ORSA - Institute of Risk Management special interest group

Of course while I spent the last couple of months topping up my tan in, errrrr, the Isle of Man, some of the guys in the UK and further afield have been building up an endeavour-flavoured sweat on some of the more malleable elements of Solvency II preparation.


Raining 'Mann' - Glorious Manx summer

The IRM as ever have kept the ball rolling, in particular hosting an ORSA session last month. While you can pick your way through the guest speaker presentations for ideas and comfort (one company specific, one consultant generic, and one which S&ST/RST fans might like as a sense check), I was much more interested in the attendee survey.

A whopping 34 replies came in, via which the attendees have delivered a reasonable ORSA landscape mock-up, which may help some of you get matters shuffled in your priority lists, given where your peers claim to be.

I noted in particular;

• ORSA Process overwhelmingly run by the Risk functions (over 90%)
• Just over half going for annual frequency, the rest (who responded) naturally more frequent - doesn't instinctively feel representative, but not all of the smaller firms would send someone down to this!
• Around two-thirds have their "Reports" at 50 pages or less - if we assume that by "report" we mean Supervisory as well as Internal, the PRA won't be too chuffed with that given their comments at the December industry seminar.
• Only a third have submitted draft ORSA Reports to the PRA and received feedback
• Coverage of emerging risk appears to be an area which not only do respondees think is lacking, but has received critical feedback from the PRA

That half have used external consultants in their ORSA work to-date is certainly no surprise. I'd be worried if that consultancy had more than a year's dust on it though, so think hard before you start submitting your 2014 gear!

Fit and Proper Persons in financial services - judge not, lest ye be judged

A quick note on the high-profile leadership-related crises which have reared their heads over the last couple of weeks, and whether the risk management professionals of the world can learn from them.

Two stories related to the flip-side of the kind of driven, charismatic figures that can progress rapidly through their chosen careers while coping with some rather spectacular character flaws. One being the ex-Chair of the UK's Co-operative Bank (already in financial turmoil), caught in a drugs and prostitutes sting this week, which has followed on from the city mayor of Toronto, who has been drawn into a similar web of videotaped misbehaviours.

Sticking with the financial services example, we have a number of issues which should interest the risk pros;

• A Chair with no financial services experience or qualifications (Northern Rock encore un fois!) ...
• In an organisation undergoing a massive transformation after acquisition...
• With a previous (if expired) criminal conviction...
• Who had resigned from public office while in the role due to pornography-related misuse of office equipment (reported at the time as due to "increasing responsibilities" at Co-op!)
• Who then (allegedly) used his work e-mail to solicit prostitutes (bottom of article)
• And all of this post-dating the nadir of the financial crisis, when one would have naturally thought that both institutions and the regulator would have been on point on such a matter.

Some elements of the story are dominating the headlines, such as the gender of the prostitutes, the type of drugs used, or the fact that the Co-operative movement, purporting to have a higher calling than the soul-hoovering plcs, should perhaps be impervious to such matters. 

For me, we have a straigthtforward case of significant internal control failings across departments, a failure to hold senior management to account when breaching internal policies, and a very strong working example of a reverse stress test, combining a number of risk factors which in concert deliver a failed business model. On that basis, I would think that the business-as-usual risk teams across the country will be analysing this one until the cows come home.

How much of a bum-paddling the FSA/PRA deserve on this is another matter. Whether light-touch or prescriptive, I think regulators in many countries will wince at the details of the approval of Rev. Flowers' appointment once this one plays out at Treasury Select Committee over the coming weeks (I have no insider information, but let's face it, we'll be watching through our fingers!). 

For context however, in 2009 the FSA (as it was then) made a formal submission to the TSC addressing many of the failings uncovered by the retreating tide post-Lehmans/Bear Stearns/Northern Rock, and what Hector Sants & Co had planned to make up the shortfall. 

The TSC made a number of comments (sandwiched within the FSA's submission) which are worth highlighting today - I have emphasised the parts which should now echo in eternity;

The FSA's assessment of whether senior bankers were fit and proper for their posts appears to have been little more than a tick-box formality, unless the applicant had a criminal record or gave some other evidence of a shady past. That bar was demonstrably set too low. We welcome the acknowledgement from the FSA that a candidate's competence, as well as their probity, will now be thoroughly reviewed before taking up a senior post in a bank. We recognise that there may be some dangers in the FSA assessing competence, not least because the FSA will become exposed to accusations of incompetence itself, if it makes a wrong judgement

We recommend that the FSA assess whether bank executives should possess relevant qualifications. We would like to see banking qualifications become one of the core indicators against which the FSA can assess a candidate's competence. If a candidate has no relevant qualifications, the onus should be on them to prove to the FSA that they have relevant compensatory experience

And from the PRA themselves...

We strongly agree that it is important for bank executives to have the right level of skills and experience. As noted above, we have recently written to all CEOs of relationship-managed firms reminding them that it remains the firm's responsibility to ensure that the candidates they put forward are fit and proper to perform the role in question, and that firms should, therefore, have robust recruitment, referencing and due diligence processes in place

It was only three years ago - at what point do we (grim pun intended) practice what we preach on corporate governance in financial services?

ABI and PRA on 'Meeting the Challenges of a Changing World' - Solvency II in particular...

Low Yield issue - not just for insurers

While I disposed of my son for the summer last week for an extensive potty training course in Bordeaux (PS you might want to avoid the 2013 whites!), the ABI gathered the great and good for their biennial conference, themed Meeting the Challenges of a Changing World.

A corresponding publication from the ABI which the event hung its hat off to a certain extent is particularly useful for anyone in the emerging risk/ORSA/reverse stress testing space, touching on 7 specific 'challenge' themes, which are themself further broken into sub-categories. With the ABI providing a mouthpiece for the interests of the UK insurance industry (and being currently Chaired by an avid opponent of Solvency II), it was worth picking up on this document's take on Solvency II, specifically;

• That it could be a future constraint on the nascent equity release market
• Its well documented "...potential effects on infrastructure financing"
• That British insurers should "...[continue] being proactive and engaged in trying to shape vital regulation such as Solvency II rather than simply criticising it from the sidelines". Not sure if the implication is that the UK is drifting from the box-seat in this regard, but certainly in the context of the next decade, a slated in/out referendum on EU membership may make proactivity on Solvency II a moot point!

The regulatory meat in this lobbyist event sandwich came from a keynote speech by the PRA's Andrew Bailey which, in the process of publicly revealing a few nuggets of truth, still left me safe in the knowledge that insurance is still the banking industry's boring cousin - that he needed to "...make clear at outset that insurance supervision matters as much as banking supervision" and stress that "...insurance supervision is a skill on its own" while supporting most prevailing regulatory techniques with the prefix 'what we learned from Banking is...' tells its own story.

That aside, the following comments are worthy of highlighting;

• The PRA's current trend of using "business model analysis" in their supervisory work - surprised that this was not already par for the course frankly (what else other than the types of analyses referenced at the bottom of p4 would you be doing?), but one would expect that the advent of ORSA will enhance everyone's activity in this field soon.
• Taking that into account, it is "...logical for us to make early adjustments to our existing regime to incorporate the ORSA under ICAS+"
• The suggestion that management "...take responsibility for understanding and mitigating the risks in their business" - 'managing', rather than 'mitigating' surely, we'll tolerate anything within appetite!
• That the truly woeful "Solvency II/Crossrail" costing analogy used by Mr Bailey to a parliamentary select committee was the PRA "...making a point on behalf of firms".
• That "PRA have not withdrawn from involvement in Solvency II, far from it", though recognises that the result around the classic matching adjustment is not what UK plc would wish for - goes on to comment that we "...still have a good way to go to make the Solvency II regime manageable in its use and implementation"
• That, as far as Sol II's legislative progress is concerned, negotiations "...continue over summer, with a conclusion expected in the autumn", and that the official implementation date discussed recently on this blog is "clearly unrealistic".

In a week where a wall of silence has descended upon the co-legislators and the Commission, it is reassuring to see at least one NSA body with a solid-ish implementation plan, regardless of the immediate lack of things to implement - however judging by the words captured by Gideon of Dr. Wiedner, the lightly briefed (and from what I could read, lightly fed) replacement of Karel van Hulle, I suspect that Solvency II on the whole remains "Klaus but no cigar"...

Lloyds of London on Validation - testing and reporting enhancement ideas

Lloyds of London delivered a presentation around model validation last week to its 80-odd syndicates which anyone in the world of IMAP would benefit from picking through the bones of, bearing in mind the rather unique position of the Lloyds application (i.e. in the door of the PRA, and seemingly well received!).

They had noted in that presentation linked to above that they had found some weaknesses in 5 areas in particular, so this presentation is a deep-dive examining the strengths and weaknesses of validation - one may expect the other 4 'weak' areas flagged may receive similar treatment in coming weeks.

While their 2013 programme aims only to close the gap between full compliance with Solvency II tests and standards and today's position, it's worth flagging some fundamentals;

• Only half of syndicates felt to meet tests and standards in full - a third are 'pending' positive assessment, the rest have not passed.
• 'Fails' seem to be centred around following up on test failures and documenting findings in the summary report, rather than anything broader.

Around the production of Validation Reports, they noted negative findings around;

• Uncertainty about how to progress when something 'unacceptable' is found during validation testing
• Content of validation reports being statistic-heavy (i.e. indigestible to any non-quants who need to make decisions off the back of the findings)
• A lack of sophistication in the testing of material risks in some instances.

The last one is particularly interesting, as the central team at Lloyds has devised a schematic (slide 11) to show the kind of testing they expect to see on the more material risks (RST, P&L attribution) versus less material (going as far as qualitative tests).

It is also worth highlighting for any benchmarkers out there that Lloyds appear to advocate around 5 pages of Validation Report per risk factor, leaving their overall expectation of reports to be 30-40 pages, with 5-10 pages of appendices (p16). Bearing in mind these reports will I suspect be some of the first to go through the PRA's hands, the frame of reference may help encourage you to bulk up or slim down your own versions!

A large amount of this presentation (from p19 onwards) is devoted to fairly granular examples of how a validation test may be 'failed', and what action would be performed in order to gain a 'pass', so for those in the test design/conduct game, you may find something to support your approaches in that detail, regardless of the risks shown in the example (premium and reserve).

Munich Re on Strategic Risk - ORSA food for thought

A thought-provoker from Munich Re for anyone in the business of Emerging Risk/'Top Down' risk review activity with this release called "Strategic Risk to Risk Strategy", which leans on the findings of the World Economic Forum's 2012 Risk Report to observe how the risks highlighted may compromise existing insurer strategies, as well as materialise into the thoughts of underwriters once sufficient data exists.

With coverage of "strategic risk" featuring in everyone's ORSA thoughts, as well as obligations around scenario analysis and reverse stress testing, there are some benchmarks in here that are worthy of consideration for practitioners. In particular;

Strategic Risk definition
Risk of making wrong business decisions, implementing decisions poorly, or being unable to adapt to changes in the operating environment


Subcategories of Strategic Risk

• Ineffective M&A
• Incorrect interpretation of external activity in a given market
• Decision making based on poor pricing/profitability assumptions
• Legal misinterpretation

Specific points

• In their opinion an insurer's risk strategy "goes beyond covering the risk capital requirement for a portfolio for the forthcoming financial year on the basis of valid models" to actually questioning and enhancing a company's business. I think most practitioners would agree that any documented risk strategy would look further forward than one-year! 
• That shortcomings around the evaluation of Strategic Risk "...are not so much of a question of the [informational] resources available", which are plentiful, nor are they especially time-pressured.
• They also include a definition of Reverse Stress Testing as scenarios which "endanger a company's business model as a whole" - interesting purely in the absence of an EU-driven definition to-date, as it tallies along with UK equivalent definitions.

An edited list of Strategic Risk scenarios is included (p3) which you may want to line up against your own activity in this field, and follow on by exploring which of these are within and outside of an insurer's sphere of influence. You might also benefit from the diagram on p6 on the main stakeholders in an insurance company which may influence your selection of strategic risk scenarios depending on your structure and business model. 

UK's "new" Prudential Regulatory Authority - Approach to Insurance Supervision

So a magical thing happened over the weekend: a venerable institution disappeared on Friday, only to come back reborn on Monday...

...that's right, the FSA is no more, being replaced by two more focused entities in the Prudential Regulatory Authority (PRA) and Financial Conduct Authority (FSA). This is part of the UK-specific fallout from the financial crisis, where a perceived lack of focus from the former tripartite system which housed the FSA allowed for both systemic risk (Northern Rock, RBS) and conduct risks (PPI, Interest Rate swaps) to emerge largely unchecked.

Rather excitingly, this means a new website with some natty logos from the Bank of England (which

PRA - emperor's new clothes
or Solvency II aperatif?

has rehoused the PRA side of the FSA), as well as a statement on the new supervisory approach that the PRA will be taking.

For anyone in the ERM/Solvency II/Corporate Governance space, this gives us a chance to pick up on the kind of regulatory interrogation one might expect when writing/upgrading system of governance-related materials in preparation for both full Solvency II implementation in 20??, as well as how they are accommodating EIOPA's interim measures from 2014.

Remembering that the PRA's two statutory objectives are to promote safety and soundness of the firms it regulates, as well as specifically providing appropriate protection to insurance policyholders, I thought it wise to make some notes on how they have catered for Solvency II and deference (when due) to EIOPA, as well as the general content around expectations of governance systems. I found the following worthy of note;

Control function-specific

Section 82 - "[PRA] wants to be satisfies in particular that designated risk management and control functions carry real weight within insurers"

Section 117 - Should have separate risk management and individual control functions in place (dependent on nature scale and complexity etc)

Section 118 - the PRA "expects these functions to be independent of an insurer's revenue generating functions"

Section 120 - expectation of an "operationally independent Actuarial function", which the PRA consider to be "integral to the effective implementation of a firm's risk management framework"

Section 182 - "Actuaries can play an important part in supporting prudential supervision"

Section 119 - an effective Risk function on the other hand merely "ensures that material risk issues receive sufficient attention from the insurer's senior management and Board" - just because I'm paranoid, doesn't mean the Risk profession isn't being made something of a gooseberry here, particularly as the FSA/Actuarial profession love-in started some time ago!

On Risk Appetite

Section 110 - a firm's risk appetite "[is] to be integral to its strategy, and the foundation of its risk management framework"

Remuneration

Section 84 - "remuneration and incentive schemes should reward careful and prudent management" - just like Prudential's and Standard Life's did this week!

Section 194 - Hint at potentially restricting pay in firms if intervention is warranted

Stress/Reverse Stress Testing

Section 109 - the AMSB must have "...an explicit understanding of the circumstances in which their firm might fail"

Section 145 - with regards to Reverse Stress Testing, "...management should consider the reliability of the output of the internal model compared with the results of these tests"

Section 106 - "competent, and where appropriate, independent control functions" should oversee risk management and internal control frameworks

Internal Models

Section 116 - On Internal Models, the AMSB should understand;

• extent of reliance on models for managing risk;
• limitations of their structure and complexity;
• Data used;
• key underpinning assumptions

Section 140 - "PRA expects internal models to be appropriately prudent"

Section 144 - firms may not choose the lowest capital requirement to determine whether or not to model internally

Regulatory Capital

Section 135 - for capital adequacy, firms "...should not rely on regulatory minima", and also "...should not rely on aggressive interpretations of actuarial or accounting standards"

Proportionality

Sections 212-215 - touches on treatment of "low impact" firms - is this effectively where aggressive approaches to proportionality interpretation should be expected (combined control functions, limited documentation, passive acceptance of Standard Formula etc)?

p43 - table covering the allocation of supervisory staff - 10 staff to 1 firm for the 25 largest insurers, versus approaching 10 firms to 1 supervisor at the small end.

Solvency II-specific references

• In the PRA's view "[Solvency II technical detail should] leave scope for supervisors of individual insurers to make informed judgements around risks posed"
• Confirms that elements of the Directive such as Prudent Person Principle, ORSA, Control Function requirements and Pillar 1 are all aligned with the new Threshold Conditions
• Model approval will be dependent on "adequate" risk identification, measurement, management, monitoring and reporting throughout the modelling process
• Will impose capital add-ons when necessary "to ensure insurers meet the required standards"

EIOPA Preparatory Guidance - ORSA (or 'forward looking assessment of risks')

Forward-looking assessment of the undertakings own risks (based on ORSA principles) (plus explanatory text)

The ORSA preparatory guidelines* are not a massive burden for anyone busy rolling eggs down hills at the moment, coming in at 34 pages containing 25 guidelines, as well as 29 pages of explanatory text. In this instance, it is probably disappointing to any underprepared supervisors and insurers in that they may have preferred more!

More pointedly, the materials add little to what was already in existence from EIOPA in July 2012, and certainly will required little in the way of adaption in the UK's instance, who are already in a similar headspace and have been advising accordingly.

Of course the world and her husband have piped up with their opinion on what ORSA should cover and how it should be administered and documented (this post has a decent sweep at capturing most of them), so opinion on this matter is something we are not short on.

For me the headline points are:

• ORSAs (well, 'overall solvency needs assessments', but let's be serious!) expected from 2014
• Internal Models should be used by anyone in pre-application
• Likely that most standard formula firms will have to qualitatively assess deviations between SF and their own Risk Profile at this time
• Expectation of an internal ORSA report and a ORSA supervisory report
• Records of the assessment expected to be documented and kept which must be "appropriate" - no prescription of what that means
• ORSAs to be performed at least annually

The following points are either new, or worthy of reiteration for anyone whose preparations on this front are less than certain - for ease of reference I have used 'ORSA' where EIOPA use 'forward looking assessment of risk', and as with the other preparatory guidance papers I have looked at, I will assume there will be blanket application as written, with no dissent from industry or NCAs:

Guideline 3

• Overall Solvency Needs assessments will be expected from 2014 (i.e compliance with Article 45.1)
• Minimum of 80% of the market must also assess whether they would comply with the Articles 45 (b) and (c) from 2014 - regardless of any Pillar 1 uncertainty.
• Internal Models expected to be used in ORSAs if a company is in model approval pre-application
• IF the standard formula is 'provided' by 2014, expectation that SF firms will assess deviation between the SF assumptions and their own Risk Profile - this excludes anyone outside of the magic 80% catchment figure mentioned above.

Guideline 6 - Documentation generated by ORSAs must include:

• An ORSA Policy
• An ORSA Record
• An Internal ORSA Report
• AN ORSA Supervisory Report

Guideline 7 - The ORSA Policy must include

• Description of component ORSA processes and procedures
• Consideration of the linkages between Risk Profile, Risk Tolerances and Overall Solvency Needs (OSN)

As well as information on

• frequency on stress tests, scenario analyses and reverse stress tests; 
• data quality standards; and 
• the frequency of the assessment, justified in relation to Risk Profile, volatility of OSN relative to capital position, timing (from calendar perspective I guess) and circumstances for ad-hoc assessments

Guideline 8 - ORSA Record

• Firms expected to "appropriately evidence" the assessment - no prescription as to what that means (logs, working papers, meeting minutes, e-mails)

Guideline 9 - Internal ORSA Report

• AMSB must communicate results to "all relevant staff" post-approval, which includes the ORSA results and conclusions

Guideline 10 - ORSA Supervisory Report

• 2 weeks after concluding ORSA, ORSA supervisory report must be submitted, which must include;
• Quantitative and qualitative results, and conclusions drawn
• Methods and main assumptions
• Comparison between Own Funds, SCR and OSN

Guideline 11

• Must quantitatively estimate the impact of different valuation bases (if used) when assessing OSN

Guideline 12

• OSN must be quantified, supplemented by a qualitative description of all material risks
• Expectation that these items are all stress/scenario tested

Guideline 17 - ORSA output to be used at least for;

• Capital Management
• Business Planning
• Product Development

Guideline 18

• ORSA to be performed at least annually

* So let's end with something fundamental, EIOPA - it is NOT useful to replace 'ORSA', as an acronym or indeed in full, with the expression "Forward-looking assessment of risk (based on ORSA principles)" 5 years down the road - I'm sure there is a rationale, just as sure as I am not going to like it (even the GCAE agree with me, going with 'ORSA-like')!

FSA and Solvency II - Adams's speech at City and Financial Conference, London

Just in case any of you UK guys working on IMAP are slacking off, a pretty unequivocal rallying call was delivered by Julian Adams late last week in London, letting the industry know in no uncertain terms that the business end of IMAP starts, well, yesterday!
The double thrust of the speech was to cover both the planned "twin peaks" model of UK regulation due to be phased in over the next year or so, as well as implementation of Solvency II. There is a genuinely aggressive tone in the wording, which betrays a certain impatience with what the guys at Canary Wharf have seen to date in Self Assessment Templates and pre-application activity. I extracted the following from it;

• Highlighting that prudential and conduct issues will be dealt with by separate peaks, allowing a more focused approach.
• A PRA agenda which seems to tread on old ground (assessing the vulnerability of business models, and whether they have a run-off plan in place). The main shift is perhaps a heavier focus on that plan's viability during a crisis, learning one hopes from the real-time experiences of the last 5 years.
• A complimentary, but very unsubtle onus on the subject of reverse stress testing, or "what would break the company" which, bearing in mind the relatively light materials available on the topic from the FSA (a few pointers in here being the most recent release on p2), would suggest firms may need to look elsewhere to bolster their RST approach (TW for example have a decent piece here).
• A very surprising revelation that the 'appropriateness' of the Standard Formula to firms who have elected against internal modelling is essentially a 2013 piece of work - what does that mean for anyone who is found to be using it 'inappropriately', bearing in mind the proximity of implementation (are we to understand that this is a lesser crime than having a stab at modelling and coming up short on the documentation front)?
• "Competence and quality" of senior management will be scrutinised from a system of governance perspective - I like this, on the premise that it would be relatively easy to build a technically compliant structure and populate it with unsufficiently trained/briefed staff. Their bullet point list of what they will be asking around (focused on quality of MI provided, understanding of reverse stresses, quantification of risks in risk appetite frameworks, and availability of management actions, modelled and non-modelled, under duress) should be put in front of your nearest directors tomorrow!
• A definition (of sorts) of proportionality as "the amount of work we expect firms to do to demonstrate a requirement has been met", though adding a vice versa to cover how much time they will devote to assessing it.
• No in-depth reviews of SATs scheduled, nor do they expect a piece of evidence for each one of the 300 model approval requirements (god forbid this turns a bit tick-boxy for the sake of administrative convenience!)
• Making "no apologies" for disagreeing with applicants' own assessments of the quality of their submission paperwork, while suggesting there is a grading criteria already in place (adequate|comprehensive|complete) - not publishing the more critical end of that spectrum it would appear!
• Note that the interaction of component parts of models, as well as correlation/diversification and extreme events in the tail, will receive more attention.
• "Much higher degree of feedback than has been the case to date" should be expected by the IMAP firms in near future, with the FSA being "much clearer on [their] view of progress", and potentially "ceasing to work with you and exiting you from the process" - this is seemingly driven off the back of the pre-application work to date and some peer group review work leaving them in a spot where they can separate the wheat from the chaff.
• Note that the transition between pre-application to submission is where they will make a "substantive decision as to a firm's progress" - explains the Lloyd's position I guess, though I'm not certain a less substantial body may have been reprieved judging by the tone of this speech.
• A final flourish around what has been witnessed to date, where they have specifically singled out the following areas of tardiness as signs of a ropey application: falling behind one's own implementation plans; validation workstreams being "significantly behind" and with narrow scopes; expert judgements not being properly documented or challenged; supporting documentation generally weak, and model change policies which have yet to conquer the challenge of "major/minor" definitions, let alone what a "qualitative major change" may consist of. I would add that these themes were covered at the industry briefing at the end of February (from p9), just not as definitively.

They also note that the scheduled Technical Provisions work noted in an earlier speech by Mr Adams is likely to be something of a fillip to the consulting actuarial profession, and any firm in IMAP will need to have been reviewed in this respect before receiving approval.

Well don't just stand there, get cracking!

Towers Watson paper on Extreme Risks - useful for Reverse Stress Testing

For anyone who has reverse stress testing on their agenda, this release from Towers Watson should help you on the "unlikely but extreme" events front.

They categorise these events into three types - Financial, Economic and "Other" (being environmental and political), and provide 15 solid risk events, some ideas on ranking, hedging and parameterising impact and likelihood., all of which are valid in the face of a lack of guidance from EIOPA on the subject at this juncture (remember ORSA requirements!).

Certainly worth using in your next FSA-driven reverse stress testing exercise if you are UK-based, and considering in the context of the forthcoming public consultation on ORSA for the rest of you Euro-landers.