Sound Practices for Stress-testing

Annex 1 – Sound Practices for Stress-testing Governance

1. Dedicated committees are assigned to manage the overall stress-testing programme with clear mandates to (i) design stress-testing scenarios that suit the institution’s risk profile, (ii) review stress-testing outputs from an enterprise-wide perspective and in the context of the prevailing macro market environment, (iii) recommend necessary risk monitoring and mitigating measures, and (iv) provide independent views and advice to senior management and the Board of Directors. The committees typically include senior representatives from risk management, treasury, front office, and research departments. With a balanced representation, the committees can ensure that the opinions of all relevant parties are heard and all potential issues thoroughly deliberated.
2. Mechanisms are in place to encourage the taking of specific actions to address the potential risks signalled by stress-testing outputs. (For example “de-risking” of trading book or banking book positions following a breach of stress-testing triggers set by a committee with responsibility for managing all or part of the stress-testing programme. Other possible courses of action include, but are not limited to, reducing the relevant market and credit risk limits and establishing medium-to-long term risk mitigation plans.) Moreover, adequate compliance reviews are in place to ensure that stress-testing outputs that exceed the institution’s risk appetite (see paragraph 8 below) must be addressed and cannot be dismissed by management as implausible and thereby delay necessary de-risking or risk-mitigation action. Stress-testing approach
3. In addition to commonly adopted stress-testing approaches such as sensitivity tests, an enterprise-wide and scenario-based approach is employed. Under this approach, stress scenarios are applied consistently across all business units within the AI, and all of its subsidiaries in the case of group-wide stress- testing, to generate consistent and coherent outputs for the entire enterprise. The outputs should provide a comprehensive view across the credit, market, interest rate and liquidity risks of the AI on a consolidated basis.
4. Forward-looking stress scenarios are developed based on observed or projected macro financial environments that are remote but plausible (e.g. the bursting of asset bubbles in the property, stock, or commodity markets). These scenarios take into consideration an AI’s exposures, e.g. exposures to specific countries or industries in the case of country or industry specific stress scenarios. For instance, an AI with significant cross-border claims on a particular country should construct stress-testing scenarios specific to

2 that country (e.g. negative GDP shock, credit crunch). The remote but plausible scenarios should assist in the identification of the AI’s vulnerabilities and the need for mitigating measures. 5. Reverse stress-testing techniques are being developed and incorporated into AIs’ stress-testing programmes. In reverse stress-testing, an AI identifies scenarios and circumstances that would render its business model unviable. This is different from scenario based stress-testing which tests for outcomes arising from changes in circumstances. The vulnerabilities identified from reverse stress-testing should be reviewed and addressed by the senior management team. 6. In addition to quantitative measures, “expert judgement” is used when developing stress scenarios. By incorporating the use of expert judgement, the AI can mitigate the risks arising from the rigid adoption of quantitative measures (e.g. estimated probabilities of stress events), especially in view of recent observations that statistical relationships used to derive probabilities tend to break down in stressed conditions. The design of stress parameters should take into account the inherently pro-cyclical nature of the financial markets. In times of strong economic growth, elevated asset prices or rapid credit expansion, more severe stress parameters are usually adopted. 7. Tailor-made stress-testing scenarios are constructed for specific assets, liabilities, or hedging strategies to which an AI is heavily exposed. An example is the stress-testing of unexpectedly large credit spread movements affecting complex structured credit products, taking into consideration the correlation relationship as implied by different structured products and the basis risk, or incomplete hedge, of existing hedging strategies. 8. Risk tolerance levels are defined in different terms to give management different perspectives of the nature of stress impact. For instance, stress-testing results can be expressed in terms of their impact on an AI’s capital adequacy ratio, common equity, leverage ratio, risk weighted assets, and annual profit and loss. Stress-testing readiness 9. Control procedures are established to ensure that the stress-testing database, models, and outputs are flexible and reliable. For example, if computer programmes or calculation models are used to generate stress-testing outputs, proper control procedures such as user acceptance test and version control, together with periodic validity checks on data sources and on the reasonableness of the output, should be in place. 10. Stress-testing infrastructure, including the database, models and application tools, is designed to be flexible enough to execute ad hoc stress-testing on short notice. Data on risk positions should be coherently defined and

3 categorised with sufficient granularity to facilitate flexible aggregation and grouping of risks. This will enable an AI to construct tailor-made stress scenarios relatively swiftly based on observable signs of stress conditions (e.g. the recent European sovereign debt problem). Procedures for retrieval and aggregation of position data are also clearly documented and regularly tested. The ability to generate stress-testing results within a short period of time allows senior management to formulate critical mitigation plans, which could prove to be crucial in times of crisis.