Best practice risk management for RI banks

Anthony Brent Elam, Managing Director, Bank Central Asia, Jakarta

Since the Asian Economic Crisis in 1997, the banking industry in Indonesia has undergone tremendous changes. The government has played a significant role in prompting these changes and in restructuring the banking industry by firstly, undertaking a massive recapitalization program; secondly, restructuring and rehabilitating the banks; and finally, undertaking privatization of the rehabilitated banks.

Indonesian banks today, while having their loan portfolios largely "cleaned up" (thanks to the government recapitalization program) still face tremendous challenges. In Indonesia, the banking system's loan to deposit ratio is low at about 38 percent loans to deposits (loan to deposit ratio measures the amount of outstanding loans granted by the bank compared to the amount of third party funds received).

A large proportion of Indonesian banks' revenues today depend on the recapitalization bonds which make up an average of about 45 percent of total banking assets as at December 2002. With current central bank's one-month SBI promissory notes interest rates declining to below 9 percent from an average of 13 percent in 2002, banks have to adjust to a new environment.

To overcome this challenge, banks have to start rebuilding their loan portfolios and decrease their reliance on recapitalization bonds. This leads to a new challenge; in increasing and rebuilding their lending businesses, banks must ensure that they have proper risk management frameworks in place to minimize the risk of a crisis similar to 1997 happening in the future.

Based on international best practice, a bank's risk management framework should cover the following key risk areas: Credit Risk, Market Risk and Operational Risk. Credit Risk measures the possibility that a borrower will default, by failing to repay its loan in a timely manner.

Market Risk measures the risk that the bank faces on the value of its investments due to economic changes or other events that impact the market (e.g. interest rate risk and foreign exchange risk).

Operational Risk measures the risk associated with the potential for system failures in the bank or from external factors, like human errors.

In Credit Risk Management, the two key fundamental principles that banks put in place are the independence of credit decision making from marketing and customer credit risk ratings. Traditionally, banks in Indonesia are organized by business units with each unit responsible for both the marketing as well as credit approving functions.

This traditional setup can lead to conflicts of interest in the loan decision process. In a booming economic cycle, these risks usually go unnoticed as even highly risky ventures succeed but in an economic downturn, these risky ventures are the first ones to default.

To prevent potential conflicts of interest, it is necessary to segregate the loan approving function from the marketing function. Many international banks have a chief risk officer (CRO) sitting on the board of directors and responsible for the credit risk management function thereby ensuring the independence of loan approving functions from marketing.

Another key principle is credit risk rating. Currently, most Indonesian banks use Bank Indonesia's (BI) rating scale which is mainly focused on categorizing non-performing loans. The BI rating system has 5 grades comprising 1 grade for performing/current loans and 4 grades for non-current loans. A risk rating system allows banks to separate within the performing loans the low risk customers from the middle risk and high risk customers.

International banks have long been using credit risk rating systems in helping them assess credit risks as well as making credit decisions. These ratings are much like the risk ratings carried out by independent rating agencies such as Standard & Poor's and Moody's.

Credit risk rating systems enable banks to measure the risk associated with making a loan to the borrower.

Secondly, the rating systems provide a standardized framework for measuring credit risk and thereby ensuring consistent credit quality.

Thirdly, the credit risk rating system allows the bank to manage the risk profile of its loan portfolio according to its risk appetite.

Finally, a credit risk rating system enables the bank to determine the appropriate interest rate to charge its customer thus ensuring an adequate return for the risk the bank is undertaking.

Whilst the biggest area of risk faced by banks today is credit risk and much attention has been given to this topic, the other two risk areas of Market and Operational Risk are increasingly becoming a significant area where banks should ensure proper risk management systems are in place.

In Market Risk, the fundamental principle of having a market risk unit independent from the business unit (or traders) prevails. In recent years, a number of big international banks have declared valuation losses on their trading portfolios and investment holdings simply because the traders performed the market valuations themselves and could hide losses.

Proper procedures and systems to accurately identify and measure market risk are becoming increasingly important for Indonesian banks to manage their existing trading portfolio and to more fully participate in the increasing sophisticated markets of the future.

With the reduction in supply of the recapitalization bonds and the continued decline in interest rates on the SBIs and other government bonds, banks are increasingly seeing their margins decline.

With Bali and the Marriot Hotel bombings highlighting the continued uncertainty and volatility of the market, coupled with the need of the banks for alternative higher yielding investments, there is a need for Indonesian banks to enhance their market risk capabilities.

Implementing best practice market risk tools and infrastructure will enable the banks to measure their market risk profile and compare it to their over-all asset profile.

Operational Risk is fairly new thing for international banks globally. The area of operational risk is also fairly wide and sometimes loosely defined to encompass "any risk which is non- credit and non-market risk related".

Examples of operational risks range from computer system failures to human errors and abuses such as fraud (one of the most infamous being the Barings downfall) and external/environmental disasters such as earthquakes.

In order to manage operational risks, the first step a bank should undertake is to have an independent risk management unit set up to monitor such risk. The second step needed is to put in place systems which are able to comprehensively capture, track and monitor the various operational risks which a bank faces in a given day.

The consequence of putting such systems in place is the investment costs particularly for the smaller banks where there are no economies of scale to be garnered from such expenditures.

The road ahead for Indonesian banks remain challenging. The successful restructuring of Indonesia's banking system and on- going privatization programs will play a critical role in the recovery and continued growth of Indonesia's economy as well as restoring investor confidence in Indonesia.

An important element to supporting the economic recovery is the development of sound risk management practices and procedures in the Indonesian banking system and as the first step in a comprehensive financial safety net for the banking system.