Management Summary
- Purpose / Background: This document (SR-1 V.2) provides updated non-statutory guidance on the HKMA’s supervisory approach to "Strategic Risk"—the risk to earnings, capital, and reputation arising from adverse strategic decisions, improper implementation, or lack of responsiveness to environmental changes. It aligns HKMA standards with the Basel Committee’s 2024 Core Principles for Effective Banking Supervision.
- One-line conclusion: AIs must formalize their strategic risk management frameworks to ensure they are commensurate with their size and complexity, focusing on robust planning, execution, and performance feedback loops.
- Key Changes:
- Explicit integration of "Strategic Risk" as one of the eight core inherent risks in the HKMA’s risk-based supervisory framework.
- Enhanced emphasis on board-level oversight and active engagement in the strategic planning process.
- Requirement to maintain a formal, documented "Strategic Risk Management Framework" (SRMF).
- Introduction of stress testing as a tool to evaluate strategic plan viability under adverse scenarios.
- Requirement for performance evaluation systems to bridge the gap between planning and implementation.
- Key Dates / Deadlines: Consultation phase (active). No immediate hard deadline for full compliance, but AIs are expected to make steady progress; the HKMA will monitor development against individual institutional circumstances.
- Applicability / Impact scope: Applies to all Authorized Institutions (AIs). The level of sophistication required is proportionate to the AI's size, business nature, and complexity.
- Recommended management actions:
- Conduct a gap analysis between current strategic planning processes and the SR-1 V.2 framework requirements.
- Formally document the roles/responsibilities of the Board, senior management, and specialized risk units regarding strategic decision-making.
- Implement periodic (at least annual) reviews of strategic plans and capital/funding needs.
- Integrate qualitative stress testing into the strategic planning cycle to identify potential threats to business objectives.
- Develop clear performance indicators (both financial and non-financial) to track strategy execution and report variances to the Board.
Detailed Summary
1) Document Overview
SR-1 V.2 serves as a guidance note clarifying how the HKMA supervises strategic risk. It defines strategic risk as a function of goal compatibility, strategy quality, resource deployment, and execution capability. While non-statutory, it informs the HKMA's assessment of an AI's internal controls (Seventh Schedule, Banking Ordinance).
2) Main Requirements
- Framework: AIs must establish a structured SRMF to identify, assess, monitor, and control strategic risk.
- Oversight: The Board and senior management must actively oversee strategic planning, approve the strategic plan, and ensure it aligns with the AI's risk appetite.
- Planning: Strategies must be supported by adequate capital, funding, HR, and IT infrastructure. Plans should cover a 3-5 year horizon.
- Monitoring: AIs must implement performance evaluation systems to track actual outcomes against planned goals and report significant variances.
3) Key Changes
- Shift from general guidance to a more formal "system-based" supervisory approach.
- Increased expectation for the use of stress testing to validate strategic assumptions.
- Explicit requirement for managing "change" (organizational/cultural resistance) as part of the implementation strategy.
4) Important Dates & Transition
This is a consultation draft. The HKMA recognizes the evolution of strategic risk management and does not mandate immediate full compliance. Instead, AIs must demonstrate "steady progress" toward implementation.
5) Impact and Risks
- Operational: Increased burden on Board/Management to document decision-making logic.
- Compliance: Failure to show an effective framework may trigger a requirement for an independent auditors’ report under §59(2) of the Banking Ordinance.
- Financial/Capital: Poor strategic choices will now be directly linked to the Supervisory Review Process (SRP) for capital adequacy assessments.
6) Compliance Action Checklist
- [ ] Review organizational structure to ensure a designated function supports strategic risk monitoring.
- [ ] Incorporate stress-testing scenarios into the annual strategic planning exercise.
- [ ] Update Management Information Systems (MIS) to ensure data accuracy for performance reporting to the Board.
- [ ] Establish formal "trigger points" on KPIs that necessitate a formal Board review of current strategies.
7) Appendices/attachments summary
- Annex A (Common causes of strategic failure): Provides hypothetical examples of planning/implementation failures (e.g., over-reliance on past success, aggressive expansion without expertise) to guide AIs in refining their SRMF.
- Annex B (Strategic risk profile): Categorizes risk profiles as low, moderate, or high, serving as the benchmark for the HKMA's supervisory assessment process.