Qualitative standardsQualitative standards

Qualitative standards

An ADI must have an independent risk control unit that is responsible for the design and implementation of the ADI’s market risk management system. The risk control unit must produce and analyse daily reports on the output of the ADI’s risk measurement model, including an evaluation of limit utilisation. This risk control unit must be independent from business trading and other risk-taking units and must report directly to senior management of the ADI.
The risk control unit must conduct a back-testing program at least quarterly that complies with the minimum requirements in paragraphs 81 to 87 of this Attachment.
The Board, or a Board committee, and senior management of an ADI must be actively involved in the risk control process and must treat risk control as an essential aspect of the business, to which significant resources need to be devoted. The daily reports prepared by the independent risk control unit must be reviewed by a level of management with sufficient seniority and authority to enforce both reductions of positions taken by individual traders and reductions in the ADI’s overall risk exposure.
An ADI’s internal market risk measurement model must be closely integrated into the day-to-day risk management process of the ADI. Accordingly, the output of the model must be an integral part of the process of planning, monitoring and controlling the ADI’s market risk profile.
An ADI’s market risk measurement system must be used in conjunction with internal trading and exposure limits. An ADI’s trading limits must be related to the ADI’s VaR measurement model in a manner that is consistent over time and that is well understood by both traders and senior management.
An ADI must have a routine and robust program of stress testing as a supplement to the risk analysis based on the day-to-day output of the risk measurement model. The results of stress testing exercises must be used in the internal assessment of capital adequacy and reflected in the policies and limits set by management and the Board, or Board committee. The results of stress testing must be routinely communicated to senior management and, periodically, to the ADI’s Board, or a Board committee.
An ADI’s risk measurement system must be well documented. An ADI must have a routine for ensuring compliance with a documented set of internal policies, controls and procedures concerning the operation of the risk measurement system.
An ADI must ensure that an independent review of the risk measurement system and overall risk management process is carried out initially (i.e. at the time when model approval is sought) and then regularly as part of the ADI’s internal audit process. This review must be conducted by functionally independent, appropriately trained and competent personnel, and must take place at least once every three years or when a material change is made to the framework. The review must cover the activities of both the business trading units and the independent risk control unit and must, at a minimum, specifically address the: