INTRODUCTION TO RISK MANAGEMENT

Risk is an integral part of financial services. When financial institutions issue loans, there is a
risk of borrower default. When banks collect deposits and lend them to other clients (i.e. conduct
financial intermediation), they put clients’ savings at risk. Any institution that conducts cash
transactions or makes investments risks the loss of those funds. Development finance institutions
should neither avoid risk (thus limiting their scope and impact) nor ignore risk (at their folly).
Like all financial institutions, microfinance institutions (MFIs) face risks that they must manage
efficiently and effectively to be successful.
If the MFI does not manage its risks well, it will likely fail to meet its social and financial
objectives. When poorly managed, risks begin to result in financial losses, donors, investors,
lenders, borrowers and savers tend to lose confidence in the organization and funds begin to dry
up. When funds dry up, an MFI is not able to meet its social objective of providing services to
the poor and quickly goes out of business.
Managing risk is a complex task for any financial organization, and increasingly important in a
world where economic events and financial systems are linked. Global financial institutions and
banking regulators have emphasized risk management as an essential element of long-term
success. Rather than focusing on current or historical financial performance, management and
regulators now focus on an organization’s ability to identify and manage future risks as the best
predictor of long-term success
Benefits of effective risk management
a) Early warning system for potential problems:
A systematic process for evaluating and measuring risk identifies problems early on,
before they become larger problems or drain management time and resources. Less time
fixing problems means more time for production and growth.

b) More efficient resource allocation (capital and cash):

A good risk management framework allows management to quantitatively measure risk
and fine-tune capital allocation and liquidity needs to match the on and off balance sheet
risks faced by the institution, and to evaluate the impact of potential shocks to the
financial system or institution. Effective treasury management becomes more important
as MFIs seek to maximize earnings from their investment portfolios while minimizing the
risk of loss.
c) Better information on potential consequences, both positive and negative. A proactive
and forward-thinking organizational culture will help managers identify and assess new
market opportunities, foster continuous improvement of existing operations, and more
effectively align performance incentives with the organization’s strategic goals.

Historically, banks have waited for external reviews by regulators to point out problems
and risks, and then acted on those recommendations. In today’s fast changing financial
environment, regulators are often left analyzing the wreckage only after a bank has had a
financial crisis. The increased emphasis on risk management reflects a fundamental shift
among
bank managers and regulators to better anticipate risks, rather than just react to them.
This approach emphasizes the importance of “self-supervision” and a proactive approach
by board members and managing directors to manage their financial institutions.

For MFIs, better internal risk management yields similar benefits. As MFIs continue to
grow and expand rapidly, serving more customers and attracting more mainstream
investment capital and funds, they need to strengthen their internal capacity to identify
and anticipate potential risks to avoid unexpected losses and surprises. Creating a risk
management framework and culture within an MFI is the next step after mastering the
fundamentals of individual risks, such as credit risk, treasury risk, and liquidity risk.
Further, more clarity about the roles and responsibilities of managers and board members
in risk management helps build stronger institutions. A comprehensive approach to risk
management reduces the risk of loss, builds credibility in the marketplace, and creates
new opportunities for growth.

Risk is the possibility of an adverse event occurring and its potential for negative
implications to the MFI.

Risk management is the process of managing the probability or the severity of the
adverse event to an acceptable range or within limits set by the MFI.

A risk management system is a method of systematically identifying, assessing, and

managing the various risks faced by an MFI.

Therefore, a risk management framework is a consciously designed system to protect

the organization from undesirable surprises (downside risks), and enable it to take
advantage of opportunities (up-side risks).

Features of a good risk management framework

A good risk management framework:-

1. Integrates into MFI operations a set of systematic processes for identifying, measuring,
and monitoring many different types of risk to help management keep an eye on the big
picture;

2. Uses a continuous feedback loop between measurement and monitoring, internal

controls and reporting, and involves active oversight by senior managers and directors,
allowing more rapid response to changes in internal and external risk environments;

3. Considers scenarios where risks interact and can aggravate one another in adverse
situations;

4. Raises responsibility for risk management and preparedness to senior management and
the board;
5. Encourages cost-effective decision-making and more efficient use of resources;

6. Creates an internal culture of “self-supervision” that can identify and manage risks
long before they are visible to outside stakeholders or regulators.

Why is Risk Management Important to MFIs?

As MFIs play an increasingly important role in local financial economies and compete
for customers and resources, the rewards of good performance and costs of poor
performance are rising. Those MFIs that manage risk effectively – creating the systematic
approach that applies across product lines and activities and considers the aggregate
impact or probability of risks – are less likely to be surprised by unexpected losses
(down-side risk) and more likely to build market credibility and capitalize on new
opportunities (up-side risk).

The core of risk management is making educated decisions about how much risk to
tolerate, how to mitigate those that cannot be tolerated, and how to manage the real risks
that are part of the business. For MFIs that evaluate their performance on both financial
and social objectives, those decisions can be more challenging than for an institution
driven solely by profit.
A risk management framework allows senior managers and directors to make conscious
decisions about risk, to identify the most cost-effective approaches to manage those risks,
and to cultivate an internal culture that rewards good risk management without
discouraging risk-taking.

As MFIs begin to expand into new business lines, including insurance and voluntary
savings products, and seek to raise money from traditional financial markets, it will
become a necessity for them to behave as mainstream financial players, and manage risk
as such.
Regulators of commercially chartered MFIs enforce certain standards. Non-regulatory
bodies representing investors and donors also have a vested interest in better risk
management within the industry to protect their investments. The most successful MFIs
are those that focus not only on their current performance and financial condition, but
also on the risk management systems that will allow them to prepare for expected and
unexpected risks in the future.

Microfinance Risks and Challenges

Microfinance institutions face many risks that threaten their financial viability and long-
term sustainability. Some of the most serious risks come from the external environment
in which the MFI operates, including the risk of natural disaster, economic crisis or war.
 While the MFI cannot control these risks directly, there are many ways in which the MFI
can prepare itself and minimize their potential for negative impact.

Major Risks to Microfinance Institutions

Many risks are common to all financial institutions. From banks to unregulated MFIs,
these include credit risk, liquidity risk, market or pricing risk, operational risk,
compliance and legal risk, and strategic risk. Most risks can be grouped into three general
categories: financial risks, operational risks and strategic risks.
Table showing major risk categories
Financial risks Operational risks Strategic risks
Credit Risk Transaction Risk Governance Risk
Transaction risk Human resources risk Ineffective oversight
Portfolio risk Information and technology Poor governance structure
risk
Liquidity risk Fraud risk Reputational risk
Market risk Legal and compliance risk External business risks
Interest rate risk Event risk
Foreign exchange risk
Investment portfolio risk

Financial Risks
The business of a financial institution is to manage financial risks, which include credit risks,
liquidity risks, interest rate risks, foreign exchange risks and investment portfolio risks.
Most microfinance institutions have put most of their resources into developing a methodology
that reduces individual credit risks and maintaining quality portfolios. Microfinance institutions
that use savings deposits as a source of loan funds must have sufficient cash to fund loans and
withdrawals from savings. Those MFIs that rely on depositors and other borrowed sources of
funds are also vulnerable to changes in interest rates. Financial risk management requires a
sophisticated treasury function, usually centralized at the head office, which manages liquidity
risk, interest rate risk, and investment portfolio risk. As MFIs face more choices in funding
sources and more product differentiation among loan assets, it becomes increasingly important to
manage these risks well.
Credit risk
Credit risk, the most frequently addressed risk for MFIs, is the risk to earnings or capital due to
borrowers’ late and non-payment of loan obligations. Credit risk encompasses both the loss of
income resulting from the MFI’s inability to collect anticipated interest earnings as well as the
loss of principle resulting from loan defaults. Credit risk includes both transaction risk and
portfolio risk.
Transaction risk
Transaction risk refers to the risk within individual loans. MFIs mitigate transaction risk through
borrower screening techniques, underwriting criteria, and quality procedures for loan
disbursement, monitoring, and collection.
Portfolio risk
Portfolio risk refers to the risk inherent in the composition of the overall loan portfolio. Policies
on diversification (avoiding concentration in a particular sector or area), maximum loan size,
types of loans, and loan structures lessen portfolio risk.
Management must continuously review the entire portfolio to assess the nature of the portfolio’s
delinquency, looking for geographic trends and concentrations by sector, product and branch. By
monitoring the overall delinquency in the portfolio, management can assure that the MFI has
adequate reserves to cover potential loan losses. MFIs have developed very effective lending
methodologies that reduce the credit risk associated with lending to microenterprises, including
group lending, cross guarantees, and peer monitoring. Other key issues that affect MFIs’ credit
risk include portfolio diversification, issuing larger individual loans, and limiting exposure to
certain sectors (e.g. agricultural or seasonal loans). Each type of lending has a different risk
profile and requires unique loan structures and underwriting guidelines.
Effective approaches to managing credit risk in MFIs include:
Well-designed borrower screening, careful loan structuring, close monitoring, clear collection
procedures, and active oversight by senior management. Delinquency is understood and
addressed promptly to avoid its rapid spread and potential for significant loss.
Good portfolio reporting that accurately reflects the status and monthly trends in delinquency,
including a portfolio-at-risk aging schedule and separate reports by loan product.
A routine process for comparing concentrations of credit risk with the adequacy of loan loss
reserves and detecting patterns (e.g., by loan product, by branch, etc.)

Liquidity risk
Liquidity risk is the possibility of negative effects on the interests of owners, customers and other
stakeholders of the financial institution resulting from the inability to meet current cash
obligations in a timely and cost-efficient manner
Liquidity risk usually arises from management’s inability to adequately anticipate and plan for
changes in funding sources and cash needs. Efficient liquidity management requires maintaining
sufficient cash reserves on hand (to meet client withdrawals, disburse loans and fund unexpected
cash shortages) while also investing as many funds as possible to maximize earnings (putting
cash to work in loans or market investments).
A lender must be able to honor all cash payment commitments as they fall due and meet
customer requests for new loans and savings withdrawals. These commitments can be met by
drawing on cash holdings, by using current cash flows, by borrowing cash, or by converting
liquid assets into cash.
Liquidity management is not a one-time activity in which the MFI determines the optimal level
of cash it should hold. Liquidity management is an ongoing effort to strike a balance between
having too much cash and too little cash.
If the MFI holds too much cash, it may not be able to make sufficient returns to cover the costs
of its operations, resulting in the need to increase interest rates above competitive levels. If the
MFI holds too little cash, it could face a crisis of confidence and lose clients who no longer trust
the institution to have funds available when needed. Effective liquidity management protects the
MFI from cash shortages while also ensuring a sufficient return on investments.
Some principles of liquidity management that MFIs use include:
 Maintaining detailed estimates of projected cash inflows and outflows for the next few
weeks or months so that net cash requirements can be identified.
 Using branch procedures to limit unexpected increases in cash needs. For example, some
MFIs, such as ASA, have put limits on the amount of withdrawals that customers can
make from savings in an effort to increase the MFI’s ability to better manage its liquidity.
 Maintaining investment accounts that can be easily liquidated into cash, or lines of credit
with local banks to meet unexpected needs.
 Anticipating the potential cash requirements of new product introductions or seasonal
variations in deposits or withdrawals.

RISK INTERACTION:
Liquidity risk and credit risk interact. For example, a loan that is not repaid when due represents
a credit risk and a loss of liquidity. A significant increase in delinquency (e.g. in the event of
natural disaster) suddenly reduces the cash inflow from loan repayments and may increase cash
outflows for new loans. This squeezes cash reserves and increases liquidity risk. Conversely,
liquidity management can be especially important in MFIs where a client’s propensity to repay is
influenced by her future access to loans. Rumors that an MFI might not be able to extend credit
immediately upon repayment because it has run out of cash could cause borrowers to default in
an effort to protect against their own impending cash shortage
Market risk
Market risk includes interest rate risk, foreign currency risk, and investment portfolio risk.
Interest rate risk Interest rate risk arises from the possibility of a change in the value of assets and
liabilities in response to changes in market interest rates. Also known as asset and liability
management risk, interest rate risk is a critical treasury function, in which financial institutions
match the maturity schedules and risk profiles of their funding sources (liabilities) to the terms of
the loans they are funding (assets).
For example, The savings and loan crisis in the 1980s in the United States resulted largely from
the mismatching of assets and liabilities. The savings and loan institutions (S&Ls) had financed
themselves primarily with short-term deposits while investing in long-term, fixed interest rate
mortgages. When the cost of short-term funding rose quickly, the S&Ls were not able to
restructure their asset base fast enough to avoid significant losses
In MFIs, the greatest interest rate risk occurs when the cost of funds goes up faster than the
institution can or is willing to adjust its lending rates. The cost of funds can sometimes exceed
the interest earned on loans and investments, resulting in a loss to the MFI.
Most financial institutions and some regulated MFIs have a separate fund management or
treasury department whose main function is to manage risks associated with interest rate
changes. Asset and liability management functions are usually centralized in the head office to
cost-effectively manage borrowed funds and the investment portfolio (idle funds not lent)
Foreign exchange risk
Foreign exchange risk is the potential for loss of earnings or capital resulting from fluctuations in
currency values. Microfinance institutions most often experience foreign exchange risk when
they borrow or mobilize savings in one currency and lend in another. For example, MFIs that
offer dollar savings accounts and lend in the local currency risk financial loss if the value of the
local currency weakens against the dollar. Alternatively, if the local currency strengthens against
the dollar, the MFI experiences a financial gain.
Principles in practice by MFIs to reduce foreign exchange risk include:
- Due to the potential severity of the downside risk, an MFI should avoid funding the loan
portfolio with foreign currency unless it can match its foreign liabilities with foreign
assets of equivalent duration and maturity
Investment portfolio risk
Investment portfolio risk refers mainly to longer-term investment decisions rather than short term
liquidity or cash management decisions.

Principles used by MFIs include:

To reduce investment portfolio risk, treasury managers sway investment maturities to ensure that
the MFI has the long-term funds needed for growth and expansion.
In addition, they consider the credit, inflation, and currency risks that might threaten the value of
the principal investment. Short-term investments, for example, carry less risk of losing value due
to inflation.
Most financial institutions have policies establishing parameters for acceptable investments
within the investment portfolio, and they range from very conservative to more aggressive for a
portion of the investment portfolio. These policies set limits on the range of permitted
investments as well as on the degree of acceptable concentration for each type of investment.

Operational Risks
Operational risk arises from human or computer error within daily product delivery and services.
It exceeds all divisions and products of a financial institution. This risk includes the potential that
inadequate technology and information systems, operational problems, insufficient human
resources, or breaches of integrity (i.e. fraud) will result in unexpected losses.
1. Transaction risk
Transaction risk exists in all products and services. It is a risk that arises on a daily basis
in the MFI as transactions are processed. Transaction risk is particularly high for MFIs
that handle a high volume of small transactions daily. When traditional banks make
loans, the staff person responsible is usually a highly trained professional and there is a
very high level of cross-checking. Since MFIs make many small, short-term loans, this
same degree of cross-checking is not cost effective, so there are more opportunities for
error and fraud

Common Operational Risks in MFIs:

- The Management Information System does not correctly reflect loan tracking, e.g.
information disbursed, payments received, current status of outstanding balances
- Lack of effectiveness and insecurity of the portfolio management system, e.g. external
environment is not safe, software does not have internal safety features (i.e. no backups),
inaccurate MIS and untimely reports.
- Inconsistencies between the loan management system data and the accounting system
data.
- Misrepresentation of loan payoffs, e.g. through refinancing, payoffs with inadequate
collateral or post dated checks.
- Rescheduling disguises loan quality problems, e.g. rescheduled loans treated as on-time.
- Inconsistent implementation of the loan administration.
- Lack of portfolio related fraud controls, e.g. no client visits to verify loan balances
- Loan tracking information is not adequate, e.g. no aging of portfolio outstanding,
inadequate credit histories.
For MFIs, key steps to reduce transaction risk include:
- Simple, standardized and consistent procedures for cash transactions throughout the
MFI.
- Effective internal controls that are incorporated into daily procedures to reduce the
chance of human error and fraud at the branch level (e.g. require dual signatures,
separate lines of reporting for cash and program transactions).
- Strong ex-post internal controls (i.e. internal audit) to test and verify the accuracy of
information and adherence to policies and procedures. These internal controls help
ensure that management reporting information is providing the most accurate
information, and reduces the occurrence of problems.
- Using computer systems and minimizing the number of times data has to be manually
entered reduces the chance and frequency of human error.
Fraud risk
Until recently, fraud risk has been one of the least addressed risks in microfinance to
date. Also referred to as integrity risk.
Fraud risk is the risk of loss of earnings or capital as a result of intentional deception by
an employee or client. The most common type of fraud in an MFI is the direct theft of
funds by loan officers or other branch staff. Other forms of fraudulent activities include
the creation of misleading financial statements, bribes, kickbacks, and phantom loans.
Effective internal controls play a key role in protecting against fraud at the branch level,
since line staff handle large amounts of client and MFI funds. While fraud risks exist in
all financial institutions, if left uncontrolled, they inevitably increase as fraudulent
behaviors tend to be learned and shared by employees. Internal controls should include
ex-ante controls that are incorporated within the methodology and design or procedures
(prior to operation), as well as ex-post controls that verify that policies and procedures
are respected (after operations).
Governance risk
One of the most understated and underestimated risks within any organization is the risk
associated with inadequate governance or a poor governance structure.
Direction and accountability come from the board of directors, who increasingly include
representatives of various stakeholders in the MFI (investors, borrowers, and institutional
partners). The social mission of MFIs attracts many high-profile bankers and business
people to serve on their boards. Unfortunately, these directors are often reluctant to apply
the same commercial tools that led to their success when dealing with MFIs.

To protect against the risks associated with poor governance structure, MFIs should
ensure that their boards comprise the right mix of individuals who collectively represent
the technical and personal skills and backgrounds needed by the institution. Microfinance
institutions are particularly vulnerable to governance risks resulting from their
institutional structure and ownership. One of the strongest links to effective governance is
ownership. Board members with a financial stake in the institution tend to have stronger
incentives to closely oversee operations. However, many MFIs operate as non-
governmental organizations whose board members have no financial stake in the
institution.
Effective governance requires clear lines of authority for the board and management. The
board should have a clear understanding of its mandate, including its duties of care,
loyalty and obedience. It is the board’s responsibility to oversee senior management and
hold them accountable for strategic decisions. If board members fail to fulfill their duties
effectively, the MFI risks financial loss as a result of poor decision making or inadequate
strategic planning.
Reputation Risk
Reputation risk refers to the risk to earnings or capital arising from negative public
opinion, which may affect an MFI’s ability to sell products and services or its access to
capital or cash funds. Reputations are much easier to lose than to rebuild, and should be
valued as an intangible asset for any organization.
Most successful MFIs cultivate their reputations carefully with specific audiences, such
as with customers (their market), their funders and investors (sources of capital), and
regulators or officials. A comprehensive risk management approach and good
management information reporting helps an MFI speak the “language” of financial
institutions and can strengthen an MFI’s reputation with regulators or sources of funding.
External business environment risk
Business environment risk refers to the inherent risks of the MFI’s business activity and
the external business environment. To minimize business risk, the microfinance
institution must react to changes in the external business environment to take advantage
of opportunities, to respond to competition, and to maintain a good public reputation.
In general, the best way for an MFI to reduce external risks is to integrate an effective
system of risk management into its culture and operations. An effective risk management
system should encourage directors and senior managers to ask whether they are prepared
for certain possible internal and external situations and whether they have built in
sufficient cushion for unexpected events.

Regulatory and legal compliance risk

Compliance risk arises out of violations of or non-conformance with laws, rules,
regulations, prescribed practices, or ethical standards, which vary from country to
country. The costs of non-conformance to norms, rules, regulations or laws range from
fines and lawsuits to the voiding of contracts, loss of reputation or business opportunities,
or shut-down by the regulatory authorities.
Many non-government organizations that provide microfinance are choosing to transform
into regulated entities, which exposes them to regulatory and compliance risks. Even
those microfinance NGOs that are not transforming are increasingly subjected to external
regulations.
Other challenges of MFI’s
- Rapid growth and expansion: Several strains on an MFI’s operations. For many
MFIs, growth has strained their capacity to groom new managers from within the
ranks, forcing rapid promotions to fill management positions (e.g. new branch
managers) with less experience. The risk of having operations run poorly by
inexperienced managers can be exacerbated by weak human resource planning or
insufficient investment in training. When employee backgrounds do not match their
responsibilities, operational risk increases in the organization.
MFIs use several risk management strategies when faced with rapid growth:
- Careful attention to staff recruitment and training. The MFI can reduce operational
risk by carefully growing staff and ensuring that employees’ interests are aligned with
those of the goals of the organization.
- Control growth to allow time to develop internal systems and prepare staff for
changes resulting from the expansion.
- Carefully monitor loan growth and portfolio quality to better understand growth (e.g.,
number of loans per client, average loan size, growth in number of borrowers) and to
not let growth mask increases in delinquency.
- Good communication from senior managers to reinforce the MFI’s culture and
commitment to quality service and integrity. These efforts should motivate new
employees, as well as existing employees who are being asked to do more.

Succession planning
As a young industry, many MFIs are just beginning to experience the first
management transition from founder to successor. For many, the dynamic and
charismatic leadership at the top has been a key motivational and risk management
tool for the employees and managers, providing a unifying vision and strong sense of
commitment and mission for the organization. For others, the transformation into a
regulated financial institution may create the need for new leadership, or existing
leaders may choose to return to the original NGOs to continue more development-
oriented activities.
While leadership change is part of growth and evolution into a mature industry, few
MFIs have planned for the inevitable succession of senior management. MFIs should
not wait until key management staff nears retirement as the need for a successor is not
always predictable.

New product development

New product risk is the potential loss that can result from a product that fails or
causes unintended harm to the MFI. Since many MFIs are experimenting with new
product innovations.
EFFECTIVE RISK MANAGEMENT
As financial service providers, MFIs thrive on reasonable risk. Successful MFIs
incorporate risk management into their organizational design, lending methodologies,
savings services, and operational procedures. This section describes each of the steps
involved in the risk management feedback loop of a microfinance institution.

Identify, assess, and prioritize risks

The first step in risk assessment is to identify risks. To identify risks, the MFI reviews
its activities, function by function, and asks several questions. For example, the MFI
examines the credit and lending operations, and reviews funding sources, loan
transactions and portfolio management processes.

It should highlight the major risks that are most significant to the MFI and require
management’s close attention. Since product differentiation is becoming more
prevalent in MFIs, the MFI should assess each product’s specific risk profile. For
example, housing loans are likely to have higher delinquency and loss rates than the
loans for income-generating activities. In this case, the relative size and severity of
risk in that housing portfolio requires management’s special attention.

In addition, the MFI should evaluate risks in individual lending separately from peer
group lending. Because individual loans tend to be larger and are often made without
co-guarantees, individual loan portfolios can be riskier and represent a different type
of risk exposure than group lending portfolios. By categorizing and evaluating
activities according to their risk profiles, MFIs can better understand risks and can
take action to reduce large exposures and avoid losses.

The second step involved in risk assessment is to determine the probability of risks
occurring and their potential severity. To assess the probability and severity of risks, a
risk management chart or matrix is used.
Risk management matrix. A risk management matrix helps the risk managers assign
ratings to different risks and prioritize those areas that need additional attention. For
each risk, the matrix assigns a rating of four different factors:
(1) The quantity or severity of the risk, based on the potential severity and probability
of occurrence (e.g. Low, Moderate, or High);
(2) The quality of existing risk management, or how well management currently
measures, controls, and monitors the risk (e.g. Strong, Acceptable, Weak);
(3) The aggregate risk profile for that risk, combining the first two measures (e.g.
High, Moderate, Low); and
(4) The trend or direction of that risk (e.g. Stable, Increasing, or Decreasing).

This tool allows management to assess the most important risks to control, the areas
with the weakest controls at present, and those areas where risk may be increasing

Develop strategies to measure risk

 After the board and management define priorities, they can develop strategies that
guide the organization’s management of those risks. The board typically develops
policies and sets the outer parameters for the business activities of an organization.
Within those broad policies, management then develops guidelines and procedures
for day-to-day operations.

The board of directors is responsible for reviewing and approving policies that
minimize risk to the MFI (within its business strategy), protect the fiduciary interests
of investors and depositors, and ensure that the MFI fulfills its mission.

The board is also responsible for monitoring those risks and ensuring that
management is enforcing the policies they approved. That oversight function is
accomplished through management reporting.

The goal is to make conscious, informed decisions about which risks to take, what is
an acceptable level of risk, and what cost-benefit tradeoff is reasonable. It is the
board’s responsibility to ensure that the MFI is making informed decisions about how
much risk is tolerable and that there is sufficient capital and liquidity for the MFI to
absorb any financial loss, should it occur.

MFIs can make several choices on how to mitigate a risk. They can:
- accept the risk as part of doing business (e.g. a cost of credit risk is annual loan
losses);
- mitigate the risk to bring it to reasonable levels through carefully-designed policies
and procedures (e.g. centralized disbursement, group lending, etc);
- eliminate the risk entirely (e.g. security to prevent physical property loss or computer
back-up for the management information systems);
- or transfer the risk to someone else (e.g. buy insurance against certain losses).

In each case, management and the board must evaluate the cost/benefit tradeoffs.
Each of these strategies entails some cost, either in staff time, expenses, or
opportunity costs. For example, trying to eliminate credit risk would not be a good
use of an MFI’s resources. It would require changes in the target customer, and
additional personnel to monitor borrowers closely and pursue delinquent loans to
avoid loss. The costs to the MFI in terms of increased personnel, lower productivity,
fewer loans to new customers (opportunity cost), and significant management time,
would exceed the potential benefit of protected revenues.

Design operational policies and procedures to mitigate risk

In most cases, an MFI lives with certain risks and designs a lending methodology and
system of controls and monitoring tools to ensure that
a) risk does not exceed acceptable levels, and
b) there is sufficient capital or liquidity to absorb the loss if it occurs. These controls
might include:
 - Policies and procedures at the branch level to minimize the frequency and scale of
the risk (e.g. dual signatures required on loans or disbursements of savings).
- Technology to reduce human error, speed data analysis and processing.
- Management information systems that provide accurate, timely and relevant data so
managers can track outputs and detect minor changes easily.
- Separate lines of information flow and reconciliation of portfolio management
information and cash accounting in the field to identify discrepancies quickly.

These are all examples of the internal controls MFIs use to maintain reasonable levels
of risk in their activities ex-ante, before operations. They are built into program
design, procedures and daily operations.

Implement into operations and assign responsibility

The next step is for management to integrate those policies, procedures and controls
into operations and assign managers to oversee them. In the implementation process,
management should seek input from operational staff on the appropriateness of the
selected policies, procedures and controls.
To effect change, the risk management system must assign clear responsibility to
someone to implement the risk controls and ensure that they are respected. Ideally,
the person should be a senior manager with operations experience and authority.

Test effectiveness and evaluate results

Management must regularly check the operating results to ensure that risk
management strategies are indeed minimizing the risks as desired. The MFI evaluates
whether the operational systems are working appropriately and having the intended
outcomes.

The MFI assesses whether it is managing risks in the most efficient and cost-effective
manner. By linking the internal audit function to risk management, the MFI can
systematically address these questions.

Good management reporting is essential to understanding whether these controls are

effective, i.e. yielding the intended results. This information reporting should occur
on several levels:
- Management reporting for operating managers: Operations managers need detailed,
timely reports that provide specifics on customer outreach, lending activity, savings
(if relevant), and branch operations. The branch and regional managers need this
information to better understand where the MFI is losing or making money, how well
unit branches are performing relative to budget, and to identify credit or liquidity
issues at the field or operations level.
- Summary reports for senior managers and directors: This audience needs summary
reports that capture trends in key ratios and indicators so they can monitor the
organization’s overall performance.
 - Internal audit reports: The internal audit is a critical part of the risk management
feedback loop. It evaluates operations “ex post” and helps assess whether the “ex-
ante” (before operations) procedures and controls are effective in mitigating risk. The
internal audit process tests the accuracy of the information coming from management
reports and investigates specific areas of higher risk to the MFI.
Revise policies and procedures as necessary
Based on the summary reporting and internal audit findings, the board reviews risk policies for
necessary adjustments. To be most effective, the internal audit should report directly to the
MFI’s board of directors. While only significant internal audit findings are reported to the board,
the directors should ensure that necessary revisions are quickly made to the systems, policies and
procedures, as well as the operational workflow to minimize the potential for loss

Guidelines for Risk Management

Guidelines for Implementing a Risk Management Framework:
1. Lead the risk management process from the top : It is the task of the MFI’s leadership (the
directors, CEO and senior managers) to communicate the importance of risk management and
instill a risk management culture at all levels of the institution. Without a commitment to risk
management from the top and resources to support it, the MFI cannot expect its employees to
perform in a manner that mitigates risk
2. Incorporate risk management into process and systems design: MFIs should incorporate risk
management into the design of its systems, processes, and methodologies to reduce the
frequency and scale of unwanted risk from the outset. Designing procedures that reduce the
chance of human error can improve quality control and significantly boost productivity and
efficiency.
For example, the most successful MFIs worldwide have built excellent credit risk management
into their lending methodologies, using screening techniques, co-guarantees, and other
mechanisms to reduce the likelihood of delinquency and default.
An important principle for integrating risk management into the MFI’s daily operations is
through the use of internal controls, such as the segregation of duties and functions. By
segregating duties, the MFI can prevent conflicts of interest and reduce risk. A lack of
segregation of duties, for example between cash transactions and recording or between cash
authorizations and disbursement, creates opportunities for fraud and collusion among staff. After
incorporating internal controls, the MFI conducts independent checks and reviews to ensure that
the system works correctly.
3. Keep it simple and easy to understand: A risk management framework is a tool for managers
that helps to manage their risk. It should be simple and clear, comprising a short list of key ratios
or figures. Tools should ease, and not complicate, the burden of already over-stretched managers.
4. Involve all levels of staff: Employees at all levels of an MFI can play a role in risk
identification and mitigation, from the data processor, to the loan officer, to the human resource
trainer
5. Align risk management goals with the goals of individuals: MFIs can further reinforce a risk
management culture by building risk management into the employees’ goals and performance
incentives. For example, rather than reward loan officers simply for volume of disbursements,
MFIs can reward staff based on a combination of loan disbursements, delinquency below a
certain threshold and repayment rates within a certain range.
6. Address the most important risks first: When beginning the risk assessment process, it is
daunting to take on all risks at the same time. MFIs should prioritize risks according to those that
have the most severe potential outcomes and those that have a high probability of occurrence
7. Assign responsibilities and set monitoring schedule : FIs must assign operational
accountability for monitoring and managing risk on a daily basis, as well as senior level
accountability for oversight of specific risks. Senior management and the board share the
responsibility for the MFI’s overall risk management strategy. To ensure they receive useful and
relevant information on a timely basis, the MFI charges specific staff members with the
responsibility for collecting and reporting information.
8. Design informative management reporting to board: good management reporting is essential to
risk management. Without good information, directors and management cannot assess whether
current risk management strategies and tools are working effectively, or whether new risks have
appeared that require immediate attention. Every level of the MFI requires some regular
management reports to monitor operations.
9. Develop effective mechanisms to evaluate internal controls: Every MFI should have some
form of internal audit, with the level of formality and complexity appropriate to the size and
complexity of the MFI. Internal audit functions take various forms, from management spot
checks, in which an operational manager is assigned specific audit duties, to an entirely separate
department. Larger and regulated MFIs often have a permanent internal audit department
10. Manage risk continuously using a risk management feedback loop: Risk management is a
continual process, not a single event. Financial, operational, and strategic risks change constantly
in response to changes in competition and the economy. New product introductions or
geographic expansions also expose the MFI to new risks that need to be incorporated into the
system quickly, ensuring that useful information is generated during the pilot or test period.