Interest rate risk policy: who sets limits, changes assumptions, signs

An interest rate risk policy is the board-approved document that sets how much interest rate risk an institution will carry, how that risk is measured, which limits apply, who may act, and how exceptions and changes are handled. Federally insured credit unions above $50 million in assets must have a written one; banks are expected to have one by the OCC, the FDIC and the Federal Reserve. What makes a policy hold up is not its limit table but its signatures: who sets the limits, who may change the assumptions that drive every number, and who checks. Botminds' Interest Rate Risk (IRRBB) Management is built around that chain: agents back-test the assumptions and draft the evidence, while the ALM manager, an independent validator and ALCO decide.

The rules below come from the regulators' own texts, linked where they are used. The worked example is a fictional sample credit union, Norrell Federal Credit Union, as it runs through the solution; its people and figures are invented.

What should an interest rate risk policy include?

An interest rate risk policy should name who is responsible, set limits on the measures the institution uses, say which tests it runs and how often results reach the board, and provide for exceptions, new products, independent review and an annual look at the policy itself. The three main texts list nearly the same contents in different words, which is useful: a policy that covers all three lists is covered for any examiner.

For credit unions the list is in Appendix A to Part 741. A written policy should identify the committees or persons responsible for reviewing the exposure, "state the frequency with which management will report on measurement results to the board", "set risk limits for IRR exposures based on selected measures", choose tests such as rate shocks, provide for review of new business activities before they start, and "provide for at least an annual evaluation of policy" (12 CFR Part 741, Appendix A). The board must also see the actions and authorities required for exceptions to policy and limits.

Two lines on the OCC's list deserve more weight than they usually get. The booklet expects a policy to include "model validation and back-testing requirements", and it expects procedures "to monitor, escalate, and address limit breaches" (OCC, Interest Rate Risk booklet). Most policies carry a limit table. Fewer say who must act when a limit is approached, by when, and what evidence an assumption needs before it can change. Those are the sections an examiner tests against the minutes.

Who approves an interest rate risk policy, and how often is it reviewed?

The board of directors, or a committee of board members it delegates, approves the interest rate risk policy and its limits, and reviews them at least once a year. The 2010 interagency advisory says the board "should oversee the establishment, approval, implementation, and annual review of IRR management strategies, policies, procedures, and limits (or risk tolerances)" (Interagency Advisory on Interest Rate Risk Management, 2010). NCUA's appendix puts the annual evaluation into the policy itself and adds that the board "should annually assess" whether the program identifies, measures, monitors and controls the risk.

Approval is not the board's only signature. The OCC lists what the board should do: establish a risk appetite, "approve key policies, relevant risk limits, independent review program", name the senior managers with authority over IRR, review reports, and "provide credible challenge". It also expects the board or a board committee to review "the bank's key assumptions and their impact on the bank's models at least annually." That last line is the one most often missed in practice: a board that approves a limit table every year but never sees the assumptions behind the numbers has approved half a policy.

Day-to-day authority sits lower. The advisory makes senior management responsible for "procedures for updating IRR measurement scenarios and key underlying assumptions" and expects an ALCO, where there is one, to draw its members from the major functions, such as lending, investments and funding. In a credit union with limited staff, NCUA notes, these responsibilities may sit with the board or management directly.

Does NCUA require an interest rate risk policy?

Yes, above $50 million in assets. Under 12 CFR 741.3(b)(5), federally insured credit unions "with assets of more than $50 million, as measured by the most recent Call Report filing, must adopt a written IRR policy and implement an effective IRR program." The rule is short; the substance is in Appendix A, which NCUA calls guidance on how to build the policy and program. Smaller credit unions are not exempt from managing the risk, only from the written-policy rule.

Credit unions that do not have a written IRR policy or that do not have an effective IRR program are out of compliance with § 741.3 of NCUA's regulations.

NCUA, 12 CFR Part 741, Appendix A, section VII

The appendix gives example limits and is careful about them. A net economic value limit might be an "after shock change in net economic value less than 25 percent, or after shock net economic value of 6 percent or greater", and an income simulation limit a net interest income change "less than 20 percent over any 12-month period". NCUA adds at once that "these are only for illustrative purposes, and management should establish its own limits that are reasonably supported." A policy that copies the examples ends up with limits nobody at the credit union can explain to an examiner.

The appendix also asks for something many policies leave out: a separation of duties. Management should keep "separation between the risk taker and IRR measurement staff", and for credit unions of $500 million or more NCUA suggests "a policy which provides for the use of outside parties to validate the tests and limits". How NCUA then scores the result, through its NEV Supervisory Test, is covered in how far a +300 bp result sits from the High line.

What the FDIC and OCC expect a bank's policy to say

For banks there is no single rule like 741.3; the expectations sit in examination manuals and the interagency advisory, and they are more specific about limits. The FDIC's manual wants limits stated as explicit amounts or percentages and set, at the least, over one-year and two-year horizons (FDIC RMS Manual 7.1; the wording is quoted in ALCO limits against 791 banks). It also sets the reporting rhythm: senior management and the board review interest rate risk reports at least every quarter, the clock ALCO meeting frequency builds a calendar on.

The OCC adds a test of whether limits mean anything. Limits that are never approached, or that are breached routinely, need explaining: if they seem high or are breached often, management "should have strong support for the appropriateness of the limits." Where your limits sit against 791 other banks' is set out in the OCC interest rate risk statistics report.

The Federal Reserve's review of Silicon Valley Bank shows what a thin policy looks like when it fails. Of SVB's interest rate risk policy, the review found: "The policy did not specify scenarios to be run, how assumptions should be analyzed, how to conduct sensitivity analysis, or articulate model back-testing requirements. Further, there was no description of how limits were set and calibrated" (Federal Reserve, Review of the Supervision and Regulation of Silicon Valley Bank, April 2023). Every gap in that sentence is a section the three checklists above ask for.

Who can change an ALM assumption?

The person who owns the model, usually the ALM manager or corporate treasurer, proposes an assumption change; it should not take effect until someone independent has reviewed it and the body the policy names, usually ALCO, has approved it. The FDIC states the principle plainly: management "should establish procedures for reviewing the reasonableness of assumption changes and for approving those changes before they occur." The manual adds that "key assumption changes should be properly documented and reviewed by the board."

The other regulators say the same thing from different sides. The OCC's examination procedures ask "whether major assumption changes are reported and tested before implementation" (OCC booklet, examination procedures). NCUA's appendix says "significant changes in assumptions, measurement methods, tests performed, or other aspects involved in the IRR process should be documented and brought to the attention of those responsible." And the 2010 interagency advisory expects any change from a prior period, and its effect on the model's outputs, to be documented and identified.

The reason this is the weak point is that an assumption change moves every reported number at once, without touching the balance sheet. A longer deposit life raises economic value; a lower deposit beta raises projected income. The SVB review describes the bank's April 2022 change to deposit duration in exactly those terms; the story is told in SVB's gap assessment against SR 10-1. A policy that lets the model owner change an assumption and report the result in the same week has no control over its own limits.

An assumption change, signer by signer

A workable policy writes the route an assumption change takes, and what each signature means. The sequence below is the one Interest Rate Risk (IRRBB) Management enforces; the agents prepare the evidence, and every step that commits the institution belongs to a named person.

The policy should also say what the maker's memo must contain, because that document is what the checker, the committee and later the examiner read. The OCC explains why: "Documentation is necessary to understand how a model is built and to validate that assumptions are properly designed," and it "helps to ensure that more than one person in the bank understands how assumptions were derived" (OCC booklet, 'Developing Behavioral and Pricing Assumptions'). A useful minimum is five parts: what the model assumes and since when, what customers actually did, why the two differ, the effect on every limit, and the recommendation with a date to test it again.

Two details make the route work. First, the change is approved before it is used, not explained afterwards: until the release, the model runs on the approved set and any proposed value lives only in what-if runs. Second, the checker does not start from the maker's memo. In the solution, the validator's own agent recomputes the number from the raw extract before it sees the first-line memo, so agreement means two independent calculations matched.

Interest Rate Risk (IRRBB) Management: every board limit read against the latest run

What is an independent review of interest rate risk?

An independent review is a periodic assessment of the whole interest rate risk process, data, assumptions, model and reporting, by people who take no part in running it, reported to the board at least once a year. The FDIC's manual is the most precise text on it: the reviewers hold no operational role in measuring or managing the risk, do none of the routine control work such as reconciling inputs or developing assumptions, review at least once a year, and work to a scope that internal audit usually defines and the audit committee approves (FDIC RMS Manual 7.1, 'Independent Reviews').

The manual lists what the review covers, and assumptions get a list of their own: the process of developing them, "the process for reviewing and approving key assumptions", their periodic review for reasonableness, and the completeness of the supporting analysis. The review of outputs must cover "performance and documentation of variance analyses (back-testing)". In other words the independent reviewer checks that the maker-checker route above exists and was followed, not just that the model's arithmetic is right.

Size changes who can do it, not whether it is done. The advisory accepts that smaller institutions often rely on an internal party well removed from the IRR work, or on an external auditor. NCUA's appendix lets a credit union without an internal auditor use management or "a supervisory committee that is independent of the IRR process", with audit findings "reported to the board or supervisory committee with recommended corrective actions and timeframes." What an ALM validation should contain once SR 26-2 replaced the old model risk guidance is set out in ALM model validation under SR 26-2.

The validator's signature, with its reason code and condition

Interest Rate Risk (IRRBB) Management: the policy as settings

In the solution, the policy is not a PDF the team consults; its limits, clocks and separations are settings the screens enforce, and any change to them is itself a change request a second administrator must approve. The sample credit union's policy, FIN-04, sets a floor of 7.0% for the NEV ratio at +300 bp and 5.0% at +400 bp, a ceiling of 40% for NEV sensitivity, a limit of −15% on year-one NII at ±300 bp, and an early warning when any measure comes within 1.0 point of its limit.

The clocks matter as much as the limits. An assumption outside tolerance needs a memo or a documented re-affirmation within 15 business days and before the next ALCO; a limit breach goes to the CFO the same day. Each step names a role, and the screens lock what a role may not do: the ALM manager cannot validate, the validator cannot vote, and the supervisory committee reads and exports but changes nothing.

ALCO votes on validated changes; the model waits

Questions people ask

Who approves an interest rate risk policy?

The board of directors, or a board committee it delegates, approves the policy and its limits. The 2010 interagency advisory asks the board to oversee their establishment, approval, implementation and annual review. Management and ALCO run the program within those limits but do not approve the policy itself.

How often should an interest rate risk policy be reviewed?

At least once a year. NCUA's Appendix A asks for "at least an annual evaluation of policy", and the advisory asks for an annual review of policies and limits. The OCC also expects the board to review key assumptions and their impact at least annually.

Can the ALM manager change an assumption without ALCO?

Not under a sound policy. The FDIC expects procedures for approving assumption changes before they occur and expects key changes to be reviewed by the board. A common design is maker (ALM manager), independent checker (model validation or an independent reviewer) and approval by ALCO before the model uses the new value.

What limits should an interest rate risk policy set?

Limits on both earnings and economic value, over a range of rate shocks. The FDIC asks for explicit dollar or percentage limits over at least one and two year horizons. In the OCC's fall 2026 statistics, the median bank's limit at +300 bp is a 20% fall in 12-month NII and a 30% fall in EVE.

Does a credit union under $50 million need an interest rate risk policy?

The written-policy rule in 12 CFR 741.3(b)(5) applies to federally insured credit unions with more than $50 million in assets on their most recent Call Report. NCUA describes Appendix A as widely accepted practice for all federally insured credit unions, so a smaller one still benefits from a short policy that limits loan maturities and investment types.

Who performs the independent review at a small credit union?

NCUA's appendix says internal audit normally assumes the role; without an internal auditor, management or a supervisory committee that is independent of the IRR process may perform it. Findings go to the board or supervisory committee with corrective actions and timeframes.