1. IOPS Toolkit for Risk-based Supervision Module 5: Supervisory Response

2. Supervisory Response Matrix • A fundamental aspect of risk-based supervision is that a logical connection should be made between the outcome of any risk analysis undertaken and the nature of the subsequent supervisory action taken in response • Supervisory response matrixes help plan supervisory actions + timetables, allow resources to be used efficiently and make the supervisory approach more transparent • The number of rows and columns in the response matrix will depend on the preferences of the supervisory authority and the environment in the country • Thresholds need to be set which highlight suitably risky cases, but equally do not place too much burden on what is often a limited number of supervisory staff (most funds should fall into the lower risk categories)

3. APRA PAIRS/SOARS

4. TPR Risk + Intervention Model

5. Supervisory Response Matrix: Inputs

6. Supervision Matrix: HFSA

7. Control Mechanisms • Quality control mechanisms ensure he supervisory response is proportionate and consistent • Balance needs to be struck between individual supervisor’s judgement and central control • Mechanisms include: • peer reviews • sign off protocols • benchmarking sessions • internal comparisons and validations • training • Ensuring that internal control mechanisms do not become too cumbersome is key • The matrix and supervisory response categories should be reviewed regularly / back tested • Special attention needs to be given to prioritising between ‘high risk’ institutions • Oversight tools for ‘low risk’ institutions include: • information campaigns (informing small entities of their regulatory requirements) • random inspections (detecting non-compliance, acting as a deterrent and protecting the supervisors credibility) • and / or themed inspections, including sampling

8. Communication • A risk-based approach to supervision involves different dynamics in terms of communication between the supervisory authority and the supervised entity • Rather than simply notifying the entity that a rule has been broken, the assessment of supervisory judgement needs to be communicated • The supervisory authority has to decide whether to disclose the results of the risk assessment to the institution itself and, if so, the extent to which details are communicated • Conditions under which public disclosure of risk assessments might be appropriate must also be considered • When it comes to releasing a risk-score to the public as a whole, clearly a balance needs to be struck between clarity and dialogue between the authority and the institution (and publicity acting as a deterrent factor) and confidentiality (so that panic and flight from institutions is not induced)

9. Enforcement Pyramid