Conducting meaningful independent reviews of interest rate risk and liquidity risk management can not only help satisfy regulatory requirements, but also can demonstrate a thorough understanding of the complex process.
Bill Delong, CPA
James Mihills, CPA
One of the many regulatory requirements for a financial institution is a periodic independent review of its interest rate risk (IRR) and liquidity risk managementpractices. Independence can be achieved in-house, through the internal audit department, or by using an independent third party. Using an independent third party may be beneficial in instances where an employee or department that is both independent and knowledgeable of IRR and liquidity risk management is not available.
Importance of Reviews
Financial institutions are, of course, very familiar with IRR regulatory requirementsfor independent reviews, as governed by the Joint Agency Policy Statement on Interest Rate Risk (1996) and Advisory on Interest Rate Risk Management (2010). While the scope and formality of IRR reviews varies depending on the size and complexity of an organization, examiners generally expect reviews to address the soundness and appropriateness of their IRR policies and risk tolerance. This includes documenting assumptions and evaluating the reasonableness of those assumptions, as well as validating the effectiveness and accuracy of an institution’s data input processes.
Unlike IRR reviews, the regulatory requirement for independent liquidity risk reviews is relatively new and many institutions may be somewhat unfamiliar with the full extent of the requirements. Regulatory guidance as outlined in the Interagency Policy Statement on Funding and Liquidity Risk Management states that management should ensure that an independent party regularly review and evaluate the components of an institution’s liquidity risk management processes. The reviews should include assessing the extent to which an institution’s liquidity risk management complies with both supervisory guidance and sound industry practices — taking into account the level of sophistication and complexity of the institution’s liquidity risk profile.
Independent reviews, whether performed internally or by a third party, provide an efficient, thorough way to help management evaluate the effectiveness of their IRR and liquidity risk management processes and parameters. Independent reviewers provide necessary objectivity and scrutiny, which allows management to gain additional insight into their models’ assumptions and methodologies. These reviews also provide management insight to better understand whether those assumptions are reasonable or in need of modification.
Independent reviews provide an institution with an excellent platform to effectively prepare for upcoming regulatory examinations. Feedback from the reviewer also can be useful in strengthening liquidity and risk management practices.
An independent IRR review should address data input verification, testing of outputs, and back testing. In addition, an effective review should include an assessment of compliance with established internal controls, policy content, determination of assumptions, and model validation. According to regulation, the results and content of an independent IRR review should be presented to an institution’s board of directors.
Back testing, in particular, provides significant insight into the appropriateness of an institution’s procedures and policies. It involves assessing the accuracy of an institution’s models, assumptions, and methodologies by comparing forecasted to actual results. For institutions using vendor-prepared models, back testing often is an element of the vendor package, but an independent back test provides management with additional validation or new perspectives that may reveal unknown weaknesses. In recent years, examiners have placed emphasis on closely examining the assumptions used in the models along with the processes chosen by an institution. This makes independent review, including back testing, increasingly important.
Specific questions the reviewer should consider in an independent IRR review include:
- Policy — Has the policy been approved by the board of directors within the past year? Does the policy address content stipulated by regulatory guidance? Have reasonable limits for changes in earnings and equity been established and are limits being monitored?
- Data Input — Has the institution established reasonable processes to assure the completeness and accuracy of data entered into the model? Is model output reviewed to assure agreement with data input into the model?
- Assumptions — Have reasonable assumptions been established for modeling? Can management justify and support assumptions? Are assumptions reviewed by the asset-liability committee (ALC) or board of directors on a periodic basis?
- Back Testing — Is projected net interest income compared to actual net interest income on a periodic basis? Are variances reviewed by management and the ALCO for reasonableness? Are adjustments made to assumptions or data input based on back-testing results?
- Reporting — Is IRR reporting regularly provided to management, the ALCO, and the board of directors? Does the reporting conform to policy requirements? Does the reporting reflect measured IRR exposure?
In addition to considering these questions, an independent reviewer should perform testing on data input, assumptions, back testing, and reporting to verify the accuracy, reasonableness, and completeness of IRR data.
Liquidity Risk Review Scope
An independent liquidity risk review, whether performed internally or by a third-party reviewer, should address policy and contingency funding plans in relation to consistency with supervisory guidance and industry best practices. The review also should evaluate the scope of liquidity reporting, forecasting, and stress testing while gauging the adequacy of funding diversification and daily cash management. The review should further include testing of liquidity reporting for accuracy and consistency against internal policies, supervisory guidance, and industry best practices.
Independent liquidity risk reviews should include documenting and reporting key issues requiring attention, including instances of noncompliance, to the appropriate level of management for prompt corrective action consistent with approved policy. Specific questions the reviewer should consider include:
- Policy and Contingency Funding Plan — Have policies been approved by the board of directors within the past year? Do policies address content as stipulated by regulatory guidance? Have appropriate contingency funding plans been established? Have reasonable limits for liquidity positions been established and are those limits being monitored?
- Reporting — Is liquidity reporting being regularly provided to management, the ALCO, and the board of directors? Does reporting conform to policy requirements? Does the reporting reflect measured liquidity position and potential liquidity concerns?
- Stress Testing — Is stress testing being conducted periodically and are stress scenarios reasonable for the institution? Can management support assumptions used in stress scenarios and are assumptions adequately documented? Does stress testing indicate liquidity shortfalls and, if so, is this documented?
- Forecasting — Is liquidity forecasting being prepared for appropriate intervals, such as daily, monthly, quarterly or yearly? Is management using reasonable documentation and assumptions in projecting cash sources and uses?
- Funding Diversification — Does the institution maintain adequate funding sources? Is funding availability through these sources being monitored by management and periodically reported to the ALCO? Is the necessary collateral for funding sources appropriately identified, segregated, and monitored? Are funding sources periodically tested for operational effectiveness?
As with the IRR review, the reviewer in an independent liquidity risk review should perform assessments on reporting, stress testing, and forecasting to verify the accuracy, reasonableness, and completeness of liquidity data.
Benefits of Meaningful Reviews
While exams are a regulatory fact of life, periodic independent reviews of IRR and liquidity risk often result in benefits that go beyond satisfying regulatory requirements. Effectively performed reviews can help management demonstrate a thorough understanding of IRR and liquidity risk. Finally, they can provide a unique perspective on risk and a level of confidence based on an independent verification of the assumptions made within their models and processes.
Bill Delong, CPA, is a partner in advisory services and James Mills, CPA, is a senior manager in advisory services for Weaver LLP in Fort Worth, Texas.