Here is the article in Markdown format:

Effective Risk Management in Central Banks: Managing Policy Risks Outside the Formal Three Lines of Defense Model

A crucial aspect of effective risk management in central banks is ensuring that policy risks are managed outside of the formal three lines of defense model, through the establishment of effective governance structures.

Clear Definition of Risk Management Roles and Responsibilities

To achieve this, it is essential to clearly define risk management roles and responsibilities. The Risk Management Framework should be drafted, reviewed, and approved by the board, taking into account a phased approach to implementation as recommended by the mission team. This will ensure that each department has a clear understanding of its first-line defense responsibilities and can effectively discharge them.

Adequate Resourcing of Second Line Risk Management Function

Additionally, it is crucial to ensure adequate resourcing of the second line risk management function. Top-down leadership sponsorship of the risk management unit (RMU) is required, along with adequate training and capacity for staff to operationalize risk management analysis and reporting. This will enable the RMU to provide support for leadership to maintain governance oversight of risks on a quarterly basis.

Establishment of Risk Working Group

The mission team also observed a governance gap in that there is currently no regular executive-level governance committee or working group that maintains ongoing oversight of the central bank’s risk profile. Therefore, it is recommended that a Risk Working Group (RWG) be established, chaired by the deputy governor. The RWG will maintain oversight on the accuracy of risks being identified, both top-down and bottom-up, and align on the aggregate risk profile.

Risk Oversight in Board Agenda

It is also essential to include risk management as a recurring item on the executive and board agendas. Risk management is a core enabler to the successful execution of any strategic plan, and it forms an important input into decisions on resource allocation. The minutes and action log from the RWG should be provided to the executive and board for information.

Risk Oversight in Board Audit Committee Terms

Finally, it is recommended that risk oversight be included in the terms of reference for the Board Audit Committee (BAC). This will enable the BAC to split its meetings into agenda items for both risk and control oversight. An effectiveness review survey of the BAC should also be completed at the end of the first year.

Risk Appetite and Tolerances

A key aspect of effective risk management is defining a risk appetite, which articulates the tolerance levels that an organization is willing to accept in pursuit of its mandate and associated business objectives. The absence of a clearly defined and board-approved risk appetite or associated risk thresholds can lead to inconsistent and ineffective internal risk governance.

Conclusion

==========

Managing policy risks outside of the formal three lines of defense model requires effective governance structures, clear definition of roles and responsibilities, adequate resourcing of second-line risk management function, establishment of a Risk Working Group, and inclusion of risk oversight in board agendas. A defined risk appetite is also crucial to ensure consistent and effective internal risk governance.

Risk Appetite Statement

==========================

A Risk Appetite Statement (RAS) defines the approach to managing strategic, financial, and operational risks, including subcategories of each. A risk tolerance is then set for each subcategory, representing a series of risk limits that should not be breached, and to support escalation and enhanced oversight if risk exposures are at the upper limit or have been breached for a short period of time.

By implementing these measures, central banks can ensure effective management of policy risks and maintain a strong foundation for overall risk governance.