Topic 4: Mandated Risk Management Tools Flashcards
The aim of Pillar 2 processes is to…
The aim of Pillar 2 processes is to enhance the link between an institution’s risk profile, its risk management and risk mitigation systems, and its capital planning
In simple terms:
Pillar 1 =
Pillar 2 =
Pillar 1 = minimum safety standards
Pillar 2 = Comprehensive ‘safety inspection’
Risk Management Framework
- definition
- 2 linked sets of processes
RMF
definition: collective term for the processes that an organisation has in place to manage risk
2 linked processes:
- risk management for business planning (ICAAP, ILAAP, RAS)
- Operational (BAU) risk management processes
Three Lines of Defence (list)
Three Lines of Defence
- Operational Management and Front Line Staff
- Dedicated Risk Management and Compliance Functions
- Independent Audit
Line 2: Dedicated Risk Management & Compliance (5) Business Planning (target: enhance capabilities) Business Execution (target: effective and efficient)
- assist business to understand risk constraints (regulation, capacity, appetite, policy)
- assist business to identify targets within constraints (risk/reward, optionality, stress tests)
- align risk processes to agreed targets (delegations, limits, procedures, incentives)
- execute operational responsibilities (reporting, forecasting, credit approvals, incident response
- assure that processes are working (deep dives, operational reviews, model monitoring)
three lines of defence:
3LOD implementation: consider (5) (DETER)
- documented
- embedded (staff clear on scope of role / responsibility)
- tested (effectiveness of challenge from Line 2 & 3 was regularly reviewed)
- evidenced
- refreshed
Common set of components that regulators require in bank’s risk management framework
- Board approved Risk Appetite Statement (perimeter of risk is owned by board)
- Documented risk identification and assessment processes (ICAAP - capital adequacy, ILAAP - liquidity adequacy) (describe process for identifying risk, in particular in quantitative terms for capital and liquidity purposes
- Stress testing: steady state assumptions are challenged; interaction of risks under extreme conditions
- Recovery and resolution plans (plans for consequences of extreme risk crystallising; orderly wind down of banks)
Risk Management Framework - Document
Purpose:
Typical Contents
Risk Management Framework - Document Purpose: document core aspects Contents: - core risk principles - risk terminology - minimum governance requirements - min risk assessment and monitoring requirements - documentation map - scale for risk appetite measures - single glossary of terms
Risk Management Framework - key aspects - list examples of…
1/ Overarching document
2/ high level governance
3/ terminology
- overarching document (principles, terminology, governance requirements)
- high level governance (responsibilities of CEO, oversight (board, audit), risk delegation governance, escalation of breach process, frequency of review, monitoring (by who, frequency)
- terminology (define risk - shortfall vs target objectives, define risk event, measure, profile, model, target)
Risk Appetite Statement
- description of bank’s current business (model & org structure)
- Definitions for all risk measures, metrics, indicators. And identify owners
- Board risk appetite
- specific board approved quantitative risk appetite and tolerance levels. Settings informed by risk assessment documented in ICAAP / ILAAP
- Mapping of risk metrics to reports and to associated governance forums
- Should be an objective measure (traffic lights?)
- what are dimensions of risk
- what are appropriate threshold levels
- what does the bank do differently when thresholds crossed
Risk Appetite Statement - Measures & Factors
- Risk Measure
- Risk Factor
- Risk Appetite Statement
RISK MEASURE
- An output of some (often complex) risk estimation process (VaR etc.)
- Ultimately the best “risk” quantity, but often complex to measure / manage
RISK FACTOR
- An input to the risk estimation process that materially influences the output
- A proxy for the risk, but usually much simpler to embed operationally
RISK APPETITE STATEMENT generally contains both, but it is useful to remember that risk factors are always “one step removed” from the actual risk
Risk definition
“what do we mean by risk?”
The potential for the bank to experience an outcome that falls short of our
targeted objectives or responsibilities; an “adverse outcome”. For example, there is a
risk that realised full year earnings will be below forecast, or that capital reserves will
fall below our targeted minimum level.
Risk Appetite Statement
- Risk Thresholds
(1) Tolerance Levels
(2) Appetite Levels
(1) Tolerance Levels (Hard Limits)
Risk management actions escalate strongly as the limit is approached. Over tolerance…
(2) Appetite Levels (Softer Limits)
Risk management actions escalate strongly when the limit is passed and bank is in “above appetite” state
Risk Appetite:
Tolerance: If over tolerance…
Appetite: If over appetite…
OVER TOLERANCE (primary goal = risk reduction)
- immediate Board notification
- CEO approval of risk increases
- certain activities prohibited
- may trigger predefined plans
- disposals, freeze dividends etc.
OVER APPETITE
If over appetite:
1. enhanced oversight / reporting
2. reduced limits/delegations,
3. discretionary risk reduction actions,
4. risk increases are escalated for approval,
5. risk reduction efforts reported to Board
ICAAP
ILAAP
Shared Content
International Capital Adequacy Assessment Process
International Liquidity Adequacy Assessment Process
Shared Content
- Business model and strategy (bus organisation, plans, risks, links to business strategy)
- Risk governance framework (roles/responsibilities, risk identification/assessment, operational controls)
- Risk data, aggregation and IT systems (systems/processes; data checks/validation)