Risk-based Supervision Framework

A significant activity is a line of business, unit or process that is fundamental to the institution’s business model and its ability to meet its overall business objectives (i.e., if the activity is not well managed there is a significant risk to the organization as a whole in terms of meeting its goals).

Significant activities may be identified by quantitative or qualitative criteria as follows:

• quantitative criteria include metrics such as the activity’s percentage of total assets, revenue, premiums written, net income, allocated capital, or its potential for material losses; and
• qualitative criteria include criteria such as the activity’s strategic importance, planned growth, risk, effect on brand value or reputation, or the criticality of an enterprise-wide process.

It is important to note that significant activities are specific to the financial institution and what is considered significant in one institution, may be insignificant in another and vice versa. In general, activities identified as significant by a supervisor would be in line with those considered significant by the financial institution’s management.

Once the significant activities are determined, supervision must determine the inherent risk in each of the significant activities.  “Inherent risk” is risk that is intrinsic to an institution or activity and occurs naturally due to a factor other than a failure of internal controls.  Inherent risk typically reflects the nature, complexity, or volatility of the activity or process and can vary by industry, institution, size and operational scope.  Inherent risk arises from exposure to, and uncertainty from, possible future events, or changes in business or economic conditions. Inherent risk is identified and assessed before considering the quality of the institution’s governance, internal controls and risk management.

Examples of key inherent risks in banking and insurance institutions include credit, market, liquidity, operational, legal, compliance and strategic risks. Insurance and reinsurance risks are also key inherent risks for insurance companies.  With the emergence of financial technology and rapid digitalisation of financial services, technology and cyber risks have come to the fore as key risks.  Other key risks that may arise are concentration, strategic, and reputational.  Where a financial institution is part of a financial group, subsidiary risk may also be important.  This is not an exhaustive list and risks may ascend or descend in priority based on prevailing circumstances. The categories and levels of inherent risk are described in more detail in Appendix A.

From time to time new risks may emerge which can have implications for one or more of the inherent risks mentioned above, e.g., artificial intelligence. These new risks should be considered in the assessment of the inherent risks.

Based on the key inherent risks identified for an institution or significant activity and their levels, supervisors develop expectations for the quality of risk management. The higher the level of inherent risk, the more rigorous the day-to-day controls and oversight expected.

Inherent risks should be assessed and rated as:

• Low (L) – where there is a lower than average probability of a material loss due to exposure and uncertainty arising from current and potential future events.
• Moderate (M) – where there is an average/ moderate probability of a material loss due to exposure and uncertainty arising from current and potential future events. Although the activity potentially could result in a loss, the entity could absorb the loss without significant impact to its soundness.
• Above Average (AA) – where there is greater than average probability of a material loss due to exposure and uncertainty arising from current and potential future events. The activity potentially could result in a loss to the entity, which may influence its soundness.
• High (H) – where there is a high probability of a material loss due to exposure and uncertainty arising from current and potential future events. The activity potentially could result in a significant and damaging loss to the entity.

The Four Lines of Defence model is a framework for managing and controlling risks in financial institutions and the Central Bank’s supervisory approach is aligned to this framework.  The Four Lines of Defence model is an enhancement of the traditional Three Lines of Defence model.  See here for details.

The Four Lines of Defence are:

1. First Line of Defence: Functions that own and manage risk: Operational Management

• This include day-to-day risk management and control activities conducted by the business units.  They are responsible for identifying and managing risks directly within their areas of responsibility.  When assessing operational management, Central Bank’s primary concern is whether operational management is capable of identifying the potential for material loss and has adequate controls in place.

2. Second Line of Defence: Functions that oversee risk: Risk Management and Compliance

• These functions provide oversight and support to the first line and comprises various risk management and compliance functions (i.e. support functions) such as financial, compliance, risk control, model validation and back office, whose key duties are to monitor and report risk-related practices and information, and to oversee all types of compliance and financial controlling issues.
• The second line of defence defines preventive and detective control requirements, and ensures that such requirements are embedded in the policies and procedures of the first line. The second line must be independent of the first line and apply controls either on an ongoing (e.g., daily) or periodical basis. There are three key oversight functions, which may exist in an institution: Financial, Compliance, and Risk Management (see Appendix B).

The structure and nature of these functions are expected to vary based on the business, size, complexity and risks of an institution. Where an institution lacks some of the oversight functions, or they are not sufficiently independent, the Central Bank expects other functions, within or external to the institution, to provide the independent oversight needed.

3. Third Line of Defence: Internal Audit

• Internal audit provides independent assurance to senior management and the board on a broad range of objectives, including efficiency and effectiveness of operations, safeguarding of assets, reliability and integrity of reporting processes and compliance with laws and regulations.
• For the function to be effective, it needs to have the highest level of independence and objectivity.  Consequently, the Chief Internal Auditor should have unfettered access to senior management and the board of the financial institution. Measures taken to ensure this high level of independence include the ability of the internal audit function to meet with the board in the absence of senior management. The board is primarily responsible for an independent audit function and has to be cognisant of potential impairments to objectivity.

4. Fourth Line of Defence: External Audit and Supervisory Oversight

• The fourth line of defence includes independent bodies, such as, external auditors and regulatory bodies[1]. They provide an additional layer of assurance by independently verifying the effectiveness of the first three lines of defence and ensuring compliance with external regulations.

The Central Bank will focus on the three (3) Lines of Defence shown above as well as the adequacy of Board and Senior Management oversight to determine the quality of risk management for each significant activity. For each significant activity, the following risk areas – namely, Operational Management, Finance, Risk Management, Compliance, Internal Audit, Senior Management and Board – will be assessed and assigned a rating of either Strong, Acceptable, Needs Improvement, or Weak.  (see Appendix B for explanations of the ratings for the Quality of Risk Management).

The Central Bank has Assessment Criteria that guide the determination of the rating for each oversight function. The assessment includes a determination of the direction of the quality of oversight (improving, stable, or deteriorating).

The Board and Senior Management sit above the Three Lines of Defence.  Collectively, they have responsibility for setting organisational objectives, defining strategies to achieve them and establishing the necessary governance, risk management and control frameworks to manage the risks to the achievement of their objectives.

In particular, the Board has ultimate accountability for the institution’s risk management and control framework and must approve risk management policies and strategies proposed by Senior Management.  The Board relies on internal audit (Third Line of Defence) to provide independent assurance on the effectiveness of risk management and controls.  The Board must also ensure compliance with regulations and standards and depends on the Second Line of Defence in this regard.

Senior management is responsible for defining the institution’s objectives and strategies to achieve same; establishing governance frameworks and processes to manage risks effectively; overseeing the first and second lines of defence and ensuring that operational management and risk management frameworks are performing effectively; and allocating resources to ensure that risk management and control functions are adequately supported.

Together, the board and senior management ensure that the institution has a robust risk management framework, aligning with its strategic goals and regulatory requirements.

Net risk or residual risk is the risk that remains after application of the controls. For each significant activity, the level of net risk is determined based on judgment that considers all of the key inherent risk ratings and relevant risk management and control ratings for the activity. Net risk may be rated as Low, Moderate, Above Average, or High.

The chart below shows typical net risk (or residual risk) ratings for combinations of inherent risk and quality of governance and risk management (QGRM) ratings. The net risk assessment includes a determination of the direction of net risk (decreasing, stable, or increasing).  Determination of the direction of risk should take into account macro-economic information, the institution’s business strategy, results of stress tests and any other reliable open source information.

The Central Bank expects an institution to maintain controls and oversight that are commensurate with the key inherent risks, so that levels of net risk are considered prudent by the Central Bank.

Chart 2 below shows typical net risk ratings for combinations of inherent risk and Quality of Governance and Risk Management ratings.

The importance of the net risk of each significant activity is a judgment of its contribution to the overall risk profile of the institution. Importance is rated as low, medium, or high. The significant activities assigned higher importance ratings are the key drivers of the overall net risk rating.

After determination of the net risk of each significant activity, it is important to derive the overall net risk on an institutional basis. To do this, each significant activity is rated by importance.

The net risks of the significant activities are combined by considering their relative importance, to arrive at the Overall Net Risk of the institution. The Overall Net Risk is a combined risk assessment determined by taking into consideration the importance and net risk assessment of each significant activity to arrive at a risk assessment for the institution as a whole.  Overall Net Risk is rated as Low, Moderate, Above Average, or High, and the direction is assessed as decreasing, stable, or increasing.

Capital

Adequate capital is critical for the overall safety and soundness of institutions. Capital is assessed based on the appropriateness of its level and quality, both at present and prospectively, and under both normal and stressed conditions, given the institution’s Overall Net Risk.

The effectiveness of the institution’s capital management processes for maintaining adequate capital relative to the risks across all of its significant activities is also considered in the assessment. Institutions with higher Overall Net Risk are expected to maintain a higher level and quality of capital and stronger capital management processes.

Earnings

Earnings are an important contributor to an institution’s long-term viability. Earnings are assessed based on their quality, quantity and consistency as a source of internally generated capital. The assessment takes into consideration both historical trends and outlook, under both normal and stressed conditions. Earnings are assessed in relation to the institution’s Overall Net Risk.

Liquidity

Ensuring adequate liquidity is another critical contributor to the overall safety and soundness of institutions. Liquidity risk is the risk that a financial institution will not be able to meet its obligations as they fall due because of an insufficiency of cash and an inability to convert assets into cash without incurring significant losses.

The level of liquidity risk depends on the institution’s balance sheet composition, its funding sources, its liquidity strategy, and market conditions and events. Institutions are required to maintain, both at present and prospectively, an adequate level of liquidity under both normal and stressed conditions.

Capital, Earnings, and Liquidity may be rated as Strong, Acceptable, Needs Improvement, or Weak and the direction assessed as Improving, Stable, or Deteriorating.

The Risk Matrix:

The Central Bank’s supervisory Risk Matrix is the key tool which ROs must use to record the risk assessment of the institution and illustrate the overall Composite Risk Rating (CRR) and the commensurate Intervention Rating (IR). While the Risk Matrix is a convenient way to summarize Central Bank’s conclusions of risk assessment, it must be supported by detailed documentation of the analysis and rationale for the conclusions. The Risk Matrix Template can be viewed by clicking on this link.

Note: The ratings shown in the Risk Matrix table is for illustration purposes only and intended as a guide for completion of the risk matrix.

The Composite Risk Rating (CRR):

The CRR is an assessment of the institution’s risk profile, after considering the assessments of its earnings and capital in relation to the derived Overall Net Risk from its significant activities, and the assessment of its liquidity. The CRR gives an indication of the regulator’s assessment of the safety and soundness of the institution with respect to its depositors and policyholders.

The CRR is rated as Low, Moderate, Above Average or High. The assessment is supplemented by the Direction of Composite Risk, which is the Central Bank’s assessment of the most likely direction in which the CRR may move.  The Direction of Composite Risk is rated as decreasing, stable, or increasing and takes into consideration the direction in which capital, earnings and liquidity are expected to move.

Intervention Rating (IR):

The IR is used to determine the level of supervisory intervention required for a financial institution.  It is based on the CRR and other factors such as the institution’s size, complexity, and systemic importance.  The IR helps the Central Bank decide on the appropriate regulatory action, which can range from increased monitoring to more severe measures such as requiring the financial institution to take supervisory action to resolving the institution.  Table 1 shows the relationship between the CRR and IR.

Chart 3 below illustrates a process flow diagram for the RBSF from identification of significant activities to determining the intervention rating.