Corporate information

An organisational standpoint in respect of risk management

Therefore the cornerstone of our risk management approach is the strong risk culture that is propagated and supported by a partnership between risk management professionals and business divisions.

Our strong risk culture will assist in entrenching our groupwide portfolio management techniques, some of which are currently undergoing major enhancement, so that risk-reward profiles are optimised to attain a more efficient attribution of capital.

A structure of board and risk management committees provides oversight of the risk management processes across the entire risk universe of the organisation, supported by the group risk function under the leadership of the Group Chief Risk Officer.

The primary focus of the group risk management function is to provide shareholders with value, and support the board through leadership of the strategic management of enterprise-wide risks.

• shaping, influencing the understanding of risk and enhancing the communication of risk and risk appetite; and
• ensuring that there is an alignment between risk appetite and business strategies and that an acceptable level of investment is made to enhance capabilities to improve the measurement, analytics, understanding, management and monitoring of risks as well as the responsiveness of key risk processes.

• keeping the board and executive management informed of major risks being assumed by or potentially facing the group;
• maintaining an integrated enterprise-wide risk measurement, management, monitoring and reporting framework as well as appropriate underlying functional organisational structures to give effect to enterprise-wide risk management and independent risk monitoring;
• working closely with business units to ensure that they identify, measure, understand, mitigate and monitor risks;
• ensuring that comprehensive risk assessment and approval processes are put in place, including the ongoing development and implementation of enterprise-wide risk policies, methodologies and procedures;

• improving risk policies, guidelines and prudential risk limits to ensure an acceptable risk diversification and optimisation of risk-return on a portfolio as well as a transaction basis.

Enterprise-wide Risk Management Framework (ERMF)

Creating shareholder value is the overriding business objective of the Nedcor Group.

Risk is similarly an integral component and driver of our success in achieving this business objective. We do not, however, look to avoid risk or shy away from it, but rather understand it, embrace it, manage it effectively and measure it in the context of an appropriately recognised reward system that should derive its approach to risk management and control from a shareholder value’ perspective.

In that sense Nedcor’s risk process covers a much broader range than the narrowly defined traditional risk categories and specifically includes strategic risk and the enterprise-wide risk management concept.

As a banking group, Nedcor’s core activity is risk taking, and accordingly risk management needs to be a core competency.

In today’s volatile and competitive corporate environment, risk management and control has become a critically important process for boards of directors as well as for all levels of management.

• an enterprise-wide view of risk;
• business unit management accountability;
• risks aligned to strategic and business objectives;
• clear risk parameters for the group;
• use of appropriate technologies;
• objective risk control and independent assurance to the board;
• a culture of risk awareness;
• consistent and transparent reporting and escalation procedures; and
• reputation protection.

• best risk management practice locally and internationally;
• the requirements of the new Basel II Accord;
• the Code of Corporate Practice and Conduct [King Report on Corporate Governance (King II)];
• the Combined Code on Corporate Governance, the Smith Guidance, the Turnbull Guidance and Higgs’ Suggestions for Good Practice; and
• the Banks Act Regulations and other key financial services legislation.

While coming off a theoretical base, the ERMF has been created to be practical and efficient, with substance prevailing over theoretical form. It is aligned with the above risk management principles developed in conjunction with Old Mutual plc’s risk management framework.

• a proper, scientifically based Risk Appetite Framework;
• integrated risk management and financial reporting systems and data management;
• a consistent risk measurement methodology (via economic capital implementation);
• a common risk language and culture;
• reliable, consolidated risk measurement and portfolio analysis; and
• compliance with regulations and other governance requirements.

In July 2003 a vision and strategic approach was finalised not only to achieve Basel II compliance for Nedcor, but also to elevate its risk management, capital management and performance measurement to industry best-practice level.

This approach involves building advanced risk measurement, risk management and capital management capabilities, leveraging off the significant investment in our Basel II Programme. The approach also incorporates the comprehensive implementation of enterprise-wide risk management in Nedcor, as discussed above.

During 2004, and to cater for the largely restructured business model under the Chief Executive, the ERMF required a major revision and update to achieve full risk coverage. A significant inclusion in this body of work was the development and implementation of an enterprise-wide set of group risk policies, which align with policies and principles established by Old Mutual and clarify group policy in respect of those major risk areas outlined in Nedcor’s risk universe.

• layer 1 – the enterprise-wide management forums and responsibilities;
• layer 2 – the risk management and corporate governance committee structures; and
• layer 3 – executive management responsibilities by risk area.

Click here to download a pdf of a summarised version of layers 1, 2 and 3 is depicted in this report.

Credit risk

Our credit risk management approach goes through an integrated set of measurements, policies and processes that operate in tandem and provide an ongoing 'risk wrap' for the group’s strategies, business planning and risk assumption aspirations. It is also an integral part of our business units’ tactical day-to-day credit risk management operations.

Each element of our credit risk management is supported by formally articulated target measures of performance. Credit portfolio measurement methodologies are being rapidly developed into target credit risk-adjusted measures of risk. Credit policy and procedure guidelines are evolving in line with these enhancements.

The maintenance of our desired credit management standards and the consistency of their application across the diverse businesses in our group are communicated, coordinated and monitored on a groupwide basis by the Group Credit Risk Monitoring Unit. However, an essential part of our organisational credit risk culture and practice is that accountability for credit portfolio quality and its underlying credit risk management, throughout the entire credit risk process chain, clearly vests with individual business units.

Although credit risk management is increasingly being integrated into our group credit portfolio procedures, key credit control and monitoring activities ensure that the independence and integrity of the credit risk methodologies and approaches are entrenched.

Key credit control and monitoring processes that were enhanced during 2004

• Credit policies and procedures

  The definitions of the key elements of the groupwide policies and procedures guidelines were updated and divisional policies and procedures were subsequently similarly aligned to the central policies. This drives a consistency in approach for key credit policy issues and required practices, but also allows our divisions the flexibility to formulate their own business-specific credit guidelines within a centrally agreed framework and reporting protocol. A formal annual review process had been introduced to ensure that the group’s credit policies and procedures continue to be relevant as part of a dynamic process of change and therefore aligned with new methodologies and changes in risk tolerance.

  ---

• Credit risk ratings

  Our internal ‘NGR’ 25-point credit risk ratings master scale, developed under the Basel II Programme, is increasingly becoming the centrepiece of our credit risk strategy formulation, management, control and monitoring approaches.

  These measurements of credit risk are already driving differentiated credit policies and procedures and will more accurately determine an appropriate risk appetite, the frequency and depth of reviews as well as credit approval mandates, to name a few impacts.

• Credit portfolio analysis and reporting

  Divisional credit portfolio reviews have been considerably enhanced in a phased-improvement project. There is consistency in measurement and reporting standards and an early and proactive focus on those components of credit risk that are showing signs of weakness. Overall, there is a better understanding of the different aspects and levels of credit risk within the varying credit portfolios of our group’s operations following an improvement in the underlying metrics and analytics.
  

  This is reflected in the improved quality of reporting to the Group Credit Committee. Executive management, Board and Risk Committee members are now able rapidly to assimilate key areas of credit risk change and weakness as well as business unit tactical responses to these trends and issues.

• Prudential risk limits

  Prudential risk limits are generally in place so that we do not become overexposed to any one borrower or related borrowers, country, industry, industry subsector or regional/geographic area. These risk limits will become more relevant as and when they are enhanced. Different and more meaningful risk characterisations, deeper data series and new measures of credit risk are becoming more reliable and are giving rise to a better knowledge of concentrations and correlated portfolios against which risk appetite measures can be defined.
  

Credit risk mitigation

Problematic credit exposures are singled out for early intervention by specialised units within each of the business clusters. These workout experts respond proactively to remedy or mitigate developing credit weaknesses, whereas others handle the management and collection of impaired advances in the most efficient and cost-effective manner.

The use of credit derivatives and/or the selling down of exposures, in cases where the obligor risk-reward profiles and borrower credit risk ratings no longer meet our objectives, will increasingly become part of our array of credit risk mitigation techniques.

Credit portfolios review (based on current credit risk rating methodologies)

More representative credit risk calibrations (which also drive treatment strategies, credit process reengineering and management information system improvement projects), including the phased deliverables of enhanced credit systems capabilities, have assisted more focused credit risk management and central monitoring across the credit process chain in all our businesses. More appropriate credit policies, changed organisational credit structures and technology-assisted processes, aided by a sustained period of low interest rates, have facilitated improvements in impaired debtor collection and recovery outcomes, particularly in Nedbank Retail.

All our credit portfolios across the group are in a better condition, risk-graded through more consistent credit risk recognition methodologies and adequately provisioned at the earliest evidence of potential impairment, generally 91 days in arrears. Additionally, the underlying credit and accounting valuation policies and methodologies give rise to mandatory recalculation of recovery rates, based on more conservative collateral valuations.

Market risk

A comprehensive groupwide Market Risk Framework has been designed and implemented to support and assist the board in its responsibility to oversee that market risks are identified, understood, monitored, reported and managed.

• an independent function within Group Risk Division, namely Group Market and Trading Risk Control, which is centralised and monitors all market risk – this is a specialist risk area that provides an independent oversight of market risk in terms of identifying, measuring, analysing, monitoring and reporting, as well as ensuring that appropriate controls are in place to manage market risk; and
• a committee structure incorporating executive committees of the Group Asset and Liability and Executive Risk Committee (Group ALCO) and Group Executive Committee (Group Exco) as well as a board committee (Group Risk Committee).

Advances per risk classification of total advances

Click on graphs for large size

Gross NPLS as a % of total loans and advances

Click here to download the summarised roadmap of Nedcor's enterprise-wide Management Framework

The independent market risk monitoring process is supported by a comprehensive reporting framework that creates communication channels between independent group risk functions and operating divisions, as well as executive and board committees. The board has approved a market risk limit, which includes banking book and trading book of 5% of capital and reserves, 2% of which represents the trading risk limit. Group Market and Trading Risk Control reports on market risk at all levels and is instrumental in ensuring that market risk limits are compatible with a level of risk acceptable to the board, and has also played a major role in a number of new developments, including:

• implementation of economic capital for trading market risk, balance sheet risk and private equity;
• ongoing review of groupwide derivatives usage and the effectiveness of derivative hedges;
• centralisation of the investment risk monitoring function, with appropriate policies and reporting;
• monitoring of risk on a number of balance sheet portfolios on a mark-to-market basis, including subordinated debt and statutory liquid assets; and
• implementation of new risk technology to facilitate compliance with Basel II.

Market risk management processes and methodologies are benchmarked against best practice on an ongoing basis. Enhancements are assessed and implemented in consultation with the operating divisions. The most recent benchmarking exercise (undertaken by Mercer Oliver Wyman) was favourable and indicated that economic capital was the main area where enhancements were required. Workstreams have been initiated and will be progressed during 2005.

Market risk associated with trading activities is a result of transactions in foreign exchange, interest rate, equity and commodity markets. Instruments actively deployed are spot and forward exchange contracts, interest rate swaps, forward rate agreements, bonds, bond options, equities and equity derivatives. Currency options, commodities and commodity derivatives are traded on a limited basis.

Market risk exposures for trading activities are measured using sensitivity analysis, value-at-risk (VaR) and stress-scenario analysis. Nedcor’s current limit structure is based on sensitivity analysis that measures the impact on earnings of specified moves in interest rates, prices, exchange rates and market volatilities. This method of risk exposure measurement is conservative, as all market factors are assumed to move adversely at the same time. For the year ended 31 December 2004 the market risk exposure was 0,34% and 0,67% of Nedcor’s capital and reserves for the trading and banking book respectively.

The VaR risk measure estimates the potential loss in pretax profit over a given holding period for a specified confidence level. The VaR methodology is a statistically defined, probability-based approach that takes into account market volatilities as well as risk diversification by recognising offsetting positions and correlations between products and markets. Risks can be measured consistently across all markets and products, and risk measures can be aggregated to arrive at a single risk number. The one-day 99% VaR number used by Nedcor represents the overnight loss that has less than 1% chance of occurring under normal market conditions.

VaR methodologies employed to calculate daily risk numbers include the historical and variance-covariance approaches. In addition to these two methodologies, Monte Carlo simulations are applied to the various portfolios on a monthly basis to determine potential future exposure. Trading risk reserves are then created as a function of potential future exposure as well as empirical risk evidence.

	Historical VaR (one-day, 99%) by risk type
Rm	Average	Minimum	Maximum	Year-end
For the year ended 31 December 2004
Foreign exchange	1,3	0,1	5,7	1,2
Interest rate	7,5	4,9	18,0	7,1
Equity products	12,3	4,0	23,2	16,5
Diversification	(7,0)			(8,3)
Total VaR exposure	14,1	9,6	33,3	16,5
Sensitivity exposure	72,4	33,7	117,0	97,7
For the year ended 31 December 2003
Foreign exchange	1,7	0,4	5,9	2,1
Interest rate	15,9	9,3	27,0	19,2
Equity products	6,1	2,4	15,3	9,9
Diversification	(8,2)			(11,8)
Total VaR exposure	15,5	8,1	25,4	19,4
Sensitivity exposure	45,2	17,1	79,8	63,9

The monitoring of trading credit risk exposures within Nedcor includes a total risk exposure measure, made up of current market value plus potential future exposure. Monte Carlo simulations are used to calculate potential future exposure. In terms of active management of credit risk there is continued emphasis on the use of credit mitigation strategies such as netting and collateralisation of exposures. These strategies have been particularly effective in situations where there has been a high risk of default.

The credit equivalent exposure of derivative financial instruments (ie total risk exposure estimate as per regulatory requirement) as at 31 December 2004 is reflected in the following tables:

				Credit
		Nominal	Replacement	equivalent
Rm		value	value	exposure
2004
Foreign exchange contracts
Less than one year		131 461	9 138	10 453
One to five years		6 911	1 284	1 630
Beyond five years		915	271	317
Interest rate contracts
Less than one year		278 008	1 170	1 170
One to five years		187 305	6 763	7 699
Beyond five years		82 419	5 071	5 483
Equity derivatives
Less than one year		5 809	1 834	1 892
One to five years		9 205	2 029	2 489
Beyond five years		21 702	–	1 085
Total		723 735	27 560	32 218
2003
Foreign exchange contracts
Less than one year		178 939	7 425	9 214
One to five years		9 869	3 694	4 187
Beyond five years		3 637	2 463	2 645
Interest rate contracts
Less than one year		252 719	933	846
One to five years		230 860	6 124	7 113
Beyond five years		79 446	5 185	5 582
Equity derivatives
Less than one year		8 689	1 881	1 968
One to five years		3 686	791	975
Total		767 845	28 496	32 530

While VaR captures Nedcor’s exposure under normal market conditions, scenario analysis and, in particular, stress-testing are used to add insight into the possible outcomes under abnormal market conditions. Nedcor uses a number of stress scenarios to measure the impact on portfolio values of extreme moves in markets, based on historical experience as well as hypothetical scenarios. The stress-test methodology assumes that all market factors move adversely at the same time and that no actions are taken during the stress events to mitigate risk, reflecting the decreased liquidity that frequently accompanies market shocks.

Group Asset and Liability and Executive Risk Committee (Group ALCO)

• liquidity risk;
• interest rate risk, both local and foreign;
• foreign exchange risk, including currency translation risk;
• trading market risk;
• market risk on financial instruments used for purposes other than trading (for example balance sheet hedges);
• investment risk; and
• capital risk.
  

Group ALCO executes its responsibilities by:

• establishing, implementing and continuously enhancing policies, limits and guidelines to manage the above risks, recognising the strategic objectives of the group;
• ensuring compliance with statutory and regulatory requirements in respect of the above risks;
• ensuring that the accountability for the management of risk is clearly defined;
• ensuring that all risks are clearly identified, understood and managed;
• ensuring that the group’s risk management systems and methodologies are appropriate and that the individuals responsible for managing risk have the required knowledge, expertise and experience;
• establishing and maintaining an independent risk monitoring function; and
• reviewing the appropriateness and effectiveness of the Market Risk Framework.
  

Group ALCO’s capital management responsibilities include:

• notional allocation of risk capital to operating units;
• investment term of capital;
• determination of capital hurdle rates for transaction pricing;
• capital adequacy in terms of regulatory requirements;
• the structure of the group’s capital; and
• capital planning.
  

Group ALCO reports to the Group Risk Committee of the board of directors on all policy, risk limit and associated issues.

Group Asset and Liability Management (ALM)

Good progress was made with the implementation of a modern and more appropriate funds transfer pricing (FTP) methodology that enables the centralisation of interest rate risk to a balance sheet management centre, which monitors the interest rate risk being generated by the various clusters and executes hedges through a dedicated ALM desk housed in Treasury. While considerable use of derivative instruments has been made to reduce unwanted risk, natural offsetting transactions on the balance sheet are also used, where possible. Hedging activities include the ongoing management of the bank's statutory liquid assets.

The FTP methodology aligns with the profitability measurement project, which combines FTP, AJTP and capital allocation to allow more correct measurement of the businesses housed in the clusters. The initial project makes use of capital required under Basel I as a measure, but prepares the organisation for risk-adjusted profitability measurement under Basel II and ultimately will use the bank’s economic capital allocation model.

A new capital management team is being formed to ensure this ongoing improvement in capital management and to enable the bank to cope with a more demanding environment under Basel II and economic capital (E Cap).

Liquidity risk management was further improved with the introduction of additional stress tests and improved information on cash flows across the business.

The creation of a centralised funding desk in Treasury, which controls all non-rand currency flows, has further enhanced the bank's liquidity and interest rate management and ensured optional funding from a cost perspective.

The margin management function of Group ALM has improved the bank’s ability to understand the margin dynamic and to develop appropriate strategies to ensure that the net interest income is optimised.

Operational risk

• sound risk governance structures;
• risk-adjusted performance measures;
• clear accountabilities with respect to risk management;
• an appropriate technology infrastructure that enables the identification, measurement, management and monitoring of operational risk in the business; and
• staff skilled in the assessment and management of operational risk.

Stakeholders and subject matter experts have been consulted to confirm that business solutions being implemented meet not only regulatory requirements, but also the needs of the user community in the most effective manner. One of the key delivery mechanisms in this regard is the Group Operational Risk Forum. In this forum proposed business solutions are evaluated and project deliverables are monitored to build or enhance the Operational Risk Management Framework in the Nedcor Group.

• implementing requirements to be compliant with the standardised approach (Basel II) for operational risk management in 2008;
• restructuring executive committees to enhance the board focus on risk management and in particular operational risk;
• enhancing the operational risk reporting process at different levels in the organisation;
• setting targets with respect to the risk assessments done in business clusters;
• separating the role of risk and compliance officers to allow for better focus on the respective disciplines; and
• setting group and business level risk policies that include defining the roles and responsibilities of stakeholders.

• Basel II regulations;
• King II on corporate governance;
• the Banks Act; and
• emerging best practice.

The bank’s external auditors and Basel II consultants do periodic independent reviews to confirm that there are no gaps between the interpretation and implementation of business solutions that form part of the Operational Risk Framework.

The group operational risk function, tasked with the responsibility of championing the operational risk management process, in partnership with business unit risk functions, laid a strong foundation for the organisation’s operational risk management initiatives.

A project has been launched to implement a quantitative measurement capability for operational risk, supported by an integrated technology infrastructure that enables operational risk to be identified, managed and measured in a holistic and consistent manner and ultimately to meet the requirements of the advanced measurement approach of Basel II.

Internal Audit Division

• the adequacy, appropriateness and effectiveness of the internal control systems, as established and maintained by management and the directors, aimed at the achievement of performance and profitability goals, the safeguarding of assets and the efficient use of resources;
• the reliability and integrity of financial and operating information generated; and
• compliance with the requirements of the Banks Act and other relevant legislation.
  

Nedbank Forensic and Protection Services (NFPS)

Forensic services

Considerable cost has been incurred in this year and will continue to be incurred in respect of ensuring compliance with anti-money-laundering and corrupt activities legislation, adapting systems and processes to comply with the identification, verification and other requirements under the Financial Intelligence Centre Act (FICA) and reporting incidents under FICA and the Prevention and Combating of Corrupt Activities Act (PRECCA).

The main focus in the past year has been on reverification of existing clients. This focus will continue through to September 2006, by which date banks are required to have completed the reverification of their entire client base. Although this is just one of many anti-money-laundering requirements, the banking industry has spent a significant amount of time, effort and money on this process, often to the annoyance and irritation of clients. The reverification of existing clients is a challenge faced by banks internationally and it is hoped that a more pragmatic solution to this requirement can be found.

• development and board ratification of a Nedcor Limited Policy for Global Money Laundering Control;
• development of a new Nedbank Limited Money Laundering Control Policy for SA Operations, aligned with a global group policy – this new policy was ratified by the Nedbank Limited Board and implemented in 2004;
• assistance rendered to Nedbank Africa in the establishment of money laundering control programmes in all of their African entities;
• establishment of an effective internal communication strategy and management of several above-the-line (external) advertising campaigns;
• establishment of a Central Storage Solution for FICA documentation and a Central Verification Hub (CVH) to assist in the reverification exercise;
• a 55% increase of reported suspicious transactions, compared with the previous year; and
• obtaining approval and registering a formal project to procure and implement a
  state-of-the-art Automated Money Laundering Detection Solution – contractual agreements should be inalised early in 2005 and implementation will occur immediately thereafter.

Crime continues to threaten our society as a whole, and Nedbank and our people are by no means exempt from this. Tip-offs Anonymous (a unique tollfree number: 0800 000 999), which is an independent reporting line, is but one aspect of Nedbank’s ongoing efforts in creating crime awareness, contributing towards crime prevention and bringing about a culture of zero tolerance to crime. Through this service Nedbank empowers its employees and clients to become part of the solution by combating crime through reporting suspicious and corrupt activities. Nedcor has also ensured, through its staff integrity process, that all new recruits and appointments are thoroughly screened in terms of background checks, criminal and credit record clearances, as well as resumé and qualification verifications to ensure that our staff meet the requirement of being fit and proper for their duties.

Security services

Comparisons from 1999 to date indicate a decline in the incidents of violent crime. This decline can be attributed to an industry-wide campaign supported by the South African Police Services and the Department of Justice, combined with a well-defined security model and strategy for Nedbank. In 2004 there were 27 incidents with a loss of R2,3 million.

Business Continuity Planning continues to play an important role, and compliance with the Payments Association of South Africa’s standards and disaster recovery timelines is a key objective for 2005.

Exchange control

The team has a good relationship with the Exchange Control Department of the South African Reserve Bank and is well-placed to advise clients on their foreign exchange requirements. The team has established appropriate forums to understand client requirements. Through a good understanding of these requirements and a thorough understanding of the Exchange Control Regulations appropriate solutions are forged.

This team is offering clients an excellent service, is able to deliver timeous solutions and is on track to fulfil its vision of being the leading exchange control department in South Africa who can satisfy clients’ needs by providing a quality value-adding service.