Not a checklist but a mirror: How risk-based supervision changes banking

Anyone who has worked in a bank knows the weeks before an inspection. 
Files are pulled out and registers are brought up to date. A signature that should have been taken months ago is somehow found. The inspectors arrive, go through their list, write up their findings and leave. Life returns to normal until the next visit.
That routine rested on a simple belief: if a bank follows the rules on the list, the bank is safe. The belief has a hole in it. A loan file can have every page in place and every stamp on it, and the borrower can still fail to repay. A checklist asks whether the form was filled in. It does not ask whether the decision to lend was a good one.
Risk-based supervision starts from a different question: how risky is this bank, and where exactly does the risk lie? The supervisor then puts attention where the danger is greatest.

What’s changing
Bangladesh Bank has now moved in this direction. It has formally moved away from a compliance-driven oversight model towards one that gives each institution attention according to its own risk profile. 
The central bank has also reorganised its own departments so that dedicated teams follow individual banks. The new system covers every business line and activity that has a material effect on a bank’s overall risk, and it looks at whether the bank’s own controls and risk management actually work.
The central bank has also made clear that the results will have consequences. Officials have said that weak assessments could lead to removal of managing directors, dissolution of boards and, where needed, resolution of failing banks.

From CAMELS to the Composite Risk Rating
For many years, a bank’s standing with its supervisor was summed up in a CAMELS rating. The letters stand for six things: capital, asset quality, management, earnings, liquidity and sensitivity to market movements.
Each was scored, usually from 1 (best) to 5 (worst), and the scores were rolled into one overall number. It was easy to read and easy to compare. Every managing director knew his bank’s number.
The Composite Risk Rating works differently, and the difference goes deeper than a change of name. Four shifts are worth understanding.
First, from ratios to activities. CAMELS looked at the bank as a whole, mostly through ratios. The new rating first asks what the bank actually does, then assesses each important activity separately: corporate lending, small business lending, retail, trade finance, treasury. A bank cannot hide a dangerous corner of its business behind healthy overall figures.
Second, from a photograph to a film. CAMELS captured the bank on one date, and ratios such as capital and bad loans describe what has already happened. The new approach is forward-looking. It asks what is likely to happen next, and it records whether the risk is rising, steady or falling. Two banks with the same rating today can be treated very differently if one is improving and the other is getting worse.
Third, management is no longer one letter. In CAMELS, the quality of management was a single score, and it was the hardest one to argue with. Now the supervisor asks, for each activity, how risky it is by nature and how well it is controlled, and sets the two side by side. A risky business with strong controls can end up in a better place than a modest business that is poorly run.
Fourth, capital, earnings and liquidity change their role. They stop being scored as separate subjects and become the bank’s cushion: the money and cash available to absorb a loss if the risks turn bad. A thin cushion makes the same risk more serious.
There is a practical warning here. A bank should not try to translate its old CAMELS number into a new rating, because the two are built on different logic. A bank that scored comfortably before, but has a large share of its loans with a few borrowers, or is growing fast in a business it does not know well, may find the new rating less kind. 
The reverse can also happen: a bank with ordinary ratios but clear limits, honest reporting and a record of dealing with problems early may do better than it expected.
The lesson for management is that the number to watch is no longer the one produced by the ratios. It is the supervisor’s view of the whole story.

What this means for a commercial bank
The first effect is that there is no longer a season for preparation. When supervision is continuous and fed by regular data, the monthly return sent to the central bank has to match what is actually happening in the branches. A bank cannot tidy itself up once a year and expect that to be enough.
The second effect is that the biggest exposures get the most scrutiny. A bank’s top twenty borrowers will be looked at harder than its twenty thousandth. If a large share of the loan book sits with a handful of business groups, the supervisor will notice and will want to know why the bank is comfortable with that.
The third effect is that the board and senior management are judged as part of the picture. The question is not only whether the numbers look acceptable. It is also whether the board asks hard questions, whether the audit department is listened to, and whether the managing director’s targets encourage careful lending or just fast lending.
The fourth effect is that the rating decides how much freedom a bank has. A bank that is rated well can expect a lighter touch and more room to grow. A bank rated poorly will face more questions, more conditions and, in the worst case, loss of control over its own future. Depositors and investors also pay attention to such signals sooner or later.
There is a cost as well. Better data, stronger risk teams and a more capable audit function take money and time. Banks that treat these as expenses to be minimised will find the new system uncomfortable. Banks that treat them as the foundation of the business will find it much easier.

How a bank should respond
Look at yourself first, and be harder on yourself than the supervisor would be. Sit down and do the supervisor’s exercise. List your activities. Work out which ones carry most of your money and most of your risk. Ask honestly how much could go wrong in each and how well it is being controlled. Let the internal audit team challenge the answers. When the supervisor’s assessment arrives, nothing in it should be a surprise.
Bring the board into the details. In many banks, board meetings are heavy on profit figures and light on loan quality. A board that wants to protect the bank needs to see more: who the largest borrowers are, how much of the portfolio sits in each sector, which loans are overdue and for how long, and which have been rescheduled again and again. 
Directors should be able to say, in plain words, what the three biggest risks to the bank are and what is being done about each. Independent directors are most useful here, because they have no reason to soften an uncomfortable answer.
Fix lending at the source. Most serious trouble in banking starts at the loan desk, long before it appears in the accounts. Loans pile up with one family or group. A struggling borrower gets a fresh loan to pay off the old one. 
Collateral is valued generously. Money is borrowed for one purpose and spent on another. Each of these is preventable. Limits on individual borrowers and groups must be meaningful, observed and reported. Follow-up after disbursement must be as serious as the appraisal before it. 
Early warning signs deserve attention: a borrower paying other lenders late, inventory piling up in a warehouse, salaries paid late, a sudden change in the way the account is run. And when a loan has gone bad, it should be called bad, and the loss recognised, rather than carried forward in the hope that things improve.
Make the numbers trustworthy. Under risk-based supervision, data is the language between the bank and the regulator. If branch figures are corrected three times before they reach head office, nobody can be sure which version is right. Every important number should have one owner, one source and a short chain of checks. It sounds dull, and it is. It is also the quickest way to build credibility with a supervisor who now sees your data regularly.
Give risk and audit staff real standing. An officer whose job is to say “no” or “not yet” can only do the job if saying it does not harm their career. The risk department and the internal audit team should be able to reach the board directly, be paid and promoted fairly, and not depend on the goodwill of the people whose work they review. When a credit officer stops a doubtful loan and is later proved right, the bank should remember it at promotion time.
Look at what targets reward. A branch will chase whatever it is measured on. If the only targets are deposits and loans disbursed, that is what the bank will get, including loans it will wish it had never made. Add loan quality to the measure, and link part of the bonus to how loans perform a year or two after they are made.
Talk to the supervisor early and plainly. A bank that reports its own problems, with a clear plan to deal with them, is treated very differently from one whose problems are found by the inspectors. Bring the bad news first.

Risk management is not a brake
There is a wrong lesson that banks could draw from all this: take less risk, lend less, stay safe. That is not what risk-based supervision asks for, and it would not be good for the bank.
A bank that refuses risk does not become safe. It becomes small. It lends only to borrowers who hardly need bank financing. It earns too little to pay depositors a fair return, to invest in better systems or to build up its capital. Slowly it loses its best staff and its customers. That is a failure too, only a quieter one.
Taking risk is the reason a bank exists. The task is to take it knowingly, in amounts the bank can bear, and to be paid properly for it. For every major activity, a bank can ask three plain questions. Do we understand this business well? Is the return enough for the risk we are taking? If this goes wrong, can we survive it?
The answers will not always point towards less lending. Lending to small and medium businesses is a good example. Each loan may be riskier than a loan to a large, established company, but a thousand small loans to different businesses in different trades can be a safer position than a single large loan to one group. The risk is spread out, and one failure cannot hurt the bank badly. A bank that understands this can grow in that area with confidence, while one that only sees the higher risk per loan may walk away from a good market.
The same logic applies to limits. A limit set by the board, written down and actually used, is a green light as much as a red one. It tells the people on the ground how far they can go without asking anyone’s permission. Limits should cover individual borrowers, whole sectors, foreign currency positions and the cash held to meet withdrawals.
The growth plan and the risk plan should be drawn up together, in the same room, by the same people. Too often, the growth plan is written by the business side, and the risk department is asked to approve it afterwards. When both are built together, targets are ambitious where the bank is strong and careful where it is not.

Growth that lasts
Sustainable growth in a bank has a simple meaning: profit that comes from loans that are repaid, deposits that stay because customers trust the bank, and capital that grows alongside the balance sheet. Growth that comes from lending to anyone who asks, or from rolling over old loans to keep them looking healthy, is borrowed from the future. The bill arrives later, and it is usually larger than the profit that was booked.
Risk-based supervision, if it is done well, is good news for banks that already run themselves this way. It recognises their quality, takes up less of their time with routine questions and lets them get on with business. For banks that have drifted, it will be a hard but useful correction, and it is better to receive that correction from a supervisor now than from depositors and the market later.
Banks should stop thinking of the supervisor’s visit as an exam to prepare for. The real preparation is the way the bank is run on an ordinary Tuesday: how the loan is approved, how the number is reported, how the board asks its questions, and whether the person who says “no” is listened to. A bank that gets those things right has little to fear from any supervisor, and it has the best chance of growing steadily for many years.

The writer is the Chief Financial Officer of Agrani Bank PLC. The views expressed in this article are the writer’s own and do not necessarily reflect the views of Agrani Bank PLC.