Risk Management

Maintaining a Sound Risk Culture

A strong risk culture is vital to the long-term sustainability of the Bank’s business franchise. Specifically, risk culture refers to the norms, attitudes and behaviours related to risk awareness, risk-taking and risk management, and controls that shape decisions on risks*. Our risk culture is based on our values. A strong risk culture ensures that our decisions and actions are considered and focused on our stakeholders, and that we are not distracted by short-term gains.

^{* Basel Committee on Banking Supervision: Guidelines on Corporate Governance Principles for Banks (July 2015)}

Risk Governance

Our risk frameworks, policies and appetite provide the principles and guidance for the Bank’s risk management activities. They guide our key decisions for capital management, strategic planning and budgeting, and performance management to ensure that the risk dimension is appropriately and adequately considered. Risk reports are submitted regularly to senior management committees and the Board to keep them apprised of the Bank's risk profile.

Responsibility for risk management starts with Board oversight of the Bank's governance structure, which ensures that the Bank’s business activities are:

• conducted in a safe and sound manner and in line with the highest standards of professionalism;
• consistent with the Bank’s overall business strategy and risk appetite; and
• subject to adequate risk management and internal controls. 

The Board is assisted primarily by the Risk Management Committee (RMC) on risk-related matters, including reviewing the overall risk appetite and level of risk capital to be maintained for the Bank. 

Our Chief Executive Officer (CEO) has established senior management committees to assist her in making business decisions with due consideration for risks and returns. The main senior management committees involved in specific risk-related matters are the Executive Committee (EXCO), Asset and Liability Committee (ALCO), Management Committee (MC), In-Country Credit Committee (ICCC), Credit Management Committee (CMC), Operational Risk Management Committee (ORMC), Information & Technology Committee (ITC), Risk and Capital Committee (RCC) and Anti-Financial Crime Committee (AFCC). These committees also assist the Board committees.

Management and the senior management committees are authorised to delegate risk appetite limits by location, business units and/or broad product lines.

Risk management is the responsibility of every employee in the Bank. We strive to instil awareness of the risks created by their actions and the accountability for the consequences of those actions in our employees. We have established frameworks and policies to ensure appropriate oversight, accountability and management of all risk types encountered in the course of our business. The Bank adopts and adapts the parent bank's risk management governance structure, frameworks and policies to comply with local regulatory requirements. This ensures that the approach across the Group is consistent and sufficiently adaptable to suit local operating environments.
Our organisational control structure is based on the Three Lines Model as follows:

First Line - The Risk Owner

The business and support units own and have primary responsibility for implementing and executing effective controls to manage the risks arising from their business activities. This includes establishing adequate managerial and supervisory controls to ensure compliance with risk policies, appetite, limits and controls and highlight control breakdowns, inadequacy of processes and unexpected risk events.

Second Line - Risk Oversight

The risk and control oversight functions (i.e. Risk Management and Compliance) and the Chief Risk Officer and Country Head of Compliance, as the Second Line, support the Bank's strategy of balancing growth with stability by establishing risk frameworks, policies, appetite and limits which the business functions must adhere to and comply with in their operations. They are also responsible for the independent review and monitoring of the Bank's risk profile and for highlighting any significant vulnerabilities and risk issues to the respective senior management committees. The independence of risk and control oversight functions from business functions ensures that the necessary checks and balances are in place.

Third Line - Independent Audit

Internal auditors conduct risk-based audits covering all aspects of the First and Second lines to provide independent assurance to the CEO, Shariah Committee, Audit Committee and the Board on the adequacy and effectiveness of our system of risk management and internal controls. The internal auditor's overall opinion of the internal controls and risk management system is provided to the AC and the Board annually.

Risk Appetite

Our risk appetite framework defines the amount of risk we are able and willing to take in the pursuit of our business objectives. It ensures that the Bank’s risk profile remains within well-defined and tolerable boundaries. The framework has been formulated based on the following key criteria:

• alignment to the Bank's key business strategy;
• relevance to the respective stakeholders, with appropriate levels of granularity;
• practical, consistent and comprehensible metrics for communication and implementation; and
• analytically-substantiated and measurable metrics.

Our risk appetite defines suitable thresholds and limits across the key risk areas including credit risk, country risk, market risk, liquidity risk, operational risk, and conduct risk. Our risk-taking approach is focused on businesses which we understand and whose risks we are well-equipped to manage. This approach helps us to minimise earnings volatility and ensures that our high credit ratings, strong capital and stable funding base remain intact. This enables us to remain a steadfast partner to our customers through changing economic conditions and cycles. 

Our risk appetite framework and risk appetite are reviewed and approved annually by the Board. Management monitors and reports the Bank's risk profiles and compliance with the established risk appetite to the Board on a regular basis.

Material Risks

Our business strategies, products, customer profiles and operating environment expose us to a number of financial and non-financial risks. Identifying and monitoring key risks are integral to the Bank’s approach to risk management, enabling us to make effective assessments of these risks and mitigate them proactively across the Bank. The table below summarises the key risks that could impact the achievement of the Bank’s strategic objectives. Details of these key risks can be found in the pages that follow.