Skip to main content
Custom print
Download Original PDF

Qualitative Standards

Effective from Dec 28 2022 - Dec 31 2022
To view other versions open the versions tab on the right

10.5In order to use the IMA to determine market risk capital requirements, the bank must have market risk management systems that are conceptually sound and implemented with integrity. Accordingly, the bank must meet the qualitative criteria set out below on an ongoing basis. SAMA will assess that the bank has met the criteria before the bank is permitted to use the IMA.
 		 
10.6The bank must have an independent risk control unit that is responsible for the design and implementation of the bank’s market risk management system. The risk control unit should produce and analyse daily reports on the output of the trading desk’s risk management model, including an evaluation of the relationship between measures of risk exposure and trading limits. This risk control unit must be independent of business trading units and should report directly to senior management of the bank.
 		 
10.7The bank’s risk control unit must conduct regular backtesting and PLA assessments at the trading desk level. The bank must also conduct regular backtesting of its bank-wide internal models used for determining market risk capital requirements.
 		 
10.8A distinct unit of the bank that is separate from the unit that designs and implements the internal models must conduct the initial and ongoing validation of all internal models used to determine market risk capital requirements. The model validation unit must validate all internal models used for purposes of the IMA on at least an annual basis.
 		 
10.9The board of directors, relevant board committee and senior management of the bank must be actively involved in the risk control process and must devote appropriate resources to risk control as an essential aspect of the business. In this regard, the daily reports prepared by the independent risk control unit must be reviewed by a level of management with sufficient seniority and authority to enforce both reductions of positions taken by individual traders and reductions in the bank’s overall risk exposure.
 		 
10.10Internal models used to determine market risk capital requirements are likely to differ from those used by a bank in its day-to-day internal risk management functions. Nevertheless, the core design elements of both the market risk capital requirement model and the internal risk management model should be the same.
 		 
 (1)Valuation models that are a feature of both models should be similar. These valuation models must be an integral part of the internal identification, measurement, management and internal reporting of price risks within the bank’s trading desks.
 
 (2)Internal risk management models should, at a minimum, be used to assess the risk of the positions that are subject to market risk capital requirements, although they may assess a broader set of positions.
 
 (3)The construction of a trading desk risk management model must be based on the methodologies used in the bank’s internal risk management model with regard to risk factor identification, parameter estimation and proxy concepts and deviate only if this is appropriate due to regulatory requirements. A bank’s market risk capital requirement model and its internal risk management model should address an identical set of risk factors.
 
10.11A routine and rigorous programme of stress testing is required. The results of stress testing must be:
 		 
 (1)reviewed at least monthly by senior management;
 
 (2)used in the bank’s internal assessment of capital adequacy; and
 
 (3)reflected in the policies and limits set by the bank’s management and its board of directors.
 
10.12Where stress tests reveal particular vulnerability to a given set of circumstances, the bank must take prompt action to mitigate those risks appropriately (eg by hedging against that outcome, reducing the size of the bank’s exposures or increasing capital).
 		 
10.13The bank must maintain a protocol for compliance with a documented set of internal manuals, policies, controls and procedures concerning the operation of the internal market risk management model. The bank’s risk management model must be well documented. Such documentation may include a comprehensive risk management manual that describes the basic principles of the risk management model and that provides a detailed explanation of the empirical techniques used to measure market risk.
 		 
10.14The bank must receive approval from SAMA prior to implementing any significant changes to its internal models used to determine market risk capital requirements.
 		 
10.15The bank’s internal models for determining market risk capital requirements must address the full set of positions that are in the scope of application of the model. All models’ measurements of risk must be based on a sound theoretical basis, calculated correctly, and reported accurately.
 		 
10.16The bank’s internal audit and validation functions or external auditor must conduct an independent review of the market risk measurement system on at least an annual basis. The scope of the independent review must include both the activities of the business trading units and the activities of the independent risk control unit. The independent review must be sufficiently detailed to determine which trading desks are impacted by any failings. At a minimum, the scope of the independent review must include the following:
 		 
 (1)the organisation of the risk control unit;
 
 (2)the adequacy of the documentation of the risk management model and process;
 
 (3)the accuracy and appropriateness of market risk management models (including any significant changes);
 
 (4)the verification of the consistency, timeliness and reliability of data sources used to run internal models, including the independence of such data sources;
 
 (5)the approval process for risk pricing models and valuation systems used by the bank’s front- and back-office personnel;
 
 (6)the scope of market risks reflected in the trading desk risk management models;
 
 (7)the integrity of the management information system;
 
 (8)the accuracy and completeness of position data;
 
 (9)the accuracy and appropriateness of volatility and correlation assumptions;
 
 (10)the accuracy of valuation and risk transformation calculations;
 
 (11)the verification of trading desk risk management model accuracy through frequent backtesting and PLA assessments; and
 
 (12)the general alignment between the model to determine market risk capital requirements and the model the bank uses in its day-to-day internal management functions.