## tarea2024083-print-pdf - Preface

## Source details

**Canonical URL:** [tarea2024083-print-pdf - Preface](https://www.imf.org/-/media/files/publications/tar/2024/english/tarea2024083-print-pdf.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/tar/2024/english/tarea2024083-print-pdf.pdf.md)
- [Structured JSON version](/-/media/files/publications/tar/2024/english/tarea2024083-print-pdf.pdf.json)

---

### Preface: mission overview and scope
- Mission type: Monetary and Capital Markets Department (MCM) hybrid technical assistance (TA) mission.
- Timing:
  - Virtual interactions: October and November 2023.
  - Onsite mission: Colombo, November 27 to December 4, 2023.
- Mission team: Mr. Gabriel Andrade and Ms. Mariam Manjgaladze (MCM experts). Backstopped by Mr. Ashraf Khan at IMF HQ.
- Purpose: assist the Central Bank of Sri Lanka (CBSL) in improving risk management to support effective and efficient central bank decision-making and help the CBSL work towards achieving its (legal) mandate.
- Scope notes:
  - Financial risk management was out of scope for this TA mission.
  - Mission took note of a recent IMF TA on financial risk management — Strengthening the Risk Assessment of the Central Bank of Sri Lanka (November 2023).
- Engagements and appendices:
  - Meetings with Governor Dr. P. Nandalal Weerasinghe; Senior Deputy Governor Mrs. T. M. J. Y. P. Fernando; Deputy Governor Mrs. K. M. A. N. Daulagala; BROC Independent External Members Mr. H. A. Karunaratne and Mr. Trevine Jayasekara; several Assistant-Governors/Directors; Head of Risk Management Department (CRO) Mr. W. R. M. K. Fernando and full RMD team.
  - Dedicated 2-hour meeting/awareness session with all Directors/RCOs.
  - Appendix I: documents consulted; Appendix II: stakeholders met; Appendix VI: mission slides.
- Acknowledgements:
  - Mission thanks CBSL colleagues for cooperation, discussions, and hospitality.
  - Special thanks to Mrs. Thilini Jayasinghe, Senior Assistant Director of RMD, for facilitating meetings.

### Executive Summary: high-level findings and strategic direction
- Historical progress:
  - CBSL has been improving its risk management function since 2015.
  - A detailed risk governance framework exists, including a high-level Risk Management Policy Statement (RMPS).
  - CBSL is working towards implementing an Enterprise Risk Management framework.
- Governance developments:
  - Creation of the Board Risk Oversight Committee (BROC) and Non-Financial Risk Management Committee (NFRMC) is a key step for appropriate-level risk discussions; both committees are recently established and have room for improvement in functioning.
- Foundational elements and gaps:
  - Various foundational aspects for proper risk management are established.
  - Implementation gaps remain: embedding risk management function, extending efforts, and improving risk culture.
- Strategic institutional actions recommended (high level):
  - Strengthen the “tone at the top”; adopt a (top-down) Risk Appetite Statement (RAS) to improve risk ownership at all organizational levels.
  - Ensure specific training (including top management) and effective communication/awareness actions.
  - Empower RMD to monitor strategic plan progress, support Strategic Risk Assessments (SRA) (top down), and participate in key CBSL meetings and projects.
  - Implement the 3 Lines Model fully, clarifying roles/responsibilities of business units (first line), risk management (second line), and Internal Audit (IA) (third line).
  - Define appropriate risk tolerance levels via Key Risk Indicators (KRIs) to accelerate maturity.
- Long-term aim:
  - More strategic approach to risk management to build a stronger risk culture requiring clear ownership by the Governing Board (GB), aligning CBSL strategy/objectives with risk management to support better-informed, more efficient, and effective decision-making in line with the CBSL’s legal mandate.

### Key recommendations (selected highlights from Table 1)
- A. Risk Management Governance
  - CRO reporting lines and access:
    - CRO should formally report to BROC through NFRMC and have administrative only reporting to AG.
    - CRO should report to a DG (or to the Governor) and/or interact more directly with the NFRMC Chair; formalize with tailored reporting and frequent one-on-one meetings. Priority: High. Timeframe: Immediate <3 months. Lead: GB. (Paragraph 12)
  - Strategic Risk Assessment (SRA) and RMD involvement:
    - SRA is a direct responsibility of the Monetary Policy Board (MPB) and the GB. RMD should be more involved; SRA should be a top/down exercise with ownership by GB/BROC. Priority: High. Timeframe: Short term <12 months. Lead: GB. (Paragraph 13)
  - Human Resources (HR) strategy:
    - Explore enhanced HR strategy to attract, reward, and retain staff in critical areas (e.g., risk and cybersecurity). Priority: High. Timeframe: Short term <12 months. Lead: GB. (Paragraph 14)
  - Participation of RMD in pre-decision stages:
    - (i) Mandatory RMD participation in relevant Committees (e.g., IT Oversight Committee, MP Committee, BCP Committee). (ii) GB should promote RMD alignment/involvement in Business Continuity Planning (BCP). Priorities: Medium; Timeframes: Immediate <3 months and Short-term <12 months. Leads: GB; GB, RMD, BCP Committee. (Paragraph 15)
  - Cybersecurity:
    - Advance CBSL cybersecurity function with dedicated/specialized resources; strengthen cybersecurity framework and information-sharing with RMD. Priority: High. Timeframe: Immediate <3 months. Lead: GB, IT Department. (Paragraph 16)
  - Governing Board workshop:
    - Organize a 1.5-day IMF Governing Board Workshop for executive and nonexecutive GB members on governance, legal framework, risk management & cybersecurity, audit committee, operational efficiency, transparency, and roles/responsibilities. Priority: Medium. Timeframe: Medium term 12-24 months. Lead: GB. (Paragraph 17)

- B. Risk Management Framework and Appetite
  - Continue developing RM Framework covering all CBSL risks, including RAS (top down). Priority: High. Timeframe: Short term <12 months. Lead: GB, RMD. (Paragraphs 27, 28)
  - Optimize BROC time, focus on implications and mitigation of risks; adhere to quarterly meeting frequency; focus on top/strategic risks and escalations from NFRMC; enhance pre-engagement with first line. Priority: High. Timeframe: Short term <12 months. Lead: BROC, NFRMC, RMD. (Paragraph 30)
  - Develop KRI process: define objectives and positioning, create objective framework, support first line to define significant, clear, objective KRIs aligned with RAS and limited in number. Priority: High. Timeframe: Short term <12 months. Lead: All business units, RMD. (Paragraph 29)
  - Implement Risk Management integrated Reports: sharp focus on weaknesses, concise, updated, timely; reconsider RCSA frequency scoring/levels; effective communication strategy to prioritize and visualize risks. Priority: Medium. Timeframe: Ongoing. Lead: BROC, NFRMC, RMD. (Paragraph 31)
  - Expedite procurement of Risk Management System to improve efficiency of risk process and reporting. Priority: Medium. Timeframe: Short term <12 months. Lead: Procurement Committee, Relevant Business Units. (Paragraph 32)

- C. Strengthen the Three Lines Model
  - Define information-sharing between second and third lines: specify type and frequency of exchanged information. Priority: Medium. Timeframe: Immediate <3 months. Lead: RMD, IAD. (Paragraph 41)
  - First line awareness and training:
    - Business units to enhance awareness of first-line roles; RCOs to receive specific RM training; RMD to organize bank-wide meetings to share best practices/lessons learned from risk events and/or external speakers. Priority: Medium. Timeframe: Short term <12 months. Lead: All business units, RMD. (Paragraphs 42, 43, 44)
  - External collaboration:
    - Promote closer relationships with the International Operational Risk Working Group (IORWG), Central Bank Risk Managers (CBRM) and enhance bilateral cooperation with other central banks and IFIs to align with international best practices. Priority: Medium. Timeframe: Immediate <3 months. Lead: RMD. (Paragraph 45)

### Introduction and context (I)
- RMD history and scope:
  - RMD created in 2015; scope extended in 2017 to include operational risk management in line with the Three Lines Model.
  - In 2023, RMD completed facilitation for development of risk registers for all 29 business units.
- Trigger for TA:
  - 2022 IMF Safeguards Assessment flagged need for improvement in CBSL’s risk management → request for MCM TA.
- Mission engagement:
  - Two months engagement including six days of onsite meetings and presentation sessions.
  - Mission used extensive information to identify main areas for improvement.

### Key statistics and staffing (from governance/current situation)
- RMD staffing and vacancies:
  - RMD staffing: nine staff directly involved with risk management-related activities, plus three management level staff, and three existing vacancies.
- Reporting cadence and committees:
  - BROC meets quarterly; lack of quorum over the last two years reduced meeting frequency.
  - RMD formally reports quarterly to the NFRMC and the BROC. (Paragraph 26)
- Strategic plan timeframe:
  - Strategic plan runs till 2026.
- Staff resignations by year:
  - 5 in 2020; 14 in 2021; 51 in 2022; approximately 40 year-to-date in 2023.
- Risk registers:
  - Risk registers for all 29 business units were completed in Q1 of 2023.
  - A consolidated operational risk profile was submitted to the GB and approved in Q3 of 2023.
- RAS timeline:
  - Timeline for submitting the RAS, recommended by the BROC, for approval of the GB is the 4th quarter of 2024.

### Cyber risk management and second-line function findings (paragraphs 10–17)
- Major findings:
  - No Chief Information Security Officer (CISO) at the time of the mission; recruitment process in place.
  - No proper and dedicated monitoring structure implemented; plan to implement a Security Operations Center and define KRIs as part of the RAS plan, but operationalization is pending. (Paragraph 10)
  - Conduct risk monitoring is ad-hoc and not formalized.
  - Compliance Function resourcing concerns:
    - Chief Compliance Officer (CCO) is only employed part-time and has a shared full time employee (50 percent) with the CBSL’s Legal Department.
    - Compliance Function is not sufficiently independent. (Paragraph 11)
- Key recommendations:
  - CRO should report to a DG (or to the Governor) and/or interact more directly with the Chair of the NFRMC; formalize tailored reporting and frequent one-on-one meetings. (Paragraph 12)
  - SRA should be a top/down exercise with ownership by GB/BROC; RMD should be more involved in assessing strategic risks and the strategic planning process. (Paragraph 13)
  - Deliver current HR plan as soon as possible, include mitigating actions to retain staff, and draft succession plans for all critical CBSL functions; prioritize staffing of internal control functions (cybersecurity, risk management, compliance, and business continuity). (Paragraph 14)
  - Make RMD participation mandatory in relevant committees (IT Oversight Committee, Monetary Policy Committee, and BCP Committee) and promote RMD involvement in BCP. (Paragraph 15)
  - Complete recruitment of the CISO and ensure separate resources dedicated to cybersecurity; strengthen cybersecurity framework and information-sharing with RMD; consider additional IMF support. (Paragraph 16)
  - Organize a 1.5-day IMF Board Workshop for GB members covering governance, legal framework, risk management & cybersecurity, audit committee, operational efficiency, and transparency. (Paragraph 17)

### Risk management framework — current state and recommendations (paragraphs 18–32)
- Current state highlights:
  - RMPS approved by the MB and reviewed biannually; describes risk taxonomy and processes based on ISO 31000-2018. (Paragraph 19)
  - Risk registers completed for all 29 business units; consolidated operational risk profile approved Q3 of 2023. (Paragraphs 20)
  - Risk registers updated quarterly, but no concise and formalized RCSA process in place; limited RMD resources may make quarterly collection mechanical. (Paragraph 21)
  - Operational risk management operations use Microsoft Excel spreadsheets; planned procurement of a Governance, Risk and Compliance system was pending at mission time. (Paragraph 22)
  - Incident Reporting System in place with protected reporter identity; no formal document outlining incident reporting goals/principles, leading to possible misclassification of reports. (Paragraph 23)
  - KRIs developed for three sub-categories: (i) cyber security risk; (ii) human resources risk; and (iii) system and technology risk; threshold values still to be defined. (Paragraph 24)
- Recommendations (selected):
  - Formalize senior management support through adoption of a RAS (top down) that re-affirms operating within a “low risk range” while accepting some risks to advance the CBSL mandate. (Paragraph 27)
  - Continue development of the RM Framework covering all risks, including RAS approved by GB and/or MPB and revisited periodically. (Paragraph 28)
  - KRI process enhancements: define objectives and positioning, lead support by RMD, limited number of KRIs aligned with RAS, define threshold values, ensure reliable data sources. (Paragraph 29)
  - Optimize BROC time: maintain quarterly frequency, focus on top strategic risks, critical incidents, and escalations from NFRMC; improve pre-engagement with risk owners. (Paragraph 30)
  - Implement integrated risk management reports that are sharp, concise, updated and timely; reconsider RCSA frequency and standardization; planned automation could improve assessments and reporting. (Paragraph 31)
  - Expedite procurement of the Risk Management System to move from Excel to an integrated system (risk management, incidents, action tracking, KRIs, controls assessment). (Paragraph 32)

### Strengthening the Three Lines Model — current situation and priorities (paragraphs 33–36)
- Current situation:
  - Three Lines Model defined in RMPS for first line (business units), second line (RMD), third line (IAD), but not fully embedded. (Paragraph 33)
  - Information-sharing gaps between second and third lines: no clear definition of type and frequency; interaction mainly via committee representation. (Paragraph 34)
  - Chief Internal Auditor is an observer on BROC and NFRMC; CRO is an observer on the AC. (Paragraph 34)
  - IAD accountability: IAD accountable to the AC and should provide independent assurance to the GB/MPB; AC awaiting a new chairperson at mission time. (Paragraph 35)
  - First-line ownership uneven; risk awareness and knowledge at first line level could be improved and standardized. (Paragraph 36)
- Priority actions:
  - Define and formalize type and frequency of information-sharing between second and third lines; tie risk assessments into IA plan and ensure RCSAs take IA recommendations into account. (Paragraph 34; recommendations)
  - Improve first-line awareness: clarify roles as risk owners, provide resources, and implement escalation processes. (Paragraph 36; recommendations)
  - Provide RCOs/RDOs specific RM training and bank-wide meetings organized by RMD to share methodology, templates, case studies, and lessons learned. (Paragraphs 42–44)

### RCOs, current arrangements, gaps and recommendations (section 37)
- Current arrangements:
  - For each business unit, a person (RCO) is designated to support risk-related responsibilities of the DRO, who is the focal point to conduct risk management activities.
  - RCOs assist business units to manage risks and coordinate with RMD; business units supported by RCOs should submit non-financial risk events, emerging risks, significant operational risks and status of action plans to RMD every quarter through the Departmental Risk Register.
  - CBSL cooperates bilaterally with Bank Al Maghrib, the South African Reserve Bank, and the Bank of Portugal; CBSL is a member of the IORWG but has been less involved recently.
- Issues and gaps identified:
  - RCOs’ potential role is not fully explored; lack visibility and consistency in relation with the RMD.
  - RCO profile is not consistent across business units; no detailed and updated job description exists.
  - RCOs are not actively and fully used by the RMD in practice.
  - Reduced involvement in IORWG activities and non-participation in annual conferences limits knowledge-sharing and benchmarking.
- Recommendations (policy and operational):
  - Further enhance and formalize the Three Lines Model; ensure staff awareness of detailed individual roles and responsibilities.
  - Formalize information-sharing between second and third lines; specify type and frequency of exchanged information.
  - Promote information-sharing between second (RMD, Compliance, Information Security) and third line (IAD); tie risk assessments into IA plan; use IAD findings to inform RMD on control effectiveness.
  - Increase business-unit awareness of first-line roles and the contribution of RMD; provide adequate resources at business level.
  - Formalize RCO role with clear job descriptions and use them in annual performance review input; ensure managers seek review input from RMD.
  - Provide specific RM training for DROs and RCOs; RMD to organize regular sessions for RCOs on methodology, templates, and lessons learned.
  - Promote closer relationships with IORWG, CBRM Group, and bilateral cooperation with other central banks and IFIs; encourage active participation in working groups and conferences.

*IMF | Sri Lanka Central Bank Risk Management — Preface and Executive Summary (pages referenced in source).*

### Preface ................................................................................................................

### tarea2024083-print-pdf - Preface ................................................................................................

### Preface: mission overview and scope
- A Monetary and Capital Markets Department (MCM) hybrid technical assistance (TA) mission took place in Q4 2023:
  - Virtual interactions: October and November 2023.
  - Onsite mission: Colombo, November 27 to December 4, 2023.
  - Mission team: Mr. Gabriel Andrade and Ms. Mariam Manjgaladze (MCM experts). Backstopped by Mr. Ashraf Khan at IMF HQ.
- Purpose: assist the Central Bank of Sri Lanka (CBSL) in improving risk management to support effective and efficient central bank decision-making and help the CBSL work towards achieving its (legal) mandate.
- Scope exclusions and notes:
  - Financial risk management was out of scope for this TA mission.
  - Mission took note of a recent IMF TA on financial risk management — Strengthening the Risk Assessment of the Central Bank of Sri Lanka (November 2023).
- Engagements and consultations:
  - Meetings with Governor Dr. P. Nandalal Weerasinghe; Senior Deputy Governor Mrs. T. M. J. Y. P. Fernando; Deputy Governor Mrs. K. M. A. N. Daulagala; BROC Independent External Members Mr. H. A. Karunaratne and Mr. Trevine Jayasekara; several Assistant-Governors/Directors; Head of Risk Management Department (CRO) Mr. W. R. M. K. Fernando and full RMD team.
  - Dedicated 2-hour meeting/awareness session with all Directors/RCOs.
  - Appendix I: documents consulted; Appendix II: stakeholders met; Appendix VI: mission slides.
- Acknowledgements:
  - Mission thanks CBSL colleagues for cooperation, discussions, and hospitality.
  - Special thanks to Mrs. Thilini Jayasinghe, Senior Assistant Director of RMD, for facilitating meetings.

### Executive Summary: high-level findings and strategic direction
- Historical progress:
  - CBSL has been improving its risk management function since 2015.
  - A detailed risk governance framework exists, including a high-level Risk Management Policy Statement (RMPS).
  - CBSL is working towards implementing an Enterprise Risk Management framework.
- Governance developments:
  - Creation of the Board Risk Oversight Committee (BROC) and Non-Financial Risk Management Committee (NFRMC) is a key step for appropriate-level risk discussions; both committees are recently established and have room for improvement in functioning.
- Foundational elements and gaps:
  - Various foundational aspects for proper risk management are established.
  - Implementation gaps remain: embedding risk management function, extending efforts, and improving risk culture.
- Key institutional actions recommended:
  - Strengthen the “tone at the top”; adopt a (top-down) Risk Appetite Statement (RAS) to improve risk ownership at all organizational levels.
  - Ensure specific training (including top management) and effective communication/awareness actions.
  - Empower RMD to monitor strategic plan progress, support Strategic Risk Assessments (SRA) (top down), and participate in key CBSL meetings and projects.
  - Implement the 3 Lines Model fully, clarifying roles/responsibilities of business units (first line), risk management (second line), and Internal Audit (IA) (third line).
  - Define appropriate risk tolerance levels via Key Risk Indicators (KRIs) to accelerate maturity.
- Long-term aim:
  - More strategic approach to risk management to build a stronger risk culture requiring clear ownership by the Governing Board (GB), aligning CBSL strategy/objectives with risk management to support better-informed, more efficient, and effective decision-making in line with the CBSL’s legal mandate.

### Key Recommendations (selected highlights from Table 1)
- A. Risk Management Governance
  - CRO reporting lines and access:
    - CRO should formally report to BROC through NFRMC and have administrative only reporting to AG.
    - CRO should report to a DG (or to the Governor) and/or interact more directly with the NFRMC Chair; formalize with tailored reporting and frequent one-on-one meetings. Priority: High. Timeframe: Immediate <3 months. Lead: GB. (Paragraph 12)
  - Strategic Risk Assessment (SRA) and RMD involvement:
    - SRA is a direct responsibility of the Monetary Policy Board (MPB) and the GB. RMD should be more involved; SRA should be a top/down exercise with ownership by GB/BROC. Priority: High. Timeframe: Short term <12 months. Lead: GB. (Paragraph 13)
  - Human Resources (HR) strategy:
    - Explore enhanced HR strategy to attract, reward, and retain staff in critical areas (e.g., risk and cybersecurity). Priority: High. Timeframe: Short term <12 months. Lead: GB. (Paragraph 14)
  - Participation of RMD in pre-decision stages:
    - (i) Mandatory RMD participation in relevant Committees (e.g., IT Oversight Committee, MP Committee, BCP Committee). (ii) GB should promote RMD alignment/involvement in Business Continuity Planning (BCP). Priorities: Medium; Timeframes: Immediate <3 months and Short-term <12 months. Leads: GB; GB, RMD, BCP Committee. (Paragraph 15)
  - Cybersecurity:
    - Advance CBSL cybersecurity function with dedicated/specialized resources; strengthen cybersecurity framework and information-sharing with RMD. Priority: High. Timeframe: Immediate <3 months. Lead: GB, IT Department. (Paragraph 16)
  - Governing Board workshop:
    - Organize a 1.5-day IMF Governing Board Workshop for executive and nonexecutive GB members on governance, legal framework, risk management & cybersecurity, audit committee, operational efficiency, transparency, and roles/responsibilities. Priority: Medium. Timeframe: Medium term 12-24 months. Lead: GB. (Paragraph 17)

- B. Risk Management Framework and Appetite
  - Continue developing RM Framework covering all CBSL risks, including RAS (top down). Priority: High. Timeframe: Short term <12 months. Lead: GB, RMD. (Paragraphs 27, 28)
  - Optimize BROC time, focus on implications and mitigation of risks; adhere to quarterly meeting frequency; focus on top/strategic risks and escalations from NFRMC; enhance pre-engagement with first line. Priority: High. Timeframe: Short term <12 months. Lead: BROC, NFRMC, RMD. (Paragraph 30)
  - Develop KRI process: define objectives and positioning, create objective framework, support first line to define significant, clear, objective KRIs aligned with RAS and limited in number. Priority: High. Timeframe: Short term <12 months. Lead: All business units, RMD. (Paragraph 29)
  - Implement Risk Management integrated Reports: sharp focus on weaknesses, concise, updated, timely; reconsider RCSA frequency scoring/levels; effective communication strategy to prioritize and visualize risks. Priority: Medium. Timeframe: Ongoing. Lead: BROC, NFRMC, RMD. (Paragraph 31)
  - Expedite procurement of Risk Management System to improve efficiency of risk process and reporting. Priority: Medium. Timeframe: Short term <12 months. Lead: Procurement Committee, Relevant Business Units. (Paragraph 32)

- C. Strengthen the Three Lines Model
  - Define information-sharing between second and third lines: specify type and frequency of exchanged information. Priority: Medium. Timeframe: Immediate <3 months. Lead: RMD, IAD. (Paragraph 41)
  - First line awareness and training:
    - Business units to enhance awareness of first-line roles; RCOs to receive specific RM training; RMD to organize bank-wide meetings to share best practices/lessons learned from risk events and/or external speakers. Priority: Medium. Timeframe: Short term <12 months. Lead: All business units, RMD. (Paragraphs 42, 43, 44)
  - External collaboration:
    - Promote closer relationships with the International Operational Risk Working Group (IORWG), Central Bank Risk Managers (CBRM) and enhance bilateral cooperation with other central banks and IFIs to align with international best practices. Priority: Medium. Timeframe: Immediate <3 months. Lead: RMD. (Paragraph 45)

### Introduction and context (I)
- RMD history and scope:
  - RMD created in 2015; scope extended in 2017 to include operational risk management in line with the Three Lines Model.
  - In 2023, RMD completed facilitation for development of risk registers for all 29 business units.
- Trigger for TA:
  - 2022 IMF Safeguards Assessment flagged need for improvement in CBSL’s risk management → request for MCM TA.
- Mission engagement:
  - Two months engagement including six days of onsite meetings and presentation sessions.
  - Mission used extensive information to identify main areas for improvement.

### II. Risk Management Governance — Current Situation (A)
- Governance documents and analysis:
  - Key policies and governance are consistent and robust.
  - Mission analyzed RMPS, Risk Management Framework, Operational Risk Management Guideline (ORMG), samples of BROC and NFRMC agendas/minutes, IA recommendations, and Risk Registers (Appendix I contains full list).
- Implementation maturity:
  - Implementation of the risk management framework and appetite is not fully completed; many documents/policies are recent and lack maturity.
  - Role, profile, and training for Risk Coordinating Officers (RCOs) are not sufficiently outlined in risk documentation and CBSL policies.
- RMD organization and reporting:
  - Revised RMPS approved by the Monetary Board (MB) in January 2023.
  - RMD responsible for financial and operational risks.
  - RMD staffing: nine staff directly involved with risk management-related activities, plus three management level staff, and three existing vacancies.
  - Reporting:
    - For operational risk, RMD reports to the GB through the NFRMC and the BROC; for financial risk, RMD reports to the GB through the BROC. (Figure 1 referenced)
    - BROC meets quarterly; lack of quorum over the last two years reduced meeting frequency. As a result, RMD reported to the NFRMC for operational risks.
    - Current reporting lines limit CRO’s regular access to top management, constraining strategic discussions and specific feedback on risk reporting.
- Implemented risk processes and gaps:
  - Implemented: incident management via online incident reporting system accessible to all staff; risk mapping across the bank.
  - Not fully addressed: development of Risk Appetite Framework (RAF); though a defined development plan exists including approval of a RAS at the GB and definition of KRIs for all risk categories (in development).
- Strategic planning and RMD involvement:
  - Strategic planning process coordinated by Policy Review and Monitoring Department annually with senior management and GB; process is well-established and extensive.
  - RMD has not been fully involved in preparation of CBSL’s Strategic plan (runs till 2026) via SRA of objectives.
  - RMD participation in pre-decision stages of CBSL decision-making is limited, reducing ability to assess initiatives before decisions.
- Human resources/staffing risk:
  - Resignations by year: 5 in 2020; 14 in 2021; 51 in 2022; approximately 40 year-to-date in 2023.
  - Critical positions unfilled (e.g., one DG, various AGs); CBSL hired an external consultant to develop mitigation plans expected to be rolled out over the next two years.
  - Control functions (risk management, compliance, cybersecurity) are significantly and negatively impacted by HR constraints.
  - Additional impacts include staffing challenges in core critical functions as a consequence of recent amendments to Banking Act.

*IMF | Sri Lanka Central Bank Risk Management — Preface and Executive Summary (pages referenced in source)*

### 10. Cyber risk management has room for improvement. Though awareness and training

### 10. Cyber risk management has room for improvement. Though awareness and training

### Major findings on governance and second-line functions
- Paragraph 10: There is no Chief Information Security Officer (CISO), even though the recruitment process is in place, and a proper and dedicated monitoring structure has not yet been implemented—there is a plan to implement a Security Operations Center and KRIs will be defined as part of the RAS plan, but this needs to be operationalized further.
- Paragraph 11: Certain second line functions are a cause for concern:
  - The process to monitor and report conduct risks is currently ad-hoc and not formalized/well-defined.
  - The Compliance Function does not have sufficient resources: the Chief Compliance Officer (CCO) is only employed part-time and has a shared full time employee (50 percent) with the CBSL’s Legal Department.
  - The Compliance Function is not sufficiently independent.
- Figure note: The BROC is chaired by an independent Board member, nominated by the Board, and also comprises two independent external experts, as well as several observers (a SDG/DGs, CCO, Chief Internal Auditor, CRO and Director and Chairman of the Committee for Disaster Recovery).

### Key recommendations for governance and oversight
- Paragraph 12: The CRO should report to a DG (or to the Governor) and/or interact more directly with the Chair of the NFRMC; this process should be properly formalized, together with tailored reporting and frequent one-on-one meetings to improve top management ownership of risk management and speed up consistent feedback on the RMD’s activities and plans.
- Paragraph 13: SRA responsibility and strategic risk management:
  - SRA is a direct responsibility of the MPB and the GB.
  - The RMD should be more involved with assessing strategic risks and the overall strategic planning process.
  - The MPB and GB should include identification of top/key risks in relation with strategic planning, with the support of the RMD.
  - A reflection on emerging risks should be part of the BROC agenda.
  - An SRA should be set up in line with international best practices, as a top/down exercise with ownership by GB/BROC; BROC discussions should focus on strategy-related issues instead of purely tactical ones.
- Paragraph 14: HR strategy enhancements:
  - The CBSL should continue to explore an enhanced HR strategy to attract, reward, and retain staff in all critical areas (e.g., risk and cybersecurity).
  - The current HR plan should be delivered as soon as possible, include mitigating actions to retain staff, and draft proper succession plans for all critical CBSL functions.
  - Staffing of internal control functions (cybersecurity, risk management, compliance, and business continuity) is critical and should be prioritized.
- Paragraph 15: RMD participation and committee membership:
  - RMD participation in pre-decision stages should be increased.
  - RMD should have mandatory participation in all relevant committees (IT Oversight Committee, Monetary Policy Committee, and BCP Committee).
  - GB should promote further alignment and involvement of the RMD in BCP in line with international best practices.
- Paragraph 16: Cybersecurity resourcing and framework:
  - CBSL’s cybersecurity function needs dedicated and specialized resources.
  - The cybersecurity framework should be strengthened, including through information-sharing with the RMD.
  - CBSL should complete recruitment of the CISO and have separate resources dedicated to handling cybersecurity.
  - Additional IMF support could help speed up the process and allow CBSL to benefit from international standards and best practices.
- Paragraph 17: Board capacity building:
  - The CBSL should organize a 1.5-day IMF Board Workshop for executive and nonexecutive members of the GB covering central bank governance, legal framework, risk management & cybersecurity, AC, operational efficiency, and transparency, with potential participation of AGs.

### Risk management framework — current state (paragraphs 18–26)
- Paragraph 18: RMD history and staffing:
  - RMD created in 2015 with focus on financial risk; operational risk function added in 2017.
  - RMD is managed by the head, two deputies and nine staff members.
- Paragraph 19: RMPS status:
  - CBSL has developed a comprehensive RMPS approved by the MB; reviewed biannually.
  - RMPS describes risk taxonomy, risk management process (based on ISO 31000-2018), responsibilities and reporting lines of all three lines, roles of CRO, CCO, Departmental Risk Officers (DROs), RCOs, committee composition (including BROC and NFRMC), and scope covering financial, operational, strategic, and compliance risks.
  - In practice, the CBSL has not yet developed a strategic risk framework, and a compliance risk function is still at early stages.
- Paragraph 20: Risk registers and timeline:
  - Risk registers for all business units completed and approved by the MB.
  - Creation of risk registers started in 2019; risk registers for all 29 business units of the bank were completed in Q1 of 2023.
  - A consolidated operational risk profile was submitted to the GB and approved in Q3 of 2023.
- Paragraph 21: RCSA and reporting cadence:
  - Risk registers are updated quarterly, but no concise and formalized RCSA process is exercised.
  - The ORMG specifies quarterly reviews; limited RMD resources (two persons in charge of operational risk) and quarterly collection across 29 business units may turn the practice mechanical with limited in-depth analysis.
- Paragraph 22: Systems and automation:
  - CBSL does not use a proper system for its operational risk management; risk register template in Microsoft Excel.
  - Creation, update, and consolidation done in spreadsheets with associated human error and data loss risk.
  - The Bank decided on procuring a Governance, Risk and Compliance system, but at the time of the mission this process was still pending.
- Paragraph 23: Incident reporting:
  - All staff must report incidents, including near misses, via an online Incident Reporting System with protected reporter identity unless indicated otherwise by reporter.
  - RMD has developed training material (Incident Reporting System User Guideline) with clear step-by-step guide and messaging that incident reporting is not for blame or disciplinary action.
  - There is no formal document outlining the goal, importance, and principles of incident reporting, causing reporting of items that may not be operational risk incidents.
- Paragraph 24: KRI development:
  - RMD had developed KRIs for three sub-categories of operational risk: (i) cyber security risk; (ii) human resources risk; and (iii) system and technology risk.
  - Threshold values (acceptable ranges) for these KRIs still need to be defined.
  - ORMG requires business units to submit actual values for each KRI quarterly prior to the NFRMC meeting; process is at early stages and could be strengthened.
- Paragraph 25: Risk Appetite Framework (RAS) roadmap:
  - The Bank has approved a Concept Paper on “Developing a Risk Appetite Framework for the Central Bank of Sri Lanka.”
  - Timeline for submitting the RAS, recommended by the BROC, for approval of the GB is the 4th quarter of 2024.
  - RMD has conducted studies of other central banks’ RAS and submitted a proposed RAF report to NFRMC and BROC.
- Paragraph 26: Reporting cadence to committees:
  - RMD formally reports quarterly to the NFRMC and the BROC.
  - Aggregate quarterly reports include top operational risks; key highlights, messages and actions; and other operational risk categories.
  - RMD submits quarterly reports with details of incidents and near-misses to NFRMC and BROC.
  - For critical incidents, RMD should immediately notify the Chairman of the NFRMC.
  - NFRMC and BROC meetings last for two to five hours; meetings are documented in detailed committee minutes.
  - Need for further alignment before committee discussions and a simpler/high-level risk dashboard was identified.

### Recommendations for risk management framework (paragraphs 27–32)
- Paragraph 27: Formalize senior management support through adoption of a RAS (top down) that re-affirms operating within a “low risk range” while accepting some risks to advance the CBSL mandate of price and financial stability.
- Paragraph 28: Continue development of the Risk Management Framework covering all risks, including a RAS approved by the GB and/or MPB and revisited periodically; risk appetite can be formalized through qualitative or quantitative parameters and statements.
- Paragraph 29: KRI process enhancements:
  - Clearly define objectives, positioning, and an objective framework for KRIs.
  - RMD to lead and support first line in defining significant, clear, and objective KRIs.
  - Establish KRIs aligned with the RAS in a reduced/controlled number.
  - Carefully develop threshold values (acceptable ranges) for KRIs based on expert judgement, past experience, and current/future trends.
  - Ensure KRIs are understood by all three lines and supported with reliable data sources from appropriate information systems.
- Paragraph 30: Optimize BROC time and meeting efficiency:
  - BROC frequency should always be quarterly, as formally defined.
  - Meetings should focus on top operational, financial and compliance strategic risks, critical incidents, and significant escalations from the NFRMC.
  - Effective committee work depends on quality of risk management reporting and timely, accurate data; further pre-engagements with risk owners are critical.
- Paragraph 31: Implement integrated risk management reports that are sharp, concise, updated, and timely; reconsider RCSA frequency; consider a more standardized RCSA with a multi-year plan and improved communication strategy; planned automation could improve risk assessment and reporting.
- Paragraph 32: Expedite procurement of the Risk Management System to move from Microsoft Excel spreadsheets to a proper risk management system enabling an integrated approach (risk management, incidents, action tracking, KRIs, controls assessment, etc.), finding synergies with IA, business continuity management, and compliance management.

### Strengthening the Three Lines Model — current situation and priorities (paragraphs 33–36)
- Paragraph 33: CBSL uses a Three Lines Model; RMPS defines roles for business units (first line), RMD (second line), and Internal Audit Department (IAD) (third line). Implementation is not yet fully embedded despite growing risk awareness and culture.
- Paragraph 34: Information-sharing gaps between second and third lines:
  - No clear definition of type and frequency of information-sharing; interaction mainly via committee representation.
  - Chief Internal Auditor is an observer on BROC and NFRMC; CRO is an observer on the AC.
  - RMD shares risk registers with IAD upon request; IAD should share audit findings with RMD, which may require formalization from the GB given CBSL Act confidentiality provisions.
- Paragraph 35: IAD accountability and oversight:
  - IAD is accountable to the AC and should provide independent assurance to the GB/MPB.
  - AC was awaiting a new chairperson at the time of the mission; mission could not interview AC members, limiting assessment of AC oversight.
- Paragraph 36: RMD–first line interaction and ownership:
  - Interaction has improved but cooperation and alignment could be intensified.
  - First line business units should recognize their role as risk owners and the added value of the second line.
  - Degree of ownership across departments is uneven; risk awareness and knowledge at first line level could be improved and standardized, including further engagement from Directors of Departments and AGs.

*Source: Central Bank of Sri Lanka; IMF mission text provided in the supplied content.*

### 37. For each business unit, a person (RCO) is designated to support risk related

### tarea2024083-print-pdf - 37. For each business unit, a person (RCO) is designated to support risk related

### Current arrangements and responsibilities
- For each business unit, a person (RCO) is designated to support risk related responsibilities of the DRO, who is the focal point to conduct risk management activities.
- The RCOs assist the business units to manage their risks and closely coordinate with RMD to carry out the risk management process effectively.
- Business units, supported by the RCOs should submit non-financial risk events (internal and external), emerging risks, significant operational risks and status of action plans to RMD every quarter through the Departmental Risk Register.
- The CBSL actively cooperates with other central banks on risk management. The RMD has established bilateral cooperation with the Bank Al Maghrib, the South African Reserve Bank, and - recently – the Bank of Portugal.
- The CBSL is a member of the IORWG, however, in recent years, they have been less involved in the IORWG’s activities and have not participated in the annual conferences.

### Issues and gaps identified
- The RCOs’ potential role is not fully explored.
- The RCOs exist but lack visibility and consistency in relation with the RMD.
- The profile of RCOs is not consistent in all CBSL business units.
- There is no detailed and updated job description for this critical risk management role.
- Though the roles and responsibilities are defined by the relevant document, the RCOs are not actively and fully used by the RMD in practice.
- The CBSL’s recent lesser involvement in IORWG activities and non-participation in annual conferences reduces access to the IORWG platform for knowledge-sharing, self-development, and benchmarking.

### Recommendations (policy and operational)
- The Three Lines Model should be further enhanced and formalized at all possible levels. Overall, staff should be aware of their detailed individual roles and responsibilities regarding the internal control environment. “The Three Lines Model” helps organizations identify structures and processes that best assist the achievement of objectives and facilitate strong governance and risk management.”
- There should be a clear definition of information-sharing between the second and the third lines. The type and the frequency of the information to be exchanged between the lines should be specified and formalized.
  - Promote information-sharing between the second (i.e., RMD, Compliance and Information Security) and the third line (i.e., IAD) to strengthen the consistency and efficiency of the internal control environment.
  - Tie risk assessments into the IA plan, and ensure RCSAs take IA recommendations into account.
  - Use IAD information on effectiveness of controls to help RMD, especially when there are gaps in respective design.
- Business units should have a greater awareness of their role as the first line and contribution of the RMD.
  - Foster awareness by facilitating adequate and sufficient resources, particularly at the business level.
  - Enable cooperation on risk management between business units, their DRO/RCO (first line) and the RMD (second line) to allow a two–way conversation on risk views, management and mitigation.
  - Implement a quick and transparent escalation process and increase the importance of the current DROs/RCOs in assessing controls, anticipating vulnerabilities and helping with mitigation strategies.
- DROs and RCOs should have specific RM training and bank-wide meetings organized by RMD, to share best practices/lessons learned from risk events and/or with external speakers.
  - RMD should organize and sponsor specific and regular risk management sessions and meetings for RCOs to discuss methodology, report templates, case studies and lessons learned.
  - Increase interaction between RMD and RCOs to raise business-unit awareness, enhance buy-in for risk management, and strengthen overall risk culture.
  - Emphasize the particular role of RCOs as an extension of the RMD within their respective business units.
- The role of RCO needs to be formalized.
  - Create clear job descriptions, including a list of tasks that the RCOs need to undertake.
  - Use the job description as the basis for the annual performance review input of the RCO.
  - Ensure the respective manager of the RCO seeks review input from the RMD.
- The CBSL should promote closer relationships with the IORWG, CBRM Group, and bilateral cooperation with other central banks and IFIs.
  - Support additional research and benchmarking in risk management with other central banks.
  - Encourage active participation in working groups and conferences to align with international best practices.
  - Continue proper attention to the development of the RMD team, recognizing this function requires recurrent and updated knowledge in technical and soft skills (communication, negotiation, etc.).

*IMF | Sri Lanka Central Bank Risk Management | 19*

---


_Source: https://www.imf.org/-/media/files/publications/tar/2024/english/tarea2024083-print-pdf.pdf_