Shyamala Gopinath: Changing paradigms in risk management
Special address by Ms Shyamala Gopinath, Deputy Governor of the Reserve Bank of India, at the
FICCI-IBA Conference on "Global Banking: Paradigm Shift", Mumbai, 27 September 2006.
* * *
The world of finance has always had an intuitive understanding of risk. The risks that emerge from the
increased variety and complexities of banking business, as well as from the various new drivers of
growth has pushed the contours of risk management in banks much beyond what would probably
have existed in the more traditional forms of banking activity of accepting deposits and lending in
relatively stable environments. Internationally, the last two decades or so have witnessed significant
changes in the profile of the banking sector, as well the nature of risk management in banks. What
perhaps has changed the nature of risk management, particularly are, inter-alia, advances in
technology that have aided quantitative approaches to risk management, like models etc., and the
increasing volumes of transactions in derivatives and other structured products that are so complex
that they are often labeled "exotic". India too has responded to this change, tempered with a
gradualist, non disruptive approach, that has stood us in good stead over the years.
In my brief remarks today, I intend to first, highlight few of the broader and more general issues
currently engaging the financial risk management fraternity and then, move to the Indian context in this
regard.
I. Some general perspectives on risk management
Quantification of risk and model risk: As mentioned earlier, significant developments in the area of
quantification of risk, has shifted focus to statistical aspects of risk management, especially to risk
modeling and other computational techniques of risk measurement. During the last decade there has
been a proliferation of academic research on the use of VaR for market risk assessment. Such models
have to be used with some care and serious examination of the data used, especially the use of
historical data for forecasting future scenarios, the assumptions behind the models, estimation errors
etc. Further, if intraday positions are not captured it would expose banks to such risks.
Similarly in respect of Credit Risk, there is no single ''best practice'' model for credit risk capital
assessment, although the Basel 2 ''Internal Rating Based'' methodology provides a portfolio model.
Bank managements will have to focus on the determinants of credit risk factors, the dependency
between risk factors, the integration of credit risk to market risk, data integrity issues like consistency
of data over long periods, accuracy and so on.
Institutions are already mapping events to operational loss categories and building warehouses of
operational risk data for implementation of Advanced Measurement Approaches. Many data
availability and reliability issues still need resolving. An internal loss experience for the important (low
frequency, high severity) operational risk types is rare and any relevant data are likely to be in the form
of risk self-assessments and/or external loss experiences.
Extreme events and stress testing: One of the key roles of the risk management process is to manage
extreme events, such as those associated with the tails of statistical distributions and could have
probability of occurrence as low as one percent. These are low probability but high loss instances
associated with extreme operational events such as rogue trading or accounting fraud. The
importance of stress testing to assess the impact of not only these events but also the impact of
various scenarios is engaging the attention of risk management personnel, academicians and bankers
alike
Risk based capital and back-testing: An important reason as to why the quantitative techniques have
received so much attention, is not because of the intellectual satisfaction it can give to the
academician but a rather mundane reason that it can be used to convince the regulator that given the
risks as measured by these techniques the amount of capital required could be far less than that may
be stipulated under broad brush, standardized techniques. An immediate linkage between the risk
models, the quantum of risk that is measured by use of these models and the capital that is required to
support these risks immediately emerge. Estimates of capital being sufficient to meet the risk can be
only as good as the models are and the credibility of the models would ultimately depend upon their
actual performance. Back testing the models to gauge and reduce the variance between the
deviations of the actual numbers from those projected are largely relied upon to give a degree of
comfort to both management of banks and supervisors alike.
II. Indian perspective
Internationally, there has been a continuous coordinated effort under the aegis of institutions like the
BIS to evolve best practices in risk management in banks and these have gradually come to be
accepted as some sort of international standards for banks across the world to benchmark themselves
to. At the regulatory and supervisory level also, there has been an effort to achieve convergence to the
best practices set out by the BCBS after duly allowing for national characteristics and feasibility. Banks
have responded to this initiative with varying levels of effectiveness.
It was in October 1999, that the Reserve Bank issued guidelines on Risk Management in banks setting
out its expectations from banks; the guidelines adopted an integrated approach to risk management.
Even earlier, in February 1999, banks were advised to set up an asset liability management framework
to manage liquidity and interest rate risk. In this context, I would like to make following observations:
a) The need to accelerate the speed at which banks have been moving towards establishment
of risk management systems
b) The need to achieve convergence with regulatory and supervisory
expectations/requirements while deciding on the sophistication of methods to be adopted.
c) Developing appropriate risk management architecture, MIS and skill enhancement
d) The need to integrate risk management process with capital planning strategies
The current business environment, with its pointed emphasis on corporate governance, is making it
critical for banks to explain their risk profiles publicly with greater clarity and detail than ever before.
Risk is still a complex and technical subject, so achieving transparency will not be easy. Internal
constituents, analysts, ratings agencies, investors, and regulators all have varying levels of
understanding of advanced risk measurement techniques. All will require continuing education before
the market as a whole reaches a common understanding of risk. In particulars, direct stakeholders in
any transaction need to be aware of the risks involved. For the third pillar of Basle II (Market
Discipline) to be efficacious, it is important that the stakeholders are aware of the risks involved in the
banks' transactions and the systems in place to manage the risks. In this context, the importance of an
appropriateness policy for banks offering various products to the corporate clients can't be
overemphasised.
The risk management systems developed by banks would include a lot of attention of top
management to the suitability of IT structure including issues of connectivity, designing an MIS format
that is risk focused, setting up an organization to manage risk that ensures segregation of risk
assessment from operations, frequent review of risk management systems to ensure there is no
slippage and last but not the least, to develop appropriate skills within the organization. In this context,
it must be kept in view that risk management is not the sole concern of the risk management
department but rather a culture that pervades the whole organization with specific support from the top
management.
III. Recent initiatives in risk management
In India, over the years various steps have been taken to strengthen the Risk Management
Architecture, both at the bank specific level as well as a broader systemic level.
ALM guidelines: Most banks have put in place an ALM framework. However there is lot to be done to
internalize this framework as a part of the overall risk perceptions of the bank and the capital planning
strategy of the bank. Issues in data infirmity still remain to some extent. In many cases, the ALCO's
role remains confined to deciding on interest rates of the bank. This is partly due to lack of decision
support system available to the ALCO. Availability of impact and scenario analysis of changes in yield
structures would be a significant enabling factor.
The Reserve Bank has recently issued draft guidelines to banks with the objective of graduating from
the current maturity ladder approach prevalent in most banks to a duration gap approach. The later
approach makes it possible for banks to calculate the modified duration of assets and liabilities, the
duration gap and duration of equity. The concept of duration of equity gives banks, subject to certain
limitations, a single number indicating the impact of a one per cent change of interest rate on its
capital, captures the interest rate risk and thereby helps move a step forward towards assessment of
risk based capital/economic capital.
Credit risk: Another important issue is that bank resources and supervisory resources have
concentrated on credit risk modeling of commercial and industrial portfolios, with relatively fewer
resources devoted to risk quantification in the retail credit area1. The possible reasons could be (i)
from a systemic perspective, it makes economic sense to devote more resources to evaluating the risk
factors of larger loans (ii) there is a long history of ratings agency evaluations for publicly traded firms
which , along with the extensive data available for publicly traded firms, provided an extremely useful
benchmark for the development of quantification methods for commercial portfolios.
However, despite this commercial side emphasis, retail credit is a substantial part of the risk borne by
the banking industry, and can not be ignored. Recognizing this, over the last decade or so, the
industry and academia have devoted significant resources to developing more sophisticated
creditscoring models for measuring this risk. Like their counterparts on the commercial side, these models
also rely heavily on quantitative analysis.
Derivatives: There has been a spurt of derivatives exposures in the off balance sheet exposures. The
composition of derivatives portfolio of the banking system has also undergone a significant
transformation. Forward foreign exchange contracts which accounted for around 80% of total
derivatives in March 2002 declined steadily and stood at almost 43% in March 2006 while the share of
interest rate contracts went up from 19% to 54% during the same period. Foreign currency options
have recorded noticeable increase during the last year. The share of single currency interest rate
swaps in total derivatives of the banking system has risen sharply from 15% in March 2002 to 53% in
March 2006.
The risks arising on account of OBS activities of banks are controlled through a combination of both
banks' internal risk management and control policies and risk mitigation mechanism imposed by the
regulators. The board approved internal control policies covering various aspects of management of
risks arising both on and off balance sheet exposures constitute the first line of defence to the bank.
Holding of minimum defined regulatory capital for all OBS exposures, collection of periodic supervisory
data and incorporating transparency and disclosure requirements in bank balance sheet are some of
the major regulatory initiatives undertaken to control and monitor OBS exposures of the banking
system.
The rapid proliferation of derivatives exposures inevitably poses a challenge on account of the
downside risks associated with them, if not managed properly. There are issues relating to use of
structured products, valuation, counterparty related issues, risk management and reporting issues and
last but not the least, training and skill development. While derivatives facilitate risk hedging and risk
transfer to institutions more willing to bear the risks, the tendency of participants to use derivatives to
assume excessive leverage, and lack of prudential accounting guidelines are matters of concern.
One of the features of in the Indian derivative market relates to concentration risk in respect of both
the market makers (banks) and the corporates. The combined share of top 15 banks has steadily
grown from around 74% in March 2002 to 82% of total OBS exposures of the banking system in March
2006, of which 62% is accounted for by foreign banks. Concentration of knowledge is another risk
which results in the concentration of derivative activity among few players.
RBI has been stressing on the need to carry out due diligence regarding customer appropriateness
and suitability of products before offering derivative products to their customers. There is need to use
risk mitigation techniques such as collaterals and netting to reduce systemic risks and evolve
appropriate accounting guidelines.
RBI has also issued two separate draft guidelines, one for valuation/accounting of investment portfolio
in general and the second relating to derivatives. The proposed guidelines attempt to put in place fair
value accounting norms for derivatives broadly in line with IAS 39, the international accounting
standard for valuation and accounting for financial instruments. For investments, the proposed
framework envisages a symmetrical treatment for unrealized gains and losses, with gains for HFT
being reflected in the Profit and loss account. For AFS, however, a gain or loss on subsequent
measurement shall be reflected in 'Unrealised gain/ loss on AFS portfolio'. Similarly for derivatives, all
valuation gains and losses are proposed to be routed either through the P&L (for less than 90 days)
and or through a new account titled ' Unrealised gains/losses on derivatives' (90 days and more),
somewhat similar to AFS portfolio. The idea is to bring all derivative transactions 'on-balance sheet' as
against 'off-balance sheet' as is being done currently.
Further, in order to address all issues related to derivatives in a comprehensive manner, we are now in
the process of harmonizing the regulatory prescriptions based on generic principles rather than
approving specific products.
Stress testing: The Governor in his Monetary Policy for 2006-07 had stressed the need for banks to
have robust stress testing process for assessment of capital adequacy given various possible events
like economic downturns, industrial downturns, market risk events and sudden shifts in liquidity
conditions. Similarly exposures to sensitive sectors and high risk category of assets would have to be
subjected to more frequent stress tests based. Stress tests would enable banks to assess the risk
more accurately and, thereby, facilitate planning for appropriate capital requirements.
Subsequently RBI has issued draft guidelines on stress testing. These guidelines cover all major risk
areas viz. market risks, credit risks, operational risks and liquidity funding risk. Banks are required to
identify an appropriate range of realistic adverse circumstances and events in which the identified risk
crystallises and estimate the financial resources needed by it under each of the circumstances to : a)
meet the risk as it arises and for mitigating the impact of manifestation of that risk; b) meet the
liabilities as they fall due; and c) meet the minimum CRAR requirements. It may be pertinent to note
that the banks have been advised to apply stress tests at varying frequencies dictated by their
respective business requirements, relevance and cost.
Financial conglomerates: There is increasingly a need to extend the framework of risk management to
the group wide level, particularly among financial conglomerates. The rapid expansion of financial
services, both in terms of volumes and variety have, as it is, posed a challenge for financial stability.
This is made all the more difficult by the organisational dimension which perhaps provides scope for
regulatory arbitrage. While this could appear beneficial to the organisation in the short run, it only
hightens systemic risk that in turn exposes the institution to externalities which have a cost. There has
been entry of some banks into other financial segments like merchant banking, insurance and several
new players have emerged who have a diversified presence across major segments of financial
sector. Some of the non-banking institutions in the financial sector can acquire proportions large
enough to have a systemic impact. It has, therefore, become necessary not only for the supervisor to
have a "conglomerate" approach to regulation and supervision but also for banks themselves to put in
place risk management systems at global levels i.e. for the whole organizational as a whole, rather
than only the bank level. The risks associated with conglomeration may include:
1. The moral hazard associated with the 'Too-Big-To-Fail' position of many financial
conglomerates;
2. Contagion or reputation effects on account of the 'holding out' phenomenon;
3. Concerns about regulatory arbitrage, non-arm's length dealings, etc. arising out of
Intragroup Transactions and Exposures (ITEs) both financial and non-financial
It is in this context that the issue of integrated risk management, at the enterprise wide as well as
group wide level, acquires significance. RBI has put in place a framework for oversight of financial
conglomerates, along with SEBI and IRDA. Half-yearly discussions have also been initiated with the
Chief Executive Officers of the designated entities of the conglomerates to address outstanding
issues/ supervisory concerns.
IV. To conclude, at the systemic level, efforts have been made to create an enabling environment for
all market participants in terms of regulation, infrastructure and instruments. In this context, let me
mention about two recent legislative developments that may have far reaching impact on the financial
markets in India. One is the promulgation of the RBI (Amendment) Act, 2006. A major issue of concern
in the OTC derivatives market in India was the issue of legality. While the Securities Contract
Regulation Act, 1956 gave specific legal recognition to derivative instruments traded in the exchanges,
there was no explicit legal recognition of OTC derivatives in India. As legal clarity is a basic
requirement for the healthy development of any market, legality of OTC derivatives was provided by
an appropriate amendment to the RBI Act, with retrospective effect. RBI has also been now
empowered to regulate the interest rate and forex OTC derivatives market. The second legislative
development pertains to the enactment of Government Securities Bill. The substantive changes
brought about in the Government Securities Act are that it provides for hypothecation, pledge and lien
of government securities, maintenance of records in electronic form and most importantly, enables
STRIPing of Government securities.
Further, during the last few months, few liberalization measures have been introduced in securities
market, that would surely have a bearing on the risk management practices in the market, the most
important being introduction of 'when issued' trading and short selling in the G-Sec markets in a limited
way. Currently the when issued trading is limited to reissuances only. We are examining extending this
to new issuances also, as requested by market participants.
What has developed incrementally over the years is now being consolidated and once the regulations,
infrastructure and appropriate accounting standards stabilize, several other initiatives like credit
derivatives could be considered.