A case for effective risk management in microfinance institutions in Uganda: Key Note Presentation AMFIU Conference

7/28/2019 A case for effective risk management in microfinance institutions in Uganda: Key Note Presentation AMFIU Conference

1/46

Microfinance Risk Management:Current Status in Uganda

Managing risks a critical challenge for MFI sustainability

Forensic. Advisory. Fraud.www.summitcl.com

Mustapha B. Mugisas Keynote address

AMFIU Annual Conference and AGM

20th 21stJune 2013Hotel Africana.


2/46

Forensic. Advisory. Fraud

What do you think is theimpact to the economy

when a business collapses?

What happens when that

particular business is amicrofinance?

Im

agecredit,

AC

FE.com

Why care?

#1

#2


3/46


Keynote Agenda

1. Perspective

2. Current statusa) Regulatory

b)Governance

3. Way forward A low-end business woman withmerchandise.

Credit: Internet photo.


4/46


Perspective

Case 1: The rise and fallof SOMEDI Microfinance.

Started in 1996, inMasindi

Expanded regionally.

Was no more by 2012


5/46


Perspective impact

Joseph Businge,who used to

own threeshops, lost it all.He now lives inpoverty in

Masindi


Lost donor goodwill Lots of people lost

livelihood

Bad reputation of theindustry


6/46


Perspective why collapse?


Poor governance High levels offraud

Lack ofshared

strategic focus


7/46


Perspective

Case 2: The rise and fall ofVictoria Basin Savings &Microfinance Cooperative

Trust Ltd (VBS).

Started in 1990, in Rakaias building society

Transformed into aSACCO.

Off the radar by 2013!


8/46


Perspectiveimpact.

9,854activeborrowersin 2005

56%women.


9/46


Perspective why collapse?

Case 2: VBS Microfinance

High levels offraud

Failure to managechange

Poor governance


10/46


Perspective lessons

Timelysupervision

Effective riskmanagement


11/46


Status of Microfinance RM

1. Perspective

2. Current status

a) Regulatory framework

b)Governance

3. Way forward



12/46

(a) Regulatoryframework is key


Majority of the players

are outside the formalregulation.


13/46


Who is regulating who?

T a b l e 1 : C u r r en t s t a t u s o f th e M ic r o f in an ce i n du s t r y in U g an da

T i e r C a t e g o r y o f

I ns t i t u t i o ns

R e g u l a tio n N u m b e r

T i e r 1 B a n k s B a n k o f U g a nda ; F i n a n c ia l I n s t it u t io n s A c t

2 0 0 4

2 4

T i e r 2 C red i t I n s t i tu t i ons 4

T i e r 3 M ic r o f in a n ce D e po s i t -Tak ing I n s t it u t ion s

B a n k o f U g a n d a ; M D I A c t 2 0 0 3 4

T ie r 4 M F I s a n d S A C C O s T h e C o m p a n i e s A c t , 1 9 6 1 4 9

T h e N G O ( A m e n d m e n t) A c t 2 0 0 6 8 1

Fo r S A C C O s , th e R e g i s tr a r o f C oo pe r a t iv e

S o c i e t ie s ( M T I C ) u nd e r th e C oop e r a t iv eS o c i e t ie s A c t C a p 112

2 , 0 6 5

In f o rm a l : no c l e a r r egu l a t ion f o r o t he r

s a v i n g s a nd c r e d it s c h e m e s l ik e s a v in g s

a nd c r e d i t s c h e m e s in s e ve r a l c om pa n ie s .

U n k n o w n

O t h e r M o n e y le n d e r s M o n e y l e n d e rs A c t , C a p 2 7 3 , 1 9 5 2 5 3

S ou r c e : AM F I U pub lic a t io n s .


14/46


Regulatoryframework

Should address thekey failings:

Avoid mission drift

Address fraud risk

Monitor keybusiness indicators


15/46


Regulatoryframework

MoPED provides policyand oversight of thefinancial sector through

Rural Finance ServicesProgram (RFSP)

Department ofCooperatives in MTIC

registers & supervisesSACCOs

AMFIU andUCSC providesupport to

members asself regulating.


16/46


Regulatoryframework

Tier 4 regulatoryframework underway

SACCOs to be classified

Large ones to be underprudential regulations,e.g. under amended

MDI Act

Cleardefinition of

large or

smallSACCOs to bespecified.


17/46


Regulatoryframework

Microfinance is abusiness for socialimpact and economic

return. It supports thepeople at the bottom ofthe pyramid to change

their lives in asustainable way.

Risk is theprobabilitythat an

investmentsactual returnwill bedifferent

thanexpected


18/46


Regulatoryframework

Microfinance is not about makinga lot of profits or becoming a

bank. It is about expanding scaleand capacity to extend very lowcost microloans to as many poorpeople as possible and enabling

their enterprises to grow,Mustapha B. Mugisa, 2013.


19/46


The needfor regulation

Case 3: Enter Promotion ofEconomic Transformation &Realization of sustainable

Livelihood (PEARL)microfinance

Started in July 2006

Expanded rapidly Voluntarily closed in

2013.


20/46


The needfor regulation

Lots of changes in theindustry

Both SACCO and non-

SACCO institutions

New dynamics e.g. moneytransfer, microcredits via

mobile money and mobilesavings = more complex!


21/46

(b) It is all aboutGood Governance.


Fact: risk management

is not structured inmany microfinances.


22/46


Status on ground

Best practices are just onpaper

There is the Board,

Auditors, etc but theseare for cosmeticpurposes

Institutions want to justbe seen to be ok becausethey have the Board.


23/46


Status on ground

Risk management isnot structured.Majority of staff dont

know their roles inrisk management!


24/46


Status on ground

Generic risks exits e.g.credit, liquidity,technology,

governance. Few people, if any, know

how those risks are

identified, assessed,managed andcontinuously reviewed


25/46


Status on ground

Although cases ofSOMEDI, VBS and PEARLhave shown fraud, IT &

staffare big challenges,few institutions haverecognized this. Why?


26/46

Forensic. Advisory. Fraud

An averageorganization losesabout 5% of itsannual revenue tofraud,ACFE Reportto The Nations 2012.

Total annual revenue (allUganda banks) in 2011

1.94/-Trillion

Ugx. 4billion annually!

ACFE Uganda survey in2011 revealed banks &telecoms lose 15-25% ofannual revenue to fraud!

Average cost of fraud toeach bank in Uganda

#1: Lots offraudin the sector


27/46

#2: Cyberthreat & ICTsecurity risks

YourInstitution

Virus & HackerAttack

Data Leakage &Network Abuse

Cyber Crime

Combat

QualityDemand from

Clients

35%

65%

For institutions65% of securitybreaches are internal

35% of security breachesare external.

You need tools to ensure realtime network monitoring?


28/46


#3: Thepeople risks

Information theft

About 2/3 leavingemployees steal data

Microfinance IT systemfrauds; e.g. salamitechniques; loan write-

offs, etc.


29/46


The wayforward

1. Perspective

2. Current status

a) Regulatoryb) Governance

3. Way forward

A low-end business woman withmerchandise.



30/46


XY Microfinance RM model

Case 4:XY Microfinance riskmanagement model is good.

Risk management is part of

their business

Process owners identify therisks and monitor them

Eight questions are askedand answered


31/46


XY RM model awareness

#1: Do the Board, management and staff allunderstand how the risk register is developed?

F ig u r e 1 : R is k m a n a g e m e n t p r o c e s s a t X Y

1 . I d e n t i f y W h a t c o u ld g o w r o n g ?

2 . A s s e s s Ho w l i k e l y is i t t o h ap pen ? W h o w o u ld c o m m it fr a u d ? W h a t w o u l d b e th e i m p a c t

i f i t h ap pen ed

3 . C o n t r o l / M i t i g a t e W h a t s h o u ld b e d o n e t o

redu ce t h e r i s k ?

W h o o w n s t h e ris k ? W h a t m o r e t o d o a b o u t it ?

4 .

M o n i to r a n dC o n t i n u o u s R e v i e w

A re th e c o n tro ls e ffe c t iv e ? H a s t h e r i s k c h a ng ed ?

X Y O b je c t iv e s /

K R A s


32/46


XY RM model tone at the top

#2: Is the Board involved inrisk management?

XY ensures a right tone at thetop throughout the RM process.


33/46


XY RMimpact/likelihood

#3, for each identified event, arelikelihoodand impactclearly definedand assessed by process owners?

XY uses the likelihood and impactguide by the Institute of RiskManagement (IRM), specificallyfollows the ISO 31000:2009

guidelines as in tables 2 & 3 below.


34/46


XY RM modellikelihood

a t in g S c o r e T h r e a t O p p o r t u n i ty

r equ en t 5 > 7 5 % c h a n c e o f o cc u rr e n c e Very r egu la r o c cu r r ence

Fa vou r a b le a n d f requ en t o c c u r r en c el ikely.

ike ly 4 > 5 0 % < 7 5 % c h a n c e o f o c c u rr e n ce C i rc u m s t a n c e s f r equ en t l y

en c ou n t e r ed

Favou rab l e ou t com e i s li ke ly t o beach i eved i n one ye a r.

M o r e t h a n 5 0 % c h a n c e o f o c cu r re n c e .os s i b l e 3 > 2 5 % < 5 0 % c h a n c e o f o c c u rr e n ce

L ik e l y t o h a ppen a t s om e po i n t int h e n ex t 2 y e a r s .

C i r cum s tances oc ca s i ona l lyen c ou n t e r ed .

Reasonab le p rospec t s o f f a vou rab l eresu l t s in on e ye ar.

2 5 % t o 5 0 % c h a n c e o f o c c u rr e n c e

n l ike ly 2 > 5 % < 2 5 % c ha n ce o f o c c u r r en c e

O n ly l ik e l y t o h a ppen on c e i n 3yea r s .

C i rc u m s t a n c e s r a re l y en c ou n t e r ed .

Som e c h a n c e s o f f a vou ra b l e ou t c om ein t h e m ed i u m t e r m

5 % t o 2 5 % c h a n c e o f o cc u r re n c e

e m o t e 1 L e s s th a n 5 % c h a n c e o f o c c u r r en c e .

H a s n e v e r h a p p e n e d b e f o re C i rc u m s t a n c e s n eve r en c ou n t e r ed .

L e s s t h a n 5% c h a n c e o f o c c u r ren c e .


35/46


XY RM modelimpact

a t i n g D e f in i t io n M o n e t a r y

I m p a c t ( U g x m )

C o n s e q u e n c e I m p a c t o n

X Y so b j e c t i v e s

R e p u t a t io n p e r

e v e n t

N o n c o m p l ia n c e

5 V e r y h i g h

( c a t a s t r o p h i c )

> 5 0 L e a d s t o

t e r m i n a t io n o f

p r o j e c t s o r

w i t h d ra w a l o f

f in a n c i n g a n d i s

u n d a m e n t a l t o

s e r v i c e d e l i v e r y

N o n

a c h i e v e m e n t

o f o b j e c t i v e s ;

p e r fo r m a n c e

fa i l u re

M a x i m u m h ig h

h e a d l i n e

e x p o s u r e ; B o a r d

c e n s u r e ; l o s s o f

c r ed ib i l i t y

S e r i o u s w i l f u l

b r e a c h ; c r im i n a l

n e g l i g e n c e o r a c t ;

p r o s e c u t i o n ; B o a r d

c e n s u r e .

4 H i g h ( C r it ic a l) > 1 0 < 5 0 E v e n t w h ic h m a yh a v e a p r o lo n g e d

n e g a t iv e i m p a c t

a n d e x t e n s i v e

c o n s e q u e n c e s

S i gn i f i c a n td e l a y s ;


s i gn i f i c a n t l y

u n d e r t a r g e t

H e a d l i n e p r o f i l e ;r e p e a t e d

e x p o s u r e ; B o a r d

i nv o l v e m e n t ;

r e g u l a t o r y

e n q u i r y

D e l ib e r a t e b r e a c h o rg r o s s n e g l ig e n c e ;

f o r m a l i n v e s t ig a t i o n ;

d i s c i p l i n a r y a c t i o n ;

B o a r d i n v o lv e m e n t

3 M o d e r a te > 5 < 1 0 E v e n t w h i c h c a n

b e m a n a g e d , b u t

r e q u i r e s a d d i ti o n a l

r e s o u r c e s a n d

m a n a g e m e n te f f o r t

M a t e r i a l

d e l a y s ,

m a r g in a l

u n d e r

a c h i e v e m e n to f t a r g e t


R e p e a t e d n o n

h e a d l i n e

e x p o s u r e ; s lo w

r e s o l u t i o n ;

P a r l ia m e n t a r ye n qu i r y / b r i e f i n g

N e g l ig e n t b r e a c h ;

l a c k o f g o o d f a i t h

e v i d e n t; p e r fo r m a n c e

r e v i e w i n i t i a t e d

2 M in o r > 0 . 5 < 5 E v e n t c a n b e

m a n a g e d u n d e r

n o r m a l o p e r a t in g

c o n d i t i o n s

I n c o n v e n i e n t

d e l a y s

N o n - h e a d l i n e

e x p o s u r e , c le a r

f a u l t s e t t l e d

qu i c k l y ;

n e g l i g ib l e im p a c t

B r e a c h ; o b j e c t i o n /

c o m p l a in t l o d g e d ;

m i n o r h a r m w it h

i n v e s t i g a t i o n

1 I n s i g n i fi c a n t < 0 . 5 C o n s e q u e n c e s c a n

e a s i l y b e

a b s o r b e d u n d e rn o r m a l o p e r a t in g

c o n d i t i o n s

L i tt le i m p a c t N o n - h e a d l in e

e x p o s u r e , n o t a t

f a u l t, n o i m p a c t

I n n o c e n t p r o c e d u r a l

b r e a c h ; e v i d e n c e o f

g ood f a i t h ; l i t t l eim p a c t


36/46


Impact xlikelihood = risk

X Y R is k in d e x = im p a c t x lik e lih o o d

IM

PACT

5

4

3

2

1

5 1 0 1 5 2 0 2 5

4 8 1 2 1 6 2 0

3 6 9 1 2 1 5

2 4 6 8 1 0

1 2 3 4 5

1 2 3 4 5

L I K E L I H O O D

S c o r e R is k m a g n i tu d e

2 0 - 2 5 M a x im u m

1 5 - 1 9 H i g h r is k

1 0 - 1 4 M e d iu m r is k

5 9 L o w r is k

1 - 4 M in i m u m r is k

#4, Are risksidentified and

managed?

Figure 2 XYs isk ni e se


37/46

Figure 2: XYs risk universe

RiskUniverse

Strategic

Financial

Compliance

Procurement

frauds

Fraud

Over

indebtednessLiquidity

Asset

misappropriation

Non Compliance

to statutory

requirements

Dynamic legal

regime / Non

compliance to

Best practices

Non

compliance

to internal

policies

Unclear

Strategic

focus

Mission drift

Corporate

governance

Inadequate

Succession

planning

Ineffective

change

management

Poor

Client

management

Stakeholder risks;

concealment of

Malpractices

High staff

turnover

Gaps in

compliance

enforcement

Operational

XYs risk universewww.summitcl.com. 2013 All rights reserved.

Reputation Risk

Unclear

Performance

Indicators

Governance

constraints low

Anti-fraud

funding

Fraud.

Compromise

of XY

Credit /

fieldStaff

Weak contract

Management

Information

Technology

Poor change

management

Poor IT security

practices

Weak

IT system

securityHigh

Systemdowntime


38/46


39/46


XY RMrisk reporting

#5, are risk reporting processes effective?R o l e Q u a r t e r ly S e m i A n n u a l / A n n u a l

u l t i m a t e a c c o u n t a b i l i t y a n d o v e r s i g h tf o r b u s i n e s s r i s k a n d c o n t r o l s .

r e c e i v e a s s u r a n c e t h a t r i s k m a n a g e m e n t i s w i t h i n p o l i c y.

R e c e i v e p e r i o d i c r e p o r ts f r o m A u d i tC o m m i t t e e a n d r e v i e w a l l r i s k s i n r e dc a t e g o r y .

A p p r o v e t h e R i sk M a n a g e m e n tS t r a t e g y .

top 1 0 r is k li s t. s u m m a r y d a s h b o a r d . p e n d in g li ti g a ti o n . m a j o r i n t e rn a l a n d e x t e r n a l e v e n t s . a u d i t a s s u r a n c e .

O v e r s e e s d e v e l o p m e n t ,i m p l e m e n t a t i o n a n d m a i n t e n a n c e o f

r i s k m a n a g e m e n t a c r o s s th e A u t h o r i t y .

r i s k p r o f i l e . s e l f a s s e s s m e n t . l o s s e v e n t d a t a . s t r e s s t e s t i n g . k e y r i s k i n d i c a t o r s . p e n d in g li ti g a ti o n .

T o p 1 0 s t r a te g i c r i s k s . T o p r i s k s o f th e d e p a r t m e n t s . a u d i t a s s u r a n c e . e f f e c t i v e n e s s o f r i s k m a n a g e m e n t . c o s t / v a lu e o f r i s k m a n a g e m e n t . b e n c h m a rk in g r is k m a n a g e m e n t.

o w n r is k s . d e s i g n a n d o w n c o n t r o l s .. r u n t h e b u s i n e s s

r i s k p r o f i l e . s e l f a s s e s s m e n t . l o s s e v e n t d a t a . s t ress t es t ing . k e y r i s k i n d i c a t o r s . p e n d in g li ti g a ti o n .

B o a r d

A u d i t / R i s k

C o m m i t t e e

D e p a r t m e n t /

S e c t i o n h e a d s


40/46


XY RMrisk appetite & KRIs

#6, has the board set and communicatedrisk appetite?

R i s k c la s s B o a r d / S M T / m a n a g e m e n t le v e l a r t ic u la t io n o f r is k

a p p e t i t e .

S t r a t e g i c 1 ) Z e r o t o l e ra n ce o f a c t iv it ie s n o t w it h in t h e C om p a ny sb u s in e s s p l a n a n d s t r a te g i c o b j e c t iv e s .

2 ) V e r y L o w r is k a p p e t it e f o r r e p u t a t io n a l ris k s3 ) Ze ro t o l e r an ce f o r d i s c l o su re o f c on f i d en t i a l o r c l a s s i f i e d

in f o rm a t io n .

C o m p lia n c e 1 ) Z e r o t o le r a n c e f o r n o n - c o m p l ia n c eF i n a n c i a l 1 ) Ze ro t o l e r an ce f o r f r aud u l en t / th e f t a c t i v it y b y an y s t a f f,

c u s t o m e r o r s ta k e h o l d e r

O p e r a t i o n a l 2 ) L o w r i s k a p p e t i t e f o r i n a d e q u a t e l y t r a i n e d ,in e x p e r i e n c e d a n d u n s k i lle d s t a ff.

3 ) L o w o p e r a t i o n a l r i s k a p p e t i t e f o r a n y i n t e r n a l p r o c e s sf a i l u re s .


41/46


XY RMtop 10 risks

#7, are top 10 risks identified andclearly monitored?

XY has operates a risk managementsoftware which provides a dashboardor a Risk Register for easy risk

monitoring on-going.


42/46


XY RMrisk reporting

#8, Is the Risk Register up to date?

XY has operates a risk managementsoftware which provides a dashboardor a Risk Register for easy riskmonitoring on-going.


43/46


Address ICT security

Train all computer users incomprehensive ICT security

96% of your staff are notIT secure aware

They are a weakest link


44/46


Focus on fraud management

SCL fraud prevention toolkit

i. Fraud risk managementstrategy e.g. PAPEMO toolkit &

on-going awareness training toall staff

ii. Effective whistleblowing solution

Microfinance fraud prevention

Toolkit


45/46


Call to Donors & Government

Donors must become businesspartners; provide support beyondenabling outreach and focus on on-site

capacity building Government must fast track the law

for regulating Microfinance Institutions GoU should take advantage of existing

institutions like AMFIU and UCSU


46/46


Our values for your success!

We take pride indoing the rightthing, rather thanwhat is right for theprofitability of SCL.

For more info, visit:www.summitcl.comwww.mustaphamugisa.com

m: 0712 984 585.

Thank you!
http://www.summitcl.com/http://www.mustaphamugisa.com/http://www.mustaphamugisa.com/http://www.summitcl.com/

Documents

A case for effective risk management in microfinance institutions in Uganda: Key Note Presentation AMFIU Conference