B. Actively observed policies and procedures

Used correctly, procedures are powerful tool of risk management. The purpose of policies and procedures is to empower people. They specify how people can accomplish what needs to be done. The success of policies and procedures depends critically upon a positive risk culture.

C. Effective use of technology

The primary role technology plays in risk management is risk assessment and communication. Technology is employed to quantify or otherwise summarize risks as they are being taken. It then communicates this information to decision makers, as appropriate.

D. Independence or risk management professionals

To get the desired outcome from risk management, risk managers must be independent of risk taking functions within the organization. Enron’s experience with risk management is instructive. The firm maintained a risk management function staffed with capable employees. Lines of reporting were reasonably independent in theory, but less so in practice.

Internal Controls

Para one on first page of the ‘Guidelines on Internal Controls’ issued by SBP provides:

“Internal Control refers to policies, plans and processes as affected by the Board of Directors and performed on continuous basis by the senior management and all levels of employees within the bank. These internal controls are used to provide reasonable assurance regarding the achievement of organizational objectives. The system of internal controls includes financial, operational and compliance controls.”

The current official definition of internal control was developed by the Committee of Sponsoring Organization (COSO) of the Treadway Commission. In its influential report, Internal Contro

By facilitating transactions and making credit and other financial products available, the financial sector is a crucial building block for private as well as public sector development. In its broadest definition, it includes everything from banks, stock exchanges, and insurers, to credit unions, microfinance institutions and moneylenders. As an efficient service provider, the financial sector simultaneously fulfils an important function in the overall economy. Various types of Financial Institutions actively working in Financial Sectors include Banks, DFIs, Micro Finance Banks, Leasing Companies, Modarabas, Assets Management Company, Mutual Funds, etc.

Thus today’s operating environment demands systematic and more integrated risk management approach.

Risk:

Risk by default has tow components; uncertainty and exposure. If both are not present, there is no risk. Definition of Risk as per Guidelines on Risk Management issued by State Bank of Pakistan is, “Financial risk in a banking organization is possibility that the outcome of an action or event could bring up adverse impacts. Such outcomes could either result in a direct loss of earnings / capital or may result in imposition of constraints on bank’s ability to meet its business objectives. Such constraints pose a risk as these could hinder a bank's ability to conduct its ongoing business or to take benefit of opportunities to enhance its business.”

Types of Risks:

Risks are usually defined by the adverse impact on profitability of several distinct sources of uncertainty. More or less all financial institutions have to manage the following faces of risks:

1. Credit Risk
2. Market Risk
3. Liquidity Risk
4. Operational Risk
5. Country Risk
6. Legal Risks
7. Compliance Risk
8. Reputational Risk

Broadly speaking there are four risks as per Risk Management Guidelines which surround Financial Sector i.e. Credit Risk, Market Risk, Liquidity Risk and Operational Risk. These risk are elaborated here under:

i. Credit Risk

This is the risk incurred in case of a counter-party default. It arises from lending activities, investing activities and from buying and selling financial assets on behalf of others. This risk is associated with financing transactions i.e.:

a. Default in repayment by the borrower and
b. Default in obliging the commitment by another Financial Institution in case of syndicated arrangements.

It is the most critical risk in banking and one that must be managed carefully. It is also the risk that requires the most subjective judgment despite constant efforts to improve and quantify the credit decision process.

ii. Market Risk

Market risk is defined as the volatility of income or market value due to fluctuations in underlying market factors such as currency, interest rates, or credit spreads. For commercial banks, the market risk of the stable liquidity investment portfolio arises from mismatches between the risk profile of the assets and their funding. This risk involves interest rate risk in all of its components: equity risk, exchange risk and commodity risk.

iii. Liquidity Risk

The liquidity risk is defined as the risk of not being able to meet its commitments or not being able to unwind or offset a position by an organization in a timely fashion because it cannot liquidate assets at reasonable prices when required.

iv. Operational Risk

This risk results from inadequacies in the conception, organization, or implementation of procedures for recording any events concerning bank’s operations in the accounting system/information systems.

Need for Risk Management and Monitoring:

There are a number of reasons as to why there is so much emphasis given to Risk Management in Financial Sector now a day. Some of them are listed below: -

1. Present structure of joint stock companies, wherein owners are not the mangers, hence risks increase; therefore proper tools are required to achieve the desired results by covering the risks.
2. The financial sector has come out of simple deposit and lending function.
3. The world has become very complex so the financial transactions and instruments.
4. Increase in the number of cross border transactions which caries its own risks.
5. Emerging markets
6. Terrorism Remittances

Risk monitoring in financial sector is very crucial and an inevitable part of risk management. Risk Monitoring is important in the financial sector due to the following reasons:

1. Deals in others’ money
2. Direct stake of deposit holder.
3. Much riskier sector than trading and manufacturing.
4. Previous / Recent problems faced by banks i.e. stuck portfolio that is credit risk.
5. Bankruptcy of Barings Bank due to short selling / long position that is market risk.
6. Operational risk does not has immediate impact, but important for continuity and progress of organization.
7. Appetite of a financial institution to take risk is related with the capital base of the institute so it caries a huge risk of over exposure.

Components of Risk Management Frame Work

Risk Management Frame Work has five components. First of all risk is Identified, then it is Assessed to classify, seek solution and management, after assessing quick Response and implementation of solution and the last phase is Monitoring of the risk management progress and Learning from this experience that such problem never occur again. Whole process is to be well Communicated during the entire process of risk management if it is to be managed efficiently.

The International Organization for Standardization (ISO) has defined risk management as the identification, analysis, evaluation, treatment (control), monitoring, review and communication of risk. These activities can be applied in a systematic or ad hoc manner. The presumption is that systematic application of these activities will result in improved decision-making and, most likely, improved outcomes.

Structure of Risk Management

Depending upon the structure and operations of organization, financial risk management can be implemented in different ways. Risk management structure defines the different layers of an organization at which risk is identified and managed. Although there are different layers or level at which risk is managed but there are three layers which are common to all. i.e.

Risk Management

For managing risk there are certain basic principles which are to be followed by every organization:

1. Corporate level Policies
2. Risk management strategy
3. Well-defined policies and procedures by senior management
4. Dissemination, implementation and compliance of policies and procedures
5. Accountability of individuals heading various functions/ business lines
6. Independent Risk review function
7. Contingency plans
8. Tools to monitor risks

Institutions can reduce some risks simply by researching them. A bank can reduce its credit risk by getting to know its borrowers. A brokerage firm can reduce market risk by being knowledgeable about the markets it operates in.

Functionally, there are four aspects of financial risk management. Success depends upon

A. A positive corporate culture,

No one can manage risk if they are not prepared to take risk. While individual initiative is critical, it is the corporate culture which facilitates the process. A positive risk culture is one which promotes individual responsibility and is supportive of risk taking.

B. Actively observed policies and procedures

Used correctly, procedures are powerful tool of risk management. The purpose of policies and procedures is to empower people. They specify how people can accomplish what needs to be done. The success of policies and procedures depends critically upon a positive risk culture.

C. Effective use of technology

The primary role technology plays in risk management is risk assessment and communication. Technology is employed to quantify or otherwise summarize risks as they are being taken. It then communicates this information to decision makers, as appropriate.

D. Independence or risk management professionals

To get the desired outcome from risk management, risk managers must be independent of risk taking functions within the organization. Enron’s experience with risk management is instructive. The firm maintained a risk management function staffed with capable employees. Lines of reporting were reasonably independent in theory, but less so in practice.

Internal Controls

Para one on first page of the ‘Guidelines on Internal Controls’ issued by SBP provides:

“Internal Control refers to policies, plans and processes as affected by the Board of Directors and performed on continuous basis by the senior management and all levels of employees within the bank. These internal controls are used to provide reasonable assurance regarding the achievement of organizational objectives. The system of internal controls includes financial, operational and compliance controls.”

The current official definition of internal control was developed by the Committee of Sponsoring Organization (COSO) of the Treadway Commission. In its influential report, Internal Control

Types of Risks:

Risks are usually defined by the adverse impact on profitability of several distinct sources of uncertainty. More or less all financial institutions have to manage the following faces of risks:

1. Credit Risk
2. Market Risk
3. Liquidity Risk
4. Operational Risk
5. Country Risk
6. Legal Risks
7. Compliance Risk
8. Reputational Risk

Broadly speaking there are four risks as per Risk Management Guidelines which surround Financial Sector i.e. Credit Risk, Market Risk, Liquidity Risk and Operational Risk. These risk are elaborated here under:

i. Credit Risk

This is the risk incurred in case of a counter-party default. It arises from lending activities, investing activities and from buying and selling financial assets on behalf of others. This risk is associated with financing transactions i.e.:

a. Default in repayment by the borrower and
b. Default in obliging the commitment by another Financial Institution in case of syndicated arrangements.

It is the most critical risk in banking and one that must be managed carefully. It is also the risk that requires the most subjective judgment despite constant efforts to improve and quantify the credit decision process.

ii. Market Risk

Market risk is defined as the volatility of income or market value due to fluctuations in underlying market factors such as currency, interest rates, or credit spreads. For commercial banks, the market risk of the stable liquidity investment portfolio arises from mismatches between the risk profile of the assets and their funding. This risk involves interest rate risk in all of its components: equity risk, exchange risk and commodity risk.

iii. Liquidity Risk

The liquidity risk is defined as the risk of not being able to meet its commitments or not being able to unwind or offset a position by an organization in a timely fashion because it cannot liquidate assets at reasonable prices when required.

iv. Operational Risk

This risk results from inadequacies in the conception, organization, or implementation of procedures for recording any events concerning bank’s operations in the accounting system/information systems.

Need for Risk Management and Monitoring:

There are a number of reasons as to why there is so much emphasis given to Risk Management in Financial Sector now a day. Some of them are listed below: -

1. Present structure of joint stock companies, wherein owners are not the mangers, hence risks increase; therefore proper tools are required to achieve the desired results by covering the risks.
2. The financial sector has come out of simple deposit and lending function.
3. The world has become very complex so the financial transactions and instruments.
4. Increase in the number of cross border transactions which caries its own risks.
5. Emerging markets
6. Terrorism Remittances

Risk monitoring in financial sector is very crucial and an inevitable part of risk management. Risk Monitoring is important in the financial sector due to the following reasons:

1. Deals in others’ money
2. Direct stake of deposit holder.
3. Much riskier sector than trading and manufacturing.
4. Previous / Recent problems faced by banks i.e. stuck portfolio that is credit risk.
5. Bankruptcy of Barings Bank due to short selling / long position that is market risk.
6. Operational risk does not has immediate impact, but important for continuity and progress of organization.
7. Appetite of a financial institution to take risk is related with the capital base of the institute so it caries a huge risk of over exposure.

Components of Risk Management Frame Work

Risk Management Frame Work has five components. First of all risk is Identified, then it is Assessed to classify, seek solution and management, after assessing quick Response and implementation of solution and the last phase is Monitoring of the risk management progress and Learning from this experience that such problem never occur again. Whole process is to be well Communicated during the entire process of risk management if it is to be managed efficiently.

The International Organization for Standardization (ISO) has defined risk management as the identification, analysis, evaluation, treatment (control), monitoring, review and communication of risk. These activities can be applied in a systematic or ad hoc manner. The presumption is that systematic application of these activities will result in improved decision-making and, most likely, improved outcomes.

Structure of Risk Management

Depending upon the structure and operations of organization, financial risk management can be implemented in different ways. Risk management structure defines the different layers of an organization at which risk is identified and managed. Although there are different layers or level at which risk is managed but there are three layers which are common to all. i.e.

Risk Management

For managing risk there are certain basic principles which are to be followed by every organization:

1. Corporate level Policies
2. Risk management strategy
3. Well-defined policies and procedures by senior management
4. Dissemination, implementation and compliance of policies and procedures
5. Accountability of individuals heading various functions/ business lines
6. Independent Risk review function
7. Contingency plans
8. Tools to monitor risks

Institutions can reduce some risks simply by researching them. A bank can reduce its credit risk by getting to know its borrowers. A brokerage firm can reduce market risk by being knowledgeable about the markets it operates in.

Functionally, there are four aspects of financial risk management. Success depends upon

A. A positive corporate culture,

No one can manage risk if they are not prepared to take risk. While individual initiative is critical, it is the corporate culture which facilitates the process. A positive risk culture is one which promotes individual responsibility and is supportive of risk taking.

B. Actively observed policies and procedures

Used correctly, procedures are powerful tool of risk management. The purpose of policies and procedures is to empower people. They specify how people can accomplish what needs to be done. The success of policies and procedures depends critically upon a positive risk culture.

C. Effective use of technology

The primary role technology plays in risk management is risk assessment and communication. Technology is employed to quantify or otherwise summarize risks as they are being taken. It then communicates this information to decision makers, as appropriate.

D. Independence or risk management professionals

To get the desired outcome from risk management, risk managers must be independent of risk taking functions within the organization. Enron’s experience with risk management is instructive. The firm maintained a risk management function staffed with capable employees. Lines of reporting were reasonably independent in theory, but less so in practice.

Internal Controls

Para one on first page of the ‘Guidelines on Internal Controls’ issued by SBP provides:

“Internal Control refers to policies, plans and processes as affected by the Board of Directors and performed on continuous basis by the senior management and all levels of employees within the bank. These internal controls are used to provide reasonable assurance regarding the achievement of organizational objectives. The system of internal controls includes financial, operational and compliance controls.”

The current official definition of internal control was developed by the Committee of Sponsoring Organization (COSO) of the Treadway Commission. In its influential report, Internal Contro

iv. Operational Risk

This risk results from inadequacies in the conception, organization, or implementation of procedures for recording any events concerning bank’s operations in the accounting system/information systems.

Need for Risk Management and Monitoring:

There are a number of reasons as to why there is so much emphasis given to Risk Management in Financial Sector now a day. Some of them are listed below: -

1. Present structure of joint stock companies, wherein owners are not the mangers, hence risks increase; therefore proper tools are required to achieve the desired results by covering the risks.
2. The financial sector has come out of simple deposit and lending function.
3. The world has become very complex so the financial transactions and instruments.
4. Increase in the number of cross border transactions which caries its own risks.
5. Emerging markets
6. Terrorism Remittances

Risk monitoring in financial sector is very crucial and an inevitable part of risk management. Risk Monitoring is important in the financial sector due to the following reasons:

1. Deals in others’ money
2. Direct stake of deposit holder.
3. Much riskier sector than trading and manufacturing.
4. Previous / Recent problems faced by banks i.e. stuck portfolio that is credit risk.
5. Bankruptcy of Barings Bank due to short selling / long position that is market risk.
6. Operational risk does not has immediate impact, but important for continuity and progress of organization.
7. Appetite of a financial institution to take risk is related with the capital base of the institute so it caries a huge risk of over exposure.

Components of Risk Management Frame Work

Risk Management Frame Work has five components. First of all risk is Identified, then it is Assessed to classify, seek solution and management, after assessing quick Response and implementation of solution and the last phase is Monitoring of the risk management progress and Learning from this experience that such problem never occur again. Whole process is to be well Communicated during the entire process of risk management if it is to be managed efficiently.

The International Organization for Standardization (ISO) has defined risk management as the identification, analysis, evaluation, treatment (control), monitoring, review and communication of risk. These activities can be applied in a systematic or ad hoc manner. The presumption is that systematic application of these activities will result in improved decision-making and, most likely, improved outcomes.

Structure of Risk Management

Depending upon the structure and operations of organization, financial risk management can be implemented in different ways. Risk management structure defines the different layers of an organization at which risk is identified and managed. Although there are different layers or level at which risk is managed but there are three layers which are common to all. i.e.

Risk Management

For managing risk there are certain basic principles which are to be followed by every organization:

1. Corporate level Policies
2. Risk management strategy
3. Well-defined policies and procedures by senior management
4. Dissemination, implementation and compliance of policies and procedures
5. Accountability of individuals heading various functions/ business lines
6. Independent Risk review function
7. Contingency plans
8. Tools to monitor risks

Institutions can reduce some risks simply by researching them. A bank can reduce its credit risk by getting to know its borrowers. A brokerage firm can reduce market risk by being knowledgeable about the markets it operates in.

Functionally, there are four aspects of financial risk management. Success depends upon

A. A positive corporate culture,

No one can manage risk if they are not prepared to take risk. While individual initiative is critical, it is the corporate culture which facilitates the process. A positive risk culture is one which promotes individual responsibility and is supportive of risk taking.

B. Actively observed policies and procedures

Used correctly, procedures are powerful tool of risk management. The purpose of policies and procedures is to empower people. They specify how people can accomplish what needs to be done. The success of policies and procedures depends critically upon a positive risk culture.

C. Effective use of technology

The primary role technology plays in risk management is risk assessment and communication. Technology is employed to quantify or otherwise summarize risks as they are being taken. It then communicates this information to decision makers, as appropriate.

D. Independence or risk management professionals

To get the desired outcome from risk management, risk managers must be independent of risk taking functions within the organization. Enron’s experience with risk management is instructive. The firm maintained a risk management function staffed with capable employees. Lines of reporting were reasonably independent in theory, but less so in practice.

Internal Controls

Para one on first page of the ‘Guidelines on Internal Controls’ issued by SBP provides:

“Internal Control refers to policies, plans and processes as affected by the Board of Directors and performed on continuous basis by the senior management and all levels of employees within the bank. These internal controls are used to provide reasonable assurance regarding the achievement of organizational objectives. The system of internal controls includes financial, operational and compliance controls.”

The current official definition of internal control was developed by the Committee of Sponsoring Organization (COSO) of the Treadway Commission. In its influential report, Internal Contro

The International Organization for Standardization (ISO) has defined risk management as the identification, analysis, evaluation, treatment (control), monitoring, review and communication of risk. These activities can be applied in a systematic or ad hoc manner. The presumption is that systematic application of these activities will result in improved decision-making and, most likely, improved outcomes.

Structure of Risk Management

Depending upon the structure and operations of organization, financial risk management can be implemented in different ways. Risk management structure defines the different layers of an organization at which risk is identified and managed. Although there are different layers or level at which risk is managed but there are three layers which are common to all. i.e.

Risk Management

For managing risk there are certain basic principles which are to be followed by every organization:

1. Corporate level Policies
2. Risk management strategy
3. Well-defined policies and procedures by senior management
4. Dissemination, implementation and compliance of policies and procedures
5. Accountability of individuals heading various functions/ business lines
6. Independent Risk review function
7. Contingency plans
8. Tools to monitor risks

Institutions can reduce some risks simply by researching them. A bank can reduce its credit risk by getting to know its borrowers. A brokerage firm can reduce market risk by being knowledgeable about the markets it operates in.

Functionally, there are four aspects of financial risk management. Success depends upon

A. A positive corporate culture,

No one can manage risk if they are not prepared to take risk. While individual initiative is critical, it is the corporate culture which facilitates the process. A positive risk culture is one which promotes individual responsibility and is supportive of risk taking.

B. Actively observed policies and procedures

Used correctly, procedures are powerful tool of risk management. The purpose of policies and procedures is to empower people. They specify how people can accomplish what needs to be done. The success of policies and procedures depends critically upon a positive risk culture.

C. Effective use of technology

The primary role technology plays in risk management is risk assessment and communication. Technology is employed to quantify or otherwise summarize risks as they are being taken. It then communicates this information to decision makers, as appropriate.

D. Independence or risk management professionals

To get the desired outcome from risk management, risk managers must be independent of risk taking functions within the organization. Enron’s experience with risk management is instructive. The firm maintained a risk management function staffed with capable employees. Lines of reporting were reasonably independent in theory, but less so in practice.

Internal Controls

Para one on first page of the ‘Guidelines on Internal Controls’ issued by SBP provides:

“Internal Control refers to policies, plans and processes as affected by the Board of Directors and performed on continuous basis by the senior management and all levels of employees within the bank. These internal controls are used to provide reasonable assurance regarding the achievement of organizational objectives. The system of internal controls includes financial, operational and compliance controls.”

The current official definition of internal control was developed by the Committee of Sponsoring Organization (COSO) of the Treadway Commission. In its influential report, Internal Contro

B. Actively observed policies and procedures

Used correctly, procedures are powerful tool of risk management. The purpose of policies and procedures is to empower people. They specify how people can accomplish what needs to be done. The success of policies and procedures depends critically upon a positive risk culture.

C. Effective use of technology

The primary role technology plays in risk management is risk assessment and communication. Technology is employed to quantify or otherwise summarize risks as they are being taken. It then communicates this information to decision makers, as appropriate.

D. Independence or risk management professionals

To get the desired outcome from risk management, risk managers must be independent of risk taking functions within the organization. Enron’s experience with risk management is instructive. The firm maintained a risk management function staffed with capable employees. Lines of reporting were reasonably independent in theory, but less so in practice.

Internal Controls

Para one on first page of the ‘Guidelines on Internal Controls’ issued by SBP provides:

“Internal Control refers to policies, plans and processes as affected by the Board of Directors and performed on continuous basis by the senior management and all levels of employees within the bank. These internal controls are used to provide reasonable assurance regarding the achievement of organizational objectives. The system of internal controls includes financial, operational and compliance controls.”

The current official definition of internal control was developed by the Committee of Sponsoring Organization (COSO) of the Treadway Commission. In its influential report, Internal Control - Integrated Framework, the Commission defines internal control as follows:

“Internal control is a process, effected by an entity's Board of Directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:

 Effectiveness and efficiency of operations.
 Reliability of financial reporting.
 Compliance with applicable laws and regulations.

This definition reflects certain fundamental concepts:

 Internal control is a process. It is a means to an end, not an end in itself.
 Internal control is effected by people. It is not policy manuals and forms, but people at every level of an organization.
 Internal control can be expected to provide only reasonable assurance, not absolute assurance, to an entity's management and board.

Internal control should assist and never impede management and staff from achieving their objectives. Control must be taken seriously. A well-designed system of internal control is worse than worthless unless it is complied with, since the assemblance of control will be likely to convey a false sense of assurance. Controls are there to be kept, not avoided. For instance, exception reports should be followed up. Senior management should set a good example about control compliance. For instance, physical access restrictions to secure areas should be observed equally by senior management as by junior personnel.

Components of Internal Controls

Components of internal control also depend upon the structure of the business unit and nature of its operation. The COSO Report describes the internal control process as consisting of five interrelated components that are derived from and integrated with the management process. The components are interrelated, which means that each component affects and is affected by the other four. These five components, which are the necessary foundation for an effective internal control system, include:

I. Control Environment,

Control environment, an intangible factor and the first of the five components, is the foundation for all other components of internal control, providing discipline and structure and encompassing both technical competence and ethical commitment.

II. Risk Assessments,

Organizations exist to achieve some purpose or goal. Goals, because they tend to be broad, are usually divided into specific targets known as objectives. A risk is anything that endangers the achievement of an objective. Risk assessments is done to determine the relative potential for loss in programs and functions and to design the most cost-effective and productive internal controls.

III. Control Activities,

Control activities mean the structure, policies, and procedures, which an organization establishes so that identified risks do not prevent the organization from reaching its objectives. Policies, procedures, and other items like job descriptions, organizational charts and supervisory standards, do not, of course, exist only for internal control purposes. These activities are basic management practices.

IV. Information and Communication, and

Organizations must be able to obtain reliable information to determine their risks and communicate policies and other information to those who need it. Information and communication, the fourth component of internal control, articulates this factor.

V. Monitoring

Life is change; internal controls are no exception. Satisfactory internal controls can become obsolete through changes in external circumstances. Therefore, after risks are identified, policies and procedures put into place, and information on control activities communicated to staff, superiors must then implement the fifth component of internal control, monitoring.

Even the best internal control plan will be unsuccessful if it is not followed. Monitoring allows the management to identify whether controls are being followed before problems occur. In the same way, management must review weaknesses identified by audits to determine whether related internal controls need revision.

Tools for Monitoring of Risk

Management Information System

M.I.S or Management Information System is the collection and analysis of data in order to support management’s decision with respect to the achievement of objectives mentioned in the policies and procedures and the control of various risks therein.

It is this area i.e. M.I.S, where I.T can play a vital and effective role as with the help of I.T large information may be analyzed efficiently and with accuracy, so that effective decision may be taken by the management without the loss of any time.

Asset-Liability Management Committee (ALCO)

In most cases, day-to-day risk assessment and management is assigned to a specialized committee, such as an Asset-Liability Management Committee (ALCO). Duties pertaining to key elements of the risk management process should be adequately separated to avoid potential conflicts of interest - in other words, a financial institution’s risk monitoring and control functions should be sufficiently independent from its risk-taking functions. Larger or more complex institutions often have a designated, independent unit responsible for the design and administration of balance sheet management, including interest rate risk. Given today's widespread innovation in banking and the dynamics of markets, banks should identify any risks inherent in a new product or service before it is introduced, and ensure that these risks are promptly considered in the assessment and management process.

Corporate Governance Principles

Corporate governance relates to the manner in which the business of the organization is governed, including setting corporate objectives and a institution’s risk profile, aligning corporate activities and behaviors with the expectation that the management will operate in a safe and sound manner, running day-to-day operations within an established risk profile, while protecting the interests of depositors and other stakeholders. It is defined by a set of relationships between the institution’s management, its board, its shareholders, and other stakeholders.

The key elements of sound corporate governance in a bank include:

a) A well-articulated corporate strategy against which the overall success and the contribution of individuals can be measured.

b) Setting and enforcing clear assignment of responsibilities, decision-making authority and accountabilities that are appropriate for the bank's risk profile.

c) A strong financial risk management function (independent of business lines), adequate internal control systems (including internal and external audit functions), and functional process design with the necessary checks and balances.

d) Corporate values, codes of conduct and other standards of appropriate behavior, and effective systems used to ensure compliance. This includes special monitoring of a bank's risk exposures where conflicts of interest are expected to appear (e.g., relationships with affiliated parties).

e) Financial and managerial incentives to act in an appropriate manner offered to the board, management and employees, including compensation, promotion and penalties. (i.e., compensation should be consistent with the bank's objectives, performance, and ethical values).

f) Transparency and appropriate information flows internally and to the public.

Tools mentioned above can be utilized in identifying and managing different risks in the following manner:

I. Credit Risk

It is managed by setting prudent limits for exposures to individual transaction, counterparties and portfolios. Credits limits are set by reference to credit rating established by Credit Rating Agencies, methodologies established by Regulators and as per Board’s direction.