59. Risk management within the Group
Report Online
2020
Risk management is one of the most important internal processes in both the Bank and other entities of the Group.
It is aimed at ensuring (in the changing environment) the profitability of business activities while ensuring an appropriate level of control and keeping the risk level within the risk tolerances and limits system adopted by the Bank and the Group, in a changing macroeconomic environment. The level of risk is an important part of the planning processes.
The Group identifies risks in its operations and analyses the impact of each type of risk on its business. All the risks are managed; some of them have a material effect on the profitability and capital needed to cover them. The following risks are considered material for the Group: credit risk, risk of foreign currency mortgage loans for households, currency risk, interest rate risk, liquidity risk (including financing risk), operating risk, business risk, risk of macroeconomic changes and model risk. The materiality of all the identified risks is assessed by the Group on a regular basis, at least annually.
A detailed description of the management policies for material risks is presented in the “Report on capital adequacy and other information subject to publication by the PKO Bank Polski S.A. Group”.
Risk management objective
The objective of risk management is to strive to maintain the level of risk within the accepted tolerances in order to:
- protect shareholder value;
- protect customer deposits;
- support the Group in conducting efficient operations.
The risk management objectives are achieved, in particular, by providing appropriate information on the risks, so that decisions are made in full awareness of the particular risks involved.
Main principles of risk management
The Group’s risk management is based, in particular, on the following principles:
- the risk management covers all the risks identified;
- the risk management process is appropriate from the perspective of the scale of operations and materiality, scale and complexity of a given risk, and adjusted on an on-going basis to take account of the new risks and their sources;
- risk management methods (especially models and their assumptions) and risk management measurement or assessment systems are tailored to the scale and complexity of individual risks, the current and planned operations of the Group and its operating environment, and are periodically verified and validated;
- the area of risk management remains organizationally independent of business activities;
- risk management is integrated into the planning and controlling systems;
- the level of risk is monitored and controlled on an on-going basis;
- the risk management process supports the implementation of the Bank’s strategy in compliance with the Risk Management Strategy, in particular with respect to the level of risk tolerance.
Risk management process
The process of risk management in the Group consists of the following stages:
Risk identification consists of recognizing the existing and potential sources of risk and estimating the significance of its potential impact on the Bank’s and the Group’s operations. As part of risk identification, the risks considered to be material in the Bank’s or the Group’s operations are identified.
Risk measurement and assessment are aimed at determining the scale of threats connected with the risks arising. Risk measurement covers determining the risk assessment measures adequate to the type and significance of the risk, and data availability. Quantitative and qualitative risk measurement results are the basis for the risk assessment aimed at identifying the scale or scope of risk.
As part of risk measurement, the Bank’s Group carries out:
- specific stress tests which are conducted separately for individual risk types and are used to assess sensitivity of a given risk to unfavourable market conditions,
- comprehensive stress tests conducted jointly for the concentration risk and risks regarded as material, used to determine sensitivity of the capital adequacy measures and Bank’s results to the occurrence of a negative scenario of changes in the environment and the functioning of the Bank Group’s.
The stress-tests are conducted by the Bank’s Group based on assumptions which ensure a sound assessment of the risk, in particular taking into account the Recommendations of the Polish Financial Supervision Authority.
Risk control involves the determination of risk control mechanisms adjusted to the scale and complexity of the Bank Group’s activities, especially in the form of strategic tolerance limits for the individual types of risk. Strategic risk tolerance limits are subject to regular monitoring, and if they are exceeded, the Group members take management actions.
Risk forecasting involves foreseeing future risk levels, taking into account the assumed business development projections, and internal and external events. Risk level forecasts of the Bank and the Bank’s Group are assessed (so-called “reverse stress tests”) in order to verify their accuracy.
Risk monitoring involves observing deviations from the forecasts or the adopted benchmarks (e.g. limits, thresholds, plans, prior period measurements, recommendations and instructions issued by external supervisory and regulatory authority). Risk monitoring and forecasting frequency is adequate to the materiality and variability of specific risks.
Risk reporting consists in informing about the results of the risk identification, measurement, assessment and forecasting, causes of changes in the risks, actions taken and recommended. The scope, frequency and form of the reporting are adjusted to the managerial level of the recipients. If potential liquidity problems arise, the Supervisory Board is immediately informed about significant changes in the risk level, and in particular, about threats and remedial actions taken, and of their impact on the Bank’s liquidity level.
Management actions consist of determining the desired risk level favourable for building the structure of assets and liabilities. Management may result, in particular, in:
- acceptance of the risk – determining the acceptable risk level, taking into account business needs and developing management actions in the case the level is exceeded,
- reduction of the risk – mitigation of the impact of the risk factors or effects of its materialization (e.g. By reducing or diversifying the risk exposure, determining limits, utilizing collaterals),
- transfer of the risk – transferring responsibility for covering potential losses (e.g. by transferring the risk to another entity with the use of legal instruments, such as insurance contracts, security services agreements for a building, accepting guarantees),
- risk avoidance – resignation from the risk-generating activity or elimination of the probability of materialization of the risk factor, including in particular determination o zero tolerance to risk.
Organization of risk management within the group
The Bank supervises the functioning of individual entities in the PKO Bank Polski S.A. Group. As part of its supervisory role, the Bank monitors their risk management systems and supports their development. In addition, the Bank takes into account the level of risk in particular Group companies for purposes of risk monitoring and reporting system at Group level. Risk management in the Bank takes place in all of the organizational units of the Bank.
The organization of risk management in PKO Bank Polski S.A. is presented in the diagram below:
The Supervisory Board supervises and evaluates the risk management process, in particular, on the basis of regular reports on the risk, taking into account the adequacy and effectiveness of the risk management system and information about the implementation of the risk management strategy, also at the level of limits which limit the risk and conclusion from stress tests, and if necessary, orders the verification of the process.
The Supervisory Board is supported by the following committees: the Supervisory Board Nominations and Remuneration Committee, the Supervisory Board Risk Committee and the Supervisory Board Audit Committee.
In respect of risk management, the Management Board of PKO Bank Polski S.A. is responsible for strategic risk management, including supervising and monitoring actions taken by the Bank in respect of risk management. The Management Board makes major decisions affecting the risk profile of the Bank and adopts internal regulations concerning risk management. It ensures operation of the risk management system, monitors and assesses its functioning, and transfers the respective information to the Supervisory Board. In its risk management activities, the Management Board is supported by the following committees:
- the Risk Committee;
- the Asset and Liability Committee (ALCO);
- The Bank’s Credit Committee;
- the Operational Risk Committee.
The risk management process is carried out in three independent but complementary lines of defence:
is formed of organizational structures responsible for product management, selling products and servicing customers, and of other structures which perform operational tasks that generate risk, which function based on internal regulations. This function is performed by all of the Bank’s and the Group’s entities. The Bank’s entities implement appropriate risk controls, including in particular limits, designed by them and located at the second-line of defence. They also ensure that they are met by means of appropriate controls.
At the same time, the Bank Group’s companies are obliged to have comparable and consistent systems for risk assessment and control, taking into account the specificity of each entity and its market.
covers compliance units and involves the identification, measurement, evaluation and/or control, monitoring and reporting of significant types of risks, and of the threats and irregularities identified; the tasks are performed by dedicated organizational structures acting on the basis of the applicable internal regulations of the Bank; the objective of these structures is to ensure that the tasks performed as part of the first line of defence are properly governed in the internal regulations of the Bank and that they effectively limit the risk, support risk measurement, assessment and analysis and contribute to operational effectiveness. The function is performed, in particular by Risk Management, the Compliance Department and relevant committees. The second line of defence supports actions taken to eliminate unfavourable deviations from the financial plan, with respect to the amounts impacting the quantitative strategic risk tolerance limits specified in the financial plan. These tasks are performed in particular in the entities of the Bank responsible for controlling.
consists of the internal audit function which performs independent audits of individual components of the Bank’s management system, including the risk management system, and the internal control system; the internal audit operates independently of the first and second lines of defence and may support their actions by way of consultation, but without the possibility to impact the decisions taken. The function is performed in accordance with the Bank’s internal regulations concerning the operation of the internal control system.
The independence of the lines consists of ensuring organizational separation at the following levels:
- the function of the second line of defence with regard to creating system solutions is independent of the function of the first line of defence;
- the function of the third line of defence is independent of the functions of the first and second lines of defence.
Risk management within the Group
The Bank, as the parent entity in the Group, defines the key risk management rules applied in the Bank’s Group, supervises implementation of the risk management principles in entities in the Group, resulting from the risk management strategy, taking into account the adequacy of such rules to the operations of entities in the Bank’s Group, and also exercises control of the risk in the Bank’s Group in respect of material risk types. Entities in the Bank’s Group create and update internal regulations concerning the management of specific risks, upon consultation with the Bank and taking into account recommendations issued by the Bank and the risk management strategy.
The risk management function in the Group entities is carried out, in particular, by:
- participation of units in the Bank’s Risk Management Area or of the relevant committees of the Bank in consulting large transactions in the Group entities;
- assessments and reviews of the internal regulations concerning risk management in individual Group entities by the Bank’s units in the Risk Management Area and Compliance Department;
- reporting of the Group risks to the relevant committees of the Bank or to the Management Board;
- monitoring the strategic limits of risk tolerance for the Group.