Governance flaws in UK financial institutions - complacency or one-offs?

Some very interesting bits released over the weekend which should prick the ears of the UK's banking and insurance entities like a corporate governance-driven piercing gun, hot off the back of last month's Co-operative Group scandal.

Governance structures
- unchallenged by Risk for too long?

Over at RSA, one of the UK's most venerable General Insurance, a house of horrors-style drama appears to be emerging. Starting with what looked like a serious, yet relatively modest, localised valuation issue over in Ireland has developed in short order into the straw which has broken the camel's back with regards to the tenure of the Chief Executive of the entire group - all off the back of a routine audit, according to one source, and perhaps not coincidentally breaking formally as a story one day after the announcement of enormous premium hikes in the country.

Astonishingly, one of the three men suspended at the Irish unit is also one of the biggest hitters in their national industry, being the current president of the Irish Insurance Federation. He was quoted in August thus (my emphasis);

I’m very optimistic about the future. The Irish Insurance Industry is robust, well capitalised, making a significant contribution to the economy and most importantly, delivering for customers.

While it is fair to say that the knives were already out for the Group CEO, who has presided over general bad news over the last year or so (this year's profit warnings one and two for example), to actually see a FTSE 100 insurer crippled to the point of fire sales to plug capital holes by such a matter is pretty remarkable, even if the geographical source of the pain is less surprising after Quinn went down actuary-less a couple of years back.

What's more, the interim CEO (who is pulling off the much-maligned Chairman/CEO double act for now, though was Non-Exec) has sanctioned a root and branch review of governance arrangements in the firm across all markets (cited here from an analyst call), quite an undertaking in itself bearing in mind its geographical spread.

It made me revisit the published feedback to EIOPA's preparatory guidance, where I had remembered that the feedback received from RSA was pretty caustic with regards to the appropriateness of EIOPA's guidance where it seemingly went above and beyond the Directive and Implementing Measures.

Pointedly in the context of this particular failure of their internal controls, they fed back extensively on the Fit and Proper requirements (p237), most of which centred around 'less is more', and emphasised the administrative burden such activity already causes. This is supplemented on p339 with a piece against the rotation of internal audit teams, both of which look discomforting in hindsight!

Reactions Magazine - CRO Risk Forum pullout (if they fix the link)

Some really nice pieces in January's CRO Risk Forum paper from Reactions magazine (you should be able to grab the paper from the link, but it does appear to be faulty at the time of writing).

A number of major CROs have contributed (Munich Re, Nationwide (US), Zurich, Scor), and they cover some juicy material on the Solvency II front, as well as some generic ERM matters and CRO role development. Pieces that particularly piqued my interest were;

Zurich's Lehmann on the role of the CRO

• Opines that, a decade ago, the CRO role was considered to be covered by the Chief Actuary in insurance undertakings
• Stresses that a CRO needs to have direct access to the CEO - though that did little for Paul Moore of course, or indeed as reported only last week, Michael Roseman at MF Global.
• Speaks supportively of the CRO Forum's Emerging Risk Initiative - strangely, as a subject so fluid and topical, the section of the website dedicated to this is sparser than my hairline!
• States that "...advanced companies have a risk function that defines the risk strategy and clearly sets risk appetite limits" - this is a pretty breathtaking thing to say, which I can only assume has lost something in interpretation, as the question it responds to relates to underwriting. In the context of my last post on Risk Appetite, I would never see myself as a second line function setting the limits of risk appetite.
• States that "[A company's ERM Framework] defines its risk culture" - hate to go all 'chicken and egg', but would a company's risk culture not determine their ERM Framework requirements?
• Tries to associate the Insurance industry's relatively safe passage through 2008-2011 on ERM advances, where I would be more inclined to attribute much of it to the 'unique features' of the industry that the CEA like to bandy around when lobbying for SIFI exemptions".

Nationwide's Mahaffey on the USA's new CRO Council

• Emphasises that the US-version of Europe's CRO Forum is not just dedicated to Solvency issues ("at the cost of engaging with other issues"), citing ratings agencies, emerging risks and federal/international developments as other agenda items. I suspect the European guys may find that snipe slightly harsh, regardless of Solvency II being the big fish right now.

RSA's MacDonald on ORSA

• Talks throughout interchangeably about ORSA process and ORSA report. Doesn't help when he goes on to state "Identifying who owns the ORSA is of primary importance" - Articles 44 (4) and 45 (1) would tend to identify the process owner, but the unconcentrated chatter in the Level 3 doesn't uncontrovertably assign document ownership (or indeed what the significance of "owning" the ORSA Report may be). 
• Piece on alignment with internal strategic or operational planning process very sensible - no point in shifting dates which are probably carved in stone, if you can fit the ORSA process around them
• Identifies most of the company bar the tea lady as 'stakeholders' for engagement - I suspect there are that many customers/end users of the output, but frankly most could make themselves scarce during process construction and not be missed.

Scor's Trainar on Solvency II progress

• Suggests that Solvency II in its entirety should "...bring enterprise risk management in the industry up to standard" - doesn't quite tally with his CRO Forum colleague above, who seemed to think the standard helped keep it afloat during the crisis!
• Worried about the size of the Solvency II challenge should it be served up "...with a heavy and indigestible bureaucratic sauce" - truly sparkling wordsmithery!
• States that "Solvency II is an excellent micro-economic reform but a mediocre macro-economic one" - hence the delay mon ami!

Towards the back are a couple of nice case study/example pieces which you might enjoy from a benchmarking perspective.

Implications of financial regulatory reform for the insurance industry - IIF and Oliver Wyman Paper

I managed to get a good look at the paper reported widely last week on how Basel III and Solvency II appear to have conflicting end-games, which could prove calamitous for banks should there not be at least some cognisance of each other's ambitions - thanks a bundle to the guys at Oliver Wyman for sending me a copy gratis (just fill in the form here to get your own, much trickier from the IIF website).

More important to note the additional lobbying angle and indeed the people behind it (Zurich's CRO and Swiss Re's CEO appear to be prominent in the IIF's insurance working group, with Allianz and Aviva also participating), rather than the minutae of the report (which is less than 30 pages regardless).

It of course points out the folly of EU government debt being "risk free" in the current environment, but also shows the differing capital requirements for corporate bonds in the NAIC, Basel III and Solvency II approaches, highlighting how relatively onerous long-term corporate debt will in terms of capital consumption, despite the fact that long-term bonds are ideal from an ALM perspective for many insurance products.

FTSE Insurers - last interim result (I think!) and Solvency II progress

Resolution/Friends Life, the darlings of the disclosure world, released their half year results today (there is a location check on the way through on this URL, but don't be put off, it's a Guernsey thing!). This of course compliments the other FTSE Insurers' releases which I have blogged on previously.

As ever, Resolution are very forthright on most aspects of their raison d'etre, including Solvency II preparations - they note the following;

• "The implementation of the EU Solvency II Directive continues to be a key focus of attention for the Group...Friends Life group is closely involved with the industry in lobbying on key areas where uncertainty remains"
• £24 million of cost booked in respect of Solvency II and finance system developments, complimented by "overall [Solvency II] implementation programme is on track against its plans and budget" 
• "the Group believes that [Solvency II] will have a favourable capital impact on the Friends Life group relative to current Pillar 1 solvency requirements"
• "Disappointingly, there is a lack of clarity on the final position with respect to Solvency II, and the implementation date looks likely to be delayed" - no commitment on date, unlike some of the others
• “participated in the EIOPA stress test exercise” and are “closely engaged in the development of the tax proposals including any changes arising as a result of Solvency II”.
• "The Group has been accepted into the FSA’s pre-application process"
• "Providers, in anticipation of the higher capital requirements under Solvency II, have been adjusting their pricing which is leading to increasing margins." reinforced later specifically on annuities
• Solvency II considerations down as a "key driver" in the context of the cash generation result - presumably in the context of how much they can pay away and how much must be retained, though I could be wrong
• German product range directly affected by "the impact of Solvency II [which] is expected to limit market participants' ability to provide traditional with-profits product offerings."

The comment that "The Group assesses strategic developments and opportunities on a Solvency II basis" was perhaps the most fascinating part - how you do this without clarity on the suite of transitional measures, Omnibus II elements etc is beyond me.

As a post script, Phoenix also posted interims, albeit a little later than the others - again, a lot of disclosure on Solvency II, quotes as below;

The Group remains actively engaged in supporting the development of Solvency II through industry consultation and participation in FSA and ABI industry forums. 

Both the European Council and the European Parliament have proposals to amend the timescales for the implementation of Solvency II and there appears to be growing political momentum towards delaying full implementation until 1 January 2014. At the present time however, there is no certainty that this will happen and the Group continues to plan for implementation on 1 January 2013.

The Group remains on track to deliver an approved partial Group internal model and has been accepted into the FSA internal model pre-application process following the submission of the pre-application process qualifying criteria template in 2010. In respect of the resources the FSA will devote to the pre-application process it has stated that it will concentrate on a small population of firms representing a significant market share and which it regards as having the highest potential impact on its objectives. The Group is included in this category and remains in continuous and constructive dialogue with the FSA.

The Group's actuarial IT systems transformation project will deliver a single actuarial modelling platform across the business, transforming modelling capability and efficiency and underpinning development of the Solvency II internal model and Own Risk and Solvency Assessment.

"We continue to target full Solvency II readiness by the end of 2012.Our Internal Model Self Assessment Template has been approved by the FSA and we are on track to meet the Internal Model Application Process date of 1 April 2012."

On 23 March 2011, HMRC issued a technical note on 'Solvency II and the Taxation of Insurance Companies' outlining changes to the taxation of UK insurance companies with effect from 2013. The Group has been actively involved in consulting with HMRC and HM Treasury on the detail of the new rules, with the aim of ensuring that the Group's policyholders and shareholders are as far as possible not adversely affected by the changes.

The consultation process is still on-going in relation to certain aspects of the new rules, and as a consequence of this and the complexity of the proposed changes it has not been possible to estimate their potential future impact on the deferred tax balances shown in these interim financial statements. Draft legislation is expected in the second half of the year and its estimated impact on the deferred tax balances will be considered and disclosed in the year end financial statements.

FSA - Operational Risk Framework enhancement consultation for banks

Consultation alert! Anyone who likes their operational risk benchmarking and best practice will want to give this document released today their attention (divided though it may be by being Bank-oriented).

Whilst "the aim of this guidance is to assist supervisors in assessing and challenging firms' documentation and the way it is managed" as well as to "help Operational Risk functions at firms to meet the standardised approach requirements for operational risk", it actually reads like a best practice list which, in the shadow of Basel's efforts last week, is worthy of the attention of the insurance industry. My take was;

• Heavy on document maintenance (definition/descriptions/formula consistency)
• "Good practice" to map SYSC/BIPRU references to op risk documentation "on a periodic basis"
• Firm wide terms of reference, naming conventions and mutual references in documents noted as "good practice"
• Created 3 tiers of a "possible document hierarchy" which could be linked together in a firm-wide documentation map
• "Good practice" to implement controls around documentation ownership, and a central register of all documentation "could be practicable"
• Very unwieldy list of categories recommended for the document register
• "Recommended" that firms identify all policies and documents that are critical to the operation of the firm
• Practice of sticking revised documents on shared drives/intranet pages actively smacked down, advocating a proportional approach ranging from memos to formal training workshops
• Advocates KRIs (or KCIs, which was a new one on me!) for documentation monitoring - I actually quite liked their suggestions
• Recommends that firms meet a "use test" for documentation

Not seeing exactly how any of this might transfer over to the Insurance industry, but it doesn't augur well for anyone without SharePoint!

Swiss Re World Insurance in 2010 sigma study - no love for Solvency II

Swiss Re have pushed out their World Insurance trends research - expect to see it cited from pillar to post, as it is an exceptional body of work, with a whole host of uses (benchmarking, strategic planning and risk monetising as a minimum).

I have just kept an eye on the Solvency II aspects - references were as follows;

• Higher capital requirements for long-tail business and "overly stringent" capital requirements noted as a challenge which could undermine profitability
• "Onerous" capital requirements deriving from Solvency II could harm policyholders and economic growth
• Life companies will be "forced to shift assets into less risk asset classes"
• "Stricter solvency regulation (Solvency II) and higher capital requirements will be implemented by ratings agencies going forward"
• "Positive step" of Solvency II nullified somewhat by the tightening of "key parameters" since the credit crisis, leading to (potentially) higher capital requirements for "the most important life insurance products"

All in all, pretty negative as far as the predicted impact of Solvency II in its current form on the future of the insurance industry. Fair?

Insurance SIFIs - Metric ideas from the AAA

Spotted this, and it looked intriguing - American Academy of Actuaries proposing metrics "regarding size, interconnectedness and risk assumption" to assess whether insurance companies are systematically important - the AIG angle still seems to be driving this desire (resisted by almost every insurance lobbying group) to include a couple of insurance giants in the SIFI pot. I haven't looked for the paper itself, so google away if you are hot on this topic!

The second notable point here was that a "voting insurance expert" has beeen elected to the Financial Stability Oversight Council - not sure if that increases or lessens the likelihood of some insurers being captured as SIFIs.

Accenture Global Risk Management Study 2011 - talking points

A rather lavish piece of research from Accenture on developments in using risk as a source of competitive advantage was pushed out yesterday - All industry version here, with Insurance-specific report here.

Solvency II doesn't really feature in the global study (which covered just under 400 risk execs), but some aggregate trends are worth noting (observations against their 2009 survey);

• Increased likelihood of execuitve-level oversight of the risk function
• Increased concern about coverage of the spectrum of risk (types and severity coverage)
• Almost half of respondents had "reducing costs" as one of their main challenges in next 2 years
• Vast majority have either a CRO or an executive with Risk responsibility
• Majority of medium term spend seems to be focused towards data and technological improvements
• 40% have responded that regulatory risk will be "significantly increasing" in next 2 years
• Integration of risk measure capture and use across busienss areas particularly poor (most categories of risk were under 50% rated as "highly integrated across business units".
• Some lareg gaps between the importance of the risk function's objectives against their achievement (worryingly large on the matter of ensuring sustainability of future profitability)

For Insurance-specific, I noted the following (around 50-odd companies by my count);

• 80% of respondentshave ERM program in place or in planning
• Top risk executive reports to CEO in almost 90% of respondents (a truly horrifying statistic, and the highest of all industries) 
• 81% of Life company respondents felt regulatory pressure is creating an increasing gap to achieving compliance
• 54% have a CRO who owns responsibility for Risk in their organisations (surely a massive no-no under Solvency II)
• Integration of Finance and Risk and improving reporting capabilities on risk-adjusted performance management are the highest Life company priorities for improving capabilities.
• To achieve "Risk Mastery", a rather anodyne list of enhancements are depicted - invest in analytic tools, integrate risk and finance, improve approaches to fraud and financial crime and leverage compliance initiatives (such as Solvency II I guess, though I wouldn't call it a compliance initiative!)

They create a sub-category of "Risk Masters", whose risk management capabilities are assumed to be superior to the crowd - these are the component parts of "risk mastery";

1. Creation of shareholder value from Risk Management
2. Risk Management involved in key decision making process
3. Improved sophiostication of measurement, monitoring and analysis
4. Going beyond a compliance mindset
5. Integration of risk management capabilities across business units and structures
6. Establishment of a "c-suite" role for Risk
7. Infusion of "|risk awareness" across the organisational culture
8. Investment in continuous improvement

Risk masters (around 40 of the respondents qualified) either have or are in the process of establishing ERM programs, and tend to use their Risk function outputs to achieve quantifiable business objectives considerably more than the pack. They also had significantly higher scores for having "highly integrated" risk measure capture and usage across business units (including using these measures in their decision making process), and the majority participate in most areas of the strategic decision making process.

Interestingly, almost 90% of Risk Masters said that they are active in influencing risk regulation in their relevant industry - Solvency II anyone?

Equivalence, captives and Solvency II - different strokes...

A subject close to my heart as a Manxman, I keep an eye on equivalence-related material, and this has been a relatively busy week. Guernsey have had a nice soiree in London to emphatically support their captive industry by confirming there would be no Solvency II equivalence sought.

For a captive-heavy country this makes sense - Ireland (who like a bit of captive themselves) have been prominent in catering for some element of proportionality at national level, and at a Solvency II presentation in the Isle of Man (where we are also partial to captives) in November 2010, the locals were equally vociferous on the problems it could cause them, so were delighted to hear that equivalence was not on the agenda.

This contrasts to the Bermudans, who are seemingly happy enough to trod the path to equivalence as early as possible. However, there seems to be a desire for a specific carve-out to put some meat on the bones of the proportionality concept which, at this juncture, is most certainly not a given.

Four captive-loving islands, four different approaches - whoever's approach is ultimately victorious, I hope it is for the right reasons.