Managing Risk in Financial Sector

Risk Management is a hot topic in the financial sectorcomponents, which are the necessary foundation for
especially in the light of the recent losses of somean effective internal control system, include:
multinational corporations e.g. collapses of Britain'sI. Control Environment,
Barings Bank, WorldCom and also due to the incidentControl environment, an intangible factor and the first
of 9/11. Rapid changes in business condition,of the five components, is the foundation for all
restructuring of organizations to cope with everother components of internal control, providing
increasing competition, development of newdiscipline and structure and encompassing both
products, emerging markets and increase in crosstechnical competence and ethical commitment.
border transactions along with complexity ofII. Risk Assessments,
transactions has exposed Financial Institutions to newOrganizations exist to achieve some purpose or goal.
risks dimensions. Thus the concept of risk hasGoals, because they tend to be broad, are usually
captured a growing importance in modern financialdivided into specific targets known as objectives. A
society.risk is anything that endangers the achievement of
By facilitating transactions and making credit andan objective. Risk assessments is done to determine
other financial products available, the financial sector isthe relative potential for loss in programs and
a crucial building block for private as well as publicfunctions and to design the most cost-effective and
sector development. In its broadest definition, itproductive internal controls.
includes everything from banks, stock exchanges,III. Control Activities,
and insurers, to credit unions, microfinance institutionsControl activities mean the structure, policies, and
and moneylenders. As an efficient service provider,procedures, which an organization establishes so that
the financial sector simultaneously fulfils an importantidentified risks do not prevent the organization from
function in the overall economy. Various types ofreaching its objectives.
Financial Institutions actively working in FinancialPolicies, procedures, and other items like job
Sectors include Banks, DFIs, Micro Finance Banks,descriptions, organizational charts and supervisory
Leasing Companies, Modarabas, Assets Managementstandards, do not, of course, exist only for internal
Company, Mutual Funds, etc.control purposes. These activities are basic
Thus today's operating environment demandsmanagement practices.
systematic and more integrated risk managementIV. Information and Communication, and
approach.Organizations must be able to obtain reliable
Risk:information to determine their risks and communicate
Risk by default has tow components; uncertainty andpolicies and other information to those who need it.
exposure. If both are not present, there is no risk.Information and communication, the fourth
Definition of Risk as per Guidelines on Riskcomponent of internal control, articulates this factor.
Management issued by State Bank of Pakistan is,V. Monitoring
"Financial risk in a banking organization is possibilityLife is change; internal controls are no exception.
that the outcome of an action or event could bringSatisfactory internal controls can become obsolete
up adverse impacts. Such outcomes could eitherthrough changes in external circumstances.
result in a direct loss of earnings / capital or mayTherefore, after risks are identified, policies and
result in imposition of constraints on bank's ability toprocedures put into place, and information on control
meet its business objectives. Such constraints pose aactivities communicated to staff, superiors must then
risk as these could hinder a bank's ability to conductimplement the fifth component of internal control,
its ongoing business or to take benefit ofmonitoring.
opportunities to enhance its business."Even the best internal control plan will be unsuccessful
Types of Risks:if it is not followed. Monitoring allows the
Risks are usually defined by the adverse impact onmanagement to identify whether controls are being
profitability of several distinct sources of uncertainty.followed before problems occur. In the same way,
More or less all financial institutions have to managemanagement must review weaknesses identified by
the following faces of risks:audits to determine whether related internal controls
1. Credit Riskneed revision.
2. Market RiskTools for Monitoring of Risk
3. Liquidity RiskManagement Information System
4. Operational RiskM.I.S or Management Information System is the
5. Country Riskcollection and analysis of data in order to support
6. Legal Risksmanagement's decision with respect to the
7. Compliance Riskachievement of objectives mentioned in the policies
8. Reputational Riskand procedures and the control of various risks
Broadly speaking there are four risks as per Risktherein.
Management Guidelines which surround FinancialIt is this area i.e. M.I.S, where I.T can play a vital and
Sector i.e. Credit Risk, Market Risk, Liquidity Risk andeffective role as with the help of I.T large
Operational Risk. These risk are elaborated hereinformation may be analyzed efficiently and with
under:i. Credit Riskaccuracy, so that effective decision may be taken
This is the risk incurred in case of a counter-partyby the management without the loss of any time.
default. It arises from lending activities, investingAsset-Liability Management Committee (ALCO)
activities and from buying and selling financial assetsIn most cases, day-to-day risk assessment and
on behalf of others. This risk is associated withmanagement is assigned to a specialized committee,
financing transactions i.e.:a. Default in repayment bysuch as an Asset-Liability Management Committee
the borrower andb. Default in obliging the(ALCO). Duties pertaining to key elements of the risk
commitment by another Financial Institution in case ofmanagement process should be adequately
syndicated arrangements.separated to avoid potential conflicts of interest - in
It is the most critical risk in banking and one thatother words, a financial institution's risk monitoring and
must be managed carefully. It is also the risk thatcontrol functions should be sufficiently independent
requires the most subjective judgment despitefrom its risk-taking functions. Larger or more complex
constant efforts to improve and quantify the creditinstitutions often have a designated, independent unit
decision process.ii. Market Riskresponsible for the design and administration of
Market risk is defined as the volatility of income orbalance sheet management, including interest rate
market value due to fluctuations in underlying marketrisk. Given today's widespread innovation in banking
factors such as currency, interest rates, or creditand the dynamics of markets, banks should identify
spreads. For commercial banks, the market risk ofany risks inherent in a new product or service before
the stable liquidity investment portfolio arises fromit is introduced, and ensure that these risks are
mismatches between the risk profile of the assetspromptly considered in the assessment and
and their funding. This risk involves interest rate riskmanagement process.
in all of its components: equity risk, exchange risk andCorporate Governance Principles
commodity risk.iii. Liquidity RiskCorporate governance relates to the manner in which
The liquidity risk is defined as the risk of not beingthe business of the organization is governed, including
able to meet its commitments or not being able tosetting corporate objectives and a institution's risk
unwind or offset a position by an organization in aprofile, aligning corporate activities and behaviors with
timely fashion because it cannot liquidate assets atthe expectation that the management will operate in
reasonable prices when required.iv. Operational Riska safe and sound manner, running day-to-day
This risk results from inadequacies in the conception,operations within an established risk profile, while
organization, or implementation of procedures forprotecting the interests of depositors and other
recording any events concerning bank's operations instakeholders. It is defined by a set of relationships
the accounting system/information systems.between the institution's management, its board, its
Need for Risk Management and Monitoring:shareholders, and other stakeholders.
There are a number of reasons as to why there isThe key elements of sound corporate governance in
so much emphasis given to Risk Management ina bank include:a) A well-articulated corporate strategy
Financial Sector now a day. Some of them are listedagainst which the overall success and the contribution
below: -of individuals can be measured.b) Setting and
1. Present structure of joint stock companies,enforcing clear assignment of responsibilities,
wherein owners are not the mangers, hence risksdecision-making authority and accountabilities that are
increase; therefore proper tools are required toappropriate for the bank's risk profile.c) A strong
achieve the desired results by covering the risks.financial risk management function (independent of
2. The financial sector has come out of simplebusiness lines), adequate internal control systems
deposit and lending function.(including internal and external audit functions), and
3. The world has become very complex so thefunctional process design with the necessary checks
financial transactions and instruments.and balances.d) Corporate values, codes of conduct
4. Increase in the number of cross borderand other standards of appropriate behavior, and
transactions which caries its own risks.effective systems used to ensure compliance. This
5. Emerging marketsincludes special monitoring of a bank's risk exposures
6. Terrorism Remittanceswhere conflicts of interest are expected to appear
Risk monitoring in financial sector is very crucial and(e.g., relationships with affiliated parties).e) Financial
an inevitable part of risk management. Risk Monitoringand managerial incentives to act in an appropriate
is important in the financial sector due to themanner offered to the board, management and
following reasons:employees, including compensation, promotion and
1. Deals in others' moneypenalties. (i.e., compensation should be consistent with
2. Direct stake of deposit holder.the bank's objectives, performance, and ethical
3. Much riskier sector than trading and manufacturing.values).f) Transparency and appropriate information
4. Previous / Recent problems faced by banks i.e.flows internally and to the public.
stuck portfolio that is credit risk.Tools mentioned above can be utilized in identifying
5. Bankruptcy of Barings Bank due to short selling /and managing different risks in the following manner:
long position that is market risk.I. Credit Risk
6. Operational risk does not has immediate impact,It is managed by setting prudent limits for exposures
but important for continuity and progress ofto individual transaction, counterparties and portfolios.
organization.Credits limits are set by reference to credit rating
7. Appetite of a financial institution to take risk isestablished by Credit Rating Agencies, methodologies
related with the capital base of the institute so itestablished by Regulators and as per Board's
caries a huge risk of over exposure.direction.o Monitoring of per party exposureo
Components of Risk Management Frame WorkMonitoring of group exposureo Monitoring of bank's
Risk Management Frame Work has five components.exposure in contingent liabilitieso Bank's exposure in
First of all risk is Identified, then it is Assessed toclean facilitieso Analysis of bank's exposure product
classify, seek solution and management, afterwiseo Analysis of concentration of bank's exposure in
assessing quick Response and implementation ofvarious segments of economyo Product profitability
solution and the last phase is Monitoring of the riskreports
management progress and Learning from thisII. Market
experience that such problem never occur again.Financial Institutions should also have an adequate
Whole process is to be well Communicated during thesystem of internal controls to oversee the interest
entire process of risk management if it is to berate risk management process. A fundamental
managed efficiently.component of such a system is a regular,
The International Organization for Standardizationindependent review and evaluation to ensure the
(ISO) has defined risk management as thesystem's effectiveness and, when appropriate, to
identification, analysis, evaluation, treatment (control),recommend revisions or enhancements.
monitoring, review and communication of risk. TheseInterest rate risk should be monitored on a
activities can be applied in a systematic or ad hocconsolidated basis, including the exposure of
manner. The presumption is that systematicsubsidiaries. The institution's board of directors has
application of these activities will result in improvedultimate responsibility for the management of interest
decision-making and, most likely, improved outcomes.rate risk. The board approves the business strategies
Structure of Risk Managementthat determine the degree of exposure to risk and
Depending upon the structure and operations ofprovides guidance on the level of interest rate risk
organization, financial risk management can bethat is acceptable to the institution, on the policies
implemented in different ways. Risk managementthat limit risk exposure, and on the procedures, lines
structure defines the different layers of anof authority, and accountability related to risk
organization at which risk is identified and managed.management. The board also should systematically
Although there are different layers or level at whichreview risk, in such a way as to fully understand the
risk is managed but there are three layers which arelevel of risk exposure and to assess the performance
common to all. i.e.of management in monitoring and controlling risks in
Risk Managementcompliance with board policies. Reports to senior
For managing risk there are certain basic principlesmanagement should provide aggregate information
which are to be followed by every organization:and a sufficient level of supporting detail to facilitate
1. Corporate level Policiesa meaningful evaluation of the level of risk, the
2. Risk management strategysensitivity of the bank to changing market conditions,
3. Well-defined policies and procedures by seniorand other relevant factors.
managementThe Asset and Liability Committee (ALCO) plays a
4. Dissemination, implementation and compliance ofkey role in the oversight and coordinated
policies and proceduresmanagement of market risk. ALCOs meet monthly.
5. Accountability of individuals heading variousInvestment mandates and risk limits are reviewed on
functions/ business linesa regular basis, usually annually to ensure that they
6. Independent Risk review functionremain valid.
7. Contingency plansRisk Management and Risk Budgets
8. Tools to monitor risksA risk budget establishes the tolerance of the board
Institutions can reduce some risks simply byor its delegates to income or capital loss due to
researching them. A bank can reduce its credit riskmarket risk over a given horizon, typically one year
by getting to know its borrowers. A brokerage firmbecause of the accounting cycle. (Institutions that are
can reduce market risk by being knowledgeablenot sensitive to annual income requirements may
about the markets it operates in.have a longer horizon, which would also allow for a
Functionally, there are four aspects of financial riskgreater degree of freedom in portfolio management.).
management. Success depends uponOnce an annual risk budget has been established, a
A. A positive corporate culture,system of risk limits needs to be put in place to
No one can manage risk if they are not prepared toguard against actual or potential losses exceeding the
take risk. While individual initiative is critical, it is therisk budget. There are two types of risk limits, and
corporate culture which facilitates the process. Aboth are necessary to constrain losses to within the
positive risk culture is one which promotes individualprescribed level (the risk budget).
responsibility and is supportive of risk taking.The first type is stop-loss limits, which control
B. Actively observed policies and procedurescumulative losses from the mark-to-market of
Used correctly, procedures are powerful tool of riskexisting positions relative to the benchmark. The
management. The purpose of policies and proceduressecond is position limits, which control potential losses
is to empower people. They specify how people canthat could arise from future adverse changes in
accomplish what needs to be done. The success ofmarket prices. Stop-loss limits are set relative to the
policies and procedures depends critically upon aoverall risk budget. The allocation of the risk budget
positive risk culture.to different types of risk is as much an art as it is a
C. Effective use of technologyscience, and the methodology used will depend on
The primary role technology plays in riskthe set-up of the individual investment process. Some
management is risk assessment and communication.of the questions that affect the risk allocation include
Technology is employed to quantify or otherwisethe following:
summarize risks as they are being taken. It then* What are the significant market risks of the
communicates this information to decision makers, asportfolio?
appropriate.* What is the correlation among these risks?
D. Independence or risk management professionals* How many risk takers are there?
To get the desired outcome from risk management,* How is the risk expected to be used over the
risk managers must be independent of risk takingcourse of a year?
functions within the organization. Enron's experienceCompliance with stop-loss limits requires frequent, if
with risk management is instructive. The firmnot daily, performance measurement. Performance is
maintained a risk management function staffed withthe total return of the portfolio less the total return
capable employees. Lines of reporting wereof the benchmark. The measurement of
reasonably independent in theory, but less so inperformance is a critical statistic for monitoring the
practice.usage of the risk budget and compliance with
Internal Controlsstop-loss limits. Position limits also are set relative to
Para one on first page of the 'Guidelines on Internalthe overall risk budget, and are subject to the same
Controls' issued by SBP provides:considerations discussed above. The function of
"Internal Control refers to policies, plans andposition limits, however, is to constrain potential
processes as affected by the Board of Directors andlosses from future adverse changes in prices or
performed on continuous basis by the senioryields.
management and all levels of employees within theIII. Liquidity Risk
bank. These internal controls are used to provideThe Basel Committee has established certain
reasonable assurance regarding the achievement ofquantitative standards for internal models when they
organizational objectives. The system of internalare used in the capital adequacy context.a. Allocation
controls includes financial, operational and complianceof capital into various types of business after taking
controls."into account the operational risks i.e. disruption of
The current official definition of internal control wasbusiness activity, which has especially increased due
developed by the Committee of Sponsoringto excessive EDP usageb. Allocation of the capital is
Organization (COSO) of the Treadway Commission.also made amongst various products i.e. long term,
In its influential report, Internal Control - Integratedshort term, consumer, corporate etc. considering the
Framework, the Commission defines internal controlrisks involved in each product and its life cycle to
as follows:avoid any liquidity crunch for which gap analysis is
"Internal control is a process, effected by an entity'smade. This is the job of ALCOc. For instance
Board of Directors, management and other personnel,Contingent liabilities not more than 10 times of
designed to provide reasonable assurance regardingcapital,d. Fund based not more than 6 times of
the achievement of objectives in the followingcapitale. Capital market operations not more than 1
categories:time of capitalf. However these limits cannot exceed
 Effectiveness and efficiency of operations.the regulations.g. Parameters of controlso Regulatory
 Reliability of financial reporting.Requirementso Board's directionso Prudent practices
 Compliance with applicable laws andFor liquidity management organizations are compelled
regulations.to hold reserves for unexpected liquidity demands.
This definition reflects certain fundamental concepts:The ALCO has responsibility for setting and
 Internal control is a process. It is a meansmonitoring liquidity risk limits. These limits are set by
to an end, not an end in itself.Regulatory Bodies and under Board's directions
 Internal control is effected by people. It iskeeping in mind the market condition and past
not policy manuals and forms, but people at everyexperience.
level of an organization.The Basel Accord comprises a definition of regulatory
 Internal control can be expected tocapital, measures of risk exposure, and rules
provide only reasonable assurance, not absolutespecifying the level of capital to be maintained in
assurance, to an entity's management and board.relation to these risks. It introduced a de facto capital
Internal control should assist and never impedeadequacy standard, based on the risk-weighted
management and staff from achieving theircomposition of a bank's assets and off-balance-sheet
objectives. Control must be taken seriously. Aexposures that ensures that an adequate amount of
well-designed system of internal control is worse thancapital and reserves is maintained to safeguard
worthless unless it is complied with, since thesolvency. The 1988 Basel Accord primarily addressed
assemblance of control will be likely to convey a falsebanking in the sense of deposit taking and lending
sense of assurance. Controls are there to be kept,(commercial banking under US law), so its focus was
not avoided. For instance, exception reports shouldcredit risk.
be followed up. Senior management should set aIn the early 1990s, the Basel Committee decided to
good example about control compliance. For instance,update the 1988 accord to include bank capital
physical access restrictions to secure areas should berequirements for market risk. This would have
observed equally by senior management as by juniorimplications for non-bank securities firms.
personnel.Thus, the formula for determining capital adequacy
Components of Internal Controlscan be illustrated as follows:
Components of internal control also depend upon the= Tier I + Tier 2 + Tier 3 *- 8% .
structure of the business unit and nature of itsRisk-weighted Assets + (Market Risk Capital Charge
operation. The COSO Report describes the internalx 12.5)
control process as consisting of five interrelatedIV. Operational Risk
components that are derived from and integratedTo manage this risk documented policies and
with the management process. The components areprocedures are established. In addition, regular training
interrelated, which means that each componentis provided to ensure that staffs are well aware of
affects and is affected by the other four. These fiveorganization's objective, statutory requirements.