1. This component of the framework identifies the principal elements of a system of internal controls for monitoring and managing the various risks to which a firm engaged in business as a professional intermediary in the OTC derivatives markets may be exposed as a result of its OTC derivatives activities.
   

2. The guidelines, policies and procedures referred to in this discussion need not be designed or implemented specifically for OTC derivatives activities but may form part of a broader or an integrated firm-wide system of internal risk management guidelines, policies and procedures, as a particular firm deems appropriate.
   

3. The design and implementation of an effective system of sound controls for a particular firm should reflect the circumstances of the firm. Accordingly, an individual firm must have the flexibility to implement specific policies and procedures unique to its circumstances. Conversely, policies and procedures that are appropriate for one firm may not be appropriate for another.
   

   Factors that may influence the policies and procedures of an individual firm include:
   

   • the ownership and governance structure of the firm (e.g., private partnership or close corporation versus publicly-held company);
     

   • the composition of the firm's governing body;
     

   • the firm's management philosophy and culture;
     

   • the scope and nature of the risk management guidelines established by the firm;
     

   • the scope and nature of the approved OTC derivatives activities of the firm in relation to its overall activities and capital;
     

   • the sophistication and experience of relevant trading, risk management and internal audit personnel;
     

   • the sophistication and functionality of information and reporting systems; and
     

   • the character and frequency of monitoring, reporting and auditing activities.
     

II. Risk Management Control Objectives

1. Internal risk management control systems are designed to implement management's business judgment regarding the scope or level of activity risk to be undertaken by an individual firm and to reduce the firm's risk of inadvertent loss.
   

2. An effective system of internal controls should include:
   
   • the adoption of risk management guidelines at an appropriate level of management; and
     

   • the implementation of risk monitoring systems to identify, measure, monitor and report exposure to relevant risks and of risk management processes to control those risks.
     

Outline of Risk Management Controls

Firms engaged in significant OTC derivatives activities should have in place comprehensive internal risk management control systems that are commensurate with the scope, size and complexity of the activities that have been authorized and the nature and extent of the risks they entail. The following overview summarizes the key elements of such risk management control systems.

1. Certain Definitions
   1. Risk. References in this discussion to risk encompass the following:
      
      • market risk: the risk that a change in liquidity or in the level of one or more market prices, rates, indices, volatilities, correlations or other market factors will result in losses for a specified position or portfolio;
        

      • credit risk: the risk that a counterparty will fail to perform its obligations to the firm;
        

      • liquidity risk: the risk that, as a result of mismatches in the timing of cash in-flows and out-flows, a firm will have inadequate cash available to fund current obligations;

      • legal risk: the risk that a counterparty's performance obligations will be unenforceable because (i) the underlying transaction documentation is inadequate; (ii) the counterparty lacks the requisite authority or is subject to legal transaction restrictions; (iii) the underlying transaction is impermissible under applicable law; or (iv) applicable bankruptcy or insolvency laws limit or alter contractual remedies; and
        

      • operational risk: the risk of human error or deficiencies in the firm's operating systems (e.g., database management, trade entry, trade processing, trade confirmation, payment, delivery, receipt, collateral management, valuation and related information systems).
        

   2. Risk Monitoring. Risk Monitoring is that function within a firm that identifies, measures, monitors and reports on the market, credit and liquidity risks incurred by the firm.
      

   3. Risk Management. Risk Management is that process within a firm by which risk guidelines are established, allocated and managed.
      

2. Role of the Governing Body or Other Authorizing Body
   
   1. Authorizing Body. The OTC derivatives activities of a firm should be conducted pursuant to general authorizing guidelines (Authorizing Guidelines) reviewed and approved by the firm's governing body (i.e., a board of directors or its equivalent), a committee of such governing body or a committee designated by the governing body for the purpose of approving such guidelines (Authorizing Body). The Authorizing Body should be selected by the governing body based on, among other relevant considerations, the composition and expertise of the governing body, the customary allocation of equivalent responsibilities within senior management of the firm and the nature, scope and complexity of the firm's OTC derivatives activities.
      

      If the Authorizing Body is not the governing body (or a committee comprised exclusively of members of the governing body) of the firm the Authorizing Guidelines, and material amendments to the Authorizing Guidelines, should be reported to the firm's governing body (or a committee comprised exclusively of members of the governing body).
      

   2. Written guidelines. The Authorizing Guidelines should be adopted in written form by the firm's Authorizing Body.
      

   3. Relevant considerations. Relevant factors to be considered by the Authorizing Body in approving Authorizing Guidelines include the firm's overall business strategies and product lines, its tolerance for risk and its general risk management philosophy, its past performance and experience, its financial condition and capital levels, its internal expertise and experience, the sophistication of its Risk Monitoring and Risk Management systems and processes and any regulatory or organizational constraints.
      

   4. Authorizing Guidelines. The Authorizing Guidelines should address the following areas:
      
      • the scope, or the procedures for determining the scope, of authorized activity or any nonquantitative limitation on the scope of authorized activities;
        

      • the quantitative guidelines for managing the firm's overall or constituent risk exposure(s);
        

      • the significant structural elements of the firm's Risk Monitoring and Risk Management systems and processes;
        

      • the scope and frequency of reporting by management on risk exposures; and
        

      • the mechanisms for reviewing the Authorizing Guidelines.
        
        1. Scope of authorized activity. If the Authorizing Body wishes to impose specific (nonquantitative) constraints on the scope of permitted activities (such as product, market, geographic or trading strategy restrictions), the Authorizing Guidelines should specify any restrictions. If the Authorizing Body wishes to approve only specific activities, the Authorizing Guidelines should specify the scope of authorized activity. The Authorizing Guidelines may designate one or more individuals within management or management committees to perform the function of authorizing or restricting activities in particular products or markets.
           

        2. Guidelines on risk exposure(s). The Authorizing Guidelines should establish market and credit risk exposure guidelines applicable to the overall or constituent risk exposure(s) of the firm's derivatives activities. Risk exposure guidelines should be based on factors such as the character of the risk(s) being measured, the extent and nature of the derivative products utilized, the risk measurement methodology employed by the firm and the nature of the firm's counterparties and their industry, country or credit rating categories.

           If the Authorizing Guidelines do not contain specific limits on risk exposures, they should contain quantitative guidelines sufficient to enable management to implement specific quantitative limits. The Authorizing Guidelines may provide that specified individuals or committees within management, independent from or senior to the relevant business or trading unit, may approve exceptions to the quantitative guidelines in the Authorizing Guidelines, with material exceptions to be periodically reported to the Authorizing Body.
           

           The Authorizing Guidelines should also address the degree to which the firm's OTC derivatives-related risk exposures should be aggregated, for purposes of Risk Monitoring and Risk Management, with the related risk exposures arising from other trading activities of the firm.
           

        3. Risk Monitoring and Risk Management structures.

           The Authorizing Guidelines should address the following structural elements of Risk Monitoring and Risk Management:
           

           1. An independent process and checks and balances for Risk Monitoring. The Authorizing Guidelines should define a process for Risk Monitoring independent from the business or trading units whose activities create the risks being monitored.
              

              In connection with Risk Monitoring systems, the Authorizing Body should also consider the need for organizational checks and balances to protect against irregularities or inconsistencies in risk measurement and to ensure to the greatest extent practicable that the risks posed by OTC derivative (and related) products are uniformly and accurately identified and evaluated.
              

           2. The appropriate degree of independence for Risk Management. The Authorizing Guidelines should define a Risk Management function to be performed by specified committees or individuals independent from or senior to the relevant business or trading units whose activities create risks for the firm.
              

           3. Authority, resources and information reporting. The Authorizing Body should determine that the bodies or personnel performing Risk Monitoring and Risk Management functions have the necessary authority and resources to accomplish their management control objectives. The Authorizing Body should also determine that mechanisms are in place through which information regarding the firm's risk-creating activities will be reported to Risk Monitoring and Risk Management personnel.
              

           4. Ongoing review of systems and processes The Authorizing Body should review from time to time the firm's Risk Monitoring and Risk Management systems and processes.
              

           5. Scope and frequency of reporting. The Authorizing Guidelines should identify the type, scope and frequency of reports to be prepared in connection with the firm's Risk Monitoring and Risk Management systems and processes and to be made available for review by the governing body, the Authorizing Body and senior management. Such reports should contain information regarding the firm's positions and risk exposures to facilitate effective oversight of the Risk Monitoring and Risk Management functions. The Authorizing Body should review the scope and frequency of reporting as business and market circumstances change.