Risk Governance: Who Decides, Who Oversees, Who Reports

Risk governance names who may decide a risk question, who checks the deciding, and who has to be told. Deciding, checking and telling are three jobs and not one. Deciding sets a limit, an assumption or an appetite. Overseeing asks whether the deciding was sound. Reporting carries the answer to whoever needs it next. A structure that blurs any two of them has stopped working.

Most of what is written about this subject is a picture of boxes joined by lines, and the picture is the least useful part of it. Boxes show where authority sits. A box does not show what the body inside it is allowed to be ignorant of, and that second question is where an institution with a complete structure, a full policy set and a clean control record can still lose sight of its own position. The structure comes first, and then the gap the structure cannot see.

What is risk governance, and what is it actually for?

The shape is identical at any size, so start with the everyday version. A wedding is being planned for eight hundred people. One person fixes the budget. A second person checks the caterer's bills against that budget. A third circulates a running total to the four households paying for it. Three jobs, three people, and everybody can name which one they are doing. Now collapse two of them. Let the person who fixes the budget also check the bills. Nothing visibly breaks, every bill still gets a tick, and the moment the budget turns out to have been set too low there is nobody in the arrangement whose job it was to say so. The check did not fail. The person doing the checking was the person being checked, so there was never a check at all.

Risk governanceThe arrangement that fixes who may decide a risk question, who checks the deciding, and who has to be told. is that arrangement written down for an institution instead of a wedding. Risk governance is not risk management. Risk management measures the exposure. Governance decides who is allowed to say what the measurement means and what happens next. An institution can have excellent measurement and no governance, in which case very good numbers reach nobody who can act on them. An institution can equally have elaborate governance and poor measurement, in which case a great many people make decisions on the wrong figure. Neither is the interesting case. The interesting case is good measurement and complete governance that still cannot see one thing.

The unit that governance is built from is the mandateThe written boundary of what one body may decide without asking anybody else.. A mandate is a boundary, and a boundary has an inside and an outside. Inside is what this body may settle on its own authority. Outside is everything it may not. Almost every mandate in existence is written entirely in that one direction: it names what the body decides. Almost none of them names what the body must be told by somebody else in order to decide it well, and that missing half is where a complete structure goes blind.

Vindhya Commercial Bank Limited, invented, is a mid-sized Indian commercial bank with a balance sheet of Rs 96,000 crore. Every committee, size, split, cadence, policy and limit named here belongs to that invented bank and is its own arrangement. None of it is a requirement of any kind, from any authority, anywhere. The expectations that bind a real bank operating in India come from the Reserve Bank of India.

Why are deciding, overseeing and reporting three different jobs?

Take the three apart with a real object in each hand. Deciding sets something that did not exist until the decision was taken. At the invented bank, committee G2, the board risk management committee, sets every one of the twelve limits L1 to L12 and accepts or refuses every breach of them. Committee G4, the asset liability management committee, sets the behavioural assumptions, including how long the bank assumes a current or savings balance stays before it leaves. Committee G1, the board, approves the eight appetite clauses A1 to A8 once a year. Three bodies, three different kinds of thing set, and in each case a number or a sentence exists afterwards that did not exist before.

Overseeing asks a question about a decision somebody else took. Committee G3, the audit committee, receives the 42 control findings raised in the year, the 92 open issues aged in the five buckets AG1 to AG5, and the assessment of internal financial controls. Notice what G3 does not do: it does not set a limit, it does not approve an exposure, and it does not choose an assumption. Its entire value comes from not having taken the decision it is looking at. The moment a body oversees its own work, the oversight becomes a conversation with itself, and the wedding budget goes unchallenged.

Reporting carries an answer to whoever needs it next, and carrying is not checking. The invented bank's monthly risk report runs to 38 printed sheets, is circulated 5 working days before the sitting it is written for, and carries 173 numbers of which 14 sit on the first sheet. Of those 38 sheets, 3 carry a decision the committee has to take and 35 carry information. A report is a delivery mechanism. Nothing inside it asks whether the decision behind any of its numbers was sound, and an institution that treats a circulated paper as a check has three jobs and one activity.

What does the governance structure look like when it is drawn out?

Here is the whole of it for the invented bank, eight committees numbered G1 to G8. Read the table once for the shape, then once for what is missing from it. The second reading is the one that pays. Every seat count, every independence split and every cadenceHow often a body sits, which sets the fastest speed at which anything it decides can change. in this table is Vindhya Commercial Bank Limited's own invented arrangement. Every number in this table is one bank's own choice, not a rule, a minimum, a norm or an expectation of any authority, and carrying one away as a standard turns somebody's choice into a requirement nobody set.

Two counts come straight off that table and both are worth holding. The seats first: G2 to G8 carry 5 plus 4 plus 9 plus 7 plus 8 plus 6 plus 6, being 45 seats, and the record names an independent director on two of those seven bodies only, 3 of G2's 5 and 4 of G3's 4. The independent seats come to 7 out of 45, being 15.6 per cent, and 2 of the 7 bodies other than the board itself carry one at all, being 28.6 per cent. G1 the board is left out of the 45 because the case does not record its size. The sittings second: 6 plus 6 plus 6 plus 12 plus 26 plus 12 plus 12 plus 4 comes to 84 sittings a year.

A governance structure is not really a diagram at all. A charter is a document, and the document has a fixed set of parts: the body's name, how many sit on it, how many of those are independent, how often it sits, what it may decide, what it must be told, and who it reports to. The charter, rather than the boxes, is what to picture. A charter has columns, and a column can be empty. Draw the invented bank's eight bodies as seven columns and one of the seven columns is blank on all eight rows.

What is the difference between a board committee and a management committee?

The difference is where the authority comes from, and the consequence is speed. A board committeeA committee of the board itself, carrying independent directors and deciding on the board's authority. decides on the board's own authority and carries directors who do not work for the institution. A management committeeA committee of executives, deciding inside authority the board has delegated to it. decides inside authority the board has handed down, and everybody on it is an employee. Where the authority comes from is the whole distinction, and every other difference follows from it. Board committees are made of people with other jobs, so they sit rarely. Management committees are made of people already in the building, so they sit often.

Count it at the invented bank. G1, G2 and G3 are board level and sit 6 times each, being 18 sittings a year, 21.4 per cent of the 84. G4 to G8 are management level and sit 12, 26, 12, 12 and 4 times, being 66 sittings a year, 78.6 per cent. Nearly four fifths of this bank's committee sittings happen where the board is not in the room, and that is not a criticism of the bank, it is what delegation looks like once it is counted. The consequence is a wait. A body sitting 6 times a year has 60.8 days between sittings on a 365 day year, so something arising at a random moment waits 30.4 days on average for the next one. A body sitting 26 times a year has 14.0 days between sittings and an average wait of 7.0 days. Same institution, same urgency, four different clocks.

How does a decision taken in one committee reach the committee that needs it?

Mostly it does not, unless somebody wrote down that it must. The inbound half of a mandate is the part of the subject that no diagram shows, and it is worth slowing down for.

G2's mandate at the invented bank reads again: it sets every limit L1 to L12 and accepts or refuses every breach. The mandate is written entirely outbound. Every word of it names what leaves G2. The inbound question is the other one. To set limit L8 sensibly, and to read the number that comes back against it, what does G2 have to know? The answer turns on one number, the assumed behavioural life of the bank's non-maturity deposits, and G2 has to know it. Nothing in G2's mandate says G2 must receive it. The missing sentence is the input listThe decisions taken elsewhere that a body must receive before it can use its own mandate properly., and it is the seventh column of the charter that came up blank on all eight rows.

Back to the everyday version, where the shape is the same. A shopkeeper tells the person at the counter that no single customer may take goods worth more than Rs 20,000/- on credit. The instruction is a clean mandate and the counter follows it exactly. The shopkeeper never said that the counter must be told when the same customer's brother, who runs the shop next door, also takes goods on credit. The rule was obeyed all year. The counter had authority and no eyesight, and an institution can build the second of those only by writing it into the same document that grants the first.

What happens when nothing carries that assumption across?

Now the worked instance, and it is the reason this whole sequence exists. Take it slowly. Every step is ordinary and the result is not.

The invented bank holds Rs 36,000 crore of non-maturity deposits, meaning current and savings balances that a customer may take out on any morning without telling anybody. Contractually they are repayable on demand. In practice most of them sit for years. So the bank has to state a view about how long they stay, and a stated view of that kind is a behavioural assumptionA stated view about how customers will act, used where a contract does not say.. Behavioural assumptions are exactly what G4's mandate covers, so committee G4 sets it, and G4 has set it at an average life of 0.5 years.

Separately, and correctly, committee G2 has set limit L8. Limit L8 caps how far the economic value of the bank's equity may move under a 200 basis point parallel rate shock. G2 set that limit at Rs 990 crore, being 15.0 per cent of the bank's own tier 1 capital. Both of those numbers are the invented bank's own choice and the 200 basis point shock is its own internal scenario, not a required one. At month 12 the measured change is minus Rs 840 crore, so G2 reads 84.8 per cent utilisation of limit L8 and the position is comfortably within. How that change is computed belongs to the sequence that teaches interest rate risk in the banking book, and it is taken here as a locked reading with only one question asked of it: who set the inputs.

Here is where the two threads meet. The 0.5 year assumption is one of those inputs, and it is the one the answer is most sensitive to. Extending the assumed life by one full year moves the economic value result by Rs 36,000 crore times 2.0 per cent, being Rs 720 crore. So at 0.5 years the change is minus Rs 840 crore. The bank's own repricing ladder slots that very same Rs 36,000 crore into the one to three year bucket, whose midpoint is 2.0 years. At 2.0 years the change is plus Rs 240 crore. The headline number changes sign on an assumption that the committee reading the headline neither set nor sees. G2 has authority over limit L8 and no line of sightWhether a body can actually see the input that moves the number it is being asked to judge. to the one input that decides the answer to it.

How far does one assumption actually move the reading G2 gets?

Before the control below is touched: one further year of assumed life is worth Rs 720 crore, and the bank starts at minus Rs 840 crore on a 0.5 year assumption.

The shape shows what the single reading does not. Utilisation of limit L8 is a V: it falls from a breach at very short assumed lives, touches zero at about 1.67 years, and climbs back to a breach at very long ones. The bank is not sitting in the safe middle of that band, it is sitting 2.5 months of assumed deposit life away from the near edge of it. An input that has never been validated, cannot be backtested and is set by a body that never sees the limit is the input holding that distance open. The number itself needs care: the 84.8 per cent quoted here is utilisation of limit L8 and nothing else. The same 84.8 per cent appears elsewhere in this bank as the completeness of its model inventory, 28 models registered against 33 found in use, and 840 over 990 and 28 over 33 are literally the same fraction. Two entirely different facts wearing one number.

What is the three lines model, and whose is it?

Somewhere in the first ten minutes of any conversation about this subject, somebody will say the words three lines. The three lines are worth knowing, and so is whose idea they are. The three lines model belongs to the Institute of Internal Auditors, who restated it in 2020, and naming them is part of using it honestly rather than a courtesy at the end. A borrowed frame carries the name of the body that built it, in the text and not in a footnote, because a reader who wants the authoritative version needs to know where to go and asking is the whole point.

Placed on the invented bank, it sorts every part of the institution into one of three positions. The first line is the part of the bank that takes the risk and runs the 214 key controls spread across the nine processes PR1 to PR9. The second line is the risk and compliance functions under the chief risk officer, Sunanda Ravikumar. The risk and compliance functions write the nine policies PL1 to PL9, set the limits and challenge what the first line has done. The third line is internal audit under Rustom Batliwala, reporting to committee G3 and to no executive at all. How the three lines work in practice, what an assurance map is, how control testing differs from a self assessment, what the parts of an audit finding are and how an issue gets remediated are all covered separately.

One distinction is worth carrying away, and people collapse it constantly. The three lines say where assurance comes from; the eight committees G1 to G8 say who decides. The two are different questions, and a bank can be tidy on the first and incoherent on the second. Committee G3 sitting in the governance structure and internal audit sitting in the third line are not the same statement about the institution. One says which body receives the findings. The other says who produced them and to whom that producer answers. The two pictures side by side give most of what an outsider needs; either one treated as a substitute for the other is a diagram that flatters the institution and says nothing.

Where do the expectations on an Indian bank's board actually come from?

Every seat, split and cadence stated so far belongs to one invented bank. The obvious question then stands: where does the binding version live for a real institution? The answer is that it is not one place, and the commonest mistake in the subject is answering with one.

Three different bodies answer three different questions, and mixing them up is how a confident sentence ends up being wrong. The international standard is where an idea such as interest rate risk in the banking book was defined and calibrated, and the standard comes from the Basel Committee on Banking Supervision at the Bank for International Settlements. There is what actually binds a bank operating in India, including anything expected of a board, a board committee, a risk policy or a risk function, and that comes from the Reserve Bank of India. Company law places duties on a board and on its individual directors whatever business the company is in, and that text and its applicability come from the Ministry of Corporate Affairs, with the assurance and audit side from the Institute of Chartered Accountants of India. A standard is a document somebody wrote and it binds nobody until a national authority makes it so. Naming only the global standard is the confident and common error.

The same discipline settles what can be taken from the invented bank's numbers. Committee G2 having 5 seats of which 3 are independent directors, and being chaired by an independent director, is Vindhya Commercial Bank Limited's own arrangement. So is the board sitting 6 times a year, G5 sitting 26 times, G8 sitting 4 times and reporting into G6 rather than upward, and every limit and appetite clause referred to along the way. Not one of these numbers is a minimum, a maximum, a composition requirement, a quorum, a required cadence or an effective date, and there is no honest way to turn one of them into any of those things. The real version is reached by naming the body and reading the text.

Who actually picks a governance structure up, and what do they do with it?

Three people read a governance structure for three different purposes, and watching what each does with it is the quickest way to see what it is for.

The independent director who chairs committee G2 reads it for authority. She sits 6 times a year, sets every limit L1 to L12 and accepts or refuses every breach, and she has no technical preparation to bring to a Rs 840 crore economic value number. The structure gives her one question she can ask at any sitting without knowing how the number is built: which decisions taken somewhere else in this bank move the figure I am about to sign off, and am I being sent them? The question needs no modelling knowledge at all, and it is the only question in the room that would have found the gap. Asked at any one of her 6 sittings, it lands on the 0.5 year deposit life immediately, because the answer is short and there is only one serious input.

Sunanda Ravikumar, the chief risk officer, reads it for routing. She is the person for whom the structure is a daily working object: something has happened, and the first decision is which body it goes to and how soon it can be there. A crossing on limit L7 at nine in the evening does not go to a committee at all. The next relevant sitting may be weeks away, and the position can be squared in the morning. A finding about how a whole book is being measured needs a decision that outlives whoever is on duty, so it goes to a body that sits. Reading the structure well is mostly the skill of knowing which of those two a thing is before a route is picked. The eight cadences set out above are the map she is reading when she decides.

The credit analyst at another lender, looking at this bank from the outside as a counterparty, reads it for shape. She cannot see any of the limits or the papers. On a call she can ask two questions that cost her nothing: which body sets the limits, and what is that body sent before it reads them. The first question is answered everywhere, quickly and confidently. The second is answered almost nowhere, and the pause is the information. The pause tells her whether the institution has ever written down the inbound half of a mandate. No ratio on its balance sheet will tell her that.

The household version of the analyst's second question is the same question asked at home. Everybody can say who in the household decides what gets spent on a wedding, a hospital admission or a school fee. Very few can say what that person has to be shown before they decide, and fewer still can point to a moment when somebody made sure they were shown it. Authority is easy to state and eyesight is not, at any size, and the second column stays blank even in institutions with excellent intentions.

What can a governance structure not do, however well it is drawn?

Three things, and an account of governance that ended without them would be dishonest.

First, it cannot make anybody read the paper. At the invented bank's month 12 sitting the monthly risk report ran to 38 printed sheets, went out 5 working days ahead, and carried 173 numbers of which 14 sat on the first sheet. Of the 38 sheets, 3 carried a decision the committee had to take and 35 carried information, and the first sheet carried none of the 3 decisions. Eight people attended. Six of them had read it before arriving, being 75.0 per cent. Nothing in any mandate, charter, cadence or reporting line in this bank or any other reaches that last figure. A structure can deliver a paper on time to the right people and that is the entire extent of its power over the last step.

Second, it cannot supply an input that nobody ever wrote down. The missing input is the finding restated as a limit on the object itself. G2's mandate is not badly written; it is written the way almost every mandate is written, entirely in the outbound direction. Adding a ninth committee, a second monthly report or a thirteenth limit would not change that by one line. The only thing that closes it is somebody sitting down with the charter and writing the inbound half, body by body, and that is a slow, unglamorous exercise that produces no new number and shows up in no dashboard.

Third, and most importantly, a complete structure is not a controlled institution. The invented bank has eight committees, nine policies, twelve limits, a monthly report and a clean answer for every governance question anybody has thought to ask it. The same bank also reads 84.8 per cent utilisation of limit L8 on an assumption produced by a model that has never been validated and cannot be backtested, and it sits 2.5 months of assumed deposit life from the near edge of the band in which limit L8 is satisfied at all. Both of those sentences are true about the same bank on the same day. The number itself needs one more care, and the case carries a trap. The 84.8 per cent quoted here is utilisation of limit L8, and the same 84.8 per cent elsewhere in this bank is the completeness of its model inventory at 28 models registered against 33 found in use. Two facts, one fraction, and the only defence is to name which one is meant in the same sentence every time.