InsuranceERM round table on Solvency II and Capital Management

Nice freebie from the InsuranceERM guys, covering a CRO/ERM Head roundtable touching on economic capital, internal models and Solvency II - the first of this double header is here. With representation from from all sides and sizes of the insurance industry spectrum, the views tabled should be useful for most practitioners in this space, even if some of it is not exactly new news.

They are relatively benign on controversial areas such as industry cost, and even positive when talking of Solvency II having provided an incentive to improve both risk and model governance in the here-and-now, regardless of the necessity from a pure compliance perspective.

Between the two, the following noteworthy views were tabled;

On Solvency II

• "...has to be considered now if, not necessarily when"
• "...from a non-life risk and capital perspective, Solvency II just does not work" - citing reserve risk specifically as inherently flawed 
• The UK's ICA+ regime "...pushes [Solvency II] back towards a more sensible view of capital"

On Internal Models

• "The main issue with the models is spurious accuracy and detail masking big assumptions, which is possibly a systemic risk"
• Regulators in some European countries think internal models are "unnecessarily complicated"
• In response to the suggestion that internal modellers could be "gaming the system" to reduce capital requirements regardless of risk profile, Aviva's ERM head noted that the FSA have identified through their own research that the ICA regime appeared to have done just that back in 2004
• It is "...inevitable that [the Bank of England wearing their PRA hat] is going to take a far more sceptical view of internal models", particularly where Internal Model SCR is lower than Standard Formula SCR
• On Use Test, "...potentially 3 or 4 years before the model is truly bedded in"

On Ratings Agencies and their capital requirements to maintain target ratings

• "...many people, especially in Bermuda, see ratings agencies as de facto regulators"
• "...may take internal models less seriously in the short term" off the back of Solvency II
• Ratings agencies capital requirements are "the worst common denominator" alongside SF SCR and IM SCR

I've personally been relatively well shielded from the extent of the discontent on the non-life side, but judging by the confidence intervals used by high profile insurers as their EC targets (frequently observed at 99.9-something/A or AA rating space), it's no surprise that ratings agency requirements are in many cases paramount - that business could potentially be dragging three or four capital measures to their respective Boards for the next 3 years (agency capital, IM SCR, ICA and SF SCR) is a grim prospect.

Perhaps of more immediate concern is the view that the FSA/PRA have the potential to be more cantankerous around internal models once they move into their new office - something to look forward to in 2013?

Chartered Institute of Internal Auditors - recommendations for UK financial services

The Chartered Institute of Internal Auditors recently created a sub-committee to provide professional guidance "...designed to be a benchmark for effective internal audit in financial services in the UK", and they have just reported back with this feast of fun, which is a vital read for anyone working in control functions within financial services. The opinions they have used to create this guidance have been purloined not only from the profession itself, but also from other professions, regulatory bodies and executive/non-executive directors

They note in summary that there is "strong support for an unrestricted scope for internal audit", while drawing attention to disparity of opinion around matters such as: IA directly challenging strategy; IA reporting to Risk Committees (rather than audit committees) in certain instances; compulsory attendance of Chief Internal Auditors at Executive Committees; and the direction of managerial reporting lines.

The proposed guidance reads very much like the Corporate Governance Code, and is relatively light. It is broken into the following sections, where I have noted anything I found new or controversial alongside (my focus being predominantly scope creep into the Risk function's activity):

1. Role and Mandate of IA - increased focus on risk assessment and risk coverage adequacy
2. Scope and Priorities of IA - unrestricted scope ultimately advised; expected to "independently determine" key risks, and assess "the setting of, and adherence to, risk appetite"; assess the "risk and control culture"; allows for potential involvement of IA on "real time basis" in key corporate events (mergers, disposals, new lines of business etc)
3. Reporting results - factors in reporting obligations to both Risk and Audit Committees where appropriate, and builds in an expectation of an annual independent assessment of governance (which covers off one of the FSB's recommendations covered yesterday!)
4. Interaction with Risk, Compliance and Finance functions - nothing new
5. Independence and Authority - Chief Internal Auditor expected to be executive committee-equivalent, have the right to attend Excom, access to all MI, and report directly to either the Chairman of the Board, Audit Committee or at a push, Risk Committee. A secondary line to an executive director should only go to CEO
6. Resources - all resourcing decisions effectively divorced from the business, to reside with the Chief Internal Auditor and the Audit Committee
7. Quality assessment - external assessment of the function recommended periodically.
8. Relationships with regulators - nothing new
9. Wider considerations - expectation that the "tone at the top" of a firm should be what fosters acceptance of IA

Any controversy? Perhaps around the seniority of the Chief Internal Auditor, and their assessment of the setting of and adherence to Risk Appetite. I think my main concern as a risk practitioner would be the potential for differences of opinion around what constitutes "adequate" risk management, given the Internal Audit predeliction for COSO on all things risk-related, against the IRM or ISO31000. 

Let battle commence?