Solvency II - things what happened in the last couple of months...

She might not be singing yet, but just like my nana at Pilates, the Solvency II fat lady is taking some deep breaths. As I have spent the last couple of months at home in au-pair mode, gladly leaving the rest of the world to waffle about ERM and Solvency II, I thought I would throw together a catch-up post, given that applications for some of the Solvency II goodies have been open since 1st April.

Starting at the top, the UK Government managed to stay sellotaped together long enough to get the fundamental Solvency II legislative work pushed through Parliament before they disbanded for the General Election. The documentation is available in full here, with synopsis here. Interestingly, this formally obliges the PRA to review capital add-ons "at least" once a year, as well as to provide specific reporting to EIOPA on the topic. There is also a little more meat around the sticky issue of firms who breach their MCR, then look unlikely to rectify the matter.

The Government also released the findings of their Regulatory Policy Committee (RPC) in assessing whether Solvency II was going to be a blessing or a curse for Britain. This is actually a very handy drop-in document for your NEDs/peripheral programme figures, and is worth pushing on to them.

They do make the rather controversial statement that on top of the estimated £2.6bn cost to the industry of implementation (!!!!!), the ongoing costs of c.£200m a year will be due to reporting obligations (fair enough) as well as the need for a remuneration policy (hmmm?). Rather disparagingly, the Treasury merely estimate "un-quantified administrative benefits" off the back of improvements in risk management and governance arrangements.

The PRA have recently released the Policy Statement covering their final rules for Solvency II implementation, which on paper should contain no surprises (other associated materials available here). Generalist media chatter (here and here for example) was pretty underwhelming, and while Mark Carney emphasises in the statement that Insurers must be "robustly supervised", Andrew Bailey stated merely that while the "...new regime will not be perfect...it is a welcome step in the right direction"

On a lighter note, the European institutions got a bit beefy over the new year when the newly installed Commissioner Hill had his ears chewed by ECON's new Chair regarding a range of issues or unanswered questions regarding the Delegated Acts. Having given himself a couple of weeks to digest, he pinged out a reply thanking ECON for pointing out three typos, and otherwise defending his corner. Much of the background noise in this correspondence regarding infrastructure investment and EIOPA funding has had a life of its own for some time now - indeed, EIOPA's dummy was definitively spat on the matter last week when they "reprioritised" their 2015 work plan to account for budget cuts.

B-ABI - got back?

NEDs have recently been the beneficiaries of a webcast featuring the juicy double of Huw Evans and Paul Fisher discussing the implications of Solvency II's progression for NEDs. For anyone struggling to get their NEDs to read overinflated board packs these days, a diversion to this footge would be a smart idea (video 1 is more chatter, so start at video 2).

A parallel release for NEDs came from the PRA in the form of a slide pack and a monster 1hr 30m recording of the presentation which it accompanied. Clearly the PRA have seen enough gaps in the efforts of NEDs to date to go to these en-masse tutorial lengths, but the material on validation and ORSA in particular should be swallowed whole.

PRA on Solvency II Approvals - One in the "IMAP"

The PRA today released a consultation paper on applying for Solvency II approvals (with the checklists for firms thinking of applying here), covering such juicy topics  as;

• Matching adjustments
• Ancilliary own funds
• USPs
• Group shenanighans (single ORSA for Groups, and excluding entities from Groups)
• SFCR dispensations

And of course the big man on campus - Internal Model Approval.


I had covered on here back in March that EIOPA intened to bring in a common internal model application package (press release here), whilst also noting that while EIOPA "expected" NCAs to accept and use it, it was not compulsory.

IMAP - waste not want not

With the UK being the largest Internal Model application handler by some distance, the stupendous amount of money, management time and administrative effort which had been injected into the IMAP Process since 2011, there was at least a theoretical possibility that the PRA might say "no thanks", and ask its applicants to continue as they were, albeit with an Excel template amended to reflect the Directive and Delegated Acts as they currently stand

Therefore the rather vicious tearing of hair and gnarling of teeth coming from the UK today is the sound of 60-odd internal model applicants finding out that 3 years of IMAP work is now redundant! Section 2.11 of today's CP states;

EIOPA is expected to publish an internal model application template which the PRA will require all firms to use for their formal internal model applications.

...[firms] will be expected to transpose data onto the new EIOPA template when they make their formal application. The PRA will not be updating the SAT to align with EIOPA's application template

Perhaps I am being a touch harsh to call IMAP efforts to-date "redundant". The UK will naturally have dominated EIOPA discussions around what a template should contain, and how it should be structured to assess applications with maximum efficiency, as they have had the Chair of the Internal Model Committee since 2009!

There is an implication in the CP though that the transposition between the two "templates" will not be as seamless as I had imagined back in March, so I suspect that internal model applicants will need to go back to the market looking for expensive IMAP cajolers in the not too distant future. A shame for UK plc, who will rightly feel they have spent a lifetime's money on this topic already.

 

PRA, BaFin and Disclosure - Grüne with envy...

Without being hypercritical, it occured to me that the PRA appear to be keeping materials and opinions "on the downsie" at a time where perhaps the industry would benefit from their overexposure, and I can't work out why.

A few things triggered that thought over the last week;

• The Internal Model Validation presentation delivered by a PRA representative to the Institute of Risk Management's Solvency II group, which publicly elaborates on the topic more than anything I have seen on the PRA site.
• The apparent failure of the PRA to follow their own Terms of Reference for their recently convened Regulatory Reporting Industry Working Group by not publishing the minutes of the December meeting yet. The TORs say 10+2 working days, and I can't find them anywhere!
• The recent overwrite of the PRA's initial response document to EIOPA regarding "comply or explain" for EIOPA's Preparatory Guidance, which has not yet been "explained" to the industry they oversee! (Well spotted John Walton)
• The almost diametrically opposed position which BaFin have taken over in Germany, where they unequivocally lay out their intentions regarding "comply or explain".

It is worth expanding on the last point, bearing in mind what a useful piece of text it is for anyone looking to confirm within their own Programme how best to interpret EIOPA's guidelines. BaFin explicitly state;

• Insurers should "immediately take the necessary steps" to implement the Preparatory Guidelines.
• That "undertakings are effectively the target audience" for the Preparatory Guidance, which I am delighted to see acknowledged publicly by such a significant participant.
• It is up to each insurer to determine the order of their implementation activity prior to 2016.
• That, for the benefit of the industry, BaFin have carved up the Guidance into 15 blocks, and will provide "additional information and tips" periodically over the next two years.
• That a special activity for Life Insurers will take place, one suspects in order to help identify the capital shortfalls hinted at at the back end of last year for those with high cost of guarantees.
• That everyone is expected to participate in the QRT exercise, ignoring the thresholds offered by EIOPA to the NCAs.
• That they will be translating any EIOPA texts released prior to 2016 in English-only into German.

Whilst it may be a case of thinking das gras ist grüner, it would be easy to envy the German contingent when offered this level of disclosure and certainty in dealing with the preparatory phase. What say you, Moorgate?

PRA briefing on Solvency II, IMAP and application of EIOPA's preparatory guidance

Santa's 'Omnibus 3' joke was not so

well received... 

Santa obviously couldn't wait to put a smile on the faces of the insurance industry this year, so his little helpers at the PRA delivered an industry briefing yesterday, and subsequently released a bucketload of materials which aimed to help give everyone's still-defrosting Solvency II programmes an early steer as to expectations over the next two years.

The main document released was a supervisory statement (along with a video explaining what a 'supervisory statement is!), which followed on from a recent consultation on how the PRA plan to apply EIOPA's preparatory guidelines.

That blog post is effectively still relevant, as virtually nothing changed as a result of the consultation which, at 18 responses, was appallingly participated in, and is perhaps symptomatic of the malaise with which the topic has been infected by during 2013.

The three areas where the PRA have provided specific clarifications following the consultation were;

• Sys Gov Guideline 30 (Securitised Instruments) - note that they will tell EIOPA that it is badly drafted, but that ultimately firms should focus on intended outcomes of it if in doubt 
• Sys Gov Guideline 41 (Actuarial Function) - confirm that the function will need to provide opinions on the reinsurance arrangements and underwriting policies during transition
• Reporting - Confirm that submissions in XBRL are expected by June 2015, but give some wriggle room should EIOPA not fix the templates!

Other than that, it is "as you were".

Julian Adams took time off from his new YouTube career to speak at the event as well - the speech, lovingly titled "A Turning Point", has been published, and from a UK Solvency II Programme perspective. I took the following from it;

General Solvency II

• "Certainty" on timetable, so while he appreciates that firms "downsized their Solvency II programmes", "...now is the time to reassess priorities" - so go tell your CFOs you need another cheque!
• "Expects to have discussions with firms" on the effect of the agreed matching adjustment on capital and technical provisions.
• On the 16-year transition to full Solvency II technical provisions, they are pleased "...to have the safeguard of the transitional floor" which will keep the old regime relevant for years to come
• The Commission "...hope to have a stable version [of delegated acts] ready by March", though won't be publishing them until summer. Does that mean we'll get another leak, like in October 2011?
• "...it is important that firms stay appraised of developments in delegated acts, implementing technical standards and guidance to be issued by the Commission and EIOPA" - PRA seemingly distancing themselves as an influencer at this point, and positioning itself as an administrator
• To that end, the PRA Handbook will follow "intelligent copy-out" rules, so the only elaboration we should expect in future outside of materials produced in the low countries will be in the form of Supervisory Statements (see above!)
• Some technical actuarial papers will be released by the PRA in the New Year 
• Reminder for standard formula firms that they will need to make sure their SCR calculation is suitable, including consideration of USPs/PIM

Specific to the PRA's application of EIOPA Preparatory Guidance

• "...emphasis is on preparations for Solvency II and not its early implementation"
• "We are not gold plating any of the guidelines" - no definition of what "gold plating" means though, which would have been useful.
• "[Proportionality] does not mean that firms can select which requirements to comply with or not"
• Expect incremental improvement in the quality of ORSA Supervisory Reports submitted between 2014 and 2015
• Industry Working Group on Reporting has been set up, as there is evidently enough discord within the UK at the prospect of parallel running numbers to justify a PRA/Industry jam session. That said, July 2015 remains the PRA expectation for XBRL reporting to come in from firms within the thresholds
• For IMAP, "it is critical that firms keep to their allocated submission slot" - if you miss, you "...will join the end of the queue", which might help free up some purse strings!
• "...no longer possible" to offer any flexibility to firms in the IMAP space. 

The PRA Consultation on EIOPA's Preparatory Guidance - priorities for 2014 and 2015

After 10 years, it's finally getting interesting - the PRA today have dropped out a consultation paper on applying EIOPA's preparatory guidelines to PRA-authorised firms (CP 9/13). You can get at the EIOPA materials through this post for convenience.

The content will, subject to any intense lobbying by industry, be adopted as a supervisory statement (section 233) to cover the 2014 and 2015 calendar years, with the expectation remaining that 2016 is our "go-live" date. It covers the following aspects of the preparatory phase;

• The PRA's expectations of firms as they prepare for Solvency II;
• The PRA's approach to implementing the guidelines; and
• The PRA's interpretation of aspects of the guidelines.

They are at pains to highlight that these are "preparatory" guidelines, and provide the traditional spiel on "nature, scale and complexity", so incremental progress is to be expected during the period in question. What that means in practice is perhaps another thing - can you show measurable 'incremental progress' for materials which are only on an annual review cycle, for example? - but that aside, it's worth picking the bones out for your respective programmes, and perhaps most importantly, getting your feedback in by November 15th if you don't like it!

Perhaps the most noteworthy aspect of this CP is that in no way is it suggestive of the PRA rejecting any of EIOPA's guidance (remember, they have until the end of November to voice any protest). That of course makes preparatory work much easier to plan for, as the UK will seemingly be doing it all!

My thoughts on the specifics were as follows;

System of Governance (SOG)

• Emphasise that the SFCR requirements around SOG are also catered for in EIOPA's work (3.7), so a smart move would be to factor that into your drafting plans during 2014
• General governance requirements "largely consistent with SYSC", though individuals holding key functions might expect a personal visit in the next two years (3.10)
• Similar position for Risk Management Systems (3.12), stressing the commonality of requirements with existing PRA obligations, but stressing in particular that firms should be "...including suitable mechanisms and methodology for connecting to their ORSAs and for carrying out regular stress and scenario tests" during the preparatory phase.
• That Prudent Person Principle is not a new concept to the PRA, but firms would be expected to review investment strategies in line with PPP over the next couple of years. A concession is seemingly made regarding the provision and review of third-party data by investment functions for smaller firms. 
• On the (new) requirement for a Capital Management Policy/Medium Term Capital Plan (3.16), they are not moving, despite the howls of protestation - "The PRA regards the development and implementation of such policies and plans as an integral part of sound risk and capital management for all firms, especially as their management and Boards assess the implications of the forthcoming Solvency II own funds and capital requirements"
• On internal controls, they appear to be fishing for firms to analyse whether their existing framework is Solvency-II ready, and then piggy-back of that self-assessment (3.17)
• Same for Internal Audit function readiness! (3.18)
• Actuarial function get a more bespoke treatment (3.19), with all firms asked to "carefully consider" the functional structure to avoid conflicts of interest. They also reserve the right to "...review firms’ analysis of the areas required for improvement, and understand the actions the firm is taking to resolve these".
• Outsourcing similarly gets additional treatment by the PRA (3.22), who are "particularly interested" in changes made specifically with Solvency II readiness in mind

Useful quotes

...the PRA articulates its expectations of firms in the preparatory period, including that firms should read, assess and implement the substantive provisions of the guidelines in order to achieve the intended outcomes (2.5)

The guidelines and this statement are designed to work towards a consistent and convergent approach in preparations for Solvency II and not its early implementation (2.6)

 The PRA expects firms, when asked, to be able to explain what governance changes they need to make to satisfy the guidelines, how they plan to make those changes, what progress there has been to date and any particular difficulties they face (3.4)

The PRA expects firms to be able to document their overall approach to outsourcing, including contingency plans in the event of a service provider failure, to ensure that the efficiency of the service remains unimpaired and uninterrupted. (3.22)

During the preparatory period, the work of the actuarial function will now focus on co-ordinating the calculation of technical provisions, providing an opinion on the underwriting policy and reinsurance arrangements and contributing to the development and performance of the internal model in the pre-application stage where relevant (3.19)

During the preparatory period, the PRA encourages firms to consider how to manage the transition to the new regime and to assess the impact on existing asset portfolios of Solvency II requirements. This need not necessarily mean that changes have to be made to firms’ investment strategies or portfolios but firms are encouraged to work on an incremental basis towards demonstrating that they meet the requirements of the PPP (3.14)

During the preparatory period firms should review their existing policy for assessing fitness and propriety and whether it needs updating in advance of Solvency II (3.11)

FLAOR/ORSA

• PRA only planning to review assessments "...on a proportionate basis" during preparatory phase - they elaborate further by stating "Due to the high number of ORSAs which will be submitted, the PRA expects that it may have to stagger its review of these during the preparatory period in a way that is risk based and proportionate". Does that mean "Top Ten & Lloyds & IMAP" get the works, with everyone else getting a lite-touch?
• Expectation that improvements are identifiable between the 2014 and 2015 FLAORs - the PRA will contact firms individually if they are within the threshold limits which enact guidelines 14-16.
• On ORSA documentation, "...firms should recognise the need for effective documentation and record keeping", for both Policy and Report (4.7)
• Note that the Board's involvement in ORSA is "...far more extensive than setting risk appetites and tolerances", and leave an open threat to go through Board packs/agendas to ensure this is the case (4.8)
• Smaller firms get permission to use their internal ORSA Report as the ORSA Supervisory Report, provided it has enough detail. Larger/riskier firms may conversely be asked to supplement whatever they submit. (4.10)
• PRA actually considering issuing a "summary sheet" to firms in order to help gather information consistently (4.11). Here comes the ORSA Template!
• Expectation that 2014 projection work is done on existing basis, and 2015 (ideally) on Solvency II basis (4.15)

Useful quotes

The preparatory period is a time of development for firms in designing, compiling and trialling these assessments (4.3)

To help capture [ORSA] data and information in a consistent way from firms and facilitate review the PRA is considering whether it may be beneficial to provide a summary sheet to firms (4.11)

The PRA does not intend to prescribe when firms should submit their ORSA...Firms should inform the PRA when their ORSA will be submitted well in advance of the submission date (4.19)

The PRA expects the Board to play an active part at various stages, providing initial steering on how the ORSA should be designed and documented, challenging on risk identification and mitigation along the way and culminating in the Board approving and communicating the finished product. (4.8)

The PRA expects all firms to develop a qualitative process to develop an ORSA which can be documented and reviewed by the PRA in line with its overall proportionate approach.(4.6)

Submission of Information

• Confirms that XBRL is required prior to 2016 as submission format for QRTs (5.7)
• Suggest that policies and procedures around reporting in firms may need "potentially significant revision" in light of Solvency II. (5.15)
• Rather obscurely, they write, "The PRA does not expect that preparatory reporting will be subject to a requirement for external audit but it may draw upon audited inputs" - as I recall the participation of external auditors in QRT-type reporting has been a massive bone of contention in Brussels (indicated within these IRSG comments from last year, but I'm sure there's a more recent story), but potentially not a welcome development.

Internal Model Pre-Application

• They isolate the Model Change policy as an example of something which should already be tested for its appropriateness (6.5)
• Still expect firms to come forward and brief them on "significant" changes during pre-application.
• Surprisingly, very little else,

Useful quotes

...it is important that where models are sufficiently stable, firms are beginning to demonstrate their use and continue to refine their models with the benefits of experience (6.5)

I may fire some feedback in, but ultimately I suspect this lady is not for changing...

ABI and PRA on 'Meeting the Challenges of a Changing World' - Solvency II in particular...

Low Yield issue - not just for insurers

While I disposed of my son for the summer last week for an extensive potty training course in Bordeaux (PS you might want to avoid the 2013 whites!), the ABI gathered the great and good for their biennial conference, themed Meeting the Challenges of a Changing World.

A corresponding publication from the ABI which the event hung its hat off to a certain extent is particularly useful for anyone in the emerging risk/ORSA/reverse stress testing space, touching on 7 specific 'challenge' themes, which are themself further broken into sub-categories. With the ABI providing a mouthpiece for the interests of the UK insurance industry (and being currently Chaired by an avid opponent of Solvency II), it was worth picking up on this document's take on Solvency II, specifically;

• That it could be a future constraint on the nascent equity release market
• Its well documented "...potential effects on infrastructure financing"
• That British insurers should "...[continue] being proactive and engaged in trying to shape vital regulation such as Solvency II rather than simply criticising it from the sidelines". Not sure if the implication is that the UK is drifting from the box-seat in this regard, but certainly in the context of the next decade, a slated in/out referendum on EU membership may make proactivity on Solvency II a moot point!

The regulatory meat in this lobbyist event sandwich came from a keynote speech by the PRA's Andrew Bailey which, in the process of publicly revealing a few nuggets of truth, still left me safe in the knowledge that insurance is still the banking industry's boring cousin - that he needed to "...make clear at outset that insurance supervision matters as much as banking supervision" and stress that "...insurance supervision is a skill on its own" while supporting most prevailing regulatory techniques with the prefix 'what we learned from Banking is...' tells its own story.

That aside, the following comments are worthy of highlighting;

• The PRA's current trend of using "business model analysis" in their supervisory work - surprised that this was not already par for the course frankly (what else other than the types of analyses referenced at the bottom of p4 would you be doing?), but one would expect that the advent of ORSA will enhance everyone's activity in this field soon.
• Taking that into account, it is "...logical for us to make early adjustments to our existing regime to incorporate the ORSA under ICAS+"
• The suggestion that management "...take responsibility for understanding and mitigating the risks in their business" - 'managing', rather than 'mitigating' surely, we'll tolerate anything within appetite!
• That the truly woeful "Solvency II/Crossrail" costing analogy used by Mr Bailey to a parliamentary select committee was the PRA "...making a point on behalf of firms".
• That "PRA have not withdrawn from involvement in Solvency II, far from it", though recognises that the result around the classic matching adjustment is not what UK plc would wish for - goes on to comment that we "...still have a good way to go to make the Solvency II regime manageable in its use and implementation"
• That, as far as Sol II's legislative progress is concerned, negotiations "...continue over summer, with a conclusion expected in the autumn", and that the official implementation date discussed recently on this blog is "clearly unrealistic".

In a week where a wall of silence has descended upon the co-legislators and the Commission, it is reassuring to see at least one NSA body with a solid-ish implementation plan, regardless of the immediate lack of things to implement - however judging by the words captured by Gideon of Dr. Wiedner, the lightly briefed (and from what I could read, lightly fed) replacement of Karel van Hulle, I suspect that Solvency II on the whole remains "Klaus but no cigar"...

Actuarial profession and the Risk Function - from 'land grab' to 'colonisation'?

Back in the early days of this Blog I used to post frequently on the Solvency II-sponsored creep towards Risk functions in insurers being 'Chiefed' by members of the actuarial profession as a matter of course rather than choice (here, here and here for a start). It was even a thread in a presentation I delivered to ILAG in late 2012 around areas of control function crossover, in particular that the actuarial profession was acknowledging that there were professional deficiencies in their ability to address the basics of an actuarial function under Solvency II, yet preferred the ambition of conquering a newer (less arduous?) space ahead of remedying them.

Whilst a quant is no doubt a decent fit for such a task, it was an evident snub to the nascent Risk Management 'profession', who took umbridge at the implication of such compulsion from the UK regulator in April 2011, though with seemingly little impact. However, limits to the amount of time and money bodies such as the IRM and FERMA can throw at developing a one-size-fits-all Risk Management qualification package that can appeal to quants and non-quants alike, plus some furious inter-squabbling in the ISO 31000 world, are certainly not lending any credence to "Risk Management" as a profession in its own right as we stand.

Risk and Actuarial professions - 'Poles' apart?

Over in Ireland, the opportunity for the Actuarial profession to secure an additional control function has been pursued so rabidly that the SAI incoming and outgoing presidents were recently able to congratulate themselves on having busted into "the new frontier" of Risk, and are now moving on into "colonisation mode" (p2)! In the UK, the Institute and Faculty of Actuaries already seem to consider that area of influence secured judging by the new president's remarks recently, indicating a desire to influence more mainstream debates than those around risk management systems and corporate governance.

The UK and Ireland don't appear to be the only ones afflicted by the perception of compulsory quants in Risk functions. Munich Re's excellent Knowledge Series delivers a Germanic take that there is "no doubt" that professional mathematicians will be needed for tomorrow's Risk functions.

When considering the history of the Actuarial profession (beautifully summarised here), there should be no reason why Risk Management cannot achieve a similar position given time, regardless of the disparity in existing approaches from representative bodies. A modular qualification which can prepare a 'risk professional' for their favoured activity (insurance buying/continuity management/financial risk/op risk/ERM) is surely an ambition which those bodies can harbour in concert? My concern would naturally be that I probably don't have another 50-100 years to wait for the that convergence to happen and enhance my own career prospects!

Or maybe I do - does anyone know an expert in longevity?

FSA and cost of Solvency II in the UK - two tunnels or half a tunnel?

Andrew Bailey, incoming head of the PRA in the UK, was widely quoted yesterday as saying that the spiralling costs of Solvency II could ultimately cost "twice as much" as London's new £15bn choo-choo tunnel Crossrail. This was at a parliamentary select committee, which for non-UK readers is where second tier politicians jump on the latest bandwagons, so that fact that Solvency II is getting some air-time is telling in itself.

Not entirely certain what expenses are included in this £30bn mega-bill, but the number is surely as inconceivable as a 2014 start date unless we add FSA costs, industry costs and slap on some arbitrary figure for "additional capital the industry will probably need to hold" - which is of course what was contained in the Cost Benefit Analysis commissioned by the FSA published back in 2011. With much of that based on QIS5 standard formula results (but at least in the same ball park as £30bn), I guess we can swallow £30bn, albeit with a pint, rather than a pinch, of salt.

"But wait a second" keen readers of the FT cry, "this time last month a prominent CEO said the cost was supposed to be HALF that of Crossrail,". Has someone in the fact sheet-preparing department at the Wharf got their wires more crossed that a breakdancing electrician, and sold their boss a dud here? Has one of the journos at the Telegraph or FT misquoted someone? Either way, there's probably a salient lesson in there somewhere around looking before you leap, it just remains to be seen who's left with the proverbial, errr, mucky shoes.

Incidentally, the full text from a separate questionnaire which the UK Parliament's Treasury Select Committee asked Mr Bailey to respond to is available here - this is separate to the interrogation transcript where the "twice as much" quote was obtained from, but contains some insight into where prudential regulation is going as of next month when the PRA take the reigns, including some good news on the regulatory levy front;

"For the next year, we intend to levy just £0.1mn [for Solvency II]. The difference [from last year's £15m] reflects cut backs that we have applied to Solvency 2 preparation costs. Although it is hard to be sure of the final cost of Solvency 2 preparations given the uncertainty on timing and substance, I expect the overall cost to be considerably lower than previously estimated. This will be a saving for insurers."


However, when one reads that, in his own words, the new head of Prudential regulation in the UK is "...by comparison new to insurance, but [he takes] it very seriously", you truly hope if the £30bn faux pas is attributable to him, that it can be put right - with all the Solvency II scaremongering and doom-mongering, we could probably use a little realism-mongering...

• 
  

  
  
  
  
  

Chartered Institute of Internal Auditors - recommendations for UK financial services

The Chartered Institute of Internal Auditors recently created a sub-committee to provide professional guidance "...designed to be a benchmark for effective internal audit in financial services in the UK", and they have just reported back with this feast of fun, which is a vital read for anyone working in control functions within financial services. The opinions they have used to create this guidance have been purloined not only from the profession itself, but also from other professions, regulatory bodies and executive/non-executive directors

They note in summary that there is "strong support for an unrestricted scope for internal audit", while drawing attention to disparity of opinion around matters such as: IA directly challenging strategy; IA reporting to Risk Committees (rather than audit committees) in certain instances; compulsory attendance of Chief Internal Auditors at Executive Committees; and the direction of managerial reporting lines.

The proposed guidance reads very much like the Corporate Governance Code, and is relatively light. It is broken into the following sections, where I have noted anything I found new or controversial alongside (my focus being predominantly scope creep into the Risk function's activity):

1. Role and Mandate of IA - increased focus on risk assessment and risk coverage adequacy
2. Scope and Priorities of IA - unrestricted scope ultimately advised; expected to "independently determine" key risks, and assess "the setting of, and adherence to, risk appetite"; assess the "risk and control culture"; allows for potential involvement of IA on "real time basis" in key corporate events (mergers, disposals, new lines of business etc)
3. Reporting results - factors in reporting obligations to both Risk and Audit Committees where appropriate, and builds in an expectation of an annual independent assessment of governance (which covers off one of the FSB's recommendations covered yesterday!)
4. Interaction with Risk, Compliance and Finance functions - nothing new
5. Independence and Authority - Chief Internal Auditor expected to be executive committee-equivalent, have the right to attend Excom, access to all MI, and report directly to either the Chairman of the Board, Audit Committee or at a push, Risk Committee. A secondary line to an executive director should only go to CEO
6. Resources - all resourcing decisions effectively divorced from the business, to reside with the Chief Internal Auditor and the Audit Committee
7. Quality assessment - external assessment of the function recommended periodically.
8. Relationships with regulators - nothing new
9. Wider considerations - expectation that the "tone at the top" of a firm should be what fosters acceptance of IA

Any controversy? Perhaps around the seniority of the Chief Internal Auditor, and their assessment of the setting of and adherence to Risk Appetite. I think my main concern as a risk practitioner would be the potential for differences of opinion around what constitutes "adequate" risk management, given the Internal Audit predeliction for COSO on all things risk-related, against the IRM or ISO31000. 

Let battle commence?

Institute of Risk Management on Risk Culture - ABCs, Double S's and mercenaries

So I figured it might be worth seeing how the other half were living by reading something that didn't start with "Solvency II" and end with "indefinite delay"!

The IRM are endeavouring to produce white papers on some of the less tangible elements of a risk practitioner's day job, which one would hope contribute to more consistency in practitioner approaches and ultimately more credence in the concept of risk professionalism (indeed, their work around defending pure risk professionalism as a career, as opposed to loading risk functions with cross-over actuaries, was very much required in early 2011).

Having scrutinised their work on Risk Appetite in 2011 (lined up against some of the competing influencing bodies here), I figured it was only fair to take a punt at their new release on Risk Culture. It's fair to say that for politicians, regulators and fingers-caught-in-the-till employees, 'culture' or 'risk culture' appears to be a handy soundbite when explaining why they didn't fulfil their obligations to their stakeholders. The IRM are joined by Protiviti in producing this guidance, Protiviti themselves having delivered a survey based on UK insurers on this very topic in the summer, which was not shy about highlighting how little some organisations think of their Risk functions.

I've always felt that the 'culture' comfort blanket was one weasel word too many i.e. "there was a culture of greed" = "they were greedy ********", or "there was a culture of fear" = "scared of the gaffer", so I approached this doc with a pretty open mind, but tempered with a Manxman's natural scepticism. I found the following (sequentially);

What does a good risk culture look like?

• Appears to have used examples of what a "bad" risk culture has recently led to, then flipped that on its head! Would have thought a clean slate approach is better for white papers, rather than reacting to zeitgeist incidents
• Fair list of 10 criteria for anyone in the risk culture assessment space, though will always be a nightmare to codify/quantify.
• The appearance of the dreaded "tone from the top" suggestion, which makes an appearance in the FRC's (p4), the FSA's and EIOPA's world (p10) - bearing in mind that the "top" is normally the problem when it comes to organisational catastrophe (Lehman, Northern Rock) as opposed to fat tail op risk loss events UBS/Credit Agricole/JP Morgan), I would be more inclined to call it "tone at the top".

What does risk culture mean?

• I like the IRM's take on culture being "the repeated behaviour" of a group - very convincing definition in comparison to say the FSA in SYSC (p12), though the rest of the ABC approach is a tad woolly.
• "Virtuous" versus "vicious" cycle sits nicely alongside this image of repetition, but nothing as such around how best to break a vicious one, either as a NED or a Head of Risk - perhaps that has been saved for the more extensive and expensive practitioner's guide!

Why is risk culture important?

• Don't agree that risk culture affects the capability to take strategic decisions, rather it enhances or impairs the quality of those decisions. Immediately makes me think of ORSA, and how "playing" at it or "doing" it doesn't prevent strategic decisions from being made.
• Also don't agree that "at worst" an inappropriate risk culture could lead to "serious reputational and financial damage" - I'm sure stockholders at Bear Stearns may say it can be a bit graver than that!
• Nice emphasis on how risk culture can both stifle necessary risk-seeking behaviour at one extreme (smartly citing Eastman Kodak as a "too slow" corporate failure), as well as the more obvious "prison rules" which emerge from uncontrolled risk taking.

What can the board do?

• Should they really ask themselves "what is the current risk culture"? If so, is that at a chinwag-type round table, or via some kind of evaluation survey issued by Risk function? Instinctively sounds like the kind of thing that would be squeezed into a Q1/Q3 board meeting at the point of a gun, which is as cynical as it is sad!

Understanding risk culture in an organisation

• The meatier (i.e. costs money!) practitioner guide apparently contains some diagnostic tools to effectively indicate and track culture within an organisation. The flash we are given here reminds me of the psychometric testing for "what makes a great Risk Manager" that I looked at last year, but feels ultimately very high-end.
• The "Double S" model is an intriguing addition to the mix, specifically the comment that low scores on either rating "create a barrier to the effective management of risk". Would love to see more of the research cited, as I've found that the odd mercenary firm can work wonders...

Changing a risk culture

• Can a risk culture effectively be changed top-down without a change in personnel? Can't imagine an existing CEO being prepared to antagonise his board/exec team by declaring them culturally bankrupt unless he had carte blanche to do so, which is normally the case with regime change. I'm more inclined to think a decent CEO, partnered with Risk, could do it by stealth, rather than with a pricey change management programme which would inevitably rock a few boats.
• "Risk culture is not a precise science" - does that make it an art?

10 questions a Board should ask itself

• I would probably make it 11 questions, and frame the first one "Do we genuinely care about how culture impacts on our decision making, or only insofar as laws and regulations insist upon it?". If a Risk practitioner gets the answer to that directly from the Board/Exec, the other questions can be catered for with proportional vigour.

Thought provoking in the right ways, I guess it does what a good white-paper should - thanks to all concerned at the Institute.

FSA - Data Review findings in context of IMAP

So I guess there was an inevitability that, with all of the resourcing around Solvency II programmes over the last couple of years being focused on filling the yawning corporate governance chasms within EU insurers with bald, handsome, impeccably mannered Pillar 2 consultants (well, one out of three ain't bad!), that some of the more mundane aspects of preparations would take a back seat.

Step forward Data Quality! With the considerable efforts expended by UK internal model applicants already on plugging their calculation kernels in, risk calibration, loss function fitting, correlations etc, the FSA's latest review findings take us right back to the starting point of SCR generation - data inputs - and they are not impressed.

The FSA began working on this topic with the industry as far back as this time last year, and are not scheduled to be finished with this thematic review until Q3 2013. Bizarrely, they note in the introduction to these review findings that their scoping tool released in July 2011 aimed to help assess compliance with both Level 1 and draft Level 2, which wasn't released to the industry (i.e. leaked) until late October - quel chance mes amis?

Splitting hairs on timings aside, just reading the five section headings of their review work would be enough to reduce many BAU staff to a quivering wreck ("Implementation of the Data Policy"? What, today?), so I wasn't expecting a glowing report. That said, the quality of data which ultimately results in today's technical provisions, capital requirements etc is seemingly fit enough for purpose, so a full-on hatchet job would be a poor reflection on both the industry and the regulator.

Assuming a 2014 go-live date (looking unlikely as of 9pm GMT today!), the areas of major concern for insurers, based on these preliminary findings, would be;

• Difficulty in assigning data ownership - there will be enough Pontius Pilates in the BAU world who will happily wash their hands of data ownership until the cows come home. Programmes will need to be extremely forceful in assigning ownership and ensuring it sticks
• Inability to articulate "accurate", "complete" and "appropriate" - this should have been an easy win, so I'm surprised that it is seemingly an issue. Realistically, should we expect the business to take ownership of data sources when we cannot define what is and isn't acceptable output from them? 
• Data Dictionary/Data Directory confusion - a suite of pretty scathing findings in this field, suggesting both over-simplicity and over-complexity has been found in the workings of Data teams.
• Spreadsheet controls and non-compliance with end user computing policies - onerous expectations on the face of it (paragraphs 4.41 and 4.42), which will be a shock to both programme budgets as well as end-users.

Some other interesting points made in the review include;

• Firms either using their Risk Committees, or a bespoke "data steering" committee as their data governance body - pretty sure the Risk Committees won't fancy this as long-term work.
• A number of suggestions as to what areas are not currently being consistently addressed when assessing materiality (p11-12)
• Some very useful comment around data classification methods (p13)
• Suggestion that, as I expected, the techniques applied to assessing the quality of data provided by third parties is not robust enough - industry-wide consensus on how to interrogate your outsourcing parties would be useful in this respect.
• A rather strange comment around poorly designed/controlled data warehouses - I can only assume they have seen one or more horror stories on their travels, as the warehouse is surely the way to go!

Any smart cookies who haven't got going on Phase II with the FSA at this juncture should be stripping this down line-by-line. For those of you outside of the UK, you may want to cross your fingers that your friendly national regulator doesn't use this approach as a yardstick...

Central Bank of Ireland - Solvency Matters newsletter, ORSA and models

The Central Bank of Ireland have released their latest Solvency II briefing letter (thanks to Mike Claffey for tweeting it).

Important to note the following from a UK and Ireland practitioner's perspective, on the premise that the two regulatory bodies in the UK and Ireland are setting the benchmarks in many respects;

• 'No panic' message given regarding the Omnibus II 'delays' - timetable unchanged in this regard
• No references to the Commission's draft Level 2 text as a basis for undertakings to use for internal model application activity (which the FSA went out of their way to advocate at their February IMAP event). Is there a legitimate reason for this, bearing in mind how useful the document is for applicants in ensuring their documentation addresses the final requirements, even if only 'there or there abouts'?
• Model applicants should be "well advanced with the technical aspects of their model build" - this is somewhat to the FSA's take, which was that build should be pretty much complete by now (p10)
• Some nice visceral examples of Use Test evidence requirements from undertakings, particularly around evidencing Board 'understanding' of the model - I would add that these seem onerous for NEDs, but reasonable for executives, so I would be interested to see how this is applied (could you for example see your non-industry, non-executive director justifying diversification benefits to your friendly local regulator? Is that a reasonable use of project resource/Board training time?)
• Board members will be interviewed by the CBoI individually "without the support of their technical experts" - I'll get my coat then...
• On ORSA, they "recognise that individual undertakings would like to get more details on specifics of the ORSA Reporting Process", but want undertakings to focus on the contributing processes themselves - easier said than done, particularly when even EIOPA had to relent from the mantra of 'ORSA is process, not a report' when they got to public consultation stage!

I'm sure that the industry will appreciate some of the clarity in here - they may appreciate the Commission's Level 2 draft a bit more though!

FSA and Solvency II - speech from Julian Adams today for IMAP firms

Hot off the press, Julian Adams spoke to the great and good today (i.e. I wasn't there!) regarding those who are in IMAP, and dropped the following hot chat:

• "What [any further delay off the back of March's ECON vote] might do instead is merely compress the period between transposition and implementation"
• "...for the time being we remain of the view that we must plan for a 2014 implementation"
• "...it is vitally important that you stick to the submission slots we have already agreed with you"
• "By sticking to your submission slot you will also be considered alongside a peer group of firms" - this is the first I have heard of submission slots being allocated to groups of 'peer' companies, assuming this was not a figure of speech
• "...we are basing our approach to the next phase [of IMAP] on the stable draft text of the Level 2 material which was circulated by the Commission in November" - which is nice if everyone else had access to it [leaks notwithstanding!]
• "[we] will be publishing later today an updated version of the self assessment template based on this" - you may be able to sers toi at this location (ZIP file) 
• "We appreciate that this change will require some additional work for firms" - nicely played down!
• "...the materials we are launching today do not take any account of the Level three text", but promises to do more once the L3's stabilise
• On technical provisions - "Our view is that we would not be able to approve a model under Solvency II without having reasonable assurance as to the accuracy of the underlying balance sheet, and we will therefore be undertaking a review of the technical provisions of IMAP firms as part of our existing activity with the firm before and after its submission slot"
• "...it is unlikely that we will review the calculation of technical provisions until a point in 2013", while the approach used will be assessed earlier, but "which may include the use of external review"
• "It will be necessary for us to gain assurance that all [300+ criteria in the Directive text] of these requirements have been met before we can decide to grant approval for a model’s use

That may take a while to digest, so let's see what tomorrow brings...

UK Treasury - Consultation on Solvency II

I have had a look through the UK Treasury's transposition of Solvency II consultation paper today (the purpose of this is to ultimately confirm which UK law and statute changes will need to be made to accommodate it, rather than the FSA's consultation, which was focused on replacing the existing handbooks with SOLPRU).

Strangely, at 100 pages, it is a pretty good read, and you should not be shy in purloining some of their idiot's guide material at the start for board presentations and staff briefings. However, the really meaty stuff comes in around halfway through, where they get to cost/benefit analyses (much of which leans heavily of the E&Y research referenced by the FSA numerous times already).

A few things jumped out, namely;

• £1.53bn as ongoing cost to UK industry (NPV over 10 years) - that's to go alongside the £1.9bn of transition costs!
• Sat alongside £3.52bn of "key monetised benefits", NPVd over 10 years - I'm no mathematician, but I guess that means it's a winner for the industry!
• Between 550 and 600 UK firms expected to be covered (Lloyds syndicates included) - this seems much lighter than the CEA figures from the other week, which had over 1,000 UK insurance entities. Are there relly that many below the de minimus level?
• No "gold plating" of Solvency II - bare minimum "copy-out" approach confirmed.
• Table included which shows the scale of the changes for firms with comparable data between Solvency I, ICAS and Solvency II.
• Still includes an estimate of 100 model candidates who will "ultimately" use an internal model, though it states that only a third of these will look for day-one approval. I'm struggling to reconcile this [100 in IMAP at outset, now down to 77, but only 33 will be approved on day 1!]
• Shows all the detail of how the FSA came to £110m as the cost between 09/10 and 13/14 (based on timesheets!) and the ongoing costs post-2014, broken down by FSA business area. Important note here is that half of the ongoing costs from 2014-2016 are for actuarial resource to assess internal models. Nice to know the logic behind the special project levies for those years

Plenty of flannel towards the back, which you are probably familiar with, but if not, knock yourself out!

FSA plans for conduct of business under the FCA

Speeches today from Hector Sants and Margeret Cole on the future of regulation for the 24,000+ small financial services firms who will not fall under the auspices of the Prudential Regulatory Authority.

Both provide quality insight as to how the risk/reward argument is playing out at the FSA as they prepare for the 2013 split - particularly liked the parallel of cost of extra regulatory visits against the cost of product failures such as Keydata.

FSA update - Solvency II, Supervision Framework and death of ARROW

The FSA had a busy week, with a major conference in London on the future of the regulator in its new guise as the Prudential Regulatory Authority (PRA) .

Media commenced with an interview in which which Hector Sants discussed the obligations of the regulator to publish findings  such as those from their report into RBS (which has been taken out of the FSA's hands). Speeches given by Hector Sants and Andrew Bailey are available here and here respectively.

It is of course banking focused, but the new risk assessment framework (p9) shows much more agressive intent from the regulator, and it will be interesting to see any transference of experience between Solvency II preparations and changes on the Banking side when the PRA finally comes out to play

As a funny aside, Andrew Bailey confirmed in the speech that the ARROW supervision model was to be scrapped - having seen the number of site visits it generates dwindle as shown in these numbers, I am surprised it has taken so long to confirm it!