Duration Limit Breach and the Limits of Management Discretion
Northbridge Bank ($18bn assets) runs a duration limit of 4.5 years on its $3.1bn available-for-sale securities portfolio. At the October month-end, Treasury reports duration of 5.1 years. The head of Treasury attributes the excess to a prepayment-speed assumption in the mortgage-backed securities model and proposes waiting for the November re-run before acting. The limit policy states that any breach above 5% must be reported in writing to the Board Risk Committee within five business days and remediated within ten business days. The breach is 13% and the next scheduled Board Risk Committee meeting is six weeks away. The CRO wants to sell long-duration bonds immediately; the CFO argues that selling would crystallize a $22m unrealized loss. The CEO asks the CRO to 'keep this at management level' and to consider raising the limit retroactively. The limit was last recalibrated three years ago and has no defined review trigger.
1. Identify the governance failures in this situation and state what must happen within the next five business days.
Read the worked answer
The breach is 13%, not 5%, so it sits well inside the mandatory reporting band. The policy requires a written report to the Board Risk Committee within five business days and remediation within ten; the six-week meeting cycle does not suspend that requirement.
Governance failures include: (1) Treasury treating a limit breach as a model-input question without independent validation; (2) the CEO seeking to keep a reportable breach at management level; (3) the proposal to raise the limit retroactively; (4) a limit that has not been reviewed for three years and has no review trigger; and (5) no extraordinary Board Risk Committee process for a material breach.
The CRO should issue a written breach report to the Board Risk Committee chair within five days, copied to the CEO and CFO. The report should state the measured duration, the cause, remediation options, the cost of each option, and a firm deadline. The CRO should convene an extraordinary Board Risk Committee meeting. If management does not escalate, the CRO should use the direct reporting line to the committee. The limit remains in force until it is changed through the proper process; a verbal instruction from the CEO does not override the policy.
2. Evaluate the CFO's proposal to raise the limit retroactively and the Treasury head's proposal to wait. What should the CRO recommend?
Read the worked answer
A retroactive limit increase is not acceptable. It converts a control failure into a non-event, destroys the audit trail, and tells the front office that limits can be redefined after the fact. A prospective recalibration may be legitimate, but only with analysis, independent validation, and Board Risk Committee approval effective after the decision.
Waiting for the November re-run is also weak. The prepayment assumption may explain part of the excess, but the CRO needs an independent duration estimate now, not a front-office estimate later. If validated duration remains above 4.5 years, Treasury should reduce risk by selling long-duration bonds or paying fixed in swaps.
The CFO's $22m unrealized loss is an economic cost of the existing position, not a reason to ignore the limit. The CRO should compare the cost of remediation with the cost of carrying excess risk. If immediate selling would be disorderly, the Board Risk Committee, not management, can grant a temporary exception with a hard sunset, daily reporting, and a ban on adding duration. The decision and its rationale should be documented, and internal audit should review the escalation.
3. Design a limit review and escalation framework that would prevent recurrence.
Read the worked answer
The framework should have four parts.
First, limit design: set limits by risk factor and portfolio, with clear owners, measurement frequency, and defined review triggers such as annual recalibration, a material portfolio change, a model change, or a market regime shift. Tie the duration range to the board-approved risk appetite.
Second, breach severity tiers: for example, below 5% notify the desk and risk; 5-10% notify the CRO and ALCO; above 10% report to the Board Risk Committee within five business days. Each tier needs a remediation deadline and a named accountable executive.
Third, exception governance: specify who may approve a temporary exception, the maximum duration, the compensating controls, and the reporting frequency. Management should not be able to approve exceptions above a defined threshold, and retroactive approval should be prohibited.
Fourth, independent assurance: validate model inputs and assumptions, track limit utilization and near-misses monthly at ALCO and quarterly at the Board Risk Committee, and have internal audit test the escalation process. Pre-approve remediation tools such as sales, swaps, and hedging so that action is not delayed by debates about cost.