Jurassic Talk - enhanced NED challenges during Solvency II preparations?

 Britain's youngest NED

Given that there won’t be a heck of a lot more briefing done on the Non-Executive Director front, I’ve given the PRA Industry Event slide pack published the other week a bit more of a going over to see if the left and right hands are pushing the Solvency II wheelie bin in the right direction. I haven’t gone as far as watching the 1h 30m video of the event yet – if I wanted to watch a room full of fidgeting old men in ill-fitting suits I’d just go to Bridge Night at the bowling club…

I can’t say I was massively enthused by the read of the slides as an individual who is frequently delivering material to the very audience the presentation was aimed at. I would highlight the following oddities;

Internal Model-specific (slides 6-12)

• That Solvency II “sets a high bar” for model approval – that feels a little disingenuous given that the PRA has had the whip hand in the IRSG’s internal model committee for years, and has evidently driven their CAT. Fair to say that the PRA set the "high bar" on behalf of the rest of Europe.
• From the “lessons learned” section they suggest that some IMAP/CAT firms have used assumptions which are not matching their experience. Is that not bravado bordering on criminality? Doesn’t feel like small beer, so unless the PRA are splitting hairs with that comment, I trust the protagonists had a strip torn from them.
• Some models ignoring “Key Risks” faced by a firm – how can this be? If this is about cheeky risk selection (i.e. let’s use SF, but model Market Risk as we get a good number from it) all well and good, but to say that firms are ignoring them is not a good steer, and if they are, then how is punishment not already being dispensed?
• For Use Test purposes, NEDS told to have “belief” but not “blind faith” – this feels like Bank Creep, given that the PRA  have been vocal (here and here) on firms blindly following models after the banks got caught with their trolleys down a few years back (nice PRA summary here). Doesn’t feel especially fair to tar insurers with exactly the same brush in advance, even if it is smart!
• “Boards need to own validation design” – just sounds meaningless when you read it back. If you want them to “do” the design (which Andrew Marshall’s later slides deriding the efforts of the validation contracting community suggest also support), then just say it.
• The “Key Questions” slides contain some very ropey gear. “Does the output of the model give a credible answer”? “Can the firm survive on the Standard Formula”? The terms used are so flimsy that one could spend hours arguing the toss about their definition – “so what is survival – EC+, SCR+, MCR+ with recovery plan” etc.

ORSA and SoG (slides 14-18)
Starts with a bit of good news – some generic industry feedback is seemingly due within the next couple of months (pertaining to our 2014 ORSA efforts?). The slide summarising findings to date is also a useful yardstick for those who can’t wait that long.

For System of Governance, the executive world should prepare themselves for NED questions regarding whether or not they (as opposed to their underlings and contractors) are reading EIOPA's Guidelines. Let's hope they have!

On the gnarlier side;

• Seems to be an obsession with assigning named individuals (as opposed to roles or teams)  to perform mitigating tasks relating to anything ropey uncovered during the ORSA
• “ORSA should be holistic” – at what point is that breathtakingly grim term going to be put to pasture? For a NED briefing, the use of plain English should be considered par for the course. It is followed two slides later by “top-down/bottom-up” which is equally non-specific.
• “ORSA is not a compliance exercise resulting in a report to the PRA” – I think you meant to say “not ONLY...”!

The final slides from Ian Marshall’s presentation are revealing more due to the clumsy terminology often used at the table with NEDs (“Key Drivers” and “Key Correlations” for example – if you mean “most money riding on it”, then say it!). Also, the idea that Risk Appetite is “no longer an aspiration” is worrying – I would have given the insurance industry credit that it ceased to be aspirational some time ago, and doesn’t need a 2015 ‘tick’, but then I am a trusting fellow.

Does anyone think, off the back of these slides, that their NEDs will be chomping at the bit at the next Risk Committee/Board meeting using the ammunition supplied here?

Maybe I’d better watch the video after all… 

Fit and Proper Persons in financial services - judge not, lest ye be judged

A quick note on the high-profile leadership-related crises which have reared their heads over the last couple of weeks, and whether the risk management professionals of the world can learn from them.

Two stories related to the flip-side of the kind of driven, charismatic figures that can progress rapidly through their chosen careers while coping with some rather spectacular character flaws. One being the ex-Chair of the UK's Co-operative Bank (already in financial turmoil), caught in a drugs and prostitutes sting this week, which has followed on from the city mayor of Toronto, who has been drawn into a similar web of videotaped misbehaviours.

Sticking with the financial services example, we have a number of issues which should interest the risk pros;

• A Chair with no financial services experience or qualifications (Northern Rock encore un fois!) ...
• In an organisation undergoing a massive transformation after acquisition...
• With a previous (if expired) criminal conviction...
• Who had resigned from public office while in the role due to pornography-related misuse of office equipment (reported at the time as due to "increasing responsibilities" at Co-op!)
• Who then (allegedly) used his work e-mail to solicit prostitutes (bottom of article)
• And all of this post-dating the nadir of the financial crisis, when one would have naturally thought that both institutions and the regulator would have been on point on such a matter.

Some elements of the story are dominating the headlines, such as the gender of the prostitutes, the type of drugs used, or the fact that the Co-operative movement, purporting to have a higher calling than the soul-hoovering plcs, should perhaps be impervious to such matters. 

For me, we have a straigthtforward case of significant internal control failings across departments, a failure to hold senior management to account when breaching internal policies, and a very strong working example of a reverse stress test, combining a number of risk factors which in concert deliver a failed business model. On that basis, I would think that the business-as-usual risk teams across the country will be analysing this one until the cows come home.

How much of a bum-paddling the FSA/PRA deserve on this is another matter. Whether light-touch or prescriptive, I think regulators in many countries will wince at the details of the approval of Rev. Flowers' appointment once this one plays out at Treasury Select Committee over the coming weeks (I have no insider information, but let's face it, we'll be watching through our fingers!). 

For context however, in 2009 the FSA (as it was then) made a formal submission to the TSC addressing many of the failings uncovered by the retreating tide post-Lehmans/Bear Stearns/Northern Rock, and what Hector Sants & Co had planned to make up the shortfall. 

The TSC made a number of comments (sandwiched within the FSA's submission) which are worth highlighting today - I have emphasised the parts which should now echo in eternity;

The FSA's assessment of whether senior bankers were fit and proper for their posts appears to have been little more than a tick-box formality, unless the applicant had a criminal record or gave some other evidence of a shady past. That bar was demonstrably set too low. We welcome the acknowledgement from the FSA that a candidate's competence, as well as their probity, will now be thoroughly reviewed before taking up a senior post in a bank. We recognise that there may be some dangers in the FSA assessing competence, not least because the FSA will become exposed to accusations of incompetence itself, if it makes a wrong judgement

We recommend that the FSA assess whether bank executives should possess relevant qualifications. We would like to see banking qualifications become one of the core indicators against which the FSA can assess a candidate's competence. If a candidate has no relevant qualifications, the onus should be on them to prove to the FSA that they have relevant compensatory experience

And from the PRA themselves...

We strongly agree that it is important for bank executives to have the right level of skills and experience. As noted above, we have recently written to all CEOs of relationship-managed firms reminding them that it remains the firm's responsibility to ensure that the candidates they put forward are fit and proper to perform the role in question, and that firms should, therefore, have robust recruitment, referencing and due diligence processes in place

It was only three years ago - at what point do we (grim pun intended) practice what we preach on corporate governance in financial services?

Financial Reporting Council - documenting 'principal risks' in Strategic Reports

I had recently spotted that the UK's Financial Reporting Council had issued draft guidance on the compilation of the Strategic Report for listed entities. This segment of a company's Annual Report and Accounts (currently called the 'Business Review') has been a rather ubiquitous and clunky affair regardless of industry, delivering little information to prospective and existing shareholders about how the company's risk profile, appetite, preferences etc. are catered for when executing its strategy.

Strategic reporting for UK companies 
- elimination of flannel?

Insurers have been prominent in efforts to improve this, though driven more by the need to pacify the FSA/PRA than by Parliament - see "risk appetite" break out from its box in  Aviva's AR&A between 2007 and 2012 for example - but the fact that a substantial piece of statutory reporting generally in the hands of executive management can potentially stray from the lexicon and structure of their increasingly professionalised Control Functions (and for banks and insurers, potentially their Internal Models), is clearly one that warrants some focus.

The Strategic Report will be compulsory content for Annual Reports and Accounts from October (Companies Act 2006 414C). The FRC's (non-mandatory) guidance regarding the incorporation of risk-related material into this section is to address the requirement on p2 that the Strategic Report;

...should include a description of the principal risks and uncertainties facing the company

The FRC's specific definition of Principal Risk is found on p35 of the draft guidance as;

A risk or combination of risks that can seriously affect the performance, future prospects or reputation of the entity. These should include those risks that affect the viability of an entity.

The draft guidance (p23) aims to tack on a few definitional aspects of how "risks and uncertainties" are reported in the context of strategy, most pointedly;

• [The risks] should be limited to those considered by the entity’s management to be the most important to the future development, performance or position of the entity. They will generally be matters that the directors regularly monitor and discuss because of their likelihood, the magnitude of their potential effect on the entity, or a combination of the two
• Principal risks or uncertainties with potential effects of such a magnitude that they may threaten the entity’s viability (ie its solvency and/or liquidity) should be explained fully and given due prominence
• Directors should consider the full range of business risks including commercial, operational and financial risks
• The descriptions...should be 
  sufficiently specific that a shareholder can understand why they are important to the 
  entity. This might include a description of the likelihood of the risk, an indication of when 
  the risk might be most relevant to the entity and its possible effects. Significant changes...

  such as a change in likelihood or possible effect, or the inclusion of new 

  risks, should be highlighted and explained. An explanation of how the principal risks and 
  uncertainties are managed or mitigated should also be included.
• 
  

  Where the risk or uncertainty is more generic, the description should make 

  clear how it might affect the entity specifically.

Prudential provide a good example here (from p72) of how this is currently done by an insurer - the fact that it is buried in 75 pages of 'Business Review' underlines why the streamlining of this work has become of statutory interest!

Interestingly, the FRC note that definition for "principal risks" has been developed/derived from previous FRC work, supplemented by work from the Sharman Inquiry - all of that therefore feels well divorced from anything produced by the IRM/Actuarial Profession/EIOPA around risk categorisation, and leads to the same bridging work I have been involved in previously; namely, reconciling how one manages and monitors risk within the business against what one reports externally. Might we have expected to see some kind of compulsory categorisation of "principal risks" in here that favours the financial services industry who arguably carry the largest set? 

Much of the other compulsory material in the Strategic Report (with exemptions) touches on other topical or sensitive matters such as;

• Inclusion of key performance indicators in the report ("...where possible, they should be accepted and widely used")
• Information on environmental matters, staff and social/community/human rights issues
• Information on gender splits at Board, Senior Management and All-company level

I may throw some feedback in to the FRC on this paper- comments welcome until late November. Externally, the main change for insurers will be trimming down some of the fluff and flannel already produced in the space. Internally, aligning the concept of "principal risks" with existing ERM programme/Internal Model lexicon may be a bigger job for anyone operating on a shoestring.

ABI Report on Board Effectiveness - board diversity

The ABI pushed out the findings from their research on board effectiveness, predominantly covering diversity, succession planning and board evaluation. The document itself will be available from tomorrow (the ABI press release link is the best I can do), but I had a look through an advance copy.

The purpose of the report is to focus on the three areas above that they believe "can help ensure an effective board and ultimately contribute to the success of the company", and they make a suite of best practice recommendations. Diversity is more on topic for me, as I suspect smaller insurers may struggle to meet any formal or informal quotas by 2015, while simultaneously meeting the Fit & Proper requirements of the management body under Solvency II, without padding out board with token non-exec female representation (and indeed the ABI allude heavily to tokenism in their advice).

The recommendations cover making the achievement of diversity a key objective when making appointments; stating steps taken to achieve it, and expanding on these in AR&A documents; widening the search for NEDs; developing more women throughout the corporate pipeline; and setting and reporting on objectives to promote gender and other diversity in companies.

I found that the advice is a little light and contradictory - while extolling the virtues of diverse boards, the ABI are against quotas for example, citing the likelihood of "two-tier" boards (two-tier, but better surely?). Norway is cited negatively, which is surprising, and the "marked increase" in 2011 female appointments does not appear to have been linked to two-tierism, despite the speed at which it has materialised pointing towards a "quantity not quality" scenario.

There are a couple of good bits covering attrition rates at FTSE 250 firms (smaller boards, lower attrition, and therefore should evidence their plans and objectives, rather than be obliged to artificially meet target level of gender diversity. They also show a good example of the problems on the hiring front, where one company was previously receiving almost exclusively male long lists for NEDs (now rectified by the recruitment firms voluntary code which requires 30% female representation on the lists).

Finally, a couple of amusing best practice examples - the Man Group and Mothercare are both cited for good work in this area. Coincidence, or does someone at the ABI have a sense of humour!

The $10m Chief Risk Officer - every little helps...

Cracking article on the (fiscal) rise to prominence in the USA - before you start pre-ordering Lambhorginis, this covers the headline money for the US "big banks". However the rest of this article is excellent, self-affirming stuff for heads/prospective heads of function, so I recommend a read (and perhaps forward it on to your board colleagues...)

In particular, when analysing the output required to generate that whopping pay packet, the article draws attention to ERM rollout as one of the gentleman's achievements - for $10m, that's got to be one shiny set of powerpoint slides!

In all seriousness, the comment regarding the CRO role being a training ground for future CEOs is a very interesting concept - I would very much like to know which company was implementing it, as certainly for the financial services industry, it is an incredibly sound idea.

Vince Cable speech at the ABI Conference

Always noce to get a steer from Government on future policy in the governance world (bearing in mind that, even with a coalition, it will get enforced quicker than Solvency II!).

Dr Cable in his speech to the ABI today seems to be fishing hard at the "voluntary" targets for improving gender diversity on boards (I believe if enough FTSE companies haven't declared by September we are probably looking at quotas). Executive pay and short-termism also feature high on the Business Secretary's agenda.