Risk Management

We enabled an effective risk management process from identification to mitigation, following an integrated approach across all the business processes. Our risk management culture across all parts of the organisation creates the basis for the robust risk management framework.

In 2020, a black swan event created about an economic, health, and social crisis that far exceeded the 2008–2010 global financial crisis in scope and impact. Several risks, namely, the credit risk, liquidity risk, market risk and capital risk became prominent risks during the crisis. The unprecedented adverse implications increased our strategic execution risk and the level of financial risks. The overall state of our risk management, balance sheet management, internal control environment and risk culture had remained sound and robust. We strive for agility by ensuring that a responsible, accountable and effective governance and risk management framework is in place, whilst managing risks associated with our evolving external environment.

In the recent years, CDB’s risk universe and risk management focus expanded greatly to include emerging risks such as cybersecurity, data loss and privacy to ensure that our tech initiatives and investments provide a greater value and a return in terms of efficiency and reliability without exposing the Organisation to any severe risk. Stringent adherence to rapidly evolving regulatory requirements had been given priority in achieving our strategic objectives.

How our key risks evolved during the year under review

Business risk was elevated in our risk universe and was driven by external factors such as COVID-19 pandemic, domestic macroeconomic and political risks, and the unprecedented level of change underpinned by the country’s reserve position and FOREX liquidity position. This has heightened inherent risk across the entire risk universe applicable to financial institutions, with high levels of stress during Q4 2021/22 across operational, liquidity, market (interest rate risk, equity price risk, currency exchange rate risk) and credit risk. However, residual risk, or the net risk outcomes were well managed within our risk appetite ensuring the CDB’s resilience and sustainable growth. We ended FY 2021/22 with a much improved outlook than FY 2020/21.

Amidst the external challenges, CDB was able to record an exceptional performance and risk metrics throughout the year in review. CDB being an Entity that is technologically-driven we continually aim to strengthen our systems and controls in order to ensure protection against cyber risks. Anti-money laundering and compliance risks have been areas of emphasis and we implemented the necessary measures to successfully combat compliance and AML risks as a responsible public deposit taking institution.

Amidst the external challenges, CDB was able to record an exceptional performance and risk metrics throughout the year in review.

Our ERM approach and governance

Our Enterprise Risk Management Framework (ERMF) provides the governance structure and approach for our risk management disciplines and guides us to embed a sound risk culture. It defines our risk management universe, structure, policies and processes. No material changes were made to the framework this year and we remained committed to ensure compliance to ERMF across the Organisation, whilst internalising the same. Through the framework, we created higher levels of assurance and visibility about potential risks and provided clarity on risk identification and mitigation. We enabled an effective risk management process from identification to mitigation, following an integrated approach across all the business processes. Employees have become more aware of potential risks and are reporting risks more frequently following frequent risk awareness campaigns. We continued to strengthen our business continuity plans and further improved our resilience to adverse risk events.

Our ERMF has been established in line with CDB’s entity wide strategic objectives and values with an ultimate objective of enhanced value creation. It ensures that risk management at CDB helps to harness opportunities arising from the evolving environment, ensuring optimum balance between risk and return. This future focused approach and robust governing structure (Three Lines of Defence model) ensures CDB’s resilience amidst different categories of risks through key risk management enablers which are integrated with high level strategies as well as mid and bottom level operations.

We continue to strengthen the use of information technology for the risk management framework and its application to effectively respond to the rapidly evolving economic context.

CDB’s Three Lines of Defence model defines the roles and responsibilities in managing risks within the risk appetite. This emphasises the fundamental concept that risk ownership and management is everyone’s responsibility across all the levels of the hierarchy.

WE HAVE ESTABLISHED AN EXTENSIVE, MULTI-LAYERED STRUCTURE TO GOVERN RISK

Combined assurance

Combined assurance enhances risk management

CDB combined assurance model

Creates a single view of the key risks for all assurance providers, enabling an alignment of efforts.
Provides oversight, structure and guidance for the identification, evaluation and treatment of risks.
Improves the overall assurance provided to Senior Management and the Board.
Provides role clarity to all assurance providers regarding their responsibilities.

Our risk culture

Managing risk is integral to how we create long-term value for our customers and stakeholders. Our risk culture is built on four principles: enforcing robust risk governance; balancing growth with stability; ensuring accountability for all our risk-based decisions and actions; and encouraging awareness, engagement and consistent behaviour in every team member. Each of these principles is based on our distinctive set of values that guides every action we take.

In addition, we expect all our team members to demonstrate a high awareness of risk and control by self-identifying issues and managing them in a manner that will deliver lasting change. What is unique about CDB is how we have carved the importance of risk identification and risk management into our team members’ mind set. We reward our team members who identify and report on critical risk areas on a quarterly basis and we have embedded a risk identification attitude into all our members’ performance assessment scorecards as well. The “Risk Reporting Champions” are recognised from among our team members and they are rewarded with monetary rewards at the Company’s annual award ceremony.

Risk management process

Update for 2021/22

Future outlook

Despite the heightened external risk environment, the outcomes and state of risk and capital management continued to be well controlled throughout FY 2021/22, confirming CDB’s agility, effectiveness, and the strong risk culture. The Risk Heat Map below shows the key risk drivers that could affect CDB in FY 2022/23 (over a one-year horizon) along the dimensions of probability and impact based on the residual risk outcome. The risk drivers are not to be seen in isolation as they may trigger or reinforce each other.

Snapshot of key risks and mitigation strategies

Credit risk
Credit risk triggers when obligors fail to meet their financial or contractual obligations towards CDB when due. This comprise two components namely Default risk and Concentration risk. Concentration risk refers to the potential loss resulting from undue exposure to a particular customer segment, geographical location or a portfolio subsegment.
Key highlights in 2021/22	Risk exposure	Future focus
NPL ratio was maintained at 5.89% compared to previous year’s 7.00% and the industry ratio was at 8.99% under challenging operating conditions. This reflects the efficiency of the recovery strategies which were in place to maintain healthy collection ratios especially amid the pandemic. The cumulative collection ratio stood at 98.39% compared to 95.86% in the previous financial year. Yard stocks were reduced by approx. 84mn within FY by disposing a higher number of vehicles on a daily/weekly basis through tenders, dealer points and car points and by promoting via patpat.lk (online platform) to generate sales leads. Continuous dialogue is maintained with customers to provide optimum solutions addressing repayment and settlement related concerns. NPL ratio and the movement of the age basket under different criteria were monitored closely. This was significantly improved through successful recovery campaigns and strategies. Broadened collection channels enhancing customer convenience apart of conventional methods of cash collection.		Portfolio NPL levels and age movement to be closely monitored giving special focus to specific products, sectors, geographical areas etc. to identify contracts which are vulnerable to default. Improve data analytic capabilities via BI team to design optimum follow up strategies based on customer behaviour and early warning signals. Continuous revision and review of credit evaluation criteria based on evolving external market environment variables and in line with the risk appetite of the Company. Automated credit decision via BOT process to be implemented to all the lending products i.e. auto loans, credit cards with the objective of increasing the quality of the credit decision and enhancing the credit granting process efficiency and transparency.

Funding and liquidity risk
Refers to the risk that the Company is unable to meet short-term financial obligations as they fall due without incurring major losses due to insufficient liquid assets.
Key highlights in 2021/22	Risk exposure	Future focus
A strong liquid assets position was maintained throughout the year and the liquidity ratio stood at 14.14% as of FY end. All the contractual obligations were met/honoured including foreign borrowing payments on time. Maturity mismatch was maintained around -2.64% level (one year gap) and was managed at tolerable levels. Liquidity stress testing was carried out based on different worst-case scenarios and liquidity contingency plans were prepared and discussed at the monthly ALCO forums. Continuous cash flow predictions were carried out to ensure that all the short-term obligations were met ensuring optimum return on investments and liquid assets.		Ensuring smooth management of liquid assets and investment portfolio via the newly installed treasury system along with a robust monitoring mechanism. Continuous improvement in cash flow predictions, forecasts and development of contingency funding mechanisms including pre-negotiated facilities with lenders.

Market risk
Changes in equity prices, interest rates, exchange rates, and commodity prices can possibly cause a financial loss to CDB due to our exposure to such market variables.
Key highlights in 2021/22	Risk exposure	Future focus
Improved internal forecasts and stress testing analyses facilitated the ALCO and Senior Management to make sound decisions minimising adverse implications from market risks. Optimum pricing decisions and strategies executed in line with dynamic market variables helped CDB to record a strong top line performance ensuring a greater consistency in our income generation. 12 months cumulative maturity gap was prevailing around -2.64% level and this improved maturity mismatch position supports the organization in minimizing repricing risk deriving from interest rate sensitive assets and liabilities. Prudent and continuous reviews, predictions and impact assessments ensured that the gold loan exposures are managed at optimum levels, within the risk appetite under sufficient LTV while advancing our competitive position. Due to the efficiency of hedging arrangements to minimise foreign currency risk, the impact of LKR depreciation was minimal during the FY from CDB’s exposure to foreign borrowings.		Continue to conduct forecast based interest rate stress testing analyses under different scenarios to better react to unforeseen economic conditions in terms of market interest rates Prudent measures to minimise the implications from stressed scenarios based on the outcome from future focused assessments.

Operational risk
An unforeseen external or internal event can cause a potential loss to the Organisation. Internal frauds, external fraud, employment practices and workplace safety, clients, products, and business practice, damage to physical assets, business disruption and systems failures, execution, delivery, and process management are the main categories of operational risk.
Key highlights in 2021/22	Risk exposure	Future focus
New ways and means of onboarding customers, immediate credit approvals, opening of savings accounts and fixed deposits and customer servicing though automated processes were initiated while complying with the regulatory requirements and guidelines. Continuous investment in IT infrastructure facilities to improve the efficiency and effectiveness of internal business processes while minimising bottlenecks and limiting the likelihood of risk occurrence. Proactively assessed and managed IT risk related concerns prior to enabling IT platforms and systems during process automations. Improved BCP and DR planning to ensure our operational resilience against unforeseen incidents. Cyber drills and comprehensive trainings covering BCP and fire fighting were carried out to enhance awareness among team members to immediately respond in emergencies. Conducted vulnerability assessments through third parties. Strengthened 1st Level (Functional Division), 2nd Level (Risk and Compliance) and 3rd Level (Internal Audit) monitoring on transactions and internal work flow execution enhancing the reliability of the processes.		AI based models and data analytics to monitor client behaviour and further enhance our prediction, prevention, detection and response capabilities in the fraud identification and reaction. Continuously promote a risk reporting culture by appointing risk representatives for each division. Continue to proactively recognise and address the cyber risks and IT risks stemming from IT platforms. Operational risk tracking and monitoring through different operational risk indicators through an integrated dashboard.

Strategic risk
Strategic risks are those risks that are most consequential to the Entity’s ability to execute its strategies and achieve its objectives, and these can ultimately affect shareholder value or the viability of the entity.
Key highlights in 2021/22	Risk exposure	Future focus
Achieved a bottom line growth of 41% compared to the previous FY amidst challenging market conditions. Various projects including process automations were initiated and executed and the risks were proactively accessed and addressed prior to implementation in order to minimise unforeseen risks and ensure alignment with our strategic objectives. Dashboards with key KPIs and KRIs are reviewed on an ongoing basis at management level committees to ensure immediate measures are obtained to minimise the variances while ensuring KRIs are within the risk appetite.		Continue to align Business Strategy and Enterprise Risk Management Strategy from top to bottom to proactively identify and address risks while creating value to our stakeholders. Further streamline and integrate business operations via Robotic Process Automation projects enhancing process integrity and efficiency. Use of big data and data analytics to support business decision making under prevailing dynamic business context.

Reputational risk
Reputational risk refers to the potential for negative publicity, public perception or uncontrollable events to have an adverse impact on an entity’s reputation, thereby affecting its earnings.
Key highlights in 2021/22	Risk exposure	Future focus
Introduced a customer convenience initiative; a self-service automation project. With the implementation of the project, our customers are now able to inquire on the arrears status of lending facilities through a simple missed call (via system registered number). The customers have 24/7 access to this service with no hold time or interaction with contact centre agents. Mystery Caller programmes were carried out periodically and the results helped to ascertain customer perceptions and experience. The findings have been an invaluable source of information to deliver a better first impression to customers and enhance phone etiquette. Implemented the “Work from Home” contingency plan following the pandemic, and maintained 24×7 operations in trilingual languages. Implemented “Customer Information Retrieve Solution” which allows the agents to provide a better and a speedy solution to client inquiries. Social listening reviews were carried out on an ongoing basis to capture the public reaction and feedback on social media. This initiative helped to address customer concerns while improving service quality and standards.		Advance IVR development to automate frequently asked questions. Enable the customer portfolio summary to pop up on the agent’s desktop through a CRM pop up screen when a customer contacts the customer hotline through a system registered number. This will further enhance service quality and efficiency. The Service Management Unit will be a centralised section that handles all customer complaints and inquiries, which it directs through multiple channels. The Unit is tasked with redirecting complaints and inquiries to the appropriate department or branch, and ensuring their resolution within the stipulated Service-Level Agreements (SLAs).

Compliance risk GRI 205-1, 205-2, 205-3
The risk of legal or regulatory sanction, financial loss or reputational damage to the entity as a result of its failure to comply with laws, regulations, codes of conduct and standards.
Key highlights in 2021/22	Risk exposure	Future focus
Adopted a rigorous and proactive approach when complying with various regulatory authorities. On a monthly basis Compliance meetings held with the Senior Management to review the compliance status of the Organization along with the Compliance dashboard which covers regulatory ratios, compliance initiatives, New Directions/Guidelines etc. Strengthen the processes with regard to anti-money laundering aspects and appointed compliance representatives among operational divisions as a part of the compliance culture at CDB.		To further enhance our efforts to capture and report suspicious transactions in tandem with the guidelines set by the Financial Intelligence Unit (FIU) of the CBSL. Continue to conduct company-wide awareness training on anti-money laundering especially among front office team members.