12 C.F.R. § 1236 app to Part 1236
The following provisions constitute the prudential management and operations standards established as guidelines pursuant to 12 U.S.C. 4513b(a) . The General Responsibilities of the Board of Directors and Standards 1, 2, 8, and 10 apply to the Office of Finance as appropriate.
General Responsibilities of the Board of Directors and Senior Management
The following provisions address the general responsibilities of the boards of directors and senior management of the regulated entities as they relate to the matters addressed by each of the Standards, and the general responsibilities of the board of directors and senior management of the Office of Finance to the extent a particular Standard is applicable to the Office of Finance. The descriptions are not a comprehensive listing of the responsibilities of either the boards or senior management, each of whom have additional duties and responsibilities to those described in these Standards.
Responsibilities of the Board of Directors
1. With respect to the subject matter addressed by each applicable Standard, the board of directors of each regulated entity and of the Office of Finance is responsible for adopting business strategies and policies that are appropriate for the particular subject matter. The board should review all such strategies and policies periodically. It should review and approve all major strategies and policies at least annually and make any revisions that are necessary to ensure that such strategies and policies remain consistent with the overall business plan of the entity or the Office of Finance.
2. The board of directors is responsible for overseeing management of the regulated entity or the Office of Finance, which includes ensuring that management includes personnel who are appropriately trained and competent to oversee the operation of the regulated entity and the Office of Finance as it relates to the functions and requirements addressed by each applicable Standard, and that management implements the policies set forth by the board.
3. The board of directors is responsible for remaining informed about the operations and condition of the regulated entity or the Office of Finance, including operating consistently with the applicable Standards, and senior management's implementation of the strategies and policies established by the board of directors.
4. The board of directors must remain sufficiently informed about the nature and level of the regulated overall risk exposures of the entity or the Office of Finance, including, as applicable, market, credit, operational, and counterparty risk, so that it can understand the possible short- and long-term effects of those exposures on the financial health of the regulated entity, including the possible short- and long-term consequences, as applicable, to earnings, liquidity, and economic value. The board of directors should: establish the risk tolerances of the regulated entity or the Office of Finance and provide management with clear guidance regarding the level of acceptable risks; review the entire risk management framework of the regulated entity or the Office of Finance, including policies and entity-wide risk limits at least annually; oversee the adequacy of the actions taken by senior management to identify, measure, manage, and control the risk exposures of the regulated entity or the Office of Finance; and ensure that management takes appropriate corrective measures whenever risk limit violations or breaches occur.
Responsibilities of Senior Management
5. With respect to the subject matter addressed by each applicable Standard, senior management is responsible for developing the policies, procedures and practices that are necessary to implement the business strategies and policies adopted by the board of directors. Senior management should ensure that such items are clearly written, sufficiently detailed, and are followed by all personnel. Senior management also should ensure that the regulated entity or the Office of Finance has personnel who are appropriately trained and competent to carry out their respective functions and that all delegated responsibilities are performed.
6. Senior management should ensure that the regulated entity or the Office of Finance has adequate resources, systems, and controls available to execute effectively the business strategies, policies, and procedures of the entity or the Office of Finance, including operating consistently with each of the applicable Standards.
7. Senior management should provide the board of directors with periodic reports relating to the condition and performance of the regulated entity or the Office of Finance, including the subject matter addressed by each of the applicable Standards, that are sufficiently detailed to allow the board of directors to remain fully informed about the business of the regulated entity or the Office of Finance.
8. Senior management should regularly review and discuss with the board of directors information regarding the risk exposures of the regulated entity or the Office of Finance that is sufficient in detail and timeliness to permit the board of directors to understand and assess the performance of management in identifying and managing the various risks to which the regulated entity or the Office of Finance is exposed.
Responsibilities of the Board of Directors and Senior Management
9. The board of directors and senior management should conduct themselves in such a manner as to promote high ethical standards and a culture of compliance throughout the organization.
10. The board of directors and senior management should ensure that the overall risk profile of the regulated entity or the Office of Finance is aligned with its mission objectives.
Standard 1-Internal Controls and Information Systems
Responsibilities of the Board of Directors
1. Regarding internal controls and information systems, the board of directors of each regulated entity and the Office of Finance should adopt appropriate policies, ensure personnel are appropriately trained and competent, approve and periodically review overall business strategies, approve the organizational structure, and assess the adequacy of senior management's oversight of this function.
Responsibilities of Senior Management
2. Regarding internal controls and information systems, senior management should implement strategies and policies approved by the board of directors, establish appropriate policies, monitor the adequacy and effectiveness of this function, and ensure personnel are appropriately trained and competent. The organizational structure should clearly assign responsibility, authority, and reporting relationships.
Responsibilities of the Board of Directors and Senior Management
3. Regarding internal controls and information systems, both the board of directors and senior management should promote high ethical standards, create a culture that emphasizes the importance of this function, and promptly address any issues in need of remediation.
Framework
4. Each regulated entity and the Office of Finance should have an adequate and effective system of internal controls, which should include a board approved organizational structure that clearly assigns responsibilities, authority, and reporting relationships, and establishes an appropriate segregation of duties that ensures that personnel are not assigned conflicting responsibilities.
5. Each regulated entity and the Office of Finance should establish appropriate internal control policies and should monitor the adequacy and effectiveness of its internal controls and information systems on an ongoing basis through a formal self-assessment process.
6. Each regulated entity and the Office of Finance should have an organizational culture that emphasizes and demonstrates to personnel at all levels the importance of internal controls.
7. Each regulated entity and the Office of Finance should address promptly any violations, findings, weaknesses, deficiencies, and other issues in need of remediation relating to the internal control systems.
Risk Recognition and Assessment
8. Each regulated entity and the Office of Finance should have an effective risk assessment process that ensures that management recognizes and continually assesses all material risks, including credit risk, market risk, interest rate risk, liquidity risk, and operational risk.
Control Activities and Segregation of Duties
9. Each regulated entity and the Office of Finance should have an effective internal control system that defines control activities at every business level.
10. The control activities of each regulated entity and the Office of Finance should include:
a. Board of directors and senior management reviews of progress toward goals and objectives;
b. Appropriate activity controls for each business unit;
c. Physical controls to protect property and other assets and limit access to property and systems;
d. Procedures for monitoring compliance with exposure limits and follow-up on non-compliance;
e. A system of approvals and authorizations for transactions over certain limits; and
f. A system for verification and reconciliation of transactions.
Information and Communication
11. Each regulated entity and the Office of Finance should have information systems that provide relevant, accurate and timely information and data.
12. Each regulated entity and the Office of Finance should have secure information systems that are supported by adequate contingency arrangements.
13. Each regulated entity and the Office of Finance should have effective channels of communication to ensure that all personnel understand and adhere to policies and procedures affecting their duties and responsibilities.
Monitoring Activities and Correcting Deficiencies
14. Each regulated entity and the Office of Finance should monitor the overall effectiveness of its internal controls and key risks on an ongoing basis and ensure that business units and internal and external audit conduct periodic evaluations.
15. Internal control deficiencies should be reported to senior management and the board of directors on a timely basis and addressed promptly.
Applicable Laws, Regulations, and Policies
16. Each regulated entity and the Office of Finance should comply with all applicable laws, regulations, and supervisory guidance (e.g., advisory bulletins) governing internal controls and information systems.
Standard 2-Independence and Adequacy of Internal Audit Systems
Audit Committee
1. The board of directors of each regulated entity and the Office of Finance should have an audit committee that exercises proper oversight and adopts appropriate policies and procedures designed to ensure the independence of the internal audit function. The audit committee should ensure that the internal audit department includes personnel who are appropriately trained and competent to oversee the internal audit function.
2. The board of directors should review and approve the audit committee charter at least every three years.
3. The audit committee of the board of directors is responsible for monitoring and evaluating the effectiveness of the internal audit function of each regulated entity and the Office of Finance.
4. Issues reported by the internal audit department to the audit committee should be promptly addressed and satisfactorily resolved.
Internal Audit Function
5. Each regulated entity and the Office of Finance should have an internal audit function that provides for adequate testing of the system of internal controls.
6. Each regulated entity and the Office of Finance should have an independent and objective internal audit department that reports directly to the audit committee of the board of directors.
7. The internal audit department of each regulated entity and the Office of Finance should be adequately staffed with properly trained and competent personnel.
8. The internal audit department should conduct risk-based audits.
9. The internal audit department should conduct adequate testing and review of internal control and information systems.
10. The internal audit department should determine whether violations, findings, weaknesses and other issues reported by regulators, external auditors, and others have been promptly addressed.
Applicable Laws, Regulations, and Policies
11. Each regulated entity and the Office of Finance should comply with applicable laws, regulations, and supervisory guidance (e.g., advisory bulletins) governing the independence and adequacy of internal audit systems.
Standard 3-Management of Market Risk Exposure
Responsibilities of the Board of Directors
1. Regarding the overall management of market risk exposure, the board of directors should remain sufficiently informed about the nature and level of the regulated entity's market risk exposures. At least annually, the board should review the entire market risk framework, including policies and risk limits, and provide an assessment of compliance.
2. Regarding the policies, practices and procedures surrounding the management of market risk, the board of directors should approve all major strategies and policies relating to the management of market risk, ensure all major strategies and policies are consistent with the overall business plan, establish and communicate a market risk tolerance, and ensure appropriate corrective measures are taken when market risk limit violations or breaches occur.
3. The board, or a board appointed committee, should oversee the adequacy of actions taken by senior management to identify, measure, manage, and control market risk exposures, ensure market risk policies establish lines of authority and responsibility, and review risk exposures on a periodic basis.
Responsibilities of Senior Management
4. Regarding the overall management of market risk exposure, senior management should provide sufficient and timely information to the board of directors, ensure personnel are appropriately trained and competent, ensure adequate systems and resources are available to manage and control market risk, report any breaches to the board of directors (or the appropriate board committee), and take appropriate remedial action.
5. Regarding the policies, practices, and procedures surrounding market risk exposure, senior management should ensure market risk policies and procedures are clearly written, sufficiently detailed, and followed. Approved policies and procedures should include clear market risk limits and lines of authority for managing market risk.
Market Risk Strategy
6. A regulated entity should have a clearly defined and well-documented strategy for managing market risk, which must be consistent with its overall business plan, must enable the regulated entity to identify, manage, monitor, and control the regulated entity's risk exposures on a business unit and an enterprise-wide basis, and must ensure that the lines of authority and responsibility for managing market risk and monitoring market risk limits are clearly identified. The strategy should specify a target account, or target accounts, for managing market risk (e.g., specify whether the objective is to control risk to earnings, net portfolio value, or some other target, or some combination of targets), and, if a market risk limit is breached, should require that the breach be reported to the board of directors, or the appropriate board committee, and that appropriate remedial action, including any ordered by the board of directors, should be taken.
7. Management should ensure that the board of directors is made aware of the advantages and disadvantages of the regulated entity's chosen market risk management strategy, as well as those of alternative strategies, so that the board of directors can make an informed judgment about the relative efficacy of the different strategies.
8. A Bank's strategy for managing market risk should take into account the importance of maintaining the market value of equity of member stock commensurate with the par value of that stock so that the Bank is able to redeem and repurchase member stock at par value.
9. A regulated entity should comply with all applicable laws, regulations, and supervisory guidance, (e.g., advisory bulletins) governing the independence and adequacy of the management of market risk exposure.
Standard 4-Management of Market Risk-Measurement Systems, Risk Limits, Stress Testing, and Monitoring and Reporting
Risk Measurement Systems
1. A regulated entity should have a risk measurement system (a model or models) that capture(s) all material sources of market risk and provide(s) meaningful and timely measures of the regulated entity's risk exposures, as well as personnel who are appropriately trained and competent to operate and oversee the risk measurement system.
2. The risk measurement system should be capable of estimating the effect of changes in interest rates and other key risk factors on the regulated entity's earnings and market value of equity over a range of scenarios.
3. The measurement system should be capable of valuing all financial assets and liabilities in the regulated entity's portfolio.
4. The measurement system should address all material sources of market risk including repricing risk, yield curve risk, basis risk, and options risk.
5. Management should ensure the integrity and timeliness of the data inputs used to measure the regulated entity's market risk exposures, and should ensure that assumptions and parameters are reasonable and properly documented.
6. The measurement system's methodologies, assumptions, and parameters should be thoroughly documented, understood by management, and reviewed on a regular basis.
7. A regulated entity's market risk model should be upgraded periodically to incorporate advances in risk modeling technology.
8. A regulated entity should have a documented approval process for model changes that requires model changes to be authorized by a party independent of the party making the change.
9. A regulated entity should ensure that its models are independently validated on a regular basis.
Risk Limits
10. Risk limits should be consistent with the regulated entity's strategy for managing interest rate risk and should take into account the financial condition of the regulated entity, including its capital position.
11. Risk limits should address the potential impact of changes in market interest rates on net interest income, net income, and the regulated entity's market value of equity.
Stress Testing
12. A regulated entity should conduct stress tests on a regular basis for a variety of institution-specific and market-wide stress scenarios to identify potential vulnerabilities and to ensure that exposures are consistent with the regulated entity's tolerance for risk.
13. A regulated entity should use stress test outcomes to adjust its market risk management strategies, policies, and positions and to develop effective contingency plans.
14. Special consideration should be given to ensuring that complex financial instruments, including instruments with complex option features, are properly valued under stress scenarios and that the risks associated with options exposures are properly understood.
15. Management should ensure that the regulated entity's board of directors or a committee thereof considers the results of stress tests when establishing and reviewing its strategies, policies, and limits for managing and controlling interest rate risk.
16. The board of directors and senior management should review periodically the design of stress tests to ensure that they encompass the kinds of market conditions under which the regulated entity's positions and strategies would be most vulnerable.
Monitoring and Reporting
17. A regulated entity should have an adequate management information system for reporting market risk exposures.
18. The board of directors, senior management, and the appropriate line managers should be provided with regular, accurate, informative, and timely market risk reports.
Applicable Laws, Regulations, and Policies
19. A regulated entity should comply with all applicable laws, regulations, and supervisory guidance (e.g., advisory bulletins) governing the management of market risk.
Standard 5-Adequacy and Maintenance of Liquidity and Reserves
Responsibilities of the Board of Directors
1. Regarding the adequacy and maintenance of liquidity and reserves, the board of directors should review (at least annually) all major strategies and policies governing this area, approve appropriate revisions to such strategies and policies, and ensure senior management are appropriately trained to effectively manage liquidity.
Responsibilities of Senior Management
2. Regarding the adequacy and maintenance of liquidity and reserves, senior management should develop strategies, policies, and practices to manage liquidity risk, ensure personnel are appropriately trained and competent, and provide the board of directors with periodic reports on the regulated entity's liquidity position.
Policies, Practices, and Procedures
3. A regulated entity should establish a liquidity management framework that ensures it maintains sufficient liquidity to withstand a range of stressful events.
4. A regulated entity should articulate a liquidity risk tolerance that is appropriate for its business strategy and its mission goals and objectives.
5. A regulated entity should have a sound process for identifying, measuring, monitoring, controlling, and reporting its liquidity position and its liquidity risk exposures.
6. A regulated entity should establish a funding strategy that provides effective diversification in the sources and tenor of funding.
7. A regulated entity should conduct stress tests on a regular basis for a variety of institution-specific and market-wide stress scenarios to identify sources of potential liquidity strain and to ensure that current exposures remain in accordance with each regulated entity's established liquidity risk tolerance.
8. A regulated entity should use stress test outcomes to adjust its liquidity management strategies, policies, and positions and to develop effective contingency plans.
9. A regulated entity should have a formal contingency funding plan that clearly sets out the strategies for addressing liquidity shortfalls in emergencies. Where practical, contingent funding sources should be tested or drawn on periodically to assess their reliability and operational soundness.
10. A regulated entity should maintain adequate reserves of liquid assets, including adequate reserves of unencumbered, marketable securities that can be liquidated to meet unexpected needs.
Applicable Laws, Regulations, and Policies
11. A regulated entity should comply with all applicable laws, regulations, and supervisory guidance (e.g., advisory bulletins) governing the adequacy and maintenance of liquidity and reserves.
Standard 6-Management of Asset and Investment Portfolio Growth
Responsibilities of the Board of Directors and Senior Management
1. Regarding the management of asset and investment portfolio growth, the board of directors is responsible for overseeing the management of growth in these areas, ensuring senior management are appropriately trained and competent, establishing policies governing the regulated entity's assets and investment growth, with prudential limits on the growth of mortgages and mortgage-backed securities, and reviewing policies at least annually.
2. Regarding the management of asset and investment portfolio growth, senior management should adhere to board-approved policies governing growth in these areas, and ensure personnel are appropriately trained and competent to manage the growth.
Risk Measurement, Monitoring, and Control
3. A regulated entity should manage its asset growth and investment growth in a prudent manner that is consistent with the regulated entity's business strategy, board-approved policies, risk tolerances, and safe and sound operations, and should establish prudential limits on the growth of its portfolios of mortgage loans and mortgage backed securities.
4. A regulated entity should manage asset growth and investment growth in a way that is compatible with mission goals and objectives.
5. A regulated entity should manage investments and acquisition of assets in a way that complies with all applicable laws, regulations, and supervisory guidance (e.g., advisory bulletins).
Standard 7-Investments and Acquisitions of Assets
Responsibilities of the Board of Directors and Senior Management
1. The board of directors is responsible for overseeing the regulated entity's investments and acquisition of other assets, ensuring senior management are appropriately trained and competent, and establishing, approving and periodically reviewing policies and procedures governing investments and acquisitions of other assets.
Policies, Practices, and Procedures
2. A regulated entity should have a board-approved investment policy that establishes clear and explicit guidelines that are appropriate to the regulated entity's mission and objectives. The investment policy should establish the regulated entity's investment objectives, risk tolerances, investment constraints, and policies and procedures for selecting investments.
3. A regulated entity should have a board-approved policy governing acquisitions of major categories of assets other than investments. The policy should establish clear and explicit guidelines for asset acquisitions that are appropriate to the regulated entity's mission and objectives.
4. A regulated entity should manage investments and acquisitions of assets prudently and in a manner that is consistent with mission goals and objectives.
5. Each Bank's investment policies and acquisition of assets should take into account the importance of maintaining the market value of member stock commensurate with the par value of that stock so that the Bank is able to redeem and repurchase member stock at par value at all times.
6. A regulated entity should manage investments and acquisitions of assets in a way that complies with all applicable laws, regulations, and supervisory guidance (e.g., advisory bulletins).
Standard 8-Overall Risk Management Processes
Responsibilities of the Board of Directors
1. Regarding overall risk management processes, the board of directors is responsible for overseeing the process, ensuring senior management are appropriately trained and competent, ensuring processes are in place to identify, manage, monitor and control risk exposures (this function may be delegated to a board appointed committee), approving all major risk limits, and ensuring incentive compensation measures for senior management capture a full range of risks to the regulated entity or the Office of Finance.
Responsibilities of the Board and Senior Management
2. Regarding overall risk management processes, the board of directors and senior management should establish and sustain a culture that promotes effective risk management. This culture includes timely, accurate and informative risk reports, alignment of the overall risk profile of the regulated entity or the Office of Finance with its mission objectives, and the annual review of comprehensive self-assessments of material risks.
Independent Risk Management Function
3. A regulated entity or the Office of Finance should have an independent risk management function, or unit, with responsibility for risk measurement and risk monitoring, including monitoring and enforcement of risk limits.
4. The chief risk officer should head the risk management function.
5. The chief risk officer should report directly to the chief executive officer and the risk committee of the board of directors.
6. The risk management function should have adequate resources, including a well-trained and capable staff.
Risk Measurement, Monitoring, and Control
7. Each regulated entity and the Office of Finance should measure, monitor, and control its overall risk exposures, reviewing, as applicable, market, credit, liquidity, and operational risk exposures on both a business unit (or business segment) and enterprise-wide basis.
8. Each regulated entity and the Office of Finance should have the risk management systems to generate, at an appropriate frequency, the information needed to manage risk. As applicable, such systems should include systems for market, credit, operational, and liquidity risk analysis, asset and liability management, regulatory reporting, and performance measurement.
9. Each regulated entity and the Office of Finance should have a comprehensive set of risk limits and monitoring procedures to ensure that risk exposures remain within established risk limits, and a mechanism for reporting violations and breaches of risk limits to senior management and the board of directors.
10. Each regulated entity and the Office of Finance should ensure that it has sufficient controls around risk measurement models to ensure the completeness, accuracy, and timeliness of risk information.
11. Each regulated entity and the Office of Finance should have adequate and well-tested disaster recovery and business resumption plans for all major systems and have remote facilitates to limit the impact of disruptive events.
Applicable Laws, Regulations, and Policies
12. As applicable, each regulated entity and the Office of Finance should comply with all applicable laws, regulations, and supervisory guidance (e.g., advisory bulletins) governing the management of risk.
Standard 9-Management of Credit and Counterparty Risk
Responsibilities of the Board of Directors and Senior Management
1. Regarding the management of credit and counterparty risk, the board of directors and senior management are responsible for ensuring that the regulated entity has appropriate policies, procedures, and systems that cover all aspects of credit administration, including credit pricing, underwriting, credit limits, collateral standards, and collateral valuation procedures. This should also include derivatives and the use of clearing houses. They are also responsible for ensuring personnel are appropriately trained, competent, and equipped with the necessary tools, procedures and systems to assess risk.
2. Senior management should provide the board of directors with regular briefings and reports on credit exposures.
Policies, Procedures, Controls, and Systems
3. A regulated entity should have policies that limit concentrations of credit risk and systems to identify concentrations of credit risk.
4. A regulated entity should establish prudential limits to restrict exposures to a single counterparty that are appropriate to its business model.
5. A regulated entity should establish prudential limits to restrict exposures to groups of related counterparties that are appropriate to its business model.
6. A regulated entity should have policies, procedures, and systems for evaluating credit risk that will enable it to make informed credit decisions.
7. A regulated entity should have policies, procedures, and systems for evaluating credit risk that will enable it to ensure that claims are legally enforceable.
8. A regulated entity should have policies and procedures for addressing problem credits.
9. A regulated entity should have an ongoing credit review program that includes stress testing and scenario analysis.
Applicable Laws, Regulations, and Policies
10. A regulated entity should manage credit and counterparty risk in a way that complies with applicable laws, regulations, and supervisory guidance (e.g., advisory bulletins).
Standard 10-Maintenance of Adequate Records
1. Each regulated entity and the Office of Finance should maintain financial records in compliance with Generally Accepted Accounting Principles (GAAP), FHFA guidelines, and applicable laws and regulations.
2. Each regulated entity and the Office of Finance should ensure that assets are safeguarded and financial and operational information is timely and reliable.
3. Each regulated entity and the Office of Finance should have a records retention program consistent with laws and corporate policies, including accounting policies, as well as personnel that are appropriately trained and competent to oversee and implement the records management plan.
4. Each regulated entity and the Office of Finance, with oversight from its board of directors, should conduct a review and approval of the records retention program and records retention schedule for all types of records at least once every two years.
5. Each regulated entity and the Office of Finance should ensure that reporting errors are detected and corrected in a timely manner.
6. Each regulated entity and the Office of Finance should comply with all applicable laws, regulations, and supervisory guidance (e.g., advisory bulletins) governing the maintenance of adequate records.
12 C.F.R. 1236 app to Part 1236