Set out what the internal audit function, senior management and the board of directors each answer for when stress testing is governed.
The idea
Three parties answer for stress testing governance in different ways. The board of directors has ultimate responsibility. It approves the objectives and the programme, ensures resources and independence, challenges assumptions and results, and makes sure stress testing informs risk appetite, capital and liquidity decisions and strategy. Senior management implements the programme the board approved. It ensures the framework works in practice with adequate data, systems and staff, reviews the results and limitations, decides or recommends actions, and keeps the board properly informed. Internal audit is the third line. It independently and periodically assesses the framework and its adherence to policy, including whether validation and controls operate effectively, and reports findings upward. Internal audit does not design scenarios or own the models. A common exam trap is giving the board or audit the day-to-day work that belongs to management.
A practice question
Which body has ultimate responsibility for a bank's stress testing programme?
- The internal audit functionWhy not: Internal audit provides independent assessment, not ownership of the programme.
- The board of directors - correct
- The model validation teamWhy not: Validation checks models; it does not hold ultimate responsibility for the programme.
- The head of the trading deskWhy not: The business line being tested is not responsible for governance of the programme.
The board is ultimately responsible: it approves the programme and objectives and ensures that results inform strategy, risk appetite, capital and liquidity decisions.
A harder one
Which of the following best describes what the board should do in stress testing governance?
- Approve objectives and the programme, challenge assumptions and results, and ensure results inform risk appetite and capital planning. - correct
- Build and run the stress models itself, with directors choosing scenarios, so that results are free of management influence and bias.Why not: Building and running models is management's work, not the board's.
- Receive stress results only through regulators and not review them internally.Why not: The board should receive and challenge results itself.
- Become involved only when stress results are poor, leaving routine results to staff.Why not: The board has continuing responsibility, not just when results are poor.
The board sets direction and holds management to account: it approves the programme, challenges what it is told and makes sure the results are used in decisions.
The hardest tier
Internal audit finds that the bank's stress testing models have not been validated for two years and that scenarios reflect only suggestions from the trading desks. Which follow-up is most consistent with governance responsibilities?
- Internal audit should itself revalidate the models and redesign the scenarios so that the problems are fixed immediately.Why not: Doing so would make audit part of the process it must independently assess.
- Internal audit reports the findings upward, senior management remedies them, and the board oversees remediation. - correct
- The board should re-run the stress tests personally, since management failed.Why not: The board oversees; it does not run the programme.
- Internal audit should wait until the supervisor asks before reporting the deficiency.Why not: Audit findings are reported upward without waiting for supervisors.
Audit identifies and reports. Senior management owns remediation of the programme. The board oversees that the deficiencies are addressed.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →More in Stress Testing
- Outline why stress testing is used as a risk management tool.
- Describe where stress testing sits alongside other risk measures, especially when it is done enterprise-wide.
- Compare how stressed VaR and stressed ES are determined with the way traditional VaR and ES are determined, describing the advantages and disadvantages of the stressed measures.
- Explain what must be weighed, and what proves difficult, when scenarios for stress testing are developed and stress testing models are built.
- Give an example of regulatory stress testing and describe what reverse stress testing is.
- Outline how validation, independent review, and policies and procedures each feature in stress testing governance.
- Outline the Basel stress testing principles that apply to banks when they put stress testing into practice.