Risk Management is a hot topic in the financial sector especially in the light of the recent losses of some multinational corporations e.g. collapses of Britain’s Barings Bank, WorldCom and also due to the incident of 9/11. Rapid changes in business condition, restructuring of organizations to cope with ever increasing competition, development of new products, emerging markets and increase in cross border transactions along with complexity of transactions has exposed Financial Institutions to new risks dimensions. Thus the concept of risk has captured a growing importance in modern financial society.By facilitating transactions and making credit and other financial products available, the financial sector is a crucial building block for private as well as public sector development. In its broadest definition, it includes everything from banks, stock exchanges, and insurers, to credit unions, microfinance institutions and moneylenders. As an efficient service provider, the financial sector simultaneously fulfils an important function in the overall economy. Various types of Financial Institutions actively working in Financial Sectors include Banks, DFIs, Micro Finance Banks, Leasing Companies, Modarabas, Assets Management Company, Mutual Funds, etc.Thus today’s operating environment demands systematic and more integrated risk management approach.Risk:Risk by default has tow components; uncertainty and exposure. If both are not present, there is no risk. Definition of Risk as per Guidelines on Risk Management issued by State Bank of Pakistan is, “Financial risk in a banking organization is possibility that the outcome of an action or event could bring up adverse impacts. Such outcomes could either result in a direct loss of earnings / capital or may result in imposition of constraints on bank’s ability to meet its business objectives. Such constraints pose a risk as these could hinder a bank’s ability to conduct its ongoing business or to take benefit of opportunities to enhance its business.”Types of Risks:Risks are usually defined by the adverse impact on profitability of several distinct sources of uncertainty. More or less all financial institutions have to manage the following faces of risks:1. Credit Risk2. Market Risk3. Liquidity Risk4. Operational Risk5. Country Risk6. Legal Risks7. Compliance Risk8. Reputational RiskBroadly speaking there are four risks as per Risk Management Guidelines which surround Financial Sector i.e. Credit Risk, Market Risk, Liquidity Risk and Operational Risk. These risk are elaborated here under:i. Credit RiskThis is the risk incurred in case of a counter-party default. It arises from lending activities, investing activities and from buying and selling financial assets on behalf of others. This risk is associated with financing transactions i.e.:a. Default in repayment by the borrower andb. Default in obliging the commitment by another Financial Institution in case of syndicated arrangements.It is the most critical risk in banking and one that must be managed carefully. It is also the risk that requires the most subjective judgment despite constant efforts to improve and quantify the credit decision process.ii. Market RiskMarket risk is defined as the volatility of income or market value due to fluctuations in underlying market factors such as currency, interest rates, or credit spreads. For commercial banks, the market risk of the stable liquidity investment portfolio arises from mismatches between the risk profile of the assets and their funding. This risk involves interest rate risk in all of its components: equity risk, exchange risk and commodity risk.iii. Liquidity RiskThe liquidity risk is defined as the risk of not being able to meet its commitments or not being able to unwind or offset a position by an organization in a timely fashion because it cannot liquidate assets at reasonable prices when required.iv. Operational RiskThis risk results from inadequacies in the conception, organization, or implementation of procedures for recording any events concerning bank’s operations in the accounting system/information systems.Need for Risk Management and Monitoring:There are a number of reasons as to why there is so much emphasis given to Risk Management in Financial Sector now a day. Some of them are listed below: -1. Present structure of joint stock companies, wherein owners are not the mangers, hence risks increase; therefore proper tools are required to achieve the desired results by covering the risks.2. The financial sector has come out of simple deposit and lending function.3. The world has become very complex so the financial transactions and instruments.4. Increase in the number of cross border transactions which caries its own risks.5. Emerging markets6. Terrorism RemittancesRisk monitoring in financial sector is very crucial and an inevitable part of risk management. Risk Monitoring is important in the financial sector due to the following reasons:1. Deals in others’ money2. Direct stake of deposit holder.3. Much riskier sector than trading and manufacturing.4. Previous / Recent problems faced by banks i.e. stuck portfolio that is credit risk.5. Bankruptcy of Barings Bank due to short selling / long position that is market risk.6. Operational risk does not has immediate impact, but important for continuity and progress of organization.7. Appetite of a financial institution to take risk is related with the capital base of the institute so it caries a huge risk of over exposure.Components of Risk Management Frame WorkRisk Management Frame Work has five components. First of all risk is Identified, then it is Assessed to classify, seek solution and management, after assessing quick Response and implementation of solution and the last phase is Monitoring of the risk management progress and Learning from this experience that such problem never occur again. Whole process is to be well Communicated during the entire process of risk management if it is to be managed efficiently.The International Organization for Standardization (ISO) has defined risk management as the identification, analysis, evaluation, treatment (control), monitoring, review and communication of risk. These activities can be applied in a systematic or ad hoc manner. The presumption is that systematic application of these activities will result in improved decision-making and, most likely, improved outcomes.Structure of Risk ManagementDepending upon the structure and operations of organization, financial risk management can be implemented in different ways. Risk management structure defines the different layers of an organization at which risk is identified and managed. Although there are different layers or level at which risk is managed but there are three layers which are common to all. i.e.Risk ManagementFor managing risk there are certain basic principles which are to be followed by every organization:1. Corporate level Policies2. Risk management strategy3. Well-defined policies and procedures by senior management4. Dissemination, implementation and compliance of policies and procedures5. Accountability of individuals heading various functions/ business lines6. Independent Risk review function7. Contingency plans8. Tools to monitor risksInstitutions can reduce some risks simply by researching them. A bank can reduce its credit risk by getting to know its borrowers. A brokerage firm can reduce market risk by being knowledgeable about the markets it operates in.Functionally, there are four aspects of financial risk management. Success depends uponA. A positive corporate culture,No one can manage risk if they are not prepared to take risk. While individual initiative is critical, it is the corporate culture which facilitates the process. A positive risk culture is one which promotes individual responsibility and is supportive of risk taking.B. Actively observed policies and proceduresUsed correctly, procedures are powerful tool of risk management. The purpose of policies and procedures is to empower people. They specify how people can accomplish what needs to be done. The success of policies and procedures depends critically upon a positive risk culture.C. Effective use of technologyThe primary role technology plays in risk management is risk assessment and communication. Technology is employed to quantify or otherwise summarize risks as they are being taken. It then communicates this information to decision makers, as appropriate.D. Independence or risk management professionalsTo get the desired outcome from risk management, risk managers must be independent of risk taking functions within the organization. Enron’s experience with risk management is instructive. The firm maintained a risk management function staffed with capable employees. Lines of reporting were reasonably independent in theory, but less so in practice.Internal ControlsPara one on first page of the ‘Guidelines on Internal Controls’ issued by SBP provides:”Internal Control refers to policies, plans and processes as affected by the Board of Directors and performed on continuous basis by the senior management and all levels of employees within the bank. These internal controls are used to provide reasonable assurance regarding the achievement of organizational objectives. The system of internal controls includes financial, operational and compliance controls.”The current official definition of internal control was developed by the Committee of Sponsoring Organization (COSO) of the Treadway Commission. In its influential report, Internal Control – Integrated Framework, the Commission defines internal control as follows:”Internal control is a process, effected by an entity’s Board of Directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: Effectiveness and efficiency of operations. Reliability of financial reporting. Compliance with applicable laws and regulations.This definition reflects certain fundamental concepts: Internal control is a process. It is a means to an end, not an end in itself. Internal control is effected by people. It is not policy manuals and forms, but people at every level of an organization. Internal control can be expected to provide only reasonable assurance, not absolute assurance, to an entity’s management and board.Internal control should assist and never impede management and staff from achieving their objectives. Control must be taken seriously. A well-designed system of internal control is worse than worthless unless it is complied with, since the assemblance of control will be likely to convey a false sense of assurance. Controls are there to be kept, not avoided. For instance, exception reports should be followed up. Senior management should set a good example about control compliance. For instance, physical access restrictions to secure areas should be observed equally by senior management as by junior personnel.Components of Internal ControlsComponents of internal control also depend upon the structure of the business unit and nature of its operation. The COSO Report describes the internal control process as consisting of five interrelated components that are derived from and integrated with the management process. The components are interrelated, which means that each component affects and is affected by the other four. These five components, which are the necessary foundation for an effective internal control system, include:I. Control Environment,Control environment, an intangible factor and the first of the five components, is the foundation for all other components of internal control, providing discipline and structure and encompassing both technical competence and ethical commitment.II. Risk Assessments,Organizations exist to achieve some purpose or goal. Goals, because they tend to be broad, are usually divided into specific targets known as objectives. A risk is anything that endangers the achievement of an objective. Risk assessments is done to determine the relative potential for loss in programs and functions and to design the most cost-effective and productive internal controls.III. Control Activities,Control activities mean the structure, policies, and procedures, which an organization establishes so that identified risks do not prevent the organization from reaching its objectives.
Policies, procedures, and other items like job descriptions, organizational charts and supervisory standards, do not, of course, exist only for internal control purposes. These activities are basic management practices.IV. Information and Communication, andOrganizations must be able to obtain reliable information to determine their risks and communicate policies and other information to those who need it. Information and communication, the fourth component of internal control, articulates this factor.V. MonitoringLife is change; internal controls are no exception. Satisfactory internal controls can become obsolete through changes in external circumstances. Therefore, after risks are identified, policies and procedures put into place, and information on control activities communicated to staff, superiors must then implement the fifth component of internal control, monitoring.Even the best internal control plan will be unsuccessful if it is not followed. Monitoring allows the management to identify whether controls are being followed before problems occur. In the same way, management must review weaknesses identified by audits to determine whether related internal controls need revision.Tools for Monitoring of RiskManagement Information SystemM.I.S or Management Information System is the collection and analysis of data in order to support management’s decision with respect to the achievement of objectives mentioned in the policies and procedures and the control of various risks therein.It is this area i.e. M.I.S, where I.T can play a vital and effective role as with the help of I.T large information may be analyzed efficiently and with accuracy, so that effective decision may be taken by the management without the loss of any time.Asset-Liability Management Committee (ALCO)In most cases, day-to-day risk assessment and management is assigned to a specialized committee, such as an Asset-Liability Management Committee (ALCO). Duties pertaining to key elements of the risk management process should be adequately separated to avoid potential conflicts of interest – in other words, a financial institution’s risk monitoring and control functions should be sufficiently independent from its risk-taking functions. Larger or more complex institutions often have a designated, independent unit responsible for the design and administration of balance sheet management, including interest rate risk. Given today’s widespread innovation in banking and the dynamics of markets, banks should identify any risks inherent in a new product or service before it is introduced, and ensure that these risks are promptly considered in the assessment and management process.Corporate Governance PrinciplesCorporate governance relates to the manner in which the business of the organization is governed, including setting corporate objectives and a institution’s risk profile, aligning corporate activities and behaviors with the expectation that the management will operate in a safe and sound manner, running day-to-day operations within an established risk profile, while protecting the interests of depositors and other stakeholders. It is defined by a set of relationships between the institution’s management, its board, its shareholders, and other stakeholders.The key elements of sound corporate governance in a bank include:a) A well-articulated corporate strategy against which the overall success and the contribution of individuals can be measured.b) Setting and enforcing clear assignment of responsibilities, decision-making authority and accountabilities that are appropriate for the bank’s risk profile.c) A strong financial risk management function (independent of business lines), adequate internal control systems (including internal and external audit functions), and functional process design with the necessary checks and balances.d) Corporate values, codes of conduct and other standards of appropriate behavior, and effective systems used to ensure compliance. This includes special monitoring of a bank’s risk exposures where conflicts of interest are expected to appear (e.g., relationships with affiliated parties).e) Financial and managerial incentives to act in an appropriate manner offered to the board, management and employees, including compensation, promotion and penalties. (i.e., compensation should be consistent with the bank’s objectives, performance, and ethical values).f) Transparency and appropriate information flows internally and to the public.Tools mentioned above can be utilized in identifying and managing different risks in the following manner:I. Credit RiskIt is managed by setting prudent limits for exposures to individual transaction, counterparties and portfolios. Credits limits are set by reference to credit rating established by Credit Rating Agencies, methodologies established by Regulators and as per Board’s direction.o Monitoring of per party exposureo Monitoring of group exposureo Monitoring of bank’s exposure in contingent liabilitieso Bank’s exposure in clean facilitieso Analysis of bank’s exposure product wiseo Analysis of concentration of bank’s exposure in various segments of economyo Product profitability reportsII. MarketFinancial Institutions should also have an adequate system of internal controls to oversee the interest rate risk management process. A fundamental component of such a system is a regular, independent review and evaluation to ensure the system’s effectiveness and, when appropriate, to recommend revisions or enhancements.Interest rate risk should be monitored on a consolidated basis, including the exposure of subsidiaries. The institution’s board of directors has ultimate responsibility for the management of interest rate risk. The board approves the business strategies that determine the degree of exposure to risk and provides guidance on the level of interest rate risk that is acceptable to the institution, on the policies that limit risk exposure, and on the procedures, lines of authority, and accountability related to risk management. The board also should systematically review risk, in such a way as to fully understand the level of risk exposure and to assess the performance of management in monitoring and controlling risks in compliance with board policies. Reports to senior management should provide aggregate information and a sufficient level of supporting detail to facilitate a meaningful evaluation of the level of risk, the sensitivity of the bank to changing market conditions, and other relevant factors.The Asset and Liability Committee (ALCO) plays a key role in the oversight and coordinated management of market risk. ALCOs meet monthly. Investment mandates and risk limits are reviewed on a regular basis, usually annually to ensure that they remain valid.Risk Management and Risk BudgetsA risk budget establishes the tolerance of the board or its delegates to income or capital loss due to market risk over a given horizon, typically one year because of the accounting cycle. (Institutions that are not sensitive to annual income requirements may have a longer horizon, which would also allow for a greater degree of freedom in portfolio management.). Once an annual risk budget has been established, a system of risk limits needs to be put in place to guard against actual or potential losses exceeding the risk budget. There are two types of risk limits, and both are necessary to constrain losses to within the prescribed level (the risk budget).The first type is stop-loss limits, which control cumulative losses from the mark-to-market of existing positions relative to the benchmark. The second is position limits, which control potential losses that could arise from future adverse changes in market prices. Stop-loss limits are set relative to the overall risk budget. The allocation of the risk budget to different types of risk is as much an art as it is a science, and the methodology used will depend on the set-up of the individual investment process. Some of the questions that affect the risk allocation include the following:* What are the significant market risks of the portfolio?* What is the correlation among these risks?* How many risk takers are there?* How is the risk expected to be used over the course of a year?Compliance with stop-loss limits requires frequent, if not daily, performance measurement. Performance is the total return of the portfolio less the total return of the benchmark. The measurement of performance is a critical statistic for monitoring the usage of the risk budget and compliance with stop-loss limits. Position limits also are set relative to the overall risk budget, and are subject to the same considerations discussed above. The function of position limits, however, is to constrain potential losses from future adverse changes in prices or yields.III. Liquidity RiskThe Basel Committee has established certain quantitative standards for internal models when they are used in the capital adequacy context.a. Allocation of capital into various types of business after taking into account the operational risks i.e. disruption of business activity, which has especially increased due to excessive EDP usageb. Allocation of the capital is also made amongst various products i.e. long term, short term, consumer, corporate etc. considering the risks involved in each product and its life cycle to avoid any liquidity crunch for which gap analysis is made. This is the job of ALCOc. For instance Contingent liabilities not more than 10 times of capital,d. Fund based not more than 6 times of capitale. Capital market operations not more than 1 time of capitalf. However these limits cannot exceed the regulations.g. Parameters of controlso Regulatory Requirementso Board’s directionso Prudent practicesFor liquidity management organizations are compelled to hold reserves for unexpected liquidity demands. The ALCO has responsibility for setting and monitoring liquidity risk limits. These limits are set by Regulatory Bodies and under Board’s directions keeping in mind the market condition and past experience.The Basel Accord comprises a definition of regulatory capital, measures of risk exposure, and rules specifying the level of capital to be maintained in relation to these risks. It introduced a de facto capital adequacy standard, based on the risk-weighted composition of a bank’s assets and off-balance-sheet exposures that ensures that an adequate amount of capital and reserves is maintained to safeguard solvency. The 1988 Basel Accord primarily addressed banking in the sense of deposit taking and lending (commercial banking under US law), so its focus was credit risk.In the early 1990s, the Basel Committee decided to update the 1988 accord to include bank capital requirements for market risk. This would have implications for non-bank securities firms.Thus, the formula for determining capital adequacy can be illustrated as follows:= Tier I + Tier 2 + Tier 3 *- 8% .Risk-weighted Assets + (Market Risk Capital Charge x 12.5)IV. Operational RiskTo manage this risk documented policies and procedures are established. In addition, regular training is provided to ensure that staffs are well aware of organization’s objective, statutory requirements.o Reporting of major/ unusual/ exceptional transactions with respect to ensuring the compliance of the principles of KYC and Anti-money laundering measureo Analysis of system problems