Bank Analysis School September 2023 - Presentations & Resources

Internal Use Only MANAGEMENT

The management rating reflects the capability of the board and management, in their respective roles, to identify, measure, monitor, and control risks of an institution’s activities. To ensure safe, sound and efficient operation in compliance with applicable laws and regulations. Directors must provide clear guidance regarding risk exposure levels and ensure appropriate policies, procedures, and practices have been established; while senior management is responsible for the development and implementation of the aforementioned. Management’s practices should address risks associated with credit, market, operational, reputation, strategic, compliance, legal, liquidity, and other risks. Directors and management should demonstrate active oversight with processes that ensure an appropriate audit program, internal control environment and effective risk-monitoring and management information systems. This rating reflects the board’s and management’s ability in relation to all aspects of banking operations. Management evaluation factors may include but are not limited to: Level and quality of board and management oversight and support of all institution activities ◊ Ability to plan and respond to arising risks ◊ Adequacy and conformance with internal policies and controls ◊ Accuracy, timeliness, and effectiveness of risk monitoring and management information systems ◊ Adequacy of audits and internal controls to promote effective operations and reliable reporting, safeguard assets, and ensure compliance with laws, regulations, and internal policies ◊ Responsiveness to audit and examination recommendations ◊ Management depth and succession ◊ Influence by dominate authority ◊ Reasonableness of compensation ◊ Willingness to serve banking needs of community ◊ Overall performance and risk profile of the institution

2

3

4

5

1

•Critically deficient asset quality or credit administrationpractices •Board andmanagement have not demonstrated willingness or ability to correct problems and implement appropriate risk management practices •Risk exposure and problems are inadequately identified and controlled •Imminent threat to the institution's viability •Board andmanagement replacement is required

•Deficient management and boardperformance •Risk management practices are inadequate •Level of problems and risk exposure is excessive •Problems and risks are inadequately identified and controlled •Board andmanagement strengthening or replacement may be necessary

•Satisfactory performance of board and management •Satisfactory risk management practices •Minor weaknesses; not material to the institution's safety and soundness, are addressed •Significant risks and problems are effectively identified, measured, monitored, and controlled

•Strong performance by management and the board •Strong risk management practices •Significant risks are consistently identified, measured, monitored,

•Board and management's performance are inneed of improvement •Risk management practices are less than capabilities may be insufficient for the institution's risk profile •Inadequate oversight of significant risks and problems satisfactory •Board and management's

and controlled •Promptly and

successfully address existing andpotential problems and risks

Internal Use Only

22