banks’ involvement with HLIs as part of their overall credit risk environment; (2) information gathering, due diligence and credit analysis of HLIs’ activities, risks and operations; (3) developing more accurate measures of exposures resulting from trading and derivatives transactions; (4) setting meaningful overall credit limits for HLIs; (5) linking credit enhancement tools, including collateral and early termination provisions, to the specific characteristics of HLIs; and (6) closely monitoring credit exposures vis-à-vis HLIs, including their trading activities, risk concentration, leverage and risk management processes.

In Sections II to VII the credit risk management issues highlighted above are set out in more detail.

II Banks’ involvement with HLIs and their overall credit risk strategy

Before conducting business with HLIs, a bank should establish clear policies that govern its involvement with these institutions consistent with its overall credit risk strategy. Banks should ensure that an adequate level of risk management, consistent with their involvement with HLIs, is in place.

In general terms, each bank should have in place a clear credit risk strategy and an effective credit risk management process approved by the board of directors and implemented by senior management. The credit risk strategy should define the bank’s risk appetite, its desired risk return trade-off and mix of products and markets. In this context, a bank should assess whether dealings with HLIs are consistent with its credit risk strategy, its risk appetite and its diversification targets. If so, policies and procedures for interactions with HLIs must be devised that establish effective monitoring and control of such relationships. These policies and procedures should drive the credit setting process and govern banks’ relationships with HLIs, and should not be overridden by competitive pressures.

An effective credit risk management process includes appropriate documentation, comprehensive financial information, effective due diligence, use of risk mitigants such as collateral and covenants, methodologies for measuring current and future exposure, effective limit setting procedures, and ongoing monitoring of both the firm’s exposure to and the changing risk profile of the counterparty. Upholding these standards is particularly important with respect to interactions with HLI counterparties, where information has been limited, leverage may be high and risk profiles can alter rapidly. Where credit concerns are identified with regard to an HLI, a bank should either not conduct business or take appropriate steps to limit and manage the exposure consistent with their overall underwriting standards and risk appetite. HLIs that provide either insufficient information to allow meaningful credit assessments or proportionately less information about their risk profile than other counterparties should face tougher credit conditions, including, for instance, a higher level of initial margin, no loss threshold, a narrower range of assets which are deemed acceptable for collateral purposes, and a stricter range of other financial covenants.

The long-term success of a bank’s credit relationships relies heavily on effective and sophisticated risk management. This applies to banks that assume credit risks arising out of derivatives and other trading transactions with HLIs such as repurchase agreements and securities lending, as well as to banks that commit funds to HLIs through loans, credit lines or

III Information gathering, due diligence and credit analysis of HLIs

A bank that deals with HLIs should employ sound and well-defined credit standards which address the specific risks associated with HLIs.

An effective credit approval process is the first line of defence against excessive counterparty credit risk. It should be a general requirement but one which assumes increasing importance with the size and/or risk of the counterparty relationship. A sound credit approval process for HLIs should begin with comprehensive financial and other information, providing a clear picture of a counterparty’s risk profile and risk management standards. The credit process should identify the purpose and structure of the transactions for which approval is requested and provide a forward-looking analysis of the repayment capacity based on various scenarios. Credit standards should articulate policy regarding the use and nature of collateral arrangements and the application of contractual provisions designed to protect the bank in the event of changes in the future risk profile of the counterparty such as covenants and close-out provisions (Section VI). Moreover, credit standards should set a clear methodology and process for establishing limits (Sections IV and V).

Before entering into any new relationship with an HLI, a bank must become familiar with the counterparty and be confident that it is dealing with an institution of sound repute and creditworthiness. This can be achieved in a number of ways, including asking for references from known parties, accessing credit registers, evaluating legal status, and becoming knowledgeable about the individuals responsible for managing the institution by, for example, checking their personal references and financial state. Banks must also have a

clear view about the stability of the HLI, in terms not only of tangible factors such as earnings but also of less tangible ones such as strategy, quality of risk management practices, and staff composition and turnover. However, a bank should not grant credit solely because the counterparty, or key members of its management, are familiar to the bank or are perceived to be highly reputable.

Before establishing a credit relationship with an HLI, a bank should ensure that all information relevant to that relationship will be available to the bank on a sufficiently timely and ongoing basis. Stipulating the conditions in advance for an adequate transfer of information lays the foundation for an appropriate monitoring of credit risk and for assessing the potential need for adjustments to non-price terms or the application of termination provisions. Banks should seek to obtain information about material developments such as changes in the general direction of trading activities, profit and loss developments, significant changes to leverage, alterations to the risk management procedures or the risk measurement process and changes in key personnel. In order to secure the necessary information, banks must in turn satisfy their HLI counterparties that they have in place effective procedures to ensure the confidentiality of the information obtained through the credit review process.

Banks should obtain comprehensive financial information about an HLI, covering both on and off-balance-sheet positions, to understand the overall risk profile of the institution. Although additional efforts may be necessary to develop effective measures of leverage that relate capital to a common denominator of risk across on and off-balance-sheet positions, a starting point could be some measure of firm-wide value-at-risk (VaR), supplemented with the results of realistic stress testing. It is important that, where this information is used, the bank understand the parameters and the assumptions used in arriving at measures of risk and leverage in order to check the plausibility of the VaR and stress testing results. The bank should establish a clear understanding of the quality and integrity of the HLI’s processes and operations for measuring, managing and controlling market, credit and liquidity risks, including back-office systems, accounting and valuation policies and methodologies. The bank should also obtain information about the HLI’s liquidity profile, such as committed lines of credit and the availability of liquid, unpledged assets to meet possible increases in margin calls under adverse market conditions. Banks should periodically confirm, in various scenarios, whether the HLI’s future repayment capacity is reasonably assured or, for instance, highly dependent on specific assumptions.

Comprehensive and current financial information about an HLI is essential for an effective analysis of the counterparty’s credit quality and prudent setting of an internal rating and, consequently, the credit limits granted to the institution and the credit enhancements applied to the relationship. Credit assessment of HLIs and the monitoring and control of the associated counterparty risks are a more complex and time-consuming activity than credit management in respect of other conventional counterparties. It entails a high level of skill and a willingness to devote resources to regular updating and monitoring, resulting in costs which banks must recognise as part of doing business prudently with such institutions.

IV Exposure measurement

A bank taking on OTC derivatives positions vis-à-vis HLIs should develop meaningful measures of credit exposure and incorporate these measures into its management decision-making process.

Exposure measurement methodologies which provide meaningful information for decision making are an essential underpinning of the credit risk management process for trading and derivatives activities. They form the basis of effective limit setting and monitoring, discussed in Section V. As banks’ trading and derivatives activities grow in complexity and as banks move in the direction of relying more on firm-wide credit modelling techniques, it is increasingly important that measures of exposure be based on meaningful methodologies that are subject to continuous improvements commensurate with changing market conditions and practices and the bank’s needs. In particular, there are three areas where individual banks and the industry should focus their efforts: (1) the development of more useful measures of potential future exposure (PFE) that provide a meaningful calculation of the overall extent of a bank’s activity with a given counterparty; (2) the effective measurement of unsecured exposure inherent in OTC derivatives transactions that are subject to daily margining; and (3) realistic and timely stress testing of counterparty credit exposures.

First, the banking industry must devote further resources to developing meaningful measures of PFE. Banks generally measure total exposure to a counterparty as the sum of the current replacement cost (mark-to-market exposure) and PFE. PFE is a measure of how far a contract could move into the money over some defined horizon (typically the life of the contract) and at some specified confidence interval. When added together with the current replacement cost, measures of PFE are used to convert derivatives contracts to “loan equivalent” amounts for aggregating counterparty credit exposures across products and instruments.

Banks must have an effective measure of PFE which gives an accurate picture of the extent of their involvement with the counterparty in relation to their overall activities. Peak exposure measures should be determined to serve as true loan equivalent measures. PFE should adequately incorporate netting of long and short positions, as well as portfolio effects across products, risk factors and maturities, and be analysed across multiple time horizons. Banks should seek greater industry consensus on the appropriate confidence interval, the volatility concept and calculation period, and the frequency with which volatilities are updated. Banks should also incorporate such improved measures of PFE into their management decision-making process. This would include the ongoing monitoring of mark-to-market exposures against initial estimates of PFE. Banks should use this measure of PFE for assessing whether counterparties’ financial capacity is sufficient to meet the level of margin calls implied by their measure of PFE.

Second, banks must develop more effective measures for assessing the unsecured risks inherent in collateralised derivatives positions. Such unsecured exposures can take many forms, for example through the use of initial loss thresholds, potential gaps or delays in the collateral/margining process, and the time it takes to liquidate collateral and rebalance positions in the event of counterparty default. Even where OTC derivatives are subject to daily payment and receipt of variation margin (including initial margin), a bank can still face significant unsecured credit exposure under volatile market conditions.

Currently there is no clear industry consensus on how to measure this type of unsecured exposure. Many banks calculate just one measure of PFE, typically over the life of the contract. While such lifetime measures of PFE are appropriate for the purpose of comparing uncollateralised derivatives and loan exposures and measuring overall activity with a given counterparty, they do not provide a meaningful measure of the unsecured credit risk inherent in collateralised derivatives positions. Shorter horizons would be necessary to capture the exposure arising over the time needed to liquidate and rebalance positions and to realise the value of collateral in the event of a failure to meet a margin call or a default by the counterparty. Moreover, shorter horizons will be more appropriate for calibrating initial margins and establishing loss threshold amounts on collateralised derivatives transactions.

Third, banks must develop more meaningful measures of credit risk exposures under volatile market conditions through the development and implementation of timely and plausible stress tests of counterparty credit exposures. Stress testing should also evaluate the impact of large market moves on the credit exposure to individual counterparties and the inherent liquidation effects. Stress testing should also consider liquidity impacts on underlying markets and positions and the effect on the value of any pledged collateral. Simply applying higher confidence intervals or longer time horizons to measures of PFE may not capture the market and exposure dynamics under turbulent market conditions, particularly as they relate to the interaction between market, credit and liquidity risk.

V Limit setting

Effective limit setting depends on the availability of meaningful exposure measurement methodologies. In particular, banks should establish overall credit limits at the level of individual counterparties that aggregate different types of exposures in a comparable and meaningful manner.

Effective measures of PFE are essential for the establishment of meaningful limits, placing an upper bound on the overall scale of activity with, and exposure to, a given counterparty, based on a comparable measure of exposure across a bank’s various activities (both on and off-balance-sheet). Mark-to-market exposures should be monitored against initial limits on PFE.

Banks should monitor actual exposures against these initial limits and have in place clear procedures for bringing down exposure as such limits are reached. Moreover, limits should generally be binding and not driven by customer demand. A bank’s limit structure should cover the types of exposures discussed in Section IV.

Moreover, banks’ credit limits should recognise and reflect the risks associated with the near-term liquidation of derivatives positions in the event of a counterparty default. Where a bank has several transactions with a counterparty, its potential exposure to that counterparty is likely to vary significantly and discontinuously over the maturity over which it is calculated. PFEs should therefore be calculated over multiple time horizons. In the case of collateralised OTC derivatives exposures, limits should factor in the unsecured exposure in a liquidation scenario, that is, the amount that could be lost over the time it takes to rebalance positions and liquidate collateral (net of any initial margin received).

Finally, banks should consider the results of stress testing in the overall limit setting and monitoring process.

VI Collateral, early termination and other contractual provisions

A bank interacting with HLIs should align collateral, early termination and other contractual provisions with the credit quality of HLIs, taking into account the particular characteristics of these institutions such as their ability to rapidly change trading strategies, risk profiles and leverage. In doing so, banks may be able to control credit risk more pre-emptively than is the case when such provisions are driven solely by net asset values.

Bank policies should determine the contractual provisions that govern HLI counterparty relationships. It is these contractual arrangements, together with the bank’s internal limit structure, that should determine the size of unsecured credit exposure assumed by the bank. In a number of market segments the types of collateral arrangements and covenants offered to a counterparty, rather than pricing, constitute the primary means for compensating for risk differentiation. It is therefore paramount that these contractual conditions closely relate to the credit quality of the counterparty.

The use of collateral can significantly reduce counterparty credit risks. Banks use collateral provisions in secured loans, repurchase agreements² and OTC derivatives transactions. This includes transactions for which PFE (Section IV) is highly uncertain and transactions with less creditworthy counterparties. Nonetheless, the use of collateral does not eliminate credit risk and may entail other risks: liquidity, legal, custody and operational risks. Moreover, two-way collateral provisions could give rise to another type of credit risk. A loss could occur, for instance, when the bank has provided collateral owing to a negative exposure and the value of this collateral at the moment of the counterparty’s default is larger than the mark-to-market position.

In establishing collateral provisions vis-à-vis HLIs, banks should bear in mind that HLIs are unregulated financial institutions whose leverage is not restricted by the prudential supervision of risk management practices and the capital requirement regimes that apply to

2 Although different in legal terms, the purchase (sale) of securities in combination with an agreement to reverse the transaction within a specified period amounts to a collateralised transaction in economic terms. In

regulated financial intermediaries. If a bank does not receive meaningful financial information on a sufficiently frequent basis to permit effective monitoring of counterparty credit risk, it should consider requiring the institution to post excess collateral even when the bank has no current exposure (i.e. posting of initial margin). At a minimum, banks should design and enforce clear internal guidelines for determining when initial margin will be required from counterparties. Similar prudent policies should be established for setting minimum transfer amounts (amounts of collateral below which a counterparty is not required to transfer collateral) and loss thresholds (exposures below which no collateral is posted). Similarly, the granting of two-way margining and rehypothecation rights should be a function of the credit quality of the counterparty. If banks agree to two-way collateral provisions, they should make sure that the resulting additional credit risk exposure is integrated in the overall risk management process (including measurement of the PFE).

Contractual provisions should reflect bank credit standards regarding haircuts applied to the securities taken as collateral, by discounting the collateral value relative to the current market value. Banks usually base the size of the valuation adjustments on the price volatility of the securities over the time that would be required to liquidate them on the default of a counterparty (in normal market conditions). In accepting collateral from HLIs, banks should carefully assess and take into account the correlation between the probability of counterparty default and the likelihood of the collateral being impaired owing to market, credit or liquidity developments. Experience has shown that in stressed-market conditions, all but the most liquid securities issued by the best credits worldwide may be downgraded owing to a broad-based flight to quality following, during or preceding the default of a major HLI.

With respect to OTC derivatives transactions, banks should bear in mind that the effectiveness of collateral provisions established to cover counterparty credit exposures may be significantly reduced if the value of the collateral is negatively correlated with the probability of the counterparty’s default or with the market value of the contracts. In stressed-market conditions, sizable amounts of additional collateral may have to be posted by an HLI with a concentrated portfolio. There should be clear documentation setting forth the actions to be taken in the event that a counterparty fails to meet collateral calls.

credit risk terms, similar risk management techniques apply to collateralised loans and (reverse) repurchase agreements.

In addition, banks should include covenants which permit termination or other action in the event of a material deterioration in an HLI’s credit quality. The application and design of such early termination or close-out provisions should be a function of the counterparty’s credit quality and the ability of the bank to observe changes in (prospective) creditworthiness and to react swiftly to any negative changes. In the case of HLIs, publicly available information may be insufficiently up-to-date to permit continuous credit monitoring. The bank should set adequate standards for information disclosure during the credit relationship and establish termination provisions in relation to the counterparty’s risk profile so that it can take risk-reducing measures in a timely manner.

Banks’ standard practice in relation to conventional corporate credits is to set a range of covenants relating to financial strength. For HLIs, verifiable covenants addressing significant changes in strategy, or relating to leverage and risk concentration, appear particularly relevant. Reflecting the difficulties of measuring the absolute levels of some of these variables, covenants should be specified in terms of changes to the levels existing at the start of a credit relationship and based on agreed definitions of risk and capital. They should be designed with a view to tightening credit limits as counterparty risk increases. However, banks should realise that industry-wide use of “sudden death” termination provisions could have systemic implications. If these provisions do not affect the extent of risk-taking by HLIs ex ante, the intended credit risk reduction may not materialise, and all lenders may tighten credit terms at the same time. Covenants should ensure that banks are made aware of adverse financial developments and are able to press for adjustment well before the time when cessation of the relationship is appropriate. This pre-emptive aspect is as important as the ability to require repayment once adverse changes have occurred.

VII Ongoing monitoring of positions vis-à-vis HLIs

A bank dealing with HLIs should effectively monitor HLI creditworthiness and the development of its exposure to HLI counterparties. Banks should assess HLI risk profiles and risk management capabilities frequently, while considering the potential for stressed-market conditions.

Given the speed with which HLIs can change their risk profile, banks should conduct reviews of counterparty credit quality of material HLI exposures on a frequent basis, at least quarterly. Additional reviews should be triggered by significant increases in exposure or market volatility. With respect to HLIs, effective monitoring tools should go beyond monthly changes in net asset value and crude balance-sheet measures. There should be detailed quantitative information about risk, for instance VaR numbers supplemented with internal stress testing results. Banks should conduct regular reviews of HLI risk management capabilities. In addition, banks should have a proper understanding of concentrations of risk, including their own exposures to HLIs as a group as well as the risk concentration facing HLIs themselves.

Effective collateral management systems are important for monitoring and limiting counterparty credit exposures. Banks should ensure that collateral management systems capture all counterparty positions, that such positions and related collateral are marked to market on at least a daily basis, and that payment and receipt of (additional) collateral is conducted in a timely manner. Haircuts that apply to the various types of securities that are accepted as collateral should be revised on a regular basis, taking into account price volatility, liquidity and credit quality developments. Where banks focus on limiting credit risk resulting from OTC derivatives positions by timely collateralisation, they should monitor the unsecured part of the exposure (including PFE) particularly closely, taking into account the counterparty’s ability to meet future collateral demands. Since OTC derivatives exposures often make up a large part of the total exposure to HLIs, assessing the ability to provide additional collateral when required and setting meaningful credit limits based on such assessments may be especially relevant in dealings with HLIs.

Finally, ongoing exposure monitoring should incorporate the results of periodic stress testing of counterparty credit exposures that takes into account the interaction between market, credit and liquidity risks (Section IV). Such stress testing results should be included in senior management reports and provide sufficient information to trigger risk-reducing actions where necessary.