Governance Flashcards
(12 cards)
What are the three lines of defence within the governance framework?
- Business owners who own and manage risk
- ERM, compliance and other functions that monitor and oversee risk policies.
- Internal and external auditors and audit teams who provide independent risk monitoring
Who is responsible for ensuring adequate governance guidelines have been established?
CEO
Main processes involved in risk taking are
- Credit origination
- Credit risk assessment
- Credit Approval
Key principles of effective governance
Guidelines: Clear guidelines should be present around approvals, for transactions that give rise to credit risk.
Skills: Authority must be delegated to those with proper skills
Limits: Adequate risk and transaction limits must be set
Oversight: Employees and functions should be subject to oversight by qualified and independent people.
Characteristics of Risk Guidelines
Understandable, concise, precise, and accessible
Guideline topics should contain
- Purpose of guidelines
- Methodology used
- Transaction approval flow and delegation of authority
- Process of handling new products and markets
- Process to review/ update the guidelines
- Consequences for employees who breach or fail to adequately follow guidelines
Steps to delegation of authority
Step 1: Assign risk parameters to each transaction
Step 2: Delegate authority based on those parameters
Transaction parameters should include
- Exposure amount
- Credit quality
- Tenor of exposure
Effective oversight requires
- Independence
- Strong qualifications
- Closeness to business
- An open mind
Transaction parameters
Amt of exposure: Measuring potential losses
Credit quality: Risk of losses from transactions with counterparties
Length of exposure (tenor): Should have good understanding of the period during which they are exposed to potential losses
Credit Committee
Tends to comprise of senior executives and is used for making decisions regarding important or high risk transactions.
Committee members should have sufficient expertise with a deep understanding of risks and should include key functions of the organization, including business units, risk management, tax, and accounting, compliance and legal.
Risk managers
Should directly report to CRO to maintain independence.
