1 Internal Control Requirements - a glance at recent Joint Forum findings for the EFCC - Roundtable of 08/09/2008 Jeroen Lamoot

2 Overview of recent market events A systematic credit event spread through the financial markets, affecting many different business lines and activities within the fico’s:  Severe drop in investor demand for any form of securitized product.  Resulted in drawdowns of back-up lines to support SPVs and orginating companies.  Build-up of concentrated exposures from assets in the wharehouse pipeline, or (structured) assets that were brought back on balance sheet.  Collateral requirements challenged the liquidity positions further.  Concentrated exposures also emerged as hedging strategies failed or could not be continued.

Overview of recent market events Con'd: The liquidity squeeze, the higher sensistivity to credit risk and elevated concerns regarding the institutions' health spread to the interbank markets. The losses on and the extensive downgrading on the ABS affected the monoline insurance companies and the municipalities market  The events showed a risk management failure in different areas.  Should evolve to an active, group-wide and integrated risk management. 3

Active, group-wide and integrated risk management "Active" implies:  A constant monitoring and understanding of the evolution (and underlying drivers) within the markets. Forward-looking approach Evolution of the business(es) and review of strategies IIF « Review with senior management how the firm’s strategy is evolving over time and to what extent the firm is deviating from that strategy » 4

Active, group-wide and integrated risk management Active cont’d:  A constant identification and measurement of the potential emergence of concentrated exposures within the firm. Identify and measure new and evolving exposures, potential interacting exposures, etc. (i.e. “identification function”). Go further than first-order observations and potential risk exposures IIF « Support senior management by identifying developing risks, concentrations and other situations that need to be examined via stress testing and other techniques »

Active, group-wide and integrated risk management Active cont’d:  A constant assessment and updating of the risk methods and the parameters given the changing environment. The risk management methods should follow the evolutions in the markets and products. Know the weaknesses of the methods and incorporate them in the risk management. IIF « In a market environment that can produce unprecedented price moves and significant tail risks, seemingly robust risk management tools and frameworks can prove inadequate » 6

Active, group-wide and integrated risk management Active cont’d:  And active management of the risk exposures As a market player, active management of the risk exposures is a necessity. However, active management may lead to additional and sometimes difficult to measure and manage risk exposures.

Active, group-wide and integrated risk management "Group-wide" implies:  A fico should have a firm-wide view of the extent that a certain scenario (single or multiple risk factors) may affect its different business lines and activities. Events clearly showed that different activities may be affected at the same time, potentially compounding the exposures at the different entities. First requirement to assess the risk exposures of the fico. IIF « The lack of a comprehensive approach to firm-wide risk management often meant that key risks were not identifed or effectively managed » 8

Active, group-wide and integrated risk management "Integrated" implies:  A risk management system well entrenched within the overall management that ensures that the potential risks it runs are embedded within the risk and firm- wide management (decisions). IIF, the crisis events showed the « need to strengthen the risk management organisational structures » 9

Active, group-wide and integrated risk management "Integrated" cont’d:  It concerns the integration of the risk management: along the (sectoral) business units of the group along the different risk categories (go beyond silo approach) with the overall management strategies and practices IIF « The cultivation of a consistent risk culture throughout firms is the main enabling tool in risk management » IIF « Eschew the silo approach towards risk management and take a comprehensive approach to risk (integrating strands such as credit, market, operational, liquidity and reputational risk) » IIF «Ensure that the firm’s risk level is consistent with its risk appetite, providing a thoughtful, integrated view of the overall risks the firm faces »

Important sources for the discussion "Cross-sectoral review of group-wide identification and management of risk concentrations", The Joint Forum, April 2008 "Final report of the IIF Committee on Market Best Practices", IFF, July 2008 "Containing systematic risk: The road to reform", The report of the CRMPG III "Credit Risk Transfer - developments from ", The Joint Forum, July 2008 "Report of the Financial Stability Forum on Enhancing Market and institutional resilience", The FSF, April

The current practices - economic capital models and stress testing Economic capital models:  For going-concern / day to day management  Focus lies on calculation of potential diversification effects Stress testing and scenario analysis:  Advantages are flexibility and potential forward-looking feature  Firms were quite reluctant to develop stress test exercises to integrate risk exposures and obtain a more firm-wide perspective  Current exercises should be made more realistic (e.g. towards management buy-ins, issues of market liquidity, second-order effects)  Will remain a complementary tool 12