The FDIC and the other federal banking agencies have long emphasized the importance of an annual independent review of interest rate risk (IRR) management systems. An independent review can help boards ensure that their IRR systems adequately portray how changes in interest rates could affect their financial condition, information that is needed both for risk assessment and strategic planning. This article describes common sense approaches that non-complex institutions may use to effectively and economically perform an IRR independent review in-house.
Elements of an Effective Independent IRR Review Process
IRR can have a significant impact on a bank’s earnings and capital, and a bank’s system for identifying and managing IRR is a key part of its internal control framework. Banks are expected to monitor the effectiveness of their key internal controls either as part of the internal audit process or by means of an appropriate independent review, and the framework for managing IRR is no exception. Many community banks rely on purchased asset-liability management (ALM) software to measure IRR. Any tool for measuring IRR, however, is only as good as the assumptions and data that are used as inputs. Unduly optimistic assumptions or incorrect data used in any IRR measurement tool can result in an inaccurate picture of an institution’s risk exposure. To mitigate this risk, the FDIC and the other federal banking supervisors expect banks to regularly and appropriately review the effectiveness of their approaches for measuring IRR and report the findings annually to the board of directors. This process can be completed internally or by an independent third party. However, because independent reviews can be costly when performed by external parties, many community banks find it is more practical and economical to complete this function internally.
Common Examination Findings Related to the Independent Review Process
- Independent review of the IRR management process is not performed annually.
- Assumptions (regarding prepayments, non-maturity deposits, driver rates, etc.) used in the income simulation or economic value of equity (EVE) calculations were not tested by the reviewer.
- Third-party validation of the vendor’s model was not obtained.
- Independent review was not sufficiently comprehensive (e.g., reviewer only evaluated one specific area).
- Independent review is not formalized in the ALM policy.
- Independent review scope did not include back-testing or the reconciliation of back-testing results.
- Results of the independent review are not adequately reported to the board of directors.
- Independent reviewer lacks adequate training.
The scope of the independent review of the IRR management system depends on the nature and complexity of the institution’s activities. Moreover, there is no one right way to conduct such an independent review. Community banks have conducted these reviews by relying on internal audit staff, bank employees independent of the IRR management process, or third-party consultants. Importantly, there is no requirement or expectation for a bank to hire a consultant, and most community banks should be able to identify an existing qualified employee or board member to periodically conduct this review. Any bank personnel with sufficient training and expertise can perform the review, provided they are not directly involved in the IRR measurement process and are otherwise independent of supervisory personnel responsible for IRR oversight.
The following graphic outlines the five elements of an independent IRR review process as described in the 1996 Policy Statement. These elements broadly define the goals of an IRR independent review and are the basis of supervisory expectations.
An independent review is more than testing a few key assumptions; rather it includes a broad review that addresses the five elements in the 1996 Policy Statement. This periodic review is intended to provide the board with an overall assessment as to whether its policies and controls over IRR are being followed, and that exposures are reliably portrayed and clearly understood.
A significant component of the independent review of a bank’s IRR measurement tool is reviewing the integrity of data inputs, the appropriateness of assumptions, and the reasonableness of scenarios. To appropriately reflect a bank’s specific asset and liability information, any IRR measurement tool is likely to require data from various sources, and the process of acquiring this data, whether performed manually or electronically, creates a potential for errors. Accordingly, part of the independent review should be devoted to checking the data entered into the IRR measurement tool against source documents. Assumptions, typically about how the prices and volumes of key bank products will respond to changes in interest rates, also are fundamental to the validity and usefulness of any IRR measurement tool. The independent review should both identify the assumptions that have a significant impact on results, and review the support or rationale for those assumptions. The validity of these key assumptions could be further assessed by reviewing the sensitivity testing performed by management and determining how the measured IRR results differ under different values of the assumptions.
Finally, the independent review should ascertain whether an appropriate range of scenarios has been considered to develop an informed view of risks under reasonably plausible and stressed financial conditions.
The 2010 Advisory recognizes that most community banks use largely standardized vendor-provided software; accordingly, validations provided by vendors can support the software mechanics and mathematical calculations. For IRR measurement tools that are customized to an individual bank, or in situations where the vendors do not provide appropriate certifications or validations, the bank should validate the tool to ensure it works properly. If applicable, management should document any validation work it has performed. If vendors provide input data or assumptions, management and the independent reviewer(s) should evaluate the relevance of the data and assumptions to the financial institution.
Although back-testing is sometimes thought of as a complex function, it can be performed in a straightforward manner at most community banks. Back-testing of an IRR measurement tool’s results and assumptions simply entails comparing forecasts with actual results. It can also include a review of key assumptions (e.g., non-maturity deposit re-pricing assumptions and betas versus actual rate changes) to determine whether actual outcomes were consistent with projections. Material variances should be researched and reconciled; this reconcilement can reveal data entry errors, flaws in assumptions or issues with the mechanics of the measurement tool. Back-testing should generally be conducted annually. While it is particularly useful to compare predicted and actual outcomes after a significant movement in rates or product pricing, an effective back-test should consider the scenario that most closely resembles the present economic condition. The back-test should cover a 12-month period, as a shorter period will not appropriately capture any errors in the model.
Independent review findings should be presented annually to the board or one of its committees for discussion and approval. Written independent review reports should include a brief summary of the bank’s IRR measurement techniques, assumptions, caveats or limitations of the analysis, policy compliance, and overall findings. Any exceptions or recommendations should be clearly addressed, and the board should require appropriate follow-up and corrective action as necessary. Finally, independent review findings should be available for examiner review.
One Approach to Conducting an In-House IRR Independent Review
A step-by-step framework is presented here as an example that community banks can consider when developing or enhancing their IRR independent review process. While there is no one right way to conduct an independent review of a bank’s IRR systems, the example described here addresses supervisory expectations based on the 1996 Policy Statement and is geared to completing the review economically with existing independent bank staff. The entire page can be removed from this edition of Supervisory Insights as an example for reference in developing an in-house independent review.
Step-by-Step Process for Performing an In-House Independent Review of an IRR Management System:
An Example for a Community Bank
- Reviewer: Identify a member of the bank’s staff (or a board member) with appropriate competence and independence to perform the review. Provide him/her with access to relevant policies, the bank’s IRR measurement tool, a description of its assumptions and inputs, and any model validation documentation provided by the vendor.
- Data Integrity: The reviewer should verify that asset and liability amounts that have been entered into the IRR measurement tool as inputs are accurate and complete. For data gathered from internal sources, the reviewer should ensure that such data reconciles with the general ledger, terms of outstanding contracts, etc.
- Earnings Analysis Time Horizons: The reviewer should verify that the earnings analysis is performed over an acceptable time horizon considering the complexity of the balance sheet. Generally, the earnings analysis should cover at least a two-year period, and be complemented with an economic value of equity analysis or other extended earnings simulations.
- Static Analysis: Verify that a “no growth” or static balance sheet analysis is included as part of the IRR analysis, to ensure risk exposure is not being masked by growth assumptions.
- Prepayment Assumptions: Evaluate whether prepayment assumptions are reasonable in light of the bank’s experience with its loan customers and the interest rate scenario being considered. For example, under a rising-interest rate scenario, loans would be expected to prepay less often.
- Non-Maturity Deposit Assumptions: Evaluate whether deposit price-sensitivity and runoff assumptions are reasonable. Key deposit assumptions ideally should be based on actual customer behavior during various rate cycles, and should consider the possibility that decay rates or the extent of re-pricing could be more pronounced than historical experience would suggest.
- Driver rates: Verify that assumed interest rates on bank products appropriately reflect changes in driver rates. The driver rate (Fed funds rate, Prime, LIBOR, etc.) is the rate that “drives” the pricing on the bank’s asset or liability in the model and should be consistent with actual pricing.
- Appropriate Scenarios: Identify the scenarios used, verify that they include the types of scenarios described in supervisory guidance, and evaluate whether they adequately reflect the stresses that changes in interest rates could cause given the bank’s mix of assets and liabilitie.
- Back-testing: Perform a simple back-test to compare actual or historical results to the results assumed or predicted by the measurement tool. Determine whether key assumptions may need to be adjusted based on back-testing results.
- Compliance with Policy: Verify that the bank has board-approved policies for IRR that delineate risk exposure limits; that specific individuals have responsibility for implementing the key aspects of the IRR policy; that IRR is measured and reported to the board at least quarterly; and that results are within policy limits or if not, were approved by the board as an exception to policy.
- Documentation and Report to Board: Once the review is completed, the reviewer should document the scope, findings, and any recommendations. The review should be presented to the board of directors and any follow-up action documented in its minutes.
Conclusion
A bank’s IRR management program should include a periodic independent review. That said, for most community banks the review process need not be an expensive exercise. Many banks have existing qualified staff whose role could be expanded to include periodic IRR reviews. This not only addresses independent review needs in a costeffective manner, but also potentially facilitates training and development across disciplines. Most importantly, an effective independent review provides the board with assurance that the IRR measurement system produces results that are reliable and relevant for strategic business decisions. Independent review procedures discussed in this article can help identify potentially significant IRR management issues and provide the institution with confidence in its IRR monitoring reports.
Syed Islam, MA
Senior Examiner
New York, NY Field Office
Division of Risk Management Supervision
sislam@fdic.gov