Microfinance Risk Management: Current Status in Uganda
Managing risks – a critical challenge for MFI sustainability
Forensic. Advisory. Fraud. www.summitcl.com
Mustapha B. Mugisa’s Keynote address AMFIU Annual Conference and AGM 20th – 21st June 2013 Hotel Africana.
Forensic. Advisory. Fraud
What do you think is the impact to the economy when a business collapses?
What happens when that particular business is a microfinance?
Imag
e c
red
it,
AC
FE
.co
m
Why care?
#1
#2
Forensic. Advisory. Fraud. www.summitcl.com
Keynote Agenda…
1. Perspective
2. Current status
a) Regulatory
b) Governance
3. Way forward
A low-end business woman with merchandise. Credit: Internet photo.
Forensic. Advisory. Fraud. www.summitcl.com
Perspective…
Case 1: The rise and fall of SOMEDI Microfinance.
• Started in 1996, in Masindi
• Expanded regionally.
• Was no more by 2012
Forensic. Advisory. Fraud. www.summitcl.com
Perspective… impact
Joseph Businge, who used to own three shops, lost it all. He now lives in poverty in Masindi
Case 1: The rise and fall of SOMEDI Microfinance.
• Lost donor goodwill
• Lots of people lost livelihood
• Bad reputation of the industry
Forensic. Advisory. Fraud. www.summitcl.com
Perspective… why collapse?
Case 1: The rise and fall of SOMEDI Microfinance.
• Poor governance
• High levels of fraud
• Lack of shared strategic focus
Forensic. Advisory. Fraud. www.summitcl.com
Perspective…
Case 2: The rise and fall of Victoria Basin Savings & Microfinance Cooperative Trust Ltd (VBS).
• Started in 1990, in Rakai as building society
• Transformed into a SACCO.
• Off the radar by 2013!
Forensic. Advisory. Fraud. www.summitcl.com
Perspective…impact.
9,854 active borrowers in 2005
56% women.
Forensic. Advisory. Fraud. www.summitcl.com
Perspective… why collapse?
Case 2: VBS Microfinance
• High levels of fraud
• Failure to manage change
• Poor governance
Forensic. Advisory. Fraud. www.summitcl.com
Perspective… lessons
• Timely supervision
• Effective risk management
Forensic. Advisory. Fraud. www.summitcl.com
Status of Microfinance RM…
1. Perspective
2. Current status
a) Regulatory framework
b) Governance
3. Way forward
Credit: Internet photo.
(a) Regulatory framework is key
Forensic. Advisory. Fraud. www.summitcl.com
“Majority of the players are outside the formal regulation.”
Forensic. Advisory. Fraud. www.summitcl.com
Who is regulating who?
T a b le 1 : C u rre n t s ta tu s o f th e M ic ro f in a n ce in d u s try in U g a n d a
T ie r C a te g o r y o f
I n s t itu t io n s
R e g u la t io n N u m b e r
T ie r 1 B a n k s B a n k o f U g a n d a ; F in a n c ia l In s t itu t io n s A c t
2 0 0 4
2 4
T ie r 2 C re d it In s t itu t io n s 4
T ie r 3 M ic ro f in a n ce D e p o s it -
T a k in g In s t itu t io n s
B a n k o f U g a n d a ; M D I A c t 2 0 0 3 4
T ie r 4 M F Is a n d S A C C O s T h e C o m p a n ie s A c t , 1 9 6 1 4 9
T h e N G O (A m e n d m e n t) A c t 2 0 0 6 8 1
F o r S A C C O s , th e R e g is tra r o f C o o p e ra t iv e
S o c ie t ie s (M T IC ) u n d e r th e C o o p e ra t iv e
S o c ie t ie s A c t C a p 1 1 2
2 ,0 6 5
In fo rm a l: n o c le a r re g u la t io n fo r o th e r
s a v in g s a n d c re d it s c h e m e s lik e s a v in g s
a n d c re d it s c h e m e s in s e v e ra l c o m p a n ie s .
U n k n o w n
O th e r M o n e y le n d e rs M o n e y le n d e rs A c t , C a p 2 7 3 , 1 9 5 2 5 3
S o u rc e : A M F IU p u b lic a t io n s .
Forensic. Advisory. Fraud. www.summitcl.com
Regulatory framework…
Should address the key failings:
• Avoid mission drift
• Address fraud risk
• Monitor key business indicators
Forensic. Advisory. Fraud. www.summitcl.com
Regulatory framework…
• MoPED provides policy and oversight of the financial sector through Rural Finance Services Program (RFSP)
• Department of Cooperatives in MTIC registers & supervises SACCOs
AMFIU and UCSC provide support to members as self regulating.
Forensic. Advisory. Fraud. www.summitcl.com
Regulatory framework…
• Tier 4 regulatory framework underway
• SACCOs to be classified
• Large ones to be under prudential regulations, e.g. under amended MDI Act
Clear definition of ‘large” or “small” SACCOs to be specified.
Forensic. Advisory. Fraud. www.summitcl.com
Regulatory framework…
Microfinance is a business for social impact and economic return. It supports the people at the bottom of the pyramid to change their lives in a sustainable way.
Risk is the probability that an investment‘s actual return will be different than expected
Forensic. Advisory. Fraud. www.summitcl.com
Regulatory framework…
“Microfinance is not about making a lot of profits or becoming a
bank. It is about expanding scale and capacity to extend very low cost microloans to as many poor people as possible and enabling
their enterprises to grow”, Mustapha B. Mugisa, 2013.
Forensic. Advisory. Fraud. www.summitcl.com
The need for regulation…
Case 3: Enter Promotion of Economic Transformation & Realization of sustainable Livelihood (PEARL) microfinance
• Started in July 2006
• Expanded rapidly
• Voluntarily closed in 2013.
Forensic. Advisory. Fraud. www.summitcl.com
The need for regulation…
• Lots of changes in the industry
• Both SACCO and non-SACCO institutions
• New dynamics e.g. money transfer, microcredits via mobile money and mobile savings = more complex!
(b) It is all about Good Governance.
Forensic. Advisory. Fraud. www.summitcl.com
Fact: risk management is not structured in many microfinances.
Forensic. Advisory. Fraud. www.summitcl.com
Status on ground…
• Best practices are just on paper
• There is the “Board”, “Auditors”, etc… but these are for cosmetic purposes
• Institutions want to just be ‘seen’ to be ok because they have the “Board.”
Forensic. Advisory. Fraud. www.summitcl.com
Status on ground…
• Risk management is not structured. Majority of staff don’t know their roles in risk management!
Forensic. Advisory. Fraud. www.summitcl.com
Status on ground…
• Generic risks exits e.g. “credit”, “liquidity”, “technology”, “governance.”
• Few people, if any, know how those risks are identified, assessed, managed and continuously reviewed
Forensic. Advisory. Fraud. www.summitcl.com
Status on ground…
• Although cases of SOMEDI, VBS and PEARL have shown fraud, IT & staff are big challenges, few institutions have recognized this. Why?
Forensic. Advisory. Fraud
“An average organization loses about 5% of its annual revenue to fraud”, ACFE Report to The Nations 2012.
Total annual revenue (all Uganda banks) in 2011
1.94/- Trillion
Ugx. 4 billion annually!
ACFE Uganda survey in 2011 revealed banks & telecoms lose 15-25% of annual revenue to fraud!
Average cost of fraud to each bank in Uganda
#1: Lots of fraud in the sector…
#2: Cyber threat & ICT security risks
Your Institution
Virus & Hacker Attack
Data Leakage & Network Abuse
Cyber Crime Combat
Quality Demand from Clients
35%
65%
For institutions 65% of security breaches are internal 35% of security breaches are external.
You need tools to ensure real time network monitoring?
Forensic. Advisory. Fraud. www.summitcl.com
#3: The people risks…
• Information theft
• About 2/3 leaving employees steal data
• Microfinance IT system frauds; e.g. salami techniques; loan write-offs, etc.
Forensic. Advisory. Fraud. www.summitcl.com
The way forward…
1. Perspective
2. Current status
a) Regulatory
b) Governance
3. Way forward
A low-end business woman with merchandise. Credit: Internet photo.
Forensic. Advisory. Fraud. www.summitcl.com
XY Microfinance RM model…
Case 4: XY Microfinance risk management model is good.
• Risk management is part of their business
• Process owners identify the risks and monitor them
• Eight questions are asked and answered
Forensic. Advisory. Fraud. www.summitcl.com
XY RM model… awareness
#1: Do the Board, management and staff all understand how the risk register is developed?
F ig u re 1 : R is k m a n a g e m e n t p ro c e s s a t X Y
1 . I d e n t ify
W h a t c o u ld g o w ro n g ?
2 . A s s e s s
H o w lik e ly is it to h a p p e n ?
W h o w o u ld c o m m it fra u d ?
W h a t w o u ld b e th e im p a c t
if it h a p p e n e d
3 . C o n tro l/ M it ig a te
W h a t sh o u ld b e d o n e to
re d u ce th e r is k ?
W h o o w n s th e r is k ?
W h a t m o re to d o a b o u t it?
4 . M o n ito r a n d
C o n t in u o u s R e v ie w
A re th e c o n tro ls e ffe c t iv e ?
H a s th e r is k c h a n g e d ?
X Y O b je c t iv e s /
K R A s
Forensic. Advisory. Fraud. www.summitcl.com
XY RM model… tone at the top
#2: Is the Board involved in risk management?
XY ensures a right tone at the top throughout the RM process.
Forensic. Advisory. Fraud. www.summitcl.com
XY RM …impact/likelihood
#3, for each identified event, are likelihood and impact clearly defined and assessed by process owners?
XY uses the likelihood and impact guide by the Institute of Risk Management (IRM), specifically follows the ISO 31000:2009 guidelines as in tables 2 & 3 below.
Forensic. Advisory. Fraud. www.summitcl.com
XY RM model…likelihood
R a t in g S c o re T h re a t O p p o r tu n ity
F re q u e n t 5 > 7 5 % ch a n ce o f o c cu rre n ce
Ve ry re g u la r o c cu rre n ce
Fa v o u ra b le a n d fre q u e n t o c cu rre n ce
lik e ly.
L ik e ly 4 > 5 0 % < 7 5 % ch a n ce o f o c cu rre n ce
C irc u m s ta n ce s fre q u e n t ly
e n co u n te re d
Fa v o u ra b le o u tc o m e is lik e ly to b e
a ch ie v e d in o n e y e a r.
M o re th a n 5 0 % ch a n ce o f o c cu rre n ce .
P o s s ib le 3 > 2 5 % < 5 0 % ch a n ce o f o c cu rre n ce
L ik e ly to h a p p e n a t s o m e p o in t in
th e n e x t 2 y e a rs .
C irc u m s ta n ce s o c c a s io n a lly
e n co u n te re d .
R e a so n a b le p ro sp e c ts o f fa v o u ra b le
re su lts in o n e y e a r.
2 5 % to 5 0 % ch a n ce o f o c cu rre n ce
U n lik e ly 2 > 5 % < 2 5 % ch a n ce o f
o c cu rre n ce
O n ly lik e ly to h a p p e n o n ce in 3
y e a rs .
C irc u m s ta n ce s ra re ly e n co u n te re d .
S o m e ch a n ce s o f fa v o u ra b le o u tc o m e
in th e m e d iu m te rm
5 % to 2 5 % ch a n ce o f o c cu rre n ce
R e m o te 1 L e s s th a n 5 % ch a n ce o f
o c cu rre n ce .
H a s n e v e r h a p p e n e d b e fo re
C irc u m s ta n ce s n e v e r e n co u n te re d .
L e s s th a n 5 % ch a n ce o f o c cu rre n ce .
Forensic. Advisory. Fraud. www.summitcl.com
XY RM model…impact
R a t in g D e f in it io n M o n e ta ry
Im p a c t
(U g x ’m )
C o n se q u e n ce Im p a c t o n
X Y ’s
o b je c t iv e s
R e p u ta t io n p e r
e v e n t
N o n c o m p lia n ce
5 Ve ry h ig h
( c a ta s tro p h ic )
> 5 0 L e a d s to
te rm in a t io n o f
p ro je c ts o r
w ith d ra w a l o f
f in a n c in g a n d is
u n d a m e n ta l to
s e rv ic e d e liv e ry
N o n
a ch ie v e m e n t
o f o b je c t iv e s ;
p e r fo rm a n ce
fa ilu re
M a x im u m h ig h
h e a d lin e
e x p o su re ; B o a rd
c e n su re ; lo s s o f
c re d ib ility
S e r io u s w ilfu l
b re a ch ; c r im in a l
n e g lig e n ce o r a c t;
p ro s e cu t io n ; B o a rd
c e n su re .
4 H ig h (C r it ic a l) > 1 0 < 5 0 E v e n t w h ic h m a y
h a v e a p ro lo n g e d
n e g a t iv e im p a c t
a n d e x te n s iv e
c o n se q u e n c e s
S ig n if ic a n t
d e la y s ;
p e r fo rm a n ce
s ig n if ic a n t ly
u n d e r ta rg e t
H e a d lin e p ro f ile ;
re p e a te d
e x p o su re ; B o a rd
in v o lv e m e n t;
re g u la to ry
e n q u iry
D e lib e ra te b re a ch o r
g ro s s n e g lig e n ce ;
fo rm a l in v e s t ig a t io n ;
d is c ip lin a ry a c t io n ;
B o a rd in v o lv e m e n t
3 M o d e ra te > 5 < 1 0 E v e n t w h ic h c a n
b e m a n a g e d , b u t
re q u ire s a d d it io n a l
re s o u rc e s a n d
m a n a g e m e n t
e ffo r t
M a te r ia l
d e la y s ,
m a rg in a l
u n d e r
a ch ie v e m e n t
o f ta rg e t
p e r fo rm a n ce
R e p e a te d n o n
h e a d lin e
e x p o su re ; s lo w
re so lu t io n ;
Pa r lia m e n ta ry
e n q u iry / b r ie f in g
N e g lig e n t b re a ch ;
la c k o f g o o d fa ith
e v id e n t; p e r fo rm a n ce
re v ie w in it ia te d
2 M in o r > 0 .5 < 5 E v e n t c a n b e
m a n a g e d u n d e r
n o rm a l o p e ra t in g
c o n d it io n s
In co n v e n ie n t
d e la y s
N o n -h e a d lin e
e x p o su re , c le a r
fa u lt s e tt le d
q u ic k ly ;
n e g lig ib le im p a c t
B re a ch ; o b je c t io n /
c o m p la in t lo d g e d ;
m in o r h a rm w ith
in v e s t ig a t io n
1 In s ig n if ic a n t < 0 .5 C o n se q u e n ce s c a n
e a s ily b e
a b so rb e d u n d e r
n o rm a l o p e ra t in g
c o n d it io n s
L it t le im p a c t N o n -h e a d lin e
e x p o su re , n o t a t
fa u lt , n o im p a c t
In n o ce n t p ro ce d u ra l
b re a ch ; e v id e n ce o f
g o o d fa ith ; l it t le
im p a c t
Forensic. Advisory. Fraud. www.summitcl.com
Impact x likelihood = risk…
X Y R is k in d e x = im p a c t x l ik e lih o o d
IM
PA
CT
5
4
3
2
1
5 1 0 1 5 2 0 2 5
4 8 1 2 1 6 2 0
3 6 9 1 2 1 5
2 4 6 8 1 0
1 2 3 4 5
1 2 3 4 5
L I K E L I H O O D
S co re R is k m a g n itu d e
2 0 - 2 5
M a x im u m
1 5 - 1 9 H ig h r is k
1 0 - 1 4 M e d iu m r is k
5 – 9 L o w r is k
1 - 4 M in im u m r is k
#4, Are risks identified and managed?
Figure 2: XY’s risk universe
Risk
Universe
Strategic
Financial
Compliance
Procurement
frauds
Fraud
Over
indebtedness Liquidity
Asset
misappropriation
Non Compliance
to statutory
requirements
Dynamic legal
regime / Non
compliance to
Best practices
Non
compliance
to internal
policies
‘Unclear’
Strategic
focus
Mission drift
Corporate
governance
Inadequate
Succession
planning
Ineffective
change
management
Poor
Client
management
Stakeholder risks;
concealment of
Malpractices
High staff
turnover
Gaps in
compliance
enforcement
Operational
XY’s risk universe www.summitcl.com. © 2013 All rights reserved.
Reputation Risk
Unclear
Performance
Indicators
Governance
constraints – low
Anti-fraud
funding
Fraud.
Compromise
of XY
Credit /
fieldStaff
Weak contract
Management
Information
Technology
Poor change
management
Poor IT security
practices
Weak
IT system
security High
System
downtime
Forensic. Advisory. Fraud. www.summitcl.com
XY’s risk control strategy…
F ig u re 3 : R is k Im p a c t/ L ik e lih o o d c o n tro l
1
5
L ik e lih o o d
P o s t
c o n tro l
P re c o n tro l
4
3
2
1
2
3
4
5
1
1
2
2
3
4
3
#
#
4
5
5
Im p a c t
XY’s strategy is to move risks from the red category to the Green one, on an on-going basis…
Forensic. Advisory. Fraud. www.summitcl.com
XY RM …risk reporting
#5, are risk reporting processes effective?
R o le Q u a r te r ly S e m i A n n u a l / A n n u a l
u ltim a te a c c o u n ta b il i ty a n d o v e rs ig h t
fo r b u s in e s s r is k a n d c o n tro ls .
re c e iv e a s s u ra n c e th a t r is k
m a n a g e m e n t is w ith in p o lic y.
R e c e iv e p e r io d ic re p o r ts f ro m A u d it
C o m m itte e a n d re v ie w a ll r is k s in re d
c a te g o ry.
A p p ro v e th e R is k M a n a g e m e n t
S tra te g y.
“ to p 1 0 ” r is k l is t .
s u m m a ry d a sh b o a rd .
p e n d in g l i t ig a tio n .
m a jo r in te rn a l a n d e x te rn a l e v e n ts .
a u d it a s s u ra n c e .
O v e rs e e s d e v e lo p m e n t ,
im p le m e n ta tio n a n d m a in te n a n c e o f
r is k m a n a g e m e n t a c ro s s th e A u th o r ity.
r is k p ro f ile .
s e lf a s s e s s m e n t .
lo s s e v e n t d a ta .
s tre s s te s tin g .
k e y r is k in d ic a to rs .
p e n d in g l i t ig a tio n .
To p 1 0 s tra te g ic r is k s .
To p r is k s o f th e d e p a r tm e n ts .
a u d it a s s u ra n c e .
e ffe c tiv e n e s s o f r is k m a n a g e m e n t.
c o s t / v a lu e o f r is k m a n a g e m e n t.
b e n c h m a rk in g r is k m a n a g e m e n t.
o w n r is k s .
d e s ig n a n d o w n c o n tro ls . .
ru n th e b u s in e s s
r is k p ro f ile .
s e lf a s s e s s m e n t .
lo s s e v e n t d a ta .
s tre s s te s tin g .
k e y r is k in d ic a to rs .
p e n d in g l i t ig a tio n .
B o a r d
A u d it /R is k
C o m m it te e
D e p a r tm e n t /
S e c t io n h e a d s
Forensic. Advisory. Fraud. www.summitcl.com
XY RM …risk appetite & KRIs
#6, has the board set and communicated risk appetite?
R is k c la s s B o a rd / S M T / m a n a g e m e n t le v e l a r t ic u la t io n o f r is k
a p p e t ite .
S tra te g ic 1 ) Z e ro to le ra n ce o f a c t iv it ie s n o t w ith in th e C o m p a n y ’s
b u s in e s s p la n a n d s tra te g ic o b je c t iv e s .
2 ) Ve ry L o w r is k a p p e t ite fo r re p u ta t io n a l r is k s
3 ) Z e ro to le ra n ce fo r d is c lo su re o f c o n f id e n t ia l o r c l a s s if ie d
in fo rm a t io n .
C o m p lia n c e 1 ) Z e ro to le ra n ce fo r n o n -c o m p lia n ce
F in a n c ia l 1 ) Z e ro to le ra n ce fo r fra u d u le n t / th e ft a c t iv ity b y a n y s ta ff,
c u s to m e r o r s ta k e h o ld e r
O p e ra t io n a l 2 ) L o w r is k a p p e t ite fo r in a d e q u a te ly t ra in e d ,
in e x p e r ie n ce d a n d u n sk ille d s ta ff.
3 ) L o w o p e ra t io n a l r is k a p p e t ite fo r a n y in te rn a l p ro c e s s
fa ilu re s .
Forensic. Advisory. Fraud. www.summitcl.com
XY RM …top 10 risks
#7, are top 10 risks identified and clearly monitored?
XY has operates a risk management software which provides a dashboard or a Risk Register for easy risk monitoring on-going.
Forensic. Advisory. Fraud. www.summitcl.com
XY RM …risk reporting
#8, Is the Risk Register up to date?
XY has operates a risk management software which provides a dashboard or a Risk Register for easy risk monitoring on-going.
Forensic. Advisory. Fraud. www.summitcl.com
Address ICT security…
Train all computer users in comprehensive ICT security
• 96% of your staff are not IT secure aware
• They are a weakest link
Forensic. Advisory. Fraud. www.summitcl.com
Focus on fraud management…
SCL fraud prevention toolkit
i. Fraud risk management strategy –e.g. PAPEMO toolkit & on-going awareness training to all staff
ii. Effective whistleblowing solution
Microfinance fraud prevention
Toolkit
Forensic. Advisory. Fraud. www.summitcl.com
Call to Donors & Government
• Donors must become business partners; provide support beyond enabling outreach and focus on on-site capacity building
• Government must fast track the law for regulating Microfinance Institutions
• GoU should take advantage of existing institutions like AMFIU and UCSU
Forensic. Advisory. Fraud. www.summitcl.com
Our values for your success!
We take pride in doing the right thing, rather than what is right for the profitability of SCL. For more info, visit: www.summitcl.com www.mustaphamugisa.com
m: 0712 984 585.
Thank you!