Bulletin Board         

13^th August 2001

DBS.CO/ RBS/58/36.01.002/2001-02

All Scheduled Commercial Banks
(Except Regional Rural Banks)

Dear Sirs,

Please refer to paragraph 76 of our Governor's statement on 'Monetary and Credit Policy for the year 2000-2001' wherein it has been stated that the Reserve Bank would be developing an overall plan for moving towards Risk-based Supervision (RBS) with the assistance of international consultants. Accordingly, Pricewaterhouse Coopers (PwC), a firm of consultants based in London, were engaged to undertake a review of the current regulatory and supervisory regime and prepare the blue print for the transition to a more sophisticated system of RBS incorporating international best practices. A discussion paper on the 'Move towards Risk-based Supervision of banks' has been prepared summarizing the recommendations of the consultants and is enclosed.

2. It may be observed from the discussion paper that the Reserve Bank would focus its supervisory attention on the banks in accordance with the risk each bank poses to itself as well as to the system. The risk profile of each bank would determine the supervisory programme comprising off-site surveillance, targeted on-site inspections, structured meetings with banks, commissioned external audits, specific supervisory directions and new policy notices in conjunction with close monitoring through a Monitorable Action Plan (MAP) followed by enforcement action, as warranted. The successful implementation of the process of RBS entails adequate preparation, both on the part of the Reserve Bank and the commercial banks.

3. The introduction of RBS would require the banks to reorient their organisational set up towards RBS and put in place an efficient risk management architecture, adopt risk focused internal audit, strengthen the management information system, and set up compliance units . The banks would also be required to address HRD issues like manpower planning, selection and deployment of staff and their training in risk management and risk based audit. It is evident that change management is a key element in RBS and the banks should have clearly defined standards of corporate governance, well documented policies and efficient practices in place so as to clearly demarcate the lines of responsibility and accountability so that they align themselves to meet the requirements of RBS.

4. The discussion paper may please be placed before the Board of Directors for deliberation in the next meeting. The comments of the bank on the various aspects of the discussion paper may please be forwarded to us as early as possible but before September 30, 2001.On the basis of the feed back received from the banks further discussions would be held.

5. In the meanwhile, kindly acknowledge receipt.

(A.L.Narasimhan)

Chief General Manager-in-charge

Encl: Discussion paper on "Move towards Risk Based Supervision of banks"

1. The international banking scene has in recent years witnessed strong trends towards globalization and consolidation of the financial system. Stability of the financial system has become the central challenge to bank regulators and supervisors throughout the world. The multi-lateral initiatives leading to evolution of international standards and codes and evaluation of adherence thereto represent resolute attempts to address this challenge.

2. The Indian banking scene has witnessed progressive deregulation, institution of prudential norm and an emulation of international supervisory best practices. The supervisory processes have also concomitantly evolved and have acquired a certain level of robustness and sophistication with the adoption of the CAMELS¹/CALCS² approach to supervisory risk assessments and rating. The tightening of exposure and prudential norms and enhancement in disclosure standards in phases over a period of time have more closely aligned the Indian banking system to international best practices. Reserve Bank of India (RBI) has been constantly endeavouring to enhance the sophistication and efficiency levels of its supervisory processes.

3. The announcement made by the Governor, RBI, as part of the monetary and credit policy statement for 2000-2001 that RBI would be developing an overall plan for moving towards risk-based supervision (RBS) with the assistance of international consultants signified the launch of a new initiative in this direction. Pricewaterhouse Coopers (PWC) based in London, were selected to undertake a review of the current regulatory and supervisory processes of the RBI with a view to assisting in the introduction of risk based regulation and supervision in India. The RBS will be a regime in which RBI's resources will be directed towards the areas of greater risk to its supervisory objectives. There are two legs to implementing effective risk-based processes: first, explicit supervisory objectives must be set and secondly, the risks posed to these objectives by the activities of commercial banks must be assessed and addressed. The current review represents further stage in the overall development of RBI's approach to regulating and supervising banks in the light of the earlier Padmanabhan Committee and Narasimham Committee reports. Based on the work of the international consultants, RBI intends to move towards a RBS system in stages.

4. The current supervisory process adopted by the Department of Banking Supervision (DBS) is applied uniformly to all supervised institutions. Though scrutiny of systems and procedures prevailing in supervised institution is an integral part of on-site inspection, there is scope for more focus on the risk profile of the institutions. The current approach is largely on-site inspection driven supplemented by off-site monitoring and the supervisory follow-up commences with the detailed findings of annual financial inspection. The process is based on CAMELS/CALCS approach where capital adequacy, asset quality, management aspects, earnings, liquidity and systems and control are examined keeping in view the requirements of Section 22 of the Banking Regulation Act, 1949. The on-site inspections are conducted, to a large extent with reference to the audited balance sheet dates. The off-site and market intelligence play a supplemental role. While in several external jurisdictions, the supervisory process extensively leverages on the work done by others, such as the internal and external auditors, the use made of these resources in India is rather limited. No legal framework exists for the external auditors to report to the supervisor their adverse findings on issues having supervisory implications.

5. Considering the growing diversities and complexities of banking business, the spate of product innovation with complex risk phenomena, the contagion effects that a crisis can spread and the consequential pressures on supervisory resources, the RBS approach, the foundation of which would be based on the CAMELS based approach, would be more appropriate. By optimizing the synergies from the different activities, including the regulatory and supervisory functions, the overall efficiency and effectiveness of the supervisory process can be substantially enhanced.

6. The RBS approach essentially entails the allocation of supervisory resources and paying supervisory attention in accordance with the risk profile of each institution. The approach is expected to optimize utilisation of supervisory resources and minimize the impact of crisis situation in the financial system. The RBS process essentially involves continuous monitoring and evaluation of the risk profiles of the supervised institutions in relation to their business strategy and exposures. This assessment will be facilitated by the construction of a Risk matrix for each institution.

7. The instruments of RBS will be by way of enhancement as well as refining of the supervisory tools over those traditionally employed under the CAMELS approach viz. on-site examination and off-site monitoring. The RBS processes and the outcome will be forward looking beyond focusing attention on the rectification of deficiencies with reference to the on-site inspection date. The extent of on-site inspection would be largely determined by the quality and reliability of off-site data, and the reliability of the risk profile built up by banks. The effectiveness of the RBS would clearly depend on banks' preparedness in certain critical areas, such as quality and reliability of data, soundness of systems and technology, appropriateness of risk control mechanism, supporting human resources and organisational back-up.

The major elements of RBS approach are set out below:

8. The central plank for RBS is an accurate risk profiling for each bank. The risk profile would be a document, which would contain various kinds of financial and non-financial risks faced by a banking institution. The risk assessment would entail the identification of financial activities in which a bank has chosen to engage and the determination of the types and quantities of risks to which these activities expose the banking institution. The type of risk that banking institution face individually or in combination include, but are not limited to, credit, market, liquidity, operational, legal and reputational risks. The quantity of risks associated with a given activity may be assessed by the volume of assets and the off-balance sheet items that the activity represents or the portion of revenue derived from that activity. Activities that are new to an institution or for which exposure is not readily quantifiable may also represent high risk to an institution that would also be evaluated and included in the risk profile document. The risk profile will also be designed to provide a systematic assessment from the supervisor's perspective of the adequacy and effectiveness of the bank's organisation, management and controls. The main risk-profiling device at present is the CAMELS rating based on on-site inspection, which in course of time will be derived from off-site returns and other information. CAMELS rating would continue to be the core of risk profile compilation, but the successive ratings would be used to reflect trends in contrast to being used as a static annual indicator of risk.

9. The risk profile of each bank will draw upon a wide range of sources of information, besides CAMELS rating, such as, off-site surveillance and monitoring (OSMOS) data, market intelligence reports, ad-hoc data from external and internal auditors, information from other domestic and overseas supervisors, on-site findings, sanctions applied etc. The data inputs would be assessed for its significance and quality before being fed into the risk profile. All outliers i.e. banks which fall outside the normal distribution based on characteristics such as profitability, new business activity, balance sheet growth etc. would be identified on the basis of a two-tailed test (i.e. too good or too bad) and investigated on a regular basis. The risk profile would be constantly updated.

10. The key components of the risk profile document would be the following:

• CAMELS rating with trends
• Narrative description of key risk features captured under each CAMELS component
• Summary of key business risks including volatility of trends in key business risk factors
• Monitorable action plan and bank’s progress to date
• Strength, Weaknesses, Opportunities, Threats (SWOT) analysis
• Sensitivity analysis

RBI would undertake a formal assessment of the risk profile of each bank on a regular basis. The period between assessments would vary depending on the materiality of the risk profile of a bank, with an average period of one year. However, more frequent assessments would be resorted to for higher risk banks and less frequent assessment for lower risk banks.

11. The supervisory process would commence with the preparation of the bank risk profile (based on data furnished by banks to the DBS of RBI, besides data from other sources). The supervision cycle will vary according to risk profile of each bank, the principle being the higher the risk the shorter will be the cycle. The supervision cycle will remain at 12 months in the short-term and will be extended beyond 12 months for low risk banks at a suitable stage. In cases where more frequent application of supervisory process will be necessary, the cycle could even be lesser than 12 months.

Supervisory programme

12. RBI would prepare a bank specific supervisory programme which will set out the detailed work plan for the bank. The scope and objectives of the inspection programme will derive from analysis of risk profile. The supervisory programme would be tailored to individual banks and would focus on the highest risk areas as well as specify the need for further investigation in identified problem areas. The supervisory programme would be prepared at the beginning of the supervisory cycle and would yet be flexible enough to permit amendments warranted by subsequent major developments. The supervisory programme would also identify the package of supervisory tools to be deployed from a range consisting of:

• greater off-site surveillance
• targeted on-site inspection
• structured meetings with banks
• commissioned external audits
• specific supervisory directions
• new policy notices (i.e. new policy directions to banks emanating from individual bank level concerns which are relevant for the industry)

On-site inspection would be largely targeted to specific areas unless a full scope inspection is warranted as per the bank-specific supervisory progamme. A monitorable action plan (MAP), the details of which are given later, to mitigate risks to supervisory objectives posed by individual banks would be drawn up for follow-up. Variable supervisory cycles and variable frequency of inspections would therefore characterise the supervisory process under RBS.

13. The risk assessment of individual banks would be performed in advance of on-site supervisory activities. The risk assessment process would highlight both the strengths and vulnerabilities of an institution and would provide a foundation from which to determine the procedures to be conducted during the inspection. The current full-scope on-site inspections, which are carried out annually cover a substantive asset evaluation. The inspections under the new approach would be largely systems based rather than laying emphasis on underlying transactions and asset valuations. The inspection would target identified high-risk areas from the supervisory perspective and would focus on the effectiveness of mechanism in capturing, measuring, monitoring and controlling various risks. The inspection procedure would continue to include transaction testing and evaluation the extent of which will depend on the materiality of an activity and the integrity of the risk management system and the control process.

14. An evaluation will be undertaken to ensure that the supervisory programme has indeed been completed and been effective in improving the risk profile of the bank concerned. If need be, further tools will be employed including additional inspection visits. The findings of inspection and other supervisory information on records would be used to produce a comprehensive document of supervisory risks and the bank’s assigned ratings for follow-up of supervisory concerns. The risk profile document of the bank will accordingly be updated in the light of new information. This process will support the issue of the supervisory letter to the bank, which would be discussed with the bank’s management or the Board of Directors.

15. The aim of supervisory follow-up would be to ensure that banks take corrective action in time to remedy or mitigate any significant risks that have been identified during the supervisory process. The major device in this respect would be the MAP. MAPs are already used by RBI to set out the improvements required in the areas identified during the current on-site and off-site supervisory process. However, MAPs would be made more robust in a number of ways. MAPs will in many cases include directions to banks on actions to be taken. The remedial actions that would be outlined, would be tied explicitly to the areas of high risks identified in the risk profiling as well as the supervisory process and should lead to improvements in the systems and controls environment at the bank. Key individuals at the bank would have to be made accountable for each of the action points. If actions and timetable set out in the MAP are not met, RBI would consider issuing further directions to the defaulting banks and even impose sanctions and penalties.

16. Within the RBI, the regulatory and supervisory structure function separately at present making it necessary for banks to have more than one contact point with the RBI Regulation (DBOD) and Supervision (DBS) departments for their interaction on supervisory and regulatory issues. As the bank specific issues would be with reference to the broad regulatory framework in place, a Central Point of Contact in RBI would be of convenience to banks. Under the RBS, there would be a focal point for all contacts by banks both at the Central Office of RBI and its ROs, in respect of all matters relating to regulatory/supervisory issues. This focal point would be the main conduit for information and communication between the banks and RBI.

17. While the aim of supervisory follow-up is to ensure that banks take corrective action to mitigate significant risks, the persistence of deficiencies would pose a risk to RBI’s supervisory objectives. A system of incentives and disincentives has been contemplated under the RBS to better serve attainment of these objectives. Banks with a better compliance record and a good risk management and control system could be entitled to an incentive package which could be in the form of longer supervisory cycle and lesser supervisory intervention. The banks, which fail to show improvement in response to the MAP, would be subjected to a disincentive package such as, more frequent supervisory examination and higher supervisory intervention including directions, sanctions and penalties. The mandatory and discretionary actions as enshrined in the Prompt Corrective Action (PCA) framework would be a part of the supervisory enforcement action. The enforcement function would be carried out through an independent Enforcement Cell to be set up at the BSD to ensure consistency of treatment, maintain objectivity and neutrality of enforcement action.

18. The use of specialist third parties, such as, external auditors can be of significant aid to the bank supervisors. In some countries, external auditors are required to perform an early warning function and inform supervisors without delay of information material to the supervisor. The Basel consultative paper ‘Internal audit in banks and the relationship of the supervisory authorities with internal and external auditors’ discusses the commonality of focus and concern of external auditors and bank supervisors. The supervisory process instead of duplicating the efforts of the external and internal auditors in some areas should seek to leverage off the work done by these agencies. Towards part achievement of this goal, the LFAR format, which is currently under revision, will have to be brought into use at the earliest. RBI would look forward to make more use of external auditors as a supervisory tool by widening the range of tasks and activities which external auditors perform at present. RBI would enter into dialogue with the Institute of Chartered Accountants of India and the bank management to chalk out an action plan.

19. Change management is a key element in ensuring that switchover to RBS takes place in an orderly and effective manner. Banks should have clearly defined standards of corporate governance and documented policies and practices in place so as to clearly demarcate the lines of responsibility and accountability. They will have to address several organisational issues to realign themselves to meet the requirements of RBS. The details of actions that need to be taken by banks are enumerated in Part II.

20. Bank level preparations

With the progressive deregulation of the financial system as also to address systemic concerns on the safety and soundness of the banking system, RBI advised banks in India in February 1999 to introduce, effective from April 1, 1999, a scientific system of Asset-Liability Management. RBI also issued in October 1999 comprehensive guidelines for putting in place an effective and comprehensive Risk Management System. The guidelines envisaged that banks would set up proper organizational structure, policies, procedures, limits for credit, market and operational risk management. Under the ALM guidelines banks were expected to cover 100% of their assets and liabilities by April 1, 2000. A review undertaken by RBI has revealed that most of the banks are yet to cover 100 per cent of their assets and liabilities for ALM or set up proper risk management systems and policies for managing credit, market, operational and other risks.

As stated earlier in paragraph 13, supervisory resources would be focused on the areas of higher risks to a bank. The risk profile would highlight both the strengths and vulnerabilities of a bank and would provide a foundation from which to determine the procedures to be conducted during an on-site examination.

Under a risk-focused on-site examination approach, the degree of transaction testing would be reduced when internal risk management processes are determined to be adequate or risks are considered minimal. When, however, risk management processes or internal controls are considered inappropriate, additional transaction testing sufficient to fully assess the degree of risk exposure in a function or activity would be performed. It would be necessary for banks to carry out a fresh review of their current status of risk management architecture by an expert team and initiate measures to bridge the gaps.

Internal Audit is an independent activity designed to improve the bank's operations. The internal audit function is a part of the ongoing monitoring of the system of internal control and assists the staff in effective discharge of their responsibilities. The success of internal audit function depends largely on the extent of reliance the bank management would place in guiding the bank's operations. The Internal Audit Department will therefore have to be independent from the internal control process and be given an appropriate standing within the bank to carry out its assignments with objectivity and impartiality. The Internal Audit Department should therefore be provided with appropriate resources and staff to achieve its objectives. Historically, the internal audit system in banks has been concentrating on: (i) transaction testing, accuracy and reliability of accounting records and financial reports, (ii) testing of integrity, reliability and timeliness of control report, and (iii) adherance to legal and regulatory requirements. Though transaction testing would remain a reliable and essential examination aspect of internal auditing, in the changing scenario such testing by itself would not be sufficient. Over the years, the evolvement of financial instruments and markets have enabled banks to reposition their portfolio risk exposure. It has become clear that periodic assessment based on transaction testing alone cannot keep pace with the rapid changes occurring in financial risk profiles. In this context the widening of the scope of internal auditing assumes significance. The internal audit would have to capture in a larger way the application and effectiveness of risk management procedures and risk assessment methodology and critical evaluation of the adequacy and effectiveness of the internal control systems. The internal audit department should pay special attention to auditing the banking activity in all the places through which the activity is undertaken. The precise scope of work of internal auditing must be determined by each bank but as a minimum, must review and report upon the control environment as a whole, the process by which risks are identified, analysed and managed, the line of controls over key processes, the reliability and integrity of corporate management function, safeguarding of assets and compliance with rules and regulations.

To achieve these objectives, banks would have to gradually move towards risk focused auditing, in addition to the system of selective transaction based auditing. The implementation of risk based auditing would mean that greater emphasis is placed on the internal auditor's role of mitigating risks. By focussing on effective risk management the internal auditor would not only offer remedies for current trouble areas but also anticipate problems and play an important role in protecting the bank from risk hazards. The risk based auditing would not only cover assessment of risks at the branch level but would also cover, as an independent assessing authority, assessment of risks at the corporate level and the overall process in place to identify, measure, monitor and control the risks. In order to focus attention on areas of greater risk to the bank, a location-wise and activity-wise risk assessment should be performed in advance of on-site risk based auditing. This would allow identification of high risk areas which would enable prioritising the activities and locations for risk based audit. If initial inquiries into the risk management system raise material doubt as to the system's effectiveness, no significant reliance should be placed on the system and a more extensive series of tests need to be undertaken to ensure that the bank's exposure to risk from a given function or activity is accurately captured and monitored. The high-risk areas need to be looked into more frequently than the low risk areas.

Risk based audit would be an aid to the ongoing risk management by banks, as it would provide checks and balances in the system. The banks could form a small Committee of executives and entrust them with the responsibility to chalk out an action plan, implement and monitor the progress in adoption of risk management systems and risk focused audit and report to the Top Management and Board of Directors periodically.

3. Strengthening of Management Information System
   and Information Technology

A principal foundation for RBS is the availability of detailed data. Under RBS the monitoring needs of RBI will differ based on the risk profile of a bank and accordingly RBI may require banks to provide information in addition to the data now being furnished in the OSMOS returns. Consequently, there is a need to devise a policy for backup and storage of various databases on regular intervals. The policy should specify details like frequency of backups, media to be used, off-site storage areas, departments and officials (Data Managers) responsible for these actions. The accuracy, completeness and the timeliness of data are very important and would have to be ensured by banks through up-gradation of their management information and information technology systems. The Data Manager's role should be created in order to ensure that the data has integrity, is stored in correct place, comprehensive and timely. The Data Managers should be made responsible for specific databases. Banks should review the present status of the management information and information technology systems and initiate necessary measures to ensure that RBI data needs as well as supervisory reporting systems are streamlined.

A major transitional task towards completion of risk management set up and introduction of risk based audit will be the reorientation of the staff to meet the required objectives. The potential primary obstacles will be the skill formation of the staff and placement in appropriate positions. Banks may have to create a dedicated risk management team at head office and reorient the Internal Audit Department to undertake risk-based audit. These objectives could be attained through addressing several HRD issues like manpower planning, selection and deployment of staff and extensive training in risk management including asset liability management and risk based audit. The banks will have to adopt a forward looking training arrangement through appropriate course designing and compilation of training materials keeping in view the best international practices and procedures.

(e) Setting up of Compliance Unit

Banks are required to take corrective action to remedy or mitigate any significant risks which have been identified in the earlier part of the supervisory cycle and which have been incorporated into the current risk profile. RBI will issue bank specific MAP which will include directions to banks on actions to be taken. If the actions and timetable set out in the MAP fail to be met, RBI may issue further directions or impose sanctions or take mandatory and discretionary actions, if deficiencies continue to persist. It is therefore necessary for banks to set up a dedicated compliance unit to coordinate various actions of the bank for compliance and for periodical reporting to RBI, and ensure the completion of compliance action within the time period indicated in the MAP. The compliance unit should be headed by a Chief Compliance Officer of the rank of not less than a General Manager who will be responsible and accountable for timeliness and accuracy of the compliance.

21. The major transitional task would be the reorientation of organizational set up by banks in line with the recommendations for bank level preparation. The main obstacle during the transitional period would be skill formation, attitudinal changes, development and retention of specialist staff, extensive training and redeployment of staff. It is not contemplated to change over to RBS approach in one go. It will be implemented in a gradual manner. However, the shift to RBS approach would not necessarily await the completion of bank level preparation. The concept is intended to be rolled out at the earliest, as the inadequacies in risk management systems in banks will themselves be a supervisory risk. As the CAMELS rating would be an important input in bank risk profiling, the CAMELS approach through on-site inspection would concurrently be followed along with the RBS approach in the shorter term. The procedure would be reviewed at the appropriate time in the light of the quality of Management Information System in banks and the accuracy and completeness of relevant off-site data furnished to the BSD of RBI which would then form the basis for compilation of CAMELS rating. At that stage, the on-site inspection for CAMELS rating would be by way of exception.

22. It is intended to roll out the RBS process in phases beginning from the last quarter of the financial year 2002-2003. It is, therefore, necessary for banks to initiate immediate measures for completion of the tasks indicated in paragraph 21 of this document by the end of the calendar year 2002. Banks may like to set up an in-house change management team to monitor the progress of implementation and suggest ways and means to overcome the obstacles.