Risk management in banks: credit, market, liquidity and operational risk

A bank's business is taking risk: it lends to people who might not repay, borrows short to lend long, and holds bonds whose prices move every day. It fails when it takes on more risk than its capital and liquidity can absorb, or when it does not know what risks it is running. Paper III questions test both the concepts and the arithmetic, and this topic ties together Basel capital, NPAs and asset–liability management. Learn the measures by working the numbers once.

The main risks

Credit, market and operational risk get Pillar 1 capital under Basel. The others are handled mainly through Pillar 2 and liquidity rules.

Credit risk

Banks control credit risk through appraisal, internal ratings, collateral, covenants, exposure limits and early-warning signals such as SMA flags. The key measure is expected loss:

Expected loss (EL) = probability of default (PD) × loss given default (LGD) × exposure at default (EAD)

Worked example: expected loss

A bank lends ₹10 crore. Its rating model estimates PD of 2% a year, and it expects to lose 45% of the exposure if default occurs.

1. EL = 0.02 × 0.45 × 10 crore = ₹0.09 crore = ₹9 lakh.
2. Expected loss is a cost of doing business. It should be covered by the loan's pricing and by provisions.
3. Unexpected loss (losses above the average in a bad year) is what capital is for.

If collateral improves and LGD falls to 30%, EL = 0.02 × 0.30 × 10 crore = ₹6 lakh. Collateral works on LGD, not on the chance of default.

Market risk

The standard summary measure is value at risk (VaR): the maximum loss over a given horizon at a given confidence level, under normal market conditions.

Worked example: VaR

A trading portfolio is worth ₹100 crore, and its daily returns have a standard deviation of 1%. At 99% confidence (one-tailed), the z-value is 2.33.

1. One-day VaR = 2.33 × 1% × 100 crore = ₹2.33 crore.
2. Meaning: on 99 days out of 100, the loss should not exceed ₹2.33 crore.
3. Ten-day VaR ≈ one-day VaR × √10 = 2.33 × 3.16 ≈ ₹7.37 crore.

VaR says nothing about how large losses can be on the worst 1% of days. That is why banks also use expected shortfall (the average loss beyond VaR) and stress tests.

For bonds, the key measure is modified duration: the approximate percentage fall in price for a one-percentage-point rise in yield.

Worked example: duration

A bank holds ₹200 crore of bonds with a modified duration of 5. Yields rise by 50 basis points (0.5 percentage point).

1. Price change ≈ −5 × 0.5% = −2.5%.
2. Loss ≈ 2.5% × 200 crore = ₹5 crore.

Liquidity and interest rate risk: ALM

Asset–liability management (ALM) manages the mismatch between a bank's short-term liabilities and longer-term assets. An ALCO (asset–liability committee) of senior managers meets regularly to set pricing and funding strategy within board-approved limits.

• Structural liquidity statement: cash inflows and outflows are placed in time buckets. RBI guidelines cap negative mismatches in the near buckets: 5% of outflows for the next day, 10% for 2–7 days, 15% for 8–14 days and 20% for 15–30 days.
• LCR and NSFR (Basel III) complement the gap statement.
• Repricing gap: rate-sensitive assets (RSA) minus rate-sensitive liabilities (RSL) in each bucket.

Worked example: repricing gap

In the one-year bucket, a bank has RSA of ₹800 crore and RSL of ₹1,000 crore.

1. Gap = 800 − 1,000 = −₹200 crore (liability-sensitive).
2. If rates rise by 1 percentage point, interest paid rises faster than interest earned: change in net interest income ≈ gap × change in rate = −200 × 1% = −₹2 crore.
3. If rates fall by 1 point, net interest income rises by ₹2 crore.

A negative gap gains when rates fall; a positive gap gains when rates rise. Duration gap analysis extends this from earnings to the bank's economic value.

Operational risk

Basel defines seven event types, which banks use to record losses:

1. Internal fraud.
2. External fraud.
3. Employment practices and workplace safety.
4. Clients, products and business practices.
5. Damage to physical assets.
6. Business disruption and system failures.
7. Execution, delivery and process management.

Controls include segregation of duties, maker-checker, reconciliation, audit, business continuity plans, cyber security frameworks and insurance. In India, loan frauds and digital-payment frauds have made this a major supervisory focus.

Governance: three lines of defence

1. First line, business units: own the risks they take and run controls day to day.
2. Second line, risk management and compliance: set limits, measure risk and challenge the business independently. The Chief Risk Officer (CRO) leads this line; RBI guidelines require the CRO to have a fixed minimum tenure and a direct reporting line to the board's risk committee, so the role is independent of business targets.
3. Third line, internal audit: independent assurance to the board's audit committee.

At the top, the board sets the risk appetite: how much risk of each type the bank is willing to take to meet its goals. Stress tests then ask whether capital and liquidity survive severe but plausible scenarios. The RBI's Financial Stability Report publishes system-wide stress test results twice a year.

Model answer outline (15 marks)

Question: Discuss the importance of asset–liability management for Indian banks, with reference to liquidity and interest rate risk.

1. Introduction: maturity transformation as the core of banking; ALM defined.
2. Liquidity risk: short-term deposits funding long loans; runs; the NBFC episode of 2018–19 as an illustration.
3. Interest rate risk: repricing gaps; worked illustration; bond portfolio losses when yields rise.
4. Tools: structural liquidity statement and bucket limits; LCR, NSFR; repricing and duration gaps; ALCO; hedging.
5. Governance: board-approved limits; CRO independence; stress testing.
6. Conclusion: ALM protects both profitability and survival.

Short model answer (10 marks)

Question: Explain the "three lines of defence" model of risk management.

The three lines of defence model sets out who is responsible for managing and checking risk in a bank.

The first line is the business itself: branches, credit departments and treasury. They take risks to earn income, so they must own those risks and run day-to-day controls such as credit appraisal and maker-checker.

The second line is the independent risk management and compliance functions. They set limits, measure exposures, monitor compliance with laws and regulations, and challenge business decisions. Their independence is protected by giving the Chief Risk Officer and the Chief Compliance Officer direct access to board committees.

The third line is internal audit. It gives the board independent assurance that the first two lines are working, reporting to the audit committee.

The model works only when each line is independent and adequately staffed, and when the board sets a clear risk appetite. Many bank failures trace back to a second line that was overruled by business targets.

Practice questions

1. PD 3%, LGD 40%, EAD ₹50 crore. What is the expected loss?
   • ₹0.6 crore (₹60 lakh). 0.03 × 0.40 × 50.
2. A bond portfolio of ₹400 crore has modified duration 4. Yields rise 25 bps. Approximate loss?
   • ₹4 crore. 4 × 0.25% = 1%, of ₹400 crore.
3. RSA ₹600 crore, RSL ₹450 crore. What happens to NII if rates fall by 1 percentage point?
   • It falls by ₹1.5 crore (positive gap of ₹150 crore).
4. Which line of defence does internal audit form?
   • The third.
5. Which risk does collateral mainly reduce: PD or LGD?
   • LGD.
6. Under which Basel event type does a data-centre fire fall?
   • Damage to physical assets.

What to do next

• Write the EL, VaR, duration and gap formulas on one card.
• Redo the VaR example at 95% confidence (z = 1.65).
• Read the Basel norms guide to see how these risks become capital.
• Then read the corporate governance guide for the board's role.