Governance flaws in UK financial institutions - complacency or one-offs?

Some very interesting bits released over the weekend which should prick the ears of the UK's banking and insurance entities like a corporate governance-driven piercing gun, hot off the back of last month's Co-operative Group scandal.

Governance structures
- unchallenged by Risk for too long?

Over at RSA, one of the UK's most venerable General Insurance, a house of horrors-style drama appears to be emerging. Starting with what looked like a serious, yet relatively modest, localised valuation issue over in Ireland has developed in short order into the straw which has broken the camel's back with regards to the tenure of the Chief Executive of the entire group - all off the back of a routine audit, according to one source, and perhaps not coincidentally breaking formally as a story one day after the announcement of enormous premium hikes in the country.

Astonishingly, one of the three men suspended at the Irish unit is also one of the biggest hitters in their national industry, being the current president of the Irish Insurance Federation. He was quoted in August thus (my emphasis);

I’m very optimistic about the future. The Irish Insurance Industry is robust, well capitalised, making a significant contribution to the economy and most importantly, delivering for customers.

While it is fair to say that the knives were already out for the Group CEO, who has presided over general bad news over the last year or so (this year's profit warnings one and two for example), to actually see a FTSE 100 insurer crippled to the point of fire sales to plug capital holes by such a matter is pretty remarkable, even if the geographical source of the pain is less surprising after Quinn went down actuary-less a couple of years back.

What's more, the interim CEO (who is pulling off the much-maligned Chairman/CEO double act for now, though was Non-Exec) has sanctioned a root and branch review of governance arrangements in the firm across all markets (cited here from an analyst call), quite an undertaking in itself bearing in mind its geographical spread.

It made me revisit the published feedback to EIOPA's preparatory guidance, where I had remembered that the feedback received from RSA was pretty caustic with regards to the appropriateness of EIOPA's guidance where it seemingly went above and beyond the Directive and Implementing Measures.

Pointedly in the context of this particular failure of their internal controls, they fed back extensively on the Fit and Proper requirements (p237), most of which centred around 'less is more', and emphasised the administrative burden such activity already causes. This is supplemented on p339 with a piece against the rotation of internal audit teams, both of which look discomforting in hindsight!

InsuranceERM round table on Solvency II and Capital Management

Nice freebie from the InsuranceERM guys, covering a CRO/ERM Head roundtable touching on economic capital, internal models and Solvency II - the first of this double header is here. With representation from from all sides and sizes of the insurance industry spectrum, the views tabled should be useful for most practitioners in this space, even if some of it is not exactly new news.

They are relatively benign on controversial areas such as industry cost, and even positive when talking of Solvency II having provided an incentive to improve both risk and model governance in the here-and-now, regardless of the necessity from a pure compliance perspective.

Between the two, the following noteworthy views were tabled;

On Solvency II

• "...has to be considered now if, not necessarily when"
• "...from a non-life risk and capital perspective, Solvency II just does not work" - citing reserve risk specifically as inherently flawed 
• The UK's ICA+ regime "...pushes [Solvency II] back towards a more sensible view of capital"

On Internal Models

• "The main issue with the models is spurious accuracy and detail masking big assumptions, which is possibly a systemic risk"
• Regulators in some European countries think internal models are "unnecessarily complicated"
• In response to the suggestion that internal modellers could be "gaming the system" to reduce capital requirements regardless of risk profile, Aviva's ERM head noted that the FSA have identified through their own research that the ICA regime appeared to have done just that back in 2004
• It is "...inevitable that [the Bank of England wearing their PRA hat] is going to take a far more sceptical view of internal models", particularly where Internal Model SCR is lower than Standard Formula SCR
• On Use Test, "...potentially 3 or 4 years before the model is truly bedded in"

On Ratings Agencies and their capital requirements to maintain target ratings

• "...many people, especially in Bermuda, see ratings agencies as de facto regulators"
• "...may take internal models less seriously in the short term" off the back of Solvency II
• Ratings agencies capital requirements are "the worst common denominator" alongside SF SCR and IM SCR

I've personally been relatively well shielded from the extent of the discontent on the non-life side, but judging by the confidence intervals used by high profile insurers as their EC targets (frequently observed at 99.9-something/A or AA rating space), it's no surprise that ratings agency requirements are in many cases paramount - that business could potentially be dragging three or four capital measures to their respective Boards for the next 3 years (agency capital, IM SCR, ICA and SF SCR) is a grim prospect.

Perhaps of more immediate concern is the view that the FSA/PRA have the potential to be more cantankerous around internal models once they move into their new office - something to look forward to in 2013?

Did we learn from Equitable Life? Professor says "No"...

A cracking thought paper was released this week by Professor Roberts from Kings College regarding the lessons one could reasonably have learned from British mutual Equitable Life's demise in early 2000s, and more importantly, did UK plc actually learn them! (simple timeline of recent events here for our non GB readers, but anyone whose website starts with a banner exclaiming "recreating value for policyholders" has clearly had a lean few years!)

This document works nicely as an aide-memoire for anyone working in a financial services risk function as to what one should be wary of in the day-job. Professor Roberts ties in some of the most recent work in this space (leaning heavily on the Cass Business School/AIRMIC Roads to Ruin research and its conclusions in particular), and comes to the inevitable conclusion that lessons are well publicised, but never learned.

My main concern as a risk specialist is that certain recurring themes in the failure of financial services firms appear to remain outside of the Risk function's control or indeed influence, notably;

• Hubris of Senior/Chief executives - Almost every example of failure in insurance and banking referenced in Prof. Roberts paper includes a flukey, unchallenged CEO who got bolder as circumstance rather than skill kept their businesses growing. I had flagged a couple of articles in a post last year touching on what makes an executive tick, and since then I have seen psychopathy and leadership (as opposed to cherubic faces!) examined further in a popular mainstream book. The legitimate concern here of course is that CROs are seemingly no nearer to being guaranteed seats at the top table, let alone a veto to keep the most dominant executives in check, regardless of their loud voices, when necessary.
• Poor quality governance from Non-Executive Director level - Risk functions simply must have the NEDs performing at their optimum in order to provide acceptable services to their employers. While the "old school tie" approach to recruiting NEDs may take a generation to phase out entirely (to be replaced by an army of Fembots, so Viviane Reding would have us think), Risk functions are left with tottering old fee-sweepers as their key route to early intervention. The more visceral approaches to documenting risk appetite/tolerance/preference now being supported by corporate governance codes and vocational/professional bodies may make it easier to raise concerns with NEDs in future (probably as it will be colour coded and in Excel...), but until they are actually prepared to risk their comfortable semi-retirement with some probing questions in the C-suite itself, should Risk functions ever think they can overcome such a void?
• Failure of regulation - Should Risk functions be banking on the (inevitable?) failure of the nascent regulatory environment, and reserve for subsequent claims/compensation if one or a number of products are "too" successful, thus providing the necessary quantum of dissatisfied customers for the regulator to act? I would have laughed this suggestion out of the room until a year ago, since when the FSA have made retrospective calls on interest rate swaps, PPI, and TLPs, all of which would have been presented as "compliant" products in the Boardroom.

For the Solvency II fans, it also notes on page 11-12 that Equitable Life featured in the research which grew up to be Solvency II! Maybe we did learn something after all - if we smash up the affordability of long-term guaranteed products, we can all go unit-linked and never have to worry about another Equitable...

CRO to CEO - what's your skillset?

As flagged on the Reputability blog, Allianz Re have recently promoted their Chief Risk Officer to the top job. Fantastic news for those super-ambitiousin the function, and tactit recognition perhaps that the balanced skillset of the latter day CRO is coming the boil nicely. You will notice that the blogger doesn't prescribe to CRO-to-CEO promotion, seeing the role as a destination, not a hub.

As an avid follower of activity on the CRO front (in particular the sustained attack on the role from the Actuarial profession as an alternative avenue to the C-suite), and was delighted to see that his background was...errr...Actuarial! To all you "Riskies" reading, please see the earlier comments from the FERMA VP on upskilling...

A nice translated piece was published by Clifford Chance regarding CROs in the EU (specifically with Germany in mind) - covers the EC green paper angles on risk governance and risk executives, as well as correctly highlighting that "Solvency II is a key ally in institutionalising the new role of the CRO"

Article on "New Risk Manager" and CRO activity

A few ideas I threw down with my good friends at Clarity Resourcing regarding the changing skill set of the Head of Risk - it's nice to do this kind of thing with the recruitment industry at a time where requirements are difficult to pin down with clients, but sadly this was written before the $10m CRO came on the scene so I wasn't able to crank up the salary expectations I'm afraid!

I did spot a few new CRO hires over the last fortnight (here and here) - that's 2-0 to the actuarial profession for those keeping score...