Basel Committee on Banking Supervision

Effective corporate governance is critical to the proper functioning of the banking sector and the economy as a whole. Governance weaknesses at banks that play a significant role in the financial system can result in the transmission of problems across the banking sector and broader economy.

Corporate governance determines the allocation of authority and responsibilities by which the business and affairs of a bank are carried out by its board and senior management, including how they:

1. set the bank’s strategy and objectives;
2. select and oversee personnel;
3. operate the bank’s business on a day-to-day basis;
4. protect the interests of depositors, meet shareholder obligations, and consider the interests of other recognised stakeholders;
5. align corporate culture, corporate activities and behaviour with the expectation that the bank will operate in a safe and sound manner, with integrity and in compliance with applicable laws and regulations; and
6. establish control functions.

The primary objective of corporate governance should be safeguarding stakeholders’ interest in conformity with public interest on a sustainable basis. Among stakeholders, particularly with respect to retail banks, shareholders’ interest would be secondary to depositors' interest.

Supervisors have a keen interest in sound corporate governance, as it is an essential element in the safe and sound functioning of a bank and may adversely affect the bank’s risk profile if not operating effectively. Well governed banks contribute to the maintenance of an efficient and cost-effective supervisory process.

Sound corporate governance may permit the supervisor to place more reliance on the bank’s internal processes. In this regard, supervisory experience underscores the importance of having the appropriate levels of authority, responsibility, accountability, and checks and balances within each bank, including those of the board of directors but also of senior management and the risk, compliance and internal audit functions.

The following terms are used throughout this chapter and have the meaning given below:1

1. Bank or banking organisation: refers to a bank, bank holding company or other company considered by banking supervisors to be the parent of a banking group under applicable national law as determined to be appropriate by the entity’s national supervisor.
2. Board of directors, board: is the body that supervises management. The structure of the board differs among countries. The use of “board” throughout this paper encompasses the different national models that exist and should be interpreted in accordance with applicable law within each jurisdiction. See also CGO10.10.
3. Conduct risk: Among their other responsibilities, board members and senior management are expected to define conduct risk based on the context of the bank’s business. Cases of misconduct have been identified as stemming from:
   1. the mis-selling of financial products to retail and business clients;
   2. the violation of national and international rules (tax rules, anti-money laundering rules, anti- terrorism rules, economic sanctions, etc); and
   3. the manipulation of financial markets – for instance, the manipulation of benchmark rates and foreign exchange rates.
4. Control functions: refers to those functions that have a responsibility independent from management to provide objective assessment, reporting and/or assurance. This includes the risk management function, the compliance function and the internal audit function.
5. Corporate governance: is a set of relationships between a company’s management, its board, its shareholders and other stakeholders which provides the structure through which the objectives of the company are set, and the means of attaining those objectives and monitoring performance. It helps define the way authority and responsibility are allocated and how corporate decisions are made.
6. Duty of care: is the duty of board members to decide and act on an informed and prudent basis with respect to the bank. Often interpreted as requiring board members to approach the affairs of the company the same way that a “prudent person” would approach his or her own affairs.
7. Duty of loyalty: is the duty of board members to act in good faith in the interest of the company. The duty of loyalty should prevent individual board members from acting in their own interest, or the interest of another individual or group, at the expense of the company and shareholders.
8. Executive director: is in jurisdictions where this is permitted, a member of the board (eg director) who also has management responsibilities within the bank. A non-executive director is a member of the board who does not have management responsibilities within the bank.
9. Independent director: refers to a non-executive member of the board who does not have any management responsibilities within the bank and is not under any other undue influence, internal or external, political or ownership, that would impede the board member’s exercise of objective judgment.
10. Internal control system: is a set of rules and controls governing the bank’s organisational and operational structure, including reporting processes, and functions for risk management, compliance and internal audit.
11. Risk appetite: is the aggregate level and types of risk a bank is willing to assume, decided in advance and within its risk capacity, to achieve its strategic objectives and business plan.
12. Risk appetite framework (RAF): is the overall approach, including policies, processes, controls and systems, through which risk appetite is established, communicated and monitored. It includes a risk appetite statement, risk limits and an outline of the roles and responsibilities of those overseeing the implementation and monitoring of the RAF. The RAF should consider material risks to the bank, as well as to its reputation vis-à-vis policyholders, depositors, investors and customers. The RAF aligns with the bank’s strategy.
13. Risk appetite statement (RAS): is the written articulation of the aggregate level and types of risk that a bank will accept, or avoid, to achieve its business objectives. It includes quantitative measures expressed relative to earnings, capital, risk measures, liquidity and other relevant measures as appropriate. It should also include qualitative statements to address reputation and conduct risks as well as money laundering and unethical practices.
14. Risk capacity: is the maximum amount of risk a bank can assume given its capital base, risk management and control capabilities as well as its regulatory constraints.
15. Risk culture: refers to a bank’s norms, attitudes and behaviours related to risk awareness, risk-taking and risk management, and controls that shape decisions on risks. Risk culture influences the decisions of management and employees during the day-to-day activities and has an impact on the risks they assume.
16. Risk governance framework: is, as part of the overall corporate governance framework, the framework through which the board and management establish and make decisions about the bank’s strategy and risk approach; articulate and monitor adherence to risk appetite and risk limits vis-à-vis the bank’s strategy; and identify, measure, manage and control risks.
17. Risk limits: are specific quantitative measures or limits based on, for example, forward-looking assumptions that allocate the bank’s aggregate risk to business lines, legal entities as relevant, specific risk categories, concentrations and, as appropriate, other measures.
18. Risk management: refers to the processes established to ensure that all material risks and associated risk concentrations are identified, measured, limited, controlled, mitigated and reported on a timely and comprehensive basis.
19. Risk profile: refers to point-in-time assessment of a bank’s gross risk exposures (ie before the application of any mitigants) or, as appropriate, net risk exposures (ie after considering mitigants) aggregated within and across each relevant risk category based on current or forward-looking assumptions.
20. Senior management: is sometimes called the executive committee, the executive board or the management board. See also CGO10.10.
21. “Three lines of defence” model: a key part of the governance framework is to identify the responsibilities of different parts of the organisation for addressing and managing risk. The is often referred to as the “three lines of defence” model. The business line – the first line of defence – has “ownership” of risk, whereby it acknowledges and manages the risk that it incurs in conducting its activities. The risk management function is responsible for further identifying, measuring, monitoring and reporting risk on an enterprise-wide basis as part of the second line of defence, independently from the first line of defence. The compliance function, which is responsible for managing legal risk stemming from non-compliance events, is also deemed part of the second line of defence. The internal audit function is charged with the third line of defence, conducting risk-based and general audits and reviews to provide assurance to the board that the overall governance framework, including the risk governance framework, is effective and that policies and processes are in place and consistently applied.

This chapter is intended to guide the actions of board members, senior managers, control function heads and supervisors of a diverse range of banks in a number of countries with varying legal and regulatory systems, including both Committee member and non-member jurisdictions.2 There are significant differences in the legislative and regulatory frameworks across countries which may restrict the application of certain principles or provisions. Each jurisdiction should apply the provisions as the national authorities see fit. In some cases, this may involve legal change. In other cases, a principle may require slight modification to be implemented.

The principles set forth in this document are relevant regardless of whether or not a jurisdiction chooses to implement the Basel Framework. The board and senior management at each bank have an obligation to pursue good governance.3

The implementation of these principles should be commensurate with the size, complexity, structure, economic significance, risk profile and business model of the bank and the group (if any) to which it belongs. This means making reasonable adjustments where appropriate for banks with lower risk profiles, and being alert to the higher risks that may accompany more complex and publicly listed institutions.4,5 Systemically important financial institutions (SIFIs) are expected to implement corporate governance structures and practices commensurate with their role in and potential impact on national and global financial stability.

This chapter refers to a governance structure composed of a board of directors and senior management. Some countries use a formal two-tier structure, where the supervisory function of the board is performed by a separate entity known as a supervisory board or audit and supervisory board, which has no executive functions. Other countries use a one-tier structure in which the board of directors has a broader role. Still other countries have moved or are moving to a mixed approach that discourages or prohibits executives from serving on the board of directors or limits their number and/or requires the board and board committees to be chaired only by non-executive or independent board members. Some countries also prohibit the chief executive officer (CEO) from serving as chair of the board of directors or even from being part of the board of directors. Owing to these differences, this chapter does not advocate any specific board or governance structure. The terms “board of directors” and “senior management” are used mainly from the perspective of a one-tier board structure. These terms should be interpreted throughout the chapter in accordance with the applicable law within each jurisdiction.

Recognising that different structural approaches to corporate governance exist across countries and that these structures evolve over time, this chapter encourages legislators, supervisors, banks and others to frequently review their practices to strengthen checks and balances and sound corporate governance under diverse structures. The application of corporate governance standards in any jurisdiction is naturally expected to be pursued in a manner consistent with applicable national laws, regulations and codes (eg considering the existence of oversight boards in some jurisdictions).

Effective implementation of sound corporate governance requires relevant legal, regulatory and institutional foundations. A variety of factors, including the system of business laws, stock exchange rules and accounting standards, can affect market integrity and systemic stability. Such factors, however, are often outside the scope of banking supervision. Supervisors are nevertheless encouraged to be aware of legal and institutional impediments to sound corporate governance, and to take steps to foster effective foundations for corporate governance where it is within their legal authority to do so. Where it is not, supervisors may wish to consider supporting legislative or other reforms that would allow them to have a more direct role in promoting or requiring sound corporate governance.

Principle 1: Board’s overall responsibilities

The board has overall responsibility for the bank, including approving and overseeing management’s implementation of the bank’s strategic objectives, governance framework and corporate culture.

Responsibilities of the board

The board has ultimate responsibility for the bank’s business strategy and financial soundness, key personnel decisions, internal organisation and governance structure and practices, and risk management and compliance obligations. The board may delegate some of its functions, though not its responsibilities, to board committees where appropriate.

The board should establish and be satisfied with the bank’s organisational structure. This will enable the board and senior management to carry out their responsibilities and facilitate effective decision-making and good governance. This includes clearly laying out the key responsibilities and authorities of the board itself and of senior management and of those responsible for the risk management and control functions.

The members of the board should exercise their “duty of care” and “duty of loyalty” to the bank under applicable national laws and supervisory standards.

Accordingly, the board should:6

1. actively engage in the affairs of the bank and keep up with material changes in the bank’s business and the external environment as well as act in a timely manner to protect the long- term interests of the bank;
2. oversee7 the development of and approve the bank’s business objectives and strategy and monitor their implementation;
3. play a lead role in establishing the bank’s corporate culture and values;
4. oversee implementation of the bank’s governance framework and periodically review that it remains appropriate in the light of material changes to the bank’s size, complexity, geographical footprint, business strategy, markets and regulatory requirements;
5. Establish, along with senior management and the Chief Risk Officer (CRO), the bank’s risk appetite, considering the competitive and regulatory landscape and the bank’s long-term interests, risk exposure and ability to manage risk effectively;
6. oversee the bank’s adherence to the RAS, risk policy and risk limits
7. approve the approach and oversee the implementation of key policies pertaining to the bank’s capital adequacy assessment process, capital and liquidity plans, compliance policies and obligations, and the internal control system;
8. require that the bank maintain a robust finance function responsible for accounting and financial data;
9. approve the annual financial statements and require a periodic independent review of critical areas;
10. approve the selection and oversee the performance of the CEO, key members of senior management and heads of the control functions;
11. oversee the bank’s approach to compensation, including monitoring and reviewing executive compensation and assessing whether it is aligned with the bank’s risk culture and risk appetite; and
12. oversee the integrity, independence and effectiveness of the bank’s policies and procedures for whistleblowing.

The board should ensure that transactions with related parties (including internal group transactions) are reviewed to assess risk and are subject to appropriate restrictions (eg by requiring that such transactions be conducted on arm’s length terms) and that corporate or business resources of the bank are not misappropriated or misapplied.

In discharging these responsibilities, the board should consider the legitimate interests of depositors, shareholders and other relevant stakeholders. It should also ensure that the bank maintains an effective relationship with its supervisors.

A fundamental component of good governance is a corporate culture of reinforcing appropriate norms for responsible and ethical behaviour. These norms are especially critical in terms of a bank’s risk awareness, risk-taking behaviour and risk management (ie the bank’s “risk culture”).

To promote a sound corporate culture, the board should reinforce the “tone at the top” by:

1. setting and adhering to corporate values that create expectations that all business should be conducted in a legal and ethical manner, and overseeing the adherence to such values by senior management and other employees;
2. promoting risk awareness within a strong risk culture, conveying the board’s expectation that it does not support excessive risk-taking and that all employees are responsible for helping the bank operate within the established risk appetite and risk limits;
3. confirming that appropriate steps have been or are being taken to communicate throughout the bank the corporate values, professional standards or codes of conduct it sets, together with supporting policies; and
4. confirming that employees, including senior management, are aware that appropriate disciplinary or other actions will follow unacceptable behaviours and transgressions.

A bank’s code of conduct or code of ethics, or comparable policy, should define acceptable and unacceptable behaviours.

1. It should explicitly disallow illegal activity, such as financial misreporting and misconduct, economic crime including fraud, breach of sanctions, money laundering, anti-competitive practices, bribery and corruption, or the violation of consumer rights.
2. It should make clear that employees are expected to conduct themselves ethically and perform their job with skill and due care and diligence in addition to complying with laws, regulations and company policies.

The bank’s corporate values should recognise the critical importance of timely and frank discussion, as well as escalation of problems to higher levels within the organisation.

1. Employees should be encouraged and able to communicate, confidentially and without the risk of reprisal, legitimate concerns about illegal, unethical or questionable practices. This can be facilitated through a well communicated policy and adequate procedures and processes, consistent with national law, which allow employees to communicate material and bona fide concerns and observations of any violations in a confidential manner (eg whistleblower policy). This includes communicating material concerns to the bank’s supervisor.
2. The board should have oversight of the whistleblowing policy mechanism and ensure that senior management addresses legitimate issues that are raised. The board should take responsibility for ensuring that staff who raise concerns are protected from detrimental treatment or reprisals.
3. The board should oversee and approve how and by whom legitimate material concerns shall be investigated and addressed, whether by an objective independent internal or external body, senior management and/or the board itself.

As part of the overall corporate governance framework, the board is responsible for overseeing a strong risk governance framework. An effective risk governance framework includes a strong risk culture, a well developed risk appetite articulated through the RAS, and well defined responsibilities for risk management in particular and control functions in general.

Developing and conveying the bank’s risk appetite is essential to reinforcing a strong risk culture. The risk governance framework should outline actions to be taken when stated risk limits are breached, including disciplinary actions for excessive risk-taking, escalation procedures and board of director notification.

The board should take an active role in defining the risk appetite and ensuring its alignment with the bank’s strategic, capital and financial plans and compensation practices. The bank’s risk appetite should be clearly conveyed through an RAS that can be easily understood by all relevant parties: the board itself, senior management, bank employees and the supervisor.

The bank’s RAS should:

1. include both quantitative and qualitative considerations;
2. establish the individual and aggregate level and types of risk that the bank is willing to assume in advance of and to achieve its business activities within its risk capacity;
3. define the boundaries and business considerations in accordance with which the bank is expected to operate when pursuing the business strategy; and
4. communicate the board’s risk appetite effectively throughout the bank, linking it to daily operational decision-making and establishing the means to raise risk issues and strategic concerns across the bank.

The development of an effective RAS should be driven by both top-down board leadership and bottom-up management involvement. While the definition of risk appetite may be initiated by senior management, successful implementation depends upon effective interactions between the board, senior management, risk management and operating businesses, including the chief financial officer (CFO).

A risk governance framework should include well defined organisational responsibilities for risk management, typically referred to as the three lines of defence:

1. the business line;
2. a risk management function and a compliance function independent from the first line of defence; and
3. an internal audit function independent from the first and second lines of defence.

Depending on the bank’s nature, size and complexity, and the risk profile of its activities, the specifics of how these three lines of defence are structured can vary. Regardless of the structure, responsibilities for each line of defence should be well defined and communicated.

Business units are the first line of defence. They take risks and are responsible and accountable for the ongoing management of such risks. This includes identifying, assessing and reporting such exposures, considering the bank’s risk appetite and its policies, procedures and controls. The way the business line executes its responsibilities should reflect the bank’s existing risk culture. The board should promote a strong culture of adhering to limits and managing risk exposures.

The second line of defence includes an independent risk management function. The risk management function complements the business line’s risk activities through its monitoring and reporting responsibilities. Among other things, it is responsible for overseeing the bank’s risk-taking activities and assessing risks and issues independently from the business line. The function should promote the importance of senior management and business line managers in identifying and assessing risks critically rather than relying only on surveillance conducted by the risk management function. The risk management function typically engages with the finance function, which plays a critical role in ensuring that business performance and profit and loss results are accurately captured and reported to the board, management and business lines that will use such information as a key input to risk and business decisions.

The second line of defence also includes an independent and effective compliance function. The compliance function should, among other things, routinely monitor compliance with laws, corporate governance rules, regulations, codes and policies to which the bank is subject. The board should approve compliance policies that are communicated to all staff. The compliance function should assess the extent to which policies are observed and report to senior management and, as appropriate, to the board on how the bank is managing its compliance risk. The function should also have sufficient authority, stature, independence, resources and access to the board.

The third line of defence consists of an independent and effective internal audit function. Among other things, it provides independent review and objective assurance on the quality and effectiveness of the bank’s internal control system, the first and second lines of defence and the risk governance framework including links to organisational culture, as well as strategic and business planning, compensation and decision-making processes. Internal auditors must be competent and appropriately trained and not involved in developing, implementing or operating the risk management function or other first or second line of defence functions (see Principle 9).

The board should ensure that the risk management, compliance and internal audit functions are properly positioned, staffed and resourced and that they carry out their responsibilities independently, objectively and effectively. In its oversight of the risk governance framework, the board should regularly review key policies and controls with senior management and with the heads of the risk management, compliance and internal audit functions to identify and address significant risks and issues, as well as determine areas that need improvement.

The board should select the CEO and may select other key personnel, including members of senior management.

The board should provide oversight of senior management. It should hold members of senior management accountable for their actions and enumerate the possible consequences (including dismissal) if those actions are not aligned with the board’s performance expectations. This includes adhering to the bank’s values, risk appetite and risk culture, under all circumstances. In doing so, the board should:

1. monitor that senior management’s actions are consistent with the strategy and policies approved by the board, including the risk appetite;
2. meet regularly with senior management;
3. question and critically review explanations and information provided by senior management;
4. set appropriate performance and remuneration standards for senior management consistent with the long-term strategic objectives and the financial soundness of the bank;
5. assess whether senior management’s collective knowledge and expertise remain appropriate given the nature of the business and the bank’s risk profile; and
6. be actively engaged in succession plans for the CEO and other key positions, as appropriate, and ensure that appropriate succession plans are in place for senior management positions

Board members should be, and remain, qualified, individually and collectively, for their positions. They should understand their oversight and corporate governance role and be able to exercise sound, objective judgment about the affairs of the bank.

The board must be suitable to carry out its responsibilities and have a composition that facilitates effective oversight. For that purpose, the board should be comprised of a sufficient number of independent directors.

The board should be comprised of individuals with a balance of skills, diversity and expertise, who collectively possess the necessary qualifications commensurate with the size, complexity and risk profile of the bank.

In assessing the collective suitability of the board, the following should be considered:

1. board members should have a range of knowledge and experience in relevant areas and have varied backgrounds to promote diversity of views. Relevant areas of competence may include, but are not limited to, capital markets, financial analysis, financial stability issues, financial reporting, information technology, strategic planning, risk management, compensation, regulation, corporate governance and management skills;
2. the board collectively should have a reasonable understanding of local, regional and, if appropriate, global economic and market forces and of the legal and regulatory environment. International experience, where relevant, should also be considered; and
3. individual board members’ attitude should facilitate communication, collaboration and critical debate in the decision-making process.

Boards should have a clear and rigorous process for identifying, assessing and selecting board candidates. Unless required otherwise by law, the board (not management) nominates candidates and promotes appropriate succession planning of board members.8

The selection process should include reviewing whether board candidates:

1. possess the knowledge, skills, experience and, particularly in the case of non-executive directors, independence of mind given their responsibilities on the board and in the light of the bank’s business and risk profile;
2. have a record of integrity and good repute;
3. have sufficient time to fully carry out their responsibilities; and
4. have the ability to promote a smooth interaction between board members.

Board candidates should not have any conflicts of interest that may impede their ability to perform their duties independently and objectively and subject them to undue influence from:

1. other persons (such as management or other shareholders);
2. past or present positions held; or
3. personal, professional or other economic relationships with other members of the board or management (or with other entities within the group).

If a board member ceases to be qualified or is failing to fulfil their responsibilities, the board should take appropriate actions as permitted by law, which may include notifying their banking supervisor.

The bank should have in place a nomination committee or similar body, composed of a sufficient number of independent board members, which identifies and nominates candidates after having considered the criteria described above. Further details about the nomination committee and other board committees are discussed in CGO10.70.

To help board members acquire, maintain and enhance their knowledge and skills, and fulfil their responsibilities, the board should ensure that members participate in induction programmes and have access to ongoing training on relevant issues which may involve internal or external resources. The board should dedicate sufficient time, budget and other resources for this purpose, and draw on external expertise as needed. More extensive efforts should be made to train and keep updated those members with more limited financial, regulatory or risk-related experience.

Where there are shareholders with power to appoint board members, the board should ensure that such individuals understand their duties. Board members have responsibilities to the bank’s overall interests, regardless of who appoints them. In cases where board members are selected by a controlling shareholder, the board may wish to set out specific procedures or conduct periodic reviews to facilitate the appropriate discharge of responsibility by all board members.

The board should define appropriate governance structures and practices for its own work, and put in place the means for such practices to be followed and periodically reviewed for ongoing effectiveness.

The board should structure itself in terms of leadership, size and the use of committees to effectively carry out its oversight role and other responsibilities. This includes ensuring that the board has the time and means to cover all necessary subjects in sufficient depth and have a robust discussion of issues.

The board should maintain and periodically update organisational rules, by-laws, or other similar documents setting out its organisation, rights, responsibilities and key activities.

To support its own performance, the board should carry out regular assessments – alone or with the assistance of external experts – of the board as a whole, its committees and individual board members. The board should:

1. periodically review its structure, size and composition as well as committees’ structures and coordination;
2. assess the ongoing suitability of each board member periodically (at least annually), also considering their performance on the board;
3. either separately or as part of these assessments, periodically review the effectiveness of its own governance practices and procedures, determine where improvements may be needed, and make any necessary changes; and
4. use the results of these assessments as part of the ongoing improvement efforts of the board and, where required by the supervisor, share results with the supervisor.

The board should maintain appropriate records (eg meeting minutes or summaries of matters reviewed, recommendations made. decisions taken and dissenting opinions) of its deliberations and decisions. These should be made available to the supervisor when required.

The chair of the board plays a crucial role in the proper functioning of the board. The chair provides leadership to the board and is responsible for its effective overall functioning, including maintaining a relationship of trust with board members. The chair should possess the requisite experience, competencies and personal qualities to fulfil these responsibilities. The chair should ensure that board decisions are taken on a sound and well informed basis. The chair should encourage and promote critical discussion and ensure that dissenting views can be freely expressed and discussed within the decision-making process. The chair should dedicate sufficient time to the exercise of their responsibilities.

To promote checks and balances, the chair of the board should be an independent or non-executive board member. In jurisdictions where the chair is permitted to assume executive duties, the bank should have measures in place to mitigate any adverse impact on the bank’s checks and balances, eg by designating a lead board member, a senior independent board member or a similar position and having a larger number of non-executives on the board.

To increase efficiency and allow deeper focus in specific areas, a board may establish certain specialised board committees. The committees should be created and mandated by the full board. The number and nature of committees depend on many factors, including the size of the bank and its board, the nature of the business areas of the bank, and its risk profile.

Each committee should have a charter or other instrument that sets out its mandate, scope and working procedures. This includes how the committee will report to the full board, what is expected of committee members and any tenure limits for serving on the committee. The board should consider the occasional rotation of members and of the chair of such committees, as this can help avoid undue concentration of power and promote fresh perspectives.

In the interest of greater transparency and accountability, a board should disclose the committees it has established, their mandates and their composition (including members who are considered to be independent).

Committees should maintain appropriate records of their deliberations and decisions (eg meeting minutes or summaries of matters reviewed, recommendations made and decisions taken). Such records should document the committees’ fulfilment of their responsibilities and help the supervisor or those responsible to assess the effectiveness of these committees.

A committee chair should be an independent, non-executive board member.

An audit committee should:9

1. be required for systemically important banks and is strongly recommended for other banks based on an organisation’s size, risk profile or complexity;
2. be distinct from other committees;
3. have a chair who is independent and is not the chair of the board or of any other committee;
4. be made up entirely of independent or non-executive board members; and
5. include members who have experience in audit practices, financial reporting and accounting.

The audit committee is responsible for:

1. framing policy on internal audit and financial reporting, among other things;
2. overseeing the financial reporting process;
3. providing oversight of and interacting with the bank’s internal and external auditors;
4. approving, or recommending to the board or shareholders for their approval, the appointment10 remuneration and dismissal of external auditors;
5. reviewing and approving the audit scope and frequency;
6. receiving key audit reports and ensuring that senior management is taking necessary corrective actions in a timely manner to address control weaknesses, non-compliance with policies, laws and regulations, and other problems identified by auditors and other control functions;
7. overseeing the establishment of accounting policies and practices by the bank; and
8. reviewing the third-party opinions on the design and effectiveness of the overall risk governance framework and internal control system.

At a minimum, the audit committee as a whole should possess a collective balance of skills and expert knowledge – commensurate with the complexity of the banking organisation and the duties to be performed – and should have relevant experience in financial reporting, accounting and auditing. Where needed, the audit committee has access to external expert advice.

A risk committee should:

1. be required for systemically important banks and is strongly recommended for other banks based on a bank’s size, risk profile or complexity;
2. should be distinct from the audit committee, but may have other related tasks, such as finance;
3. should have a chair who is an independent director and not the chair of the board or of any other committee;
4. should include a majority of members who are independent;
5. should include members who have experience in risk management issues and practices;
6. should discuss all risk strategies on both an aggregated basis and by type of risk and make recommendations to the board thereon, and on the risk appetite;
7. is required to review the bank’s risk policies at least annually; and
8. should oversee that management has in place processes to promote the bank’s adherence to the approved risk policies.

The risk committee of the board is responsible for advising the board on the bank’s overall current and future risk appetite, overseeing senior management’s implementation of the RAS, reporting on the state of risk culture in the bank, and interacting with and overseeing the CRO.

The committee’s work includes oversight of the strategies for capital and liquidity management as well as for all relevant risks of the bank, such as credit, market, operational and reputational risks, to ensure they are consistent with the stated risk appetite.

The committee should receive regular reporting and communication from the CRO and other relevant functions about the bank’s current risk profile, current state of the risk culture, utilisation against the established risk appetite, and limits, limit breaches and mitigation plans (see Principle 6).

There should be effective communication and coordination between the audit committee and the risk committee to facilitate the exchange of information and effective coverage of all risks, including emerging risks, and any needed adjustments to the risk governance framework of the bank.

The compensation committee is required for systemically important banks. It should support the board in overseeing the remuneration system’s design and operation and in ensuring that remuneration is appropriate and consistent with the bank’s culture, long-term business and risk appetite, performance and control environment (see Principle 10) as well as with any legal or regulatory requirements. The compensation committee should be constituted in a way that enables it to exercise competent and independent judgment on compensation policies and practices and the incentives they create. The compensation committee works closely with the bank’s risk committee in evaluating the incentives created by the remuneration system. The risk committee should, without prejudice to the tasks of the compensation committee, examine whether incentives provided by the remuneration system take into consideration risk, capital, liquidity and the likelihood and timing of earnings.

Other specialised committees that are recommended include:

1. Nomination/human resources/governance committee: provides recommendations to the board for new board members and members of senior management. The nomination committee should analyse the role and responsibilities of the board member and the knowledge, experience and competence which the role requires. Where a supervisory board or board of directors is formally separate from a management board, objectivity and independence still need to be ensured by appropriate selection of board members. The nomination committee should strive to ensure that the board is not dominated by any one individual or small group of individuals in a manner that is detrimental to the interests of the bank as a whole. It may be involved in assessment of board and senior management effectiveness and may be involved in overseeing the bank’s personnel or human resource policies (see Principle 2).
2. Ethics and compliance committee: ensures that the bank has the appropriate means for promoting proper decision-making, due consideration of the risks to the bank’s reputation, and compliance with laws, regulations and internal rules.

The board should appoint members to specialised committees with the goal of achieving an appropriate mix of skills and experience that, in combination, allow the committees to fully understand, objectively evaluate and bring fresh thinking to the relevant issues.

In jurisdictions permitting or requiring executive members on the board, the board of a bank should work to ensure the needed objectivity in each committee, such as by having only non-executives and, to the extent possible, a majority of independent members.

Conflicts of interest may arise as a result of the various activities and roles of the bank (eg where the bank extends loans to a firm while its proprietary trading function buys and sells securities issued by that firm), or between the interests of the bank or its customers and those of the bank’s board members or senior managers (eg where the bank enters into a business relationship with an entity in which one of the bank’s board members has a financial interest).

Conflicts of interest may also arise when a bank is part of a broader group. For example, where the bank is part of a group, reporting lines and information flows between the bank, its parent company and/or other subsidiaries can lead to the emergence of conflicts of interest (eg sharing of potential proprietary, confidential or otherwise sensitive information from different entities or pressure to conduct business on a non-arm’s length basis).

The board should oversee the implementation and operation of policies to identify potential conflicts of interest. Where these conflicts cannot be prevented, they should be properly managed (based on the permissibility of relationships or transactions under sound corporate policies consistent with national law and supervisory standards).

The board should have a formal written conflicts-of-interest policy and an objective compliance process for implementing the policy. The policy should include:

1. a member’s duty to avoid, to the extent possible, activities that could create conflicts of interest or the appearance of conflicts of interest;
2. examples of where conflicts can arise when serving as a board member;
3. a rigorous review and approval process for members to follow before they engage in certain activities (such as serving on another board) to ensure that such activity will not create a conflict of interest;11
4. a member’s duty to promptly disclose any matter that may result, or has already resulted, in a conflict of interest;
5. a member’s responsibility to abstain from voting on any matter where the member may have a conflict of interest or where the member’s objectivity or ability to properly fulfil duties to the bank may be otherwise compromised;
6. adequate procedures for transactions with related parties so that they are made on an arm’s length basis; and
7. the way in which the board will deal with any non-compliance with the policy.

The board should oversee and be satisfied with the process by which appropriate public disclosure is made, and/or information is provided to supervisors, relating to the bank’s policies on conflicts of interest and potential material conflicts of interest.

This should include information on the bank’s approach to disclosing and managing material conflicts of interest that are not consistent with such policies, and conflicts that could arise because of the bank’s affiliation or transactions with other entities within the group.

There is a potential conflict of interest where a bank is both owned by the state and subject to banking supervision of the state. If such conflicts of interest do exist, there should be full administrative separation of the ownership and banking supervision functions to minimise political interference in the supervision of the bank.

Principle 4: Senior management

Under the direction and oversight of the board, senior management should carry out and manage the bank’s activities in a manner consistent with the business strategy, risk appetite, remuneration and other policies approved by the board.

Senior management consists of a core group of individuals responsible and accountable to the board for the sound and prudent day-to-day management of the bank.

The organisation and procedures and decision-making of senior management should be clear and transparent and designed to promote effective management of the bank. This includes clarity on the role, authority and responsibility of the various positions within senior management, including that of the CEO.

Members of senior management should have the necessary experience, competencies and integrity to manage the businesses and people under their supervision. They should receive access to regular training to maintain and enhance their competencies and stay up to date on developments relevant to their areas of responsibility.

Members of senior management should be selected through an appropriate promotion or recruitment process which considers the qualifications required for the position in question. For those senior management positions for which the board of directors is required to review or select candidates through an interview process, senior management should provide sufficient information to the board.

Senior management contributes substantially to a bank’s sound corporate governance through personal conduct (eg by helping to establish the “tone at the top” along with the board). Members of senior management should provide adequate oversight of those they manage, and ensure that the bank’s activities are consistent with the business strategy, risk appetite and the policies approved by the board.

Senior management is responsible for delegating duties to staff and should establish a management structure that promotes accountability and transparency throughout the bank.

Consistent with the direction given by the board, senior management should implement business strategies, risk management systems, risk culture, processes and controls for managing the risks – both financial and non-financial – to which the bank is exposed and concerning which it is responsible for complying with laws, regulations and internal policies. This includes comprehensive and independent risk management, compliance and audit functions as well as an effective overall system of internal controls. Senior management should recognise and respect the independent duties of the risk management, compliance and internal audit functions and should not interfere in their exercise of such duties.

Senior management should provide the board with the information it needs to carry out its responsibilities, supervise senior management and assess the quality of senior management’s performance. In this regard, senior management should keep the board regularly and adequately informed of material matters, including:

1. changes in business strategy, risk strategy/risk appetite;
2. the bank’s performance and financial condition;
3. breaches of risk limits or compliance rules;
4. internal control failures;
5. legal or regulatory concerns; and
6. issues raised as a result of the bank’s whistleblowing procedures.

Principle 5: Governance of group structures

In a group structure, the board of the parent company has the overall responsibility for the group and for ensuring the establishment and operation of a clear governance framework appropriate to the structure, business and risks of the group and its entities.12 The board and senior management should know and understand the bank group’s organisational structure and the risks that it poses.

Parent company boards

In operating within a group structure, the board of the parent company should be aware of the material risks and issues that might affect both the bank as a whole and its subsidiaries. It should exercise adequate oversight over subsidiaries while respecting the independent legal and governance responsibilities that might apply to subsidiary boards.

To fulfil its responsibilities, the board of the parent company should:

1. establish a group structure (including the legal entity and business structure) and a corporate governance framework with clearly defined roles and responsibilities, including those at the parent company level and at the subsidiary level as may be appropriate based on the complexity and significance of the subsidiary;
2. define an appropriate subsidiary board and management structure which takes into account the material risks to which the group, its businesses and its subsidiaries are exposed;
3. assess whether the group’s corporate governance framework includes adequate policies, processes and controls and whether the framework addresses risk management across the businesses and legal entity structures;
4. ensure that the group’s corporate governance framework includes appropriate processes and controls to identify and address potential intragroup conflicts of interest, such as those arising from intragroup transactions;
5. approve policies and clear strategies for establishing new structures and legal entities, and ensure that they are consistent with the policies and interests of the group;
6. assess whether there are effective systems in place to facilitate the exchange of information among the various entities, to manage the risks of the separate subsidiaries or group entities as well as of the group as a whole, and to ensure effective supervision of the group;
7. have sufficient resources to monitor the compliance of subsidiaries with all applicable legal, regulatory and governance requirements;
8. maintain an effective relationship with both the home regulator and, through the subsidiary board or direct contact, with the regulators of all subsidiaries;
9. establish an effective internal audit function that ensures audits are being performed within or for all subsidiaries and part of the group and group itself;13 and
10. ensure that the group’s corporate governance framework includes appropriate processes and controls to identify and address potential intragroup conflicts of interest, such as those arising from intragroup transactions, in appropriate recognition of the interest of the group.

Subsidiary boards14

Subsidiary and senior management remain responsible for developing effective risk management processes for their entities. The methods and procedures applied by subsidiaries should support the effectiveness of risk management at a group level. While parent companies should conduct strategic, group-wide risk management and prescribe corporate risk policies, subsidiary management and boards should have appropriate input to their local or regional application and to the assessment of local risks. Parent companies should ensure that adequate tools and authorities are available to the subsidiary and that the subsidiary understands the reporting obligations it has to the head office. It is the responsibility of subsidiary boards to assess the compatibility of group policy with local legal and regulatory requirements and, where appropriate, amend those policies.

While the strategic objectives, risk governance framework, corporate values and corporate governance principles of the subsidiary should align with that of the parent company (referred to here as “group policies”), the subsidiary board should make necessary adjustments where a group policy conflicts with an applicable legal or regulatory provision or prudential rule, or would be detrimental to the sound and prudent management of the subsidiary.

The board of a significant regulated subsidiary (due to its risk profile or systemic importance or due to its size relative to the parent company) should take further steps as needed to ensure the subsidiary meets its own corporate governance responsibilities and complies with legal and regulatory requirements.

Complex or opaque structures

Banks create structures such as units, branches, subsidiaries, or other legal entities for legal, regulatory and tax purposes. Such structures can considerably increase the complexity of the organisation. A large number of legal entities, especially with interconnections and intragroup transactions, can lead to challenges in identifying and managing the risks of the organisation as a whole.

Operating through complex or non-transparent structures may pose financial, legal, reputational and other risks to the bank. It may impede the ability of the board and senior management to conduct appropriate business oversight and could hinder effective banking supervision.15

Senior management – and the board, as appropriate – should be aware of these challenges and take action to avoid or mitigate them by:

1. avoiding the creation of complicated structures that lack economic substance or business purpose;
2. continually maintaining and reviewing appropriate policies, procedures and processes governing the approval and maintenance of such structures or activities, including fully vetting the purpose, the associated risks and the bank’s ability to manage those risks prior to setting up new structures and initiating associated activities;
3. having a centralised process for approving the creation of new legal entities and subsidiaries based on established criteria, including the ability to monitor and fulfil each entity’s regulatory, tax, financial reporting, governance and other requirements, as well as for the dissolution of dormant subsidiaries;
4. establishing adequate procedures and processes to identify and manage all material risks arising from these structures, including lack of management transparency, operational risks introduced by interconnected and complex funding structures, intragroup exposures, trapped collateral and counterparty risk. The bank should only approve structures if the material risks can be properly identified, assessed and managed; and
5. ensuring that the activities and structure are subject to regular internal and external audit reviews..

The board of the parent company can enhance the effectiveness of the above efforts by requiring a periodic independent formal review of the structures, their controls and activities as well as of their consistency with board-approved strategy.

The board should be prepared to discuss with, and as necessary report to, the bank’s supervisor and the host country supervisors the policies and strategies adopted regarding the establishment and maintenance of these structures and activities.

Principle 6: Risk management function

Banks should have an effective independent risk management function, under the direction of a chief risk officer (CRO), with sufficient stature, independence, resources and access to the board.

The independent risk management function is a key component of the bank’s second line of defence. This function is responsible for overseeing risk-taking activities across the enterprise and should have authority within the organisation to do so. Key activities of the risk management function should include:

1. identifying material individual, aggregate and emerging risks;
2. assessing these risks and measuring the bank’s exposure to them;
3. subject to the review and approval of the board, developing and implementing the enterprise-wide risk governance framework, which includes the bank’s risk culture, risk appetite and risk limits;
4. ongoing monitoring of the risk-taking activities and risk exposures in line with the board- approved risk appetite, risk limits and corresponding capital or liquidity needs (ie capital planning);
5. establishing an early warning or trigger system for breaches of the bank’s risk appetite or limits;
6. influencing and, when necessary, challenging decisions that give rise to material risk; and
7. reporting to senior management and the board or risk committee on all these items, including but not limited to proposing appropriate risk-mitigating actions.

While it is common for risk managers to work closely with individual business units, the risk management function should be sufficiently independent of the business units and should not be involved in revenue generation. Such independence is an essential component of an effective risk management function, as is having access to all business lines that have the potential to generate material risk to the bank as well as to relevant risk-bearing subsidiaries and affiliates.

The risk management function should have sufficient staffing with the necessary experience and qualifications, including market and product knowledge as well as command of risk disciplines16. Staff should be able and willing to effectively challenge business operations on all risk-related matters. They should also have access to regular training.

Role of the CRO

Large, complex and internationally active banks, and other banks, based on their risk profile and local governance requirements, should have a senior manager (CRO or equivalent) with overall responsibility for the bank’s risk management function. In banking groups, there should be a group CRO in addition to subsidiary-level risk officers. Because some banks may have an officer who fulfils the function of a CRO under a different title, reference in this document to the CRO is intended to incorporate equivalent positions, provided they meet the independence and other requirements set out herein.

The CRO has primary responsibility for overseeing the development and implementation of the bank’s risk management function. This includes the ongoing strengthening of staff skills and enhancements to risk management systems, policies, processes, quantitative models and reports as necessary to ensure that the bank’s risk management capabilities are sufficiently robust and effective to fully support its strategic objectives and all of its risk-taking activities. The CRO is responsible for supporting the board in its engagement with and oversight of the development of the bank’s risk appetite and RAS and translates the risk appetite into a structure of risk limits. Along with management, the CRO should be actively engaged in monitoring performance against risk-taking and adherence to risk limit. The CRO’s responsibilities also include managing and participating in key decision-making processes (eg strategic planning, capital and liquidity planning, new products and services, compensation design and operation).

The CRO should have the organisational stature, authority and necessary skills to oversee the bank’s risk management activities. The CRO should be independent and have duties distinct from other executive functions. The CRO must have access to all necessary information but should not manage or have financial responsibility for operational business lines or revenue-generating functions. There should be no “dual hatting” (ie the chief operating officer, CFO, chief auditor or other senior manager should in principle not also serve as the CRO).17 The CRO should report directly to the board or its risk committee and have unrestricted access to them. The CRO should have the ability to interpret and articulate risk in a clear and understandable manner and to effectively engage the board and management in constructive dialogue on key risk issues. The CRO should interact regularly with the board and/or risk committee, and the CRO should have the ability to meet with the board or risk committee without executive directors being present.18

Appointment, dismissal and other changes to the CRO position should be approved by the board or its risk committee. If the CRO is removed from their position, this should be disclosed publicly, and the reasons should also be discussed with the bank’s supervisor. The risk committee or the board should review and approve the CRO’s performance, compensation and budget.

Principle 7: Risk identification, monitoring and controlling

Risks should be identified, monitored and controlled on an ongoing bank-wide and individual entity basis. The sophistication of the bank’s risk management and internal control infrastructure should keep pace with changes to the bank’s risk profile, to the external risk landscape and in industry practice.

The bank’s risk governance framework should include policies, supported by appropriate control procedures and processes, designed to ensure that the bank’s risk identification, aggregation, mitigation and monitoring capabilities are commensurate with the bank’s size, complexity and risk profile.

Risk identification should encompass all material risks to the bank, on- and off-balance sheet and on a group-wide, portfolio-wise and business-line level. To perform effective risk assessments, the board and senior management, including the CRO, should, regularly and on an ad hoc basis, evaluate the risks faced by the bank and its overall risk profile. The risk assessment process should include ongoing analysis of existing risks as well as the identification of new or emerging risks. Risks should be captured from all organisational units. Concentrations associated with material risks should likewise be factored into the risk assessment.

Risk identification and measurement should include both quantitative and qualitative elements. Risk measurements should also include qualitative, bank-wide views of risk relative to the bank’s external operating environment. Banks should also consider and evaluate harder-to-quantify risks, such as reputation risk.

Internal controls are designed, among other things, to ensure that each key risk has a policy, process or other measure, as well as a control to ensure that such policy, process or other measure is being applied and works as intended. As such, internal controls help ensure process integrity, compliance and effectiveness. Internal controls provide reasonable assurance that financial and management information is reliable, timely and complete and that the bank is complying with its various policies and applicable laws and regulations.

To avoid actions beyond the authority of the individual or even fraud, internal controls also place reasonable checks on managerial and employee discretion. Even in smaller banks, for example, key management decisions should be taken by more than one person. Internal reviews should also determine the extent of a bank’s compliance with company policies and procedures as well as with legal and regulatory policies. Adequate escalation procedures are a key element of the internal control system.

An effective internal control system requires appropriate segregation of duties and that personnel are not assigned conflicting responsibilities. Areas of potential conflicts of interest should be identified, minimised, and subject to careful, independent monitoring.

Segregation of duties is not limited to situations involving simultaneous front and back office control by one individual. It can also result in serious problems when there are not appropriate controls in those instances where an individual has responsibility for:

1. approval of the disbursement of funds and the actual disbursement;
2. customer and proprietary accounts;
3. transactions in both the "banking" and "trading" books;
4. informally providing information to customers about their positions while marketing to the same customers;
5. assessing the adequacy of loan documentation and monitoring the borrower after loan origination; and,
6. any other areas where significant conflicts of interest emerge and are not mitigated by other factors.

The degree of sophistication of the bank’s risk management infrastructure – including, in particular, a sufficiently robust data infrastructure, data architecture and information technology infrastructure – should keep pace with developments such as balance sheet and revenue growth; increasing complexity of the bank’s business, risk configuration or operating structure; geographical expansion; mergers and acquisitions; or the introduction of new products or business lines.

Banks should have accurate internal and external data to be able to identify, assess and mitigate risk, make strategic business decisions and determine capital and liquidity adequacy. The board and senior management should give special attention to the quality, completeness and accuracy of the data used to make risk decisions.19 While tools such as external credit ratings or externally purchased risk models and data can be useful as inputs into a more comprehensive assessment, banks are ultimately responsible for the assessment of their risks.

Risk measurement and modelling techniques should be used in addition to, but should not replace, qualitative risk analysis and monitoring. The risk management function should keep the board and senior management apprised of the assumptions used in and potential shortcomings of the bank’s risk models and analyses. This would ensure better understanding of risks and exposures and may allow quicker action to address and mitigate risks.

As part of its quantitative and qualitative analysis, the bank should utilise stress tests and scenario analyses to better understand potential risk exposures under a variety of adverse circumstances:20

1. internal stress tests should cover a range of scenarios based on reasonable assumptions regarding dependencies and correlations. Senior management should define and approve and, as applicable, the board should review and provide effective challenge to the scenarios that are used in the bank’s risk analyses;
2. reverse stress testing could provide additional insight into the risk position of the bank as well as potential future management actions;
3. stress test programme results should be periodically reviewed with the board or its risk committee. Test results should be incorporated into the reviews of the risk appetite, the capital adequacy assessment process, the capital and liquidity planning processes, and budgets. They should also be linked to recovery and resolution planning. The risk management function should suggest if and what action is required based on results; and
4. the results of stress tests and scenario analyses should also be communicated to, and given appropriate consideration by, relevant business lines and individuals within the bank.

Banks should regularly compare actual performance against risk estimates (ie backtesting) to assist in judging the accuracy and effectiveness of the risk management process and making necessary adjustments.

The risk management function should not only identify and measure risk exposures but also evaluate possible ways to mitigate these exposures. In some cases, tit may direct that risk be reduced or hedged to limit exposure. In other cases, such as when there is a decision to accept or take risk that is beyond risk limits (ie on a temporary basis) or take risk that cannot be hedged or mitigated, the risk management function should report these material exemptions to the board and monitor the positions to ensure that they remain within the bank’s framework of limits and controls or within exception approval. Either approach may be appropriate depending on the issue at hand, provided that the independence of the risk management function is not compromised.

Banks should have risk management and approval processes for new or expanded products or services, lines of business and markets, as well as for large and complex transactions that require significant use of resources or have hard-to-quantify risks. Banks should also have review and approval processes for outsourcing bank functions.21 The risk management function should provide input on risks as part of such processes and on the outsourcer’s ability to manage risks and comply with legal and regulatory obligations. Such processes should entail the following:

1. A full and frank assessment of risks under a variety of scenarios as well as an assessment of potential shortcomings in the ability of the bank’s risk management and internal controls to effectively manage associated risks;
2. An assessment of the extent to which the bank’s risk management, legal and regulatory compliance, information technology, business line and internal control functions have adequate tools and the expertise necessary to measure and manage related risks.
3. If adequate risk management processes are not in place, a new product, service, business line or third- party relationship or major transaction should be delayed until the bank is able to appropriately address the activity. There should also be a process to assess risk and performance relative to initial projections and to adapt the risk management treatment accordingly as the business matures.

Effective risk identification and measurement approaches are likewise necessary in subsidiary banks and affiliates.22 Material risk-bearing affiliates and subsidiaries should be captured by the bank-wide risk management system and should be a part of the overall risk governance framework.23

Mergers and acquisitions, divestitures and other changes to a bank’s organisational structure can pose special risk management challenges to the bank. In particular, risks can arise from conducting due diligence that fails to identify post-merger risks or activities conflicting with the bank’s strategic objectives or risk appetite. The risk management function should be actively involved in assessing risks that could arise from mergers and acquisitions and inform the board and senior management of its findings

Principle 8: Risk communication

An effective risk governance framework requires robust communication within the bank about risk, both across the organisation and through reporting to the board and senior management.

Ongoing communication about risk issues, including the bank’s risk strategy, throughout the bank is a key tenet of a strong risk culture. A strong risk culture should promote risk awareness and encourage open communication and challenge about risk-taking across the organisation as well as vertically to and from the board and senior management. Senior management should actively communicate and consult with the control functions on management’s major plans and activities to enable those functions to carry out their responsibilities.

Information should be communicated to the board and senior management in a timely, accurate and understandable manner so that they are equipped to take informed decisions. To avoid overwhelming them with excessive details, risk information should be prioritised, concise, and fully contextualised. The board should assess the relevance and the process for maintaining the accuracy of the information it receives and determine if additional or less information is needed.

Material risk-related ad hoc information that requires immediate decisions or reactions should be promptly presented to senior management and, as appropriate, the board, the responsible officers and, where applicable, the heads of control functions to facilitate timely action.

Risk reporting to the board should be carefully designed to present bank-wide, individual portfolio and other risks in a concise and meaningful manner. Reporting should accurately communicate risk exposures, results of stress tests or scenario analyses and encourage discussion on topics such as the bank’s current and prospective exposures (particularly under stressed scenarios), risk/return relationships and risk appetite and limits. Reporting should also include information about the external environment to identify market conditions and trends that may have an impact on the bank’s current or future risk profile.

Risk reporting systems should be dynamic, comprehensive and accurate, using a variety of underlying assumptions. Risk monitoring and reporting should not only occur at the disaggregated level (including material risk residing in subsidiaries) but should also be aggregated to allow for a bank-wide or integrated perspective of risk exposures. Risk reporting systems should highlight any deficiencies or limitations in risk estimates, as well as any significant embedded assumptions (eg regarding risk dependencies or correlations).

Banks should avoid organisational “silos” that can impede effective sharing of information across an organisation and can result in decisions being taken in isolation from the rest of the bank.24 Overcoming these information-sharing obstacles may require the board, senior management and control functions to re-evaluate established practices to encourage greater communication.

Principle 9: Compliance

The bank’s board of directors is responsible for overseeing the management of the bank’s compliance risk. The board should establish a compliance function and approve the bank’s policies and processes for identifying, assessing, monitoring and reporting and advising on compliance risk.

An independent compliance function25 is a key component of the bank’s second line of defence. Its main role is to ensure that the bank operates with integrity and complies with applicable, laws, regulations and internal policies.

Senior management is responsible for establishing a compliance policy that contains the basic principles to be approved by the board and explains how compliance risks will be identified and managed through all levels of the organisation.

While the board and management are accountable for the bank’s compliance, the compliance function has an important role in supporting corporate values, policies and processes that help ensure that the bank acts responsibly and fulfils all applicable obligations.

The compliance function should advise the board and senior management on the bank’s compliance with applicable laws, rules and standards and keep them informed of developments in the area. It should also help educate staff about compliance issues, act as a contact point within the bank for compliance queries from staff members, and provide guidance to staff on the appropriate implementation of applicable laws, rules and standards in the form of policies and procedures and other documents such as compliance manuals, internal codes of conduct and practice guidelines.

The compliance function is independent from management to avoid undue influence or obstacles in the performance of its duties. The compliance function should directly report to the board, as appropriate, on how the bank is managing its compliance risk. As previously noted, there should be no “dual hatting” by the head of the compliance function.

To be effective, the compliance function must have sufficient authority, stature, independence, resources and access to the board. Management should respect the independent duties of the compliance function and not interfere with their fulfilment.

Principle 10: Internal audit

The internal audit function should provide independent assurance to the board and should support board and senior management in promoting an effective governance process and the long-term soundness of the bank.

An effective and efficient internal audit function constitutes the third line of defence in the system of internal control. It provides an independent assurance to the board of directors and senior management on the quality and effectiveness of a bank’s internal control, risk management and governance systems and processes, thereby helping the board and senior management protect their organisation and its reputation.26

The internal audit function should have a clear mandate, be accountable to the board and be independent of the audited activities. It should have sufficient standing, skills, resources and authority within the bank to enable the auditors to carry out their assignments effectively and objectively. To ensure independence, the head of the internal audit function should not take on other roles (“dual hatting”).

The board and senior management contribute to the effectiveness of the internal audit function by:

1. providing the function with full and unconditional access to any records, file data and physical properties of the bank, including access to management information systems and records and the minutes of all consultative and decision-making bodies;
2. requiring the function to independently assess the effectiveness and efficiency of the internal control, risk management and governance systems and processes;
3. requiring internal auditors to adhere to national and international professional standards, such as those established by the Institute of Internal Auditors;
4. requiring that audit staff collectively have or can access knowledge, skills and resources commensurate with the business activities and risks of the bank;
5. requiring timely and effective correction of audit issues by senior management; and
6. requiring the function to perform a periodic assessment of the bank’s overall risk governance framework, including but not limited to an assessment of:
   1. the effectiveness of the risk management and compliance functions;
   2. the quality of risk reporting to the board and senior management; and
   3. the effectiveness of the bank’s system of internal controls.

To safeguard the independence of the internal audit function, the board and senior management should ensure that:

1. internal audit reports are provided to the board or its audit committee without interference from management and that the internal auditors have direct access to the board or the board’s audit committee;
2. the head of the internal audit function’s primary reporting line is to the board (or its audit committee), which is also responsible for the selection, oversight of the performance and, if necessary, dismissal of the head of this function;
3. if the chief audit executive is removed from their position, this should be disclosed publicly. The bank should also discuss the reasons for such removal with its supervisor.

Principle 11: Compensation

The bank’s remuneration structure should support sound corporate governance and risk management.

Remuneration systems form a key component of the governance and incentive structure through which the board and senior management promote good performance, convey acceptable risk- taking behaviour and reinforce the bank’s operating and risk culture. The board (or, by delegation, its compensation committee) is responsible for the overall oversight of management’s implementation of the remuneration system for the entire bank. In addition, the board or its committee should regularly monitor and review outcomes to assess whether the bank-wide remuneration system is creating the desired incentives for managing risk, capital and liquidity.27 The board or subcommittee should review the remuneration plans, processes and outcomes at least annually.

Systemically important financial institutions should have a board compensation committee as an integral part of their governance structure and organisation to oversee the compensation system’s design and operation.

The board, together with its compensation committee, if applicable, should approve the compensation of senior executives, including the CEO, CRO and head of internal audit, and should oversee development and operation of compensation policies, systems and related control processes.

For employees in control functions (eg risk, compliance and internal audit), remuneration should be determined independently of any business line overseen, and performance measures should be based principally on the achievement of their own objectives to maintain independence.

The remuneration structure should align with the business and risk strategy, objectives, values and long-term interests of the bank. It should also incorporate measures to prevent conflicts of interest. Remuneration programmes should encourage a sound risk culture in which risk-taking behaviour is appropriate and which encourages employees to act in the interest of the bank as a whole (also considering client interests) rather than prioritising personal or business line gains. Incentives embedded within remuneration structures should not incentivise staff to take excessive risk.

Remuneration should reflect risk-taking and risk outcomes. Practices by which remuneration is paid for potential future revenues whose timing and likelihood remain uncertain should be carefully evaluated by means of both qualitative and quantitative key indicators. The remuneration framework should provide for variable remuneration to be adjusted to take into account the full range of risks, including breaches of risk appetite limits, internal procedures or legal requirements.

Banks must set specific provisions for employees with significant influence on the overall risk profile, so-called material risk-takers. For these employees, remuneration payout schedules should be sensitive to risk outcomes over a multi-year horizon. This often involves deferring a significant part of the compensation until risk outcomes become better known. This includes “malus/forfeiture” provisions, where compensation can be reduced or reversed based on realised risks or conduct events before compensation vests, and/or “clawback” provisions, under which compensation can be reduced or reversed after compensation vests if new facts emerge showing that the compensation paid was based on erroneous assumptions, such as misreporting, or if it is discovered that the employee has failed to comply with internal policies or legal requirements. In such cases, banks should take action as soon as practicable to recover forfeitable or recoupable amounts to improve the likelihood of successful recovery. “Golden hellos” or “golden parachutes”, under which new or terminated executives or staff receive large payouts irrespective of performance, are generally not consistent with sound compensation practice.

Principle 12: Disclosure and transparency

The governance of the bank should be adequately transparent to its shareholders, depositors, other relevant stakeholders and market participants.

Transparency is consistent with sound and effective corporate governance. As emphasised in DIS Disclosure requirements, it is difficult for shareholders, depositors, other relevant stakeholders and market participants to effectively monitor and properly hold the board and senior management accountable when there is insufficient transparency. The objective of transparency in corporate governance is to provide these parties with the information necessary to enable them to assess the effectiveness of the board and senior management in governing the bank.

Although disclosure may be less detailed for non-listed banks, especially those that are wholly owned, these banks can nevertheless pose the same types of risk to the financial system as publicly traded banks through various activities, including their participation in payment systems and acceptance of retail deposits.

All banks, even those for whom disclosure requirements may differ because they are non-listed, should disclose relevant and useful information that supports the key areas of corporate governance identified by the Committee. Such disclosure should be proportionate to the size, complexity, structure, economic significance and risk profile of the bank. At a minimum, banks should disclose annually the following information:

1. the recruitment approach for the selection of members of the board and for ensuring an appropriate diversity of skills, backgrounds and viewpoints; and
2. whether the bank has set up board committees and the number of times key standing committees have met.

In general, banks should apply the disclosure and transparency section of the OECD principles.28 Disclosure should include, but not be limited to, material information on the bank’s objectives, organisational and governance structures and policies (in particular, the content of any corporate governance or remuneration code or policy and the process by which it is implemented), major share ownership and voting rights, and related party transactions.29 An annual report on compensation should be disclosed to the public, which includes:

1. the decision-making process used to determine the bank-wide compensation policy;
2. the most important design characteristics of the compensation system, including the criteria used for performance measurement and risk adjustment; and
3. aggregate quantitative information on remuneration.

Measures that reflect the longer-term performance of the bank should also be presented.

The bank should also disclose key points concerning its risk exposures and risk management strategies without breaching necessary confidentiality. When involved in material and complex or non- transparent activities, the bank should disclose adequate information on their purpose, strategies, structures, and related risks and controls.

Disclosure should be accurate, clear and presented in a manner that allows shareholders, depositors, other relevant stakeholders and market participants to consult the information easily. Timely public disclosure is recommended, whether on a bank’s public website, in its annual and periodic financial reports, or by other appropriate means. It is good practice to have an annual corporate governance-specific and comprehensive statement in a clearly identifiable section of the annual report depending on the applicable financial reporting framework. Any material developments that arise between regular reports should be disclosed to the bank supervisor and relevant stakeholders as required by law without undue delay.

Principle 13: The role of supervisors

Supervisors should provide guidance for and supervise corporate governance at banks (including through comprehensive evaluations and regular interaction with boards and senior management), require improvement and remedial action as necessary, and share information on corporate governance with other supervisors.

The board and senior management are primarily responsible for the governance of the bank, and supervisors should assess their performance in this regard. This section sets forth several principles that can assist supervisors in assessing corporate governance and foster good corporate governance in banks.

Supervisory guidance for sound corporate governance

Supervisors should establish guidance or rules requiring banks to have robust corporate governance policies and practices. Such guidance is especially important where national laws, regulations, codes or listing requirements regarding corporate governance are not sufficiently robust to address the unique corporate governance needs of banks. Regulatory guidance should address, among other things, expectations for checks and balances and a clear allocation of responsibilities, accountability and transparency among the members of the board and senior management and within the bank. In addition to guidance or rules, where appropriate, supervisors should also share industry best practices regarding corporate governance with the banks they supervise.

Evaluating corporate governance

Supervisors should have processes in place to fully evaluate a bank’s corporate governance. This may include regular reviews of written materials and reports, interviews with board members and bank personnel, examinations, self-assessments by the bank, and other types of on- and off-site monitoring. Supervisors should maintain regular communication with a bank’s board, senior management, risk management, compliance and internal audit functions, and external auditors.30

Supervisors should evaluate whether the bank has implemented effective mechanisms through which the board and senior management execute their respective oversight responsibilities. Supervisors should evaluate whether the board and senior management have implemented processes for the oversight of the bank’s strategic objectives, including risk appetite, financial performance, capital adequacy, capital planning, liquidity, risk profile and risk culture, controls, compensation practices, and the selection and evaluation of management. Supervisors should focus particular attention on the oversight of the risk management, compliance and internal audit functions. This should include assessing the extent to which the board interacts with and meets with representatives of these functions. Supervisors should determine whether internal controls are being adequately assessed and contribute to sound governance throughout the bank.

Supervisors should evaluate the processes and criteria used by banks to select board members and senior management and, as they judge necessary, obtain information about the expertise and character of board members and senior management. The fit and proper criteria should include those detailed in Principle 2 of this chapter. The individual and collective suitability of board members and senior management should be subject to ongoing attention by supervisors.

Governance evaluations should also include an assessment of how effectively the board and senior management contribute to good governance and promote risk culture within a bank. Supervisors should consider factors such as how the “tone at the top” and the cultural values of the bank are communicated and put into practice, how information flows to and from the board and senior management, and how serious problems are identified and addressed. This may include reviewing board and management assessments, surveys and other tools used by banks in assessing their internal culture, as well as conducting interviews and making qualitative judgments. In arriving at such judgments, supervisors should be mindful of the consistency of treatment across supervised banks. Supervisory staff should have the necessary skills to evaluate and assess governance effectiveness.

When reviewing corporate governance for groups, supervisors should consider the governance responsibilities of both the parent company and subsidiaries, in accordance with Principle 5 of this chapter.

Supervisors should interact regularly with the board, individual board members, senior managers and those responsible for the risk management, compliance and internal audit functions. This should include scheduled meetings and ad hoc exchanges through various communication channels (eg e-mail, telephone, in-person meetings). The purpose of these interactions is to support timely and open dialogue between the bank and supervisors on a range of issues, including:

1. the bank’s strategies, business model and risks;
2. the effectiveness of corporate governance at the bank;
3. the bank’s culture, management issues and succession planning;
4. compensation and incentives; and
5. other supervisory findings or expectations that supervisors believe should be particularly important to board members.

The frequency of interactions may vary according to the size, complexity, structure, economic significance and risk profile of the bank. For example, supervisors may meet with the full board of directors annually, but more frequently with key individuals, such as the chairperson or board committee chairs. For systemically important banks, interaction should occur more frequently, particularly with members of the board and senior management, and those responsible for the risk management, compliance and internal audit functions.

Supervisors should have a range of tools to address governance weaknesses or failures at banks. They should be able to require improvements and remedial actions, and ensure accountability for the corporate governance of a bank. These tools may include the ability to compel changes in the bank’s policies and practices, the composition of the board of directors or senior management, or other corrective actions. They should also include, where necessary, the authority to impose sanctions or other punitive measures. The choice of tool and the time frame for any remedial action should be proportionate to the level of risk the deficiency poses to the safety and soundness of the bank or the relevant financial system(s).

If remedial action is required, the supervisor should set a timetable for completion. Supervisors should also implement escalation procedures to enforce more stringent or faster remedial action if a bank fails to address the deficiencies identified or the supervisor deems that further action is warranted.

Supervisors should cooperate and share information on corporate governance matters with relevant public authorities, including between bank supervisors and conduct authorities, and between home and host supervisors of internationally active banks. Such communication can help supervisors improve their assessment of the overall governance of a bank and the risks it faces, particularly in a group context, and help other authorities assess the risks posed to the broader financial system.31