Sunil Mendis: Risk management in Sri Lankan banks in the changing
environment
Inaugural address by Mr Sunil Mendis, Governor of the Central Bank of Sri Lanka, at the
CRISILSLBA seminar on risk management in Sri Lankan banks in the changing environment,
Colombo, 15-16 November 2004.
* * *
Good morning ladies and gentlemen,
Let me first thank the SLBA (Sri Lanka Banks Association) and the representatives from CRISIL India
(Credit Rating Information Services of India Ltd) for the initiative taken to organize this Seminar on a
very important aspect of banking business - risk management.
As we all know, risk management in banking is a continuous process of planning, organizing and
controlling a bank's assets and liabilities, their volumes, maturities, rates and yields. This is the most
simple definition that I can think of. However, its implications on banking business are what we
concern ourselves with, especially from the regulatory point of view.
In the context of Sri Lankan banks at least, of the major risks confronting financial institutions, credit
risk remains the predominant or core risk. Risktaking is part and parcel of banking. The highly
leveraged nature of banking business itself illustrates the risk exposure level of banks. Therefore, what
is important is how we manage these risks, how we measure and price risk and above all what
measures we take to mitigate these risks.
The primary responsibility of understanding the risks run by the bank and ensuring that such risks are
appropriately controlled and are within the risk parameters of the Bank, i.e. its risk appetite, is vested
with the Board of Directors. It is now a widely accepted principle of good corporate governance that
bank management understands new banking products and businesses of the Bank. Without proper
understanding of the risks associated with such new products the management should not give their
assent to the introduction of such products. It is the responsibility, therefore, of the Board of Directors
to set the parameters for risk taking beyond which banking business should not be permitted.
What then are the essential pre-requisites for good and effective risk management? Timely and
reliable information is the foundation upon which good risk management is built. Lots of questions
come to my mind here - do those responsible for credit decisions have a knowledge of the industry
they are lending to? Why do banks depend so much on collateral when we all know it is the last
resort? This is where information plays an important part. If you do not have knowledge of the industry
or sector to which you are lending, your credit decision is seriously flawed and sooner or later will
translate itself into NPA. Why do we have high levels of NPA? Is the information necessary for
evaluation of creditworthiness of a borrower available to the banks? Is the credit decision taken on the
basis of such evaluation - how current is the financial information on the borrower with the bank? The
market is a dynamic place, where change takes place all the time. It is imperative that credit officers of
banks be given maximum exposure to the real sector - the numbers in financial statements must have
a direct relationship to the real sector to reflect the current status of the borrower's business? They
should support the repayment programme undertaken by the borrower on which the Bank's credit
decision was predicated. You will see thus that information is critical to risk management without which
you are groping in the dark and before long you will be faced with large losses.
The emphasis should therefore be on the early identification of risk, which if addressed at the very
initial stages, would not expose the bank to large scale losses at a later stage.
Effective credit risk management is the key to the health of the banking industry today. It is not the
resolution of NPA but the cause of NPA that should be addressed. Internal rating systems must be
developed to afford an accurate and continuous picture of the level of risk exposure of the bank to
individual credit risk so that timely action can be taken to soften the risk. Management Information
Systems must be strengthened. Preventive and remedial actions should encompass additional capital,
better internal controls and/or safer provisioning policies. Capital is not a substitute for sound risk
management. An operating environment based on prudent risk management rather than aggressive
risk taking, gives us regulators comfort that profits are conservatively stated. This is the essence of
prudence which underpins safe and sound banking.
In an increasing trend to harmonise prudential frameworks across the globe, in recognition of the fact
that banks, wherever they may be domiciled, are exposed to the same risks, it is becoming
increasingly difficult to pursue country-specific solutions. We recognize that we too have to be
internationally compatible in adopting common standards for regulation and supervision which are
spearheaded by the Basel Committee. Global financial reporting practices are not far away and there
are efforts underway to establish a common set of internationally accepted financial reporting
standards. Differences of opinion between standard setters and regulators need to be reconciled -
IAS 39 is one such which is being hotly debated.
The efforts taken by CRISIL India, together with the SLBA, in this regard are commendable and I
would like to see this initiative gather momentum to provide the platform for the improvement of risk
management techniques by the banks in Sri Lanka which would, in turn, make them ready, if not in
2007, even later, to meet the challenges of Basel II. The transition to Basel II calls for a fundamental
shift from the basic rudiments of risk management to sophisticated risk management techniques. The
period of transition and the cost of transition has to be closely examined by the banking industry.
Considerable investment in information technology will have to be made to complete this transition.
The strong platform of good risk management, therefore has first to be in place. Therefore, the
incentive that I can see from Basel II now is to commence the process to improve risk management
especially operational risk by banks in Sri Lanka. As you may know Basle II requires specific capital to
be allocated to operational risk, which is one of the main differences between Basle I and Basle II.
Some internationally reputed banks have already allocated about 20% of capital for operational risk.
To effectively mitigate risks, banks need to have risk managers or risk management specialists. If you
don't have such specialists, you need to look for them or enhance the capacity of the existing staff to
meet this need. Sound risk management practices lead to cushions that are built in good times so as
to be run down , up to a point, in bad times. Provisions for loan losses dictated by prudence when
profits are good, can always be written back when profits are low. It is that degree of caution in the
exercise of judgements, in making estimates when there is an element of uncertainity, that makes
prudence the most critical factor in risk management in banks.
This is my message to you today and I wish this Seminar every success.