Bank Risk Management and Internal Control

Introduction and context

Banking is an activity of managed risk rather than risk elimination. Banks accept deposits and other short-term obligations, transform maturities, provide credit, trade financial instruments, operate payment systems, and hold sensitive information. These functions create economic value, but they also expose the institution to losses, liquidity pressure, fraud, regulatory sanctions, technology failure, and reputational damage.

Risk management is the systematic process of identifying, measuring, monitoring, controlling, and reporting uncertainty that may affect a bank’s objectives. Internal control is the set of policies, procedures, structures, and behaviours designed to provide reasonable—not absolute—assurance that objectives are achieved, reporting is reliable, laws are followed, and assets are protected.

A sound framework links strategy to risk appetite, risk limits, controls, stress testing, capital and liquidity planning, business continuity, and independent assurance. It must also address risks that are difficult to quantify, including conduct, cyber, compliance, and systemic risk.

Learning objectives

By the end of this chapter, a student should be able to:

1. distinguish major banking risks and explain their interrelationships;
2. measure basic credit, market, liquidity, and interest-rate exposures;
3. apply risk appetite, limits, the three-lines model, stress testing, and scenario analysis;
4. design appropriate internal controls, continuity arrangements, and audit responses;
5. evaluate cyber, compliance, conduct, and systemic-risk governance;
6. interpret a practical bank-risk case and recommend proportionate action.

1. The risk-management architecture

Risk taxonomy

A bank’s risk taxonomy should be comprehensive but manageable. Common categories are shown below.

Risks interact. A cyberattack may create operational losses, liquidity outflows, conduct failures, and regulatory penalties. Credit deterioration can reduce capital and trigger funding withdrawals. Therefore, risk reporting should show both individual exposures and cross-risk dependencies.

Risk appetite and limits

The board sets the risk appetite: the aggregate level and types of risk the bank is willing to accept in pursuit of its strategy. A risk appetite statement should include qualitative principles and measurable boundaries, such as a maximum non-performing-loan ratio, minimum liquidity buffer, maximum trading loss, or zero tolerance for deliberate regulatory breaches.

Risk capacity is the maximum risk the bank can absorb, given capital, liquidity, earnings, legal obligations, and operational resilience. Appetite should remain below capacity. Limits translate appetite into business decisions; triggers provide early warning before a limit is breached. A breach requires documented escalation, root-cause analysis, corrective action, and board reporting.

Governance and the three lines

The three-lines model clarifies accountability:

• First line: business and operational managers own risks, operate controls, and remain accountable for outcomes.
• Second line: risk management and compliance set frameworks, challenge decisions, monitor exposures, and report independently from revenue generation.
• Third line: internal audit provides independent, risk-based assurance on governance, risk management, and controls.

The board and senior management are not a fourth line; they retain ultimate responsibility for governance, culture, resources, and corrective action. External audit, regulators, and supervisors provide additional external assurance, but they do not replace management’s responsibility.

A strong governance cycle is: identify → assess → approve → control → monitor → report → challenge → improve.

2. Measuring principal financial risks

Credit risk

Credit risk measurement begins with exposure identification and borrower assessment. Important factors include repayment capacity, cash flow, leverage, collateral quality, industry conditions, concentration, and correlated exposures.

A simplified expected-loss model is:

where EL is expected loss in currency units, PD is probability of default over the relevant horizon, LGD is loss given default as a proportion of exposure, and EAD is exposure at default. The variables must refer to the same borrower population, time horizon, and definition of default. This is a simplified one-period model; real expected-credit-loss systems may discount cash shortfalls and use scenario-weighted forecasts.

Worked example. A loan portfolio has EAD of $20 million, an estimated one-year PD of 3%, and LGD of 40%. Then:

EL = 0.03 × 0.40 × $20,000,000 = $240,000.

The result is an expected statistical loss, not a prediction that exactly $240,000 will be lost. If collateral recovery improves, LGD may fall; if a recession raises default probability, EL increases.

Concentration risk is also important. A portfolio may have low average default probability but unacceptable exposure to one borrower, sector, geography, currency, or correlated collateral. Limits and stress tests supplement the expected-loss estimate.

Market risk

Market risk arises from changes in interest rates, exchange rates, equity prices, commodity prices, and credit spreads. A simple position approximation is:

where ∆V is the approximate change in instrument value, D is modified duration in years, V is current market value, and ∆y is the decimal change in yield. This approximation is most appropriate for relatively small yield changes and instruments whose value is sufficiently well represented by duration. Convexity becomes important for larger changes.

Example. A bond portfolio worth $10 million has modified duration of 4.5. If yield rises by 0.50%, ∆y = 0.005. The estimated change is:

∆V ≈ −4.5 × $10,000,000 × 0.005 = −$225,000.

The negative sign indicates a loss. The approximation excludes spread changes, defaults, convexity, and hedging effects.

Value at Risk (VaR) estimates a loss threshold at a stated confidence level and horizon, but it does not describe losses beyond that threshold. Expected shortfall estimates the average loss in the tail beyond the chosen VaR threshold. Both depend heavily on data, assumptions, liquidity, and model specification; stress testing remains necessary.

Liquidity risk

Liquidity risk has two dimensions. Funding liquidity risk is the inability to obtain funds or roll over liabilities. Market liquidity risk is the inability to sell or hedge an asset quickly without a substantial price concession.

For a time bucket t, the periodic liquidity gap is:

where I_t is expected cash inflow during bucket t and O_t is expected cash outflow during that same bucket. A positive gap is a net inflow for that period; a negative gap is a net outflow.

The cumulative liquidity gap through time T is different and must sum all periodic gaps:

Alternatively, if cumulative inflows and outflows are defined directly, CG_T = I^cum_T − O^cum_T. These definitions must not be confused with the single-period gap.

Worked example. Expected cash flows are:

All figures are $ million. The cumulative gaps are −4, 0, and −2 respectively. Thus, despite a balanced first two buckets, the position remains a cumulative $2 million net outflow by 90 days. This analysis should incorporate behavioural assumptions, such as deposit stability and loan drawdowns, and should be tested under stress.

#### Liquidity Coverage Ratio

The Liquidity Coverage Ratio (LCR) is a short-term resilience measure:

HQLA means eligible high-quality liquid assets, while NCOF means net cash outflows over the prescribed 30-day stress period. The regulatory definition includes specified eligibility, haircuts, inflow restrictions, and stress assumptions; therefore, a student should not substitute unrestricted accounting cash flows without checking the applicable rulebook. An LCR of at least 100% is a common Basel minimum for internationally active banks, subject to jurisdictional implementation and supervisory discretion.

Example. If eligible HQLA is $150 million and 30-day net cash outflows are $120 million, LCR = 150 ÷ 120 × 100% = 125%.

#### Net Stable Funding Ratio

The Net Stable Funding Ratio (NSFR) addresses structural, approximately one-year funding resilience:

ASF is available stable funding, weighted according to the stability of funding sources; RSF is required stable funding, weighted according to asset liquidity and maturity. Under the Basel framework, the standard minimum is commonly 100%, subject to local rules. LCR and NSFR are complementary: LCR focuses on a 30-day stress horizon, whereas NSFR addresses structural funding over a longer horizon. Neither replaces daily cash-flow monitoring or a contingency funding plan.

Interest-rate risk in the banking book

Interest-rate risk affects net interest income and the present economic value of assets, liabilities, and off-balance-sheet items. Repricing-gap analysis classifies items according to the next repricing date. A negative gap in a time bucket means more liabilities than assets reprice in that bucket; the earnings effect depends on the direction of rate changes and the bank’s margin structure.

Duration-based economic-value analysis estimates sensitivity of present value. It should include deposits with uncertain behavioural maturities, prepayments, early withdrawals, basis risk, yield-curve changes, and optionality. A single parallel-rate-shock measure is not sufficient; banks should consider non-parallel and basis scenarios.

3. Non-financial risk and resilience

Operational risk and internal controls

Operational risk concerns failed or inadequate processes, people, systems, or external events. Typical losses arise from unauthorized transactions, processing errors, model failures, third-party outages, natural disasters, and internal fraud.

Controls may be:

• Preventive: segregation of duties, approval limits, authentication, maker-checker procedures;
• Detective: reconciliations, exception reports, surveillance, access reviews;
• Corrective: incident response, recovery, restitution, and control redesign.

A control is effective only when it is appropriately designed and consistently operated. Evidence should demonstrate who performed it, when, what was reviewed, exceptions identified, and how exceptions were resolved. Automation can reduce manual error but can also amplify a bad rule across thousands of transactions.

Compliance and conduct risk

Compliance risk includes breaches of banking law, prudential requirements, consumer-protection rules, sanctions, anti-money-laundering and counter-terrorist-financing obligations, data-protection law, and tax or reporting requirements. A risk-based compliance programme maps obligations to owners, controls, monitoring, training, escalation, and documented remediation.

Conduct risk focuses on customer and market harm. Important safeguards include fair product design, transparent pricing, suitability or affordability assessment where applicable, responsible sales incentives, complaint analysis, vulnerable-customer protections, and controls over conflicts of interest. A technically legal action may still be inconsistent with fair treatment or the bank’s stated values.

Cyber risk

Cyber risk threatens confidentiality, integrity, and availability. A layered programme includes asset inventories, secure configuration, identity and access management, multi-factor authentication, least privilege, network segmentation, encryption, patching, backup protection, security monitoring, staff awareness, supplier controls, and tested incident response.

The response cycle is commonly described as identify and protect, detect, respond, and recover. Important governance questions include: which services are critical, how quickly must they recover, who can isolate systems, how are customers and regulators notified, and how is evidence preserved? Cybersecurity is therefore both a technology issue and a board-level operational-resilience issue.

Business continuity and recovery

Business continuity management identifies critical services, dependencies, impact tolerances, alternate processes, communications, and recovery strategies. A business impact analysis distinguishes recovery time objective (maximum acceptable time to restore a service) from recovery point objective (maximum acceptable data loss measured in time).

Plans must cover people, premises, technology, data, suppliers, liquidity access, communications, and decision authority. Testing should include tabletop exercises, technical recovery tests, cyber simulations, and severe-but-plausible scenarios. A plan that has not been tested is an assumption, not demonstrated capability.

4. Stress testing and scenario analysis

Stress testing asks how the bank would perform under adverse conditions. Scenario analysis may be historical, hypothetical, reverse, or sensitivity-based.

• A sensitivity test changes one factor, such as unemployment or interest rates.
• A scenario changes several linked variables consistently.
• A reverse stress test starts with failure, such as a liquidity breach, and identifies the combination of events that could cause it.

A credible process defines the scenario, maps effects to risk parameters, estimates impacts on earnings, capital, liquidity, and operations, identifies management actions, and challenges assumptions. It should not rely only on historical data because the next crisis may differ from the last.

For a simplified capital illustration:

If capital is $900 million and risk-weighted assets are $10 billion, the ratio is 9%. If a stress produces a $150 million loss and no mitigating action is assumed, capital becomes $750 million and the ratio becomes 7.5%, assuming risk-weighted assets remain unchanged. In reality, losses may also change risk-weighted assets, taxes, provisions, and management responses; the illustration is intentionally limited.

Stress results should inform capital and liquidity plans, limits, pricing, provisioning, hedging, recovery options, and risk appetite. They are not forecasts and should not be presented with false precision.

5. Internal control, audit, and assurance

The control environment is the foundation of internal control. It includes board oversight, ethical culture, competence, accountability, clear authority, and consequences for misconduct. Risk assessment identifies threats to objectives. Control activities address those threats. Information and communication ensure that relevant data reaches decision-makers. Monitoring evaluates whether controls remain effective.

Internal audit should use a risk-based audit universe covering products, legal entities, processes, technology, outsourced services, and major change programmes. An audit typically establishes scope and criteria, assesses inherent and residual risk, tests design and operating effectiveness, documents evidence, reports findings, agrees action owners and deadlines, and performs follow-up validation.

Internal audit independence is protected when the chief audit executive reports functionally to the audit committee and has unrestricted access to records and personnel. Internal audit should not design or operate controls it later audits. External audit generally focuses on financial-statement assurance, while internal audit covers broader governance and control assurance; their responsibilities should not be confused.

Control limitations include human error, collusion, management override, poor judgement, cost constraints, changing conditions, and incomplete information. Consequently, “effective control” means reasonable assurance, not certainty.

6. Systemic risk and regulatory perspective

Systemic risk may arise through common exposures, interconnected claims, correlated behaviour, payment-system dependence, fire sales, or loss of confidence. A bank can be individually prudent yet contribute to systemic fragility if many institutions use the same models, funding sources, or asset markets.

Macroprudential responses include capital buffers, liquidity standards, large-exposure limits, recovery and resolution planning, central counterparty safeguards, supervisory stress tests, and restrictions on risky activities. Resolution planning seeks to preserve critical economic functions without assuming that taxpayers will automatically absorb losses.

Regulation cannot substitute for sound judgement. Banks must understand the purpose and limitations of a rule, maintain accurate data, and avoid “compliance by checklist.” Supervisors increasingly expect credible risk data aggregation, timely reporting, operational resilience, third-party oversight, and evidence of board challenge.

7. Technology, data, and artificial intelligence

Risk technology can improve early-warning indicators, transaction monitoring, anomaly detection, liquidity forecasting, and control testing. However, artificial-intelligence systems create model risk, data-quality risk, privacy risk, explainability problems, bias, cybersecurity exposure, and third-party dependence.

Responsible use requires a defined purpose, lawful data use, data lineage, validation, performance monitoring, human review, access controls, change management, documentation, and a process for contesting or correcting automated decisions. A model’s accuracy in normal conditions does not prove robustness during a crisis. Critical decisions should have fallback procedures when data or models fail.

8. Illustrative integrated case: Meridian Community Bank

Background. Meridian Community Bank funds small-business loans with deposits and short-term wholesale borrowing. It has strong recent profits but rapid loan growth, concentrated exposure to commercial property, a mobile-banking platform supplied by a third party, and limited treasury staffing.

Problem. A regional downturn increases expected defaults. At the same time, social-media rumours cause some deposit withdrawals, the wholesale lender reduces its limit, and a ransomware event interrupts mobile access. Management reports that the LCR remains above 100%, but its cumulative 90-day liquidity gap is negative. The board has no documented trigger for escalating a combined event.

Analysis. Credit risk is elevated through sector concentration and weaker collateral values. Liquidity risk is amplified because stressed outflows may exceed historical behavioural assumptions. Operational and cyber risks threaten payment access and customer confidence. Conduct risk arises if customers cannot access funds or receive timely information. The risks are correlated rather than independent.

Approach. Meridian should immediately verify eligible HQLA and calculate LCR under the applicable regulatory definition, update daily contractual and behavioural cash-flow forecasts, and distinguish each periodic gap from the cumulative gap. It should run a combined scenario involving property losses, deposit runoff, wholesale non-renewal, and a seven-day technology outage. The bank should activate its incident and contingency funding teams, pre-position collateral, diversify communications, preserve forensic evidence, and notify authorities where required.

The board should temporarily restrict concentrated lending, review collateral haircuts and provisions, and set triggers for liquidity, capital, cyber recovery, and customer-harm indicators. The second line should challenge assumptions; internal audit should later assess governance, access controls, third-party oversight, and the reliability of stress calculations. Management should remediate root causes rather than merely restore systems.

Outcome. In this illustrative case, the bank preserves critical payments, obtains emergency but costly funding, and remains solvent. Its post-event programme includes a stronger contingency funding plan, tested recovery capability, concentration limits, improved deposit-run scenarios, vendor exit planning, and board reporting that combines financial and non-financial indicators.

Learning points. A ratio above a minimum does not guarantee safety. Liquidity measurement must use correct time aggregation and stressed assumptions. Cyber resilience is connected to liquidity and conduct. Governance must specify actions before a crisis, not only describe responsibilities afterward.

9. Best practices and limitations

Best practice is proportionate, forward-looking, documented, and evidence-based. Banks should maintain a current risk taxonomy; align appetite with capacity; use independent challenge; reconcile risk, finance, and treasury data; combine metrics with judgement; test severe-but-plausible scenarios; monitor third parties; protect whistleblowers; and track remediation to closure.

Important limitations remain. Probability estimates may be unstable; historical correlations can break down; liquidity can disappear faster than models imply; valuation may be uncertain in illiquid markets; and risk categories can obscure common causes. Quantitative models should therefore be supplemented by expert judgement, qualitative indicators, reverse stress testing, and strong escalation culture.

Chapter Summary

Bank risk management integrates identification, measurement, control, monitoring, reporting, and assurance. Credit risk can be approximated using EL = PD × LGD × EAD, while market sensitivity may use duration for small yield changes. Liquidity analysis must distinguish the periodic gap G_t = I_t − O_t from the cumulative gap CG_T = ∑_t=1^TG_t. LCR measures short-term stressed liquidity and NSFR measures structural stable funding; both complement, rather than replace, cash-flow forecasting and contingency planning.

Risk appetite converts strategy into boundaries, and the three-lines model allocates ownership, challenge, and independent assurance. Operational, compliance, cyber, conduct, and systemic risks require controls and governance that cannot be reduced to financial ratios. Stress tests, scenario analysis, business continuity, internal audit, and responsible technology use help banks remain resilient under uncertainty. Effective control provides reasonable assurance, but no framework eliminates human error, model limitations, management override, or systemic contagion.

Key Terms

Risk appetite: The aggregate amount and types of risk a bank is willing to accept.

Risk capacity: The maximum risk the bank can absorb without failing obligations or strategic constraints.

Credit risk: Risk that a counterparty will not meet its contractual obligation.

Probability of default (PD): Likelihood that a borrower defaults over a defined horizon.

Loss given default (LGD): Proportion of exposure expected to be lost after recovery.

Exposure at default (EAD): Amount exposed when default occurs.

Market risk: Risk of loss from market-price or market-rate movements.

Liquidity risk: Risk of inability to meet obligations when due.

Periodic liquidity gap: Inflows minus outflows within one time bucket.

Cumulative liquidity gap: Sum of periodic gaps through a specified time.

LCR: High-quality liquid assets divided by prescribed 30-day net cash outflows.

NSFR: Available stable funding divided by required stable funding.

Operational risk: Risk from failed processes, people, systems, or external events.

Conduct risk: Risk of customer or market harm from inappropriate behaviour.

Three-lines model: Allocation of ownership, oversight/challenge, and independent assurance.

Stress testing: Assessment of performance under adverse assumptions or scenarios.

Business continuity: Capability to continue or restore critical services after disruption.

Internal audit: Independent assurance on governance, risk management, and controls.

Systemic risk: Risk that distress spreads across the financial system.

Model risk: Risk of adverse consequences from incorrect or misused models.

Review Questions

Short Answer Questions

1. Define risk appetite and explain how it differs from risk capacity.
2. What is the difference between a periodic and cumulative liquidity gap?
3. Identify the three lines and state the main responsibility of each.
4. Distinguish LCR from NSFR.
5. Why does internal control provide reasonable rather than absolute assurance?

Long Answer Questions

1. Explain how credit, liquidity, market, operational, and cyber risks can reinforce one another.
2. Discuss the design of a bank’s risk appetite statement and limit framework.
3. Explain the role of stress testing, scenario analysis, and reverse stress testing.
4. Evaluate the contribution of internal audit to bank governance and risk management.
5. Discuss ethical and regulatory issues in conduct risk and AI-supported banking decisions.

Analytical / Application Questions

1. A bank expects inflows of $12 million and outflows of $17 million in month one, followed by inflows of $20 million and outflows of $14 million in month two. Calculate each periodic gap and the cumulative gap at the end of month two. Interpret the result.
2. A loan portfolio has EAD of $50 million, PD of 2.5%, and LGD of 45%. Calculate simplified expected loss and explain two reasons why actual loss may differ.
3. A bank has $240 million of eligible HQLA and $200 million of prescribed 30-day net cash outflows. Calculate its LCR and recommend two additional liquidity-management actions beyond observing the ratio.

Multiple Choice Questions with Answers

Question 1

A bank has EAD of $10 million, PD of 4%, and LGD of 50%. What is the simplified expected loss?

A. $20,000

B. $200,000

C. $500,000

D. $2,000,000

Correct Answer: B. $200,000

Question 2

Expected inflows in a week are $9 million and outflows are $13 million. What is the periodic liquidity gap for that week?

A. +$4 million

B. +$22 million

C. −$4 million

D. −$22 million

Correct Answer: C. −$4 million

Question 3

Periodic liquidity gaps are −$6 million in month one and +$2 million in month two. What is the cumulative gap at the end of month two?

A. −$8 million

B. −$4 million

C. +$4 million

D. +$8 million

Correct Answer: B. −$4 million

Question 4

A bank has HQLA of $180 million and prescribed 30-day net cash outflows of $150 million. Its LCR is:

A. 83.3%

B. 100%

C. 120%

D. 330%

Correct Answer: C. 120%

Question 5

Which measure primarily addresses structural funding resilience over an approximately one-year horizon?

A. NSFR

B. VaR

C. PD

D. Modified duration

Correct Answer: A. NSFR

Question 6

Under the three-lines model, which function provides independent, risk-based assurance?

A. Business operations

B. Internal audit

C. Treasury dealing

D. Sales management

Correct Answer: B. Internal audit

Question 7

A bond portfolio has market value $5 million and modified duration 3. If yield rises by 1%, the approximate value change is:

A. +$150,000

B. −$15,000

C. +$1,500,000

D. −$150,000

Correct Answer: D. −$150,000

Question 8

Which is a preventive control?

A. Post-event loss report

B. Customer complaint trend analysis

C. Segregation of duties before payment approval

D. Forensic investigation after fraud

Correct Answer: C. Segregation of duties before payment approval

Question 9

What is the principal purpose of reverse stress testing?

A. To calculate normal-period profitability

B. To identify scenarios that could cause a defined failure

C. To replace all regulatory capital calculations

D. To eliminate the need for internal audit

Correct Answer: B. To identify scenarios that could cause a defined failure

Question 10

Which statement about LCR and NSFR is correct?

A. Both measure only market-price volatility

B. LCR addresses short-term stressed liquidity, while NSFR addresses structural funding

C. NSFR is calculated as HQLA divided by 30-day outflows

D. LCR makes cash-flow forecasting unnecessary

Correct Answer: B. LCR addresses short-term stressed liquidity, while NSFR addresses structural funding