MORNBFI Vol. 1 - Planters Development Bank

APP. Q-4208.12.31c. Ensure that strategic direction andrisk tolerances are effectivelycommunicated and adhered to throughoutthe organization;d. Oversee the development andmaintenance of management informationsystems to ensure that information istimely, accurate, and pertinent.V. Assessment of risk managementWhen assessing risk managementsystems, the BSP will consider the FI’spolicies, processes, personnel, and controlsystems. Significant deficiencies in any oneof these areas will cause the BSP to expectthe FI to compensate for these deficienciesin their overall risk management process.1. Policies are statements of the FIs’commitment to pursue certain results.Policies often set standards (on risktolerances, for example) and recommendcourses of action. Policies should expressan FI’s underlying mission, values, andprinciples. A policy review should alwaysbe triggered when an FI’s activities or risktolerances change.2. Processes are the procedures,programs, and practices that impose orderon the FI’s pursuit of its objectives.Processes define how daily activities arecarried out. Effective processes areconsistent with the underlying policies, areefficient, and are governed by checks andbalances.3. Personnel are the staff andmanagers that execute or overseeprocesses. Good staff and managersperform as expected, are qualified, andcompetent. They understand the FI’smission, values, policies, and processes.Compensation programs should bedesigned to attract, develop, and retainqualified personnel. In addition,compensation should be structured toreward contributions to effective riskmanagement.4. Control systems include the toolsand information systems (e.g, internal/external audit programs) that FI managersuse to measure performance, makedecisions about risk, and assess theeffectiveness of processes. Feedbackshould be timely, accurate, and pertinent.VI. Supervision by RiskUsing the core assessment standardsof the BSP as guide, an examiner willobtain both a current and prospective viewof an FI’s risk profile. When appropriate,this profile will incorporate potentialmaterial risks to the FI from non-bankaffiliates’ activities conducted by the FI.Subsidiaries and branches of foreign FIsshould maintain sufficient documentationonsite to support the analysis of their riskmanagement. This risk assessment drivessupervisory strategies and activities. It alsofacilitates discussions with FI managementand directors and helps to ensure moreefficient examinations. The coreassessment complements the riskassessment system (RAS). Examinersdocument their conclusions regarding thequantity of risk, the quality of riskmanagement, the level of supervisoryconcern (measured as aggregate risk), andthe direction of risk using the RAS.Together, the core assessment and RASgive the appropriate department of the SESthe means to assess existing and emergingrisks in FIs, regardless of size orcomplexity.Specifically, supervision by riskallocates greater resources to areas withhigher risks. The appropriate departmentof the SES will accomplish this by:1. Identifying risks using commondefinitions. The categories of risk, as theyare defined, are the foundation forsupervisory activities.2. Measuring risks using commonmethods of evaluation. Risk cannot alwaysQ RegulationsAppendix Q-42 - Page 4Manual of Regulations for Non-Bank Financial Institutions