11/15/2016. Enterprise Risk Management. Building FHLBank Atlanta s ERM Program. FHLBank Atlanta. Navigating the Enterprise Risk Management Landscape

Transcription

1 Enterprise Risk Management Navigating the Enterprise Risk Management Landscape Alp E. Can Director of Enterprise Risk Management, FHLBank Atlanta Virginia Bankers Association November 16, 2016 Building FHLBank Atlanta s ERM Program FHLBank Atlanta Goal: To help shareholder financial institutions make affordable home mortgages and provide economic development credit to their communities One of the 11 regional Banks in FHLBank System 3rd quarter 2016 dividend: 4.64% (LIBOR bps) 3 1

2 FHLBanks and ERM As a matter of sound practice, each FHLBank should have a risk management function or unit(s) with clearly defined responsibilities that reports directly to executive management and has regular reporting responsibility to the board of directors of a committee thereof. The risk management function should not report to business units that undertake risk positioning. Federal Housing Finance Agency Advisory Bulletin May 18, FHLBank Atlanta and ERM Years 1 and 2 ( ) Early challenges Hiring of risk managers and analysts Development of Key Risk Indicators (KRIs) Continuous improvement (assessment quality, reporting) Year 3 and 4 ( ) refinement Model enhancement and methodology development Better analysis and focus on risk versus return (stress testing) Increased ERM personnel involvement on key projects 5 FHLBank Atlanta and ERM Years 5 through 10 ( ) Expansion + increased credibility and trust of ERM team Development of risk appetite statement Created an ERM charter Involvement in strategic planning process Created Model Risk Governance Group Implementing Dodd-Frank Act Stress testing Embed stress testing with strategic planning, risk appetite, and capital planning Future of ERM (2016-beyond) Business Intelligence Using new technology and big data to improve future risk assessments 6 2

3 Why ERM? ERM Defined Enterprise Risk Management (ERM) is the capability of an organization to understand, control, and articulate the nature and level of the risks taken in pursuit of a risk adjusted return. Categories of risk: Credit Liquidity Strategic / Business / Reputation Market Operational Compliance / Legal Financial Capital Adequacy Source: Risk Management Association (RMA) 8 ERM Framework (Rooted in Culture) Ensure the company has significant capital in a stressed environment Stress Testing Develop a response plan to best manage risk Response Coverage Consider all current and potential risks facing business strategy and operations Assess how well the company manages risks Control Environment CULTURE Risk Appetite Determine the amount of risk the company is willing to accept Determine the size and scope of all risks Measurement & Evaluation Governance & Policies Create a strong foundation for risk management Risk Data & Infrastructure Ensure appropriate data is used to manage risk Source: Risk Management Association (RMA) 9 3

4 What Makes a Culture Strong? Honesty Tone at the top Integrity Trust CULTURAL VALUES Proper incentives Courage to speak up and act Independence of thought Openness / transparency Respect for the ideas of others Source: Toward Effective Governance of Financial Institutions,G30 Working Group, Examples of Top Risks/Issues 11 Examples of Recent Risk Events CYBER RISK GEOPOLITICAL RISK June 2015 Exposed PII of over 20 million people June 2016, the U.K. votes to leave the EU Impacted global stock markets and currency valuation Negatively impacted forecasted GDP for U.K. and EU 12 4

5 ERM: Practical Implementation Steps Three Lines of Defense Model Board / Risk or Audit s Senior Management 1 st Line 2 nd Line 3 rd Line Operational Management Internal Controls Risk management by business operations Risk Oversight Compliance Independent risk oversight and compliance Internal Audit Independent evaluation of risk management effectiveness EXTERNAL AUDIT REGULATOR 14 Risk Appetite Statement Strategic Plan Risk Assessment Capital Plan Incentive Comp Plan Risk Appetite Framework Internal Risk Policies Risk Reports (i.e., ALCO) Other Key Internal Documents IT Risk Tolerance Statement 15 5

6 Stress Testing: A Fundamental ERM Tool Source: Supervisors Raising the Bar on ERM. Promontory, Sightlines in Focus, February Final Thoughts Effective ERM = more intelligent risk-taking, fewer loss events Implementation takes years and commitment Pace toward maturity determined by CEO and board commitment and demonstrated value Developing a balanced risk/return culture is a journey Developing a comprehensive risk assessment that includes emerging risks 17 APPENDIX 6

7 Organizational ERM Structure/Team Board Board Risk CEO CRO Independent ERM Units Credit Risk Team Market Risk Team Ops Risk Team Model Risk Team 19 Board Structure BOARD OF DIRECTORS Overall Risks Business Risks Strategic Risks Reputation Risks Audit Finance Credit & Member Services Enterprise Risk & Operations Governance & Compensation Housing & Community Investment Financial Market Risks Reporting Risks Liquidity Risks Overall Compliance Risks Capital Risks Fraud Risks Earnings Risks Internal Controls Credit Risks Collateral Risks Enterprise-wide Risks Risk Appetite Operational Risks Emerging Risks Black Swans Human Resources Risks Disclosure Risks (CD&A) Affordable Housing Program Compliance Risks 20 Management Structure IT Steering Credit & Collateral Asset/Liability Enterprise Risk IT Governance Collateral Model Valuation Financial Management Strategy Operational Risk Security Governance Retirement Plan Community Investment Services Accounting Policy Disclosure 21 7

8 Risk Identification and Assessment 22 Risk Assessment: Key Risk Indicators and Trends 23 Risk Appetite Statement/Report (Community Bank Template) Sample Template Risk Category Capital Adequacy Market Risk / Earnings Credit Risk (Concentration) Liquidity Compliance / Regulatory Reputation/Strategic Operational Risk Risk Appetite Report As of Risk Level Risk Appetite Levels Risk Appetite Categories Current Previous Zero Low Moderate High Capital Adequacy Market Risk / Earnings Credit Risk (Concentration) Liquidity Compliance / Regulatory Reputation/Strategic Operational Risk Key Risk Indicators: Focus Group vs. All Banks Regulatory Leverage Ratio (%) All Banks (Avg) Focus Group (Avg) Loan Loss Reserves / Gross Loans (%) Texas Ratio All Banks (Avg) Focus Group (Avg) Net Non-Core Funding Dependence 2 (%) NPAs / Assets (%) All Banks (Avg) Focus Group (Avg) Efficiency Ratio (%) All Banks (Avg) Focus Group (Avg) All Banks (Avg) Focus Group (Avg) All Banks (Avg) Focus Group (Avg) 24 8

9 1.a. Achieve satisfactory CAMELS ratings for Capital Adequacy 1.b. Maintain Total Equity / Total Assets w ithin acceptable limits (%) 1.c. Maintain capital ratios above regulatory capital requirements 1.d. Maintain Leverage Ratio w ithin acceptable levels 2.a. Achieve satisf actory CAMELS ratings for Sensitivity to Market Risk 2.b. Maintain Duration Gap above acceptable levels w ith up/dow n 100, 200, 300 bps rate shocks 2.c. Maintain EVE above acceptable levels w ith up/dow n 100, 200, 300 bps rate shocks 2.d. Maintain Interest Expense/ Avg. Assets w ithin acceptable limits (%) 2.e. Rate-sensitive Assets/Assets (%) 2.f. Rate-sensitive Liabilities/Assets (%) 3.a. Achieve satisfactory CAMELS ratings for Asset Quality 3.b. Maintain NPA's (Non-Performing Assets) / Assets w ithin acceptable level (%) 3.c. Maintain NPL's (Non-Performing Loans) / Loans within acceptable level (%) 3.d. Maintain ALLL w ithin acceptable level 3.e. Maintain Commercial Real Estate (CRE) Loans / Total RBC w ithin acceptable level (%) 3.f. Maintain Residential 1-4 within limits to RBC (%) 3.g. Maintain C&I w ithin limits to RBC (%) 4.a. Achieve satisfactory CAMELS ratings for Liquidity 4.b. Maintain satisfactory Net Non-Core Funding Dependence (%) 4.c. Maintain satisfactory Net Short-Term Liabilities / Assets (%) 4.d. Maintain satisfactory FHLB funding availability 4.e. Maintain acceptable liquidity ratios (%) 4.f. Maintain acceptable levels of pledged securities 5.a. Achieve a satisfactory exam report 5.b. Number of Internal audit reports less than satisfactory (%) 5.c. Number of external audit reports less than satisfactory 5.d. Number of customer complaints 5.e. Number of new or proposed regulations or legislation 5.f. Minimize Bank Secrecy Act / Anti-Money Laundering related losses ($000s) 6.a. Achieve satisfactory CAMELS ratings for Management 6.b. Number of active litigation matters 6.c. Community Reinvestment Act activities 6.d. Tone of new s reports (positive/negative) 6.e. Succession planning in place for senior management / key personnel (%) 6.f. Achievement of strategic goals 7.a. Number of material weaknesses 7.b. Maintain acceptable level of operational losses ($000s) 7.c. Maintain high level of critical system availability (%) 7.d. Maintain adequate insurance coverage (e.g. f lood / hazard) (%) 7.e. Maintain optimal level of employee headcount (%) 7.f. Minimize confidential data breaches Green Yellow Red Outstanding or Satisfactory *P rio r Rating Needs to Improve Substantial Noncompliance Green Yellow Re d Internal Sources Current Level Previous Level Risk Trend Board Oversight Not w illing to accept risks under any circumstances Not w illing to accept risks in most circumstances Willing to accept risks in certain circumstances Willing to accept risks in most circumstances Aggregate Risk Score Less than 80 -n/a BP Budget Plan CP Capital Plan ICP Incentive Comp Plan IP Internal Bank Po licies IndividualRisk Level Acceptable At Risk Unacceptable Increasing Risk Stable Risk Decreasing Risk AC Audit CC Credit ERC Enterprise Risk FC Finance GCC Governance & Compensation 11/15/2016 Risk Appetite Statement/Report (Community Bank Template) Risk Categories 1. Capital Adequacy 2. Market Risk / Earnings 3. Credit Risk (Concentration) 4. Liquidity Sample Template 5. Compliance / Regulatory 6. Reputation/Strategic 7. Operational Risk Risk Appetite Key Risk Indicators as of Risk Appetite Level Definitions Internal Documents Zero Low Moderate High Legend Board s 25 Risk Appetite Statement/Report (Community Bank Template) Sample Metrics / Data Risk Appetite Key Risk Indicators as of 1. Capital Adequacy 3. Credit Risk 1.a. Achieve satisfactory CAMELS ratings a. Achieve satisfactory CAMELS for Capital Adequacy ratings for Asset Quality b. Maintain Total Equity / Total Assets 3.b. Maintain Non-Performing Assets / 4 6 within acceptable limits (%) Assets within acceptable level (%) c. Maintain capital ratios above c. Maintain Non-Performing Loans / regulatory capital requirements (%) Loans within acceptable level (%) d. Maintain Leverage Ratio within d. Maintain ALLL within acceptable acceptable levels (%) level ($000s) Market Risk / Earnings 3.e. Maintain CRE Loans / Total RBC within acceptable level (%) a. Achieve satisfactory CAMELS ratings for Sensitivity to Market Risk f. Maintain Residential 1-4 within limits to RBC (%) b. Maintain Duration Gap between acceptable levels with up/down 100, 200, 300 bps rate shocks (years) 2.c. Maintain EVE above acceptable levels with up/down 100, 200, 300 bps rate shocks 2.d. Maintain Interest Expense/ Avg. Assets within acceptable limits (%) 2.e. Rate-sensitive Assets/Assets (%) g. Maintain C&I within limits to RBC (%) 4. Liquidity 4.a. Achieve satisfactory CAMELS ratings for Liquidity b. Maintain satisfactory Net Non-Core Funding Dependence (%) c. Maintain satisfactory Net Short- Term Liabilities / Assets (%) 2.f. Rate-sensitive Liabilities/Assets (%) Legend 4.d. Maintain satisfactory FHLB funding availability Risk is within acceptable threshold Increase in risk as threshold has been breached Increase in risk as threshold has been breached Current Level 12 - month Avg 4.e. Maintain acceptable liquidity ratios (%) 4.f. Maintain acceptable levels of pledged securities Risk Appetite Statement/Report (Community Bank Template) Sample Metrics / Data 5. Compliance / Regulatory 5.a. Achieve a satisfactory exam report Risk Appetite Key Risk Indicators as of 7. Operational Risk a. Number of material weaknesses b. Number of Internal audit reports less b. Maintain acceptable level of than satisfactory (%) operational losses ($000s) c. Number of external audit reports less c. Maintain high level of critical than satisfactory system availability (%) d. Number of significant customer d. Maintain adequate insurance complaints coverage (e.g. flood / hazard) (%) e. Maintain optimal level of employee 5.e. Number of new or proposed headcount (%) regulations or legislation f. Minimize Bank Secrecy Act / Anti f. Minimize confidential data Money Laundering related losses breaches ($000s) 6. Reputation / Strategic 6.a. Achieve satisfactory CAMELS ratings for Management 6.b. Number of active litigation matters * 6.c. Community Reinvestment Act activities 6.d. Tone of news reports (positive/negative) - qualitative measure Legend 95 6.e. Succession planning in place for senior management / key personnel (%) Risk is within acceptable threshold Potential increase in risk as threshold has been breached Increase in risk as threshold has been breached Current Level 12 mo. Average 6.f. Achievement of strategic goals 27 9

10 Risk Appetite Statement/Report (Community Bank Template) 28 Questions and Answers Alp E. Can Director of Enterprise Risk Management FHLBank Atlanta Tel: