Alert January 12, 2010

Banking Agencies Remind Depository Institutions of Supervisory Expectations with Respect to Interest Rate Risk Management

The federal banking agencies and the Federal Financial Institutions Examination Council’s State Liaison Committee (the “Agencies”) issued an advisory (the “Advisory”) which reminds federally insured depository institutions (“institutions”) of supervisory expectations regarding managing interest rate risk (“IRR”).  The Agencies issued the Advisory in part because the current economic environment  has exacted pressure on institutions’ earnings and the value of institutions’ securities portfolios.  The Advisory notes that while each of the Agencies has issued distinct guidance with regard to IRR management (such guidance is listed in the Advisory), supervisory expectations for IRR management are broadly consistent for all institutions.  The Advisory focuses on the importance, with respect to IRR management, of corporate governance, policies and procedures, risk measuring and monitoring systems, stress testing, and internal controls related to IRR exposures.  The Advisory also recognizes that some IRR is inherent to the business of banking.

With respect to corporate governance, the Advisory identifies the board of directors of an institution as having the ultimate responsibility for managing IRR.  The board of directors or a designated committee should oversee and annually review IRR management strategies, policies, procedures, and limits.  Senior management of an institution should implement board-approved strategies, policies, and procedures.  Additionally, management is responsible for managing IRR on a day to day basis, including staying within board‑approved tolerances and maintaining comprehensive systems for measuring IRR and detailed IRR reporting processes.  Finally, management and the board of directors are responsible for ensuring that the board of directors has access to both aggregate and sufficiently detailed information regarding IRR.

The Advisory states that institutions are expected to have IRR policies and procedures that integrate new strategies, products and businesses.  Such policies and procedures should govern all aspects of an institution’s IRR management process.  IRR tolerances articulated in such policies should be explicit and address the short-term and long-term perspective, and also address basis risk, yield curve risk, and the institution’s positions with explicit or embedded options.

The Advisory further notes that institutions are expected to have robust IRR measurement and monitoring processes and systems that are commensurate with the size and complexity of the institution.  Institutions may rely on third-party IRR models, so long as they thoroughly understand them.  Institutions may use a variety of techniques to measure IRR exposure.  The Agencies believe that while simple maturity gap analysis may be sufficient for some institutions, many institutions choose to use simulation modeling, which is now accessible to smaller and less complex institutions.  Institutions are encouraged to use the full complement of analytical capabilities of IRR simulation models.  IRR exposures are best projected over a two-year period; however, the Agencies suggest that longer time horizons, such as five to seven year time horizons, should also be analyzed.  Static or dynamic simulation models may be used.  The Agencies suggest that simulation models alone may be insufficient to evaluate IRR and suggest that economic value models also be used. 

The Advisory further states that measurement and monitoring should also include stress testing, which should include both scenario and sensitivity analysis.  Scenario analysis should include, as applicable, analysis of instantaneous and prolonged rate shocks, basis risk, and yield curve risk.  Sensitivity analysis should also be conducted to determine which assumptions have the most influence on IRR model outputs.  Finally, prudent IRR measurement and monitoring depends on sound and properly updated assumptions.

The Advisory also makes clear that risk mitigating steps are an important component of IRR management.  In particular, management should be able to easily identify when IRR limits are approached or exceeded and should take appropriate action.  The Agencies suggest that the most common way of addressing excessive IRR is through balance sheet adjustment.  However, hedging and other derivative-based strategies are also available.  Institutions that wish to use derivative strategies must have adequate knowledge of, and expertise in, using derivative instruments. 

Finally, the Advisory states that IRR models must be independently validated.  Validation is best performed through an independent review of the conceptual and logical soundness of the IRR model.  The results of such review should be available to relevant Agencies.  Smaller institutions that do not have the resources to staff an independent review function may rely on internal parties for such a review if such internal party is sufficiently removed from the IRR management process.  Alternatively, an external auditor may be used.  Institutions that use vendor-supplied IRR models are not required to test the mechanics and mathematics of such models, so long as the vendor supplies documentation for the program.  However, larger and more complex institutions may need to be more proactive in validating vendor-provided models, including the use of “benchmark” models to test the performance of vendor-provided IRR models.