Reserve Bank of Australia Annual Report – 2023 3.3 Risk Management

Objectives and governance structure

The Reserve Bank, like any organisation, cannot achieve its objectives without taking some risk. To help manage risk, the Bank has implemented the ‘three lines model’:

• The ‘first line’ are departments – as ‘risk owners’, departments are responsible for evaluating their risk environment, putting in place appropriate controls and ensuring these controls are implemented effectively.
• The ‘second line’ is Risk and Compliance Department – it provides additional expertise, monitoring and challenge, particularly in areas where the inherent risks are higher.
• The ‘third line’ is Audit Department – it provides independent assurance and advice.

The Bank identifies, assesses and manages risk at both an enterprise (‘top-down’) and business (‘bottom-up’) level. Risks are managed to a level that is consistent with the Bank’s risk appetite, as articulated by the Bank’s management. The Bank supports and promotes the development and maintenance of an active risk management culture that acknowledges the need for careful analysis and management of risk in all business processes.

Oversight of the Bank’s arrangements for risk management is undertaken by the Risk Management Committee (RMC). The RMC is chaired by the Deputy Governor and comprises: the Assistant Governors for Business Services, Corporate Services and Financial Markets groups; the Chief Risk Officer; the Chief Financial Officer; the Chief Information Officer; the Heads of the Audit, Human Resources and Information departments; and the General Counsel. The RMC meets at least six times each year and informs the Executive Committee and the Reserve Bank Board Audit Committee of its activities.

The RMC is responsible for ensuring the proper assessment and effective management of all the risks faced by the Reserve Bank, with the exception of those arising directly from its monetary and financial stability policies and payments policy functions. These risks remain the responsibility of the Governor, the Reserve Bank Board and the Payments System Board. The risks associated with the Bank’s ownership of Note Printing Australia Limited (NPA) are overseen by the Reserve Bank Board, while the risks of operating NPA are overseen by the NPA Board and management.

The RMC is assisted in its responsibilities by Risk and Compliance Department (which is headed by the Chief Risk Officer). The Department also assists individual business areas manage their risk and compliance environment effectively within a framework that is consistent across the Bank. It monitors risk and performance associated with the Bank’s activities in financial markets and supports the business areas by implementing Bank-wide control frameworks covering fraud, bribery and corruption, business continuity and compliance-related risks. The Chief Risk Officer reports directly to the Deputy Governor and the Reserve Bank Board Audit Committee.

Audit Department undertakes a risk-based audit program to provide independent assurance that risks are identified and that key controls to mitigate these risks are well designed, implemented and working effectively. The Head of Audit Department reports to the Deputy Governor and the Reserve Bank Board Audit Committee. Audit Department’s work is governed by the Audit Department Charter, which is approved by the Audit Committee.

Portfolio risks

The Reserve Bank holds domestic and foreign currency denominated financial instruments to support its operations in financial markets, in pursuit of its policy objectives. These instruments account for the majority of the Bank’s assets and expose its balance sheet to financial risks. The primary responsibility for managing these risks rests with Financial Markets Group. Risk and Compliance Department monitors these risks and assesses compliance with the approved risk framework. Within this framework, compliance with financial management guidelines and developments in portfolio risks are reported to the RMC.

Exchange rate risk

The Bank is exposed to exchange rate risk, as some of its assets are denominated in foreign currency while most of its liabilities are denominated in Australian dollars. Foreign currency assets consist of outright foreign exchange holdings, assets funded by foreign exchange swaps, Special Drawing Rights (see Chapter 2.5 International Financial Cooperation) and units in the Asian Bond Fund (an investment that is managed externally by the Bank for International Settlements). Outright foreign exchange holdings remain the largest component of foreign currency assets. As these assets are held for policy purposes, the Bank does not seek to eliminate or hedge the associated foreign exchange exposure. However, the Bank mitigates some of this risk by diversifying these assets across various currencies. The foreign portfolio has target shares of 55 per cent in US dollars (USD), 20 per cent in euros (EUR) and 5 per cent each in Japanese yen (JPY), Canadian dollars (CAD), UK pound sterling (GBP), Chinese renminbi (CNY) and South Korean won (KRW). These shares have been unchanged since 2016. The portfolio composition reflects the Bank’s risk appetite and desired liquidity. Some limited deviation from target currency shares is permitted to simplify management and minimise transaction costs.

The Australian dollar value of the Bank’s outright foreign exchange holdings increased modestly over 2022/23 owing to an overall depreciation of the Australian dollar against the currencies held. Based on the size of the outright foreign exchange portfolio as at 30 June 2023, a 10 per cent appreciation of the Australian dollar would result in a mark-to-market loss of $4.2 billion, which is little changed from the previous year.^[1]

Interest rate risk

The value of the Bank’s financial assets is also exposed to movements in market interest rates. Interest rate risk on the Bank’s portfolio declined over 2022/23, reflecting a fall in the remaining maturity of assets on the Bank’s balance sheet. However, interest rate risk on the domestic portfolio remains at a historically high level because of the large increase in outright bond holdings and outstanding Term Funding Facility (TFF) repos since early 2020.

Total holdings of domestic securities decreased by $33 billion over 2022/23 to $501 billion. Domestic securities held outright decreased by $23 billion to $314 billion, while the value of repurchase agreements (repos) decreased by $10 billion to $188 billion.

The expansion in securities held outright between early 2020 and early 2022 was a result of the Reserve Bank’s policy actions to support the Australian economy during the COVID-19 pandemic. These included purchases of Australian Government and state and territory securities in the secondary market to address dysfunction in the government bond market, support the three-year yield target and as part of the bond purchase program (which focused on the 5–10 year segment of the yield curve). The Bank ceased all bond purchases under these programs in February 2022. Over the past year, assets held outright have declined, principally as some of the purchases made during the pandemic began to mature but also due to lower valuations as bond yields have risen.

The interest rate sensitivity of outright holdings in the domestic portfolio, as measured by modified duration, decreased from around five years to 4.2 years over 2022/23. The Bank’s current approach is to hold these bonds until maturity, rather than selling them prior to that, in accordance with a decision of the Reserve Bank Board in May 2023. Under the current approach, the return the Bank will earn on these bonds will be determined by the yield on each bond at the time of purchase and will not change with valuation gains or losses that result from fluctuations in yields (see Chapter 3.4 Earnings, Distribution and Capital).

The $10 billion decline in the value of repos over the past year was driven by the maturing of repos extended as part of the TFF. Under the TFF, the Bank provided three-year funding to authorised deposit-taking institutions (ADIs) under repurchase transactions between April 2020 and June 2021. The average term of all outstanding repos decreased over 2022/23, from 18 months to seven months, as the remaining term to maturity of outstanding repos under the TFF decreased.

The Bank’s foreign portfolio is comprised of assets denominated in the seven reserve currencies. Each asset portfolio is managed relative to a benchmark portfolio, with duration targets that reflect the Bank’s long-term appetite for interest rate risk and return. These targets are reviewed periodically. During 2022/23, duration targets were unchanged in all seven asset benchmark portfolios. The current duration targets are: 18 months for the CNY and KRW portfolios; six months for the EUR, CAD and USD portfolios; three months for the GBP portfolio; and less than three months for the JPY portfolio. The low levels of duration in the foreign portfolio have protected the Bank from the large increase in interest rates in many foreign markets over 2022/23. Some limited variation in actual portfolio duration from these duration targets is permitted, to reduce transaction costs and provide scope for staff to enhance portfolio returns. The weighted-average benchmark duration target for the Bank’s total foreign portfolio was unchanged over 2022/23 at 6.75 months.

The Bank is also exposed to interest rate risk owing to a maturity mismatch between assets and liabilities. This risk has increased substantially since 2020, when the Bank implemented its policy response to the pandemic – the TFF and bond purchase program caused Exchange Settlement (ES) account balances to increase significantly. ES balances then continued to rise as the Bank increased gross foreign exchange reserves by entering into long-term foreign exchange swaps that lend AUD against USD and JPY. These swaps have maturities of up to three years and are used to fund the Bank’s commitments to the International Monetary Fund (IMF) (see Chapter 2.2 Operations in Financial Markets). Interest paid on ES balances, as well as deposits held by the Australian Government and its agencies, is based on an overnight rate that reflects the Bank’s monetary policy settings. This rate increased by 325 basis points over 2022/23 as the Reserve Bank Board tightened monetary policy. Historically, this interest cost has been broadly offset by interest earnings on the domestic asset portfolio, which is mostly comprised of short-term repos earning close to the overnight cash rate. However, changes in the composition of the Bank’s balance sheet in recent years mean earnings on most of the Bank’s current asset holdings are now fixed; TFF repos earn a fixed rate over three-year terms, government bond holdings earn a fixed yield if held to maturity and long-term foreign exchange swaps attract a fixed rate on the AUD provided under swap. The mismatch in maturity between much of the Bank’s domestic assets and liabilities is expected to persist until these fixed-rate assets mature. Banknotes on issue have remained a constant share of liabilities over the year, at 16 per cent, and carry no interest cost to the Bank.

Credit risk

Credit risk is the potential for financial loss arising from the default of a debtor or issuer, or from a decline in asset values following a deterioration in credit quality. The Bank manages its credit exposure by applying a strict set of eligibility criteria to its holdings of financial assets and to counterparties with which it is willing to transact.

The Bank is exposed to very little issuer credit risk on its outright holdings of domestic securities as it invests only in securities issued by the Australian Government or by state and territory government borrowing authorities. The Bank is exposed to a small amount of counterparty credit risk on domestic assets that are held under repo. The Bank would face a loss only if a counterparty failed to repurchase securities sold to the Bank under repo and the market value of the securities fell below the agreed repurchase amount. The Bank manages this exposure by requiring these securities to meet certain eligibility criteria and by applying an appropriate margin to the securities, which reduces the risk profile faced by the Bank. The required margin is maintained throughout the term of the repo through daily margining.

Alongside the establishment of the TFF in March 2020, the Bank relaxed constraints on certain ADIs posting eligible self-securitised asset-backed securities (ABS) – called ‘self-securitisations’ – as collateral.^[2] Previously, only ADIs with access to the Committed Liquidity Facility were permitted to post self-securitisations as collateral under the Bank’s standing facilities. However, under the TFF, any eligible self-securitisation could be presented as collateral. Following this adjustment to the policy, ADIs’ use of self-securitisations as collateral increased significantly. These securities are related to the counterparty presenting them as collateral in a repo, implying that a default by the counterparty may be associated with a decline in the value of the securities held as collateral. However, this risk is mitigated because the issuing trust is bankruptcy remote,^[3] the securities must be rated AAA and the Bank applies a relatively high margin. Unlike other types of securities accepted as collateral in the Bank’s operations, these securities are not typically traded in the market as they are held by ADIs solely for the purpose of accessing central bank liquidity. Risk and Compliance Department typically values these securities based on a pricing model that references the public ABS market. When the TFF was established, the Bank froze prices of eligible self-securitisations until early 2023 for the purpose of valuing collateral accepted under repo. This was to ensure that modelled prices were not unduly affected by potential volatility in public ABS arising from the pandemic. Self-securitisation prices were unfrozen in March 2023.

Counterparties to the Bank’s dealings in policy operations in the domestic market must be: members of RITS; subject to an appropriate level of regulation; and able to settle transactions within the Austraclear system. Certain counterparties must also demonstrate a material connection to the bond and/or repo markets and be creditworthy to be eligible. Repo transactions with the Bank are governed by a Global Master Repurchase Agreement.

Investments in the Bank’s foreign currency portfolio are typically confined to highly rated and liquid securities, as well as deposits with foreign central banks. The majority of the Bank’s outright holdings are securities issued by the national governments of the United States, Germany, France, the Netherlands, Japan, Canada, the United Kingdom, China and South Korea, with modest holdings of securities issued by highly rated supranational institutions and government-owned agencies. Gross holdings of JPY-denominated assets remained the largest share of the Bank’s foreign currency issuer exposures at 30 June 2023. The majority of these assets are funded under short-term foreign exchange swaps between JPY and other currencies in the Bank’s portfolio. When the cost of hedging currency risk under short-term foreign exchange swaps is taken into account, yields on short-dated Japanese investments have generally been higher than those available in the other currencies in the Bank’s portfolio (see Chapter 2.2 Operations in Financial Markets). A limit on the size of exposures to individual currencies serves to mitigate concentration risk.

The Bank holds a portion of its foreign currency portfolio in short-term repos. This exposes the Bank to the small amount of residual credit risk that is inherent in repos, as noted above. The Bank manages this risk by requiring 2 per cent over-collateralisation, which is maintained through two-way margining in the local currency, and by accepting only high-quality and liquid securities as collateral. Credit exposure on foreign repos is further managed by imposing limits on individual counterparty exposures and by requiring execution of a Global Master Repurchase Agreement (or Master Repurchase Agreement where appropriate) with each counterparty.

The Bank undertakes foreign exchange and gold swaps as part of its policy operations, and as a means of enhancing returns on the foreign currency portfolio. The Bank commenced transacting in long-term foreign exchange swaps in February 2021 to manage existing and future foreign currency commitments to the IMF. The size of this foreign exchange swap position continued to increase during 2022/23 due to transactions with the IMF that increased Australia’s holdings of Special Drawing Rights. These transactions involved swapping Australian dollars into USD or JPY for terms of up to three years. IMF commitments were previously funded from foreign currency reserves held outright.

Credit risk on foreign exchange and gold swaps is managed by transacting only with counterparties that meet strict eligibility criteria, including the requirement to have executed with the Reserve Bank an International Swaps and Derivatives Association agreement with a credit support annex. Exposures generated by movements in market exchange and interest rates and gold prices are managed through daily two-way margining in Australian dollars.

In addition to gold swaps, the Bank undertakes some limited lending of its gold holdings. This lending is either fully collateralised or with borrowers that have government support. As at 30 June 2023, 3 tonnes of gold, valued at $0.3 billion, was on loan.

Operational risk

The Reserve Bank faces a diverse range of operational risks arising from its responsibilities as Australia’s central bank. The Bank’s risk appetite is defined as the amount of risk that the Bank is prepared to accept when pursuing its strategic goals and can be expressed on a scale that ranges from ‘high appetite’ to ‘no appetite’. For example, the Bank has a high risk appetite for the exploration and expansion of analysis and decisions to effectively support decision-making, but no risk appetite for employees to engage in acts of fraud or corruption.

The Bank’s Risk Management Policy, which captures its risk appetite across its activities, was updated in August 2023 to capture learnings from a service outage in 2022 (see below).^[4] The policy aims to ensure that we manage risk to the best of our ability to enable the successful achievement of the Bank’s objectives.

The most significant operational risks the Bank is exposed to arise from:

• the management of its people and culture, including safety and wellbeing, talent, and risk culture
• transacting in financial markets to implement monetary policy
• maintaining the infrastructure to facilitate real-time interbank payment and settlement services through RITS and the Fast Settlement Service
• providing banking facilities for government entities, including the Australian Taxation Office, Medicare and Centrelink
• the provision of safe, secure and reliable Australian banknotes.

The Bank’s activities are highly dependent on information technology (IT) systems, and the Bank’s risk management and control framework supports an ongoing focus on managing the risks associated with complex IT systems. The IT Department collaborates with relevant business areas to facilitate the monitoring, assessment and management of IT-related risks and ensures IT-related initiatives are consistent with the Bank’s Corporate Plan. This work is supported by ongoing evaluation of industry developments, to ensure the Bank’s systems and procedures remain robust and conform to current IT standards.

The Bank has a strong focus on the security of its technology and operational systems. Cyber resilience is a key operational risk and this is managed by staff at all levels of the Bank. Protecting digital assets from cybersecurity threats is a priority for the Bank, alongside providing a high-quality IT service. The Bank remains committed to a mature implementation of the Australian Signals Directorate Information Security Manual and relevant security standards, introducing innovative security technologies and proactively searching for emerging threats to continually meet the Bank’s strategic cyber resilience objectives. The Bank continues to work with peer central banks, the Australian Government and industry participants to increase the cyber resilience of national and international financial systems.

The Bank invests in significant security controls and risk assurance functions, which are supported by a regular assessment regime. The Bank receives regular independent assurance of its compliance with security strategies endorsed by the Australian Signals Directorate and maintains independent certification for the ISO 27001 global standard for Information Security Management.

Following a service outage in late 2022, the Bank commissioned two independent external reviews. One of these considered the technical factors that contributed to the outage. This review identified a range of improvements to strengthen the control environment around the management of technology infrastructure.

The other considered a broader range of factors that impacted on the Bank’s ability to operate RITS as a highly available and resilient service, including: the operating framework, processes, roles and responsibilities; people and culture; and risk management and governance. This review acknowledged both the strong culture of risk awareness at the Bank and the steps taken over recent years to uplift risk frameworks and arrangements. However, it identified further action to effectively implement, embed and uplift the Bank’s risk management practices.^[5] Work is now underway to address the recommendations from this review.

During the past year, the Bank continued to direct substantial resources towards the delivery or completion of several large and complex multi-year projects. The most significant of these is the renovation of the Head Office at 65 Martin Place, Sydney. There are also several large IT projects underway to improve the Bank’s resilience and security. Successfully completing and embedding these projects will ensure high-quality services are maintained for the Bank’s clients and the Australian public. Project risks are managed to ensure that adequate resources are available, nominated project deadlines are met and change management is effective. Project steering committees play an important role in overseeing the management of these risks.

The Bank manages risks related to the handling of confidential and sensitive information to ensure there are no unintended disclosures. While the primary focus is on ensuring sufficient controls exist to prevent a breach occurring, the risk and control framework also seeks to ensure the Bank can respond appropriately should a breach occur.

The Bank does not tolerate dishonest or fraudulent behaviour and is committed to deterring and preventing such behaviour. It takes a very serious approach to cases, or suspected cases, of fraud. All staff involved in financial dealing have well-defined limits to their authority to take risks or otherwise commit the Bank. These arrangements are further enhanced by the separation of front-, back- and middle-office functions, where staff involved in trading, settlement and reconciliation activity remain physically apart and have separate reporting lines. For non-trading activities, several layers of fraud control are in place. A clear decision-making hierarchy, separation of duties and physical controls over systems and information have been established and are subject to regular review. The Bank requires all staff to undertake fraud awareness training periodically. The Bank has arrangements in place for staff and members of the public to report any concerns anonymously. All concerns are fully investigated. During 2022/23, there were no reported instances of fraud by employees.

The Bank remains committed to maintaining and strengthening a workplace culture in which employees uphold the highest standards of behaviour. The Code of Conduct sets out requirements of the Bank’s employees and others who are involved in its activities. The Bank has arrangements in place for staff to report concerns about breaches of the Code of Conduct, including channels through which concerns can be reported anonymously.

The effective management of compliance risk is central to the Bank’s activities. Supporting this, staff complete regular training on areas such as privacy and workplace health and safety. Risk and Compliance Department collaborates with all business areas to ensure compliance risks are being managed effectively. It also keeps the RMC informed about the level of compliance in key areas.

Notwithstanding these measures, events can occur from time to time that may lead to service disruption or to financial or other costs. Timely reports on incidents and ‘near misses’ are provided to the RMC. These reports outline the circumstances (including impact and cause) and identify areas where new controls may be needed, where existing controls should be strengthened or where more significant innovation efforts might be well placed.

The Bank continued to act as the administrator of the Guarantee of State and Territory Borrowing until the final security under this scheme reached maturity in early-May 2023. A total of $429.6 million in fees was collected for the guarantees of state and territory borrowing since the scheme commenced in 2009, with $0.6 million collected in 2022/23.

Business resilience

The resilience of critical business function is a strategic priority for the Reserve Bank. The Bank’s main objectives in managing its operational resilience are to ensure the safety and wellbeing of staff, to take reasonable steps to minimise the likelihood and impact of disruptions to critical operations, and to keep key stakeholders informed of developments that may impact on the Bank’s critical operations and ability to achieve its strategic objectives. The Bank undertakes ongoing testing of its business resilience arrangements to ensure it remains responsive to potential disruptions.

Another major consideration is to maintain business resilience during the renovation of the Bank’s Head Office. There is ongoing and extensive communication with staff to ensure they are aware of their roles and responsibilities during the project, and to ensure business contingency response arrangements reflect the change in location of staff during the renovation. The RMC receives regular updates on this project to ensure operational risks are managed effectively.

Endnotes

Based on the Reserve Bank’s total foreign exchange reserves exposure (including outright holdings of foreign exchange, Special Drawing Rights, gold and the Asian Bond Fund) as at 30 June 2023, a 10 per cent appreciation of the Australian dollar would result in a mark-to-market loss of $5.8 billion, up slightly from the previous year. [1]

ABS are debt securities issued by a trust that are backed by a pool of assets such as residential mortgages. Investors that purchase the securities receive income funded by the principal and interest payments from the pool of assets. Self-securitisations are a type of ABS. A distinguishing feature of self-securitisations is that notes issued from the trust are typically not sold to the public; rather, they are held by the ADI that issued them to use as collateral to access central bank liquidity. The Bank accepts securities issued by eligible self-securitisations as collateral. [2]

That is, the assets sold into the trust are not at risk if the counterparty that sold those assets into the trust becomes bankrupt. [3]

See RBA (2023), ‘Risk Management Policy’, August. [4]

Deloitte (2023), ‘Independent Review of the October 2022 Reserve Bank Information and Transfer System (RITS) Outage – Final’, April. [5]