Risk Management

Video for this Topic

Unique Funding

Sections in this Topic

Overview
Types of Risk
Elements of Risk Management
Main Page for Topic Index

Overview

A banking institution should apply sound management principles to its entire spectrum of risks. Failure to establish a management structure that adequately identifies, measures, monitors, and controls the risks involved in an institution's various products and lines of business has long been considered unsafe and unsound conduct. These risks include, but are not limited to, credit, market, liquidity, operational, legal, and reputational risk.

Types of Risk

A banking institution will face risks during every stage of its life cycle. Regulators place great emphasis on the institution's management of the types of risk described below. See Supervisory Letters SR-97-24 and SR-97-25 for more information.

Credit risk arises from the potential that a borrower or counterparty will fail to perform on an obligation.
Market risk is the risk to a financial institution's condition resulting from adverse movements in market rates or prices, such as interest rates, foreign-exchange rates, or equity prices.
Liquidity risk is the potential that an institution will be unable to meet its obligations as they come due because of an inability to liquidate assets or obtain adequate funding (referred to as "funding liquidity risk"), or the potential that the institution cannot easily unwind or offset specific exposures without significantly lowering market prices because of inadequate market depth or market disruptions (referred to as "market liquidity risk").
Operational risk arises from the potential that inadequate information systems, operational problems, breaches in internal controls, fraud, or unforeseen catastrophes will result in unexpected losses.
Legal risk arises from the potential that unenforceable contracts, lawsuits, or adverse judgments can disrupt or otherwise negatively affect the operations or condition of a banking organization.
Reputational risk is the potential that negative publicity regarding an institution's business practices, whether true or not, will cause a decline in the customer base, costly litigation, or revenue reductions.

In practice, an institution's business activities present various combinations and concentrations of these risks depending on the nature and scope of the particular activity. Regulators pay close attention to the quality of bank management's formal or informal systems for identifying, measuring, and containing these risks.

Elements of Risk Management

When evaluating the quality of risk management as part of the evaluation of the overall quality of management, regulators consider the following elements of a sound risk-management system:

Active board and senior management oversight
Adequate policies, procedures, and limits
Adequate risk-measurement, risk-monitoring, and management information systems
Comprehensive internal controls

Adequate risk-management programs can vary considerably in sophistication, depending on the size and complexity of the banking organization and the level of risk that it accepts. For smaller institutions engaged solely in traditional banking activities and whose senior managers and directors are actively involved in the details of day-to-day operations, relatively basic risk-management systems may be adequate. However, large, multinational organizations will require far more elaborate and formal risk management systems to address their broader and typically more complex range of financial activities and to provide senior managers and directors with the information they need to monitor and direct day-to-day activities. In addition to the banking organization's market and credit risks, risk-management systems should encompass the organization's trust and fiduciary activities, including investment advisory services, mutual funds, and securities lending.

For more information on risk management, see the Commercial Bank Examination Manual.