Board Risk Oversight When Markets Move: Interest Rates, Oil Shocks, and the Case for Real-Time Risk Intelligence

In the first quarter of 2026, nearly every tier-one Kenyan bank posted significant profit growth. Equity Group Holdings reported a 23.8 percent increase in net profit to Sh18.3 billion. KCB Group rose 10.7 percent to Sh17.81 billion. NCBA climbed 8.8 percent to Sh5.96 billion. The Co-operative Bank of Kenya posted 21.2 percent growth. The common driver across all of them was the expansion of net interest income — the spread between what banks earn on loans and investments and what they pay depositors.

The mechanics of that expansion are instructive. Central Bank of Kenya data shows that the average savings and demand deposit rate fell to 6.86 percent in March 2026 from 11.48 percent in June 2024 — a decline of 4.72 percentage points. Over the same period, the average lending rate fell by only 2.19 percentage points to 16.85 percent. The spread between lending and fixed deposit rates widened to 7.80 percent from 5.37 percent. Banks cut the cost of funds faster than they reduced the price of credit, and the margin flowed directly to the bottom line.

For bank boards, the record profits are welcome. But the conditions that produced them — widening spreads, elevated non-performing loan ratios near 15 percent, aggressive reallocation toward government securities, and a geopolitical environment that has driven fuel prices past Sh200 per litre — are also the conditions that create concentrated and correlated risks. Inflation accelerated to 5.6 percent in April, the fastest pace in seven years. The banking industry expects the Central Bank to raise its benchmark rate for the first time since February 2024. And the US-Israel war on Iran continues to disrupt oil supply routes, keeping energy costs elevated and currency markets volatile.

This is the environment in which board risk committees must make decisions. And the quality of those decisions depends entirely on the quality of the risk intelligence they receive.

The Risk Convergence: Why This Moment Demands Better Board Intelligence

The risk environment facing Kenyan institutions in mid-2026 is characterised by convergence — multiple risk categories moving simultaneously and reinforcing each other. The Iran-driven oil shock feeds directly into inflation, which pressures the exchange rate, which triggers expectations of a CBR increase, which raises the cost of funds, which compresses the very margins that produced record Q1 profits. At the same time, higher input costs across the economy increase the probability of credit deterioration in commercial and SME loan portfolios, potentially pushing the already-elevated NPL ratio higher.

For insurers, the same dynamics increase claims costs — particularly in motor and medical lines where fuel and imported pharmaceutical costs are directly affected by exchange rate movements. For manufacturers and importers, margin compression is compounded by Finance Bill uncertainty, trapped input VAT, and supply chain disruptions on Middle East shipping routes. For SACCOs, the combination of rising member borrowing costs and declining real returns on deposits creates pressure on both sides of the balance sheet.

The defining characteristic of converging risks is that they cannot be monitored in isolation. A board risk committee that receives separate reports on credit risk, market risk, liquidity risk, and operational risk — prepared by different teams at different intervals — will miss the connections between them. The interest rate risk report does not show how a CBR hike affects the credit quality of rate-sensitive borrowers. The credit risk report does not incorporate the oil price scenarios that drive the inflation assumptions that determine repayment capacity. The quarterly PDF that arrives at the board meeting reflects conditions that may have shifted materially since it was assembled.

From Quarterly Reports to Real-Time Risk Registers

The gap between the risk environment and the risk intelligence that boards receive is a governance deficit. It is not caused by a lack of data — Kenyan institutions generate substantial volumes of risk-relevant data from their lending operations, treasury positions, claims experience, and regulatory interactions. The gap is in the infrastructure that converts that data into timely, structured, decision-grade intelligence for the board.

A real-time risk register replaces the quarterly snapshot with a living instrument. Risks are identified, scored using a consistent methodology, assigned to owners, and monitored against defined key risk indicators. When a KRI breaches its threshold — for example, when the NPL ratio exceeds a board-defined limit, when inflation crosses a trigger level, or when the exchange rate moves beyond the institution's risk appetite — the risk register updates automatically and surfaces the event to the risk committee through an alert or dashboard change.

Heat maps provide the board with an intuitive visual representation of the institution's risk profile — showing where risks cluster by likelihood and impact, and how the profile has shifted over time. A heat map that showed concentrated green in Q4 2025 and has shifted toward amber and red in Q1 2026 tells a story that no prose summary can communicate as quickly or as clearly.

Key Risk Indicators: The Early Warning System Boards Need

Key risk indicators are the measurable signals that tell a risk committee whether the institution's exposure is within appetite or approaching a boundary. In the current environment, the KRIs that matter most for Kenyan institutions include the net interest margin trajectory, the deposit concentration ratio, the NPL ratio by sector and segment, the oil-price-driven inflation rate, the exchange rate volatility index, the liquidity coverage ratio, and the portfolio sensitivity to a CBR change.

Each KRI must have a defined threshold — a green-amber-red boundary that reflects the board's risk appetite. When a KRI crosses from green to amber, the risk owner investigates and reports. When it crosses to red, the risk committee convenes or the escalation protocol triggers. This is not bureaucratic overhead. It is the mechanism through which a board exercises its oversight function in real time rather than in retrospect.

The alternative — learning about threshold breaches at the next scheduled board meeting, weeks or months after the event — is a governance posture that accepts preventable surprise as the normal operating condition. In a period of macro volatility, that posture is increasingly difficult to defend to shareholders, regulators, and rating agencies.

The Bond-Equity Rotation: What It Tells Risk Committees

One of the clearest market signals in the current environment is the rotation from equities to fixed income. The NSE declined approximately 1.3 percent over the month as investors shifted toward government securities, which offer 7.5 percent on 91-day Treasury bills and 8.4 percent on 364-day bills with minimal credit risk. Corporate bond issuance has crossed Sh100 billion outstanding for the first time. Banks themselves have increased their holdings of government securities relative to commercial lending — a risk-averse allocation that prioritises liquidity and capital preservation over growth.

For board risk committees, this rotation is a macro risk signal that intersects with several institutional risk categories. Treasury portfolio duration — the sensitivity of the institution's bond holdings to interest rate changes — becomes a critical metric when a CBR hike is expected. Equity price risk affects institutions that hold investment portfolios or manage unit trusts. And the broader economic signal — that sophisticated investors are reducing risk exposure — is context that should inform the institution's own risk appetite review.

Infrastructure for Real-Time Board Risk Intelligence

The technology infrastructure for board-level risk intelligence is not complex in architecture. It requires a structured risk register that captures risks across all categories in a consistent format; a scoring methodology that evaluates likelihood and impact using defined criteria; KRI monitoring that links to operational data sources and evaluates thresholds continuously; heat maps and dashboards that update in real time; escalation workflows that route threshold breaches to the appropriate decision-maker; and board reporting that can be generated at any point with current data.

Trigarc Risk provides this infrastructure through its enterprise risk management module. Risks are captured in a structured register with 7-criteria weighted scoring. KRIs are configured with threshold boundaries that trigger alerts and escalation. Heat maps update as risk scores change. Board risk dashboards consolidate the institution's risk profile across credit, market, operational, compliance, and strategic risk categories in one view. And the AML/CFT and fraud risk capability — including ML/TF assessment, sanctions screening, and suspicious transaction reporting — integrates with the broader risk register so that financial crime risk is visible alongside all other categories.

Governance in Motion: What Boards Should Do Now

The macro environment will not wait for governance infrastructure to catch up. Boards that are currently receiving quarterly PDF risk reports should be asking their CROs three questions: How quickly can we see a KRI breach after it occurs? Can we see how our risk categories interact — specifically, how an interest rate change affects credit quality, and how oil prices affect our cost base and our borrowers? And does our risk register reflect today's conditions, or last quarter's?

If the answers reveal a gap between the speed of the risk environment and the speed of the board's risk intelligence, that gap is the governance investment that matters most in the current cycle. The institutions that built their risk infrastructure during periods of stability will navigate volatility with confidence. Those that attempt to build it in the middle of a storm will find themselves governing with yesterday's information in a market that has already moved.