By Hennie van Greuning and Sonja Brajovic Bratanovic - World Bank

ANALYZING BANKING RISK
By Hennie van Greuning and Sonja Brajovic Bratanovic
Appendix
GENERAL BACKGROUND QUESTIONNAIRE
(see Table 13.2 in Analyzing Banking Risk)
Name of bank:
Address:
Date completed:
Telephone number:
Fax number:
Person(s) responsible for
completion:
1. EXECUTIVE SUMMARY AND RECOMMENDATIONS
What are the biggest challenges facing your bank in the next few years?
What are your strategies to overcome those challenges?
What are your bank’s greatest strengths?
What risks do lenders/investors face in lending money to your
organization:
-external to your bank
-internal to your bank?
Why would money lent to your banks be a good investment for
lenders/investors?
How would your bank use money lent by lenders/investors to
develop financial markets or specific sectors in your country?
2. INSTITUTIONAL DEVELOPMENT NEEDS
What are your bank’s greatest development needs as identified in the
conclusions and recommendations section (Section 15)at the end of this
report?
Which areas will you focus on in the coming year?
What role can lenders/investors play in assisting you with the development
of your institution?
What active plans do you have to ensure that reforms are sustained?
Who would be the primary contact person in your organization, to
take responsibility for the institutional development plan and
coordinate with lenders/investors if a loan is granted?

3. OVERVIEW OF THE FINANCIAL SECTOR AND REGULATION
3.1 Status of financial infrastructure (disclosure, payment systems, scrip
registries, and so on)
3.2 Banking and the financial system: the status of financial regulation
3.3 Banking regulation
Which are the key laws affecting the banking system in your country?
When were the banking laws and regulations last changed?
Describe the key prudential regulations regarding:
- shareholding
- related party (connected) lending
- large exposures
- loan classification guidelines
- suspension and reversal of interest
- investment limits
= for equity investments
= for property and other fixed assets
- currency exposure limits
- deposit insurance.
Describe the supervisory approach and philosophy (of the
regulators).
What is the minimum capital requirement and how do your capital
adequacy guidelines differ from the BIS guidelines?
Describe any cash reserve and liquid asset requirements of the
central bank.
How is currency risk regulated?
Are prudential regulations strictly enforced?
4. OVERVIEW OF THE BANK AND ITS RISK MANAGEMENT CULTURE
4.1 Historical background and general information
Provide a brief history of the bank, detailing incorporation dates, earlier
names, mergers, major events, and so on.
What is your ranking in the banking system (capital and assets)?
What is the bank’s main business focus and what are its main
product areas?
Describe the strategy of your bank.
What is your bank’s mission statement?

4.2 Group and organization structure
Provide a group structure chart showing holding companies, ultimate
controlling entities, associates, and subsidiaries. Identify other financial
institutions in the group (include as appendix 1).
Provide an organization chart of the bank under review (include as
appendix 2).
How many departments and divisions does the bank have? Name them and
provide an organization chart describing the key departments and divisions
as well as the number of staff in each.
How many branches does the bank have? Describe their geographic spread
and size.
How many staff members does the bank have?
How many staff members have a post–high school education?
Provide details about technical institute and university graduates.
Identify how the development of human resources complements the
risk focus of the bank. –(This is done to ensure that the right caliber
staff is recruited and trained, in order to enable compliance and
maintenance of the risk management procedures established.)
To what extent are staff paid competitive market-based salaries in
order to retain them?
To what extent are bonuses paid to staff?
What training is offered to staff?
How does the organizational structure encourage good risk
management? (Also see risk management culture, Section 4.5.)
4.3 Accounting systems, management information, and internal control
Describe the status of the bank’s accounting systems and records.
How much reliance can be placed on the financial reporting and
information systems?

4.4 Information technology
Describe the computer systems in operation (both hardware and software),
including microcomputers (whether used as terminals or stand-alone
units).
What backup and recovery systems are available?
How is security in the EDP area controlled?
4.5 Risk management culture and decisionmaking process
What major risks (stemming either from its products or from the
environment) does the bank face?
Planning and defining risk tolerance levels: Have the board and executive
management delineated the level of risk they are willing to assume for each
area and overall?
Risk identification: How is the risk in current operations identified?
Risk supervision and management: How are current and proposed
operations managed?
Risk monitoring: Evaluate the effectiveness of control
implementation.
How effectively are board-approved risk tolerance levels
communicated in the organization?
Evaluate the manner in which risk is being assumed, measured,
limited, controlled, and reported.

5. CORPORATE GOVERNANCE
5.1 Shareholders / O/ownership
When was the last shareholders’ meeting of the bank and how many
shareholders were present? What percentage of the total shares did they
represent?
What is the main business of the key shareholders, and who controls those
shareholders?
Are there any provisions allowing shareholders voting rights that
are not in proportion to their shareholding?
Describe any options or other rights given to persons to acquire
more share capital.
Do any resolutions require more than a simple majority to be
accepted? If so, name such provisions.
What direct involvement, if any, do the shareholders have with the
bank, the supervisory board, and the management board?
5.2 Board of directors/supervisory board
For how long is the supervisory board elected? What are the board’s main
objectives and responsibilities?
Describe the supervisory board’s involvement with bank policy setting,
especially as regards risk management.
To what extent does the supervisory board review financial information
during the year and at year end?
Describe the interaction between bank management and the bank’s policysetting
board, the responsibility for the determination of the bank’s
policies and objectives, delegation of authority and responsibility, internal
systems and procedures for performance reviews, and checks on
accountability.
Is the board of directors (supervisory and management boards)
committed to the active use of risk-based management
information? These “ideal” management accounts should be the
driving force in identifying where the bank wishes to see itself in
terms of ideal critical management information. This goal should
determine what other systems development and training should take
place, and how.
5.3 Executive management
Who appoints the chief executive officer (chairman of the management
board)?
For how long is the management board elected? What are their main
objectives and responsibilities?
Elaborate on the interaction between bank management and the bank’s
policy-setting board, the responsibility for the determination of bank
policy and objectives, delegation of authority and responsibility, internal
systems and procedures for performance reviews, and checks on
accountability.
Discuss the interaction between bank management and employees in
carrying out the bank’s objectives.
Do senior management and the board receive and require risk-based
management information on a regular basis?
Is risk-based management information used to ensure that
procedures are in place to safeguard assets and depositors as well as
ensure the integrity of data?
Which management accounts should be developed to identify
critical risk management issues for top management (distinguish
between information needed on a daily basis, and information to be
presented on a monthly or less frequent basis for management and
supervisory board meetings)?
Identify the risk management systems and procedures that must be
designed to support the information needs of management, to
ensure that the desire for proper risk management drives all systems
development.

5.4 Internal audit/audit committee of the board
How many persons work in the internal audit department? Describe their
experience and qualifications.
Do those who carry out the internal audit function report to a
subcommittee of the supervisory board? If not, to whom do they report?
Do the supervisory board members receive and review the internal
audit reports?
Do internal audit reports discuss deviations from policies? What
else is discussed in those reports?
5.5 External auditors
Are International Accounting Standards (IAS) and International Standards
of Auditing (ISA) followed?
Who are the external auditors of the bank and how long have they been
auditing the financial statements? If they were appointed recently, name
their predecessors.
Identify the major items reported on by the auditors during the past three
years. Supply copies of the latest two management reports from the
auditors.
What audit and consulting fees have been paid to the auditors
during the past two years?
To what extent do the auditors evaluate the bank’s risk
management procedures?
Discuss the involvement of and relationship between the external
auditors and management.

FINANCIAL RISK MANAGEMENT (6–13)
6. Balance sheet structure and the changes therein
XXXXXXXXXXXXXXXXXXXXXXXXX
6.1 Composition of the balance sheet
Asset structure: growth and changes
Liabilities structure: growth and changes
6.2 Overall on- and off-balance sheet growth
6.3 Low and nonearning assets
6.4 ALCO–planned changes in the
balance sheet structure
Describe:
- what happened
- why it happened
- the impact of the trend or observation
- the planned response to the situation
- alternative recommendations regarding the situation
observed.
Describe the structure of your balance sheet and any planned
changes.
Describe (and quantify) the nature, volume, and anticipated
usage of credit commitments, contingent liabilities,
guarantees and other off-balance sheet items.

7. Income statement structure and the changes therein (profitability/earnings)
7.1 Sources of income: changes in the structure and
trends of income
7.2 Structure of assets compared to structure of income
7.3 Margins earned on intermediation business
7.4 Operating income and operating expenses
breakdown
7.5 Return on assets and shareholders’ funds
Describe:
- what happened
- why it happened
- the impact of the trend or observation
- the planned response to the situation
- alternative recommendations are regarding the situation
observed
Describe your major sources of income and most profitable
business areas.
Describe the extent to which accrued but uncollected interest is
taken into income—especially if such interest income relates to
loans that you or the bank place in risk categories of substandard or
worse.
Describe the extent to which collateral values (rather than operating
cash flows) are the basis for decisions to capitalize interest and /or
to roll over extensions of credit.
List any income or expenditure recognition policies that might
affect (or distort) earnings.
Describe the effect of material intergroup transactions, especially
those relating to the transfer of earnings and asset /liability
valuations.
Are there any revenue and expense items that may be significantly
overstated or understated?
Describe areas and the manner in which greater efficiencies can be
achieved.

8. Capital adequacy
8.1 Capital retention policies
8.2 Compliance with capital adequacy requirements
8.3 Potential future capital requirements
8.4 Structure of shareholders’ funds
8.5 Risk profile of balance sheet assets
Describe:
- what happened
- why it happened
- the impact of the trend or observation
- the planned response to the situation
- alternative recommendations regarding the situation
observed
What plans do you have for the maintenance of minimum
regulatory capital, given your past growth and future plans for
expansion?
What access does the bank have to capital and financial assistance?
What are the bank’s growth experiences, plans, and prospects for
the future?
Is capital growth funded by internal cash generation or capital
contributions?
To what extent have reserves been generated by revaluations of
fixed assets, and investments, or from the capitalization of interest
on classified loans?
In the case of capital contributions, were they in cash or in kind
(fixed assets)?
In the case of contributions in kind (fixed assets), state the
proportion that such contributions (see Table 5.3A) constitute as a
percentage of total capital and describe the process used to obtain a
reliable third party valuation.

9. Credit risk management
9.1 Credit risk management policies, systems, and
procedures
Use the structure of Section 4.5 (risk management culture) to discuss
the following questions:
How is credit risk managed in the bank? Include a description of the
lending organization, concerned departments, management levels, and
staffing.
Provide the profile and lending skills of your chief lending officers, credit
managers and officers, and all relevant staff.
Describe the key risks that you face and control in this area.
What are your strengths as far as this risk area is concerned?
What are the most pressing development needs for your bank as far as
this risk area is concerned?
Describe the top-level information prepared for the most senior
management in the bank.
What information is asked for during the loan application request?
Describe the contents of loan files. –How do you use this information to
monitor the quality of loans?
Describe the standard loan process from the client’s initial enquiry, or the
bank’s marketing efforts, to the final lending decision, and a description
of the credit decision process.
What are the criteria used for granting loans? Also describe any specific
limits, ratios, and so forth used by you in the evaluation process.
Describe any specific lending procedures and techniques for project
appraisal, approvals and legal finalization of projects, procurement and
disbursement, as well as follow-up and supervision of such projects.
Describe any formalized credit policies, procedures, and
underwriting criteria for the identification of target markets.
Discuss the procedures for management of problem loans, describing
specialized work-out departments or intensive care units and
detailing their scope, skill, resources, and efficiency.
What instruments or remedies are available to ensure that borrowers
repay their loans to the bank; describe also the mechanisms that exist
for legal recovery, foreclosure and repossession of collateral, and
transmission of legal rights.
Describe the taxation deductions allowed for loan loss provisioning
as well as the influence that taxation has on your bank’s provisioning
policy.
At what point do you suspend interest and how do you control the
overall amounts owed by a client in such a case?
What is the total number of corporate and retail loans?
Has your bank made any loans on other than normal credit terms
(pricing or directed)?
To what extent have you accepted equity in clients as payment for
loans?
What percentage of loans have been rescheduled once?
What percentage of loans have been rescheduled more than once?
For what percentage of loans do you act as a fiscal agent ?

9.2 Profile of borrowers
9.3 Maturity of loans
9.4 Loan products
9.5 Sectoral analysis of loans
9.6 Large exposures to individuals and connected
parties
9.7 Loan and other asset classification and provisioning
9.8 Analysis of loans in arrears
9.9 Connected lending (to related parties)
Describe:
- what happened
- why it happened
- the impact of the trend or observation
- the planned response to the situation
- alternative recommendations regarding the situation observed
Describe the major loan products offered by the bank.
Describe your bank’s current policies, practices, and procedures to
identify common ownership, control, and reliance on common cash
flows. You should also, if appropriate, suggest new guidelines and
new procedures by which concentrations should be identified and
tracked in the bank.
Are all assets (in addition to the loan portfolio) with a credit risk in
fact classified as to quality and provided against, when needed?
Describe your methodology for the determination of the level of
reserves required.
To what extent do you rely on collateral for establishing the
recommended reserves? Specify the methodology used to establish
the value of the collateral? –What types of collateral do you regard
as acceptable?
Under what circumstances do you use specific reserves and when
are general reserves used?

10. Liquidity risk management
10.1 Liquidity risk management policies, systems, and
procedures
Use the structure of Section 4.5 (risk management culture) to discuss
the following questions:
How is liquidity risk managed in the bank?
Describe the key risks that you face and control in this area.
Describe the top-level information prepared for the most senior
management in the bank.
What are your strengths as far as this risk area is concerned?
What are the most pressing development needs for your bank as far as this
risk area is concerned?
How many persons work in the treasury? –Describe their daily activities
(split between domestic and international if applicable) in ensuring that the
bank’s funding is adequate to meet its deposit liabilities and
investment/lending commitments.
How strong is the interbank market? What is your participation in
those markets?
Do you have adequate access to money markets or other ready
sources of cash? If so, please describe these sources.
What reliance does your bank place on interest-sensitive funds?
To what extent do you make use of central bank credit? Report
how many times you used central bank credit in the last 12 months,
describing the different types of access used and the maximum
amount involved.
What ability do you have to readily convert assets into cash?
Describe your capacity to meet unexpected deposit withdrawals and
other demands for payment.
What other sources of funding do you have available in case of a
shortage of liquidity.
How many depositors does the bank have in total?
10.2 Compliance with regulatory requirements
10.4 Sources of deposits—profile of depositors
10.3 Maturity structure of deposits
10.5 Large depositors and volatility of funding
10.6 Maturity mismatches of assets and liabilities
10.7 Liquidity risk measures
Describe:
- what happened
- why it happened
- the impact of the trend or observation
- the planned response to the situation
- alternative recommendations regarding the situation observed

11. Interest rate risk management
11.1 Interest rate risk management policies, systems, and procedures
Use the structure of Section 4.5 (risk management culture) to discuss
the following questions:
How is interest rate risk managed in the bank?
Describe the key risks that you face and control in this area?
Describe the top-level information prepared for the most senior
management in the bank?
What are your strengths as far as this risk area is concerned?
What are the most pressing development needs for your bank as far
as this risk area is concerned?
11.2 Forecasting of interest rates
11.3 Measures to determine the potential impact of
exogenous rate movements on the bank’s capital
Describe:
- what happened
- why it happened
- the impact of the trend or observation
- the planned response to the situation
- alternative recommendations regarding the situation
observed

12. Market/price risk management
12.1 Market/price risk management policies, systems,
and procedures
Use the structure of Section 4.5 (risk management culture) to discuss
the following questions:
Describe the top-level information prepared for the most senior
management in the bank.
What are your strengths as far as this risk area is concerned?
What are the most pressing development needs for your bank as far
as this risk area is concerned?
To what price risk/market risk is the bank exposed as a result of its trading
in the securities, commodities, equities, or other markets?
How is market risk managed in the bank?
Describe the key risks that you face and control in this area.
12.2 Structure of the investment portfolio
12.3 Structure of the trading portfolio
12.4 Net effective open positions and potential capital
exposures
12.5 Market risk attached to off-balance-sheet activities
and derivatives
Describe:
- what happened
- why happened
- the impact of the trend or observation
- the planned response to the situation
- alternative recommendations regarding the situation
observed

13. Currency risk management
13.1 risk management policies, systems, and procedures
Use the structure of Section 4.5 (risk management culture) to discuss
the following questions:
What are your strengths as far as this risk area is concerned?
What are the most pressing development needs for your bank as far
as this risk area is concerned?
How does the bank manage its currency risks?
Describe the key risks that you face and control in this area?
Describe the top-level information prepared for the most senior
management in the bank?
13.2 Currency structure of assets and liabilities
13.3 Currency structure of off-balance-sheet activities
13.4 Maturity structure of foreign currency liabilities
13.5 Currency structure of loans and deposits
13.6 Net effective open position and capital exposed
Describe:
- what happened
- why it happened
- the impact of the trend or observation
- the planned response to the situation
- alternative recommendations regarding the situation observed

14. OPERATIONAL RISK
Discuss risks resulting from the following areas:
14.1 Human resources
14.2 Potential loss of data
14.3 Payments and settlement transactions
The possibility of loss resulting from errors in instructing payments or
settling transactions
14.4 Other technological risk
14.5 Legal issues
The possibility of loss when a contract cannot be enforced (e.g., because the
client had no authority to enter into the contract or the contract turned out to
be unenforceable in a bankruptcy proceeding)
15. CONCLUSIONS AND RECOMMENDATIONS
Discuss the following:
15.1 The changes that appear necessary within the bank’s culture and
managerial practices, given the nature and relative complexity of its
operations, including (as applicable):
• The need for full sponsorship by the board and executive
management.
• The necessary enabling culture in which every manager is expected
to consider risk (i.e., to identify, measure, and report on risk
exposure.
• The changes that appear necessary after the assessment of evaluation,
monitoring, and reporting systems that cover critical risk functions.
• The convenience of adopting appropriate risk objectives for each
function and for the bank as a whole.
• The need to institute a formal process for the general manager or
CEO of the bank and the board to review and evaluate all expected
and unexpected risks and all risk-taking activities.
• The convenience of designating a member of senior executive
management for overseeing all risk management, with
authority to act on risk problems and ensure risk control;
15.2 The implications of the problems identified and for instituting
a bank-wide risk management function, the process and phases
required for such action, and the role and function within the
organization of the risk management senior official.
15.3 The manner in which risk management functions could be
instituted in the bank.
15.4 The feasibility of installing effective comprehensive bankwide
risk management, and their implications for the bank.

Group Structure
Attach a diagram
Organization Structure
Attach a diagram

Shareholding*
Shareholders (as of ______)
Number of
Shareholders
Shares Held
Percentage of Shares
Private companies
Private individuals
Subtotal: private sector shareholders
Public sector and government companies (less than 51 percent
private) **
Total shareholding
Number
Unit Size
List of shareholders who own more than 5 percent of the bank’s
shares
Name Shares Held Percentage of Shares
Number
Unit Size
List of shareholders and companies that effectively or indirectly own more than 5 percent of the bank's shares through their control over
shareholders of the bank
* The ultimate (and real) owner of the shares must determine whether the shareholder is from the private or the public sector.
** If shares are held as nominees, indicate who the ultimate owner is.

Supervisory Board/Board of Directors
Name
Where
Employed
Shareholders/Entity
Represented
Majority Private Sector-
Owned (Y/N)
Qualifications Experience Responsibility*
* Responsibility examples: administration, corporate banking, international division, domestic treasury, retail banking, internal control, finance and accounting,
information systems, branch management.

Management Board (Executive Management)
Name Qualifications Experience Responsibility *
* Responsibility examples: administration, corporate banking, international division, domestic treasury, retail banking, internal control, finance and accounting,
information systems, branch management.

Appendix 4.3.B Reports Prepared for Top Management
Daily
Weekly
Monthly
Quarterly
Annually
Other
For Department Heads For Executive Management For Supervisory Board