Sunil Mendis: Risk management in Sri Lankan banks in the changing environment Inaugural address by Mr Sunil Mendis, Governor of the Central Bank of Sri Lanka, at the CRISILSLBA seminar on risk management in Sri Lankan banks in the changing environment, Colombo, 15-16 November 2004. * * * Good morning ladies and gentlemen, Let me first thank the SLBA (Sri Lanka Banks Association) and the representatives from CRISIL India (Credit Rating Information Services of India Ltd) for the initiative taken to organize this Seminar on a very important aspect of banking business - risk management. As we all know, risk management in banking is a continuous process of planning, organizing and controlling a bank’s assets and liabilities, their volumes, maturities, rates and yields. This is the most simple definition that I can think of. However, its implications on banking business are what we concern ourselves with, especially from the regulatory point of view. In the context of Sri Lankan banks at least, of the major risks confronting financial institutions, credit risk remains the predominant or core risk. Risktaking is part and parcel of banking. The highly leveraged nature of banking business itself illustrates the risk exposure level of banks. Therefore, what is important is how we manage these risks, how we measure and price risk and above all what measures we take to mitigate these risks. The primary responsibility of understanding the risks run by the bank and ensuring that such risks are appropriately controlled and are within the risk parameters of the Bank, i.e. its risk appetite, is vested with the Board of Directors. It is now a widely accepted principle of good corporate governance that bank management understands new banking products and businesses of the Bank. Without proper understanding of the risks associated with such new products the management should not give their assent to the introduction of such products. It is the responsibility, therefore, of the Board of Directors to set the parameters for risk taking beyond which banking business should not be permitted. What then are the essential pre-requisites for good and effective risk management? Timely and reliable information is the foundation upon which good risk management is built. Lots of questions come to my mind here - do those responsible for credit decisions have a knowledge of the industry they are lending to? Why do banks depend so much on collateral when we all know it is the last resort? This is where information plays an important part. If you do not have knowledge of the industry or sector to which you are lending, your credit decision is seriously flawed and sooner or later will translate itself into NPA. Why do we have high levels of NPA? Is the information necessary for evaluation of creditworthiness of a borrower available to the banks? Is the credit decision taken on the basis of such evaluation - how current is the financial information on the borrower with the bank? The market is a dynamic place, where change takes place all the time. It is imperative that credit officers of banks be given maximum exposure to the real sector - the numbers in financial statements must have a direct relationship to the real sector to reflect the current status of the borrower’s business? They should support the repayment programme undertaken by the borrower on which the Bank’s credit decision was predicated. You will see thus that information is critical to risk management without which you are groping in the dark and before long you will be faced with large losses. The emphasis should therefore be on the early identification of risk, which if addressed at the very initial stages, would not expose the bank to large scale losses at a later stage. Effective credit risk management is the key to the health of the banking industry today. It is not the resolution of NPA but the cause of NPA that should be addressed. Internal rating systems must be developed to afford an accurate and continuous picture of the level of risk exposure of the bank to individual credit risk so that timely action can be taken to soften the risk. Management Information Systems must be strengthened. Preventive and remedial actions should encompass additional capital, better internal controls and/or safer provisioning policies. Capital is not a substitute for sound risk management. An operating environment based on prudent risk management rather than aggressive risk taking, gives us regulators comfort that profits are conservatively stated. This is the essence of prudence which underpins safe and sound banking. In an increasing trend to harmonise prudential frameworks across the globe, in recognition of the fact that banks, wherever they may be domiciled, are exposed to the same risks, it is becoming increasingly difficult to pursue country-specific solutions. We recognize that we too have to be internationally compatible in adopting common standards for regulation and supervision which are spearheaded by the Basel Committee. Global financial reporting practices are not far away and there are efforts underway to establish a common set of internationally accepted financial reporting standards. Differences of opinion between standard setters and regulators need to be reconciled IAS 39 is one such which is being hotly debated. The efforts taken by CRISIL India, together with the SLBA, in this regard are commendable and I would like to see this initiative gather momentum to provide the platform for the improvement of risk management techniques by the banks in Sri Lanka which would, in turn, make them ready, if not in 2007, even later, to meet the challenges of Basel II. The transition to Basel II calls for a fundamental shift from the basic rudiments of risk management to sophisticated risk management techniques. The period of transition and the cost of transition has to be closely examined by the banking industry. Considerable investment in information technology will have to be made to complete this transition. The strong platform of good risk management, therefore has first to be in place. Therefore, the incentive that I can see from Basel II now is to commence the process to improve risk management especially operational risk by banks in Sri Lanka. As you may know Basle II requires specific capital to be allocated to operational risk, which is one of the main differences between Basle I and Basle II. Some internationally reputed banks have already allocated about 20% of capital for operational risk. To effectively mitigate risks, banks need to have risk managers or risk management specialists. If you don’t have such specialists, you need to look for them or enhance the capacity of the existing staff to meet this need. Sound risk management practices lead to cushions that are built in good times so as to be run down , up to a point, in bad times. Provisions for loan losses dictated by prudence when profits are good, can always be written back when profits are low. It is that degree of caution in the exercise of judgements, in making estimates when there is an element of uncertainity, that makes prudence the most critical factor in risk management in banks. This is my message to you today and I wish this Seminar every success.