Introduction
Risk management becomes useful only when a bank can apply it to an actual business situation.
A banker may face questions such as:
What can go wrong?
How serious can the loss be?
How likely is the event?
Can the risk be reduced?
Should the bank accept, avoid, transfer or control it?
Has the risk increased after the original decision?
Does the exposure need escalation?
The current IIBF CAIIB BFM Module B begins with Risk and Basic Risk Management Framework and then moves into identification and management of banking risks such as market, credit, operational and liquidity risk.
Basel’s current supervisory principles similarly require banks to maintain comprehensive processes to identify, measure, evaluate, monitor, report and control or mitigate all material risks on a timely basis.
For case studies, remember the basic sequence:
Identify → Measure → Mitigate → Monitor → Report and Review
Learning Objectives
After studying this topic, you should be able to:
Identify the main risks hidden inside a banking case.
Distinguish inherent risk from residual risk.
Understand qualitative and quantitative risk measurement.
Select suitable methods for mitigating different risks.
Explain why monitoring continues after a transaction is approved.
Apply the framework to credit, market, liquidity and operational situations.
Stage 1: Risk Identification
Risk identification means finding out what events or conditions can adversely affect the bank.
The objective is not merely to label an activity as “risky”.
The bank should identify:
the source of risk;
the exposure affected;
the event that can create loss;
possible interaction with other risks; and
whether the risk is existing or emerging.
Basel requires risk identification to cover all material risks on:
on-balance-sheet exposures;
off-balance-sheet exposures;
group-wide basis;
portfolio level; and
business-line level.
It also requires banks to consider new and emerging risks.
Examples
A housing loan can involve:
credit risk;
interest-rate risk;
collateral-value risk;
operational risk; and
legal risk.
A foreign-currency loan can additionally involve:
exchange-rate risk;
country risk; and
settlement risk.
Therefore, one transaction can contain several risks simultaneously.
Inherent Risk and Residual Risk
These two concepts are important in case analysis.
Inherent Risk
Inherent risk is the risk existing before considering the effect of controls or mitigation.
Residual Risk
Residual risk is the risk remaining after controls and mitigation are applied.
For example:
A bank grants a secured loan.
The borrower may still default. Collateral reduces the bank’s possible loss, but it does not eliminate borrower default risk.
Therefore:
Credit risk before collateral → Inherent risk
Credit risk remaining after collateral and other controls → Residual risk
Risk management should ultimately assess whether the residual risk is acceptable.
Stage 2: Risk Measurement and Assessment
After identifying risk, the bank must determine its significance.
Risk measurement generally considers two basic dimensions:
likelihood or probability of an adverse event; and
potential impact if the event occurs.
Risk assessment may use:
quantitative techniques;
qualitative judgement; or
a combination of both.
RBI’s risk-based supervisory framework has similarly recognised the use of both quantitative and qualitative approaches in assessing inherent risks and the effectiveness of controls.
Quantitative Assessment
Suitable where risk can be expressed through measurable information such as:
exposure amount;
default probability;
market-price sensitivity;
liquidity gap;
loss experience;
volatility; or
concentration.
Qualitative Assessment
Useful for factors such as:
quality of management;
internal controls;
system reliability;
legal uncertainty;
process weaknesses;
staff capability; or
emerging risks with limited historical data.
Risk Rating or Risk Matrix
Banks may classify risks into categories such as:
Low;
Moderate; or
High.
A risk matrix may combine:
Likelihood of Event × Severity of Impact
This helps management decide which exposures require:
immediate control;
tighter limits;
additional capital;
closer monitoring; or
escalation.
The exact methodology depends on the particular risk and the bank’s approved framework.
Stage 3: Risk Mitigation
Risk mitigation means reducing the likelihood or impact of an adverse event.
There are four broad responses.
Avoid
Do not undertake the activity.
Example:
A bank may decide not to finance a prohibited or unacceptable business.
Reduce or Control
Take the risk but introduce safeguards.
Examples:
collateral;
borrower covenants;
diversification;
maker-checker control;
position limits;
stronger authentication.
Transfer or Share
Shift part of the financial impact to another party.
Examples:
insurance;
guarantees;
credit derivatives where permitted;
hedging.
Accept
Retain the risk because:
it is within risk appetite;
further mitigation is uneconomic; or
the expected risk-adjusted return justifies it.
Acceptance does not mean ignoring the risk. Accepted risks still require monitoring.
Mitigation Does Not Mean Elimination
Suppose a bank obtains a valuable mortgage against a loan.
The collateral reduces potential loss if the borrower defaults.
But the bank may still face:
fall in collateral value;
legal problems;
delay in enforcement;
documentation defects; or
insufficient sale proceeds.
Therefore:
A mitigated risk normally becomes residual risk, not zero risk.
Stage 4: Risk Monitoring
Risk assessment is not completed when a loan is sanctioned or a treasury transaction is booked.
Conditions change.
A borrower can weaken. Market prices can move. Deposits can leave. Technology systems can fail.
Banks therefore monitor:
exposure levels;
risk indicators;
limit utilisation;
concentration;
exceptions;
collateral;
early-warning signals;
stress conditions; and
emerging risks.
Basel requires risk identification, monitoring and control to operate on an ongoing basis and for risk-management infrastructure to keep pace with changes in the bank and the external risk environment.
Stage 5: Reporting and Review
Monitoring is useful only if important information reaches the people who can act on it.
Risk reporting should highlight:
significant exposures;
deterioration;
limit breaches;
concentration;
control failures;
stress indicators; and
emerging concerns.
Management may then:
reduce exposure;
obtain more security;
hedge;
change limits;
stop new business;
strengthen controls; or
escalate the issue.
Case 1: Corporate Borrower Shows Early Stress
A bank has a large working-capital exposure to a manufacturing company.
When the loan was sanctioned, the company had:
satisfactory financial performance;
regular operations; and
acceptable leverage.
Later, the bank notices:
falling sales;
repeated excess drawings;
delayed submission of stock statements; and
deterioration in industry conditions.
Risk Identification
The main risk is credit risk.
There may also be:
industry concentration risk;
collateral-value risk; and
operational risk if monitoring has been weak.
Measurement
The bank should reassess:
borrower financial strength;
cash-flow position;
outstanding exposure;
repayment capacity;
collateral coverage; and
internal credit rating.
Mitigation
Possible actions include:
reducing further exposure;
obtaining additional security;
tightening covenants;
improving cash-flow control; or
taking another action permitted under bank policy.
Monitoring
The account should receive closer monitoring through appropriate early-warning and credit-review processes.
Exam Lesson
Risk measurement at sanction does not remain valid forever.
Monitoring can trigger fresh identification and measurement.
Case 2: Collateral Value Is High, Borrower Is Weak
A borrower has weak cash flows but offers property worth substantially more than the loan amount.
The credit officer concludes:
“There is no credit risk because security is sufficient.”
Analysis
The conclusion is incorrect.
The primary source of repayment should normally remain the borrower’s ability to generate repayment cash flows.
Collateral is a risk mitigant.
It does not eliminate:
probability of default;
enforcement delay;
legal risk;
valuation risk; or
recovery uncertainty.
Case Principle
Good collateral reduces loss severity. It does not make a weak borrower risk-free.
Case 3: Treasury Position Moves against the Bank
A treasury dealer takes a permitted position in a security.
Market yields move adversely and the value of the position falls.
The position is still within the dealer’s original transaction authority.
Risk Identification
The primary risk is market risk.
Measurement
The bank should assess the market exposure using the approved market-risk measures.
Mitigation
Depending on policy, the bank may:
reduce the position;
hedge it; or
allow it to remain within approved limits.
Monitoring
The important question is not merely whether the original deal was authorised.
The bank must monitor:
position limits;
loss limits;
market movements; and
concentration.
Exam Lesson
An authorised transaction can subsequently become unacceptable because its risk profile changes.
Case 4: Heavy Dependence on One Depositor
A bank has adequate total deposits.
However, a very large portion comes from a small number of corporate depositors.
Risk Identification
The bank faces funding concentration and liquidity risk.
Looking only at total deposit size would miss the real problem.
Measurement
Assessment should consider:
concentration by depositor;
maturity profile;
expected withdrawals;
alternative funding sources; and
liquidity buffers.
Mitigation
The bank can reduce risk through:
diversified funding sources;
suitable liquid assets;
contingency funding arrangements; and
monitoring large deposit behaviour.
RBI’s liquidity-risk guidance requires banks to identify, measure, monitor and control liquidity risk and maintain diversified funding strategies.
Exam Lesson
A large balance sheet can appear liquid while still containing serious concentration risk.
Case 5: Employee Bypasses Maker-Checker Control
A branch employee processes a high-value transaction by bypassing an internal control.
No financial loss occurs because another employee detects the error before settlement.
Management decides that there is nothing to report because the bank did not lose money.
Analysis
This reasoning is weak.
The case reveals operational risk.
The absence of actual financial loss does not mean the risk event is irrelevant.
The incident can reveal:
control weakness;
access-management failure;
staff-training issue; or
possibility of a future larger loss.
Mitigation
The bank may need to:
correct system permissions;
strengthen maker-checker control;
review similar transactions;
retrain staff; and
investigate the root cause.
Monitoring
Near-miss incidents can provide valuable information for future risk prevention.
Case 6: Bank Guarantee Is Ignored in Risk Assessment
A bank has sanctioned several guarantees for a corporate customer.
Because no cash has yet been paid, the relationship manager excludes the guarantees from the customer’s risk assessment.
Analysis
This is incorrect.
Guarantees are off-balance-sheet exposures and can create actual funded obligations if invoked.
Basel requires risk identification to cover both on-balance-sheet and off-balance-sheet exposures.
The bank should therefore consider:
likelihood of invocation;
total customer exposure;
concentration;
available security;
counterparty strength; and
capital implications.
Exam Lesson
No present cash outflow does not mean no risk exposure.
Case 7: Insurance Covers Operational Loss
A bank purchases insurance against a specified operational event.
Management concludes that the underlying operational risk no longer needs monitoring.
Analysis
Incorrect.
Insurance is a risk-transfer tool.
Residual risk can remain because of:
deductibles;
exclusions;
policy limits;
claim disputes;
uninsured indirect loss; and
reputational damage.
The bank must continue managing the underlying operational process.
Case 8: New Digital Product Has No Loss History
A bank plans a new digital product.
Management argues that the product should be classified as low risk because there is no historical loss data.
Analysis
Absence of historical loss does not prove low risk.
The bank should identify potential:
cyber risk;
fraud risk;
operational risk;
legal risk;
third-party risk;
customer-protection risk; and
reputational risk.
Qualitative assessment and scenario analysis may be necessary where reliable historical data is limited.
Basel requires banks to identify new and emerging risks and to ensure that risk-management capability keeps pace with changes in products and the external environment.
Practical Banking Application
A useful way to analyse any banking transaction is to ask five questions.
1. Identify
What can go wrong?
Look beyond the most obvious risk.
2. Measure
How significant is the risk?
Consider likelihood, impact and concentration using quantitative and qualitative information.
3. Mitigate
Can the risk be reduced or transferred?
Consider suitable controls, security, diversification, hedging or insurance.
4. Monitor
What indicators will show deterioration?
Set:
limits;
triggers;
review frequency; and
early-warning indicators.
5. Escalate and Review
Who needs to know if the position becomes unacceptable?
Material deterioration and breaches must reach the appropriate authority.
This approach closely reflects Basel’s expectation that banks maintain comprehensive and timely identification, measurement, mitigation, monitoring and reporting of material risks.
CAIIB Exam Focus
Remember these high-value concepts:
Risk identification comes before measurement and mitigation.
One banking transaction can contain several different risks.
Inherent risk exists before considering controls.
Residual risk remains after mitigation and controls.
Risk measurement may be quantitative, qualitative or both.
Lack of precise numerical data does not mean that a risk can be ignored.
Mitigation includes avoiding, reducing, transferring/sharing or accepting risk.
Collateral is a credit-risk mitigant; it does not eliminate borrower default risk.
An accepted risk must still be monitored.
Risk monitoring continues throughout the life of an exposure.
A near miss can reveal important operational risk even without an actual loss.
Off-balance-sheet exposures such as guarantees must be included in risk identification.
Concentration can create risk even when individual exposures appear acceptable.
Insurance transfers part of risk but leaves residual risk.
New products require risk assessment even where historical loss data is unavailable.
Basel requires banks to identify, measure, evaluate, monitor, report and control or mitigate all material risks.
Common Exam Traps
Trap 1: “Risk Identification Means Identifying Only the Main Risk”
Incorrect.
A transaction may create multiple interacting risks.
Trap 2: “Risk Can Be Measured Only Numerically”
Incorrect.
Qualitative assessment is important for many control, legal, emerging and operational risks.
Trap 3: “Collateral Eliminates Credit Risk”
Incorrect.
It normally reduces potential loss but does not remove default, legal, valuation or recovery risk.
Trap 4: “Risk Mitigation Means Risk Elimination”
Incorrect.
Mitigation normally leaves residual risk.
Trap 5: “A Risk within Limit Does Not Need Monitoring”
Incorrect.
Market conditions, counterparties and exposures can change after the original decision.
Trap 6: “No Financial Loss Means No Operational-Risk Event”
Incorrect.
Near misses and control failures can reveal material weaknesses.
Trap 7: “Off-Balance-Sheet Items Do Not Create Risk until Payment Is Made”
Incorrect.
Guarantees and other contingent exposures can create material risk before cash outflow occurs.
Trap 8: “No Historical Loss Means a New Product Is Low Risk”
Incorrect.
New and emerging risks often require forward-looking qualitative assessment.
Memory Technique
Remember I-M-M-M:
I – Identify: What can go wrong?
M – Measure: How serious is it?
M – Mitigate: How can it be reduced, transferred or accepted?
M – Monitor: Is the risk changing?
Then Report and Review whenever the risk, control or exposure changes materially.