Ranee Jayamaha: Governance, risk management and compliance Keynote address by Dr Ranee Jayamaha, Deputy Governor of the Central Bank of Sri Lanka, at the Seminar on “Governance, Risk Management and Compliance and the Roadmap for Financial Services Industry”, Colombo, 7 February 2008. * * * The Chairman and the Organizing Committee; I would like to begin by expressing my gratitude for being given the opportunity to address a gathering that includes impressive groups of representatives from the financial services industry, risk management professionals, regulators and businesses. As you are aware, the year 2008 has started off with the continuation of some of the challenges that resulted in significant disturbances in world financial markets: the impact of the sub prime market turmoil which originated in the US is still spreading across Europe and other financial markets; the Northern Rock crisis in the U.K. has raised serious regulatory issues; and the large frauds in global banks have highlighted the repercussions of the lack of internal controls and accountability in financial institutions. As in the past, many of these have been due to lapses in governance and risk management practices. Although Sri Lanka’s financial markets have been insulated from these disturbances, they underscore the need for good corporate governance, better risk management and compliance in our financial industry. It is also important for us to learn from the bitter lessons experienced by others as our financial services industry too is tempted to provide low quality credit, which has been the root cause of the subprime issue. The topic therefore is very relevant and it is time to generate a wider discussion on Governance, Risk Management and Compliance – in short – GRC, which are considered to be the three key pillars or imperatives of financial management. 1. What is GRC? 1.1 By itself, GRC is not new or unknown. GRC has always been of fundamental concern to businesses, the financial service industry and to regulators and supervisors. All stakeholders realize that there are enormous benefits of observing GRC and that such benefits would outweigh the cost of putting in place processes, procedures and controls that enable effective implementation of GRC. 1.2 Governance is all about self-discipline. It is the process by which the Board of Directors sets the objectives for an organization and oversees progress towards achieving those objectives. Put it simply, it is the set of procedures and processes that keeps the organization alive and allows it to operate as a “going concern”. The higher the sophistication of the financial system, the higher would be the demand for governance as regulation and supervision cannot cover all risk elements in their supervisory processes. 1.3 The next critical pillar or imperative is Risk Management; i.e. identification, assessment, continuous monitoring of risks (real or hypothesized) and risk mitigation, while maximizing returns. In financial business, risk can emanate from many areas. The wellknown risks are credit, liquidity, market, operational and human capital risks. There are several other risks, such as cross-border product risks, illiquidity risks etc. The new and complex products that are being offered by foreign financial markets or institutions can have cross-border risks as their distribution can bring in serious contagion risks across global markets. Most financial institutions do not view equity as risk capital. In banking, risks must include situations of drying up of liquidity. A case in point is the Northern Rock episode in which the bank exposed itself to the illiquidity risk. The need to bring in new capital to cover illiquidity was not given adequate attention by Northern Rock. Such risks should also be analysed by banks and financial institutions and include them in their risk management framework. Ignoring this risk or not taking action to mitigate can be construed as the “moral hazard” we often speak about. Moral hazard leads banks and financial institutions to expect the public to rescue their institutions and continue to run on an illiquid basis, until they hit serious drying up of liquidity. If managed properly, risks can be confined to the institution concerned. If not, any one of these risks or a combination can affect a group of financial institutions or the entire financial services industry thereby creating a systemic risk. As Martin Wolf, a well known Financial Times journalist said “The financial services industry is famous for privatizing its gains and socializing its losses in that it expects the society at large to rescue them through public funds”. 1.4 The third component is Compliance, which relates to laws and regulations, internal policies and procedures. Literally, Compliance means obedience or dutifulness, but it has broad scope and various interpretations. Compliance generally covers matters such as observance, application of standards of market conduct and managing conflicts of interests. More recently, Compliance has expanded its scope to cover specific areas such as operations of money laundering and terrorist financing and even tax laws that are relevant to financial services. In brief, the Compliance function should protect the institution against unlawful behaviour and strengthen its ethical consciousness. A Board of Directors of any financial institution should approve and oversee the institution’s strategic objectives and set a compliance culture. Similarly, the Board should ensure that the financial institution has adequate policies and procedures that enable oversight activities to be carried out on all business lines. Given their fiduciary responsibilities, financial institutions, in particular, should comply with applicable laws and regulations in the jurisdiction in which they operate. 1.5 The word “Compliance” has also a connotation of regulatory and supervisory structures, which means that there is an external regulatory or supervisory body to ensure that financial institutions adhere to norms, guidelines and rules set by it. Compliance efforts will be effective and sustainable only in organizations where Compliance emerges from an ongoing board-level engagement. Compliance management therefore is the execution of business processes designed to manage risks and to continuously benchmark against expected parameters/tolerance levels applicable for the entire industry. 1.6 Compliance is considered to be costly, time consuming and an onerous endeavor. But, many financial institutions understand the criticality and the importance of better GRC and they are willing to devise strategies for leveraging their GRC systems to derive value as well as increase their compliance performance. Behind all these imperatives is the commitment at all levels to manage GRC in an integrated manner and inculcate the culture across the financial services industry. 1.7 The three GRC imperatives are interrelated in financial business and implementing them in isolation or treating them as separate elements would not be fruitful. In the past, most organizations have traditionally viewed, and some still continue to treat, GRC as separate components. The emerging perception of GRC is that it is an integrated set of concepts and, when applied holistically within an organization, it can add significant value and provide competitive advantage. Further, the holistic approach would be more efficient, consistent and legally sound and the Boards of Directors, senior management and staff at all levels would be involved in the organization’s conduct of business. Most financial institutions have viewed GRC as discrete activities undertaken by different departments with no coordinated efforts. As a result, there is a lack of integration of GRC across business areas or functions. 2. New regulations and pressure for integrated risk management 2.1 During the past few years, regulatory and compliance requirements of the financial institutions have strengthened globally. Since the first updating of the Basel Capital Accord in the late 1990s, the Sarbanes-Oxley Act in 2002, the launch of new regulations seems to have become more frequent. With these new requirements, financial institutions are facing an amplified focus on risk management with risk based performance measures and capital allocation. Rating agencies too have expanded their analysis of Integrated Risk Management practices when determining credit ratings. 2.2 The Financial Services Authority (FSA) in the UK, which has come under much criticism in recent times due to the failure of Northern Rock, has published its risk outlook report in 2008, which has identified 5 priority risks. Although some of these may not be directly relevant or applicable to Sri Lanka’s financial institutions, they are common risks that need to be flagged by the Boards of Directors of financial institutions. The priority risks set out by the FSA are: • Existing business model of some financial institutions are under strain as a result of adverse market conditions. Given the nature of financial business, i.e. borrow short term for funding longer term lending, it is irrational to assume plentiful liquidity to prevail at all times without treating liquidity as part of risk capital; • Increased financial pressures may lead financial institutions to shift their efforts away from focusing on the conduct of business requirements and from maintaining and strengthening business as usual; • Market participants and consumers may lose confidence in financial institutions and in the authority’s ability to safeguard the financial system; • A significant minority of consumers could experience financial problems because of their high levels of borrowings; and • Tighter economic conditions could increase the incidence or discovery of financial crime or divert the institution’s resources away from tracking financial crime. 2.3 In addition to these, there could also be institution specific risks, which may bring in potential disturbances. Conventional wisdom now is that the more recent episodes like Northern Rock were an accident waiting to happen as banking regulations have not been emphasizing on liquidity risks. The recent turmoil has exposed the vulnerability of a regulatory framework that places so much emphasis on how well capitalized a bank is, but makes little reference to whether it has an adequate cash cushion and liquid securities to see the institution through a period of market turbulence. In this instance, the Basel II regime also does not seem to offer much help. 2.4 Given these challenges in Risk Management, financial institutions are expected to move towards Integrated Risk Management (IRM) which, in simple terms, is a continuous proactive and systematic process aimed at understanding, managing and communicating risks from an organization-wide perspective. It is about making strategic decisions that contribute to the achievement of an organization’s overall corporate objectives. In other words, IRM requires an on-going assessment of potential risks at every level and every segment and then aggregating the results at the corporate level to facilitate priority setting and improved decision-making. IRM should be embedded in the organization’s corporate strategy and it should shape the organization’s risk mitigation culture and highlight the importance of effective coordination among interdependent risks. 2.5 Many of you may have been following the rogue trading scandal that cost 4.9 billion Euros for Societe Generale – SocGen, the French Bank in recent months. The credibility of the bank suffered a fresh blow this week following the interim report handed over by the Finance Minister, Christine Lagarde to the Prime Minister. In summary, the findings of this report said “Very clearly, certain mechanisms of internal controls of SocGen did not function and those that functioned were not always followed by appropriate modifications”. Further, the report highlighted 8 elements of internal controls that were clearly inadequate and they may have been the decisive factors behind the crisis. Some of the critical ones are: the security of the bank’s IT systems and protection of logins; confirmation of all transactions with all counterparties; respect for “Chinese Walls” between front and back offices; monitoring of cancellations and changes in trades coming from a single trader; and “atypical” behaviour such as failure to take holidays by Kerviel – the rogue trader. 3. Changes to the regulatory framework in Sri Lanka 3.1 Several new regulatory measures have been introduced to strengthen the regulatory and supervisory framework in Sri Lanka. In recent times, the Central Bank has moved away from compliance-based supervision to risk-focused supervision. In 2002, the Central Bank issued a voluntary code of governance for banks and financial institutions expecting them to improve their corporate governance. However, the introduction of this code did not show significant improvement at Board level, primarily due to lack of commitment by the Boards. The Central Bank’s regulatory examinations of banks and financial institutions have raised concerns on corporate governance, inadequate systems and controls, exposure to related party transactions, under-estimation of non-performing loans and inadequate provisioning for bad and doubtful loans, weak administration of loan accounts and potential credit risk and lapses in submission of periodical returns to the regulatory authorities. Almost all of these concerns are related to non-availability of a proper GRC processes in financial institutions. Considering the fiduciary responsibility of the Boards towards their stakeholders, and in the interest of wider financial system stability, the Central Bank issued directions on corporate governance in December 2007, requiring the banks to streamline their governance practices commencing from 2008. 3.2 The implementation of the Basel II framework from January 2008 is another enhancement to the regulatory structure, which requires the financial industry to have a better risk management framework. Most of the leading banks have set up independent risk management and compliance divisions to monitor bank-wide risks. These institutions should now focus in moving forward to implement advanced approaches under Basel II framework by setting up data warehouses and sophisticated IT systems in order to have better risk management and compliance. Similarly, the adoption of International Accounting Standards such as IAS 32 & 39 and IFRS 7, which deal with disclosures, presentation, recognition and measurement of financial instruments, also highlight the need for an integrated risk management, disclosures and compliance. There is, however, reluctance by banks to build robust IT infrastructure and advanced IT frameworks due to the high cost of investment and the time it would take to reap the benefits. It is important that banks and financial institutions change this mindset to pave the way for a GRC management and also to avoid operational losses due to product failures and frauds. Risks arising in these areas could spread beyond the financial institution concerned and have the potential to affect the entire industry. 4. Adopting an integrated GRC framework is a challenge 4.1 Understanding the demands of the organization’s stakeholders is the key in terms of performance and conformance, and aligning the organization to deliver against these objectives. Considering the risk appetite and risk tolerance of the organization, the processes and technology should be designed and deployed so that the achievement of objectives is measured, risks are assessed and continuous improvement is realized in support of effective GRC. Integrating GRC has become a challenge for virtually every financial institution looking to establish an integrated and consistent approach to controlling exposures, managing risks and creating value. 4.2 The major challenge in adopting an integrated GRC approach is the aligning of the GRC framework and processes to standalone and isolated solutions that are already in place. The difficulty is to integrate these isolated solutions through a flexible and add-on basis to embrace new requirements. Changing core business solutions without overhauling business requirements is considered to be a nightmare by many financial institutions. If it is properly planned and designed, it would not be that bad and those who have taken the bold decision to do so will be the winners in the future. 4.3 Another important challenge would be to adopt a GRC framework, which is consistent with international standards. To enable this, new policies and procedures have to be written with links to automated systems. Keeping up with the international best practice is not an easy task, but we have much less choice in not doing so. It will also bring in new challenges for the supervisory and legislative community. The changes that occur at high speed, the new risks and complexities that cut across the financial industry at an international level may pose difficulties for institutions to be compliant at all times because their compliance today may not hold for tomorrow, but it is important to realize that today’s challenges are tomorrow’s history. So, it is necessary to act today. 4.4 Given the expansion of financial markets associated with rapid growth in India and China, it is essential for banking and financial institutions in the Asian region to analyze risks relating to innovative financial products that will be sold by these markets. In this regard, the wider financial system in Sri Lanka should be adequately robust and resilient to deal with complex risks associated with these new products. In this context too, Sri Lanka’s financial services industry should focus on GRC as a package and deal with these three pillars or imperatives within an integrated framework. 4.5 Introducing an “awareness culture” of GRC is also a serious challenge. It is necessary to ensure that the integrated GRC should be a prime concern of the employees and the Boards, as well as the senior management of financial institutions. Continuous training of relevant stakeholders would be a solution to this challenge. 5. Key elements of a roadmap 5.1 Firm commitment to implement GRC as a package 5.1.1 The key to meet these challenges is the commitment by all stakeholders, i.e. the Boards of Directors, senior management and employees of the financial institution. The commitment has to be clearly demonstrated at all levels and not by isolated groups within the institution. Usually, commitment should commence at the top and filter down to all levels, which requires a well-coordinated effort. In designing a roadmap, one can begin by reviewing the situation and assessing associated risks. It would also be necessary to survey the existing GRC framework and identify gaps focusing on different procedures and processes that exist in organizations. All stakeholders should be convinced that the key GRC elements point towards the same goal and that there is little use in implementing these critical components in isolation. An integrated GRC package should then be designed ensuring that it relates to the business model of the financial institution and also taking into consideration the fiduciary responsibilities of financial institutions. Once each financial institution has designed its GRC framework, it would be easy to roll it out to the entire financial industry through various formal and informal institutions, which coordinates among different segments of the financial services industry. In our context, the Sri Lanka Bankers’ Association, the Finance Houses Association, the Leasing Association etc., should be able to coordinate within and among their segments of the financial services industry in implementing GRC in an integrated manner. 5.1.2 If one financial institution experiences problems today, given the interrelated transactions, it could lead to a systemic issue which will result in the entire system suffering. Therefore, it is equally important to use peer pressure to get weak or prodigal institutions to comply with regulatory instructions and directives. So, it is everybody’s responsibility to ensure that outliers are brought on to the desired path. 5.1.3 Clearly, training and consulting remain very important, especially to change the mindset to a more committed one. All stakeholders need to understand why GRC should be implemented as a package and the benefits attached to it, from the point of view of the institution as well as its clients. 5.2 Leveraging on technology 5.2.1 Technology is a critical factor, which facilitates efficiency and effectiveness in the GRC processes. A real time risk, compliance and monitoring environment enables financial institutions to ensure that risks are being managed and disruptive events are being acted upon. Therefore, technology integration across the financial institution would enable institutions to gain more timely and reliable regulatory compliance, more efficient use of IT systems, and lower cost on development and maintenance of software applications. Many organizations that apply GRC best practices have understood that service-oriented architecture (SOA) is more appropriate, as it would promote GRC integration while securing the highest value that IT can offer. SOA is an architecture that provides IT infrastructure which allows different applications to exchange databases and participate in business processes that are loosely coupled from the operating systems and programming languages underlying those applications. 5.2.2 SOA is a design for linking business and computational resources that are available on demand to achieve the desired results to service consumers. Under SOA models, different applications/services can communicate with each other by passing data from one application/service to another, or by coordinating an activity between two or more applications/services. Further, the financial institutions with IT infrastructure based on stand alone systems acquired over time to meet different business goals can benefit from an integrated service-oriented architecture. Web services can be considered to implement a service-oriented architecture where certain functions/services can be accessible over standard Internet protocols that are independent from other IT systems in the institution. The Central Bank of Sri Lanka is now using a web-based application to gather regulatory compliance reports from financial institutions. Although it is still at a preliminary stage, it is certainly a step towards improving the quality of the GRC in banks. 6. Conclusion 6.1 Now is the time to change. There should be a multifaceted approach to face the GRC challenges. GRC should be treated as one package or a set. This approach includes governance, built on Principles and Rules, Integrated Risk Management Mechanisms to identify, assess and mitigate risks and a defined compliance mechanism that deals with internal and external compliance requirements. The financial institutions have the responsibility to establish a compliance mindset throughout the organization as a foundation that places high regard on ethics, trust and values. Energies that are used by some banks and financial institutions to design ways and means of flouting instructions and defying directives should be diverted to observance of governance and compliance. 6.2 I have highlighted the challenges that financial institutions could encounter in implementing GRC amidst ongoing increasing globalization, continuously changing laws and regulations, various forms of financial stresses and continuous evolution of complex financial products. These challenges underscore the importance of compliance and best practice, which have already been set by the financial services industry regulators and supervisors as well as the international standard setters. 6.3 In the present financial industry environment, where the stakeholders and other interested parties put pressure for greater transparency and corporate responsibility, the Board of Directors and senior management have to set high standards in all aspects of GRC. The increase in investments to improve the IT infrastructure and human resources to integrate GRC management can improve risk management as well as compliance performance and its efficiencies. The financial institutions that have strong governance and compliance processes in an integrated GRC framework will be more capable of winning public confidence, attracting investors, improving corporate reputation and efficiency, as well as contributing to promote financial system stability. 6.4 Northern Rock’s fall has become something of a parable for the times: a story of insecurity, mistrust and powerlessness that often seem to best describe some financial markets in our part of the world as well. It speaks to the fragility of the international financial system, which is directly impacted by globalization, of the capacity of the regulatory institutions and governments to shape events and the powerlessness of all stakeholders to halt an erosion of confidence in once solid institutions. 6.5 It is also important to note that markets and investors are much more vigilant than banks and financial institutions themselves. They may watch global events with bemusement or with justified suspicion and feel that nothing is straightforward anymore. We need to reduce such feelings in the public in our country and instill confidence in them. Given the severe impacts of the recent sub-prime crisis and low quality credit decisions in the US and Europe and large frauds in international banks, it is important that the financial services industry and the regulatory community reflect on what additional precautionary efforts should be initiated to ensure that Sri Lanka’s financial services industry continues to function as a stable and resilient one. I hope that the deliberations of this seminar will lead to the preparation of a roadmap, which would help to promote a competitive, resilient and dynamic financial sector with new initiatives on Governance, Risk Management and Compliance. Thank you.