Risk Management System

Introduction

Among the primary objectives of risk management is to limit adverse gaps in earnings and equity though managing risk exposures and capital within agreed limits. This ensures attainment of the Bank’s growth plans in a controlled environment. Managing and controlling risk, minimizing undue concentrations of exposures and limiting potential losses from stress events are among the essential elements of the Bank’s risk management and control framework. This framework ultimately ensures the protection of the Bank’s reputation and is consistent with our objective of increasing shareholder value.

PNB, as a group, complies with the Internal Capital Adequacy Assessment Process (ICAAP) as required under Pillar 2 of Basel II requirements. In undertaking the ICAAP, the bank ensures that appropriate processes are in place to comply with its planned capital requirements in view of the risks related to doing business both under “business as usual (BAU)” and under stressed scenarios. ICAAP requires the Bank to identify and assess risks, maintain sufficient capital to face these risks and apply appropriate risk management techniques to ensure adequate capitalization on an ongoing basis.

At PNB, we place a high priority on risk management and are taking steps to continue to refine our framework for risk management, including the identification and control of the risks associated with our operational activities.

The Board and its Risk Oversight Committee operate as the highest level of PNB’s risk governance. At management level, risk governance is undertaken by a structured hierarchy of committees each with specified accountabilities. The continues flow of information between the board and board-level committees and the corresponding management committees; allow for consistent evaluation of the risks inherent in the business, raise the alarms, if any, and manage the business effectively with strong adherence to process management guidelines and controls.

Enterprise Risk Management Framework

The Bank’s philosophy is that responsibility for risk management resides at all levels within the Bank and therefore uses the three lines model:

• Management: First & Second line roles – Management’s responsibility to achieve organizational objectives comprises both first and second line roles.
  
  • First line roles are the lines of business who are directly involved in managing risks. This entails the proactive self-identification of risks as well as the design and implementation of appropriate controls.
  • The second line roles are the support units who provide expertise and insight to the first line in managing risks. For the Bank, second line roles include the Enterprise Risk Management Group (ERMG) and Global Compliance Group (GCG).


• Internal Audit: Third line roles – Internal audit provides independent and objective assurance and advice on the adequacy and effectiveness of the Bank’s control, governance and risk management processes. It reports its findings to Management and the BACC to promote and facilitate continuous improvement. Internal audit’s independence from the responsibilities of management is critical to its objectivity, authority, and credibility. It is established through accountability to the governing body, unfettered access to people, resources and data needed to complete its work; and freedom from bias or interference in the planning and delivery of audit services.

The PNB Board Risk Oversight Committee is created by the PNB Board of Directors to assist the board to oversee the risk profile and approves the enterprise risk management framework of PNB and its related allied subsidiaries and affiliates. It is mandated to advise on the risk appetite, approve frameworks, policies and processes for managing risk, and accept risks beyond the approval discretion provided to management.

The risk management policy includes:

• a comprehensive risk management approach;
• a detailed structure of limits, guidelines and other parameters used to govern risk-taking;
• a clear delineation of lines of responsibilities for managing risk;
• an adequate system for measuring risk; and
• effective internal controls and a comprehensive monitoring and risk-reporting process; and
• adherence to standards and regulations.