Monitoring and control of credit risk in the risk-oriented bank management system

The article examines monitoring and control of credit risk within the risk-oriented management framework of banking activities. The institutional framework is based on the COSO model (updated in 2017) and three lines of defense: business units provide initial identification and operational monitoring (first line), risk management and compliance units provide independent oversight through key risk indicators (KRI) and limits (second line), and internal audit provides effectiveness validation (third line). Credit risk management is divided into a strategic process of risk profile formation based on monitoring (continuous observation of portfolio quality, borrowers, early warning signals) and control (compliance with procedures, limits, corrective actions). Key tools include traffic-light systems for borrower risk profiling, stop-loss limits on product parameters, and escalation protocols triggered by limit breaches, with remediation plans required within 14 – 21 days for supervisory board review. These integrate with the bank's Risk Appetite Framework (RAF)/Risk Appetite Statement (RAS), as mandated by NBU Regulation No. 64, defining risk appetite as aggregate risks acceptable for strategic goals. A hierarchical monitoring model aligns RAF levels–risk capacity (capital/liquidity buffers against aggregate ECL), risk appetite (KPI/KRI thresholds for portfolios), risk tolerance (segment limits, zero tolerance for prohibited activities), risk profile (dynamic risk-return balance), and limits (hard/soft thresholds with triggers) – to specific monitoring objects, tools, and decisions like portfolio restructuring or capitalization. This structure ensures strategic coherence, transforming high-level appetite into operational controls under macroeconomic uncertainty, war risks, and Ukraine's financial transformations. Results propose this integrated model, enhancing real-time risk detection and response to prevent portfolio deterioration. Applicable to Ukrainian banks for RAF implementation, it supports NBU compliance, capital adequacy, and stability amid volatility. Conclusions emphasize monitoring and control as indispensable for risk management efficacy, bridging theoretical frameworks with practical tools to minimize losses and align operations with strategic objectives.