How to set a Risk Escalation Workflow That Fits the Breach

A risk escalation workflow is the written route a limit crossing takes from the control that notices it to the body that decides what to do about it. Build it in eight numbered steps: detection, classification, the first named person, the clock, the deciding body, the decision and its record, the standing reporting line, and the closure test. Miss the second step and everything after it runs down one route.

Most institutions have something they call an escalation process, and most of the time it is a sentence in a policy saying that material breaches will be escalated to the appropriate committee. The sentence in the policy is not a workflow. The sentence does not say who notices, how often they look, who is telephoned that evening, how long anybody has, who is permitted to say yes, what has to be written down when they do, or what would have to be true for the whole thing to be over. A workflow is those eight answers, written down in advance, in a fixed order.

One invented bank carries every worked figure that follows: Vindhya Commercial Bank Limited, with a balance sheet of Rs 96,000 crore, twelve limits it set for itself and six limit crossings in a twelve month case year. Its record is unusually good teaching material for one reason: three of those six crossings closed inside days, three are still open at the reporting date, and the two groups divide along a line that this bank's own route never asks about.

What is a risk escalation workflow, and what does it have to contain?

An escalation workflowThe written route a limit crossing takes from the thing that notices it to the body that decides what to do about it. is a route, not a rule. A workflow does not say what anybody must decide. The route says how one fact travels from the place it first appears to the place where somebody has the authority to do something about it. The route is fixed before anything has gone wrong, when nobody yet has an interest in the answer. The whole value of writing it down in advance is that it is written by people who do not yet know whose problem it will turn out to be.

Here is the household version, and it is worth carrying all the way down to the closure test. Two things go wrong in a house on the same Tuesday. A tap starts leaking, and the rent renewal arrives at a figure that will take six tenths of the one salary the house runs on. Both are problems. Both deserve attention. But one of them a plumber closes on Wednesday morning for a few hundred rupees. The rent is the shape of the household rather than an event inside it, and no single action anybody takes this week closes it. A house with one procedure for problems will either send a plumber to the rent, or put the leaking tap on the agenda of a discussion in six weeks. Neither of those is careless. Both come from having one route.

A bank is that house at Rs 96,000 crore. When a limit crossing appears, the same fork exists: some crossings are positions that a trade or a settlement closes before the end of the week, and some are the shape of the balance sheet, where nothing anybody does in the next month changes the reading at all. So a workflow has to contain eight things, in a fixed order, and the second one is the fork.

The tags down the right hand side already show the design. Three of the eight steps, the clock, the deciding body and the standing reporting line, exist only on the longer route. Those three steps are the machinery of getting something in front of a committee and keeping it there. Every crossing has to be noticed, sorted, given to somebody, decided and eventually closed against a test, and the other five steps exist without exception. A crossing that goes through only five of the eight steps has not skipped anything: it has been correctly classified as the kind that a person can finish.

What are the first two steps, and why does classification come second?

EW1 is detection, and it is the least glamorous step in the whole route and the one that sets the ceiling on everything after it. Detection is not a person; it is a control that runs on a schedule. In this invented bank, the end of day position report is what found the overnight currency crossing, the daily value at risk computation is what found the trading book crossing, and a monthly concentration report is what found the sector crossing. A control that runs every day surfaces a crossing on average half a day old. A control that runs every quarter surfaces one that is on average forty five days old before anybody has even read it. No later step in the workflow can recover a delay that detection has already spent.

EW2 is classificationThe step that asks whether a position can be moved to close the crossing, which decides everything after it., and it asks exactly one question. Can a position be moved to close this, or is this the shape of the balance sheet? The one question is the whole of the step. Classification is not a severity rating, not a red, amber or green, and deliberately not a judgement about how serious the crossing is. The step asks only whether an action exists.

If the answer is yes, the crossing is a position excessA crossing that a trade or a settlement can close within days.. Somebody can sell something, buy something back, square something or let a settlement run, and the crossing is gone within days. If the answer is no, the crossing is a structural excessA crossing caused by the shape of the balance sheet, which no trade closes.. The lending is already on the books, the deposits are already placed, the funding mix is already what it is, and the reading changes only as the balance sheet itself changes over months. A position excess and a structural excess need different routes, different clocks and different closure tests, and a workflow with one route has already decided in advance to handle one of them badly.

Notice what is not in that fork. Nothing about size. The largest crossing of this bank's year, at 120.8 per cent of its limit, sits on the slow route, and one of the smallest, at 102.7 per cent, sits there too. Nothing about how worried anybody is. Nothing about which risk type it belongs to. The only question is whether an action exists that closes the reading, and if it does, the crossing does not need a committee at all.

Who is told first, and how long do they have?

EW3 says a person. Not a function, not a team, not a committee: a name and a role, written into the workflow before anything happens. In this bank's record the crossing on the overnight currency limit reached Devendra Achar, head of treasury, on the evening of month 9 day 2, and the position was squared on the morning of day 3. Naming one person is the entire mechanism, and it works because a person can be reached in an evening and a committee cannot.

The street stall version makes the point in one line. A vendor whose gas cylinder runs out at eleven in the morning does not convene anybody. He telephones the one supplier whose number is written on the inside of the shutter, and he is cooking again by noon. If the number on the shutter were the address of a meeting, he would lose the day. The first named person is the only step in the entire workflow capable of producing an action on the same day. The step therefore sits before the deciding body and not after it.

Now the arithmetic that makes the rest of the design inevitable, and it is arithmetic rather than opinion. Committees sit on a cadence. If a body sits six times in a year, the average interval between its sittings is 365 divided by 6, being 60.8 days. An event that arrives at a random point between two sittings waits, on average, half of that interval, being 30.4 days. There is no clever routing that gets underneath that number. The cadence can be changed, or somebody can be given delegated authority between sittings, and those are the only two moves available.

EW4 is the clockThe stated time allowed between two steps, set when the crossing is classified rather than argued about later., and the only thing that matters about it is when it is set. The clock is set at classification, on the type of crossing, before anybody knows whose desk this particular crossing lands on. Set later, the clock asks the people it constrains to agree to the constraint, at the exact moment they most want more room. On that day the extra fortnight will look obviously reasonable. The people being constrained will agree to something generous, every time, and they will do it in good faith. A clock matters only when it is inconvenient. A clock fixed in advance on the type of crossing is the only kind that still binds at that moment.

Who decides, and what does the record of that decision have to carry?

EW5 is the deciding body, and this bank makes it easy: G2, the board risk management committee, is the body that sets every one of limits L1 to L12 and the body that accepts or refuses every crossing of them. Five members, three of them independent directors, chaired by an independent director, sitting six times a year, and every one of those arrangements is the bank's own invention rather than anybody's requirement. One deciding body for twelve limits is a clean design and it is also the reason the floor of 30.4 days applies uniformly: there is no faster committee to send anything to.

From a distance a decision and a note that a discussion happened look identical, and they are not the same object at all. EW6 is where most institutions quietly fail. A record of a decision has fixed parts. A record says what was decided, the body that decided it, the date, who is answerable for what happens next, when the plan ends, and what would have to be measurably true for the crossing to be over. Take any one of those out and there is nothing left to follow up against. Nobody downstream can act on the record at all.

Read the right hand column of that table and something uncomfortable emerges. Vindhya Commercial Bank got five of the six parts right on its hardest crossing. The record named the decision, the body, the date, the person and the end of the plan. The missing part is the one that says how anybody would know when the crossing is over. An institution that gets five of six here is not sloppy, it is normal, and the missing sixth is the part that turns a plan into something that can be failed.

What must a body be told even when it is not the body that decides?

EW7 is the standing reporting lineThe agenda item a crossing appears on at every sitting until it closes., and it answers a completely different question from EW5. EW5 asks who must decide. EW7 asks who must be told, and told again at every sitting until the thing is gone. Who must decide and who must be told have different answers about the same event, and a workflow that collapses the two into one step loses information in both directions.

The overnight currency crossing shows it cleanly. The crossing was found by the end of day position report, reached Devendra Achar that evening, and was squared by a trade the next morning. No committee decided anything, and no committee could have: the whole event lasted one business day and the fastest relevant body sits monthly. And yet it still appeared at the month 9 sitting of G7, the market risk committee, as a closed item. A body that only hears about the crossings still open never learns how often the limits it watches are being touched. Reporting a crossing somebody has already closed is therefore not a formality.

How does a crossing come off the workflow?

EW8 is the closure testThe measured condition that has to be true for a crossing to come off, written before the plan starts., and the reason it is the last step is that it is the last thing anybody wants to write and the first thing that should be written. A closure test is a measured condition. Not improvement, not comfort, not a view that things are better: a number, a comparison and a date on which the comparison is made. Written in advance, it can be failed, and something that can be failed is the only kind of undertaking that has any grip on a future meeting.

Now the awkward case, and this bank supplies it. Breach B6 crossed the sub-investment grade limit L4 in month 7 at 15.4 per cent against a 15.0 per cent limit, and was back inside at 14.0 per cent in month 9. About sixty one days from crossing to closing, almost exactly the 60.8 day interval between two sittings of G2. An interval and an average wait are two different figures, and only the average wait of 30.4 days is the floor. Read the register and it looks like a crossing that was escalated and remediated. Read what actually happened and one exposure reached its own maturity. Nobody did anything.

Breach B6 is what run-offA crossing closing because an exposure reached its own maturity, which is neither an action nor a decision. looks like on a register, and run-off is the quietest way an escalation route can teach an institution the wrong lesson. Six crossings in a year, three of them closed, and if one of the three closed itself, then the route has a strike rate of two rather than three and nobody who reads only the register will ever know. The purpose of a closure test written before the plan starts is not bureaucracy: it forces the record to say what closed the crossing, and run-off is not an answer that any plan can claim credit for.

The other awkward case is the crossing that is still open. Breach B1 on the sector concentration limit L3 was accepted by G2 in month 6 as a temporary excess with a remediation plan running to month 18. The acceptance is a decision, properly taken, by the body with the authority to take it. But between the acceptance in month 6 and the reporting date in month 12, the reading moved from 12.2 per cent of gross advances to 13.0 per cent. In rupees the reading is Rs 7,644 crore against a limit of Rs 7,056 crore. The reading got further away from the limit while the plan was running.

What happens when all six crossings are sorted through both routes?

Take the six crossings of this bank's case year and put each one through the classification question, then look at where they land. Three of them closed. Three of them are still open at the reporting date. And the split is not random, is not about size, and is not about which risk type they belong to.

Set the two columns beside each other and the classification question stops being theory. On the left, a currency position squared by one trade, a trading book cut back on the third day, and a loan that matured. On the right, Rs 7,644 crore already lent to one sector, Rs 19,920 crore of funding already raised in one form, and twenty depositors who have already placed their money. Nothing on the right hand column can be closed by anything anybody does this week, and nothing on the left hand column needed a committee at all.

What can a workflow not do?

Two things, and both of them are worth saying out loud because the discipline is routinely oversold. The first: a workflow cannot close a breach. A workflow moves a decision from where the information appeared to where the authority sits, and moving the decision is the entirety of the job. Breach B1 went through every step of the long route correctly. The crossing was detected in month 5, it reached G2 in month 6, the committee took a decision, the decision was recorded with a named person and a plan running to month 18, and the crossing appears on a standing agenda. Breach B1 is still open at month 12 at 13.0 per cent of gross advances. Nothing about the route failed.

The second: a workflow cannot make a body sit more often than its charter says. If G2 sits six times a year, then 30.4 days is the floor on the committee route and no amount of process design gets underneath it. There are exactly two levers, and both of them are decisions somebody has to take outside the workflow: change the cadence, or write delegated authority for a named person to act between sittings. Confusing a workflow with a remedy is the single most common way an institution ends up with an excellent process and an unchanged balance sheet.

Who actually reads a workflow like this, and what do they use it for?

Four readers, and each of them is looking for something different. The four together are a useful test of whether the written workflow is worth anything.

The independent director on the board risk management committee reads it for the classification column, and reads it before the crossings. If every crossing in the pack arrives on the same route, the committee is being asked to decide things it cannot influence and is not being told about things that were closed before the pack was printed. Six crossings in a year, two of which closed in under three days, means the committee's real business is the three that are still open, and a pack that gives equal space to all six has buried its own agenda.

The credit analyst at another institution, looking at this bank as a counterparty rather than as an employer, reads it for something narrower: how long the average crossing stays open, and whether anything closed itself. A bank whose crossings all close inside a week is either well run or lightly limited. A bank with three concentrations open at once, two of them on the funding side, has a structural position rather than a run of bad luck, and the escalation record is where that becomes visible before the balance sheet says it.

The treasury dealer reads exactly one line of it: the name at EW3, and whether that person has authority to act between sittings. Everything else in the eight steps is somebody else's business on the night the position is over the limit. If the answer to that one question is a committee, the dealer knows the position is carried until the committee sits, and prices the risk accordingly.

And the household reader. The mechanism does not change with scale. A person carrying a credit card balance and a rent that has moved to six tenths of one salary has two problems at once, and if they treat both the same way they will pay off the card twice and never move house. The classification question, can a position be moved to close this, separates the problems that a decision fixes from the problems that only time and a different shape can fix. To a household budget that separation is worth more than any amount of monitoring.