Best practice risk management for RI banks

Best practice risk management for RI banks

Anthony Brent Elam, Managing Director, Bank Central Asia, Jakarta

Since the Asian Economic Crisis in 1997, the banking industry
in Indonesia has undergone tremendous changes. The government has
played a significant role in prompting these changes and in
restructuring the banking industry by firstly, undertaking a
massive recapitalization program; secondly, restructuring and
rehabilitating the banks; and finally, undertaking privatization
of the rehabilitated banks.

Indonesian banks today, while having their loan portfolios
largely "cleaned up" (thanks to the government recapitalization
program) still face tremendous challenges. In Indonesia, the
banking system's loan to deposit ratio is low at about 38 percent
loans to deposits (loan to deposit ratio measures the amount of
outstanding loans granted by the bank compared to the amount of
third party funds received).

A large proportion of Indonesian banks' revenues today depend
on the recapitalization bonds which make up an average of about
45 percent of total banking assets as at December 2002. With
current central bank's one-month SBI promissory notes interest
rates declining to below 9 percent from an average of 13 percent
in 2002, banks have to adjust to a new environment.

To overcome this challenge, banks have to start rebuilding
their loan portfolios and decrease their reliance on
recapitalization bonds. This leads to a new challenge; in
increasing and rebuilding their lending businesses, banks must
ensure that they have proper risk management frameworks in place
to minimize the risk of a crisis similar to 1997 happening in the
future.

Based on international best practice, a bank's risk management
framework should cover the following key risk areas: Credit Risk,
Market Risk and Operational Risk. Credit Risk measures the
possibility that a borrower will default, by failing to repay its
loan in a timely manner.

Market Risk measures the risk that the bank faces on the value
of its investments due to economic changes or other events that
impact the market (e.g. interest rate risk and foreign exchange
risk).

Operational Risk measures the risk associated with the
potential for system failures in the bank or from external
factors, like human errors.

In Credit Risk Management, the two key fundamental principles
that banks put in place are the independence of credit decision
making from marketing and customer credit risk ratings.
Traditionally, banks in Indonesia are organized by business units
with each unit responsible for both the marketing as well as
credit approving functions.

This traditional setup can lead to conflicts of interest in
the loan decision process. In a booming economic cycle, these
risks usually go unnoticed as even highly risky ventures succeed
but in an economic downturn, these risky ventures are the first
ones to default.

To prevent potential conflicts of interest, it is necessary to
segregate the loan approving function from the marketing
function. Many international banks have a chief risk officer
(CRO) sitting on the board of directors and responsible for the
credit risk management function thereby ensuring the independence
of loan approving functions from marketing.

Another key principle is credit risk rating. Currently, most
Indonesian banks use Bank Indonesia's (BI) rating scale which is
mainly focused on categorizing non-performing loans. The BI
rating system has 5 grades comprising 1 grade for
performing/current loans and 4 grades for non-current loans. A
risk rating system allows banks to separate within the performing
loans the low risk customers from the middle risk and high risk
customers.

International banks have long been using credit risk rating
systems in helping them assess credit risks as well as making
credit decisions. These ratings are much like the risk ratings
carried out by independent rating agencies such as Standard &
Poor's and Moody's.

Credit risk rating systems enable banks to measure the risk
associated with making a loan to the borrower.

Secondly, the rating systems provide a standardized framework
for measuring credit risk and thereby ensuring consistent credit
quality.

Thirdly, the credit risk rating system allows the bank to
manage the risk profile of its loan portfolio according to its
risk appetite.

Finally, a credit risk rating system enables the bank to
determine the appropriate interest rate to charge its customer
thus ensuring an adequate return for the risk the bank is
undertaking.

Whilst the biggest area of risk faced by banks today is credit
risk and much attention has been given to this topic, the other
two risk areas of Market and Operational Risk are increasingly
becoming a significant area where banks should ensure proper risk
management systems are in place.

In Market Risk, the fundamental principle of having a market
risk unit independent from the business unit (or traders)
prevails. In recent years, a number of big international banks
have declared valuation losses on their trading portfolios and
investment holdings simply because the traders performed the
market valuations themselves and could hide losses.

Proper procedures and systems to accurately identify and
measure market risk are becoming increasingly important for
Indonesian banks to manage their existing trading portfolio and
to more fully participate in the increasing sophisticated markets
of the future.

With the reduction in supply of the recapitalization bonds and
the continued decline in interest rates on the SBIs and other
government bonds, banks are increasingly seeing their margins
decline.

With Bali and the Marriot Hotel bombings highlighting the
continued uncertainty and volatility of the market, coupled with
the need of the banks for alternative higher yielding
investments, there is a need for Indonesian banks to enhance
their market risk capabilities.

Implementing best practice market risk tools and
infrastructure will enable the banks to measure their market risk
profile and compare it to their over-all asset profile.

Operational Risk is fairly new thing for international banks
globally. The area of operational risk is also fairly wide and
sometimes loosely defined to encompass "any risk which is non-
credit and non-market risk related".

Examples of operational risks range from computer system
failures to human errors and abuses such as fraud (one of the
most infamous being the Barings downfall) and
external/environmental disasters such as earthquakes.

In order to manage operational risks, the first step a bank
should undertake is to have an independent risk management unit
set up to monitor such risk. The second step needed is to put in
place systems which are able to comprehensively capture, track
and monitor the various operational risks which a bank faces in a
given day.

The consequence of putting such systems in place is the
investment costs particularly for the smaller banks where there
are no economies of scale to be garnered from such expenditures.

The road ahead for Indonesian banks remain challenging. The
successful restructuring of Indonesia's banking system and on-
going privatization programs will play a critical role in the
recovery and continued growth of Indonesia's economy as well as
restoring investor confidence in Indonesia.

An important element to supporting the economic recovery is
the development of sound risk management practices and procedures
in the Indonesian banking system and as the first step in a
comprehensive financial safety net for the banking system.