Interest rate risk (IRR) is the risk that changes in interest rates reduce an institution’s earnings or the economic value of its balance sheet; it applies to any entity with rate-sensitive assets or liabilities. Interest rate risk in the banking book (IRRBB) is the supervisory category the Basel Committee defined for the interest rate risk of a bank’s non-trading positions (loans, deposits, securities held for the long term, and the hedges against them), with prescribed shock scenarios, two measures (economic value of equity and net interest income), an outlier test and disclosure requirements. Structural interest rate risk (SIRR, also written SIR) is the asset-liability management term for the mismatch embedded in the balance sheet itself: fixed-rate mortgages funded by deposits with no contractual maturity, equity and non-interest-bearing deposits that fund rate-sensitive assets. In a bank, SIRR and IRRBB usually describe the same exposure, the first from the manager’s seat and the second from the supervisor’s. The distinctions matter because the terms carry different measurement conventions, different rulebooks and different owners, and an audit program that confuses them tests the wrong thing.
This guide gives the three definitions and where each is used; the four sources of interest rate risk and the banking book boundary; the Basel Committee’s 2016 IRRBB standard in detail (principles, scenarios, measures, outlier test, standardised framework, disclosure); how Europe and the United States implement it, with the Silicon Valley Bank failure as the modern case; what structural interest rate risk adds, including structural hedging; the measures and the behavioral assumptions that drive them; the audit program; and a worked example from Lakeshore Bancorp, the $9 billion regional bank used in examples across this site. The EVE vs NII guide covers the two measures in depth, the deposit beta modeling guide the assumption that drives both, and the interest rate risk vs ALM guide the committee that owns them.
In this guide
- The three terms side by side
- The four sources of interest rate risk and the banking book boundary
- IRRBB: the Basel Committee’s 2016 standard
- EVE, NII and the conventions behind them
- The standardised framework and the deposit caps
- IRRBB in Europe: the EBA guidelines and the outlier tests
- IRRBB in the United States and the lesson of Silicon Valley Bank
- Structural interest rate risk: what the term adds
- The assumptions that drive every measure
- A working vocabulary
- Internal audit’s program
- A worked example: Lakeshore Bancorp’s EVE finding
- Questions about IRR, IRRBB and SIRR
- Related guides
The three terms side by side
The terms are nested rather than competing. Interest rate risk is the phenomenon, and it exists in a corporate treasury with floating-rate debt, in an insurer with long liabilities, in a pension fund and in a bank’s trading desk as much as in its loan book. IRRBB is the part of a bank’s interest rate risk that sits in the banking book, defined and governed by the Basel Committee’s standards and the national rules that implement them; the trading book’s interest rate risk is governed instead by the market risk capital framework. Structural interest rate risk is the part of IRRBB (or of a corporate’s interest rate risk) that arises from the shape of the balance sheet rather than from a position taken to profit from a rate view: the mismatch a bank has because it lends long and borrows short, because its depositors do not demand market rates, and because its equity costs nothing in interest terms. The table gives the distinctions that matter in practice.
| Dimension | IRR | IRRBB | SIRR |
|---|---|---|---|
| What it names | The risk that rate changes reduce earnings or economic value | The interest rate risk of a bank’s non-trading positions, as a supervisory category | The mismatch embedded in the balance sheet’s structure, as a management concept |
| Who uses the term | Everyone: banks, corporates, insurers, investors, auditors | Bank supervisors, bank risk and finance functions, external assessors | Asset-liability managers and treasurers; many European and Latin American banks and some supervisors |
| Rulebook | None in general; accounting standards for hedges; sector rules where regulated | Basel Committee IRRBB standards (2016); EBA guidelines and EU technical standards; US interagency guidance | No separate rulebook; captured inside IRRBB measurement for banks |
| Measures | Any: gap, duration, sensitivity, earnings at risk | Change in economic value of equity (ΔEVE) and in net interest income (ΔNII) under prescribed shocks | Repricing and duration gaps of the structural position; EVE; the hedge ratio of equity and core deposits |
| Horizon | Depends on the user | EVE: full run-off of the balance sheet; NII: 12 months in the Basel standard, often one to three years internally | Multi-year; the life of the structural position |
| Typical owner | Treasurer or CFO | ALCO; treasury as first line; risk management as second line; internal audit as third | ALCO and treasury |
| Example | A manufacturer’s floating-rate term loan when rates rise | A bank’s +200 basis point EVE result against its board limit | Fixed-rate mortgages funded by checking accounts; the structural hedge of equity |
The four sources of interest rate risk and the banking book boundary
The Basel Committee’s 2004 principles named four sources of interest rate risk, and the 2016 standard regrouped them into three. Repricing (gap) risk arises from differences in the timing of rate changes on assets, liabilities and off-balance-sheet positions: a five-year fixed-rate loan funded by a deposit that reprices monthly. Yield curve risk arises when the curve changes shape rather than level, so that a position hedged against a parallel shift loses when the curve steepens or flattens; the 2016 standard folds it into gap risk by prescribing non-parallel scenarios. Basis risk arises when assets and liabilities reprice off different reference rates that do not move together: prime-based loans funded by deposits priced off the federal funds rate, or a SOFR asset hedged with a swap on another index. Option risk arises from the rights embedded in products: the borrower’s right to prepay a fixed-rate mortgage when rates fall, the depositor’s right to withdraw a non-maturity deposit at any time, caps and floors on adjustable-rate loans. The 2016 standard splits option risk into automatic options, whose exercise is driven by the rate alone, and behavioral options, whose exercise depends on customer behavior and must be modeled.
The banking book is defined by exclusion: positions not in the trading book. The trading book holds instruments held for short-term resale, to profit from price movements, to lock in arbitrage profits or to hedge other trading positions; it is marked to market daily and attracts market risk capital, under the Fundamental Review of the Trading Book since its 2019 finalization. Everything else is banking book: loans, deposits, securities held to maturity or available for sale, funding, and the derivatives that hedge them. The boundary matters because the same interest rate exposure is capitalized under Pillar 1 in the trading book and managed under Pillar 2 in the banking book, and because the available-for-sale securities that destroyed Silicon Valley Bank’s equity were banking book positions whose losses did not flow through regulatory capital. The market risk and value at risk guides cover the trading side; this guide stays in the banking book.
IRRBB: the Basel Committee’s 2016 standard
The Basel Committee published Principles for the management and supervision of interest rate risk in July 2004, with fifteen principles and a supervisory outlier test that flagged banks whose economic value fell by more than 20 percent of Tier 1 plus Tier 2 capital under a standardised 200 basis point shock. After the crisis, and after a 2015 consultation that proposed and then abandoned a Pillar 1 capital charge, the Committee published Interest rate risk in the banking book in April 2016, with implementation expected by 2018. The standard, now chapter SRP31 of the consolidated Basel Framework, keeps IRRBB in Pillar 2 but tightens everything around it: twelve principles (nine for banks, covering governance, risk appetite, measurement, assumptions, systems, reporting, disclosure and capital assessment, and three for supervisors, covering information collection, assessment and the outlier test), six prescribed interest rate shock scenarios, a stricter outlier test, a standardised framework that supervisors may impose, and a public disclosure template. The table summarizes what changed.
| Element | 2004 principles | 2016 standard |
|---|---|---|
| Principles | 15 | 12 (9 for banks, 3 for supervisors) |
| Shock scenarios | A standardised 200 basis point parallel shock for the outlier test | Six prescribed scenarios: parallel up, parallel down, steepener, flattener, short rates up, short rates down, with currency-specific shock sizes |
| Outlier test | ΔEVE greater than 20 percent of Tier 1 plus Tier 2 capital | Maximum ΔEVE across the six scenarios greater than 15 percent of Tier 1 capital; supervisors may add tests at least as stringent |
| Measures | Economic value and earnings, at the bank’s discretion | Both ΔEVE and ΔNII required, with defined conventions |
| Standardised framework | None | A full standardised EVE calculation with 19 time buckets and caps on deposit assumptions, which supervisors may require |
| Disclosure | Qualitative | Table A (qualitative) and Table B (ΔEVE under all six scenarios and ΔNII under the two parallel shocks, with Tier 1 capital) |
| Credit spread risk in the banking book | Not addressed | To be monitored and assessed |
| Capital | Pillar 2 | Pillar 2, with an explicit requirement that banks assess IRRBB capital in the ICAAP |
The six scenarios are built from three shock sizes per currency: a parallel shock, a short-rate shock and a long-rate shock, derived from historical rate series and published in the standard. The original 2016 calibration set the US dollar at 200 basis points parallel, 300 short and 150 long, and the euro at 200, 250 and 100. The Committee recalibrated the shocks in July 2024 using rate data from January 2000 to December 2023, effective 1 January 2026: the dollar is now 200, 300 and 225 and the euro 225, 350 and 200. The steepener combines a short-rate fall with a long-rate rise, the flattener the reverse, and the short shocks move the front of the curve with a decaying effect along the maturities. A bank’s maximum loss across the six is its IRRBB exposure for the outlier test, and the scenario that produces it tells the supervisor where the bank’s mismatch lies: a flattener loss points at a bank funding long assets with short liabilities in a way that parallel shocks understate.
EVE, NII and the conventions behind them
The two measures answer different questions, and the Basel standard fixes the conventions that make them comparable. Economic value of equity is the present value of all banking book asset cash flows less the present value of all liability cash flows, excluding equity itself; ΔEVE is the change in that value under a shock. The standard requires a run-off balance sheet (positions amortize and are not replaced), the exclusion of the bank’s own equity from the liabilities and its commercial margins from the cash flows where the bank’s methodology allows, and discounting at a risk-free curve. EVE is a long-horizon measure of the value at risk in the balance sheet as it stands, and it is what the outlier test uses. Net interest income sensitivity is the change in interest income less interest expense over a horizon, 12 months in the standard, under a constant balance sheet (maturing positions are replaced with like positions at the new rates). NII is a short-horizon earnings measure that captures repricing in the period and little else. The two routinely disagree, which is the subject of the EVE vs NII guide: a bank with long fixed-rate assets funded by short deposits sees NII rise and EVE fall when rates rise, because the deposits reprice up (helping neither) while the assets’ value falls. A board that reads only NII will believe rising rates help it until the securities portfolio is marked, which is the Silicon Valley Bank story told below.
| Convention | ΔEVE | ΔNII |
|---|---|---|
| Question answered | How much economic value does the balance sheet lose if rates move today? | How much does next year’s interest margin change if rates move today? |
| Balance sheet | Run-off: positions amortize and are not replaced | Constant: maturing positions are replaced at new rates |
| Horizon | Full life of all positions | 12 months (Basel); one to three years internally |
| Equity | Excluded from liabilities, so that EVE measures the value of the assets funding equity | Not applicable |
| Commercial margins | May be excluded (discount at risk-free rates) | Included: NII is the margin |
| Most sensitive assumption | Behavioral maturity of non-maturity deposits; prepayment speeds | Deposit betas and lags; new business pricing |
| Regulatory use | Outlier test (15 percent of Tier 1); disclosure under all six scenarios | Disclosure under the parallel shocks; EU NII outlier test (5 percent of Tier 1) |
| Direction for a typical retail bank when rates rise | Falls | Rises, then falls as betas catch up |
The standardised framework and the deposit caps
The standardised framework is the Committee’s fallback: supervisors may require a bank to use it where its internal measurement system is inadequate, and banks may adopt it voluntarily. It slots notional repricing cash flows into 19 time buckets from overnight to beyond twenty years, applies the six shock scenarios to a risk-free curve per currency, and computes ΔEVE with prescribed treatments for the positions whose timing is not contractual. Non-maturity deposits are separated into a core portion, which is assumed stable and slotted out along the buckets, and a non-core portion placed in the overnight bucket, and the standard caps both the proportion that may be treated as core and the average maturity it may be given. Fixed-rate loans subject to prepayment and term deposits subject to early redemption receive baseline rates that scale up or down under each scenario (prepayments accelerate when rates fall; early redemptions rise when rates rise). Automatic options are revalued directly. The deposit caps are the framework’s most-cited numbers, because they are also the benchmark supervisors use to judge a bank’s internal assumptions even where the bank is not on the standardised framework.
| Non-maturity deposit category | Cap on proportion treated as core | Cap on average maturity of core deposits | What falls in the category |
|---|---|---|---|
| Retail, transactional | 90 percent | 5 years | Retail accounts used for regular transactions (salaries paid in, bills paid out), including non-interest-bearing checking |
| Retail, non-transactional | 70 percent | 4.5 years | Retail savings and similar accounts not used for transactions |
| Wholesale | 50 percent | 4 years | Deposits of corporates and other non-retail customers without contractual maturity; financial-institution deposits are treated as non-core |
A bank running internal models may assume longer lives where its data support them, but it will be asked why, and the deposit beta guide shows what happens when the data used (a decade of near-zero rates) do not resemble the cycle being modeled. The European Banking Authority’s 2024 heatmap work made the five-year cap on the weighted average repricing maturity of non-maturity deposits a standing supervisory focus for exactly that reason.
IRRBB in Europe: the EBA guidelines and the outlier tests
The European Union transposed the Basel standard through the fifth Capital Requirements Directive, which mandated the European Banking Authority to write guidelines and technical standards. The EBA published its package in October 2022: Guidelines on the management of interest rate risk and credit spread risk arising from non-trading book activities (EBA/GL/2022/14), applicable from 30 June 2023 with the credit spread provisions from 31 December 2023, which replaced its 2018 guidelines and set expectations for governance, measurement, assumptions, hedging, stress testing and, for the first time in detail, credit spread risk in the banking book; draft regulatory technical standards on the supervisory outlier tests; and draft technical standards on a standardised approach, including a simplified version for smaller institutions. The European Commission adopted the outlier test standards as Delegated Regulation (EU) 2024/856 and the standardised approach as Delegated Regulation (EU) 2024/857, both published in the Official Journal on 24 April 2024. The outlier tests are two: a decline in EVE of more than 15 percent of Tier 1 capital under any of the six Basel scenarios, and a decline in NII of more than 5 percent of Tier 1 capital under the two parallel scenarios over one year; the EBA had proposed 2.5 percent for the NII test and the Commission raised it. Breaching either test obliges the supervisor to consider measures, from requiring assumption changes to additional capital, under the supervisory review and evaluation process. Banks also disclose ΔEVE and ΔNII under the Pillar 3 template, and the European Central Bank has made IRRBB and credit spread risk a supervisory priority since the 2022 rate turn, with targeted reviews of the largest banks’ assumptions and hedging.
IRRBB in the United States and the lesson of Silicon Valley Bank
The United States has not adopted the Basel IRRBB disclosure template, standardised framework or outlier test as rules. It supervises interest rate risk through examination: the 1996 Joint Agency Policy Statement on Interest Rate Risk, which accompanied the addition of the Sensitivity to Market Risk component to the CAMELS rating in 1997, and the January 2010 Interagency Advisory on Interest Rate Risk Management (with questions and answers in 2012), which the Federal Reserve, OCC, FDIC, NCUA and state supervisors issued as rates sat near zero and the risk of the eventual rise was being underpriced. The advisory expects a board-approved policy and limits, measurement of both earnings and economic value, scenarios that go beyond industry convention (shocks of at least plus and minus 300 and 400 basis points, non-parallel shifts and changes in the relationship between rates), documented and periodically reviewed assumptions with sensitivity testing of the key ones (deposit behavior, prepayments), independent review and validation of models, and stress testing integrated with capital and liquidity planning. The OCC’s Comptroller’s Handbook booklet on interest rate risk and the examination manuals carry the detail, examiners rate the result in the Sensitivity component, and deficiencies become matters requiring attention (the MRA guide covers what follows). Larger firms meet IRRBB again inside capital planning and the stress tests. Nothing in the framework is weak on paper; the Silicon Valley Bank failure of March 2023 showed what happens when it is not enforced.
| What happened at Silicon Valley Bank | Which concept it illustrates |
|---|---|
| Deposits tripled during 2020 and 2021 and were invested in long-duration agency mortgage-backed securities and Treasuries, mostly classified as held to maturity; by year-end 2022 the held-to-maturity portfolio carried about $15 billion of unrealized losses against roughly $16 billion of equity | Structural interest rate risk: long fixed-rate assets funded by uninsured, rate-sensitive, concentrated deposits, with no hedging of the structural position |
| The firm breached its own long-term interest rate risk limits on and off from 2017, according to the Federal Reserve’s April 2023 review | IRRBB measurement working as designed: the EVE-type limits said what was wrong |
| In April 2022 management changed its deposit-duration modeling assumptions to cure a limit breach rather than reduce the risk, and during 2022 removed interest rate hedges that would have protected against rising rates | Assumption governance: the single most common way a limit breach disappears without the risk disappearing |
| Supervisors raised interest rate risk deficiencies in the 2020, 2021 and 2022 examinations as advisories and observations, not findings; a November 2022 letter stated the firm’s interest rate risk simulations were not reliable and an MRA followed, but the Sensitivity rating remained Satisfactory until the firm failed | Supervision through the CAMELS Sensitivity component depends on escalation |
| On 8 March 2023 the firm sold $21 billion of available-for-sale securities at a $1.8 billion after-tax loss and announced a capital raise; the next day depositors withdrew about $42 billion | The interaction of interest rate risk with liquidity risk: the unrealized loss became a realized one the moment funding left |
The failure changed supervisory attention more than the rules. Examiners now ask for the held-to-maturity portfolio’s fair value against capital in every exam, for the assumption change log, for the hedging rationale, and for evidence that a limit breach was escalated rather than modeled away. The liquidity risk guide tells the funding side of the same story, the bank runs guide the history it joined, and the internal audit in banking guide what the supervisory cascade means for a function.
Structural interest rate risk: what the term adds
Structural interest rate risk is the oldest of the three ideas and the least codified. It describes the interest rate position a bank has not because it chose one but because of what a bank is: it holds assets with longer or fixed repricing (mortgages, term loans, securities) funded by liabilities whose repricing is contractual in form but behavioral in fact (non-maturity deposits) or absent altogether (equity and non-interest-bearing deposits). Asset-liability managers call this the structural position, and the decisions about it are strategic rather than tactical: how much of the mismatch to keep because it earns the margin that a bank exists to earn, how much to hedge, and how to model the liabilities whose behavior determines the answer. Two practices make the term concrete. The structural hedge (a term used by UK and European banks in particular) is a program of receive-fixed swaps, or a ladder of fixed-rate securities, that gives equity and non-interest-bearing deposits a notional maturity profile, typically rolling over three to five years, so that the margin earned on them is smoothed across the rate cycle rather than swinging with the overnight rate; banks disclose the hedge’s size and yield because it drives several years of earnings. The replicating portfolio is the modeling counterpart: non-maturity deposits are represented as a portfolio of fixed-rate instruments with a maturity ladder chosen so that its yield tracks the deposit rate the bank actually pays, which converts a behavioral liability into cash flows the EVE calculation can use. Both practices are where the structural view and the regulatory view meet: the structural hedge’s tenor and the replicating portfolio’s ladder are the same assumptions the IRRBB standard caps.
| Question | The IRRBB answer | The SIRR answer |
|---|---|---|
| What is the exposure? | ΔEVE and ΔNII under six prescribed shocks, against the outlier thresholds and board limits | The repricing and duration mismatch of the structural position, and the share of it hedged |
| What is the horizon? | Run-off for EVE; 12 months for NII | The multi-year life of the position; the tenor of the structural hedge |
| What is a good result? | Inside limits with assumptions the supervisor accepts | A margin that is stable across the cycle at a mismatch the board has chosen |
| What is hedged? | Whatever brings the measures inside limits | Equity and core deposits, to a target profile; sometimes the mortgage pipeline |
| Who sets the assumptions? | Treasury or risk, validated by model risk management, capped by the standard | Treasury, from the bank’s own deposit and prepayment studies |
| What does the board see? | A limits dashboard | The structural hedge’s size, tenor and yield; the NII path under rate paths |
| What does the auditor test? | Measurement completeness, scenario application, limit monitoring, disclosure | Assumption governance, hedge strategy approval and effectiveness, consistency between the structural view and the regulatory measures |
Outside banking, the structural idea is the useful one. A corporate has no banking book and no IRRBB, but it has structural interest rate risk if its debt is floating and its revenues are not, or if its pension liabilities are long and its assets short; the how to audit treasury guide covers the corporate program, including hedge accounting, and the corporate liquidity risk guide the funding side.
The assumptions that drive every measure
Interest rate risk measurement is a model, and three behavioral assumptions decide most of what it reports. Non-maturity deposit behavior has two parts: how balances decay over time (the behavioral maturity or average life that EVE depends on) and how the rate paid on them follows market rates (the deposit beta, with its lags and asymmetry, that NII depends on). Both are estimated from the bank’s own history, and the 2022 to 2024 tightening showed how a history dominated by a decade of near-zero rates can mislead: betas rose faster than modeled, balances migrated from checking to money market accounts and time deposits, and banks that had lengthened deposit lives on the old data found their EVE results flattering. Prepayment behavior on fixed-rate loans and mortgage-backed securities shortens assets when rates fall and lengthens them when rates rise (extension risk), so the asset side of the gap moves against the bank in both directions. New business and pricing assumptions drive NII under a constant balance sheet: what replaces maturing loans, at what spread, and how fast deposit pricing responds. The audit interest in all three is the same: who sets the assumption, from what data, who reviewed it independently, what changed in the period and what the change did to the results. A change that moves a measure from outside a limit to inside it is the first thing to look for, and the model risk management guide gives the test steps.
A working vocabulary
| Term | Meaning | Where it belongs |
|---|---|---|
| ALM, ALCO | Asset-liability management; the asset-liability committee that owns interest rate and liquidity risk decisions | Governance of IRR, IRRBB and SIRR |
| Repricing gap | Rate-sensitive assets less rate-sensitive liabilities per time bucket | The oldest IRR measure; a SIRR view when applied to the structural position |
| Duration gap | The difference between the duration of assets and of liabilities, weighted by size; the sensitivity of equity’s value to a small parallel rate change | Bridge between gap reports and EVE |
| EVE, ΔEVE | Economic value of equity and its change under a shock | IRRBB long-horizon measure; outlier test |
| NII, ΔNII; earnings at risk | Net interest income and its change under a shock; the broader earnings version includes fee and other income | IRRBB short-horizon measure |
| Non-maturity deposit (NMD) | A deposit with no contractual maturity that the depositor may withdraw at any time | The assumption at the center of IRRBB and SIRR |
| Core deposits; behavioral maturity | The stable portion of NMDs and the maturity profile assigned to it | Capped in the standardised framework (90/70/50 percent; 5/4.5/4 years) |
| Deposit beta | The change in the deposit rate divided by the change in the market rate | NII’s key assumption |
| Structural hedge; replicating portfolio | The swap or securities program that gives equity and NMDs a maturity profile; the modeling of NMDs as a ladder of fixed-rate instruments | SIRR practice; IRRBB assumption |
| Supervisory outlier test (SOT) | A threshold on ΔEVE (15 percent of Tier 1) or ΔNII (5 percent of Tier 1 in the EU) that triggers supervisory attention | IRRBB |
| CSRBB | Credit spread risk in the banking book: the change in value of banking book instruments from spread moves not explained by rates or credit quality | Monitored under IRRBB; detailed in the EBA guidelines |
| Banking book vs trading book | Non-trading positions versus positions held for short-term resale or trading intent | The boundary between IRRBB (Pillar 2) and market risk capital (Pillar 1) |
| Sensitivity to market risk (the S in CAMELS) | The US examination rating component that covers interest rate risk | US supervision of IRRBB |
Internal audit’s program
Interest rate risk management is a first- and second-line activity; internal audit’s job is to confirm that the framework the board approved exists in practice, that the measures are complete and reliable, that the assumptions are governed, that limits mean something, and that what the board and the supervisor are told is true. The program below is the one the how to audit interest rate risk guide gives in detail, condensed to the areas that distinguish the three concepts; the systems and tools guide covers the ALM platforms the work runs on, and the bank audit universe guide shows where the entity sits among a bank’s auditable units and why it is rated high.
| Area | What the auditor tests | Evidence | Concept |
|---|---|---|---|
| Governance and appetite | Board-approved policy defines the measures, scenarios, limits and escalation; ALCO charter and minutes show decisions, not just presentations; limits trace to the risk appetite statement | Policy, ALCO minutes, appetite statement, limit framework | All three |
| Measurement completeness | All banking book positions, in all currencies, including off-balance-sheet commitments and hedges, reach the model; reconciliation of model balances to the general ledger | Position reconciliations, data lineage, exception reports | IRRBB |
| Scenarios | The six Basel scenarios (or the supervisor’s equivalents) plus internal scenarios are run on the required frequency; shock sizes current; the scenario producing the maximum loss is identified and explained | Scenario library, model runs, ALCO package | IRRBB |
| Assumptions | Deposit behavior, betas, prepayments and new business assumptions are documented, estimated on data that resemble the environment, independently reviewed, back-tested against outcomes and changed only through governance; sensitivity of results to each key assumption is reported | Assumption inventory and change log, deposit and prepayment studies, back-tests, validation reports | SIRR and IRRBB |
| Model risk | The ALM model is in the inventory, tiered, validated on schedule, with findings tracked; vendor model limitations are understood | Model inventory, validation reports, issue log | IRRBB |
| Limits and breaches | Results are compared with limits each period; breaches are escalated to the committee the policy names, with action, not re-modeled away; limit changes are approved at the right level with rationale | Limit reports, breach log, committee minutes | IRRBB and SIRR |
| Hedging | The structural hedge or other hedging strategy is approved, within mandate, effective against its stated objective and accounted for correctly; hedge removal decisions are documented and escalated | Hedge strategy paper, swap confirmations, effectiveness testing, hedge accounting documentation | SIRR |
| Reporting and disclosure | Board and ALCO reports are accurate, timely and show the trend and the assumptions; regulatory reports and Pillar 3 disclosures reconcile to the model | Board packs, regulatory submissions, disclosure reconciliations | IRRBB |
| Integration | Interest rate risk is linked to liquidity stress testing, capital planning and the ICAAP or capital plan; securities portfolio fair value is monitored against capital | Stress test documentation, capital plan, portfolio fair value reports | All three |
Two tests earn their time out of proportion to their cost. The first is to re-run the current results under the assumptions in force a year earlier and explain the difference, which separates risk that changed from modeling that changed. The second is to read the assumption change log and ask who reviewed each line, which is how the Lakeshore finding below was made. The Fed interest rate decisions guide explains why timing the audit to the rate cycle matters, and the risk appetite, tolerance and limits guide gives the structure the limits should sit in.
A worked example: Lakeshore Bancorp’s EVE finding
Lakeshore Bancorp, the $9 billion publicly traded regional bank holding company with 60 branches used in examples across this site, has the classic structural position: a book of fixed-rate residential mortgages and a securities portfolio, alongside floating-rate commercial loans, funded by about $7.5 billion of retail and commercial deposits, a quarter of them non-interest-bearing. It sits below the asset thresholds that would bring it into the US tailoring framework’s liquidity and capital rules, so its interest rate risk is supervised by the OCC under the 2010 interagency advisory and rated in the CAMELS Sensitivity component. Its ALCO package reports NII sensitivity over twelve months and EVE sensitivity under parallel shocks of plus and minus 100, 200 and 300 basis points against board limits, which is IRRBB measurement in everything but name; its structural view is the mortgage and securities duration against the behavioral life of the deposits. Internal audit’s 2026 audit of interest rate risk management, a high-rated entity in its 126-entity universe, started from the June 2026 package.
| Scenario | 12-month ΔNII | NII limit | ΔEVE | EVE limit |
|---|---|---|---|---|
| Plus 300 basis points | +4.2 percent | −15 percent | −17.9 percent | −25 percent |
| Plus 200 basis points | +3.1 percent | −10 percent | −11.6 percent | −15 percent |
| Plus 100 basis points | +1.7 percent | −5 percent | −5.4 percent | −10 percent |
| Minus 100 basis points | −2.6 percent | −5 percent | +3.9 percent | −10 percent |
| Minus 200 basis points | −5.8 percent | −10 percent | +6.2 percent | −15 percent |
Every result sat inside its limit, and the divergence between the two measures was textbook: NII rose in up-rate scenarios because the commercial loans reprice faster than the deposits, and EVE fell because the mortgages and securities lose value. The audit’s assumption test told a different story. In the fourth quarter of 2025 the ALM team had extended the assumed average life of the interest checking and savings balances, about $2.2 billion, from 4.1 years to 6.8 years on the basis of a new deposit study, presented to ALCO and approved on treasury’s recommendation without independent review by the four-person model risk management function. Internal audit re-ran the June results with the model team under the prior assumption: ΔEVE at plus 200 basis points would have been −16.2 percent against the −15 percent limit, and at plus 300 −24.3 percent, just inside its limit; NII barely moved, because the assumption drives EVE and not NII. The deposit study had measured balance retention from 2015 to 2021, a period of near-zero rates and steady growth, and excluded the 2022 to 2024 cycle in which the bank’s own interest checking balances fell by 9 percent; the beta model, estimated on that very cycle, treated the same depositors as rate-aware. The High finding on assumption governance went to the audit committee with the re-run figures. The committee required an independent model risk review, which supported an average life of 5.3 years and a plus-200 ΔEVE of −14.1 percent, inside the limit but by less than the board had been told, and a standard requiring independent review of material assumption changes followed. When the OCC’s examination arrived four months later, the examiners issued a matter requiring attention on the same facts, and the chief audit executive’s observation to the committee was that the finding had cost about six hours of reading the assumption log and asking who had reviewed each line.
The example shows the three terms doing their work. The structural position (long mortgages and securities, behavioral deposits) was the SIRR; the EVE and NII package against board limits was the IRRBB measurement, under US supervision rather than the Basel template; and the deposit life assumption was the point where the structural view (how long do these deposits really stay?) became the regulatory number (is the bank inside its limit?). The EVE vs NII and deposit beta guides carry the technical detail of the same engagement, and the risk appetite statements guide the limit framework the results were read against.
Questions about IRR, IRRBB and SIRR
What is the difference between IRR and IRRBB?
IRR is interest rate risk in general, wherever it arises. IRRBB is the interest rate risk of a bank’s banking book (its non-trading positions) as defined by the Basel Committee’s 2016 standard, with prescribed scenarios, EVE and NII measures, an outlier test and disclosure requirements. Trading book interest rate risk is governed separately under market risk capital rules.
What is structural interest rate risk (SIRR)?
The interest rate mismatch embedded in a balance sheet’s structure rather than taken as a position: long or fixed-rate assets funded by non-maturity deposits and equity. It is an asset-liability management concept; in banks it is measured inside the IRRBB framework and managed through structural hedging and the modeling of deposit behavior.
What are the six IRRBB shock scenarios?
Parallel up, parallel down, steepener (short rates down, long rates up), flattener (short rates up, long rates down), short rates up and short rates down, with shock sizes set per currency; the US dollar shocks are 200 basis points parallel, 300 short and 225 long after the recalibration effective 1 January 2026.
What is the IRRBB outlier test?
A supervisory threshold: a bank whose maximum decline in economic value of equity across the six scenarios exceeds 15 percent of Tier 1 capital is an outlier and can expect supervisory measures. The European Union adds a second test on net interest income at 5 percent of Tier 1 capital under the parallel shocks.
Does the United States apply the Basel IRRBB standard?
Not as a rule. US agencies supervise interest rate risk through the 2010 interagency advisory, examinations and the CAMELS Sensitivity component, expecting both earnings and economic value measures, severe scenarios and governed assumptions, and they have not adopted the disclosure template or the outlier test. Silicon Valley Bank’s failure showed the consequences of weak escalation under that approach.
What should internal audit focus on in an interest rate risk audit?
Assumption governance first: who set the deposit, beta and prepayment assumptions, from what data, who reviewed them, what changed in the period and what the change did to the results. Then measurement completeness, scenario application, limit monitoring and breach escalation, hedge governance, and the accuracy of what the board and supervisor are told.
Related guides
- EVE vs NII — the two measures and why they disagree.
- Deposit beta modeling — the assumption behind both measures.
- Interest rate risk vs ALM — the committee and the discipline.
- Interest rate risk: a comprehensive overview — the foundations.
- How to audit interest rate risk in banks — the full audit program.
- Interest rate risk systems and tools — the ALM platforms the work runs on.
- Liquidity risk — the funding side of the Silicon Valley Bank story.
- Liquidity stress testing — the complementary stress program.
- Market risk — the trading book side of the boundary.
- Value at risk — the trading book measure.
- How to audit model risk management — where the ALM model lives.
- SR 11-7 and SR 26-2 explained — the model risk guidance.
- Internal audit in banking — the supervisory context.
- A bank audit universe worked example — where interest rate risk sits among 126 entities.
- MRAs, MRIAs and consent orders — what an interest rate risk finding becomes.
- How to audit treasury — the corporate program, including hedge accounting.
- OCC risk categories — interest rate risk among the eight risk stripes.
- The Risk Library — every risk type on this site.
Leave a Reply