Solvency II - Another year (or two) later?

As flagged by Reuters earlier, the German FT has cited an "industry insider" as having whispered that a move to 2015, or even 2016, is a possibility.

While the general chatter in the FT article covers some supportibng argument on the quant front, the legislative timetable argument is a lot more compelling. Bearing in mind that the ECON vote has moved, but the plenary vote currently remains unchanged, should any delays or differences of opinion hold up Omnibus II clearance above and beyond the summer recess, the knock on effects would perhaps support this (i.e. bifurcation or not, Jan 2014 would not be achievable).

As ever, I guess the parliamentary vote date is the one to look out for!

Late post script - Reuters ponied up with another article today which touches on the story but brings in Peter Skinner's explanation of the delay

ERM Speciality papers - Harvard Business Review and Zurich

As with the previous post, another document which may make Insurance industry readers feel like the proverbial grandmother being taught to suck eggs was pushed out by Zurich, in conjunction with the Harvard Business Review. Heavily themed around ERM programs and CRO tactics used in deployment.

This contains some generic examples of current CRO risk management practices, obtained from the horses' mouths. I hasten to add that these are not all "best practice", and indeed some might not even be considered "good", but they are across all industries, which does help benchmark any progress you might be making on infant ERM programmes forced by Solvency II or Corporate Governance code changes.

In its entirety it feels 10 pages longer than it ought to be, purely due to the number of quotations and practice examples it includes. It does however include a decent sample size (1,419), so the response percentages are a better representation than a lot of benchmarking/best practice materials.

I took from it the following;

• Huge growth in number of CROs at large companies since 2008 (11% to 42%)
• Two-thirds felt they were not doing well at the 6 risk management capabilities cited in the report as critical to organisational performance - all of these capaibilities are very much embedded in the ORSA world for insurers
• Only 1-in-10 felt they had a "Strong risk-aware culture" - I know this is a topic for debate on the IRM's LinkedIn page, so worth a look if you feel you are lacking in this area
• Note a "broad agreement on the increased importance of ERM" - the PwC paper referenced in the last post argues the opposite!
• "Big risks" flagged as currently being the zeitgeist were; Nat Cat, Economic Crisis, Talent Retention and Reputation - this definitely shows how the CRO can pull themselves away from operational activity to focus attention on less visceral matters.
• Reference to "sequential risks" which to all intents and purposes is describing scenario analysis - is there a case for trying to enforce a common risk language on this matter as a profession?
• Reference to "proactively managing risk, rather than simply mitigating it in a reactive way" - is it not possible to proactively mitigate risk?
• Half of companies surveyed have a single identifiable individual reponsible for ERM, "a key factor in driving success in this area" - can't make up my mind if this is a good or a bad thing, but I guess it is dependent on how vigorously the three lines of defence are established.
• Aggregation of risk types and proactively identifying current/emerging risks were deemed by the sample to be less important than "embedding a risk-aware culture at all levels" - this seems very odd, and perhaps borrows on the vagaries of the term to enhance its importance to CROs
• Piece quoting from COSO on page 11 which contradicts the view mentioned above that individual ownership of ERM is something to aspire to.
• Some strange numbers on the relationship between Risk and Internal Audit - over a quarter of respondents said they either didn't work closely with IA at all, or didn't know. Goes on to describe an example of IA using ERM-identified risks as the basis of the Audit plan, which in my view is ideal, and a great example of knowledge and intelligence sharing.
• Strangely for something with heavy US input, no references to ratings agencies as a driver for ERM
• Primary barriers to implementing ERM all seem logical, though the failure of key staff to acquire new skills features around halfway down the list, and in my experience this would probably be top.
• Finally, one CRO talks of his "small, lean staff" - no need for a punchline there... 

Overall good benchmarking questions, but perhaps too much in the way of "at one firm..." examples.

ERM Speciality papers - PwC on "Black Swans"

A couple of speciality ERM benchmarking papers were released in the last week which are worthy of comment.

The first, from PwC, touches on the well trodden path of Black Swans, as well as giving the concept of ERM as a whole a bit of a black eye, suggesting that alignment of risk and strategy is infrequenctly achieved. I can certainly sympathise with the comments relating to the inflexibility of ERM frameworks and the onerous nature of running them in a way that contributes to wider boardroom debate. There is also some salient comment on how malfunctioning ERM can blur the lines of responsibility in an organisation, as well as the old "risk appetite is not explicitly defined" chestnut.

It does however lean heavily on the AIRMIC research from last year for content, and contains some startling generalisations (from an insurer's perspective at least);

• "In most organisations" risk is grouped into three main categories - operational, strategic and financial?
• "Under current risk management thinking, a risk that cannot be identified cannot be managed"?
• Audit committees cited as complaining that they receive too much risk information (as opposed to their job of financial statement scutiny and internal controls adequacy)?
• ERM "currently used by most major corporations" and has "a focus on providing stronger control over operational and financial risks"?
• Some critics claim that ERM "can encourage a box-ticking, process-led approach to managing risk"?

It goes on to descend into some schematic craziness before coming back to reference reverse stress testing (close to insurer and banking hearts already, but this paper is targeted across industries). The concluding recommendations for enhancing ERM frameworks into "ERM plus" all scream "ORSA". All in all one for the non-insurers to consume, as a lot of the Solvency-II world will feel they have this covered.

Next up Harvard Business Review and Zurich!

IRM Solvency II SIG Presentations from January - Stress Testing

For anyone who is working on firming up their approach to stress testing and its cousins for Solvency II purposes, I would recommend taking a look at the outputs from this month's IRM Solvency II Special Interest Group.

The presentation has some worth, although I guess you needed to be there to get the full gist. The survey however is of much more use for justifying any approaches you currently have in play (who is responsible for what, and indeed what varieties of stress testing are actually used). Small sample as you might expect for a SIG at 28 respondents, but worthy nonetheless.

Solvency II updates from Freshfields and Clifford Chance

A couple of extremely useful Solvency II legislative updates from Clifford Chance and Freshfields Bruckhaus Deringer which cover the state of play up to but not including the delay announced at the end of last week.

Both cover the transition between pre and post-Lisbon treaty legislative frameworks, the post-Lisbon Lamfalussy process and the drivers behind the current sticking points - if you are struggling to convey the uncertainty to your project sponsors, I would recommend giving both a once-over.

Omnibus II delay - ECON moves, Plenary stays still?

No doubt you all enjoyed Gideon's reportage from Friday (leapt upon by the other outlets shortly afterwards) that the sign-off on Omnibus II from the specialist EU parliamentary committee ECON, scheduled for this month before moving on to a full plenary (i.e. all of the EU Parliament) vote in April, had been yet again postponed. For you Brits, the FSA have commented on this development as well.

Easy to speculate on the causes of this (indeed the recent snub by David Cameron on the bail-out front is cited here as perhaps having weakened the UK's lobbying power at a time where they perhaps have the most to lose), but fair to assume it is still on the numbers front as opposed to Pillar II or III.

Worth flagging here that, while the ECON vote has now been changed to end of March on the Europarl website, the full plenary vote is still as it stood previously (mid-April). This could be the reason why most public comment since Gideon broke the story has been reluctant to say that this delay might shift the go-live date.

Good news then I guess...

Risk Appetite Statements - Central Bank of Ireland not impressed

Good spot from Mike Claffey, flagging an finance industry-wide rollicking from the Central Bank of Ireland on the quality of Risk Appetite Statements, now of course a regulatory requirement.

Some extraordinary findings appear to have emerged, judging by the recommendations, for example;

• Board not signing off the appetite statement (never mind just signing off, how about formulating!)
• Non-coverage of material risks
• Statement not being communicated to relevant staff

With the advent of PRISM in 2012, there is clearly a desire to get ducks in a line on the Emerald Isle, and of course there is plenty of Risk Appetite guidance out there (some from Mr. Claffey himself at Milliman here, the IRM's take here, the Society of Actuaries in Ireland had a good stab here, but strangely nothing extensive on the FAQ front from the CBoI). Fair to say that excuses should be hard to come by then?

However, as I have mentioned earlier, having some paper perfect statements doesn't necessarily deliver the right outcome, as UBS will attest to!