4. Stress Testing Framework
Banks are required to design, develop and implement a sound and robust stress testing frameworks. They are expected to ensure compliance of the following minimum requirements in this regard:
4.1. Approach to Stress Testing
i. Banks must adopt a holistic approach to stress testing, which means that all material risks (whether internal or external) to which the bank is or can be exposed to, should be covered in the stress testing process;
ii. The magnitude of the shock should be large enough to stress exposure of the bank to various risks;
iii. Banks should aim to capture all exceptional but plausible events in the scenario selection process;
iv. The stress tests should take into account the recent developments in domestic, regional and global financial markets as well as all other relevant developments;
v. The time horizon for capturing historical events for stress testing should be long enough to cover a period relevant to the portfolio of the bank;
4.2. Stress Testing Process
Banks should document the entire process of stress testing for the guidance of the concerned staff. This may become part of the bank’s policy on stress testing or included in its standard operating procedures. The process to be laid down by the banks should, inter alia, cover the following points:
i. Assigning the responsibility for conducting stress tests. This responsibility may be assigned to the Chief Risk Officer who should be supported by a team (which may be an inter-departmental team or a dedicated unit created for this purpose);
ii. Defining the responsibilities of the team members or individuals involved in stress testing;
iii. Determining the frequency of regular stress tests in line with the regulatory requirements and also defining the parameters which should lead the bank to conduct ad-hoc stress tests;
iv. Reviewing the composition and nature of the bank’s portfolio as well as the external factors affecting the quality of this portfolio in order to identify the major risks to which the bank is exposed to and which should be tested under its stress testing program;
v. Reviewing the historical data to identify the past events relevant to the bank’s portfolio, which can be used in designing the appropriate stress tests. Banks are expected to compile a time series of relevant data covering at least one business cycle;
vi. Determining the magnitude of shocks based on the identified historical events, future outlook and expert judgment;
vii. Deciding on the type of stress tests to be conducted. This would involve a choice to either use a sensitivity analysis or a scenario analysis or a combination of both;
viii. Listing the assumptions to be used in stress testing and articulating the basis of such assumptions;
ix. Documenting the procedures for conducting stress tests and compiling the results thereof;
x. Determining the procedure to be adopted for communicating results of stress tests to the board of directors, relevant board and management committees, senior management, relevant business areas and SAMA;
xi. Determining the procedure to be adopted for taking remedial actions to mitigate the potential risks highlighted by the stress tests;
xii. Laying down the criteria and factors which should lead the bank to review the effectiveness of its stress testing program. This may include, for instance, significant changes in bank’s activities or portfolio characteristics or operating environment.
4.3. Designing Stress Tests
Banks are expected to take into account the following factors in designing their stress testing programs:
i. The overall stress testing process should be managed/coordinated by the Chief Risk Officer of the bank;
ii. Stress testing process should identify and stress all relevant risks faced by the bank. This should cover all risks prevalent in the entire portfolio of the bank including both on-balance sheet and off-balance sheet positions;
iii. The frequency of stress tests should be determined in line with the requirements set out under Section 2.4;
iv. The stress scenarios should be developed by using both quantitative and qualitative factors and can be based on historical events and/or expert judgment;
v. The adequacy of IT system and availability of required data for conducting robust stress tests. The IT system should be capable of producing aggregate data at portfolio level as well as granular data at the level of business units;
vi. The effectiveness of the bank’s stress testing framework. The stress testing program may be independently evaluated by the bank’s internal audit function or by a third-party consultant engaged for this purpose.
4.4. Other Requirements
As part of their stress testing frameworks, banks shall also specify the methodologies and techniques to be used, choice of scenarios, coverage of risks, procedures for compiling and communicating results, thresholds and options for taking remedial actions, and the process for compliance of regulatory reporting requirements. Detailed requirements in this regard are set out in the ensuing parts of these Rules.