FIRSTRAND LIMITED

INTRODUCTION

FirstRand’s (“the Group”) primary business objective is the generation of sustainable profits. As an integrated financial services company, risk taking is an essential part of the Group’s business and FirstRand Limited thus explicitly recognises risk assessment, monitoring and management as core competencies and important differentiators in the competitive environment it operates in.

The Group defines risk widely – as any factor that, if not adequately assessed, monitored and managed, may prevent it from achieving its business objectives or result in adverse outcomes, including damage to its reputation.

As a company built on a strong and pervasive “owner-manager culture”, the adherence to the validity, methodology and scope of risk management is deeply embedded in the Group’s tactical and strategic decision making. Accordingly capital is seen as a scarce resource and the imperative to protect its reputation means that risk is considered in a holistic and integrated manner.

The current economic crisis precipitated by the turmoil in the world’s financial markets and the failure of financial institutions internationally has dramatically underscored the need for an integrated risk and capital management approach alongside the renewed emphasis on sustainable earnings. Consequently, the Group has adopted a comprehensive approach to risk and capital management that comprises six core components, illustrated graphically in the chart below:

Components of FirstRand’s approach to risk and capital management

These core components are discussed further in the major sections of this report:

• FirstRand’s risk appetite frames all organisational decisionmaking and forms the basis for the Group’s continuing efforts to improve its risk identification, assessment and management capabilities. The articulation of risk appetite is closely related to the level of earnings volatility the Group is willing to accept, its target capitalisation level and the allocation of capital and risk capacity (see here and here). Sound capital management practices are a core component of the Group’s business strategy and support the management of its businesses within risk appetite constraints.
• A strong governance structure and policy framework fosters the embedding of risk considerations in existing business processes and ensures that consistent standards across the Group’s operating units exist (see here, here and here).
• Best practice risk methodologies have been developed in and for the respective business areas. These have been modelled on existing and emerging best practice in the global financial services industry and are constantly reviewed, challenged and enhanced by deployed and central risk management teams (see here and here).
• An integrated approach to managing risk has been established to facilitate the pro-active exchange of information between individual risk areas and between risk and finance functions. In doing so, the organisation aims to eliminate any “risk silo” thinking across different risk types and ensure an increasing integration of the traditionally separate domains of risk and finance (see here).
• The Group is deploying a comprehensive, consistent and integrated approach to stress testing that is embedded as a business planning and management tool, emphasising scenario based analyses in all its decision processes. This will enable FirstRand to draw on strong expertise in individual risk areas and the finance functions to ensure optimal decision making in pursuit of stable, growing and sustainable earnings (see here).
• Independent oversight, validation and audit functions ensure a high standard across methodological, operational and process components of the Group’s risk and capital manage - ment efforts. These functions independently review and challenge deployed and centralised risk, business and support functions and are directly responsible for providing board members with assurance that the Group remains within its chosen risk appetite and adheres to the standards and practices set by the Board (see here).

The remainder of this introductory section provides the Group’s perspective on the recent financial crisis as well as an overview of the major risks it is exposed to and the steps taken to strengthen risk management practices on the basis of lessons taken from the international financial markets. Each of the core components mentioned above is described in more detail in the main section of this risk and capital management report, alongside a detailed discussion of the risk profile for the banking and insurance operations. Separate risk management reports have been prepared for FirstRand Bank Holdings Limited (“FRBH”), which is referred to as “the Banking Group” or “the bank” and the Momentum Group, which is referred to as “Momentum” or “the Insurance Group” to reflect the different nature of the respective businesses (a clear distinction is made between current practices in these two entities where appropriate).

The financial crisis in context

The current economic and financial crisis is rooted in the gradual build up and explosive unwinding of global macro economic imbalances, which was ultimately triggered by the deflation of the United States of America (“US”) housing market. Although initially confined to the US with the impact limited to a reduction in liquidity and mark-to-market losses on certain credit assets, the consequential knock on effects on securitised assets and derivatives quickly spread to all major markets by the middle of 2008.

The severe reduction in liquidity as a consequence of sharply reduced interbank lending also led to deposit runs on banks in a number of economies, culminating in the collapse, govern - ment bailout, forced sale or forced merger of a number of large financial institutions in the US and in Europe. The seizure of credit markets, precipitated by the virtually unprecedented drop in banks’ risk appetite, began to fully feed through to the remainder of the global economy in the second half of 2008.

The South African economy was exposed to similar macro economic imbalances, but has not experienced a comparable seizure of credit markets due mostly to the following factors, namely:

• South African banks had very little exposure to toxic credit assets tied to the US housing bubble, thus reducing the potential negative impact on their portfolios’ credit quality and capitalisation levels;
• the local banking sector has been much less reliant on offshore borrowing and deposits. Accordingly, liquidity and funding pressures have been manageable compared to international markets;
• the correction in South African real estate prices has been orderly to date; and
• South African banks tend to be less geared than international financial institutions.

Nevertheless, the domestic market is not insulated from global macro economic and financial shocks. The Group did experience pressure with respect to its international and domestic exposure, namely:

• mark-to-market losses on international assets;
• a scarcity of international funding and, consequently, sharply increased international funding costs, in particular for US dollars; trading losses in international portfolios where the sharp reduction in market liquidity required the aggressive marking down of assets; and
• wholesale funding costs in the domestic market increased moderately.

For the Banking Group, defaults in the retail sector picked up sharply as a consequence of the relatively high levels of consumer indebtedness. This increase in defaults, combined with the general slowdown in economic activity, reduced the bank’s ability to realise value from collateral, in particular in the motor vehicle space. In addition further pressure on the Banking Group’s revenue resulted from a reduction in transaction volumes across the board.

Momentum has been primarily affected through the reduction in economic activity across South Africa. As in the banking operations, the crisis has clearly highlighted the need for close monitoring of counterparty health and for close cooperation across risk functions and between risk and business.

The Group expects the South African economic environment to remain challenging over the next reporting period. The recovery in the retail sector is expected to be gradual as lower inflation and interest rates mitigate the economic downturn over time. Default rates in retail portfolios are expected to remain at elevated levels, while credit risk will likely migrate to corporate and commercial portfolios in line with the downturn in economic output.

The Group has taken a number of steps over the period under review to address these challenges and mitigate the negative impact of the financial and economic crisis. It has strengthened its market risk processes considerably to limit the potential losses, which may emanate from market illiquidity and positions in proprietary trading and counterparty credit risk areas. These are discussed in more detail in the following section covering individual risk types as well as aspects of governance, the setting of risk appetite and the embedding of stress testing in the planning and budgeting process, discussed from here onwards.

Major risk factors and recent developments

The Group is exposed to a number of risks that are inherent in its operations. Identifying, assessing, pricing and managing these risks appropriately are core competencies of the individual business areas. Individual risk types are commonly grouped into three broad categories, namely financial risks, operational risks and strategic risks.

This section provides a brief summary of the major risk types as well as the changes in measurement and management approaches implemented over the period under review, as appropriate. Further information and an analysis of the respective risk profiles can be found in the detailed risk sections here onwards.

Credit risk

Credit risk, in terms of the potential impact on earnings and associated capital requirements, is the most significant risk type for the Group.

The Group remains focused on detailed analyses of the credit portfolio with respect to the organisation’s credit risk appetite, which enables it to continuously align its efforts to rebalance the portfolio with its core macro economic outlook. These efforts are a continuation of portfolio actions initiated in the past that include the refinement of Loan-to-Value (“LTV”) criteria for the mortgage and asset finance businesses, amongst others.

Changes to the determination of credit strategy and the origination process have been implemented. These are now the joint responsibility of the individual business areas and the central Balance Sheet Management (“BSM”) function. These steps aim to ensure consistency across credit origination practices in the Group as well as a granular implementation of and alignment with the Group’s credit risk appetite. In addition, centralised cross risk type management as part of the BSM function in the Chief Operating Officer (“COO”) portfolio is intended to facilitate a consistent and integrated approach to managing credit, market and liquidity risk.

Further methodological refinements to credit scoring models across various business areas are in progress and sophisticated macro economic credit stress testing models have been implemented as part of the wider stress testing framework. These models are being embedded as vital components of strategic and tactical decision making processes and are already being used as inputs into the planning and budgeting process.

Market and equity investment risk

In line with improvements in measuring market risk internationally and in anticipation of forthcoming regulatory requirements, the Group’s efforts are focused on integrating market and credit risk considerations more closely. One example of this is the development and implementation of an internal model for measuring specific risk, ie the idiosyncratic credit risk component not commonly captured by traditional Value at Risk (“VaR”) models. Further refinements to the Expected Tail Loss (“ETL”) measurement methodology used in the bank’s internal capital models are currently under development.

Over the period under review, a number of steps have been taken to strengthen market risk controls. The most noteworthy of these are the implementation of absolute loss thresholds that supplement traditional VaR limits and the inclusion of a liquidity adjustment in the ETL methodology, reflecting lessons taken from international markets where the rapid reduction in market depth (liquidity) has led to unprecedented market risk losses driven by mark-to-market (“MTM”) accounting requirements.

Changes to the equity investment risk measurement methodology are also planned to reflect an increased emphasis by the business on the pro-active management of the investment portfolio through the economic cycle.

Counterparty credit risk

The sudden and unprecedented failure of several large international financial institutions has highlighted the importance of pro-active and resolute counterparty risk measurement practices. In response to these events the Group has strengthened the level of communication and cooperation between all risk functions that contribute to the assessment of this risk type so as to ensure that all relevant factors are taken into account for purposes of assessing and pricing this risk.

Additional refinements were made to the methodologies used for calculating Potential Future Exposure (“PFE”) values, in particular with respect to the valuation and application of collateral held against counterparty exposures. These method - ological refinements were complemented by revisions and improvements to the RMB Equities Trading business unit’s credit risk governance framework and the implementation of additional dealing guidelines as well as increased monitoring and management of exposures through the crisis.

Liquidity risk

The Group’s international balance sheet has been negatively affected by the global financial crisis, leading to a severe reduction in liquidity in a number of markets and a sharp increase in funding costs internationally. As a consequence, the Group has elected to de-risk its overseas surplus funds over the reporting period, investing these only in highly liquid and very high quality assets such as treasury bills of European central banks.

The Group’s experience in the domestic market has been largely benign with spill over effects from the international crisis contained to an escalation in the term premium for funding (which has remained high over the reporting period). In line with industry practice, the Group continues to comply with the Basel Committee on Banking Supervision’s Principles for Sound Liquidity Risk Management and Supervision. In addition, liquidity buffers have been increased substantially and the portfolios of highly liquid securities in which these buffers have been placed continue to be the focus of pro-active management and close monitoring.

Interest rate risk in the banking book

Interest rate risk management practices have remained focused on putting in place and managing appropriate hedges to protect the Group’s income statement and balance sheet through the declining interest rate cycle. Over the reporting period, the Group’s exposure to interest rate risk remained within the limits imposed by the board as part of the Group’s risk appetite.

The Group’s interest rate risk management strategy has been aligned closely with the stress testing framework over the reporting period and rate movements have been successfully managed on the basis of the Group’s core planning scenario. Hedging decisions have also been supported by scenario and stress analyses, with a number of positions taken to mitigate potential tail risks in the interest rate cycle. Over the reporting period the Group experienced no disruptions in the domestic market with respect to its interest rate risk management efforts, although its ability to transact at an economic rate was at times impaired by market predictions of larger rate reductions than those that ultimately materialised.

Operational risk

FirstRand Bank Limited received approval from the South African Reserve Bank (“SARB”) to adopt the Advanced Measurement Approach (“AMA”) for operational risk on a partial use basis from 1 January 2009. The bank recognises the significance of operational risk and remains focused on improving the measurement, management and reporting of this risk across all its operations.

Sophisticated risk assessment approaches and statistical models are a part of this effort as is the ongoing review of controls and management frameworks to ensure their effectiveness. In support of the operational risk modelling approaches, the bank seeks to capture and collate relevant internal and external operational risk loss data. During the period under review the bank has been accepted as a member of the Operational Riskdata Exchange Association (“ORX”), which greatly enhances its access to high quality loss event data and thus improves the sophistication and accuracy of the risk assessment models for operational risk.

Risks in the Insurance Group

The FirstRand Group’s insurance operations are exposed to credit, market, liquidity, operational, compliance, insurance, tax, strategic and business risks as well as risks arising from fiduciary duties. In response to the international financial crisis Momentum implemented a number of steps to protect its capital base from potential adverse effects the crisis may have on its operations. The focus of the operation’s risk control and management activities remains on the continuous improvement of existing practices and the implementation of new regulatory directives.

Over the period under review, the Insurance Group completed significant projects in the credit, tax and operational risk space with respect to the implementation of new risk assessment models (credit), the rollout of new systems (tax) and the quantification of new statutory capital requirements (credit and operational).

Enterprise risk management

The Enterprise Risk Management (“ERM”) functions provide central independent oversight and risk control as part of the Group’s risk governance structure, both in the banking and the insurance operations. As part of the Group’s efforts to continuously strengthen and advance its risk measurement and management practices a number of changes have been implemented over the period under review.

These were aimed at strengthening the independence of the risk control functions and at increasing the effectiveness of risk assessment and monitoring practices. The mandate of the Banking and Insurance Group ERM functions, respective reporting lines and the emphasis on assuring independent oversight through the staffing of non executive directors on all relevant risk and audit boards across the Group are discussed further in the risk governance sections of this report (see here and here).

Group risk governance

The Group’s overall governance structure is described in detail here and here. It sets out the respective roles and responsibilities as well as delegation mechanisms of the board across the businesses. The appropriate identification and management of risk and the setting of risk appetite is the board’s responsibility, which it discharges through various committees and the boards of the individual franchises. Risk governance approaches and practices necessarily differ across the banking and insurance operations and therefore separate risk governance sections have been prepared for FRBH and for Momentum (see here and here).

Risk management: Income statement and balance sheet

The Group considers risk management to be an integral part of the management of the Group’s balance sheet and income statement. To this end, risk adjusted versions of the income statement are considered regularly as part of the Banking Group’s ongoing stress testing and scenario planning process, as well as in the evaluation of performance across the various businesses. The Integration of risk and finance and The Stress testing and scenario based planning sections provide more information on this. Furthermore, the relevant governance and management processes are also discussed in the detailed risk sections, as appropriate. (For example, the management of the balance sheet from a risk perspective is largely covered in the Credit risk section).