A. Board of Directors

Principle 1:

In order to carry out its responsibilities, the board of directors in a bank should approve strategies and policies with respect to interest rate risk management and ensure that senior management takes the steps necessary to monitor and control these risks. The board of directors should be informed regularly of the interest rate risk exposure of the bank in order to assess the monitoring and controlling of such risk.

1. The board of directors has the ultimate responsibility for understanding the nature and the level of interest rate risk taken by the bank. The board should approve broad business strategies and policies that govern or influence the interest rate risk of the bank. It should review the overall objectives of the bank with respect to interest rate risk and should ensure the provision of clear guidance regarding the level of interest rate risk acceptable to the bank. The board should also approve policies that identify lines of authority and responsibility for managing interest rate risk exposures.

2. Accordingly, the board of directors is responsible for approving the overall policies of the bank with respect to interest rate risk and for ensuring that management takes the steps necessary to identify, measure, monitor, and control these risks. The board or a specific committee of the board should periodically review information that is sufficient in detail and timeliness to allow it to understand and assess the performance of senior management in monitoring and controlling these risks in compliance with the bank's board-approved policies. Such reviews should be conducted regularly, being carried out more frequently where the bank holds significant positions in complex instruments. In addition, the board or one of its committees should periodically re-evaluate significant interest rate risk management policies as well as overall business strategies that affect the interest rate risk exposure of the bank.

3. The board of directors should encourage discussions between its members and senior management - as well as between senior management and others in the bank - regarding the bank's interest rate risk exposures and management process. Board members need not have detailed technical knowledge of complex financial instruments, legal issues, or of sophisticated risk management techniques. They have the responsibility, however, to ensure that senior management has a full understanding of the risks incurred by the bank and that the bank has personnel available who have the necessary technical skills to evaluate and control these risks.

B. Senior Management

Principle 2:

Senior management must ensure that the structure of the bank's business and the level of interest rate risk it assumes are effectively managed, that appropriate policies and procedures are established to control and limit these risks, and that resources are available for evaluating and controlling interest rate risk.

1.Senior management is responsible for ensuring that the bank has adequate policies and procedures for managing interest rate risk on both a long-term and day-to-day basis and that it maintains clear lines of authority and responsibility for managing and controlling this risk. Management is also responsible for maintaining:

• appropriate limits on risk taking;
• adequate systems and standards for measuring risk;
• standards for valuing positions and measuring performance;
• a comprehensive interest rate risk reporting and interest rate risk management review process; and
• effective internal controls.

2. Interest rate risk reports to senior management should provide aggregate information as well as sufficient supporting detail to enable management to assess the sensitivity of the institution to changes in market conditions and other important risk factors. Senior management should also review periodically the organisation's interest rate risk management policies and procedures to ensure that they remain appropriate and sound. Senior management should also encourage and participate in discussions with members of the board and, where appropriate to the size and complexity of the bank, with risk management staff regarding risk measurement, reporting and management procedures.

3. Management should ensure that analysis and risk management activities related to interest rate risk are conducted by competent staff with technical knowledge and experience consistent with the nature and scope of the bank's activities. There should be sufficient depth in staff resources to manage these activities and to accommodate the temporary absence of key personnel.

C. Lines of Responsibility and Authority for Managing Interest Rate Risk

Principle 3:

Banks should clearly define the individuals and/or committees responsible for managing interest rate risk and should ensure that there is adequate separation of duties in key elements of the risk management process to avoid potential conflicts of interest. Banks should have risk measurement, monitoring and control functions with clearly defined duties that are sufficiently independent from position-taking functions of the bank and which report risk exposures directly to senior management and the board of directors. Larger or more complex banks should have a designated independent unit responsible for the design and administration of the bank's interest rate risk measurement, monitoring and control functions.

1. Banks should clearly identify the individuals and/or committees responsible for conducting all of the various elements of interest rate risk management. Senior management should define lines of authority and responsibility for developing strategies, implementing tactics and conducting the risk measurement and reporting functions of the interest rate risk management process. Senior management should also provide reasonable assurance that all activities and all aspects of interest rate risk are covered by a bank's risk management process.

2. Care should be taken to ensure that there is adequate separation of duties in key elements of the risk management process to avoid potential conflicts of interest. Management should ensure that sufficient safeguards exist to minimise the potential that individuals initiating risk-taking positions may inappropriately influence key control functions of the risk management process such as the development and enforcement of policies and procedures, the reporting of risks to senior management, and the conduct of back-office functions. The nature and scope of such safeguards should be in accordance with the size and structure of the bank. They should also be commensurate with the volume and complexity of interest rate risk incurred by the banks and the complexity of its transactions and commitments. Larger or more complex banks should have a designated independent unit responsible for the design and administration of the bank's interest rate risk measurement, monitoring and control functions. The control functions carried out by this unit, such as administering the risk limits, are part of the overall internal control system.

3. The personnel charged with measuring, monitoring and controlling interest rate risk should have a well-founded understanding of all types of interest rate risk faced throughout the bank.