1. Establishing a Modern Risk Management Department Sponsor: Central Bank of Libya Presenter: Financial Services Volunteer Corps January 19 - 22, 2009

2. 22 Establishing a Modern Risk Management Department FSVC Presenters: Howard Stein – New York, NY Garrett R. Glass – Chicago, IL

3. 33 Agenda January 19 Opening Remarks by Central Bank of Libya The Principles of Bank Risk Management (Howard Stein) Organizing Your Bank Using Risk Management (Garrett Glass) End of Day 1

4. 44 Agenda January 20 Managing Different Types of Risk Market and Credit Risk (Garrett Glass) Managing Different Types of Risk – Operational risk and Payment Systems risk (Howard Stein) Reputation Risk (Howard Stein) End of Day 2

5. 55 Agenda January 21 Basel 2 and Bank Risk Management (Garrett Glass) Case Study (Howard Stein and Garrett Glass) Summary of Course (Howard Stein) End of Day 3

6. 66 Day One Organizing Your Bank Using Risk Management Garrett Glass Period 9:50 to 11:00 AM January 19, 2009

7. 77 Risk Management in Banking –Bank functions can be divided into two risk categories: risk taking functions, and risk managing/facilitating functions Risk taking functions are the responsibility of line managers Risk managing/facilitating functions are the responsibility of staff managers Organizing Your Bank Using Risk Management

8. 88 Risk Management Roles –Line functions initiate and manage risk –Staff functions control and facilitate risk management –Individuals, not departments or groups, are the primary risk managers Organizing Your Bank Using Risk Management

9. 9 Risk Management Model By Function Organization Policies/Procedures Planning/Training Communications/ Reporting Risk Analysis Risk Controls Portfolio Valuation Oversight/ Monitoring By Function Wholesale Banking Retail Banking Asset Management Capital Markets Cash Management Payments/Settlements By Risk Credit Market Operational Other Economic Risk Management Department Senior Management Sets Objectives/Manages Processes Line Management Line Responsibility Staff Independence Transparency Integrity Shared Corporate Risk Values/ Risk Culture

10. 10 Risk Management Model Risk Management Functions Relationship to Business Management Organization Risk Management Department is organized by risk areas Policies/Procedures Policies written by risk, procedures written by function Planning/Training Upgrade systems, enhance technical skills of staff, etc. Communications/Reporting Upward reporting to senior management, outward to regulators Credit Market Operational Other Risk Analysis Credit ExposurePositionsSettlement Amount, etc. Unexpected Loss Risk Controls Lines of CreditTrading Limits Payment Limits, Back-up Systems Capital Allocation Portfolio Valuation Default and Loss Probability Value at Risk Error/Failure History of Loss Capital at Risk Oversight/Monitoring Loan ReviewDaily Review AuditSr. Management Organizing Your Bank Using Risk Management Risk Management Model

11. 11 The Risk Management function is a staff function Organizing Your Bank Using Risk Management

12. 12 Risk Management Organization Chief Risk Officer (CRO) Chief Credit Officer Chief Market Risk Officer Chief Operational Risk Officer Technology Officer Organizing Your Bank Using Risk Management

13. 13 Organizing Your Bank Using Risk Management Policies and Procedures  Risk management professionals write and maintain policies and procedures governing risks undertaken in the line of business  Risk management is expected to work with the line of business when drafting policies and procedures, but ultimately risk management professionals take final responsibility for these policies and procedures

14. 14 Organizing Your Bank Using Risk Management Risk policies should focus on explaining to employees what risks are to be managed and why they are to be managed Policies are general guidelines for the what and why questions; policies therefore should be brief and simple, and not include a large amount of detail

15. 15 Organizing Your Bank Using Risk Management Risk procedures are more detailed than policies, and explain how risks are to be managed A procedure might provide information on the approval process for a typical loan or settlement transfer, e.g.; the method of booking and documenting the exposure; the reporting requirements; and risk management or hedge specifications

16. 16 Organizing Your Bank Using Risk Management Skills and Training Risk managers must have skills equal to those line managers they review On-going training is critical to maintain skills The best practice for the risk management function is to ensure that all line managers spend some part of their career as a risk manager

17. 17 Organizing Your Bank Using Risk Management Risk managers should: –Be paid at the same level as line managers –Have the same promotional opportunities –Have the same officer title –Receive bonuses from the general bonus pool, not from the line of business bonus pool –Avoid close friendships with the line of business managers

18. 18 Organizing Your Bank Using Risk Management Communication A critical responsibility of any risk manager is to understand the business risks thoroughly, and be able to explain them to management simply, accurately, and without technical terms When communicating with senior management, it helps to remember that senior management may not know what questions to ask, or they may not want to show they do not understand something

19. 19 Organizing Your Bank Using Risk Management Risk Management communicates about risk to management, regulators, auditors, and investors Communications are critical because Risk management must decide: –Which are the important risks to highlight –Which risk exposures are “outsized” or violate limits –How frequently risks should be reported –Which surprise events might occur

20. 20 7 Risk Management Warning Signs 1.An employee is considered a “superstar” 2. An employee is allowed to use abusive behavior 3.The bank employs a black box to manage risk 4.Risk takers value the portfolio 5.Line management controls staff employees 6.Managers do not understand what their employees are doing 7.No independent evaluation of profit/loss Organizing our Bank Using Risk Management