SAFETY AND SOUNDNESS—Interest-Rate Risk; Frequently Asked Questions Regarding Interagency Advisory

The financial regulators¹ have received several requests to clarify points in the 2010 interagency Advisory on Interest Rate Risk Management (the advisory). This “Frequently Asked Questions” document responds to the most common questions.

The advisory reiterates the need for sound management of interest rate risk (IRR) and highlights sound practices. Each of the financial regulators has published guidance on interest rate risk management (see the appendix). Although the specific guidance issued and the oversight and surveillance mechanisms used by the regulators may differ, supervisory expectations for sound IRR management are consistent. Ultimately, consistent with the agencies’ safety and soundness guidelines, financial institution management is responsible for ensuring that the capabilities of the risk management process match the risks being taken. The regulators expect all institutions to manage IRR exposures using processes and systems commensurate with earnings and capital levels, complexity, business models, risk profiles, and the scope of operations.

One of the underlying principles of effective risk management is that the depth and capabilities of risk management processes should be sufficient for the complexity and magnitude of risks being taken. This document provides examples of risk management expectations for institutions of various risk profiles, and it includes direction on how to adjust processes as profiles change. Each financial regulator, in the examination process, assesses whether an institution’s IRR measurement process is adequate for its complexity and risk profile.

Q1. How should financial institutions determine which IRR vendor models are appropriate?

A1. Models can vary significantly depending on complexity, data management, and cost. Achieving the proper balance among risk positions, risk measurement processes, and cost is critical to a successful model risk management program. When creating an IRR model or evaluating third-party models, institution management should thoroughly assess the model’s ability to reasonably capture risks in the institution. Additionally, management should reevaluate the model’s appropriateness as risk positions, strategies, and activities change. When reviewing modeling options, management should at a minimum consider the following:

To better control third-party model risk, financial regulators expect financial institutions to have sufficient in-house knowledge in case vendors or financial institutions terminate contracts for any reason, or if vendors are no longer in business. Financial institutions should maintain contingency plans for addressing how management should respond to such lapses in vendor support.

Q2. If an institution implements a new strategy and later finds that its IRR measurement model cannot capture the risk exposure, could this raise significant supervisory concerns?

A2. Yes. All potential risk exposures, including IRR, posed by new products or strategies should be considered as part of the due diligence for any new strategy. If a new strategy involves IRR that cannot be adequately captured by existing measurement processes, steps should be taken to ensure this risk can be adequately measured before implementation of the strategy. The cost of measuring the change in exposure from a new product or strategy also should be considered an essential part of the due diligence process. For example, if an institution were to implement a leverage strategy using highly structured liabilities to fund fixed-rate mortgage investments or whole loans, this type of strategy could introduce a significant level of option risk to the institution’s IRR risk profile. If existing IRR measurement tools do not adequately capture the potential volatility in cash flows and rate adjustments from the newly acquired assets and liabilities, the model would not be able to adequately capture this option risk. Therefore, management would not be able to measure the IRR exposure accurately. This would likely be considered a management weakness, and corrective actions could include making the appropriate changes or enhancements to the model. In some cases where on- or off-balance-sheet items cannot be effectively measured in the primary IRR model, it may be appropriate to use alternative means to measure the risk in such products, where the alternative output is then incorporated into the primary model results (i.e., add-ons). Financial regulators expect risk managers to consider the ability of current systems to model risks posed by a new strategy in advance to understand how new products or strategies affect overall IRR exposure.²

Q3. What types of IRR measurement methodologies are institutions expected to use?

A3. Institutions should measure the potential impact of changes in market interest rates on both earnings and the economic value of capital.³ Measurement methodologies generally focus on either changes to net interest income (NII)/net income (NI), or changes to the economic value of capital over various time horizons. Income simulations are typically used to measure potential volatility in NII/NI over various time horizons (generally one to five years). Economic or market value of equity models typically cover much longer time horizons and measure risk to the economic value of capital. Institutions should use a combination of both earnings-focused and economic value of capital-focused measures to capture the full spectrum of IRR. Large and complex institutions as well as model vendors continue to develop new approaches to IRR measurement. Financial regulators will consider these new approaches on a case-by-case basis to ensure that they meet the spirit of outstanding guidance and effectively model IRR.

Since the original interagency guidance on IRR was issued by the FRB, FDIC, and OCC in 1996,⁴ the number and availability of financial products with embedded options has grown considerably. Such products, which include but are not limited to collateralized mortgage obligations, step-up notes, callable agency bonds, convertible Federal Home Loan Bank borrowings, alternative certificates of deposit, one-to-four family residential mortgage loans/securities, and commercial real estate loans/securities, present significant challenges to IRR measurement. The IRR measurement challenges arise because the timing and size of the cash flows may change considerably, depending on how interest rates vary over time. As a result, these products often carry significant prepayment or extension risk. The ability of risk measurement systems to capture the risk from these new products has also evolved over time. Institutions should manage the evolving risks in their on- and off-balance sheet positions, and a key part of this process is selecting the appropriate IRR measurement system and processes.

Institutions gain a better understanding of when rate and cash flow options may be exercised by using longer simulation time horizons. For example, significant levels of options risk embedded in assets and liabilities can cause large shifts in repricing cash flows over time. Depending on the type of scenario, and the nature of the options, these shifts may not become apparent until a simulation is projected beyond one year. This volatility in cash flows likely causes an institution’s earnings-at-risk profile to change significantly as the simulation progresses. To capture this potential “cliff effect,” exposures should be projected over at least a two-year period. To understand how risk evolves, management is encouraged to measure earnings-at-risk for each 12-month period over the simulation horizon. Although not expected for community institutions with less-complex balance sheets, longer-term simulations (five to seven years) are a useful tool to highlight option risk positions and better evaluate risk. Long-term simulations can provide a complementary metric to “risk-to-capital” measurements, allowing institutions to understand how interest rate shifts could affect future earnings over longer time horizons.

Institutions should measure the potential impact of changes in market interest rates on the economic value of capital. Measuring risk to capital generally requires institutions to use some type of long-term economic or market-value-based process. Risk to capital has traditionally been measured by analyzing the effects of various interest rate scenarios through either a long-term discounted cash flow model such as economic value of equity (EVE), net economic value (NEV), or models assessing anticipated changes in net present value (NPV) or duration.

When modeling complex products with embedded options, risk managers should not overlook the importance of data aggregation and stratification. Complex, or structured, securities should be modeled individually. Homogenous whole-loan portfolios, when possible,⁵ should be aggregated by product type, coupon band, maturity, and prepayment volatility. For adjustable-rate portfolios, management should ensure that the modeling process takes into account all loan attributes that have a material impact on IRR, including reset dates, reset indices and margins, embedded caps and floors, and any prepayment penalties.

Q4. Should institutions with non-complex balance sheets use earnings simulations to measure risk to earnings?

A4. All institutions are encouraged to use earnings simulations. Advances in technology have made simulation modeling more accessible for all institutions. Financial regulators recognize that some institutions with non-complex balance sheets may have minimal levels of embedded options in both assets and liabilities, such as products discussed in response to question #3, and have few or no derivatives. In these limited cases, onsite financial regulators assess management’s alternative measurement processes to analyze the institution’s less-complex risk profile. Based on this assessment, regulators may determine that a less sophisticated measurement process may adequately measure earnings at risk.

Q5. Should institutions perform rate shocks greater than ± 300 basis points?

A5. Generally yes. Although the advisory suggests ± 300 and ± 400 basis points as examples of meaningful stress scenarios, the decision as to which stress testing scenarios are appropriate should be based on the institution’s risk profile and current economic conditions. Institutions should consider the current level of rates relative to the normal rate cycle. In a period of extremely low rates, a +400 basis point shock would provide a meaningful stress scenario while some negative-rate scenarios that result in negative market rates would provide less value to risk managers. Therefore, during low-rate environments, institutions may increase the number of positive-rate shocks, including very large positive-rate moves, while reducing the severity of negative shocks. In other rate environments, even more extreme ramped rate curve shifts or shocks may be appropriate.

Performing extreme shocks to measure IRR should provide useful information for risk management. More extreme stress scenarios can provide important risk management insights about on- and off-balance sheet positions and exposures. Institutions are encouraged to develop robust stress testing scenarios and to adjust scenarios as conditions change.

Q6. Should all institutions analyze risk other than repricing risk (i.e., non-parallel yield curves, basis risk, and options risk)? If so, how often should risk analyses be run?

A6. The advisory states that the types of stress scenarios depend on the risk profile of the institution and the complexity of its structure and activities. All institutions are expected to run these types of scenarios periodically to fully identify significant positions in the four components of IRR: repricing mismatch, basis risk, yield curve risk, and options risk. Institutions should conduct analyses for basis, yield curve, and options risk as necessary, depending on the complexity of activities and risk profile. Generally, these analyses should be run at least annually, or when the risk profile of the institution has changed (for example, because of acquisitions, significant new products, or new hedging programs). Ideally, these analyses would be conducted for earnings calculations as well as economic value of capital measurements.

If an institution’s risk profile shows a significant sensitivity to one of these risks, this scenario should be included in the regular monthly or quarterly IRR monitoring. For example, if an institution maintains a relatively short net duration balance sheet, but uses two indices to price assets and liabilities, a basis-shift scenario may identify IRR exposures that otherwise would not be detected in an interest-rate-only scenario. For institutions that price assets primarily from long-term rates, and liabilities from short-term rates, a change in the shape of the yield curve typically would be a more appropriate scenario.

Q7. Should institutions establish board-approved thresholds for monitoring each stress scenario they run?

A7. Management should establish limits, triggers, or thresholds for stress scenarios in order to compare risk measurement results with the institution’s risk tolerance. Typically, institutions establish a set of stress scenarios as part of the regular IRR assessment process. Long-standing supervisory guidance provides that an appropriate limit system should permit management to control IRR exposures, initiate discussion about opportunities and risk, and monitor actual risk taking against predetermined risk tolerances. Risk measurements and limits generally focus on the level of volatility on earnings and capital. Stress scenarios would include board-approved risk limits and be reported regularly to the appropriate management committee and the board. Institutions may also conduct other nonstandard or less-frequently run stress tests that provide further insight into the institution’s IRR position in unique or extreme market conditions. The results of these tests should be evaluated against established risk tolerances or appropriate trend analysis and reported to the appropriate management committee. An institution’s limits system may change over time as economic conditions and the risk profile influences management to add or drop certain stress scenarios from regular reporting. Stress tests, either standard or nonstandard, that reflect significant IRR exposure and/or exceed established risk tolerance measures should be reported to the board or appropriate board committee.

Q8. When no growth scenarios for measuring earnings simulations are mentioned, can you clarify what no growth means?

A8. “No growth” refers to maintaining a stable balance sheet (both size and mix) throughout the modeling horizon. Financial regulators are concerned that including asset growth in model inputs can reduce the amount of IRR identified in model outputs. For example, if model inputs predict significant loan growth occurring after a rate shock, new loans are often assumed to be made at higher interest rates. This has the effect of reducing the level of IRR identified by the model. If this assumed growth does not occur, the model would underreport actual IRR exposure.

Institutions should recognize and understand how growth affects model output. Management should run scenarios that maintain the balance sheet constant across the simulation horizon. These types of scenarios help highlight the current level of risk in the institution’s positions without the effects of growth assumptions. As a sound practice, management could contrast the “no growth” scenario with scenarios that include growth assumptions to highlight how future growth may change the institution’s risk profile.

Q9. Most institutions use third-party tools to measure IRR. Can independent certifications/validations commissioned by model vendors satisfy supervisory expectations for model validations?

A9. No. Financial regulators expect each financial institution to ensure that the selected model is appropriate for its IRR profile by conducting an independent review and validation and performing ongoing monitoring and back-testing to confirm model appropriateness. Although a useful tool, model certifications/validations commissioned by vendors would likely not completely satisfy supervisory expectations regarding validation of the use of vendor products. As part of the validation process, institutions need to ensure that the mechanics and mathematics of the IRR model are functioning as intended. The advisory recognizes that most community institutions use largely standardized vendor-provided models, and in such cases validations provided by vendors can be used to support the model mechanics and mathematic calculations. For models that are customized to an individual institution or in situations where the vendors are unable or unwilling to provide appropriate certifications or validations, management would be responsible for validating the mechanics and mathematics of the model work as expected.

An effective validation framework is a critical part of an institution’s model risk governance process. An effective model validation policy has three key elements:⁶

Model certifications/validations commissioned by vendors are a useful part of an institution’s efforts to evaluate the model’s conceptual soundness and understanding of developmental efforts. Although many vendors offer services for process verification, benchmarking, and back-testing, these are usually separate engagements, and each institution should ensure these engagements meet its internal policy requirements for validation and independent review. Financial institutions should discuss with vendors what validation or internal control process assessments have been conducted.

Vendors should be able to provide clients with appropriate testing results to show their product works as expected. They should also clearly indicate the model’s limitations and assumptions and when the product’s use may be problematic. Such disclosures, within the bounds of confidential or proprietary information, should contain useful insights regarding model implementation and outputs. These insights can help institutions design a more effective model validation framework.

Vendor models are often designed to provide a range of capabilities and may need to be customized by an institution. Management should document and justify the institution’s customization choices as part of the validation process. If vendors provide input data or assumptions, management should evaluate the relevance of this data to the financial institution. Further, institutions should obtain information regarding the data (for example, vendor-derived assumptions) used to develop the model and assess whether the data is representative of the institution’s situation.

Management should conduct ongoing monitoring and outcomes analysis of model performance using the institution’s results (back-testing). Through ongoing monitoring efforts, management should evaluate whether changes in such variables as products, activities, or market conditions require model adjustment or replacement. Process verification ensures that internal and external data inputs continue to be accurate, complete, and consistent with model purpose and design. Using back-testing analysis, management can determine whether differences between forecasted and actual results stem from errors in model setup, model assumptions, or other factors such as market changes.

Q10. Can you provide some examples of effective back-testing practices?

A10. Many institutions back-test model outcomes by determining the key drivers of differences between actual net-interest margin re sults and the modeled net-interest margin for a given period. This type of analysis attempts to explain the differences by isolating when key drivers, such as actual interest rates, prepayment speeds, other runoff, and new volumes, varied from the assumptions used in the model run. Tracking these variances over time helps to determine when key assumptions may need to be recalibrated. Isolating these key drivers in back-testing analysis is also important since testing too many variables at the same time produces unreliable and less meaningful results. Periodically comparing offering rates with modeled behavior also ensures that the model input reflects the institution’s current business practices. Sensitivity testing may also inform assumption analysis by highlighting the assumptions that have a strong influence on model output.

Q11. Can an institution use industry estimates for non-maturity-deposit (NMD) decay rates?

A11. Institutions should use assumptions that reflect the institution’s profile and activities and generally avoid reliance on industry estimates or default vendor assumptions. Some institutions, however, have difficultly measuring decay rates on NMDs because of limitations on their systems’ ability to provide necessary data, acquisitions or mergers, or possibly a lack of technical expertise. Industry averages provide an approximation but may not be a suitable estimate in every case. For example, customer types and behaviors are inconsistent across geographic areas and are likely to produce very different deposit decay rates from one institution to another. Industry estimates should be a starting point until sufficient internal data sets can be developed. An institution can contract with an outside vendor to assist with this process if necessary. For any key assumptions, back-testing should be performed to determine whether assumption estimates are reasonable.

Q12. Regarding deposit decay-rate assumptions, what are some examples of a “market environment in which customer behaviors may not reflect long-term economic fundamentals?”

A12. Management should carefully consider deposit and NMD decay-rate assumptions, particularly when customer behaviors change during periods of stress as well as external factors that may influence that behavior. For example, customers’ flight to quality (insured deposits) during times of stress might influence NMD decay rates. Additionally, the deterrence value of prepayment penalties during times of near-zero interest rates (penalty becomes negligible) might influence time-deposit decay rates. Similar considerations should be given to other key rate drivers and prepayment assumptions used in the IRR model.