Risk Monitoring: Watching a Risk Between Assessments

Between two assessments a risk keeps moving and nobody has reassessed it. Monitoring is watching it move. At Vindhya Commercial Bank Limited, invented, four of the thirteen incidents I1 to I13 had an amber or a red already showing beforehand, being 30.8 per cent, so nine arrived with nothing showing. Breach B1 moved from 12.2 per cent to 13.0 per cent while it was open.

An assessmentA rating taken on a date, correct on that date. is a photograph. The photograph is right on the date it was taken, and the thing it photographed carries on moving the moment the shutter closes. Everything that happens between one photograph and the next is either watched or unobserved, and the difference between those two words is not effort or skill but frequency. A number somebody looks at six times a year is a number about which six things are known. For the rest of the year what is held is a picture being called a position.

What happens to a risk between one assessment and the next?

Think about the water tank on the roof of a building where thirty households live. Once a month the caretaker climbs up, looks in and writes the level on a sheet. On the day he looks, the sheet is exactly right. On the twenty ninth day the sheet is a memory. Nothing about the tank has been dishonest; the tank simply kept doing what tanks do while nobody was on the roof. If the building wants to know the level on the twenty ninth day, it has exactly two options, and neither of them is arguing with the sheet. The building can send somebody up more often, or it can put a float and a wire in the tank so the level shows on a panel downstairs.

The tank is the entire subject. A risk that has been assessed is a tank that has been looked into. The assessment gives the level on the day and says nothing at all about any other day, and monitoring is the name for whatever is done about the other days. Monitoring is not a second assessment, not a review, and not a committee meeting. The arrangement it names is whatever gets a number about a live risk to somebody between the dates on which the risk gets rated.

How much this matters follows from what a risk actually is. A risk is not a fact sitting still in a register. A risk is a thing being pushed around by lending decisions, deposit flows, staff leaving, systems ageing and customers behaving. None of those pause between assessments. So the interval between two assessments is not a quiet stretch where the number holds; it is the stretch where the number does most of its moving and nobody is writing it down.

What can actually be watched, and what does each channel cost to collect?

Watching sounds like attention and it is not. A risk cannot be watched. Only something the risk leaves behind can be watched, and a bank leaves behind four kinds of trace between assessments. Vindhya Commercial Bank Limited runs all four, and it is worth naming them separately because they behave nothing like each other. The four traces carry the numbers MW1 to MW4.

MW1 is the limit reading and its direction of travel, MW2 is the near miss log, MW3 is the indicator status and MW4 is the loss log, and the four differ on two things at once: how early each moves, and what it costs to collect. Cost here does not mean a licence fee. Cost means the real price of getting the trace: the work, the arguments, and in one case the loss itself.

Look down that last column and something uncomfortable appears. The channel that costs the most is the one reported most fully, and the channel that costs the least is the one most often collected and never used. The mismatch is not a coincidence, and it is not laziness either. A loss is unarguable: it carries a rupee figure, a date and a name, so it survives every conversation on its way to a committee. A near missSomething that began to go wrong and was caught before any money moved. entry has none of that armour. Nothing was lost, so nothing forces anybody to look at it.

What does a trend show that a level does not?

Most people think they already understand MW1. Take it on its own for a moment. A limit reading is a level: the number running against a cap, expressed as limit utilisationWhat is actually running against a limit, as a share of the limit.. A level says where the position stands, and nothing else. Where the position is going is what a reader actually wants to know, and a level is silent on it.

Two readings answer a different question. The moment a second reading exists there is a direction and a speed, and a trendThe direction and speed of a reading between two sightings. is nothing more grand than that. A level with no trend beside it cannot distinguish a number that has been sitting still for a year from a number that arrived at the same place last week and is still climbing, and those two are not the same risk at all.

The everyday version is a fever. A thermometer reading of 38.5 degrees is a level. Whether it was 37.0 an hour ago or 39.5 an hour ago changes everything about what anybody does next, and the reading itself contains none of that. One reading of a limit, however precise, is nearly always the least useful thing a risk report can carry, and a report full of single readings feels informative and decides nothing.

What do the two recorded readings of breach B1 actually show?

Now put a real object under the idea. Breach B1 at Vindhya Commercial Bank Limited is an excess against limit L3. Limit L3 caps sector concentration at 12.0 per cent of gross advances, and the cap belongs to the bank rather than to anybody outside it. The bank's records hold two readings of that number for the year and no others: month 5 at 12.2 per cent, and month 12 at 13.0 per cent. The risk owner is Manjari Sondhi, head of wholesale banking. In month 6 the board risk management committee accepted the excess as temporary and set a remediation planA dated plan to bring a breached limit back inside its cap. running to month 18.

Two readings, seven months apart. The whole evidence base is those two numbers, and it is worth sitting with how thin that is before doing anything clever with it. Between the reading in month 5 and the reading in month 12 there are six months in which nobody wrote a number down, and no arithmetic anybody performs later can put information into those six months that was never collected.

The two readings do support a comparison of the excess itself. At month 5 the reading stood 0.2 percentage points above the cap. At month 12 it stood 1.0 point above the cap, five times the excess. Both ends of that comparison are recorded, so the fivefold rise is a genuine finding. There is also what cannot be said. Gross advances of Rs 58,800 crore are a month 12 figure, so the month 12 reading can be turned into rupees. One percentage point is Rs 588 crore, and the excess at month 12 is Rs 588 crore. The bank's records hold no gross advances figure for month 5, so the month 5 reading cannot be turned into rupees at all, and inventing a denominator to make a rupee number look tidy would be making up the answer. Every month 5 statement below therefore stays in percentage points.

Why is the line between those two readings a construction and not a path?

The moment anybody puts those two dots on a chart, a hand reaches for a ruler. Joining them produces a line that rises 0.8 percentage points over 7 months. The rise works out at 0.1143 percentage points a month, or about 1.37 points a year. The line is useful and worth drawing. A drawn line is still a drawing, and calling it anything else is the central mistake in reading a monitored risk.

Test it by extending it backwards. The 0.2 point excess at month 5 divided by 0.1143 points a month is 1.75 months of climb. Run the same line down and to the left and it meets the 12.0 per cent limit at month 3.25, or about month 3.3. The bank's own record says the limit was first crossed in month 5, and the line says month 3.3, and the record is the fact while the line is the drawing.

The disagreement does not need resolving, and it is neither a data error waiting to be corrected nor evidence that the record is wrong. The gap between month 3.3 and month 5 is the honest shape of what two readings can support. A straight line assumes a constant rate of climb, and a concentration built out of drawdowns, run-offs and one large sanction does not climb at a constant rate. The disagreement puts a size on the ignorance, and that is what makes it the most instructive thing on the chart. Somewhere between one and two months of history is being asserted by a ruler rather than observed by anybody.

So a working habit, and it is not a fussy one. Whenever a third point appears on a chart of a monitored risk, ask whether it was read or drawn. Read points come from a record with a date and a source. Drawn points come from the line. Both belong on the chart. Only one of them belongs in a sentence beginning with the word was.

How often does a limit actually have to be read?

The answer feels like a matter of taste, so everybody skips the question. It is not. Once a rate of climb exists, a reading interval can be priced exactly, and the price is stated in the same units as the risk. Taking the drawn line at its own word for a moment, purely as an assumption, the arithmetic falls out. The line climbs 0.1143 percentage points a month, or about 1.37 points a year. Dividing that by the number of times a year somebody actually looks gives how far the number can travel while nobody is watching.

A sightingOne occasion on which somebody actually looks at the number. is a real event with a person attached, not a data refresh. A number that exists in a system every night but reaches a human twice a year has two sightings, not three hundred and sixty five. A number nobody has looked at cannot start anything, so frequency is counted in the number of times a human being looks.

Move the slider to 1 and look at what happens. One sighting a year and the movement between sightings is about 1.37 percentage points, larger than the whole 1.0 point excess that existed at month 12. In plain words, on this assumed rate of climb an annually reviewed limit can go from comfortably inside its cap to a full point outside it and back to being read, with the reader learning about the entire journey from a single number. Move it to 6 and the movement falls to about 0.23 points. Move it to 12 and it falls to about 0.11.

Then keep going, and notice that the gain from each extra sighting shrinks: the first few sightings buy enormous amounts of certainty and the later ones buy very little. Going from 1 to 2 sightings a year removes about 0.69 points of blind movement. Going from 12 to 13 removes about 0.01. 13 sightings still leave about 0.105 points and 14 leave about 0.098, so 14 is the first whole number of sightings a year that keeps the movement under a tenth of a percentage point. The curve also never touches zero anywhere on the scale, and that is the honest part. No affordable frequency makes the unobserved movement disappear, it only makes it small enough to live with.

What does the same construction say about a plan running to month 18?

Breach B1 was not ignored. In month 6 it was accepted as temporary, by the board risk management committee, with a dated plan attached that runs to month 18 and Manjari Sondhi named against it. Accepting a breach is a decision, and a decision made on the evidence available on the day is not a failure. But notice what evidence was available on that day: one reading, the month 5 reading of 12.2 per cent, standing 0.2 points above the cap. An acceptance taken on one reading is an acceptance taken on a level with no direction attached to it.

By month 12 there is a second reading and therefore, for the first time, a direction. Carry the same construction forward to month 18, where the plan is due to end, and it reaches about 13.7 per cent, roughly 1.7 percentage points above the cap. The drawn line does not merely fail to return to the limit by the end of the plan; it ends further away from it than the reading that was accepted, and that is a different piece of information from anything the acceptance itself contained.

Say plainly what the trend does and does not establish. Month 18 has not happened and the line is still a drawing, so the trend does not establish that the plan has failed. On the only trend the bank's own records support, waiting is not a strategy. The plan has to bend the line rather than sit alongside it. Monitoring exists to produce exactly that kind of statement. The acceptance decided what to do about the level. Monitoring answers what nobody asked in month 6. Is the accepted breach behaving the way the acceptance assumed?

Why is a near miss the cheapest signal this bank has?

Turn to MW2. Vindhya Commercial Bank Limited recorded five near misses in the year, numbered N1 to N5. A duplicate settlement instruction for Rs 68 crore, the second of its kind that year, stopped by the four eyes check before release. A payment file of 1,240 salary credits queued against the wrong account and caught at reconciliation. A collateral valuation feed stale for 2 working days and caught by a data quality check. A trade finance document set carrying a forgery pattern and refused by a checker. A privileged access account belonging to a leaver that stayed live for 46 days and was found by the quarterly access review.

Not one of those cost a rupee. Costing nothing is precisely what makes them valuable and precisely why they get ignored. A near miss carries the same information about a control failure as a loss does, arrives before the loss, and costs nothing to collect, so it is the best value channel of the four by a very large margin. The catch is that nothing about it demands attention: there is no rupee figure to explain, no customer to compensate, and nobody has to write anything to a committee.

The bank's own year makes the argument better than any general statement could. Two of the five near misses, N3 and N4, turned up again later in the year as an incident with the identical failure underneath it, being 40.0 per cent of the log. N3 in month 6 was that stale collateral valuation feed, out for 2 working days, and nobody raised it as an issue. Four months later, in month 10, incident I10 was the same feed, stale for 11 working days, with 340 loans wrongly marked, at a net loss of Rs 1.4 crore. N4 in month 7 was the refused trade finance document set carrying the forgery pattern, recorded as a routine refusal and never linked to anything. One month later, in month 8, incident I13 was discovered, being nine letters of credit written against shipping documents that had been forged, across fourteen months, at a net loss of Rs 15.4 crore and the largest single loss of the year.

Add those two together and the size of the thing becomes plain. I10 at Rs 1.4 crore and I13 at Rs 15.4 crore come to Rs 16.8 crore of the year's Rs 43.8 crore net operational loss, being 38.4 per cent. The bank had already collected a warning about both, in writing, at no cost. The value of a near miss register is not in the recording, it is in the linking, and this bank did the first and not the second.

How much warning did the dashboard actually give?

MW3 is the channel most people picture when they hear the phrase risk monitoring: a dashboard, a screen of coloured statuses, a monthly pack. At month 12 Vindhya Commercial Bank Limited ran sixteen indicators on that dashboard, standing at 9 green, 5 amberThe middle status on this bank's own three status indicator scale. and 2 red. The two reds were the sector concentration behind breach B1 and the depositor concentration behind breach B4, so the dashboard was not asleep. The dashboard was showing the things it was built to show.

The guess is the lesson here. Thirteen incidents happened at this bank during the year, I1 to I13. Sixteen indicators were running the whole time. How many of the thirteen had an amber or a red already showing before the incident arrived?

Four. Four of the thirteen had an amber or a red already showing when the incident arrived, being 30.8 per cent, so nine of them, being 69.2 per cent, turned up with the dashboard silent. Sixteen indicators looks like coverage and a screen of colours looks like vigilance, so most people guess a much higher number.

The reason sits inside the sixteen. Eleven of them are lagging countsAn indicator that counts something after it has already happened.: a loss already booked, a breach already recorded, an issue already past its agreed date, a complaint already received. Five of them genuinely move before the loss, being the certificate of deposit roll rate, how many exceptions get signed off by the person who raised them, how old the open access rights on the system have become, how much of the closing journal is still keyed by hand, and how many people are leaving the dealing room. A dashboard that is two thirds counts of things that already happened is a history of the quarter rather than a warning about the next one, and it will be green right up until the moment it is not.

Be careful about one thing here. The two cuts of those sixteen indicators, the colour cut and the leading against lagging cut, are separate facts about the same set, and this bank's records do not say which statuses sat on which kind. So do not read the figure below as saying that the ambers were the lagging ones. The figure says that sixteen indicators split 9, 5 and 2 by status and 11 and 5 by nature, and that thirteen incidents split 4 and 9 by what was showing beforehand.

Why is the slowest channel the one that gets reported most?

MW4 is the loss log, and at this bank it holds all thirteen incidents at a net cost of Rs 43.8 crore for the year against limit L11 of Rs 60.0 crore. The loss log goes to a committee every month. A loss has to happen before a loss can be logged, so the log is complete, reconciled and unarguable, and it is the last of the four channels to move.

Completeness and lateness are the same property. The loss log is easy to report precisely because every number on it is final, and a number that is final is a number that has stopped being a warning. Incident I2 illustrates the point twice over: a settlement instruction sent twice, Rs 42.0 crore out of the bank, and Rs 41.4 crore recovered, so the row that dominates a report ranked on gross loss almost vanishes from a report ranked on net. Either way it is a description of month 2, written afterwards.

Here is the household version, and it is uncomfortably close. A household that reviews its finances by reading last month's bank statement knows exactly what it spent and has no idea what it is about to spend. The statement is accurate, complete and entirely about the past. The rent going up, the contract ending, the car making a new noise: none of those appear on it, and all of them are the reason next month will differ from last month.

If one channel could be added to a report, which should it be?

Put the four side by side on the two things that matter and an order falls out. Nothing is lost in a near miss, so MW2, the near miss log, moves earliest and costs nothing. The number behind MW1 is being computed anyway, so the limit reading with its trend attached moves while the exposure is still building and costs almost nothing. MW3, the indicator status, moves whenever its underlying counts move, and at this bank eleven of sixteen moved only after the event. MW4, the loss log, moves last and is paid for with the loss.

So the two cheapest channels are also the two earliest, and the most expensive is the latest. The usual reporting habit of leading with the loss log has the order exactly backwards. If a report carried only MW4 today and one thing could be added to it, the near miss log is the answer: it is already being collected, it costs nothing more, and at this bank it contained two entries that each preceded an incident nobody connected to them. The limit trend is a close second, and it is the cheaper of the two to argue for. Nobody has to be persuaded to start collecting anything.

Where does watching a risk stop and designing an indicator begin?

Watching a risk has a boundary, and it is a sharp one. Monitoring is about looking: what traces exist, how often somebody reads them, and what moves between one reading and the next. Deciding that the sector concentration reading should be looked at every month is a decision about frequency, and it is a complete decision on its own terms. Setting a frequency is not the design of an indicator.

Designing the indicator is a separate job with separate questions: what exactly it measures and out of which record, what level turns it amber and what level turns it red, and who receives it, in what pack, and where in that pack. One more question separates an indicator from a measurement: what does somebody actually do when it fires? An indicator with no action attached to it is a measurement, and this bank runs sixteen of the first kind on its dashboard and seven early warning indicators of the second kind, each with a defined action attached to a defined trigger, and the two are different objects that must never be merged. All of that design work is covered separately.