Policy Statement on Risk Management
- Risk presence is not inherently problematic; concern arises when risks are poorly managed.
- BSP does not restrict risk-taking but ensures FIs identify, understand, and control risks effectively.
- As FIs grow complex, their risk management processes must keep pace.
- BSP may require corrective action if risks are unmanaged, such as reducing exposures or increasing capital.
- The ultimate goal is the safe and sound operation of FIs with capital aligned to risk exposure.
Categories and Definitions of Risks
- Risk is the potential adverse impact on FI's capital or earnings.
- Eight risk categories identified:
- Credit Risk: Counterparty failure to fulfill contract terms, present in all activities involving exposure.
- Market Risk: Losses from changes in market values of traded financial instruments.
- Interest Rate Risk: Losses due to interest rate fluctuations affecting earnings or capital.
- Liquidity Risk: The risk of inability to meet obligations without unacceptable losses.
- Operational Risk: Losses from fraud, errors, or inadequate processes affecting services and competitiveness.
- Compliance Risk: Risk due to violations of laws, regulations, or internal policies leading to fines or legal issues.
- Strategic Risk: Risks from adverse business decisions or poor implementation.
- Reputation Risk: Loss arising from negative public opinion affecting operations and customer relations.
- Risks can be interdependent and exposures often overlap.
Risk Management Requirements for FIs
- No single risk management system fits all; programs must be tailored to each FI.
- Effective risk management programs share key features:
- Identify Risk: Continuous process considering all activities including nonbank affiliates.
- Measure Risk: Use appropriate and periodically tested tools to quantify risk at transaction and portfolio levels.
- Monitor Risk: Frequent, accurate risk reports distributed for timely corrective actions, especially in large FIs.
- Control Risk: Establish and communicate risk limits; allow for authorized exceptions; manage transitions in mergers carefully.
- The board sets strategic direction and risk tolerances and approves relevant policies.
- Management is responsible for implementing strategies, defining risk tolerances, communicating policies, and maintaining management information systems.
Assessment of Risk Management Systems
- BSP evaluates four elements in risk management:
- Policies: Commitment statements guiding operations, setting standards, and requiring periodic review.
- Processes: Procedures and practices aligned with policies, incorporating checks and balances.
- Personnel: Qualified staff and management with appropriate compensation aligned to effective risk management.
- Control Systems: Tools and information systems that provide timely and relevant feedback on risk and performance.
- Deficiencies in any area require compensating controls in others.
Supervision by Risk
- BSP conducts comprehensive risk profiling considering current and prospective risks, including those from nonbank affiliates.
- Risk assessments guide supervisory strategies and resource allocation.
- Supervisory process steps include:
- Identifying risks with standardized definitions.
- Measuring risks through quantitative and qualitative methods.
- Evaluating risk management effectiveness.
- BSP communicates preliminary findings with FI management before finalizing conclusions.
- CAMELS ratings are assigned to lead and affiliated FIs to reflect consolidated risk profiles.
- Risks at individual FIs may be adjusted based on overall consolidated risk exposure.
- BSP verifies inter-affiliate transactions to support consolidated risk analysis.
Effective Date
- The guidelines take effect fifteen calendar days after publication in the Official Gazette or a newspaper of general circulation.
These guidelines from BSP Circular No. 510, S. 2006 establish a comprehensive framework for risk-focused supervision ensuring that financial institutions identify, measure, monitor, and control the broad spectrum of risks posed by their operations and consolidated structures.