ALM in the Context of Enterprise Risk Management

Koos Timmermans and Wessel Douma

One of the lessons learned by banks during the global financial crisis in 2008–9 was that banks need to have in place a comprehensive risk appetite framework, which is based on the principle that banks should be able to restore their capital and liquidity positions following a stress situation, as it may take years before full access to capital and funding markets is re-established. Regulators picked up on this by implementing, for example, the Capital Requirements Regulation (CRR) and the Capital Requirements Directive IV (CRD IV), which led to new and much stricter capital and liquidity requirements than before. Furthermore, national competent authorities and the European Central Bank have raised the bar significantly with respect to the required quality of the banks’ risk appetite frameworks. Therefore, most banks have put a considerable amount of effort in the improvement of their risk and asset and liability management (ALM) processes, frameworks and governance.

In this chapter we provide an insight into the main solvency risks banks are confronted with, and the necessary components of the processes to deal with these. The first section is dedicated to the governance: how can banks make sure that their risk appetite and ALM remains up-to-date, taking into account all the relevant risks given the prevailing macroeconomic and geopolitical situation, and who should be involved in this process? In the second section, we zoom in on the balance sheet of a typical large bank, and describe the main sensitivities such a bank needs to manage in order to protect itself against potential adverse developments. Then, in the third section, we describe the high-level design of an enterprise-wide risk appetite framework that banks can consider in order to manage these risks, and of the metrics needed for such a framework.


Perhaps just as important as the technical design of ALM and risk appetite frameworks, and the conceptual and mathematical approaches used therein, is how the risk process is organised, and who is involved. Risk appetite frameworks need to be maintained and regularly updated as the environment in which banks operate changes and new risks may emerge.

Banks can use a step-by-step risk management approach to identify, monitor, mitigate and manage their financial and non-financial risks. The approach consists of a cycle of five recurrent activities.

  • 1.

    Determine the potential risks, by, for example, interviewing a number of senior employees, and/or by reviewing externally published risk assessments.

  • 2.

    Select the risks that could actually have a significant impact on the capital or liquidity position of the bank.

  • 3.

    Make sure that the relevant risks are controlled and incorporated into the risk appetite framework. Furthermore, the scenario selection for the stress testing programme should also be based on the risk identification and assessment.

  • 4.

    Monitor the actual risk profile with respect to the risk appetite.

  • 5.

    Report the main risk developments to senior management, to enable them to take timely additional measures, if necessary.

The process described in Figure 2.1 recurs in two different ways.

  • (i)

    The identification, assessment and review of the risks and the appetite for these risks are carried out periodically, and potential mitigating measures are updated.

  • (ii)

    The periodical monitoring exercise may indicate that new risks are arising, known risks are changing and assessed risk levels are changing or control measures are not effective enough. Further analyses of these findings may result in renewed and more frequent risk identification and/or assessment and/or a change in mitigating measures.

Figure 2.1

In each of the steps in the cycle, the involvement of senior management, including board members is of paramount importance. For the risk process and the risk appetite framework to be effective, the board should contribute to, and agree with, the selection, measurement and management of the relevant risks, and the accompanying selection of the stress scenarios to be evaluated. They should also approve the changes to the risk appetite framework, and regularly receive and discuss risk reports. In this way, the board can take informed decisions to further mitigate certain risks, if this mitigation is deemed necessary.

The principle that the design of the overarching risk appetite framework, and the developments of the actual risk profile with respect to the appetite for these risks should be regularly discussed by senior management can be applied in different ways. Various committee structures to achieve this are in place for the various banks, but generally the main risks of the bank are discussed in a dedicated risk committee, a combined finance and risk committee, or in an asset and liability committee (ALCO). In any case, board members are represented in these committees.


To obtain insight into the main risks and sensitivities with which most banks are confronted, a stylised example of the business model of a typical large bank, such that as shown in Figure 2.2, can be of use.

Figure 2.2

Usually, the main activity of a bank is to provide loans to customers. To fund these loans, banks either collect deposits from retail customers, or attract funding from the professional funding markets. This leads to a balance sheet as shown in the upper left corner of Figure 2.2.

Normally, banks will ask a higher interest rate to be paid on the loans they grant to banks than the rates they pay on their own funding. This leads to a positive interest margin, which is often the most important source of income for banks. The fact that banks provide loans to customers also means that they accept the risk that clients may not always pay back these loans. To deal with this, banks must quantify their risk profile via risk-weighted assets (RWA), calculated as the exposure multiplied by a risk weight that depends on, eg, the creditworthiness of the client and the amount of collateral received to cover for the loan. Regulators require banks to hold a certain percentage of RWA as capital, to ensure that they have a significant buffer to withstand losses resulting from their activities. These requirements are defined in terms of the minimum Common Equity Tier 1 (CET1) ratio banks need to maintain. This is calculated as the available CET1 capital divided by the amount of RWA.

Returning to the income side: the annual profit and loss (P&L) of a bank will be less than the sum of net interest income, trading and sales income and fee income, because certain expenses and costs need to be deducted from these. Expenses for banks are primarily salary costs, but also include costs related to the necessary infrastructure, as well as those related to non-financial risk events (eg, compensation of clients due to mis-selling, fines from regulators, etc). Furthermore, credit risk costs (ie, costs incurred when clients default on their loans) negatively affect the profit and loss as well. Finally, banks have to pay tax over the gross result

gross result = income expenses risk costs

which means that the final net profit and loss that can be used to pay a dividend, or to strengthen the capital position is equal to

net result = (1 tax%)(income expenses risk costs)

Finally, a highly relevant indicator of bank performance is the return on equity (RoE), which is calculated as the net results divided by the capital. To remain attractive for investors, banks need to achieve an RoE of approximately 10%, which can be achieved by, eg, making sure that net interest income is high enough and sufficiently stable, the cost-to-income (C/I) ratio and credit risk costs are not too high and required capital does not increase too much.

If everything goes according to plan, a 10% RoE is certainly achievable for a bank with a sound client base and efficient processes. However, there are a number of uncertainties that need to be carefully managed, a process in which the risk management function plays a key role.

Net interest income can, for example, be lower than expected when interest rates remain very low for a prolonged period of time. In that case, maturing assets that originated a long time ago, when interest rates were higher, need to be replaced by new assets with a significantly lower yield. This can be offset by making sure that similar rate reductions occur for the liabilities, but the possibility to fully compensate may be limited if the funding consists mostly of retail deposits. If banks were to make these rates negative, for example, it is likely that a significant percentage of such clients would take their money and put it in their safe or in their piggy bank.

Furthermore, many banks have prepayable assets, such as residential mortgages, on their balance sheets. The related prepayment options can become quite costly for banks in a low interest rate environment, because higher than expected prepayments of loans with higher client rates than the prevailing ones will erode the net interest margin if the related funding is not prepayable.

Sudden increases in interest rates can also be a threat to the net interest income, for example, if banks have to translate these market rate increases into significant deposit rate increases, eg, because new players with no legacy investments enter the market, or because customers may otherwise decide to move their money to other products, such as term deposits.

Interest rate risk can be mitigated by making sure that the interest rate typical maturities of assets and liabilities are to a large extent matched and that prepayment option risk is hedged and properly priced in, and by reducing the reliance on interest income by, eg, increasing the share of other types of income, such as fee income.

Credit risk costs can be higher than expected due to deteriorating economic circumstances, which will affect the credit risk profile of the bank’s clients. Higher unemployment rates will normally lead to a higher default percentage for residential mortgages, for example, while default rates for business lending portfolios typically go up if the economic growth slows down. Furthermore, under the International Financial Reporting Standard 9 rules for loan loss provisioning to be implemented in January 2018, there will be an additional effect from clients for which the credit profile has deteriorated significantly. For these clients, the loan loss provisions must be based on lifetime expected loss instead of one-year expected loss, which means that the provisions must be increased significantly. Obviously, banks will be faced with more clients with a deteriorating credit profile in times of economic downturn.

Credit default risk can be partially mitigated by putting in place sound credit acceptance criteria and policies, while loss risk in the case of a default can be reduced by making sure that sufficient collateral is obtained. Furthermore, credit risk can also be reduced by ensuring a sufficient level of diversification in the credit portfolio, in terms of countries, sectors and asset classes.

Expense risk for banks is primarily related to non-financial risk events. Mis-selling practices and non-compliance with regulations can lead to hefty fines and compensation of clients.

These types of risk can be mitigated by making sure that a bank has developed a strong compliance function and culture.

Not only the numerator of the CET1 ratio (available capital, influenced by, eg, net income) but also the denominator (RWA) is subject to uncertainty. Credit-risk-weighted assets will on average increase in times of economic stress, because deteriorations in the credit profile of the clients will be translated into higher risk weights, and consequently greater RWA. Market-risk-weighted assets will increase as well, as these are influenced by the observed volatility of the market. Furthermore, RWA are subject to regulatory risk, as well as sensitivity to the economic and market circumstances. Since the mid-2010s, the confidence of regulators in the use of internal models for the calculation of RWA has decreased, which has resulted in proposals for a more standardised approach, with a potentially significant impact on the risk weights for certain asset classes.

Regulatory risk can be mitigated by reducing the maturities of transactions in asset classes that are likely candidates for significant RWA increases, and by making sure that “originate to distribute” capabilities have been developed that enable banks to offload affected assets from their balance sheets.

Finally, in addition to the risks that could affect the capital ratios, banks are subject to liquidity risk. The liquidity position of a bank can be negatively affected when, eg, the professional funding market dries up for them, or when a significant percentage of customers with a savings account decide to withdraw their money. However, this chapter focuses solely on solvency risk.


If the risks mentioned above (Figure 2.3) are not carefully managed, banks may not achieve their target ROE, may not be able to make the intended dividend payments, and their CET1 ratio may be negatively affected to the extent that regulatory requirements are no longer met. Therefore, it makes sense to implement a risk appetite framework from the starting point that the CET1 ratio should not drop below certain levels in either normal situations or in a (standardised) stress scenario. The evidence, from previous crises, that banks will often not be able to obtain new equity from the capital markets in crisis situations, and that they will have to rely on retained earnings for the restoration of their capital position should be taken into account here.

Figure 2.3

A possible risk appetite statement for solvency risk could therefore be:

in a standardised 1-in-x years scenario, the CET1 ratio should not drop below a% throughout the scenario horizon, and should be back at (a + b)% at the end of the scenario horizon, using retained earnings.

Formulating such a risk appetite statement is of course the first step, but to implement it, and to be able to measure the potential development of the CET1 ratio in a crisis situation, a number of related risk metrics are needed. To determine exactly which risk metrics are needed, it is useful to take a look at the stylised balance sheet of a bank. As will be shown below, the various balance-sheet items influence the CET1 ratio in different ways.

As can be observed from Figure 2.4, a number of different metrics need to be incorporated in order to fully capture the potential impact of a stress scenario on the CET1 ratio.

Figure 2.4

The earnings-at-risk value captures the various P&L impacts of a stress scenario, due to, eg, changing interest rates, equity prices, credit losses and operational risk losses. Prevailing accounting rules should be followed for the calculation of these shocks, which means that the calculations for trading books should be based on economic value, whereas impacts for the banking books should be based on book value. This means, for example, that, for the assumed interest rate changes in the stress scenario, the impact on the net interest income rather than the impacts on value should be calculated.

Another metric necessary for the calculation of the impact on available capital is revaluation reserve-at-risk. For the investment portfolio (more precisely, the part that is classified as “available for sale”), value changes will not affect the P&L, but will affect other comprehensive income via the so-called revaluation reserves. This metric should capture the impact on value of the stress scenario for the assumed interest rate, equity, real estate and credit spread shocks.

As already mentioned, in a stress scenario not only the numerator (available CET1 capital) but also the denominator (RWA) will be affected. Therefore, a risk metric called risk-weighted-assets-at-risk should be included. This should reflect the credit-risk-weighted assets’ increase due to the negative credit migration of the lending assets and the bond portfolio. Furthermore, it should measure the potential value-at-risk increases for the trading book due to increased volatility in the financial markets, which will influence the market risk RWA.

In order not to overestimate the impact of a stress scenario on the CET1 ratio, it is very important that the commercial result is also taken into account. This result is defined as the expected P&L prior to loan loss provisioning, and thus serves as a buffer for all the negative P&L impacts covered in the earnings-at-risk calculations.

Figure 2.5

In Figure 2.5, the potential outcome of the measurement related to the CET1 ratio risk appetite statement is shown. The graph shows the two dimensions that are relevant for the CET1 ratio: available CET1 capital on the horizontal axis, and RWA on the vertical axis. The curve shows a typical development of the RWA and CET1 capital in a medium severe stress scenario, with RWA going up, and CET1 capital increasing at a slower pace than expected due to negative P&L and valuation impacts. The dark grey, light grey and white areas, respectively, reflect the levels where

    • the CET1 ratio should end up at the end of the scenario horizon (white),
    • the CET1 ratio may temporarily exist throughout the scenario horizon (light grey),
    • the CET1 ratio should not exist at all (dark grey).

Finally, for the risk appetite statement as described in this section to be effective, it should be complemented with a number of more granular supporting risk appetite statements for individual risk types, countries, businesses, etc. Cascading down the overarching risk appetite statements to all levels of the organisation is an essential part of the risk appetite framework and processes.

Only users who have a paid subscription or are part of a corporate subscription are able to print or copy content.

To access these options, along with all other subscription benefits, please contact [email protected] or view our subscription options here:

You are currently unable to copy this content. Please contact [email protected] to find out more.

You need to sign in to use this feature. If you don’t have a account, please register for a trial.

Sign in
You are currently on corporate access.

To use this feature you will need an individual account. If you have one already please sign in.

Sign in.

Alternatively you can request an individual account here: