Reserve Bank of Australia Annual Report – 2013 Risk Management
Objectives and Governance Structure
In the process of carrying out its responsibilities as a central bank, the Reserve Bank faces a broad range of risks. From a financial perspective, the most significant of these are derived from the financial assets held to support the Bank's operations in financial markets. However the Bank also manages material risks arising from its banking and settlement operations, the implementation of large and complex projects and from the administration of the Bank itself. The Bank seeks to manage its risk profile carefully. This reflects the view that satisfactory fulfilment of its important public policy responsibilities could be seriously undermined if poorly managed risks were to result in significant financial losses or damage to the Bank's reputation. That said, the Bank recognises that it cannot eliminate the risks involved in its activities completely.
Risk management is an integral part of the management function in the organisation and, as such, is the clear responsibility of management. Line managers have the responsibility to evaluate their risk environment, to put in place appropriate controls and to monitor the effectiveness of these controls. Management is supported in this role through the development and maintenance of an active risk management culture that acknowledges the need for careful analysis and management of risk in all business processes.
The Reserve Bank identifies, assesses and manages risk at both an enterprise (‘top-down’) and business (‘bottom-up’) level, a process that is subject to ongoing review. Controls put in place to manage the Bank's risk environment are carefully assessed to ensure they are well developed and implemented effectively. During the past year the Bank's senior executives participated in a facilitated workshop to discuss the key risks that could potentially affect the Bank at an enterprise-wide level. These key enterprise risks were analysed to ensure the primary drivers are fully understood and the corresponding control environment is as robust as possible. This exercise was a valuable addition to the existing risk assessment process undertaken by individual departments on an annual basis.
Oversight of the risk management framework sits with the Risk Management Committee, which is chaired by the Deputy Governor and comprises the Assistant Governors for Banking and Payments, Corporate Services, Currency and Financial Markets; the Chief Financial Officer; the Chief Information Officer; the Heads of Audit, Human Resources and Risk Management; and the General Counsel and Deputy Secretary. The Risk Management Committee is responsible for ensuring that all the risks the organisation faces, with the exception of those arising directly from the Bank's monetary policy, financial stability and payments policy functions, are properly assessed and managed. Over the course of the past year, the Committee met quarterly and informed the Executive Committee and Reserve Bank Board Audit Committee of its activities. The Committee recently decided to move to six meetings a year, and will meet more frequently if needed.
The Risk Management Committee is assisted in its responsibilities by the Risk Management Unit (RM). The Unit's main role is to assist individual business areas to manage their risk environment within a broadly consistent framework. RM also monitors risk and performance associated with the Bank's activities in financial markets and provides support to the business areas in the implementation of fraud control and business continuity systems. RM reports directly to the Deputy Governor.
The Audit Department also supports the framework for managing risk, complementing but remaining separate from the work of RM. In addition to providing assurance that the Bank's risk management policies are effective, the Audit Department has a separate, independent brief to test the adequacy of procedures and controls at all levels of the Reserve Bank. RM itself is subject to audit review. The Audit Department reports to the Deputy Governor and the Reserve Bank Board Audit Committee, which meets every three months or more frequently if required.
As noted above, the Reserve Bank's risk management framework covers a broad range of financial and operational risks, but not those inherent to the Bank's core monetary policy, financial stability and payments policy functions. These remain the responsibility of the Governor, the Reserve Bank Board and the Payments System Board. The risks associated with the Bank's ownership of Note Printing Australia Limited (NPA) – a wholly owned subsidiary of the Reserve Bank – are also covered by the framework, though the day-to-day activities of NPA are the responsibility of its management and the NPA Board.
Portfolio Risks
The Reserve Bank holds domestic and foreign currency-denominated financial instruments to support its operations in financial markets in pursuit of its policy objectives. These instruments account for the majority of the Bank's assets and expose the balance sheet to a number of financial risks, of which the largest are exchange rate risk, interest rate risk and credit risk. The Bank does not aim to eliminate these portfolio risks entirely as this would interfere with its ability to implement its policy objectives. Instead, the risks are managed to an acceptable level and minimised where appropriate through a number of controls, which are discussed below. The primary responsibility for managing these risks rests with the Financial Markets Group. The role of RM is to monitor these risks and report on adherence with approved authorities and limits. In that regard, the Assistant Governor (Financial Markets), the Head of Risk Management and other senior staff are provided with real-time and daily reports on limits compliance, portfolio risks and performance.
Exchange rate risk
The Reserve Bank invests in foreign currency-denominated assets as holder of Australia's official foreign currency reserves. These holdings expose the Bank's balance sheet to fluctuations in exchange rates. Given its policy role, the Bank does not seek to eliminate this exposure but rather mitigates the risk by diversifying its foreign currency assets across four currencies. The weights of these four currencies are specified in terms of a benchmark that reflects the Bank's long-term risk and return preferences given its need for high liquidity and security. The portfolio is rebalanced daily taking into account changes in market rates or transactions.
The allocation of the portfolio across the four currencies was changed over the course of 2012/13, with the US dollar allocation increased from 45 to 55 per cent, while the euro allocation was reduced from 45 to 35 per cent; the 5 per cent allocation to the Japanese yen and the 5 per cent allocation to the Canadian dollar remained unchanged (see chapter on ‘Operations in Financial Markets’). The changes in allocation were effected gradually to avoid disrupting markets.
The Australian dollar value of the Reserve Bank's portfolio rose over the year, mainly owing to valuation gains due to the depreciation of the Australian dollar exchange rate. As exchange rate risk is primarily a function of portfolio size, the yardstick measure of exchange rate risk increased over the year. At the current level of reserves, a yardstick measure of exchange rate risk (a 10 per cent appreciation of the Australian dollar) would result in losses of around $3.8 billion.
Interest rate risk
The value of the Reserve Bank's financial assets is also exposed to movements in market interest rates as the bulk of the portfolio is made up of domestic and foreign fixed-income securities. Because the cashflow on these securities is fixed, changes in market yields affect the present value of this income stream. In general, the value of these securities will decline as market yields rise while a fall in market yields will increase their value. Other things being equal, securities that have a longer maturity contain a greater degree of interest rate risk as their cashflows extend further into the future. In present value terms, these securities will be more sensitive to discounting than those with near-term cashflows.
The Reserve Bank holds domestic securities for policy-related purposes. At the end of June 2013, total holdings of domestic securities were $43 billion, around $11 billion higher than a year earlier owing to an increase in holdings of securities under reverse repurchase agreements (repos). The average term of the Bank's domestic repo book at the end of June was almost four weeks, slightly higher than a year earlier. For domestic securities held outright, the sensitivity to movements in market yields fell marginally over the year as the value of the outright holdings in the portfolio declined.
The Reserve Bank is exposed to very little interest rate risk on its balance sheet liabilities. Banknotes on issue account for over half of total liabilities and carry no interest cost to the Bank. The other sizeable obligations include deposits held by the Australian Government and government agencies, and exchange settlement account balances held by authorised deposit-taking institutions (ADIs). These deposits have short maturities that broadly match the Bank's domestic assets held under repo. Interest paid on these deposits reflects domestic short-term interest rates, effectively hedging part of the interest rate exposure of the domestic asset portfolio.
In contrast to the domestic portfolio, the Reserve Bank's foreign currency assets are managed relative to a benchmark that reflects the Bank's long-term appetite for risk and return and is specified in terms of a target portfolio duration. The benchmark duration was reduced to six months for the US, Canadian and Japanese portfolios over the past year, but remains at 18 months for the European portfolio.
The overall level of interest rate risk on the Reserve Bank's domestic and foreign financial assets decreased over the past year, driven by the changes to the benchmark duration targets and asset allocation of the foreign portfolio. The Bank would incur a valuation loss of about $480 million if interest rates in Australia and overseas rose uniformly by 1 percentage point across the yield curve.
Credit risk
Credit risk is the potential for financial loss arising from the default of a debtor or issuer, as well as declines in asset values due to a deterioration in credit quality. The Reserve Bank manages its credit exposure by applying a strict set of criteria to its investments, confining its dealings to highly creditworthy counterparties and holding only highly rated securities. In addition, the Bank's transactions are executed under internationally recognised legal agreements.
The Reserve Bank is exposed to very little credit risk on its outright holdings in the domestic portfolio as it invests only in securities issued by the Australian Government or by state and territory government borrowing authorities. Given that a large portion of the Bank's domestic assets are held under repo, the Bank is exposed to some counterparty credit risk. However, the credit risk on repos is inherently limited and ultimately reflects the quality and market value of the securities provided as collateral. The Bank faces a loss only if the counterparty fails to repurchase securities sold under repo and the market value of the securities falls to be less than the agreed repurchase amount. Furthermore, the Bank manages this exposure by applying an appropriate margin (‘haircut’) to the securities and requiring that these securities meet certain eligibility criteria. The degree of over-collateralisation ranges from 1 to 23 per cent, and increases with the risk profile of the security. As a result, the residual exposure to the Bank is very low.
Given its policy role, the Reserve Bank does not apply specific credit criteria to the counterparties with which it is willing to deal in its domestic market operations. Rather, to be eligible to participate in the Bank's open market operations, counterparties must be subject to an appropriate level of regulation and be able to ensure efficient and timely settlement of transactions within the Austraclear system.
The Reserve Bank's investments in the foreign portfolio are also typically confined to highly rated securities. The majority of the Bank's outright holdings are highly liquid securities issued by the national governments of the United States, Germany, France, the Netherlands, Japan and Canada, with modest holdings of securities issued by select highly rated supranational institutions. The Bank also holds a portion of its foreign portfolio in short-term repos. This exposes the Bank to the small amount of residual credit risk that is inherent in repos, as noted above. The Bank manages this risk by requiring 2 per cent over-collateralisation and accepting only high-quality and liquid securities as collateral. Credit exposure on foreign repurchase agreements is further managed by imposing limits on individual counterparty exposures. The credit risk framework applies credit ratings and market-based credit measures to manage risk exposures.
The Reserve Bank uses foreign exchange swaps as part of its policy operations. Credit risk on these instruments is managed to a low level by executing foreign exchange transactions under internationally recognised legal agreements only with counterparties that meet strict eligibility criteria and have been approved by a group of senior Bank officials. These counterparties are generally highly rated; however, factors other than credit ratings are also considered. The Bank has sought to reduce risk associated with foreign exchange swaps further through margining under two-way credit support annexes. This involves the Bank receiving and sending collateral to cover exposures on foreign exchange swaps generated by movements in exchange rates away from the contracted rate.
Operational Risk
The Reserve Bank faces risks to the operation of its systems and the effective functioning of its internal processes on a day-to-day basis. These risks are similar to those faced by other financial institutions and range from the possibility that access to key financial infrastructure might be lost to the possibility that services might not be delivered to the required standard.
The risks associated with financial transactions remain among the most significant faced by the Reserve Bank. These transactions are carried out both to support the Bank's activities and on behalf of clients. During 2012/13, Financial Markets Group executed around 82,000 transactions, generating an average daily settlement value of around $29 billion.
In addition to these activities, the Reserve Bank is the main banker for a number of government agencies – including the Australian Taxation Office and the Department of Human Services – and maintains the infrastructure to facilitate real-time interbank payment and settlement services through the Reserve Bank Information and Transfer System. Given the pivotal nature of these activities, any operational failure could have widespread consequences for the financial system. Ongoing assessments of the operating risks associated with these functions are undertaken to ensure the control environment remains suitably robust.
The provision of the Reserve Bank's policy and business operations are highly dependent on complex information technology (IT) systems. As such, the Bank's risk management framework supports a continuing focus on controlling the main operational risks associated with these systems, including extensive monitoring, reconciliation and reporting functions, to ensure that a control failure does not lead to an unacceptable outage. In addition to this, IT staff regularly evaluate industry developments to ensure the Bank's systems reflect current technology and remain robust. Assessments of appropriate staff resourcing, the adequacy of controls over IT processes and the level of security over information management are all incorporated into the Bank's ongoing risk management processes.
As well as maintaining existing IT systems, the Reserve Bank is currently engaged in a number of large and complex technology projects, including the renovation of its banking applications and systems, the development of infrastructure to facilitate real-time retail payments and the upgrade of Australia's banknotes. These initiatives will ensure high-quality services are maintained for the Bank's clients and the Australian public. To address any potential risk that infrastructure changes to the systems and databases used in these projects could result in a failure or deterioration of service, the Bank has put in place comprehensive change management procedures and project management systems. This includes a comprehensive testing regime before any change is upgraded to a production environment, with staff on-call to ensure any system problems are quickly assessed and remedial action is put in place where required.
The loss of IT systems or Head Office facilities as a result of a natural disaster or other disruptive event is a key risk identified at both an enterprise and business level. In order to ensure the continuity of critical business services in such an event, the Reserve Bank has put in place extensive backup plans and operates a Business Resumption Site (BRS) in north-west Sydney. Permanent staff from some of the most critical business areas are located at the BRS to enable virtual continuity of operations if a disruption to Head Office were to occur. All departments regularly test backup arrangements to cover a range of contingency scenarios, including working from the BRS or an alternative location. The Risk Management Committee monitors the results of these tests.
A significant operational risk facing any institution is that staff may engage in fraud or undertake unauthorised transactions exposing the institution to reputational damage or significant financial loss. Over the year to the end of June 2013, the Reserve Bank has seen this risk materialise in two instances. The first incident concerned the theft and unauthorised disclosure of Bank data in September 2012. The second instance occurred from December 2011 to November 2012 in the procurement area of the Melbourne Office and involved a former manager of the facilities management function. In both cases the Deputy Governor notified the Australian Federal Police and requested its assistance in the investigation.
The Reserve Bank has a number of controls in place to mitigate the risk of fraud. These include having a clear decision-making hierarchy, separation of duties, and controls over computer access at both the user and administrator levels. However, when a control failure is detected a reassessment of the risk environment is undertaken. Following the two fraud incidents, the relevant circumstances were reviewed extensively by the Risk Management Committee and remedial work was commissioned by management to strengthen the Bank's processes and controls.
With regard to financial transactions, all staff involved in financial dealing have well-defined limits to their authority to take risk or otherwise commit the Reserve Bank. These arrangements are further enhanced by independent front-, back- and middle-office functions where staff who initiate trades, those who settle them and those who monitor and report on exposures and compliance with trading and investment guidelines are physically separate and have separate reporting lines.
The Reserve Bank is strongly committed to establishing and maintaining a culture that encourages and supports the highest standards of behaviour. As noted in the chapter on ‘Governance’, the Code of Conduct for employees was rewritten over the course of the past year to articulate more explicitly the values that the Bank expects its staff to demonstrate when pursuing its objectives, including promotion of the public interest, integrity, excellence, intelligent inquiry and respect. The Fraud Control Policy and arrangements by which fraud and unethical behaviour can be reported anonymously are part of the framework. These initiatives are supported by regular fraud awareness training, which endeavours to keep staff aware of their responsibilities in this area.
Despite strong controls and a good risk management culture, operational failures occur from time to time, which can adversely affect the Reserve Bank's reputation or lead to other costs. These failures are reported in a timely way to the Risk Management Committee and monitored to identify areas where new controls may be needed or where existing controls should be strengthened.
Anti-Money Laundering and Counter-Terrorism Financing Program
As a provider of designated services under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act), the Reserve Bank is required to have an anti-money laundering and counter-terrorism financing program. The AML/CTF Act mandates that an AML/CTF program be divided into Part A and Part B, with the primary purpose of Part A being to identify, manage and mitigate the money laundering or terrorism financing risks faced by the Bank, while Part B sets out its customer identification procedures under the AML/CTF Act. One of the requirements of the rules made under the AML/CTF Act is that Part A must be approved by an organisation's governing board and senior management.
Over the past year, the Reserve Bank reviewed and updated its AML/CTF program to ensure that it accurately reflected the Bank's AML/CTF-related activities and met the requirements of the AML/CTF Act. Part A of the Bank's revised AML/CTF program was endorsed by the Bank's Executive Committee in June 2013 and by the Reserve Bank Board the following month. The Board also receives an annual report on the Bank's AML/CTF program.
Government Guarantee Scheme
The Reserve Bank manages on behalf of the Australian Government the Guarantee Schemes for Large Deposits and Wholesale Funding and for State and Territory Borrowing. Applications for new guaranteed liabilities under both schemes closed in 2010, but the Bank will continue to have responsibility for collecting fees on existing liabilities for some years. Around $600 million in fees was collected on behalf of the Government in 2012/13.