these reports confirm that thus far banks risks are diversified and managed in line with the banking regulations. an analysis of trends in different types of risk would offer better appreciation and perspective on changes in banks ’ risk profile : credit risk : in pakistani banks, credit operations remain the main source of banks income and have been supported by strong economic activity. given its size, credit operations are a primary source of risk. supported by growth in businesses and gradual improvement in internal credit reviews, on balance credit risk have been well managed. the net npls to net loan ratio have declined in the last few years and fell to 1. 8 % by september 2006. in recent years, the macroeconomic environment has been supportive of the growth of banking systems but the growing fiscal imbalance and the external imbalances have enhanced domestic demand pressures. while the vulnerabilities of banking system have been well managed, the shocks arising from external sources can be a cause of concern. exposure to perceived risks arise from the ( i ) structural problems facing the real sector whose resolution is critical to maintain the momentum in credit operations, and ( ii ) high domestic asset prices given high interest rates, equity prices and property prices. underlying the credit growth is altering risk exposures which need to be well tracked to ensure their effective risk management. there is a broader concern that the growing domestic demand have impact on bank asset quality and the growing exposure of household sector to consumer financing could have their attendant risks. consumer finance has risen from 2. 4 % in 2002 to 14. 3 % by september 2006 and number of borrowers of consumer finance from 0. 25 million to 2. 6 million, respectively. thus far credit risks on the banking books associated with some assets has been limited. for instance, the housing finance is barely $ 1 billion ( or 2. 3 % of total loan outstanding ) and mortgage business non - existent. market risk : banks market risk exposure largely stems from the interest rate risk as the equity price and exchange rate risks are not substantial given their exposure in balance sheet is limited. interest rate risk emanates from movements in interest rates, which are determined both by the liquidity available and its response to short term rates and the future expectations of economy, the longer term yield curve. interest rates in pakistan have remained volatile in line with demand pressures during the past few years. after the 9 / 11, initially growth in liquidity resulted in fall in interest rates and by august 2003 the interest rates reached lowest levels and the differential between

as approved by the board. senior management must ensure that all its business activities are adequately staffed having necessary experience and technical skills. the remuneration policies should also be consistent with the approved risk appetite. managers should not be rewarded solely on the basis of profits, but audit findings and compliance status should also be considered while deciding bonuses and compensations. sound operational risk governance practices rely mainly on the following lines of defense : i. business line management is the first line of defense against operational risk. business line management is responsible for identifying and managing risks in the products, activities, processes and systems for which they are accountable. it is important that clearly documented and regularly updated operating manuals are readily available to all employees. segregation of duties needs to be ensured. it is also necessary that operational staff must have necessary skills and training so that they can fulfill their duties. ii. a separate independent operational risk management function is the second line of defense and has become a good practice. independent operational risk management function would assist management to understand and manage operational risk. the function should be responsible to assist in establishing policies & standards and coordinate with various businesses / risk management activities. the function assesses, monitors, and reports operational risks as a whole, and ensures that the management of operational risk in the bank is as per approved strategy / policies. iii. independent validation and verification is the third line of defense in the governance structure. it serves as a challenge function to the other two lines of defense. internal audit or any independent group of qualified staff may conduct these independent reviews. since internal audit reports to the board audit committee therefore the audit function should also provide assurance to the board regarding effectiveness of the operational risk management framework. senior management should seriously investigate the findings of audit to set up a risk culture in the bank. the next principles focus on risk management environment, it outlines the bank ’ s approach to the identification, assessment, monitoring, control and mitigation of risk. banks need to use various tools for proactive operational risk management. these tools include audit findings, analysis of internal and external loss data, risk control and self assessments, key risk indicators, scenario analysis, comparative analysis etc. i am pleased to know that lively discussions on these tools will follow in the coming sessions. sbp is cognizant of its responsibilities with regard to sound operational risk management frameworks in banks. sbp will continue to play its role in ensuring effectiveness of established frameworks in banks. we expect each bank to develop and continuously