Qualitative Standards

The bank must maintain a protocol for compliance with a documented set of internal manuals, policies, controls and procedures concerning the operation of the internal market risk management model. The bank’s risk management model must be well documented. Such documentation may include a comprehensive risk management manual that describes the basic principles of the risk management model and that provides a detailed explanation of the empirical techniques used to measure market risk. 10.14 The bank must receive approval from SAMA prior to implementing any significant changes to its internal models used to determine market risk capital requirements. 10.15 The bank’s internal models for determining market risk capital requirements must address the full set of positions that are in the scope of application of the model. All models’ measurements of risk must be based on a sound theoretical basis, calculated correctly, and reported accurately. 10.16 The bank’s internal audit and validation functions or external auditor must conduct an independent review of the market risk measurement system on at least an annual basis. The scope of the independent review must include both the activities of the business trading units and the activities of the independent risk control unit. The independent review must be sufficiently detailed to determine which trading desks are impacted by any failings. At a minimum, the scope of the independent review must include the following: (1) the organisation of the risk control unit; (2) the adequacy of the documentation of the risk management model and process; (3) the accuracy and appropriateness of market risk management models (including any significant changes); (4) the verification of the consistency, timeliness and reliability of data sources used to run internal models, including the independence of such data sources; (5) the approval process for risk pricing models and valuation systems used by the bank’s front- and back-office personnel; (6) the scope of market risks reflected in the trading desk risk management models; (7) the integrity of the management information system; (8) the accuracy and completeness of position data; (9) the accuracy and appropriateness of volatility and correlation assumptions; (10) the accuracy of valuation and risk transformation calculations; (11) the verification of trading desk risk management model accuracy through frequent backtesting and PLA assessments; and (12) the general alignment between the model to determine market risk capital requirements and the model the bank uses in its day-to-day internal management functions.