Who governs risk in a CIF: the board, the risk committee and the risk management function?

The exam material takes these rules from the CRD, applied through CySEC Directive DI144-2014-14. Since 5 November 2021 the core duties for Class 2 CIFs have come from Law 165(I)/2021 (section 22), for Class 1-minus CIFs from Law 97(I)/2021 (section 37) and for banks from the banking law. The board sets and regularly reviews the firm's strategies and policies on how risks are taken, managed, monitored and mitigated, including risks from the wider economy and the business cycle. It gives risk issues enough time and resources, and reporting lines to it cover all material risks and risk policies.

The exam material says a CIF that is significant because of its size, internal organisation or the nature, scope and complexity of its activities must set up a risk committee. Its members are board members with no executive role and with the knowledge, skills and expertise to understand and monitor its risk strategy and appetite. It advises the board on its risk appetite and strategy, now and for the future, and helps it oversee how senior management carries out that strategy. The board keeps overall responsibility. Since 5 November 2021, Law 165(I)/2021 has required a risk committee of non-executive directors in Class 2 CIFs whose on- and off-balance-sheet assets averaged more than €100 million over the previous four years.

The exam material adds three rules for all CIFs: the committee reviews whether the prices of the assets and liabilities offered to clients reflect the business model and risk strategy and, if not, presents a remedy plan to the board; a firm that is not significant may, with CySEC's permission, merge the risk and audit committees; and the head of risk cannot be removed without the board's prior approval. Since 5 November 2021 these have applied only to banks and Class 1-minus CIFs (for CIFs, Law 97(I)/2021 section 37); Law 165(I)/2021 has no equivalent.

The risk management function is independent of the operational functions and has enough authority, standing, resources and access to the board. It identifies, measures and reports all material risks, takes part in setting risk strategy and in material risk decisions, and where necessary reports directly to the board, independently of senior management. Its head is an independent senior manager; in a smaller firm another senior person may take the role if there is no conflict of interest. These details are CRD rules, now in Law 97(I)/2021 section 37 for Class 1-minus CIFs. For every CIF, MiFID II requires an independent risk management function where this is appropriate and proportionate; see What organisation, risk management and internal audit must an investment firm have?. In the ICAAP, CySEC's 2012 guidelines give it the job of identifying the risks, preparing the assessment and applying the stress tests, while internal audit reviews independently.

The exam material says CIFs need recovery and resolution plans proportionate to their size and business, which CySEC may reduce where a failure would not harm markets, other institutions or funding conditions. Law 20(I)/2016 requires recovery plans from CIFs in the top initial capital band and certain group entities. The board approves the plan, which is updated after material changes and at least annually; CySEC may set simplified obligations, having regard to the effect a failure could have. Resolution plans are the resolution authority's work, with the firm's cooperation.

For Class 2 CIFs, IFR Article 51 requires public disclosure of the pay policy's main features, the ratios the firm sets between fixed and variable pay, and aggregate figures for senior management and material risk-takers, including amounts split into fixed and variable pay with the number of beneficiaries, forms of variable pay, deferred amounts and severance. Class 3 firms make no pay disclosure; if they issue AT1 instruments, they disclose only their risk management objectives, own funds and own funds requirements. Separately, a Class 2 CIF reports to CySEC the number of people paid €1 million or more, in €1 million bands, and on request the total pay of each board member or senior manager; CySEC passes both to the EBA.

The exam material says firms permitted to use internal approaches report their results for benchmark portfolios, with their methods explained, at least annually. CySEC assesses the approaches at least annually and takes corrective action if one underestimates own funds requirements for reasons not explained by the underlying risks. The exam material's wording leaves out a 'not', so it reads as if such action should bring wrong incentives and herd behaviour; the CRD says corrective action must not lead to standardisation, must not create wrong incentives and must not cause herd behaviour. Benchmarking is a CRD rule for banks and Class 1-minus CIFs; IFR firms may use an internal model only for net position risk, and CySEC reviews that permission at least every three years.