I. BACKGROUND
The joint federal agencies issued an interagency advisory reminding institutions of supervisory expectations on sound practices for managing interest rate risk (IRR). The advisory reiterates basic principles of sound IRR management that each of the regulators has codified in its existing guidance, as well as in the interagency guidance on IRR management issued by the banking agencies in 1996 (joint policy statement on interest rate risk). The advisory highlights the need for active board and senior management oversight and a comprehensive risk-management process that effectively measures, monitors, and controls IRR.
The advisory targets IRR management at insured depository institutions. However, principles and supervisory expectations articulated also apply to bank holding companies, which are reminded of long-standing supervisory guidance that they should manage and control aggregate risk exposures on a consolidated basis while recognizing legal distinctions and possible obstacles to cash movements among subsidiaries.
Current economic conditions present significant risk management challenges to depository institutions of all sizes. Institutions are reminded to not lose focus on their management of IRR. For a number of institutions, increased loan losses and sharp declines in the value of certain securities portfolios are placing downward pressure on capital and earnings. In this interest rate environment, taking advantage of a steeply upward sloping yield curve by funding longer-term assets with shorter-term liabilities may pose risks to an institution’s capital and earnings should short-term interest rates rise. Depository institutions are expected to manage IRR exposures using policies and procedures commensurate with their complexity, business model, risk profile, and scope of operations.
This advisory re-emphasizes the importance of effective corporate governance, policies and procedures, risk measuring and monitoring systems, stress testing, and internal controls related to the IRR exposures of institutions. It also clarifies various elements of existing guidance and describes selected IRR management techniques used by effective risk managers. More detailed guidelines on the basic principles of IRR management discussed in this advisory can be found in each regulator’s established guidance.
II. CORPORATE GOVERNANCE
Existing interagency and international guidance identifies the board of directors as having the ultimate responsibility for the risks undertaken by an institution – including IRR. As a result, the regulators remind boards of directors that they should understand and be regularly informed about the level and trend of their institutions’ IRR exposure. The board of directors, or its delegated committee of board members, should oversee the establishment, approval, implementation, and annual review of IRR management strategies, policies, procedures, and limits (or risk tolerances). Institutions should understand the implications of the IRR strategies they pursue, including their potential impact on market, liquidity, credit, and operating risks.
Senior management is responsible for ensuring that board-approved strategies, policies, and procedures for managing IRR are appropriately executed within the designated lines of authority and responsibility. Management also is responsible for maintaining:
An institution’s IRR tolerance should be communicated so that the board of directors and senior management clearly understand the institution’s risk tolerance limits and approach to managing the impact of IRR on earnings and capital adequacy. IRR reports distributed to senior management and the board should provide aggregate information and supporting detail that is sufficient to enable them to assess the sensitivity of the institution to changes in market rates and important assumptions underlying the metrics used. Institutions with an Asset/Liability Committee (ALCO), or similar senior management committee, should ensure the committee actively monitors the IRR profile and has sufficiently broad representation across major functions that can directly or indirectly influence the institution’s IRR exposure (e.g., lending, investment securities, wholesale and retail funding).
III. POLICIES AND PROCEDURES
Institutions are expected to have comprehensive policies and procedures governing all aspects of their IRR management process. Such policies and procedures should ensure the IRR implications of significant new strategies, products and businesses are integrated into their IRR management process. Policies and procedures also should document and provide for controls over permissible hedging strategies and hedging instruments. Institutions should ensure the assessment of IRR is appropriately incorporated in firm-wide risk management efforts so that the interrelationships between IRR and other risks are understood.
IRR tolerances articulated in an institution’s policies should be explicit and address the potential impact of changing interest rates on earnings and capital from a short-term and a long-term perspective. Well-managed institutions generally specify IRR tolerances in the context of scenarios of potential changes in market interest rates and a target or range for performance metrics. Institutions with significant exposures to basis risk, yield curve risk or positions with explicit or embedded options should establish risk tolerances appropriate for these risks.
IV. MEASUREMENT AND MONITORING OF INTEREST RATE RISK
Existing interagency guidance articulates supervisors’ expectations that institutions have robust IRR measurement processes and systems to assess exposures relative to established risk tolerances. Such systems should be commensurate with the size and complexity of the institution. Although institutions may rely on third-party IRR models, they are expected to fully understand the underlying analytics, assumptions, and methodologies and ensure such systems and processes are incorporated appropriately in the strategic (long-term) and tactical (short-term) management of IRR exposures.
V. MEASUREMENT METHODOLOGIES
Institutions use a variety of techniques to measure IRR exposure. The regulators continue to believe that well-managed institutions will consider earnings and economic perspectives when assessing the scope of their IRR exposure. Reduced earnings or outright losses adversely affect an institution’s liquidity and capital adequacy. Evaluating the impact of adverse changes in an institution’s economic value also is useful, as it can signal future earnings and capital problems.
Although simple maturity gap analysis for assessing the impact of changes in market rates on earnings may continue to be a viable analytical tool for small institutions with less complex IRR profiles, many institutions now use some form of simulation modeling to measure IRR exposure. In fact, current computer technology allows even some smaller, less sophisticated institutions to perform comprehensive simulations of the potential impact of changes in market rates on their earnings and capital. Most institutions primarily use simulations to assess the impact of changing rates on earnings. However, many simulation models have the capability of forecasting the impact on both earnings and capital by generating pro-forma income statements and balance sheets. Most also have capabilities for assessing the impact of changing rates on the market value of the balance sheet. Institutions are encouraged to use the full complement of analytical capabilities of their IRR simulation models.
A key aspect of IRR simulation involves the selection of an appropriate time horizon(s) over which to assess IRR exposures. Simulations can be performed over any time horizon and often are used to analyze multiple horizons identifying short-term, intermediate-term, and long-term risk. When using earnings simulation models, IRR exposures are best projected over at least a two-year period. Using a two-year time frame will better capture the true impact of important transactions, tactics, and strategies taken to increase revenues which can be hidden by viewing projected results within shorter time horizons. However, to fully assess the impacts of certain products with embedded options, longer time horizons of five to seven years are typically needed.
In general, simulation models can be either static or dynamic. Static simulation models are based on current exposures and assume a constant balance sheet with no new growth. In contrast, dynamic simulation models rely on detailed assumptions regarding changes in existing business lines, new business, and changes in management and customer behavior. Both techniques are capable of incorporating assumptions about the future path of interest rates using simple deterministic scenario analysis, more sophisticated stochastic-path techniques, or Monte Carlo simulations.
Dynamic earnings simulation models can be useful for business planning and budgeting purposes. However, dynamic simulation is highly dependent on key variables and assumptions that are extremely difficult to project with accuracy over an extended period. Furthermore, model assumptions can potentially hide certain key underlying risk exposures. As such, when performing dynamic simulations, institutions should also run static simulations to provide ALCO or senior management a complete and comparative description of the institution’s IRR exposure.
Despite their many benefits, both static and dynamic earnings simulations have limitations in quantifying IRR exposure. As a result, economic value methodologies should also be used to broaden the assessment of IRR exposure. Economic value-based methodologies measure the degree to which the economic values of an institution’s positions change under different interest rate scenarios. The economic-value approach focuses on a longer-term time horizon, captures all future cash flows expected from existing assets and liabilities, and is more effective in considering embedded options in a typical institution’s portfolio.
In general, most economic value models use a static approach in that the analysis typically does not incorporate new business; rather, the analysis shows a snapshot in time of the risk inherent in the portfolio or balance sheet. However, some institutions have started to incorporate dynamic modeling techniques that provide forward-looking estimates of economic value.
Institutions are encouraged to use a variety of measurement methods to assess their IRR profile. Regardless of the methods used, an institution’s IRR measurement system should be sufficiently robust to capture all material on- and off-balance sheet positions and incorporate a stress-testing process to identify and quantify the institution’s IRR exposure and potential problem areas.
VI. STRESS TESTING
The regulators remind institutions that stress testing, which includes both scenario and sensitivity analysis, is an integral component of IRR management. In general, scenario analysis uses the model to predict a possible future outcome given an event or series of events, while sensitivity analysis tests a model’s parameters without relating those changes to an underlying event or real world outcome.
When conducting scenario analyses, institutions should assess a range of alternative future interest rate scenarios in evaluating IRR exposure. This range should be sufficiently meaningful to fully identify basis risk, yield curve risk and the risks of embedded options. In many cases, static interest rate shocks consisting of parallel shifts in the yield curve of plus and minus 200 basis points may not be sufficient to adequately assess an institution’s IRR exposure. As a result, institutions should regularly assess IRR exposures beyond typical industry conventions, including changes in rates of greater magnitude (e.g., up and down 300 and 400 basis points) across different tenors to reflect changing slopes and twists of the yield curve. Institutions should ensure their scenarios are severe but plausible in light of the existing level of rates and the interest rate cycle. For example, in low-rate environments, scenarios involving significant declines in market rates can be de-emphasized in favor of increasing the number and size of alternative rising-rate scenarios.
Depending on an institution’s IRR profile, stress scenarios should include but not be limited to:
Non-complex institutions (e.g., institutions with limited embedded options or structured products on their balance sheets) may be able to justify running fewer or less intricate scenarios, depending on their IRR profile. However, interest rate shocks of sufficient magnitude should be run, regardless of the institution’s size or complexity. Institutions should ensure IRR exposures are incorporated and evaluated as part of the enterprise-wide risk identification and analysis process.
In addition to scenario analysis, stress testing should include a sensitivity analysis to help determine which assumptions have the most influence on model output. Institutions will generally focus more of their efforts in verifying the most influential assumptions. Additionally, sensitivity analysis can be used to determine the conditions under which key business assumptions and model parameters break down or when IRR may be exacerbated by other risks or earnings pressures.
At well-managed institutions, management compares stress test results against approved tolerance limits. Such reviews enable institutions to properly estimate and monitor key variables whose volatility will significantly affect IRR exposure. Moreover, in conducting stress tests, special consideration should be given to instruments or markets in which concentrations exist, as such positions may be more difficult to unwind or hedge during periods of market stress.
VII. ASSUMPTIONS
Proper measurement of IRR requires regularly assessing the reasonableness of assumptions that underlie an institution’s IRR exposure estimates. The regulators remind institutions to document, monitor, and regularly update key assumptions used in IRR measurement models. At a minimum, institutions should ensure the reasonableness of asset prepayments, non-maturity deposit price sensitivity and decay rates, and key rate drivers for each interest rate shock scenario. Assumptions about non-maturity deposits are critical, particularly in market environments in which customer behaviors may not reflect long-term economic fundamentals, or in which institutions are subject to heightened competition for such deposits. Generally, rate-sensitive and higher-cost deposits, such as brokered and Internet deposits, would reflect higher decay rates than other types of deposits. Also, institutions experiencing or projecting capital levels that trigger brokered and high interest rate deposit restrictions should adjust deposit assumptions accordingly.
When dynamic simulations of future growth and business assumptions are used, assessment of consistent replacement growth rate assumptions is particularly important. Customer behaviors can differ in various markets. Financial institutions should perform historical and forward-looking analyses to develop supportable assumptions and models relevant to their market and business plans.
Proper measurement of IRR also requires sensitivity testing of key assumptions that exert the greatest impact on measurement results. When actual experience differs significantly from past assumptions and expectations, institutions should use a range of assumptions to appropriately reflect this uncertainty. When assumptions are adjusted from prior reporting periods, the changes and their effects on model outputs should be documented and clearly identified.
VIII. RISK MITIGATING STEPS
Limit controls should be in place to ensure positions that exceed certain predetermined levels receive prompt management attention. An appropriate limit system should permit management to identify IRR exposures, initiate discussions about risk, and take appropriate action as identified in IRR policies and procedures. Further, a well-managed institution will find a balance between establishing limits that are neither so high that they are never breached nor so low that exceeding the limits is considered routine and not worthy of action.
Should IRR exposure exceed or approach these limits, institutions can mitigate their risk through balance sheet alteration and hedging. The most common way to control IRR is through the balance sheet mix of assets and liabilities. This involves achieving an appropriate distribution of asset maturities or repricing structures, with the maturity or repricing mix of liabilities that will avoid the potential for severe maturity or duration mismatches between assets and liabilities.
Using derivative instruments to mitigate IRR exposures may be appropriate for institutions with the knowledge and expertise in these instruments. Hedging with interest rate derivatives is a potentially complex activity that can have unintended consequences, including compounding losses, if used incorrectly. Each institution using derivatives should establish an effective process for managing interest rate risk. The level of structure and formality in this process should be commensurate with the activities and level of risk approved by senior management and the board. Institutions should not undertake this activity unless the board and senior management understand the institution’s hedging strategy when using these instruments, including the potential risks and benefits of the strategy. Reliance on outside consultants to assist in the establishment of such a strategy does not absolve the board and senior management of their responsibility to fully understand the risks of the derivatives hedging strategy. Hedging strategies should be designed to limit downside earnings exposure or manage income or economic value of equity (EVE) volatility.
IX. INTERNAL CONTROLS AND VALIDATION
The regulators expect institutions to have an adequate system of internal controls to ensure the integrity of all elements of their IRR management process, including the adequacy of corporate governance, compliance with policies and procedures, and the comprehensiveness of IRR measurement and management information systems. These controls should be an integral part of the institution’s overall system of internal controls and should promote effective and efficient operations, reliable financial and regulatory reporting, and compliance with relevant laws, regulations, and institution policies.
X. MODEL VALIDATION
Validating IRR models is a fundamental part of any institution’s system of internal controls. An important element of model validation is independent review of the logical and conceptual soundness. The scope of the independent review should involve assessing the institution’s measurement of IRR, including the reasonableness of assumptions, the process used in determining assumptions, and the back testing of assumptions and results. Management also should implement adequate follow-up procedures to monitor management’s corrective actions. The results of these reviews should be available for the relevant supervisory authorities.
Smaller institutions that do not have the resources to staff an independent review function should have processes in place to ensure the integrity of the various elements of their IRR management processes. Often, smaller institutions will use an internal party that is sufficiently removed from the primary IRR functions or an external auditor to ensure the integrity of their risk management process.
Institutions that use vendor-supplied models are not required to test the mechanics and mathematics of the measurement model. However, the vendor should provide documentation showing a credible independent third party has performed such a function. Large and complex institutions, or those with significant IRR exposures, may need to perform more in-depth validation procedures of the underlying mathematics. Validation practices could include constructing an identical model to test assumptions and outcomes or using an existing, well-validated “benchmark” model, which is often a less costly alternative. The benchmark model should have theoretical underpinnings, methodologies, and inputs that are as close as possible to those used in the model being validated. Large and more complex institutions have used “benchmarking” effectively to identify model errors that could distort IRR measurements. The depth and extent of the validation process should be consistent with the materiality and complexity of the risk being managed.