Governance, Controls and Ethical Treasury Practice

Introduction

Treasury is a strategic function because it converts the bank’s balance sheet into funding, liquidity, market-risk and profitability decisions. Those decisions affect solvency, regulatory compliance, shareholder value, customers and the stability of the financial system. Consequently, Treasury and Asset Liability Management (ALM) cannot be governed merely through trading-room procedures or periodic management reports. They require an integrated framework of authority, risk appetite, limits, independent challenge, reliable data, model discipline and ethical conduct.

The Asset Liability Committee (ALCO) is normally the central management forum for this framework. It does not replace the board, executive management, risk management, internal audit or regulatory supervision. Rather, it connects them. Effective ALCO governance ensures that the bank’s strategic objectives—growth, profitability, liquidity resilience and capital preservation—are pursued within clearly approved constraints.

This chapter examines the design of ALCO governance, treasury policies, delegated authorities, limits, model validation, independent oversight, audit and reporting. It also considers conduct risk, conflicts of interest, market manipulation and regulatory compliance. The central argument is that governance is not a documentation exercise: it is a system for making responsible decisions under uncertainty.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Design an ALCO structure with appropriate board, management and control responsibilities.
2. Distinguish policies, procedures, limits, mandates and delegated authorities.
3. Construct a coherent limit framework for liquidity, interest-rate, foreign-exchange and investment risks.
4. Explain model-risk governance and the role of independent validation.
5. Evaluate the contribution of the second line of defence, internal audit and regulatory reporting.
6. Identify conduct risks, conflicts of interest and forms of market abuse in treasury activity.
7. Apply governance principles to an integrated treasury case.

1. The Governance Architecture of Treasury

1.1 Three lines of responsibility

A sound architecture separates business ownership from independent challenge and assurance.

The first line is accountable for the risks it takes; it cannot transfer accountability to the risk function merely by reporting a limit. The second line should not execute treasury transactions, because independence would be compromised. Internal audit should be sufficiently independent from both lines and report functionally to the audit committee or equivalent board committee.

1.2 Board and senior-management responsibilities

The board approves the bank’s risk appetite, capital and liquidity strategy, treasury policy and material risk limits. It should understand the implications of funding concentration, stress assumptions, interest-rate exposure, model uncertainty and contingent liabilities. Board approval is meaningful only when directors receive information that is timely, comprehensible and sufficiently challenging—not simply a large volume of dashboards.

Senior management translates board-approved appetite into business plans, limits, mandates and resources. The chief executive, chief financial officer, chief risk officer and treasurer have distinct responsibilities. The treasurer manages the balance sheet within approved constraints; the chief risk officer independently assesses whether those constraints remain appropriate; and the finance function ensures that valuation, accounting and performance measurement are reliable.

1.3 ALCO composition and mandate

ALCO commonly includes the chief executive or a delegated senior executive, treasurer, chief risk officer, chief financial officer, heads of business lines, and representatives from finance, risk, compliance and economics. Membership should be senior enough to resolve trade-offs. A committee that merely receives information without decision rights is not effective governance.

An ALCO charter should specify:

• purpose, authority and reporting line;
• membership, chairing arrangements and quorum;
• frequency of meetings and circumstances requiring an extraordinary meeting;
• matters reserved for ALCO and matters escalated to the board;
• voting, dissent and conflict-of-interest procedures;
• required information and minimum reporting standards;
• minutes, action ownership and deadlines; and
• escalation requirements for breaches and emerging risks.

ALCO should review structural liquidity, funding plans, interest-rate risk in the banking book, foreign-exchange exposure, investment portfolios, transfer pricing, capital implications, stress tests, model assumptions and remediation actions. It should not become a forum for approving individual trades that ought to be controlled through delegated mandates.

2. From Risk Appetite to Operating Limits

2.1 The hierarchy of control documents

Governance documents operate at different levels:

1. Risk appetite statement: the amount and type of risk the bank is willing to accept in pursuit of objectives.
2. Policy: mandatory principles approved by the board or an authorised committee.
3. Standard: detailed control expectations, such as valuation independence or collateral eligibility.
4. Limit: a measurable boundary, such as a maximum maturity mismatch or stop-loss amount.
5. Mandate: permitted activities, instruments, currencies, counterparties and markets.
6. Procedure: operational steps for executing and monitoring approved activities.
7. Methodology: technical specifications for measurement, modelling, stress testing or valuation.

A policy should not be so detailed that it becomes obsolete whenever a product changes. Conversely, a limit should not be so vague that compliance cannot be determined objectively.

2.2 Designing effective limits

A limit should have a defined risk concept, measurement basis, owner, frequency, threshold, breach action and escalation recipient. For example, “manage liquidity prudently” is an objective but not an operational limit. “Maintain a minimum survival horizon of 30 days under the approved combined stress scenario” is measurable, although the scenario and measurement methodology must also be documented.

Limits should be calibrated to risk appetite, not simply copied from historical practice. They should consider risk aggregation, diversification benefits, non-linear exposures, data quality and the speed with which a position can be reduced. A limit that appears large in normal markets may be inadequate during a stressed market when liquidity disappears.

Important treasury limits include:

• Liquidity limits: minimum liquidity buffers, survival horizons, cumulative cash-flow gaps, wholesale-funding concentration and collateral encumbrance.
• Interest-rate limits: economic-value sensitivity, earnings sensitivity, duration, basis risk, repricing gaps and option risk.
• Market-risk limits: value-at-risk where appropriate, stress losses, sensitivity limits, position limits and stop-loss limits.
• Foreign-exchange limits: open currency positions, overnight positions, settlement exposure and currency-specific limits.
• Counterparty limits: exposure by institution, parent group, product, tenor, rating and collateral type.
• Investment limits: issuer, sector, rating, maturity, country, concentration and instrument eligibility.
• Operational limits: payment authority, manual adjustments, system access and segregation of duties.

A limit framework should combine hard limits with early-warning triggers. A hard limit defines the maximum permitted exposure. An early-warning trigger prompts management action before the hard limit is reached. For example, a 90% utilisation trigger may require a funding review even though the formal limit is not breached.

2.3 Quantitative measures and assumptions

A simple cumulative liquidity gap for time bucket t can be expressed as:

where I_t is expected inflow during bucket t, O_t is expected outflow, and G_t is the net cash-flow gap. A cumulative gap through bucket T is:

The units are monetary units, such as millions of currency units. The measure is useful only when inflows and outflows are classified consistently by contractual or behavioural maturity. It does not by itself measure liquidity sufficiency, because it excludes the quality and availability of liquid assets, market access, collateral and stress assumptions.

For an interest-rate position, a simplified change in economic value may be approximated by:

where ∆V is the approximate change in market value, D is modified duration in years, V is the current market value, and ∆y is the change in yield expressed as a decimal. The approximation assumes a small, parallel yield movement and ignores convexity, credit-spread changes, basis risk and embedded options. For larger or non-parallel movements, full revaluation or a duration-convexity approach is more appropriate.

For example, if a bond portfolio has value 100 million, modified duration 4 years and yields rise by 0.50% (0.005), then:

The estimated loss is 2 million currency units. This is a sensitivity, not a guaranteed outcome. Governance should ensure that users understand its limitations before it becomes a reported “forecast.”

2.4 Limit breaches and exceptions

A breach should be treated as an event requiring investigation, not as a routine administrative inconvenience. The process should identify the time and cause of breach, quantify exposure, determine whether the breach arose from market movement, transaction, data error or model error, and prescribe immediate containment. A temporary limit excess should require documented approval from an authorised person and a credible remediation date. Repeated “temporary” exceptions indicate defective limits, inadequate resources or poor conduct.

No employee should be able to approve an exception to a limit that they personally exceeded. Material breaches should be reported promptly to the chief risk officer, ALCO chair and relevant board committee, subject to applicable regulation.

3. Delegation, Segregation and Control Design

Delegation should be explicit, risk-sensitive and time-bounded. A mandate may specify that a dealer can transact only approved instruments, currencies, maturities and counterparties within a notional and sensitivity limit. Delegation should also identify who may approve new products, override a valuation, alter a model parameter, release a payment or communicate with a regulator.

The following segregation principles are fundamental:

• front office originates and executes transactions;
• middle office independently confirms trades, measures risk and monitors limits;
• back office settles transactions, reconciles positions and controls static data;
• finance controls accounting treatment and independent price verification where appropriate;
• compliance monitors conduct and regulatory obligations; and
• internal audit independently evaluates the whole framework.

Access controls should follow least privilege. A person who creates a transaction should not be able to confirm, settle and reconcile it without independent review. Generic user IDs, shared passwords, unrestricted spreadsheet access and unlogged manual adjustments are control weaknesses.

New products require a formal approval process covering legal enforceability, liquidity, valuation, accounting, tax, capital, operational capacity, technology, conduct and exit strategy. Revenue opportunity is not a sufficient justification for product approval.

4. Model Risk and Independent Validation

Treasury decisions rely on models for behavioural deposits, prepayments, cash-flow forecasting, liquidity stress, interest-rate sensitivity, valuation, transfer pricing and capital allocation. Model risk is the possibility that a model is unsuitable, incorrectly implemented, based on poor data or misused by decision-makers.

A model governance framework should include:

1. a complete model inventory and risk classification;
2. documented purpose, scope, assumptions and limitations;
3. independent development or review controls;
4. conceptual soundness assessment;
5. verification of implementation, data and calculations;
6. outcome analysis, back-testing or benchmarking where applicable;
7. sensitivity and stress analysis;
8. approval before production use;
9. version control and change management;
10. periodic validation and monitoring; and
11. retirement procedures when a model is no longer suitable.

Validation must be independent of the model owner and, ideally, sufficiently independent of the developers. Independence does not mean that validators lack subject-matter expertise; it means that they have authority to challenge assumptions and report unresolved concerns without commercial retaliation.

Behavioural models require particular care. A non-maturity deposit may have no contractual maturity but can display stable historical behaviour. Stability inferred from a benign period may disappear during stress. Therefore, behavioural assumptions should be segmented, regularly monitored, subjected to adverse scenarios and supplemented by management overlays where justified. Overlays should be documented rather than used as unexplained adjustments to achieve a desired result.

Model outputs should never be treated as objective facts. A risk report should distinguish observed data, estimated parameters, assumptions, scenario results and management judgement. Where model uncertainty is material, governance may impose a model-risk buffer, conservative parameter, exposure limit or use restriction.

5. Independent Risk Oversight, Compliance and Audit

The second line establishes risk measurement standards, challenges first-line decisions, monitors limits and escalates concerns. It should have access to systems, data, traders, committee papers and senior management. Its effectiveness depends on expertise, resources and independence from revenue targets.

Compliance focuses on legal and regulatory obligations, including market conduct, insider information, sanctions, anti-money-laundering controls, transaction reporting, benchmark rules, record retention and personal-account dealing. Compliance should be involved in product design and surveillance, not only consulted after an incident.

Internal audit assesses whether the framework is designed appropriately and operates effectively. A treasury audit may test:

• ALCO minutes and evidence of challenge;
• board-approved policies and current limits;
• trade capture, confirmation and settlement;
• valuation and independent price verification;
• limit monitoring and breach escalation;
• liquidity and interest-rate stress testing;
• model inventories and validation reports;
• access controls and change management;
• regulatory submissions; and
• remediation of earlier findings.

Audit findings should be graded by risk, assigned accountable owners and tracked to closure. A finding is not closed merely because a new policy has been issued; evidence must show that the control operates consistently.

6. Reporting and Management Information

Effective reporting is decision-oriented. A treasury dashboard should enable recipients to answer: What has changed? Why has it changed? Is the change within appetite? What could happen under stress? Who must act and by when?

A useful ALCO pack normally includes:

• liquidity position, buffer composition and survival horizon;
• funding profile, maturity concentration and refinancing needs;
• contractual and behavioural cash-flow gaps;
• interest-rate and basis sensitivities;
• foreign-exchange and investment exposures;
• counterparty concentrations and collateral;
• stress-test results and reverse-stress indicators;
• limit utilisation, breaches and exceptions;
• model changes and validation status;
• profitability, transfer pricing and capital implications; and
• emerging risks, regulatory developments and action tracking.

Reports should state data date, production date, methodology, coverage, exclusions and material limitations. Reconciliations between risk, finance and general-ledger data are essential. A polished dashboard containing stale or unreconciled data is more dangerous than an obviously incomplete report because it creates false confidence.

7. Ethical Treasury Practice and Conduct Risk

Conduct risk is the possibility that behaviour produces unfair outcomes for customers, market participants, the institution or the financial system. In treasury, ethical risk may arise even where an action is not clearly prohibited by a rule. A narrow focus on legality can therefore be inadequate.

7.1 Conflicts of interest

Conflicts may arise when an employee’s remuneration depends on short-term trading revenue, when the bank trades before executing a customer transaction, when a treasury employee has a personal investment in a counterparty, or when a valuation affects both performance pay and financial reporting. Controls include disclosure, recusals, restricted lists, information barriers, independent valuation and remuneration structures that incorporate risk-adjusted and deferred outcomes.

7.2 Manipulation and misuse of information

Potential misconduct includes spoofing, layering, wash trades, marking the close, benchmark manipulation, collusion, misuse of confidential customer information and misleading communications. A transaction can be economically small yet strategically important if it influences a benchmark, valuation or reported performance.

Surveillance should combine automated alerts with human investigation. Alerts may examine unusual order cancellation, end-of-day price movements, concentrated activity around benchmark windows, communications patterns and transactions inconsistent with stated strategy. An alert is not proof of misconduct; investigators need context, records and a documented conclusion.

Employees should be trained to escalate suspicious activity without first seeking permission from the person whose conduct is questioned. Whistleblowing channels should protect confidentiality and prohibit retaliation. Ethical culture is reinforced when senior employees are subject to the same controls as junior staff and when commercial success does not excuse misconduct.

7.3 Regulatory compliance as a management responsibility

Compliance with prudential and market-conduct regulation should be integrated into strategic decisions. Relevant obligations vary by jurisdiction but commonly concern liquidity and capital adequacy, large exposures, market abuse, sanctions, anti-money laundering, derivatives reporting, benchmark administration, accounting, disclosure and data protection. The bank should maintain a regulatory obligations register, assign owners, monitor changes and retain evidence of compliance.

Regulatory reporting requires special attention because definitions may differ from internal management measures. Reconciliation controls, maker-checker review, sign-off and documented judgement are necessary. Deliberately classifying assets or transactions to obtain a favourable regulatory result is a serious ethical and governance failure even if a technical ambiguity exists.

8. Technology, Data and Artificial Intelligence

Treasury control increasingly depends on integrated data platforms, automated limit monitoring, application programming interfaces and analytics. These technologies can reduce manual error, but they also create concentration, cyber, model and third-party risks.

Controls should address data lineage, completeness, timeliness, access, encryption, resilience and change approval. A limit engine should be tested for missing trades, duplicate records, stale market data and incorrect aggregation. Manual overrides should be rare, authorised, logged and independently reviewed.

Artificial intelligence may assist with anomaly detection, cash-flow forecasting and surveillance. However, AI outputs may be opaque, unstable under changing market conditions or biased by historical data. AI should therefore be governed as a model or decision-support tool: its purpose, training data, validation, human review, performance thresholds and failure response should be documented. It should not autonomously override approved limits or obscure accountability.

9. Illustrative Case: The Rapid-Growth Bank

Background. Meridian Bank, a fictional regional bank, expanded its corporate lending rapidly. To fund growth, Treasury increased reliance on short-term wholesale deposits and invested surplus cash in longer-duration securities. ALCO met monthly, but its papers were distributed late and limit exceptions were reported only after month-end.

Problem. When market yields rose and wholesale funding became more expensive, the bank experienced three pressures: the securities portfolio recorded losses, deposit runoff exceeded the behavioural model assumption, and a dealer exceeded a foreign-exchange limit while hedging a customer-related position. The dealer’s manager informally approved the excess, believing it would be reversed quickly.

Analysis. The bank’s governance failure was not one isolated breach. The board risk appetite did not specify funding concentration or survival horizon. ALCO lacked a clear escalation mandate. The behavioural deposit model had been validated during a stable period and had no severe runoff scenario. The middle office reported limit utilisation but did not have authority to stop trading. Incentives rewarded loan growth and quarterly income, while liquidity resilience and control quality were not included in performance assessment. Finally, the foreign-exchange exception was not independently documented.

Approach. The bank adopted a remediation programme:

• the board approved explicit liquidity, concentration and interest-rate limits;
• ALCO became a weekly decision forum during the remediation period;
• hard limits and early-warning triggers were separated;
• the middle office received authority to escalate immediately and block unauthorised transactions;
• the deposit model was revalidated using stressed periods and segmented assumptions;
• a contingency funding plan was linked to observable triggers;
• all exceptions required written approval, expiry dates and independent reporting;
• dealer remuneration incorporated risk-adjusted, deferred outcomes;
• treasury, finance and risk data were reconciled daily; and
• internal audit performed a follow-up review after six months.

Outcome. Meridian restored its liquidity buffer, reduced short-term funding concentration and closed the foreign-exchange control weakness. More importantly, ALCO began discussing strategic trade-offs rather than merely reviewing historical figures. The case illustrates that limits, models and committees are effective only when authority, information and incentives reinforce one another.

Learning points. First, rapid balance-sheet growth must be matched by governance capacity. Second, a model validated in normal conditions cannot be assumed reliable in stress. Third, a limit without immediate escalation and enforcement is a target, not a control. Fourth, remuneration is part of risk governance because it shapes behaviour.

10. Challenges and Best Practices

Governance systems face several persistent challenges. Complex products make exposures difficult to aggregate. Data may be fragmented across legacy systems. Independent control functions may struggle to recruit specialists. Excessive committees can delay action, while insufficient challenge permits unchecked risk-taking. Regulatory requirements may differ across jurisdictions, and climate, cyber and geopolitical events can invalidate historical assumptions.

Best practice is therefore conditional rather than cosmetic. The bank should maintain a clear risk taxonomy, use forward-looking stress tests, document judgement, reconcile data, test escalation channels, rotate independent reviewers where appropriate, and conduct periodic board education. It should also perform reverse stress testing: identify conditions that would make the business model or liquidity plan fail, then assess whether indicators and contingency actions would activate in time.

A mature framework treats near misses as valuable evidence. A payment almost made to the wrong counterparty, an unexplained valuation adjustment or a late limit report may reveal a systemic weakness before it becomes a loss. Reporting such events should be encouraged, investigated and used for control improvement rather than automatically punished.

Chapter Summary

Treasury governance aligns balance-sheet strategy with approved risk appetite. ALCO is the principal management forum, but its effectiveness depends on clear board oversight, capable first-line ownership, independent second-line challenge and robust internal audit. Policies establish principles; mandates and limits convert them into operating boundaries; procedures and systems enforce them.

Liquidity, interest-rate, market, foreign-exchange, counterparty and operational limits should be measurable, risk-sensitive and supported by early-warning triggers. Breaches require prompt escalation, documented remediation and independent reporting. Model governance must address conceptual soundness, data, implementation, validation, uncertainty and change control. Reports should be timely, reconciled and designed to support decisions.

Ethical treasury practice extends beyond technical compliance. Conflicts of interest, manipulation, misuse of information, distorted incentives and retaliation against whistleblowers can undermine both market integrity and institutional resilience. Technology and AI can strengthen monitoring but introduce data, cyber and model risks. Ultimately, governance succeeds when authority, information, incentives and accountability point in the same direction.

Key Terms

Risk appetite: The level and types of risk an institution is willing to accept in pursuit of its objectives.

ALCO: The management committee responsible for coordinating balance-sheet, liquidity, market-risk and funding decisions.

Limit: A measurable boundary placed on an exposure, activity or risk measure.

Mandate: A formal statement of permitted activities, instruments, counterparties, currencies and authorities.

Early-warning trigger: A threshold that prompts management action before a formal limit is breached.

Liquidity gap: The difference between expected cash inflows and outflows over a specified period.

Survival horizon: The period for which a bank can meet obligations under a defined stress scenario.

Segregation of duties: Separation of incompatible activities among different individuals or functions.

Independent price verification: Valuation review performed separately from the transaction originator.

Model risk: Risk arising from inappropriate models, errors, poor data, misuse or misunderstood assumptions.

Model validation: Independent assessment of a model’s conceptual soundness, implementation and performance.

Second line of defence: Risk and compliance functions that set standards, monitor and challenge the first line.

Internal audit: An independent assurance function evaluating governance, risk management and controls.

Conduct risk: The risk of harm arising from inappropriate behaviour or unfair outcomes.

Conflict of interest: A situation in which personal or competing institutional interests may impair objective judgement.

Market manipulation: Conduct intended to distort prices, benchmarks, market activity or perceptions.

Regulatory reporting: Submission of required information to supervisory or governmental authorities.

Data lineage: The documented path through which data is created, transformed, aggregated and reported.

Reverse stress test: An analysis that begins with a failure outcome and identifies the conditions that could cause it.

Review Questions

Short Answer Questions

1. What are the principal responsibilities of ALCO?
2. Distinguish a risk appetite statement, a policy, a limit and a procedure.
3. Why must the middle office be independent of the front office?
4. State two limitations of the duration-based interest-rate sensitivity approximation.
5. What is model risk, and why is independent validation necessary?

Long Answer Questions

1. Explain how the board, senior management, ALCO, risk function, compliance and internal audit should interact in a treasury governance architecture.
2. Design a limit framework covering liquidity, interest-rate, foreign-exchange and counterparty risks. Explain the role of early-warning triggers.
3. Discuss the complete lifecycle of a treasury model, from development and approval to validation, monitoring and retirement.
4. Analyse how remuneration, information barriers and surveillance can reduce conduct risk in treasury.
5. Evaluate the strengths and weaknesses of using automated systems and artificial intelligence in treasury control.

Analytical / Application Questions

1. A bank has a 100 million bond portfolio with modified duration of 4 years. Estimate the change in value if yields rise by 0.50%, assuming a small parallel shift and ignoring convexity. Explain why the result should not be interpreted as a precise forecast.
2. A dealer exceeds a foreign-exchange limit near the end of the reporting period and claims that the position will be reversed the next morning. What governance, conduct and escalation issues should the bank examine?
3. A behavioural deposit model was validated during a decade of stable funding conditions. Develop a governance response for a bank that now faces rapid deposit outflows and stressed wholesale markets.

Multiple Choice Questions with Answers

Question 1

Which function is primarily responsible for independently challenging treasury risk-taking?

A. Front office

B. Second-line risk management

C. Back office settlement

D. Investor relations

Correct Answer: B. Second-line risk management

Question 2

Which document normally states the amount and type of risk the bank is willing to accept?

A. Risk appetite statement

B. Settlement instruction

C. Trade confirmation

D. Audit working paper

Correct Answer: A. Risk appetite statement

Question 3

A liquidity gap for a time bucket is calculated as:

A. Outflows minus capital

B. Inflows minus outflows

C. Assets minus equity only

D. Revenue minus expenses

Correct Answer: B. Inflows minus outflows

Question 4

Using ∆V ≈ −D × V × ∆y, what is the approximate loss on a 100 million portfolio with duration 4 when yield rises by 0.50%?

A. 0.2 million

B. 2 million

C. 20 million

D. 200 million

Correct Answer: B. 2 million

Question 5

Which is a key requirement for independent model validation?

A. The validator must be rewarded for model-generated revenue

B. The validator must be able to challenge assumptions independently

C. The validator must be the original model developer

D. The validator may omit limitations from reports

Correct Answer: B. The validator must be able to challenge assumptions independently

Question 6

What is the primary purpose of an early-warning trigger?

A. To replace every hard limit

B. To prompt action before a formal limit breach

C. To conceal limit utilisation

D. To authorise unaudited transactions

Correct Answer: B. To prompt action before a formal limit breach

Question 7

Which arrangement best demonstrates segregation of duties?

A. One dealer executes and settles every trade

B. The trader approves their own valuation override

C. Front office executes while back office settles and reconciles

D. The risk function receives no transaction data

Correct Answer: C. Front office executes while back office settles and reconciles

Question 8

Which behaviour is most clearly associated with market manipulation?

A. Independent price verification

B. Spoofing designed to create a misleading market impression

C. Documented stress testing

D. Prompt breach escalation

Correct Answer: B. Spoofing designed to create a misleading market impression

Question 9

Why should a behavioural deposit model be tested under stress?

A. Historical stability may not persist during adverse conditions

B. Stress testing eliminates all uncertainty

C. Contractual maturity is always known

D. It makes independent validation unnecessary

Correct Answer: A. Historical stability may not persist during adverse conditions

Question 10

Which statement best describes internal audit’s role?

A. It executes daily treasury trades

B. It sets dealer prices

C. It provides independent assurance over governance and controls

D. It replaces the board’s risk appetite

Correct Answer: C. It provides independent assurance over governance and controls