Risk manager: Bank of Portugal

The Bank of Portugal has spent the past eight years developing its comprehensive risk framework, which covers strategic risks, as well as financial and non-financial risks. As part of this long-running effort, the eurozone central bank has established an effective risk management committee. And, in the past year, it was able to undertake important risk-related exercises, such as an asset management review.

The creation of an integrated risk management department and the reform of its risk framework was initially supported by former governor Carlos Costa, and the current governor, Mário Centeno, and board member Ana Paula Serra have also backed the effort. “[Without their leadership and support], we wouldn’t have evolved so much over these eight years,” says Gabriel Andrade, director of the central bank’s risk management department. Indeed, Centeno has supported even “faster development” of “some of the initiatives we had in the pipeline”, including “the board’s strategic risk assessment”, adds Andrade.

Prior to its overhaul, the Bank of Portugal ran risk via a middle office within the markets department and an operational risk unit independent from all other departments. To better monitor all risks, governor Costa approved the creation of a unified risk management department. To bring about this institutional change, the central bank hired Andrade from the private sector in 2014 to develop the new structure.

The new strategy has resulted in sweeping changes. The institution created a risk committee in 2017, as well as two subcommittees: one is focused on financial risks; and the other on non-financial risks. Additionally, the annual risk committee gathers all departments and board members to reflect on the main risks faced by the Bank of Portugal.

The risk management committee includes staff members embedded in all departments across the central bank. These risk managers are the key points of contact for each department, allowing them to have an up-to-date view on all risks.

The subcommittee on non-financial risks covers elements including operational risks, cyber security and facility/security management. This new body proved especially valuable during the coronavirus pandemic. In a working-from-home environment, “it became a key communication tool for all departments, even for the board”, says Andrade.

New analytical capabilities

The financial risk subcommittee is tasked with reviewing the Bank of Portugal’s benchmark and strategic asset allocation (SAA). It has set up working groups on asset management, and reviews the performance of the central bank’s assets. These new capabilities have allowed the institution to better understand its investments and risks.

One example was the central bank’s foreign currency portfolio. “It was managed regularly, yielded profits, but it was not viewed through the lens of strategic management,” says Andrade. “We were able to look at the overall influence that the portfolio had for the risk management function, and also for the bank’s risk management profile.”

The new analytical approach demonstrated interdependencies between portfolios, and made the board aware of asset concentrations, particularly in some currency exposures. As a result, the Bank of Portugal modified some of its investment positions.

The risk management department has also completed the review of other long-term investments, based on which it made recommendations to the board, which decided to adapt its rules to make the portfolio more up to date.

The central bank is developing a software tool to optimise its benchmark and SAA. Work done by the European Central Bank was harnessed to develop models that estimate variables such as profitability and macroeconomic scenarios. Specifically, the Bank of Portugal uses two ECB models: one for 10-year projections of profitability, and profit-and-loss estimation; and the other for financial risk estimates in credit and market risk. Both models were developed by the ECB directorate risk management, and the Bank of Portugal has adjusted them to its needs. The central bank has embedded two staff members – one for three years, and the other for one year – at the ECB to work on this project and familiarise themselves with the tools available. The ultimate goal is to replace the current external software model.

During the past year, the risk management department has also completed a strategic asset management review. It did so by establishing a steering committee with oversight of the project to assess the Bank of Portugal’s benchmark.

“We’ve had interviews with internal and external experts on financial risk management to analyse specific asset classes,” says Andrade. The study has determined the “kind of asset classes we can have, what kind of risks we can incur and what kind of legal limitations we face”, he adds.

This has also included the adoption of environmental, social and governance criteria to determine how the institution can embark on sustainable investment.

All these initiatives were reflected in an internal policy document published last year. Presented to the board in 2021, it covers the institutional organisation, policy tools, stakeholders involved in every workstream. It also includes the division of risk management into strategic, financial and non-financial risk. And it also identifies the central bank’s key risk indicators, rules, internal controls, self-assessment, guidelines and continuity management.

International engagement

Back in 2014, Andrade’s team was tasked with reviewing the central bank’s business continuity plan. The team comprised staff members from various departments and included a budget for external consulting. One of the first modifications Andrade implemented was to stop using consultants, and instead start directly visiting other central banks and multi-lateral institutions – so the team itself secured knowledge of best practice.

His team visited the US Federal Reserve System and the Bank for International Settlements, and has frequent interactions with the ECB. In the US, the Bank of Portugal’s engagement with the Federal Reserve Bank of Philadelphia focused on operational risk matters, while dealings with the New York Fed focused on financial and non-financial risk.

“These visits opened the door to international exchanges, which have been key in our development,” says Andrade.

Another milestone has been the Portuguese central bank’s engagement with the International Operational Risk Management Working Group. The group counts 110 central banks from around the world that are working to develop a global operational risk management database, among other initiatives. The group uses a ‘maturity model’, developed by the Central Bank of Brazil, to measure the development of the operational risk modelling frameworks of central banks. It’s the sort of adoption that highlights the advancements at the Bank of Portugal. Out of 67 central banks taking part in the Brazilian central bank’s exercise, the Bank of Portugal climbed from the ‘top 30’ in 2017 to the ‘top seven’ by 2021.

The Central Banking Awards were written by Christopher Jeffery, Daniel Hinge, Dan Hardie, Victor Mendez-Barreira, Ben Margulies and Riley Steward