16 Risk management framework

As part of the overall internal control framework, investment firms should have a holistic investment firm-wide risk management framework extending across all their business lines and internal units, including internal control functions, recognising fully the economic substance of all their risk exposures including the risks the investment firm poses to itself, its customers and markets and liquidity risks, in particular those that can have a material impact on or deplete the level of own funds available. The risk management framework should enable the investment firm to make fully informed decisions on risk-taking. The risk management framework should encompass all risks as well as actual risks and future risks that the investment firm may be exposed to. Risks should be evaluated from the bottom up and from the top down, within and across business lines, using consistent terminology and compatible methodologies throughout the investment firm and at a consolidated level. All relevant risks should be encompassed in the risk management framework with appropriate consideration given to both financial and non-financial risks, including market, liquidity, concentration, operational, IT, reputational, legal, conduct, compliance with AML/CTF and other financial crime, ESG and strategic risks.

An investment firm ’s risk management framework should include policies, procedures, risk limits and risk controls ensuring adequate, timely and continuous identification, measurement or assessment, monitoring, management, mitigation and reporting of the risks at the business line, investment firm and consolidated levels.

An investment firm ’ s risk management framework should provide specific guidance on the implementation of its strategies. This guidance should, where appropriate, establish and maintain internal limits consistent with the investment firm ’s risk appetite and commensurate with its sound operation, financial strength, capital base and strategic goals. An investment firm ’s risk profile should be kept within these established limits. The risk management framework should ensure that, whenever breaches of risk limits occur, there is a defined process to escalate and address them with an appropriate follow-up procedure.

The risk management framework should be subject to independent internal review, e.g. performed by the internal audit function, and reassessed regularly against the investment firm ’s risk appetite, taking into account information from the risk management function and the risk committee, where established. Factors that should be considered include internal and external developments, including revenue changes; any increase in the complexity of the investment firm's business, risk profile or operating structure; geographic expansion; mergers and acquisitions; and the introduction of new products or business lines.

When identifying and measuring or assessing risks, an investment firm should develop appropriate methodologies including both forward-looking and backward-looking tools. The tools should include the assessment of the actual risk profile against the investment firm ’s risk appetite, as well as the identification and assessment of potential and stressed risk exposures under a range of assumed adverse circumstances against the investment firm’s risk capacity . The tools should provide information on any adjustment to the risk profile that may be required. Investment firms should make appropriately conservative assumptions when building stressed scenarios.

Investment firms should take into consideration that the results of quantitative assessment methodologies, including stress testing, are highly dependent on the limitations and assumptions of the models (including the severity and duration of the shock and the underlying risks). For example, models showing very high returns on economic capital may result from a weakness in the models (e.g. the exclusion of some relevant risks) rather than a superior strategy or excellent execution of a strategy on the part of the investment firm. The determination of the level of risk taken should not therefore be based only on quantitative information or model outputs; it should also comprise a qualitative approach (including expert judgement and critical analysis). Relevant macroeconomic environmental trends and data should be explicitly addressed to identify their potential impact on exposures and portfolios.

The ultimate responsibility for risk assessment lies solely with the investment firm, which, accordingly, should evaluate its risks critically and should not rely exclusively on external assessments.

Investment firms should be fully aware of the limitations of models and metrics and use not only quantitative but also qualitative risk assessment tools (including expert judgement and critical analysis).

In addition to the investment firms ’ own assessments, investment firms may use external risk assessments (including external credit ratings or externally purchased risk models). Investment firms should be fully aware of the exact scope of such assessments and their limitations.

Regular and transparent reporting mechanisms should be established so that the management body, its risk committee, where established, and all relevant units in an investment firm are provided with reports in a timely, accurate, concise, understandable and meaningful manner and can share relevant information about the identification, measurement or assessment, monitoring and management of risks. The reporting framework should be well defined and documented.

Effective communication and awareness regarding risks and the risk strategy is crucial for the whole risk management process, including the review and decision-making processes, and helps prevent decisions that may unknowingly increase risk. Effective risk reporting involves sound internal consideration and the communication of the risk strategy and relevant risk data (e.g. exposures and key risk indicators), both horizontally across the investment firms and up and down the management chain.