First, the definition of commercial bank risk

In 1895, American scholar Hemings defined "risk" as "risk as an economic factor": "The word risk has no technical content in economics and other academic fields, which means the possibility of damage. Whether a certain behavior will produce harmful consequences should be defined by its uncertainty. If a behavior is uncertain, then its behavior reflects the burden of risk. " It can be said that risk refers to the uncertainty (or possibility) that causes loss. There are two elements of risk: loss and uncertainty (possibility), which rule out the impossibility and inevitability of loss. The loss probability is greater than 0 and less than 1.

Modern commercial banks mainly refer to banks that operate deposits and provide short-term loans to industry and commerce. It has created the vast majority of deposit currencies, and its loan assets account for a considerable proportion of financial assets in various countries. Especially in the case of indirect financing in China, the assets of commercial banks have absolute advantages, which have great influence on the national economy and the risks are quite prominent.

1, risk characteristics of commercial banks

Due to the particularity of commercial bank commodity currency and its management, commercial bank risk has different characteristics from general risk.

① The uniqueness of the risk connotation of commercial banks.

The risk of general industrial and commercial enterprises can generally be defined as the possibility of asset loss or the possibility of operating losses. As a credit enterprise, commercial banks have a much broader definition of risk. The efficiency and safety of funds and the possibility of loss or loss of liquidity should all be defined as risks. If the bank's loan principal and interest can't be repaid on schedule, it will suffer losses and affect the customer's deposits and the supply of loan funds, which will affect the development and survival of the bank. If the bank's funds are illiquid, that is, it lacks the ability to pay all accounts payable to customers in time, commercial banks will face bankruptcy. Credit is the lifeblood of banks, and the possibility of credit loss is a risk that commercial banks must not underestimate.

② The duality of risk sources of commercial banks.

The risks of commercial banks come from many aspects, and there are various risks in their deposit and loan business activities and other business activities. To a great extent, the nature of indirect production of commercial banks determines the duality of their risk sources. On the one hand, the risk comes from the internal management of banks, and the possibility of capital loss caused by high management cost or poor management is internal risk. On the other hand, the risk comes from the object of credit funds-customers. Loans and interest losses caused by the failure of customers' production and operation activities and investment activities belong to external risks.

(3) Double effects of commercial bank risks.

The business activities of commercial banks are the main components of the monetary and financial system, connecting borrowers and lenders. Through the credit chain and payment chain, the business activities of commercial banks have penetrated into all fields of social economy and have a strong influence. Market changes are unpredictable. Once a bank has a crisis, it will not only affect its own security, but also cause a domino effect, which will have a destructive impact on customers, banks with business contacts and even the whole society. Most modern countries have regarded the safe and steady operation of the banking industry as the height of national security.

Therefore, the risk of a commercial bank can be defined as the possibility that its actual operating conditions deviate from the expected operating conditions due to the influence of various uncertain factors between itself and its customers in the process of operation and management, thus causing the efficiency, safety or liquidity of commercial banks to suffer losses.

2. Risk classification of commercial banks

According to the Core Principles of Effective Banking Supervision promulgated by Basel Committee 1997 in September, various risks faced by commercial banks are as follows:

① Credit risk

Loans are the main activities of banks. Lending activities require banks to judge the credit level of borrowers. These judgments are not always correct, and the credit level of borrowers may also decline for various reasons. Banks are always faced with the risk of losing loans due to the default of their counterparties, that is, credit risk.

② Country risk

When banks carry out international credit business, they are faced with national risks in addition to the credit risks arising from general loan business. The so-called country risk refers to the risk related to the economic, social and political environment of the country where the borrower is located. When lending to foreign governments or government agencies, the country risk is most obvious, because such loans are usually unsecured.

③ Market risk

Due to the change of market price, both on-balance sheet and off-balance sheet positions of banks will face the risk of loss. This risk is most obvious in the bank's trading activities, whether it is related to debt and equity instruments, or to foreign exchange or commodity positions. A specific content of market risk is foreign exchange risk. As a market maker in the foreign exchange market, banks publish quotations to customers and hold open positions in various currencies. When the exchange rate fluctuates greatly, the inherent risks of foreign exchange business, especially the risks of foreign exchange exposure positions, will increase.

④ Interest rate risk

Interest rate risk refers to the risk faced by the bank's financial situation when interest rates fluctuate unfavorably. This risk not only affects the profitability of banks, but also affects the economic value of their assets, liabilities and off-balance-sheet financial instruments.

⑤ Liquidity risk

Liquidity risk refers to the bank's inability to provide financing for the reduction of liabilities or the increase of assets, that is, when the bank's liquidity is insufficient, it can't quickly increase liabilities or realize assets at a reasonable cost to obtain enough funds, thus affecting its credit and profitability. In extreme cases, insufficient liquidity will make banks insolvent.

⑥ Operational risk

The most important operational risk lies in the failure of internal control and governance mechanism. This failure may cause the bank to suffer financial losses due to mistakes, fraud and failure to respond in time, or the interests of the bank may suffer losses in other ways, such as bank traders, loan officers and other staff exceeding their powers or engaging in businesses that are not allowed by professional ethics or are too risky. Other aspects of operational risk include major failures or events of information technology systems, such as fires and other disasters.

⑦ Legal risk

Commercial banks must bear different forms of legal risks. Including the risk that the value of assets will decrease or the debt will increase than expected due to imperfect and incorrect legal opinions and documents. At the same time, the existing laws may not solve the legal problems related to commercial banks: a court case related to a commercial bank may have a wider impact on the entire commercial banking business, thus increasing the cost of the bank itself and even all commercial banks, and the relevant laws may change. Commercial banks are particularly vulnerable to legal risks when the legal rights of new businesses or trading partners are unclear.

⑧ Reputation risk

Reputation risk comes from operational mistakes, violation of relevant laws and other issues. Reputation risk is extremely harmful to commercial banks, because the business nature of banks requires them to maintain the confidence of depositors, lenders and the whole market.

Second, the concept of risk management of commercial banks

1. The concept of risk management

William and Hans, the famous risk management experts, define risk management as: "Risk management is a scientific management method to minimize all kinds of adverse consequences caused by risks at the least cost by identifying, measuring and controlling risks." The purpose of risk management is consistent with that of enterprise management. By planning, arranging and controlling various business activities and resources of the enterprise, the influence of various uncertain events with negative effects can be minimized. Risk management can also be understood as the effective use of required resources by enterprises in order to restore financial stability and business vitality after unexpected losses, or to minimize long-term risk losses at a fixed cost.

2. The concept of risk management of commercial banks.

Risk management of commercial banks refers to preventing, avoiding, eliminating or transferring risks in operation through risk analysis, risk prediction and risk control, so as to reduce or avoid economic losses and ensure the safety of operating funds. It has two meanings: one is to minimize the risk under the condition of certain income; The second is to maximize the income under certain risk conditions. These two basic objectives (income objective and safety objective) of risk management of commercial banks are consistent with their business objectives.

Because the risks of commercial banks are hidden and unpredictable, and mainly rely on their own management, the risk management of commercial banks is more difficult than general risk management. The risk management of commercial banks is a complex system engineering, which involves various businesses of banks. Different business departments have different ways to control risks and different emphases, but the overall goal of the whole bank is the same, that is, the process of seeking the optimal risk-return combination. In other words, in the final analysis, its goal is to ensure the implementation of the principles of "three natures" (namely, liquidity, profitability and security) of commercial banks and obtain greater profits with relatively small risks.

The second part is the present situation and existing problems of risk management of commercial banks in China.

The risk management of commercial banks in China started late. With the deepening of financial system reform, the risk management of commercial banks in China has improved, but there are still many problems. Judging from China's current actual situation and the process of reform and opening up, China's commercial banks are facing and will face the following problems:

1. The asset quality is not high. Due to internal and external reasons such as self-interest-driven, lack of self-restraint and internal control mechanism, government administrative intervention and macro-policy adjustment, a considerable number of assets of commercial banks in China have become or will become bad debts, losing income and even principal.

It is difficult to recover the loan. Although the Company Law, the Commercial Bank Law, the General Principles of Loans and other laws and regulations have been promulgated and implemented, banks still face the risk that enterprises are unwilling or unable to repay bank loans, which makes them bear a greater risk that loans cannot be recovered.

3. The risk of marketization has increased. China's financial market has developed to a certain scale, and banks' fund raising and application have begun to be market-oriented, which will make banks face the risk of liquidity or payment crisis. For example, the development of interbank lending market can be beneficial to the liquidity management of commercial banks, but due to the imperfection of the market and the irregular lending behavior of commercial banks, it may lead to the crisis of liquidity or payment ability.

4. Exchange rate and other financial derivatives trading risks are increasing. With the continuous expansion of foreign exchange business and foreign exchange transactions of commercial banks, the exchange rate fluctuations they face are also increasing. At the same time, due to the lack of management experience, commercial banks' participation in financial derivatives trading further increases their operational risks.

5. Interest rate risk increases. With the continuous marketization of financing and the central bank's use of interest rate control means, the frequency and extent of interest rate changes will be further accelerated and expanded, and the interest rate risks faced by banks will also be further increased.

6. Financial crimes are frequent and have a great impact. The types and means of crimes are increasingly diverse, and the economic losses and influences are also expanding, especially the financial fraud and theft cases caused by internal reasons of banks, which further increase the risk of bank capital loss.

There are many factors that cause the above problems. Some are caused by lax internal control, and some are formed by external objective factors; Some are endogenous controllable, and some are exogenous uncontrollable. Therefore, commercial banks should pay attention to internal risk control and consider external monitoring factors to design the risk management system of commercial banks.

The third part is to improve the risk management system of commercial banks in China.

The establishment and improvement of the risk management system of commercial banks is a huge and complicated systematic project, which should include six subsystems: information communication and policy coordination system of risk supervision of commercial banks, risk prevention system, risk prediction system, risk evaluation system, risk early warning system and risk handling system.

Since the 1990s, the bankruptcies of international banks such as BCCI (International Inter-bank Credit Bank), Bahrain and Daiwa, as well as the frequent occurrence of bank risk events in China in recent years, have made us more and more aware that improving the internal risk control mechanism of commercial banks is an important issue facing China's financial system reform.

Commercial banks should strengthen internal monitoring from both hardware and software to improve their risk prevention ability. The so-called "hardware", that is, hardware planning, is the organizational design of risk management in commercial banks. The so-called "software", that is, software planning, refers to the understanding and attitude of bank managers to various rules and regulations, as well as related corporate culture and management concepts. The hardware and software of internal risk control in commercial banks complement each other and are indispensable.

First, decent planning-organizational design of internal control of commercial banks

The design of risk management system of commercial banks includes the following three elements: strategy, organizational design and reward system. If any business behavior of a commercial bank is regarded as "investment", then its risk management strategy can be regarded as an investment strategy, which will depend on the investment attitude (that is, the philosophy of investment strategy) and affect its organizational design and reward system (from

Table 1 shows the relationship between the three).

Table 1 Cooperation between investment purpose and hardware surface

It aims to avoid risks and gain profits.

Passive strategies generally avoid risks partially or even completely, which can also be said to be excessive risk avoidance.

Centralized organization and design, decentralization of local or departmental power.

Reward system: middle (high) basic salary for investment analysts and middle (low) basic salary for investment analysts.

Performance awards and pensions High performance awards and pensions

The internal organizational structure of commercial banks should be set according to the principle of effective operation, and its characteristics should fully reflect the standardization of risk management, correspond to the domestic financial system, and adapt to the changes in the external operating environment. In order to make the risk management of commercial banks systematic and institutionalized, banks can set up a scientific and reasonable internal organizational structure according to different risk levels and types, thus forming a set of risk management system.

In addition to implementing a series of management procedures and handling methods, the risk management of commercial banks must also have reasonable arrangements in the internal organization of banks. Specifically, the risk management system of commercial banks should usually pay attention to the following three aspects: first, scientific organizational arrangements, the establishment of specialized risk management departments, such as various flexible and efficient risk management committees within commercial banks. The function of the Risk Management Committee is to cooperate closely with the internal audit department, data statistics department and business operation department, comprehensively collect and process relevant information, systematically identify, analyze, evaluate and control risks, so as to strictly monitor self-operation and realize self-restraint and self-balance, so as to quickly adapt to changes in the financial environment, reduce operational risks and greatly improve the safety, liquidity and profitability of assets. Secondly, set up business departments reasonably, and reflect the concept of risk prevention in the most basic department setting. Every business of a bank cannot be completed by a single department. Taking credit risk management as an example, credit business is generally completed by two departments: credit management department and credit business department are completely separated. Managers are not in direct contact with customers, but only responsible for the approval and management of loans, and the pre-loan evaluation and loan issuance are completed by business department personnel. Third, strictly follow the risk management procedures to make risk management quantitative, concrete and institutionalized. For example, the risk management 12 index set up by Citibank in the United States is worth learning from our commercial banks. These 12 indicators are risk indicators, industry status indicators, boundary indicators, product status indicators, global real estate information indicators, national risk indicators, counterparty risk indicators, incidental risk indicators, price risk indicators, cash risk indicators, equity risk indicators and securities underwriting risk indicators. These highly sensitive risk management indicators have realized the scientific management and steady operation of banks and promoted the standardized development of banks.

Management structure design

The organizational structure of risk management system of commercial banks is logically consistent with the stratification of bank decision-making system and management system. The decision-making of general banks is divided into three levels: development strategy decision, operation management decision and business development decision, and the organizational structure of decision-making and management is also divided into three levels: the board of directors at the highest level of decision-making and the managers of business departments under the leadership of committees, general managers and general managers. The risk classification and standardized management are shown in Table 2.

Table 2 Risk Classification and Standardized Management

Risk Management Mode Risk Management Department

Credit Risk III/II Customer-intensive Risk Management Credit Business Department, Credit Review Department and Financing Planning Department

Liquidity risk level III/II professional departments focus on risk management business department, treasury department and overseas department.

Interest Rate Risk II/I Management Strategy Risk Management Finance Department and Planning Department

Exchange rate risk Ⅲ/Ⅱ Risk management of different financial instruments and currencies Overseas Department and Treasury Department

Investment Risk II/I Specialized departments focus on risk management: Finance Department, Securities Department and Planning Department.

Transaction Risk Ⅲ Business-intensive Risk Management Business Department and Audit Department

Business Risk I Business Strategic Risk Management Planning Department, Personnel Department, Research Department, etc.

Policy Risk I Management Strategy Risk Management Planning Department and Research Department

Note: I= decision-making level of development strategy, II = decision-making level of operation management and III = decision-making level of business development.

The above table focuses on the relationship between risk management and operation management, determines the corresponding management institutions in risk management, embodies the corresponding relationship of organizational structure in the bank risk management system, and clarifies the relationship between risk management and operation management.

This structural design is based on the following reasons:

(1) Credit risk management. Credit risk refers to the risk that loans, bonds and other assets lose their solvency due to the debtor's default. Credit risk management needs direct contact with customers to collect and analyze information, so it is most appropriate for credit business department, credit review department and other departments to undertake it.

(2) Liquidity risk management. Liquidity risk refers to the risk that banks will suffer losses if they cannot meet the demand for deposit withdrawal and normal loans. In liquidity risk management, the situation of local currency and foreign currency is slightly different, and local currency funds are raised by special departments, so the liquidity management of local currency funds should be undertaken by business departments or financial departments. It is more appropriate for the liquidity risk management of foreign currency funds to be handled by specialized departments or local overseas banks.

(3) Interest rate risk management. The risk of interest rate change refers to the risk of fluctuation and decline of bank interest income caused by the change of market interest rate level. Interest rate risk management also has different ways in local and foreign currency funds, especially foreign exchange funds can basically be raised from the market, and the income is entrusted to the fund-raising department for accounting. Therefore, the management of foreign exchange change risk should be undertaken by the department responsible for the income management of foreign exchange funds. The financing and application of local currency funds are very limited, and its prediction of interest rate changes and corresponding operations must conform to the strategic intention of bank development, so this kind of risk management belongs to strategic risk management.

(4) Exchange rate risk management. Exchange rate risk refers to the risk that the fluctuation of foreign exchange rate leads to the loss of bank assets in the process of holding or using. Like the risk of foreign exchange interest rate changes, the relevant departments need to adjust the income cost of foreign exchange funds at any time according to the exchange rate changes in the market, so as to reduce the loss of foreign exchange risks, so it is managed centrally by the fund department. At the same time, branches of overseas banks should be required to manage foreign exchange risks according to different foreign exchange currencies.

(5) Investment risk management. Investment risk is the risk that banks suffer from market price fluctuations when investing in securities, movable property and real estate. The management of investment risk needs the development strategy of the bank, so it should be comprehensively managed by the finance department, securities department, planning department and other departments.

(6) Transaction risk management. Transaction risk refers to the risk of losses caused by subjective or objective reasons of operators in the process of handling related businesses or transactions by the banking business department or other departments. Transaction risk management can be carried out during transaction processing or completed by the audit department afterwards, so the business department and the audit department are jointly responsible.

(7) Operational risk management and policy risk management. Operating risk refers to the risk that the operating cost deviates greatly from the original expected target, which leads to the decline of bank profits. Belongs to the bank's business decision. Policy risk refers to the risk of direct or indirect loss of banking business due to changes in relevant national policies. It is not controlled by the business department, but directly decided by the highest decision-making department of the bank. The management of these two types of risks is entrusted to the planning department by the highest decision-making body of the bank and its subordinate risk management Committee, and the personnel department and the research department can also cooperate.

2. Introduce external control mechanism

In order to prevent internal shareholders of joint-stock commercial banks (or financial companies) from exploiting external shareholders, customers can ask banks (or companies) to publish financial statements in time in case of accidents, and provide shareholders and people or institutions (such as financial institutions) interested in banks (or companies) with the risk exposure of investments made by banks (or companies). However, because the frequency of financial statements is at most once a quarter, external control is often afterwards.

Under the management of companies above the company level, for the organizational design of departmental risk management, the investment departments of many banks or financial enterprises adopt the way that trading and delivery affairs are handled by different personnel (or units) respectively. The function of this method is to make departments contain each other and avoid personnel risks (such as the risk of absconding with money).

Through the above analysis, we can get an organizational design framework for internal risk control of financial investment, which is not only applicable to commercial banks, but also to general financial enterprises (as shown in figure 1).

Second, software planning-the concept and principle of internal risk control of commercial banks

1, modern concept

Behaviorism school emphasizes that "obeying the law is not enough for self" and "invincible". Therefore, after planning the hardware aspects such as rules and systems, the institutional school needs to formulate the following soft measures with modern ideas to give it flesh and blood and life.

A commercial bank is also a kind of enterprise, which should have its own unique corporate culture and management concept, and form the same culture and concept.

(1)*** same culture. How to brand the bank's mission, objectives, ethics and morality in employees' minds and create a corporate culture with the same spirit has always been a topic that enterprises strive for. In other words, employees are persuaded to abide by the ethical standards of bank employees and investment-related personnel, and are willing to actively urge their individuals and departments to minimize risks in order to pursue the long-term welfare of enterprises and individuals.

(2) Scientific employment. It is a sufficient condition for the smooth operation of the whole system that investors and auditors have law-abiding consciousness and professional ability. Therefore, managers should be scientific in employing people and knowing people, and pass psychological tests before employing people, so as to reduce the probability of bad behavior of employed traders, deliverymen and inspectors. The former chairman of the Federal Council of the United States suggested in his G30 report that "the psychological stress of traders must be tested regularly", and its purpose is still to reduce management risks.

We believe that the key to risk management is to establish risk awareness and risk avoidance. Examples such as Bahrain Bank remind us to be always on guard against risks, and realize that diversification of banking business brings diversification of risks, and individual risks and risk points (especially those of derivative financial instruments) are extremely lethal, which is enough to destroy the whole foundation; We should keep a good balance among profit, scale, speed and risk, and don't blindly pursue profit and ignore risk, and don't overemphasize risk and ignore reasonable profit, scale and speed. In a word, establishing a strong risk awareness within the whole bank will be a powerful cornerstone of bank risk management.

2. The principle of internal risk management

(1) The principle of fully identifying risks. This is the first stage and necessary preparation for implementing risk management. With the deepening of the research on the design, development and trading methods of financial products and the increase of off-balance-sheet activities of banks, many potential risks cannot be evaluated by traditional asset-liability management and financial analysis. This requires that risk managers must have a high degree of professional knowledge and risk analysis ability in order to make risk management measures feasible.

(2) The principle of actively avoiding risks. This is mainly aimed at credit risk. Commercial banks should avoid dealing with high-risk objects and objects with poor credit ratings to avoid losses. Another meaning of avoiding risks is to correctly handle the relationship between maintaining or reducing costs and corporate profits and huge risks.

(3) The principle of overall risk dispersion. The rule of thumb proves that different asset portfolios can effectively reduce risks, and their control effects on external risks such as market risk, liquidity risk and credit risk are more significant.

(4) Strictly limit the risk principle. It refers to limiting the possible risks of the transaction to a certain range. Banks (or financial enterprises) that conduct financial transactions should set trading limits and risk limits. 1988 Basel Accord stipulates the capital adequacy ratio of banks engaged in derivative goods business, which requires that the proportion of free capital of bank assets to risk assets should not be less than 8% after giving risk weight to bank-specific financial assets and off-balance sheet transactions respectively.

(5) Check the risk principle with each other. This is one of the important principles of internal control. On the basis of division of labor among departments, no financial business can be handled by one person alone, and it must be audited and supervised by multiple departments.

Commercial banks should design a reasonable risk management process according to the above concepts and principles. A reasonable risk management process should be able to integrate the management process of individual risks into the overall risk management system, which should include: (1) risk measurement system. Make the risk measurement process fully and accurately reflect all kinds of risks faced; Risk measurement standards should also be understood by people at all levels and provide a similar framework for risk limitation and monitoring. (2) Risk limiting system. It should be consistent with the effectiveness of the whole risk management process and the adequacy of the capital level, and set classification boundaries for various risks to ensure that the risk exposure exceeds the set level and can be reported to the management in time. (3) Management information system. It is necessary to report the risks measured by the risk management department to the top management department in time, so that they can fully understand the risk situation.

In short, China's commercial banks should establish and improve the internal risk control mechanism, and consider the introduction of external objective factors and external control mechanisms, and gradually form a new risk management system with China characteristics and in line with the current national conditions.