ranee jayamaha : governance, risk management and compliance keynote address by dr ranee jayamaha, deputy governor of the central bank of sri lanka, at the seminar on “ governance, risk management and compliance and the roadmap for financial services industry ”, colombo, 7 february 2008. * * * the chairman and the organizing committee ; i would like to begin by expressing my gratitude for being given the opportunity to address a gathering that includes impressive groups of representatives from the financial services industry, risk management professionals, regulators and businesses. as you are aware, the year 2008 has started off with the continuation of some of the challenges that resulted in significant disturbances in world financial markets : the impact of the sub prime market turmoil which originated in the us is still spreading across europe and other financial markets ; the northern rock crisis in the u. k. has raised serious regulatory issues ; and the large frauds in global banks have highlighted the repercussions of the lack of internal controls and accountability in financial institutions. as in the past, many of these have been due to lapses in governance and risk management practices. although sri lanka ’ s financial markets have been insulated from these disturbances, they underscore the need for good corporate governance, better risk management and compliance in our financial industry. it is also important for us to learn from the bitter lessons experienced by others as our financial services industry too is tempted to provide low quality credit, which has been the root cause of the subprime issue. the topic therefore is very relevant and it is time to generate a wider discussion on governance, risk management and compliance – in short – grc, which are considered to be the three key pillars or imperatives of financial management. 1. what is grc? 1. 1 by itself, grc is not new or unknown. grc has always been of fundamental concern to businesses, the financial service industry and to regulators and supervisors. all stakeholders realize that there are enormous benefits of observing grc and that such benefits would outweigh the cost of putting in place processes, procedures and controls that enable effective implementation of grc. 1. 2 governance is all about self - discipline. it is the process by which the board of directors sets the objectives for an organization and oversees progress towards achieving those objectives. put it simply, it is the set of procedures and processes that keeps the organization alive and allows it to operate as a “ going concern ”. the higher the sophistication of

each other by passing data from one application / service to another, or by coordinating an activity between two or more applications / services. further, the financial institutions with it infrastructure based on stand alone systems acquired over time to meet different business goals can benefit from an integrated service - oriented architecture. web services can be considered to implement a service - oriented architecture where certain functions / services can be accessible over standard internet protocols that are independent from other it systems in the institution. the central bank of sri lanka is now using a web - based application to gather regulatory compliance reports from financial institutions. although it is still at a preliminary stage, it is certainly a step towards improving the quality of the grc in banks. 6. conclusion 6. 1 now is the time to change. there should be a multifaceted approach to face the grc challenges. grc should be treated as one package or a set. this approach includes governance, built on principles and rules, integrated risk management mechanisms to identify, assess and mitigate risks and a defined compliance mechanism that deals with internal and external compliance requirements. the financial institutions have the responsibility to establish a compliance mindset throughout the organization as a foundation that places high regard on ethics, trust and values. energies that are used by some banks and financial institutions to design ways and means of flouting instructions and defying directives should be diverted to observance of governance and compliance. 6. 2 i have highlighted the challenges that financial institutions could encounter in implementing grc amidst ongoing increasing globalization, continuously changing laws and regulations, various forms of financial stresses and continuous evolution of complex financial products. these challenges underscore the importance of compliance and best practice, which have already been set by the financial services industry regulators and supervisors as well as the international standard setters. 6. 3 in the present financial industry environment, where the stakeholders and other interested parties put pressure for greater transparency and corporate responsibility, the board of directors and senior management have to set high standards in all aspects of grc. the increase in investments to improve the it infrastructure and human resources to integrate grc management can improve risk management as well as compliance performance and its efficiencies. the financial institutions that have strong governance and compliance processes in an integrated grc framework will be more capable of winning public confidence, attracting investors, improving corporate reputation and efficiency, as well as contributing to promote financial system stability. 6. 4 northern rock ’ s fall has become something of a parable for the times :