IOPS Toolkit for Risk-based Supervision Module 5: Supervisory Response

Supervisory Response Matrix A fundamental aspect of risk-based supervision is that a logical connection should be made between the outcome of any risk analysis undertaken and the nature of the subsequent supervisory action taken in response Supervisory response matrixes help plan supervisory actions + timetables, allow resources to be used efficiently and make the supervisory approach more transparent The number of rows and columns in the response matrix will depend on the preferences of the supervisory authority and the environment in the country Thresholds need to be set which highlight suitably risky cases, but equally do not place too much burden on what is often a limited number of supervisory staff (most funds should fall into the lower risk categories)

APRA PAIRS/SOARS

TPR Risk + Intervention Model

Supervisory Response Matrix: Inputs

Supervision Matrix: HFSA

Control Mechanisms Quality control mechanisms ensure he supervisory response is proportionate and consistent Balance needs to be struck between individual supervisor’s judgement and central control Mechanisms include:  peer reviews  sign off protocols  benchmarking sessions  internal comparisons and validations  training Ensuring that internal control mechanisms do not become too cumbersome is key The matrix and supervisory response categories should be reviewed regularly / back tested Special attention needs to be given to prioritising between ‘high risk’ institutions Oversight tools for ‘low risk’ institutions include:  information campaigns (informing small entities of their regulatory requirements)  random inspections (detecting non-compliance, acting as a deterrent and protecting the supervisors credibility)  and / or themed inspections, including sampling

Communication A risk-based approach to supervision involves different dynamics in terms of communication between the supervisory authority and the supervised entity Rather than simply notifying the entity that a rule has been broken, the assessment of supervisory judgement needs to be communicated The supervisory authority has to decide whether to disclose the results of the risk assessment to the institution itself and, if so, the extent to which details are communicated Conditions under which public disclosure of risk assessments might be appropriate must also be considered When it comes to releasing a risk-score to the public as a whole, clearly a balance needs to be struck between clarity and dialogue between the authority and the institution (and publicity acting as a deterrent factor) and confidentiality (so that panic and flight from institutions is not induced)

Enforcement Pyramid