4.3 Governance

The IRRBB strategy of the institution, including the risk appetite for IRRBB and IRRBB mitigation, should be part of the overall strategy, in particular the strategic objectives and risk objectives, which the management body must approve as laid down in subparagraph (2), letter (a) of Article 88(1) of Directive 2013/36/EU.

The institution’s risk appetite for IRRBB should be expressed in terms of the acceptable impact of fluctuating interest rates on both earnings and economic value and should be reflected in limits. Institutions with significant exposures to gap risk, basis risk or option risk should determine their risk appetite in relation to each of these material sub-types of IRRBB.

The overall IRRBB strategy should also include the decision about the extent to which the business model relies on generating earnings by ‘riding the yield curve’, i.e. funding assets with a comparatively long repricing period with liabilities with a comparatively short repricing period. Where the business model relies heavily on this source of earnings, the management body should explain its IRRBB strategy and how it plans to survive periods of flat or inverse yield curves.

Institutions should duly assess proposals to use new products, or engage in new activities, risk-taking or hedging strategies, prior to acquisition or implementation to ensure that the resources required to establish sound and effective IRRBB management of the product or activity have been identified, that the proposed activities are in line with the institution’s overall risk appetite, and that procedures to identify, measure, monitor and control the risks of the proposed product or activity have been established. It should be ensured that the IRRBB characteristics of these new products and activities are well understood.

Institutions using derivative instruments to mitigate IRRBB exposures should possess the necessary knowledge and expertise. Each institution should demonstrate that it understands the consequences of hedging with interest rate derivatives.

Institutions using models of customer behaviour as input for the measurement of their IRRBB should possess the necessary knowledge and expertise. Each institution should be able to demonstrate that it understands the consequences of modelling the behaviour of its customer base.

When making decisions on hedging activities, institutions should be aware of the effects of accounting policies, but the accounting treatment should not drive their risk management approach. The management of economic risks should therefore be a priority, and the accounting impacts managed as a secondary concern.

Consolidating institutions should ensure that internal governance arrangements and processes for the management of IRRBB are consistent and well integrated on a consolidated and a sub-consolidated basis.

4.3.2 Risk management framework and responsibilities

In view of having internal governance arrangements pursuant to Article 74 and 88 of Directive 2013/36/EU, institutions should, in relation to IRRBB, ensure the following:

• (a) That their management body bears the ultimate responsibility for the oversight of the IRRBB management framework, the institution’s risk appetite framework and the amounts, types and distribution of internal capital to adequately cover the risks. The management body should determine the institution’s overall IRRBB strategy and approve the corresponding policies and processes. The management body may, however, delegate the monitoring and management of IRRBB to senior management, expert individuals or an asset and liability management committee under the conditions further specified in paragraph 41.
• (b) That they have in place an IRRBB management framework that establishes clear lines of responsibilities and that consists of a limit system, policies, processes and internal controls including regular independent reviews and evaluations of the effectiveness of the framework.

The management body should, in particular, be responsible for the following:

• (a) Understanding the nature and the level of the IRRBB exposure. The management body should ensure that there is clear guidance regarding the risk appetite for IRRBB in respect of the institution’s business strategies.
• (b) Establishing that the appropriate actions are taken to identify, measure, monitor and control IRRBB, consistent with the approved strategies and policies. In this regard, the management body or its delegates are responsible for setting:
• i. appropriate limits on IRRBB, including the definition of specific procedures and approvals necessary for exceptions, and ensuring compliance with those limits;
• ii. systems and standards for measuring IRRBB, valuing positions and assessing performance, including procedures for updating interest rate shock and stress scenarios and key underlying assumptions driving the institution’s IRRBB analysis;
• iii. a comprehensive IRRBB reporting and review process; and
• iv. effective internal controls and management information systems (MISs).
• (c) Approving major hedging or risk-taking initiatives in advance of implementation. Positions related to internal risk transfers between the non-trading book and the trading book should be properly documented.
• (d) Carrying out the oversight of the approval, implementation and review of IRRBB management policies, procedures and limits. The level of and changes in the institution’s IRRBB exposure should be provided regularly to the management body (at least quarterly).
• (e) Ensuring that the validation of IRRBB measurement methods and assessment of corresponding model risk are included in a formal policy process that should be reviewed and approved by the management body or its delegates.
• (f) Understanding and assessing the functioning of its delegates in monitoring and controlling IRRBB, consistent with policies approved by the management body, on the basis of regular reviews of timely and sufficiently detailed information.
• (g) Understanding the implications of the institution’s IRRBB strategies and their potential linkages with market, liquidity, credit and operational risk but without requiring all the management body members to be experts in the area. Some of the members should have sufficient technical knowledge to question and challenge the reports made to the management body. The institution should establish that management body members are responsible for ensuring that senior management has the competence to understand IRRBB and that IRRBB management is provided with adequate resources.

Institutions should have delegation arrangements and procedures in place for any delegation by the management body of the monitoring or management of IRRBB, including, but not limited to, the following:

• (a) Persons or committees to which tasks of the management body are delegated for developing IRRBB policies and practices, such as senior management, expert individuals or an asset and liability management committee (ALCO), should be identified and have objectives clearly set out by the management body.
• (b) The management body should ensure that there is an adequate separation of responsibilities in the risk management process for IRRBB. The IRRBB identification, measurement, monitoring and control functions should have clearly defined responsibilities, should be independent from risk-taking functions on IRRBB and should report IRRBB exposures directly to the management body or its delegates.
• (c) The institution should ensure that the management body’s delegates have clear lines of authority over the units responsible for risk taking on IRRBB. The communication channel to convey the delegates’ directives to these line units should be clear.
• (d) The management body should establish that the institution’s structure enables its delegates to carry out their responsibilities, and facilitates effective decision-making and governance. In this regard, an ALCO should meet regularly and its composition should reflect each major department linked to IRRBB. The management body should foster discussion regarding the IRRBB management process, both between its members and its delegates and between its delegates and others in the institution. The management body should also ensure that regular communication between the risk management and strategic planning areas facilitate the monitoring of the risk arising from future business.

4.3.3 Risk appetite and policy limits

Institutions should articulate their risk appetite for IRRBB in terms of the risk to both economic value and earnings in particular:

• (a) Institutions should have clearly defined risk appetite statements that are approved by their management body and implemented through comprehensive risk appetite frameworks, i.e. policies and procedures for limiting and controlling IRRBB.
• (b) Their risk appetite frameworks should delineate delegated powers, lines of responsibility and accountability over IRRBB management decisions and should list the instruments, hedging strategies and risk-taking opportunities authorised for IRRBB.
• (c) In defining their risk appetites, institutions should take account of earnings risks that may arise as a consequence of the accounting treatment of transactions in the non-trading book. The risk to earnings may not be limited to interest income and expenses: the effects of changes in interest rates on the market value of instruments that, depending on accounting treatment, are reflected either through the profit and loss account or directly in equity (via other comprehensive income), should be taken into account separately. Institutions should particularly take into account the earnings impact related to embedded optionalities in fair value instruments under ongoing interest rate shocks and stress scenarios. Institutions should also take into account the potential impact on the P&L accounts of hedging interest rate derivatives if their effectiveness was hampered by interest rate changes.

Institutions should implement limits that target maintaining IRRBB exposures consistent with their risk appetite and with their overall approach for measuring IRRBB, in particular the following:

• (a) Aggregate risk limits that clearly articulate the amount of IRRBB acceptable to the management body should be applied on a consolidated basis and, as appropriate, at the level of individual affiliates.
• (b) Limits may be associated with specific scenarios of changes in interest rates and term structures, such as their increase or decrease or a change in shape of the yield curve. The interest rate movements used in developing these limits should represent sufficiently adverse shock and stress situations, taking into account historical interest rate volatility and the time required by management to mitigate those risk exposures.
• (c) Policy limits should be appropriate to the nature, size, complexity and capital adequacy of the institution, as well as its ability to measure and manage its risks.
• (d) Depending on the nature of an institution's activities and business model, sub-limits may also be identified for individual business units, portfolios, instrument types, specific instruments or material sub-types of IRRBB risk such as gap risk, basis risk and option risk.
• (e) Systems should be in place to ensure that positions that exceed, or are likely to exceed, limits defined by the management body or its delegates receive prompt management attention and are escalated without delay. There should be a clear policy on who will be informed, how the communication will take place and the actions which will be taken in response.
• (f) The reporting of risk measures to the management body or its delegates should have at least a quarterly frequency and should compare current exposure with policy limits.

A framework should be in place to monitor the evolution of hedging strategies that rely on instruments such as derivatives, and to control mark-to-market risks in instruments that are accounted for at market value. 4.3.4 Risk policies, processes and controls

• a. Risk policies and processes

The management body should, based on its overall IRRBB strategy, adopt robust risk policies, processes and systems which should ensure that:

• (a) procedures for updating scenarios for the measurement and assessment of IRRBB are set up;
• (b) the measurement approach and the corresponding assumptions for measuring and assessing IRRBB, including the allocation of internal capital to IRRBB risks, are appropriate and proportional;
• (c) the assumptions of the models used are regularly reviewed and, if necessary, amended;
• (d) standards for the evaluation of positions and the measuring of performance are defined;
• (e) appropriate documentation and control over permissible hedging strategies and hedging instruments exist; and
• (f) the lines of authority and responsibility for managing IRRBB exposures are defined.

The policies should be well reasoned, robust and documented and should address all IRRBB components that are important to the institution’s individual circumstances. Without prejudice to the proportionality principle, the IRRBB policies should include the following:

• (a) The application of the boundary between ‘non-trading book’ and ‘trading book’. Internal risk transfers between the banking book and the trading book should be properly documented and monitored within the broader monitoring of the IRRBB originated by interest rate derivatives instruments.
• (b) The more detailed definition of economic value and its consistency with the method used to value assets and liabilities (e.g. based on the discounted value of future cash flows, and on the discounted value of future earnings) adopted for internal use.
• (c) The more detailed definition of earnings risk and its consistency with the institution’s approach to developing financial plans and financial forecasts adopted for internal use.
• (d) The size and the form of the different interest rate shocks to be used for internal IRRBB calculations.
• (e) The use of conditional or unconditional cash flow modelling approaches.
• (f) The treatment of ‘pipeline transactions’¹⁴ (including any related hedging).
• (g) The aggregation of multicurrency interest rate exposures.
• (h) The measurement and management of basis risk resulting from different interest rate indexes.
• (i) Whether or not non-interest-bearing assets and liabilities of the non-trading book (including capital and reserves) are included in calculations measuring IRRBB for the ICAAP.
• (j) The behavioural treatment of current and savings accounts (i.e. the maturity assumed for liabilities with short contractual maturity but long behavioural maturity).
• (k) The measurement of IRRBB arising from behavioural and automatic options in assets or liabilities, including convexity effects and non-linear payoff profiles.
• (l) The degree of granularity employed in measurement calculations (e.g. use of time buckets).
• (m) The internal definition of commercial margins and adequate methodology for internal treatment of commercial margins.

All IRRBB policies should be reviewed regularly, at least annually, and revised as needed.

To ensure that the institution’s IRRBB management policies and procedures remain appropriate and sound, the management body or its delegates should review the IRRBB management policies and procedures in the light of the outcomes of regular reports.

The management body or its delegates should ensure that analysis and risk management activities related to IRRBB are conducted by sufficient and competent staff with technical knowledge and experience, consistent with the nature and scope of the institution’s activities.

• b. Internal controls

With regard to IRRBB control policies and procedures, institutions should have appropriate approval processes, exposure limits, reviews and other mechanisms designed to provide a reasonable assurance that risk management objectives are being achieved.

Institutions should undertake regular reviews and evaluations of their internal control systems and risk management processes, seeking assurance that personnel comply with established policies and procedures. Such reviews should also address any significant changes that may affect the effectiveness of controls, including changes in market conditions, personnel, technology and structures of compliance with exposure limits, and ensure that there are

14 Pipeline exposures (e.g. where a loan has been agreed and the customer can choose whether to draw down or not) effectively provide the customer with an option that will most likely be exercised when market conditions least suit the institution (negative convexity). Management of pipeline exposures relies on accurate data on applications received, and modelling of expected drawdowns. appropriate escalation procedures for any exceeded limits. The reviews and evaluations should be conducted regularly by individuals or units that are independent of the function under review. When revisions or enhancements to internal controls are warranted, there should be an internal review mechanism in place to ensure that these are implemented in a timely manner.

Institutions should have their IRRBB identification, measurement, monitoring and control processes reviewed by an independent auditing function, which may be an internal or external auditor, on a regular basis. In such cases, reports written by internal or external auditors or other equivalent external parties should be made available to relevant competent authorities.

• c. IRRBB IT system and data quality

The IT systems and applications used by the institution to carry out, process and record operations, to identify, measure and aggregate IRRBB exposures, and to generate reports should be capable of supporting the management of IRRBB in a timely and accurate manner. In particular, the systems should:

• (a) Capture interest rate risk data on all the institution’s material IRRBB exposures including exposures to gap, basis, and option risk. This should support the institution’s measurement system to identify, measure and aggregate the major sources of IRRBB exposures.
• (b) Be capable of fully and clearly recording all transactions made by the institution, taking into account their IRRBB characteristics.
• (c) Be tailored to the complexity and number of transactions creating IRRBB.
• (d) Offer sufficient flexibility to accommodate a reasonable range of shock and stress scenarios and any additional scenarios.
• (e) Enable the institutions to fully measure, assess and monitor the contribution of individual transactions to their overall exposure.
• (f) Be able to compute economic value and earnings-based measures of IRRBB, as well as other measures of IRRBB prescribed by their competent authorities, based on the interest rate shock and stress scenarios set out in sections 4.4.3 and 4.4.4.
• (g) Be sufficiently flexible to incorporate supervisory-imposed constraints on institutions’ internal risk parameter assumptions.

The IT system and transaction system should be capable of recording the repricing profile, interest rate characteristics (including spread) and option characteristics of the products to enable measurement of gap risk, basis risk and option risk. In particular, the transaction system should be able to gather detailed information on the repricing date(s) of a given transaction, interest rate type or index, any options (including early repayment or redemption) and the fees relating to the exercise of these options.

The systems used to measure IRRBB should be capable of capturing the IRRBB characteristics of all products. The systems should also allow the disaggregation of the impact of individual IRRBB instruments and portfolios at the risk level of the non-trading book.

For complex, structured products in particular, the transaction system should be able to gather information about the separate parts of the product and to capture their IRRBB characteristics (e.g. the characteristics of assets and liabilities grouped by certain characteristics such as repricing dates or optionality elements). The institution should ensure that the IT system is able to keep pace with the introduction of new products.

Adequate organisational controls of IT systems should be in place to prevent the corruption of data used by IRRBB computer systems and applications, and to control changes to the coding used in those applications, so as to ensure, in particular:

• (a) the reliability of data used as input, and the integrity of processing systems for IRRBB models;
• (b) that the likelihood of errors occurring in the IT system, including those occurring during data processing and aggregation, is minimised; and
• (c) that adequate measures are taken if market disruptions or slumps occur.

Risk measures should be based on reliable market and internal data. Institutions should scrutinise the quality of external sources of information used to establish the historical databases of interest rates, as well as the frequency at which databases are updated.

To ensure the high quality of data, institutions should implement appropriate processes that ensure that the data entered into the IT system is correct. Data inputs should be automated as much as possible to reduce administrative errors, and data mapping should be periodically reviewed and tested against an approved model version. In addition, there should be sufficient documentation of the major data sources used in the institution’s risk measurement process. Institutions should also establish appropriate mechanisms to verify the correctness of the aggregation process and the reliability of model results. These mechanisms should confirm the accuracy and reliability of data.

Where institutions slot cash flows into different time buckets (e.g. for gap analyses) or assign the cash flows to different vertex points to reflect the different tenors of the interest rate curve, the slotting criteria should be stable over time to allow a meaningful comparison of risk figures over different periods.

Institutions should identify potential reasons for discrepancies and irregularities that may arise at the time of data processing. Institutions should have procedures in place to handle those discrepancies and irregularities, including procedures for the mutual reconciliation of positions to enable these discrepancies and irregularities to be eliminated.

Institutions should set up appropriate processes to ensure that the data used to feed models measuring the IRRBB across the group — e.g. for simulating earnings — is consistent with the data used for financial planning.

• d. Internal reporting

Institutions’ internal risk-reporting systems should provide timely, accurate and comprehensive information about their exposures to IRRBB. The frequency of internal reports should be at least quarterly.

The internal reports should be provided to the management body or its delegates with information at relevant levels of aggregation (by consolidation level and currency), and reviewed regularly. The reports should contain a level of information adapted to the particular management level (e.g. management body, senior management) and to the specific situation of the institution and the economic environment.

The IRRBB reports should provide aggregate information as well as sufficient supporting detail to enable the management body or its delegates to assess the sensitivity of the institution to changes in market conditions and other important risk factors. The content of the reports should reflect changes in the risk profile of the institution and in the economic environment, and compare current exposure with policy limits.

The IRRBB reports should, on a regular basis, include the results of the model reviews and audits as well as comparisons of past forecasts or risk estimates with actual results to inform potential modelling shortcomings. In particular, institutions should assess the modelled prepayment losses against historical realised losses. Portfolios that may be subject to significant mark-to-market movements should be clearly identified and the impact should be monitored within the institution’s MIS and subject to oversight in line with any other portfolios exposed to market risk.

While the types of reports prepared for the management body or its delegates will vary based on the institution’s portfolio composition, they should include, taking into account paragraph 65, the following:

• (a) Summaries of the institution’s aggregate IRRBB exposures, including information on exposures to gap, basis and option risk. Assets, liabilities, cash flows, and strategies that are driving the level and direction of IRRBB should be identified and explained.
• (b) Reports demonstrating the institution’s compliance with policies and limits.
• (c) Key modelling assumptions, such as characteristics of non-maturity deposits (NMDs), prepayments on fixed rate loans, early withdrawals of fixed term deposits, drawing of commitments, currency aggregation and treatment of commercial margins.
• (d) Details of the impact of key modelling assumptions on the measurement of IRRBB in terms of both economic value measures and earnings measures, including changes in assumptions under various interest rate scenarios.
• (e) Details of the impact of interest rate derivatives on the measurement of IRRBB, in terms of both economic value measures and earnings measures.
• (f) Details of the impact of fair value instruments, including Level 3 assets and liabilities, on the measurement of IRRBB in terms of both economic value measures and earnings measures.
• (g) Results of stress tests as referred to in section 4.4.4, the shocks as referred to in section 4.4.3, the supervisory outlier test as referred to in section 4.5, and assessments of sensitivity to key assumptions and parameters; and
• (h) Summaries of the reviews of IRRBB policies, procedures and adequacy of the measurement systems, including any findings of internal and external auditors or other equivalent external parties (such as consultants).

Based on these reports, the management body or its delegates should be able to assess the sensitivity of the institution to changes in market conditions and other important risk factors, with particular reference to portfolios that may potentially be subject to significant mark-to-market movements.

The internal measurement system should generate reports in a format that allows the different levels of the institution’s management to understand the reports easily and to make appropriate decisions in a timely manner. The reports should constitute the basis for regular monitoring of whether or not the institution operates in line with its strategy and the interest rate risk limits it has adopted.

• e. Model governance

Institutions should ensure that the validation of IRRBB measurement methods — which should be reviewed and validated independently of their development — and the assessment of corresponding model risk are included in a formal policy process that should be reviewed and approved by the management body or its delegates. The policy should be integrated within the governance processes for model risk management and should specify:

• (a) the management roles and designate who is responsible for the development, validation, documentation, implementation and use of models; and
• (b) the model oversight responsibilities as well as policies including the development of initial and ongoing validation procedures, evaluation of results, approval, version control, exception, escalation, modification and decommission processes.

The validation framework should include the following four core elements:

• (a) evaluation of conceptual and methodological soundness, including developmental evidence;
• (b) ongoing model monitoring, including process verification and benchmarking;
• (c) outcomes analysis, including back-testing of key internal parameters (e.g. stability of deposits, loan prepayment rates, early redemptions of deposits, pricing of instruments); and
• (d) thorough assessment of any expert opinions and judgements used in internal models.

In addressing the expected initial and ongoing validation activities, the policy should establish a hierarchical process for determining model risk soundness based on both quantitative and qualitative dimensions such as size, impact, past performance and staff expertise with the modelling technique employed.

Model risk management for IRRBB measures should follow a holistic approach that begins with motivation, development and implementation by model owners and users. Prior to receiving internal approval for usage, the process for determining model inputs, assumptions, modelling methodologies and outputs should be reviewed and validated independently of the development of IRRBB models.

The review and validation results and any recommendations on model usage should be presented to and approved by the management body or its delegates. Upon approval, the model should be subject to ongoing review, process verification and validation at a frequency that is consistent with the level of model risk determined and approved by the institution.

The ongoing review process should establish a set of exception trigger events that obligate the model reviewers to notify the management body or its delegates in a timely fashion, in order to determine corrective actions and restrictions on model usage. Clear version control authorisations should be designated, where appropriate, to model owners.

On the basis of observations and new information gained over time, an approved model may be modified or withdrawn. Institutions should articulate policies for model transition, including change and version control authorisations and documentation.

Institutions may rely on third-party IRRBB models to manage and control IRRBB, provided that these models are adequately customised to properly reflect the specific characteristics of the institution in question. Institutions are expected to fully understand the underlying analytics, assumptions and methodologies of the third-party models and to ensure that they are adequately integrated into the institutions’ overall risk management systems and processes. Where third parties provide input for market data, behavioural assumptions or model settings, the institution should have a process in place to determine if those inputs are reasonable for its business and the risk characteristics of its activities. Institutions should ensure there is adequate documentation of their use of third-party models, including any specific customisation.

Model inputs or assumptions, whether stemming from internal model processes or from third parties, should be included in the validation process. The institution should document and explain model specification choices as part of the validation process.