Risk Escalation: When a Risk Must Go Up, and to Whom

Risk escalation is moving a decision to somebody with the authority to take it. The person holding the decision does not have that authority. Escalation is not a report and it is not a warning. Something goes up when a threshold written down in advance has been crossed, or when a person judges that it should. At Vindhya Commercial Bank Limited, an invented mid-sized commercial bank, the largest breach of the year was also among the slowest to move.

A limit is crossed at four in the afternoon. Somewhere inside an institution a number has gone past a cap, and for the next several hours the only thing that has actually changed is that a number sits on the wrong side of a line. Nothing has been decided. Nothing has been closed. Nobody has yet been asked anything. Everything that happens next turns on who finds out, how quickly they find out, and whether the person who finds out is allowed to do anything at all about it.

Whether the finder is allowed to act is the whole subject. Escalation is not monitoring, it is not reporting, and it is not fixing. Escalation is one narrow act: moving a decision from somebody who cannot take it to somebody who can. Take that definition seriously and everything else follows from it, including a calculation that most institutions have never done about themselves.

What is risk escalation, and what is it actually for?

Start somewhere small. A household runs on one salary. On a Tuesday the person who does the shopping notices that the balance will not cover the school fee cheque due on Friday. The household's fixed deposit is in somebody else's name and the branch will not act on a phone call, so the shopper cannot move money out of it. The useful act on Tuesday is not worrying and it is not writing it in a notebook. The useful act is telling the one person who can walk into a branch on Wednesday. Escalation exists because information and authority almost never sit in the same person, and the gap between them is where a small problem is allowed to become an expensive one.

EscalationMoving a decision to somebody with the authority to take it, because the person holding it does not. at an institution is that Tuesday phone call with a name, a route and a clock attached to it. Everything else about it is administration. Stripped of the templates and the committee papers, what is left is one question asked in the right direction: this thing has happened, and the person being asked is the one allowed to decide what is done about it.

The working example throughout is Vindhya Commercial Bank Limited, a mid-sized commercial bank in India carrying Rs 96,000 crore of assets. Its board risk management committee, numbered G2 here, sets twelve limits numbered L1 to L12, covering things as different as how much can be lent to one borrower group and how much the trading book may be expected to lose in a day. In the twelve numbered months of this case, six of those limits were crossed. The crossings are numbered B1 to B6, and they are the whole evidence base of this guide. Every limit, cadence, date and person named here is that bank's own arrangement rather than a requirement placed on anybody.

What is the difference between escalating and reporting?

Escalating and reporting look identical from the outside. In both cases a document moves upward and somebody more senior reads it. The difference is not the seniority and it is not the format. An escalation asks for a decision, and because it asks for a decision it carries a clock; a report states what happened, and because it asks for nothing it moves at whatever speed the calendar already moves at.

Breach B2 shows both in the space of a fortnight. On month 9 day 2 the bank's net overnight open foreign exchange position reached Rs 276 crore against limit L7 of Rs 240 crore, an excess of Rs 36 crore. A customer deal had been booked after the cut-off. The end of day position report found it, it reached Devendra Achar, the head of treasury, that same evening, and the position was squared on the morning of day 3. The evening message was the escalation: it went to one person who could instruct a dealer, and it produced an action inside a working day.

The same event also reached committee G7, the market risk committee, at its month 9 sitting. The month 9 committee paper was a report. By the time it arrived the position had been flat for weeks and nobody was being asked to decide anything. The paper was perfectly good governance and it changed nothing. Changing nothing is exactly what a report is supposed to do. Confusing the two is the most common structural fault in an escalation route. A route that ends only at a committee has quietly converted every escalation into a report.

What makes something go up, and who decides that in advance?

There are exactly two reasons anything is ever escalated. Either a triggerThe stated condition that makes something go up, ideally a number written down before anybody knows what the number will be. written down in advance has fired, or a person has decided on the day that this ought to go up. The second is a judgement callAn escalation made because a person decided it should be, with no written trigger behind it., and it is rarer and slower than most people expect, for a reason worth sitting with.

On the day, the person judging whether something is serious enough to escalate is usually the person who would have to do the work if it is. The direction of that judgement is not a comment on anybody's character. The overlap is a structural fact, and it points the judgement one way. A number written down in advance was set by somebody who did not yet know what the number would turn out to be. Not knowing the answer is exactly what makes the number useful. A trigger written before the event is a decision taken by people who had nothing at stake in it. Having nothing at stake is the only condition under which a threshold is honest.

Vindhya Commercial Bank Limited has a clean example, and it comes from the bank's own market risk policy rather than from anybody's rulebook. The bank measures its trading book against a one day value at risk figure and then counts the days on which the realised loss exceeded that morning's measured figure. Its own policy says that five such exceptions in 250 observation days go to committee G7, the market risk committee, and that seven force a model review. In the case year, seven were observed. Both actions followed and nobody had to hold an argument about whether seven was a lot. The argument had been settled in advance by people who did not know the answer yet.

Note carefully what the five and the seven are. The five and the seven are the bank's own working numbers. The Basel Committee at the Bank for International Settlements, at bis.org, publishes a standardised approach that bands an exception count, and how a supervisor in India treats such a count comes from the Reserve Bank of India at rbi.org.in. The band and the supervisory treatment sit with those two sources.

Who does it reach first, and is that the same person who decides?

Almost never, and the split matters more than any other design choice in an escalation route. The first named personThe individual a crossing reaches first, who is a person rather than a body so that something can happen the same day. is who is told. The deciding bodyThe committee that may accept a breach, refuse it or require action, which here is the board risk management committee for every limit. is who may accept the crossing, refuse it or require action. At this bank the deciding body is committee G2 for every one of the twelve limits, without exception, and G2 sits six times a year.

A crossing goes to a name before it goes to a body for one reason: a person can act today and a committee cannot sit today. Breach B2 is the proof. Rs 36 crore over a Rs 240 crore cap, found at the end of a day, one person told that evening, one instruction the next morning, closed. Route it only to the body that could formally accept or refuse it and the same breach would have sat open for the better part of a month while a perfectly closable position stayed on the book.

One caution the record itself supplies. Devendra Achar appears on breach B2's record as the person the crossing was escalated to, and he appears on breaches B3 and B4 as the risk owner, the person answerable for the exposure. The two roles are different jobs that happen to land on one person here. Being told is not the same as being answerable, and a register with one column doing both jobs cannot show which one it means.

What actually sets the speed, and is it how serious the thing is?

Here is where intuition breaks. Ask anybody how quickly a limit crossing should reach a decision and they will answer in terms of severity: the bigger the breach, the faster it should move. Now rank this bank's six crossings by how far over the cap they went, and rank them again by how long they took to reach a decision, and compare the two lists.

The record does not give the same kind of number for all six, so read the readings honestly first. For B2, B5 and B6 the case records the utilisation at the moment of crossing. For B1, B3 and B4 the case records a later reading, and the figure below is each breach's worst reading on the record rather than its reading on the day it crossed. B1 crossed at 12.2 per cent of gross advances against a 12.0 per cent limit, or 101.7 per cent utilisation, and reached 13.0 per cent by month 12, or 108.3 per cent. B3 crossed at 107.0 per cent and reached 112.8 per cent. B4's crossing reading is not in the record at all, and its 120.8 per cent is the month 12 figure. Saying so costs nothing and stops a reader building a false timeline out of a table.

The two orders do not match anywhere. The largest crossing in the book, B4 at 120.8 per cent, is among the slowest of the six, and the second largest, B2 at 115.0 per cent, was closed inside a day, so seriousness plainly does not set the speed. Speed is set by something visible in one column that is not in the table: what found each crossing. B2 was found by an end of day position report that runs every day. B5 was found by a daily value at risk measure. A sector share, a funding share and a depositor share are not things anybody computes at five in the evening, so B1, B3 and B4 were found by a balance sheet reading taken periodically.

There is a second and separate thing the column measures, and it pays to keep it apart. B2 could be closed by one dealer doing one trade. B4 happened because a single state undertaking placed Rs 1,440 crore with the bank, taking the top twenty depositors to Rs 11,136 crore against a Rs 9,216 crore cap, an excess of Rs 1,920 crore. No trade closes that. The excess is the shape of the deposit book. So detection sets how fast an escalation travels, and the nature of the exposure sets how fast anything can actually close.

Why does the total time refuse to fall when detection gets faster?

Now the arithmetic, and it is the part of this subject that almost nobody does about their own institution. A crossing does not announce itself. The crossing sits there until something looks. Call the detection intervalHow often the control that would notice a crossing actually runs. d, in days. If the crossing is equally likely to happen at any point between two runs of that control, the expected wait from the crossing to somebody noticing it is d divided by 2.

Then add one day to reach a named person. Breach B2's record shows that day: found by the end of day report, reached Devendra Achar that evening, acted on the next morning. So the expected time to a named person is d over 2 plus 1. At a control that runs daily that is 1.5 days. At a monthly control it is 16.0 days. At a quarterly one, taking a quarter as 91 days, it is 46.5 days.

A named person can square a position but cannot accept a breach, so now add the deciding body. Committee G2 convenes 6 times a year. On a 365 day year that is one sitting every 60.8 days, so the average wait from any moment to the next of them is 30.4 days. Time to the deciding body is therefore d over 2 plus 30.4. At a daily control that is 30.9 days. At a monthly control, 45.4 days. At a quarterly one, 75.9 days.

The lower bar carries the point rather than the number beside it. As the control moves from quarterly to daily, the green segment shrinks almost to nothing and the dark segment does not move at all. Making detection thirty times faster, from monthly to daily, cuts the time to a decision from 45.4 days to 30.9 days, a saving of 14.5 days or 31.9 per cent, and that is the whole prize for a thirtyfold improvement. The other 30.4 days was never detection. The remaining wait belongs to a body that sits six times a year, and no monitoring project on earth touches it.

Naming that floor precisely turns an argument into an arithmetic question. The two waits are equal when d over 2 equals 30.4, at d of 60.8 days. So there is an exact interval, computable from nothing but a cadence, at which the detecting control stops being the problem and the calendar starts being it.

What does accepting a breach mean, and is it a failure to act?

An accepted breachA crossing a deciding body has decided to live with, with a named person and a dated plan. reads badly in a headline and it is the opposite of what most readers assume. Committee G2 looked at breach B1 in month 6, had the authority to refuse it and require the exposure be cut, and chose instead to live with it for a stated period. Manjari Sondhi, the head of wholesale banking, was named against it. A remediation plan was set with an end date of month 18. Acceptance is a decision, taken by the body that was supposed to take it, with a name and a date attached.

Compare that with the thing it superficially resembles: a crossing that nobody acted on. Same number in the report, same red flag, same limit breached. Only one of acceptance and inaction has a body, a name and a date against it, so the two produce an identical line in a summary and differ completely in the record underneath. The record therefore matters more than the summary, and a reader who only ever sees the top line cannot tell a governed institution from an ungoverned one.

What happens to something that is escalated and then stays open?

An escalated crossing stays visible, and this is where most escalation routes quietly fail. Acceptance is a decision to live with a crossing for a stated period. Acceptance is not a decision to stop looking at the crossing. Breach B1 was still a live breachA limit crossing still open at the reporting date, whether accepted or not. at month 12, seven months after it crossed and six months before its plan is due to end.

And it had moved the wrong way. The reading was 12.2 per cent of gross advances when it crossed in month 5 and 13.0 per cent at month 12, against a cap of 12.0 per cent. In rupees that is Rs 7,644 crore of infrastructure and power exposure against a Rs 7,056 crore cap, an excess of Rs 588 crore. Every step of the escalation had worked. The crossing was detected, it went up, a body with authority looked at it, a person was named, a date was set. The reading still went from 101.7 per cent of the cap at the crossing to 108.3 per cent at the reporting date, and the gap between a working route and a rising exposure shows exactly what escalation does and does not do.

One honest note about the line in the drawing below. The case gives two readings and no others, so the line between them is a straight line drawn through two points. The line is a construction and not a path. The exposure did not necessarily rise smoothly; what the two endpoints do establish is direction, and direction is enough for the point being made.

Who actually picks this up, and what do they do with it?

Four readers use this differently, and none of them is reading it as theory. The independent director sitting on committee G2 uses it to ask one question of any crossing that arrives: how long has this been open, and how much of that time was the wait for the committee itself. If the answer is that most of it was the wait for that very committee, then the paper in front of her is not evidence of a slow risk function, and asking for better monitoring would be a way of blaming the wrong half of the process.

The head of a business line uses it to argue for the right thing. Manjari Sondhi is answerable for a Rs 7,644 crore sector position she cannot unwind in a quarter. Knowing that the committee wait is 30.4 days on average and that her detection is already periodic tells her the useful ask is a delegated authority or an interim route to a person between sittings, not a faster report.

A credit analyst at another institution, looking at this bank as a counterparty rather than as an employer, uses the same reading in reverse. Three of this bank's crossings were open at the reporting date and all three are concentrations: one sector on the asset side, one funding type on the liability side, and twenty depositors. Three closed in the year and every one of those closed by a trade or a run-off. The contrast tells the analyst something no ratio does: this bank's remaining problems are structural rather than positional, and structural problems do not close by themselves.

The mechanism is identical at every scale, so the household version is worth one more look. A person who notices on Tuesday that Friday's cheque will bounce faces exactly the same two clocks. How often does anybody look at the balance, and how long until the person who can move money is next available. If the balance is checked daily and the other person is reachable that evening, the shortfall is a phone call. If the balance is checked when the statement arrives and the other person is away for a fortnight, the same shortfall becomes a bounced cheque, a fee and an awkward conversation with a school. Nothing about the size of the shortfall entered either outcome.

What can escalation not achieve?

Escalation moves a decision. Moving a decision is the entire claim, and it is worth being blunt about everything escalation therefore does not do. Escalation does not shrink an exposure: breach B1's reading rose after it was escalated, accepted, named and dated. Escalation does not make the resulting decision a good one: a body with the authority to accept a crossing has exactly the same authority to accept it badly. Escalation does not close anything by itself. Something closes when a position is traded out, an exposure runs off, or a remediation plan does its work, and none of those three things is an escalation.

Escalation changes who is holding the decision, and if that sounds modest it is worth remembering that the alternative is a question sitting permanently with somebody who is not allowed to answer it. Two of this bank's six crossings closed inside three days because the right person was told the same evening. One closed at the committee floor because an exposure ran off rather than because anybody chose. Three are still open. Six crossings with that record are a fair account of what a working escalation route delivers, and an institution that expected more had misunderstood the instrument.