Ashraf Mahmood Wathra: Risk management framework in banks Welcome address by Mr Ashraf Mahmood Wathra, Acting Governor of the State Bank of Pakistan, at the SAARCFINANCE Regional Seminar on “Risk Management Framework in Banks”, Islamabad, 17 March 2014. * * * Good morning, Ladies and Gentlemen. I am immensely delighted to welcome you all in Islamabad. It is my pleasure to inaugurate this SAARCFINANCE event on the ever important theme of “Risk Management Framework for Banks”. I believe the program will facilitate sharing of best practices, latest developments in risk management and generate a fruitful discussion on impending challenges in the field of risk management while analyzing its different facets. An efficient and healthy banking system is a prerequisite for sustainable economic growth of a country. In this context, effective risk management practices enable the banking industry to build public trust and confidence in the institutions which is necessary for mobilizing private savings for investment to facilitate economic growth. On the flip side, inadequate risk management practices in the banking industry would result in bank failures leading to erosion of public confidence in the industry having adverse implications for the economic growth. Therefore, an effective risk management framework is a prerequisite for banks to achieve their own business objectives and also play their role in the economic growth of the country. Ideally, banks’ risk management framework should strive to cover the full spectrum of risks by analyzing them from both business and enterprise level perspectives. Each banking institution should tailor its risk management program to its need and circumstances. I would like to elaborate on the main elements of a risk management framework that apply to banking institutions irrespective of their size and complexity of business: First and foremost, effective risk management framework demands active involvement of the Board of Directors (BoD) and senior management in the formulation and oversight of risk management processes. Accordingly, they should provide strategic direction and approve the overall business strategies and significant policies of their institutions, including those related to managing and taking risks, and should also ensure that senior management is fully capable of managing the activities that their institutions undertake. Second, adequate Policies, Procedures, and Limits need to be defined by an institution’s directors and senior management to tailor their risk management policies and procedures to the types of risks that arise from the activities the institution conducts. Third, adequate Risk Monitoring and Management Information Systems need to be developed for effective risk monitoring and to identify and measure all material risk exposures. Consequently, risk monitoring activities must be supported by information systems that provide senior managers and directors with timely reports on the financial condition, operating performance, and risk exposure of the institution. Fourth, establishing and maintaining an effective system of controls, including the enforcement of official lines of authority and the appropriate separation of duties such as trading, custodial, and back-office is one of management’s more important responsibilities. A properly structured system of internal controls promote effective operations and reliable financial and regulatory reporting, safeguards assets, and helps to ensure compliance with relevant laws, regulations, and institutional policies. Given the importance of appropriate internal controls, the results of audits or reviews should be adequately documented, as should management’s responses to them. BIS central bankers’ speeches Fifth, the Risk Management Function should be institutionalized to supervise overall risk management at the bank. Ideally, overall risk management function should be independent from those who take or accept risk on behalf of the institution. Ladies and Gentlemen! One would assume that these principles are fairly simple to understand and practice, however, banks failures of the past & the recent Global Financial Crisis highlight weaknesses/ vulnerabilities in the risk management systems/ practices of the financial industry. Following are some of the key lessons which should not be overlooked, to ensure effective risk management at banks: • Boards need to be more actively engaged and involved in risk policy setting and governance, and spend more focused, higher-quality time on risk issues. • The responsibilities and influence of Chief Risk Officers (CROs) need to be elevated and strengthened with CROs actively participating in business strategy and planning as opposed to having only veto power over decisions that adversely impact risk. The risk function is not in place to manage risk, but to make sure that risks are managed.” • Banks need to align pay to risk-adjusted performance • There is a need to institutionalize an appropriate risk culture throughout the organization, where risk is everyone’s business from the board to the front line. • Banks need to improve the transparency, quality, accuracy and timeliness of information to support risk management. • Institute enterprise wide risk management systems instead of managing the risks in silos. • Use both qualitative and quantitative techniques with varied assumptions instead of blindly following the models. Ladies and Gentlemen! I would now like to give a brief overview of some of the main steps taken by Pakistan to improve the soundness and stability of its banking system. Over the years, our banking sector has witnessed a transformation from an entirely public sector owned industry to the now majority privately owned sector. This shift was one of the main factors which led to improved performance of the overall banking sector. Keeping in view the importance of risk management for banks, SBP has put in place detailed guidelines for banks in the area of Risk Management (2003), Internal Controls (2004), Country Risk (2004), internal credit rating systems (2007), general policies framework which provides broad guidelines for the formulation of polices in the major risk areas, stress testing (2012) and Fraud Risk Management & Reporting (2014). In addition, we have constantly been refining our regulatory and supervisory oversight. For instance, we have issued separate set of prudential regulations for corporate/ commercial banking, Consumer financing, SME financing, Microfinance & Agriculture financing which are updating on an on-going basis. PRs for corporate/ commercial banking cover four areas of risk management, corporate governance, CDD & AML and banks’ operations. Likewise, stress testing guidelines have been revised extensively in line with BCBS reforms package which provide for a bigger role for stress testing in the determination of capital buffers under Pillar 2. Moreover, as per Pillar 2 of Basel capital accord, risk management framework is dealt under the “Internal Capital Adequacy Assessment Process (ICAAP)” of banks, therefore, in order to make the ICAAP exercise more effective we have issued a standardized reporting template for ICAAP in December 2012. BIS central bankers’ speeches Moreover, a major on-going development is the implementation of Basel III in Pakistan from December 2013. Our efforts to keep the banking sector well capitalized and have sufficient capital buffers to absorb minor to moderate shocks can be judged from the fact that our banking sector has healthy capital adequacy ratio of 16%. I am sure you will hear more about the implementation of Basel III in Pakistan during the presentation of country papers. As a regulator, SBP has established a comprehensive and well balanced regulatory and supervisory set up to ensure that sound risk management practices are being followed within the banking sector. Ladies and Gentlemen! In the end, I would like to say that expanding business arenas, globalization of financial activities, emergence of new financial products and increased level of competition have opened up opportunities but also increased the potential risks from such developments. I strongly believe that regional forums such as SAARCFINANCE are very helpful in facilitating knowledge exchange and ongoing collaboration for region specific issues which may pose potential risks for each of our banking sectors. I hope you will enjoy your stay at Islamabad and continue deliberations in the forthcoming sessions of the seminar. Thanks. BIS central bankers’ speeches