Market-Risk Governance, Organisation and Framework - Article

Introduction

Market risk cannot be managed only by calculating VaR, duration or capital charge.

A bank also needs a clear system to decide:

• who may take market risk;

• how much risk may be taken;

• which instruments may be traded;

• who independently measures the risk;

• how limit breaches are handled;

• how positions are valued; and

• when senior management or the Board must intervene.

This is the market-risk governance and management framework.

The current IIBF CAIIB BFM Module B expressly covers Market Risk Management Framework, Organisation Structure, Risk Identification, Risk Measurement, Risk Monitoring and Control, Risk Reporting, Managing Trading Liquidity and Risk Mitigation.

The central governance principle is:

Risk-taking authority and independent risk control should be clearly separated.

Current Basel supervisory principles similarly require banks to maintain prudent processes to identify, measure, evaluate, monitor, report and control market risk, supported by appropriate limits, independent controls and reliable valuation.

Learning Objectives

After studying this topic, you should be able to:

• explain the structure of a market-risk management framework;

• understand the roles of the Board, senior management and treasury functions;

• distinguish front office, mid office and back office;

• explain market-risk policies, limits and escalation;

• understand independent valuation, stress testing and model controls; and

• identify common governance failures in treasury operations.

What Is Market-Risk Governance?

Market-risk governance is the system through which a bank directs, controls and oversees its market-risk-taking activities.

It establishes:

• authority;

• accountability;

• risk appetite;

• policies;

• limits;

• independent control;

• reporting; and

• escalation.

A good framework answers three basic questions:

1. Who Can Take Risk?

Only authorised dealers or business units acting within approved mandates.

2. How Much Risk Can They Take?

Only within approved:

• position limits;

• sensitivity limits;

• VaR or other risk limits;

• stop-loss limits; and

• counterparty or product limits.

3. Who Checks the Risk Independently?

An independent risk-control or market-risk function must measure and monitor risk without being controlled by the traders who create the exposure.

Main Building Blocks of the Framework

A sound market-risk framework normally contains:

1. Board-approved risk appetite and strategy;

2. clearly defined organisational responsibilities;

3. market-risk policies and procedures;

4. approved products and trading mandates;

5. risk-measurement systems;

6. risk limits;

7. independent monitoring and valuation;

8. stress testing and model validation;

9. timely MIS and escalation; and

10. independent audit and review.

The Basel Core Principles require market-risk arrangements to consider the bank's:

• risk appetite;

• risk profile;

• market and macroeconomic conditions; and

• possible deterioration in market liquidity.

Board of Directors

The Board has ultimate oversight of the bank's risk-taking framework.

It should ensure that market-risk activities are consistent with:

• overall business strategy;

• financial strength;

• capital;

• risk appetite; and

• capacity to manage the risks being taken.

The Board does not normally execute individual treasury trades.

Its role is governance and oversight.

Important Board-level responsibilities include ensuring that:

• risk-taking objectives are clearly defined;

• appropriate policies and limits exist;

• responsibilities are clearly allocated;

• independent risk-control arrangements are effective;

• management receives adequate risk information; and

• significant breaches and concentrations receive appropriate attention.

Basel's current risk-management principles require the independent risk function and Chief Risk Officer or equivalent to remain independent of individual business lines and to escalate risk concentrations and risk-appetite breaches to senior management and the Board.

Risk Appetite and Market Risk

Risk appetite expresses how much and what type of risk the bank is prepared to accept while pursuing its objectives.

For treasury, this can influence:

• maximum market-risk exposure;

• permitted instruments;

• trading horizons;

• concentration;

• liquidity of positions;

• acceptable loss;

• capital usage; and

• stress-loss tolerance.

Risk appetite is broader than an individual trader limit.

Risk Appetite → Policies → Limits → Dealer Mandates

This hierarchy is important for CAIIB.

Senior Management

Senior management converts the Board-approved framework into operating practice.

Its responsibilities normally include:

• implementing market-risk strategy;

• approving detailed limits within delegated authority;

• allocating responsibilities;

• ensuring adequate systems and skilled staff;

• reviewing risk reports;

• dealing with significant breaches;

• reviewing stress-test results; and

• ensuring that risk-taking remains consistent with capital and business objectives.

Basel requires senior management to receive meaningful information on risk exposure and limit usage and to have sufficient authority to require reductions in positions when necessary.

Treasury Organisation: Front, Mid and Back Office

A highly examinable organisational principle is the functional separation of:

• Front Office

• Mid Office

• Back Office

RBI supervisory material specifically evaluates the adequacy of front-office, mid-office and back-office functions when assessing market-risk controls. RBI has also required clear functional separation of trading, risk management, and settlement/accounting functions in treasury-related regulatory frameworks.

Front Office

The front office is the risk-taking and dealing function.

Its activities may include:

• buying and selling securities;

• foreign-exchange dealing;

• money-market transactions;

• derivatives;

• customer and interbank transactions; and

• proprietary trading.

Front-office personnel operate within:

• approved products;

• dealer mandates;

• position limits;

• stop-loss limits; and

• other delegated authorities.

Key Principle

The dealer should take authorised risk, not independently determine whether the resulting risk is acceptable after the trade.

That assessment requires independent control.

Mid Office

The mid office or independent market-risk function provides the main risk measurement and monitoring role.

Its activities commonly include:

• measuring market-risk exposures;

• monitoring utilisation of limits;

• identifying limit breaches;

• producing independent risk reports;

• monitoring intraday positions where relevant;

• analysing sensitivities and VaR;

• conducting or reviewing stress tests;

• monitoring unusual positions;

• reviewing market liquidity;

• supporting model validation and backtesting; and

• escalating exceptions.

RBI's risk-based supervisory framework specifically examines whether:

• aggregate risk and position limits cover major trading positions;

• risk limits are appropriately validated;

• stop-loss/take-profit targets are followed;

• intraday positions receive adequate mid-office oversight; and

• unusual trading practices are independently analysed.

Current Basel standards similarly require an independent risk-control unit to analyse risk exposures relative to trading limits and report independently of the business trading units.

Back Office

The back office performs the processing and settlement-control function.

Activities generally include:

• confirmation of transactions;

• settlement;

• accounting;

• reconciliation;

• custody-related processing;

• checking transaction records; and

• identifying settlement exceptions.

RBI treasury-related instructions emphasise separation between trading and settlement/accounting functions and require transaction records to flow independently to the back office for processing.

Why Separation Is Necessary

Suppose the same dealer can:

1. enter a trade;

2. alter the trade record;

3. confirm it;

4. settle it; and

5. reconcile the account.

The risk of:

• concealment;

• unauthorised dealing;

• fraud;

• delayed loss recognition; and

• manipulation

becomes much higher.

Functional segregation reduces this risk.

Front vs Mid vs Back Office

Market-Risk Policy

The market-risk policy translates the bank's risk appetite into operating rules.

A sound policy should address relevant matters such as:

• permitted market activities;

• permitted instruments;

• trading and Banking Book boundaries;

• organisational responsibilities;

• risk-measurement methods;

• limits;

• valuation;

• stress testing;

• exception handling;

• reporting;

• new products; and

• policy-review frequency.

Basel requires trading-book positions to be subject to clearly defined senior-management-approved policies and procedures for active risk management. These should address trading strategy, limits, valuation, liquidity and risk monitoring.

Policy vs Limit

These terms are related but different.

Policy

Sets the broader rule.

Example:

Foreign-exchange positions must remain within Board-approved risk appetite and prescribed regulatory requirements.

Limit

Sets a measurable boundary.

Example:

A particular desk may not exceed an approved exposure level.

Therefore:

Policy tells the bank how risk should be managed. Limit tells the bank how far risk may go.

Market-Risk Limits

Limits convert risk appetite into measurable controls.

Depending on the activity, banks may use:

• position limits;

• dealer limits;

• desk limits;

• product limits;

• currency limits;

• maturity limits;

• sensitivity limits;

• VaR limits;

• stop-loss limits;

• concentration limits; and

• intraday limits.

Basel requires limits to be consistent with the bank's:

• risk appetite;

• risk profile;

• capital strength; and

• ability to manage market risk.

Limit Breach Is Not Automatically Fraud

A limit breach means the approved risk boundary has been exceeded.

It should trigger:

• identification;

• reporting;

• escalation;

• investigation; and

• corrective action.

The appropriate response depends on:

• materiality;

• cause;

• duration;

• market conditions; and

• whether the breach was authorised or unauthorised.

Silently ignoring a breach is itself a control weakness.

Stop-Loss Limits

A stop-loss limit restricts the amount of loss that can be incurred before a position must normally be reviewed, reduced or closed according to policy.

Its purpose is to prevent a dealer from continually holding a losing position in the hope that:

“The market will come back.”

This is especially important where behavioural bias encourages traders to delay recognising losses.

RBI's supervisory risk-control assessment explicitly considers adherence to stop-loss and take-profit targets.

Independent Valuation

Market-risk measurement depends heavily on correct prices.

If the trading desk itself controls the final valuation of its positions, it may have an incentive to use favourable assumptions.

A sound framework therefore requires independent valuation controls.

Current Basel guidance requires:

• documented valuation policies;

• clear responsibilities;

• independent reporting lines;

• independent price verification; and

• valuation adjustments where uncertainty exists.

Independent price verification should be performed by a unit independent of the dealing room.

Mark-to-Market vs Independent Price Verification

Mark-to-Market

Values the position using available market prices.

Independent Price Verification

Checks independently whether:

• market prices;

• model inputs; and

• valuation assumptions

used by the bank are reliable.

They are related but not identical.

Mark-to-Model Positions

Some complex or illiquid instruments do not have a reliable observable market price.

The bank may then depend on models.

This creates additional concerns involving:

• model assumptions;

• data quality;

• liquidity;

• valuation uncertainty; and

• independent validation.

Basel supervisory standards require banks to maintain clear procedures for instruments valued using models and to assess whether material risks can be properly identified and hedged.

Risk Identification and Measurement

Governance starts with identifying all material market-risk factors.

These can include:

• interest rates;

• yield-curve movements;

• credit spreads;

• foreign-exchange rates;

• equity prices;

• gold or commodity prices;

• volatility; and

• basis movements.

Measurement techniques can then include:

• position measures;

• sensitivities;

• PV01/PVBP;

• duration;

• VaR;

• Expected Shortfall where relevant;

• scenario analysis; and

• stress testing.

A measurement system is useful only when its outputs influence actual risk decisions.

Current Basel standards require internal risk measures to be integrated with day-to-day risk management rather than maintained merely for regulatory calculation.

Stress Testing

Normal risk measures often depend on historical data and statistical assumptions.

They may underestimate losses during:

• extreme interest-rate movements;

• severe currency depreciation;

• sudden spread widening;

• market closure;

• volatility spikes; or

• disappearance of market liquidity.

Stress testing asks:

What happens to the portfolio under severe but plausible market conditions?

Results should influence:

• limits;

• hedging;

• capital planning;

• risk reduction; and

• contingency actions.

Basel requires regular stress testing as a core element of sound market-risk management.

Backtesting

Backtesting compares model-generated risk estimates with actual or hypothetical portfolio outcomes.

Its purpose is to assess whether the model performs reasonably in practice.

Repeated large exceptions may indicate:

• model weakness;

• incorrect assumptions;

• poor data;

• changing market behaviour; or

• inadequate risk-factor coverage.

Backtesting therefore supports model validation, not trading profitability assessment.

Trading Liquidity within the Framework

A position may appear manageable under normal market conditions but become very difficult to sell during stress.

Market-risk governance should therefore consider:

• market depth;

• bid-offer spreads;

• position size relative to turnover;

• concentration;

• ageing of positions; and

• time needed to exit or hedge.

Basel requires trading desks and supervisors to consider deterioration in market liquidity and maintain reports assessing market liquidity.

Risk Reporting and Escalation

Risk information must reach the right decision-maker quickly.

Reports may cover:

• current positions;

• risk-limit utilisation;

• VaR or sensitivities;

• profit and loss;

• concentration;

• stress losses;

• liquidity concerns;

• limit breaches; and

• ageing or unusual positions.

Basel requires trading desks to maintain regular risk-management reports and daily reports on limits, utilisation, breaches and follow-up where relevant.

Good Reporting Has Three Features

It should be:

• accurate;

• timely;

• actionable.

A sophisticated risk report received too late to control the exposure has limited value.

New Product Approval

A bank should not begin trading a complex new instrument simply because the front office sees a profit opportunity.

Before launch, relevant functions should understand:

• product characteristics;

• market risks;

• valuation;

• accounting;

• legal implications;

• liquidity;

• operational requirements;

• systems capability;

• model requirements; and

• capital treatment.

Basel specifically requires new-business and new-product processes to bring together relevant business, risk and control functions before the activity is initiated.

Role of Internal Audit

Internal audit provides independent assurance on the market-risk framework.

It should not replace the mid-office risk function.

The market-risk function performs ongoing risk control.

Internal audit independently assesses whether that framework and its controls are working effectively.

Current Basel standards require an independent review of market-risk measurement systems, including:

• organisation of the risk-control unit;

• models;

• data;

• valuation;

• position information;

• MIS;

• backtesting; and

• trading-unit activities.

Market Risk Function vs Internal Audit

Practical Banking Application

Assume a dealer builds a large Government-security position because the dealer expects interest rates to fall.

A sound framework works as follows:

Front Office

Executes the trade within authorised dealing powers.

Market-Risk/Mid Office

Measures:

• position;

• duration/PV01;

• VaR or other risk measure;

• concentration; and

• limit utilisation.

Limit Monitoring

If the position breaches a desk limit, the breach is immediately identified.

Escalation

The appropriate senior authority is informed rather than allowing the dealer to hide or self-approve the breach.

Valuation

Prices are independently verified.

Stress Testing

Management considers what happens if interest rates rise sharply instead of falling.

Back Office

Independently confirms, settles, accounts and reconciles the transaction.

Management Review

If the exposure is inconsistent with:

• risk appetite;

• market conditions;

• liquidity; or

• capital capacity,

management may require the position to be:

• reduced;

• hedged; or

• closed.

This demonstrates that market-risk management is not the responsibility of the trader alone.

CAIIB Exam Focus

Remember these high-value concepts:

• IIBF expressly covers Market Risk Management Framework and Organisation Structure in BFM Module B.

• The Board provides overall risk governance and oversight.

• Risk appetite must be translated into policies and measurable limits.

• Senior management implements the Board-approved framework.

• Front office takes authorised market positions.

• Mid office/independent risk function measures and monitors risk.

• Back office independently handles settlement, accounting and reconciliation.

• RBI supervisory material specifically examines front-, mid- and back-office controls in treasury.

• Trading and independent risk control should be functionally separated.

• Market-risk limits should reflect risk appetite, capital and management capability.

• Limit breaches require reporting, escalation and corrective action.

• Stop-loss limits help prevent uncontrolled continuation of losing positions.

• Independent valuation reduces conflicts of interest.

• Independent price verification is different from ordinary daily marking of positions.

• Stress testing complements normal risk measurement.

• Backtesting assesses the performance of risk models.

• Trading liquidity must be considered alongside market-risk measurement.

• New products require risk and control assessment before introduction.

• Internal audit independently reviews the framework but does not perform the mid office's daily control role.

• IIBF's published cut-off for examinations conducted from September through February is 30 June, so regulatory developments up to 30 June 2026 are within the published cut-off for the December 2026 examination.

Common Exam Traps

Trap 1: “Market-Risk Management Is the Treasury Dealer's Responsibility”

Incorrect.

Dealers take risk, but governance involves the Board, management, independent risk control, back office and audit.

Trap 2: “Mid Office and Back Office Perform the Same Function”

Incorrect.

Mid office mainly monitors risk. Back office mainly confirms, settles, accounts and reconciles transactions.

Trap 3: “Front-Mid-Back Office Is the Same as the Three Lines Model”

Incorrect.

Front/mid/back office describes treasury functional segregation. The broader lines-of-defence concept addresses organisation-wide governance and assurance.

Trap 4: “A Position within Dealer Limit Is Automatically Acceptable”

Incorrect.

It may still breach:

• desk;

• portfolio;

• stop-loss;

• concentration;

• risk-appetite; or

• regulatory limits.

Trap 5: “Limit Breach Can Be Regularised Silently after the Market Moves Favourably”

Incorrect.

Breaches must be identified, reported and handled under the approved escalation process.

Trap 6: “Daily Mark-to-Market Makes Independent Valuation Unnecessary”

Incorrect.

Independent price verification is an additional control against incorrect or biased valuation.

Trap 7: “VaR Eliminates the Need for Stress Testing”

Incorrect.

Normal statistical measures may not capture extreme market conditions adequately. Stress testing remains essential.

Trap 8: “Internal Audit Should Perform Daily Market-Risk Monitoring”

Incorrect.

Daily monitoring belongs to the risk-control framework. Internal audit independently evaluates whether that framework is effective.

Memory Technique

Remember T-C-S:

• T – Take Risk: Front Office

• C – Control Risk: Mid Office

• S – Settle: Back Office

Above all three:

Board sets direction → Management implements → Independent functions control and assure