System of Governance - EIOPA's FINAL preparatory guidance for national supervisors

Based on feedback received since their initial consultation paper was released, EIOPA make the following generic clarifications/statements in the preamble of their guidance doc for System of Governance preparations;

• That proportionality will not be defined or presented as examples in the guideline text (p5-6)
• That NCAs are "expected to...review and evaluate the quality of the information provided to them" - bad news for the PRA, who were clinically uninterested in reviewing Solvency II reporting attempts according to one blogger (p6)
• The emergence of a new ORSA acronym, "FLAOR", which looks more like something an amused teenager would write on Facebook (p6)
• The expectation that 2015 will see submissions of (2014) ORSAs to NCAs (p7)
• While there is no generic take on what enforcement action should take place in this interim period, firms are expected to (a) Discuss any negative findings from their ORSA/Governance systems with their supervisor, and (b) To produce SCRs using information of appropriate quality. Enforcement action in the absence of this WILL NOT consist of capital add-ons, apparently (p7)
• That the submission date calendar for all of the information expected will be reviewed at the end of this year, so that EIOPA can take Omnibus II progress into account (p8)
• That the explanatory text in each set of guidance is NOT part of "Comply or Explain" (p9)
• That the reasons behind a negative "Comply or Explain" decision from any country will be kept secret as standard (p10, and disgraceful, frankly).

They then go on to focus on some of the larger bones of contention within the 52 guidelines provided. The following generic points stand out for me as a practitioner;

1. There is almost no discernible movement in EIOPA's position, even after a volumous lobbying effort;
2. That explanations for the inclusion of contentious content are generally forthcoming, though on a number of occasions, flimsy;
3. That planning for 2014 full-year mothballing of Solvency II programmes is not an option, particularly for ICAS+ candidates - some may get away with a few months of inertia, depending on the quality of their paperwork (strategies, policies, process guides/maps, terms of reference, charters etc).

The following supporting arguments for EIOPA's final view were, in my mind at least, poorly formulated, regardless of whether the end result is still agreeable;

3.48 (Guideline 6)

- Refused to add more definition around what constitutes a "significant decision", which is poor form.

3.58 (All of Chapter III)

- That the expectations of Risk Management in insurers  "...comprise risk management standards which are considered to be matter-of-course and wide spread activities" - extraordinarily loose, considering the lack of a majority-accepted global, or indeed pan-European standard on the subject (IRM/ISO/COSO/FERMA/FSB's efforts notwithstanding)

3.65 (Guideline 19)

- That, while it is "not an easy task", Operational Risks should be quantifiable, and therefore subject to tolerance limits - I don't think it would have hurt to suggest (or even compel the use of) a method if it is that difficult.

3.68 (Guideline 25)

- That firms should maintain Investment Risk-related KRIs outside of what might be provided by normal parties (for example, ratings agencies), which would help "...increase overall risk management" - not entirely convinced that a generic "increase" is any kind of worthy ambition. 

3.74 (Guideline 31)

- That a capital management policy and capital management plan is both necessary (though for not entirely convincing reasons when tying back to the Directive)

3.78 (Chapter VI [Internal Control])

- That there is already plenty of clarification on what the Compliance function is charged with. I would agree in principle, but have heard evidence to the contrary in practice.

3.81 (Chapter VII [Internal Audit])

- That they neither wish to mandate or discourage rotation of Internal Audit staff or whistleblowing direct to NCAs - in which case, why mention it!

3.110
- A bizarre comment in response to a suggestion that a public statement should be released by the AMSB annually regarding the discharge of responsibilities around the system of governance that the Directive "...only deals with internal governance, not corporate governance" - think I know what they are fishing at, but terribly worded.

3.144
- Justify their decision not to define risk appetite and risk tolerance in the context of these guidelines

They have however provided some more defendable clarifications, for example;

3.51 (Guideline 11)

- Clarified that the gold-plated "Fit and Proper" requirements apply to AMSB/Control Function staff only, as well as specify what is expected from Outsourcers.

3.57 (Chapter III [Risk Management])

- That in the context of separating the duties of the Risk and Actuarial functions, the Directive is abundantly clear and that undertakings "...cannot deviate from [the Directive's] distribution of tasks"

3.62 (All "Policy"-related guidelines)

- That efforts should be targeted towards drafting the required documents during the preparatory phase. I would imagine this would be "re-working" in the UK, where such activity is most probably long done.

3.67 (Guideline 19)

- That there is no compulsion for firms to operate an electronic database to store operational risk events

3.85 (Chapter VIII [Actuarial])

- That, regardless of the absence of a valuation framework for TPs, the processes behind their co-ordination and calculation justify early activity, rather than "wait and see" on Pillar 1.

3.124
- Regarding Op Risk, activity will have to include "...identifying all operational risks that have crystallised and their near misses" (my emphasis)

Relatively easy in summary then - if it was a gap/issue in your system of governance in March, it probably still is, so go and fix it!

Financial Reporting Council - documenting 'principal risks' in Strategic Reports

I had recently spotted that the UK's Financial Reporting Council had issued draft guidance on the compilation of the Strategic Report for listed entities. This segment of a company's Annual Report and Accounts (currently called the 'Business Review') has been a rather ubiquitous and clunky affair regardless of industry, delivering little information to prospective and existing shareholders about how the company's risk profile, appetite, preferences etc. are catered for when executing its strategy.

Strategic reporting for UK companies 
- elimination of flannel?

Insurers have been prominent in efforts to improve this, though driven more by the need to pacify the FSA/PRA than by Parliament - see "risk appetite" break out from its box in  Aviva's AR&A between 2007 and 2012 for example - but the fact that a substantial piece of statutory reporting generally in the hands of executive management can potentially stray from the lexicon and structure of their increasingly professionalised Control Functions (and for banks and insurers, potentially their Internal Models), is clearly one that warrants some focus.

The Strategic Report will be compulsory content for Annual Reports and Accounts from October (Companies Act 2006 414C). The FRC's (non-mandatory) guidance regarding the incorporation of risk-related material into this section is to address the requirement on p2 that the Strategic Report;

...should include a description of the principal risks and uncertainties facing the company

The FRC's specific definition of Principal Risk is found on p35 of the draft guidance as;

A risk or combination of risks that can seriously affect the performance, future prospects or reputation of the entity. These should include those risks that affect the viability of an entity.

The draft guidance (p23) aims to tack on a few definitional aspects of how "risks and uncertainties" are reported in the context of strategy, most pointedly;

• [The risks] should be limited to those considered by the entity’s management to be the most important to the future development, performance or position of the entity. They will generally be matters that the directors regularly monitor and discuss because of their likelihood, the magnitude of their potential effect on the entity, or a combination of the two
• Principal risks or uncertainties with potential effects of such a magnitude that they may threaten the entity’s viability (ie its solvency and/or liquidity) should be explained fully and given due prominence
• Directors should consider the full range of business risks including commercial, operational and financial risks
• The descriptions...should be 
  sufficiently specific that a shareholder can understand why they are important to the 
  entity. This might include a description of the likelihood of the risk, an indication of when 
  the risk might be most relevant to the entity and its possible effects. Significant changes...

  such as a change in likelihood or possible effect, or the inclusion of new 

  risks, should be highlighted and explained. An explanation of how the principal risks and 
  uncertainties are managed or mitigated should also be included.
• 
  

  Where the risk or uncertainty is more generic, the description should make 

  clear how it might affect the entity specifically.

Prudential provide a good example here (from p72) of how this is currently done by an insurer - the fact that it is buried in 75 pages of 'Business Review' underlines why the streamlining of this work has become of statutory interest!

Interestingly, the FRC note that definition for "principal risks" has been developed/derived from previous FRC work, supplemented by work from the Sharman Inquiry - all of that therefore feels well divorced from anything produced by the IRM/Actuarial Profession/EIOPA around risk categorisation, and leads to the same bridging work I have been involved in previously; namely, reconciling how one manages and monitors risk within the business against what one reports externally. Might we have expected to see some kind of compulsory categorisation of "principal risks" in here that favours the financial services industry who arguably carry the largest set? 

Much of the other compulsory material in the Strategic Report (with exemptions) touches on other topical or sensitive matters such as;

• Inclusion of key performance indicators in the report ("...where possible, they should be accepted and widely used")
• Information on environmental matters, staff and social/community/human rights issues
• Information on gender splits at Board, Senior Management and All-company level

I may throw some feedback in to the FRC on this paper- comments welcome until late November. Externally, the main change for insurers will be trimming down some of the fluff and flannel already produced in the space. Internally, aligning the concept of "principal risks" with existing ERM programme/Internal Model lexicon may be a bigger job for anyone operating on a shoestring.

Towers Watson - 'Risk Appetite revisited' (did we ever leave it?)

I have been doing a little work on Risk Appetite in the background recently, so was intrigued to have a read through this recent release by Towers Watson on the subject, seemingly targeted at North American and UK markets, but relevant to any practitioner in this space. Somehow I wasn't put off by p6 when, in response to the hypothetical question 'What is Risk Appetite', they responded with, "...we do not want to focus too much on the issue..."!

Appetite - second helpings?

I had blogged earlier this year on Risk Appetite, covering the expectations of EIOPA on the matter (which are few), as well as the more pokey/proddy stakeholders like the PRA/Central Bank of Ireland/S&P (which are several!), so the backdrop of risk appetite's practical significance to insurers doesn't need to be repeated here, more how consultants and practitioners are improving their game on the ground. Worth noting here that a few of the other consultancies have proffered their two cents on the matter over the last year or so (here, here, and here).

While interest in 'risk appetite' is currently piqued at governmental level thanks to the forensic examination of the banking industry's failings (multiple references in Parliamentary Commission evidence here and here for example), the driver of activity in the UK and Ireland is predominantly from the regulatory compliance perspective rather than expectations of bespoke, strategy-driving activity. In addition, we now see the emergence of Internal Audit as a party with a vested interest in the matter, which has the potential to draw the subject even more to a tidy, but ultimately superfluous documentation exercise.

With that in mind, Towers note that this paper is focused on "...enhancing risk appetite by improving its articulation, via clearer linkages to mission and strategy", and a rather derisive tone is therefore applied throughout regarding the familiar quantification methods preferred by regulators to monitor likelihood of insolvency in the next 12 months, giving equal billing to non-monetary capital and qualitative measurements. The paper also crosses some familiar ground, such as a lack of consistent terminology, which it tries to address (below).

Oddly, the document does not reference the FSB's thematic review of risk governance earlier this year, which will surely drive efforts in this space in the medium term, if only due to the paucity of certainty on the subject. That the FSB believe that regulators have "more work to do" is striking, and while they also bemoan the lack of common terminology, they don't let that prevent them from offering definitions of their own, as well as listing their "Key features" of a Risk Appetite Framework.

More obvious statements

• "..clearer linkages are needed to mission and strategy for risk appetite to be effective"
• "risk appetites must include boundary constraints"
• "We suggested that greater clarity around the definition of risk is needed..."

Definitions

• Risk - "In this context, risk should be defined in terms of those events and circumstances that may result in an insurer failing to deliver on its mission."
• Risk appetite - "...the manner in which a company expresses an identified set of risk-trading opportunities, and sets boundaries on its risk-trading among those opportunities, aligned with successfully delivering on its mission."
• Risk strategy - "The company’s risk strategy articulates how risk fits with the mission".
• Risk tolerance - "Risk tolerances are a quantitative extension of the risk strategy...risk tolerances must be measurable...[and] place quantitative boundaries on the company’s strategy"
• Risk limits - "Risk limits are more granular tolerance levels expressed for specific risk sources, business units, and/or products that are used to implement the risk tolerances."
• Risk appetite statement - "...risk appetite statements should be taken as the combination of risk strategy tolerances and preferences, bringing together qualitative and quantitative enterprise perspectives on risk as both opportunity and threat."
• Mission - "mission is the insurer’s unique multi-period and multi-stakeholder value creation proposition."

Technical suggestions

• They promote four facets of risk assessment: size, likelihood, impact and significance.
• For those working on statement content, they recommend "...since published mission statements can be fairly terse, the risk appetite may need to look beyond the explicit elements of the mission and consider elements that are implicit." Instinctively that feels unfair, but I guess the world of implicity is one for the second line to inhabit, while the first line concentrate on value-adding.
• Concept of adaptive buffers sits nicely with me - the most visceral ones being economic capital and reinsurance/hedging/liquidity facilities, but TW attempt to expand that over qualitative areas of the risk appetite statement
• Risk preference ranking of 0-4 depicted at the back is a handy schematic

Sore points

• "Some take the view that risk appetite can be expressed as a single metric, or perhaps a small set of metrics, that capture the organisation’s willingness and ability to bear risk." - that 'some' would include the FSB, COSO, the Central Bank of Ireland and the IRM, so I wouldn't be too sniffy at efforts to-date
• "Much of the work to-date on risk appetite statements has been driven by solvency supervision requirements, many statements tend to focus primarily on potential losses of capital"- a natural and by no means unwelcome by-product of having regulators in the box-seat, as opposed to stakeholders combining their efforts to establish compulsory risk appetite statement content?
• "While most insurers have, by now, developed risk appetite policy statements and discussed them with their boards, many have expressed dissatisfaction with the exercise" - that feels a rather loose statement, and if true says more about the personnel charged with performing the work.

I'll take a look at the diversity of definition in the risk appetite space across different bodies in a separate post - for now, just enjoy this tidy piece of work for what it is.

Deloitte on 'regulatory uncertainty in Europe' - embedding a new modus operandi (?)

In a wonderful example of predicting the present, Deloitte have released a white paper (sign-up required) giving their take on regulatory uncertainty in the European insurance industry, and how the volume of new regulations (and their inability to land on time) is driving emerging best practices in the consideration of regulatory risk at Board level.

New Modus Operandi - alloy wheels optional?

Of course, it is always best to wait for such matters to emerge before proselytising, and the current cup of omni-postponed over-elaborate regulations is running over (Sol II, IFRS 4 Phase II, FATCA, etc), naturally causing difficulties for all those responsible for preparing for them, as well as the execs who take the topics into the boardroom every quarter, only to say "it's been delayed again, can I have more money"...

From my perspective, it was particularly interesting to see that proactivity is recommended regardless of nature/scale/complexity, bearing in mind the first time I spoke to a Board of Directors at a tiny insurer regarding Solvency II preparations was in 2009 - only consultants could comfortably suggest that an new executive-level role is established, and Board agenda time is regularly set aside, only to explain the latest delays in multi-jurisdictional regulations (I certainly know what my old CEO would have said to that!)

That aside, they suggest that two major problems need to be overcome; that few insurers have a single view of regulatory risk; and that regulatory insight is poorly represented in the strategic workings of insurers, both of which are easy to agree with purely on circumstantial evidence.

Whilst this frequently reads like a paper written to justify bringing consultants in to compensate for failing in risk and compliance professionals' armoury, Deloitte make the following noteworthy assertions/recommendations in it;

Trends

• That most insurers prefer to 'wait and see' rather than be 'first mover' when it comes to regulatory preparations - after the Solvency II experience, does that surprise anyone?
• That "...Deloitte's view is that regulation can be regarded as a 'structural' driver of the insurance industry"
• That "...Deloitte's considers a regulatory dividend can and should be sought", which is not necessarily my experience of consultancies when on site, who (presumably for legal reasons) prefer to promote a gold-plated complaince approach to regulation-driven projects.
• Cost of compliance is now materially diluting return on equity in EU insurers
• That Conduct Risk is likely to become high profile across Europe over a longer period of time than its current flavour of the month feel, thanks to IMD2/PRIPS/MIFID
• National regulators are increasingly impeding on day-to-day running - examples given (all of which have a whiff of IMAP requirements about them), include documentation improvements and influencing risk appetite/capital allocation work.

Costs and volume

• Regulation prep cost the European insurance industry €4.2-€4.7bn in 2012 - they go on to expand that to €8.1-€9.2bn over the last 3 years.
• UK industry will be subject to 29 new pieces of legislation of the next 5 years (surprisingly lower than the French at 35, and the Germans at 32!)
• That the "cost of doing nothing" while waiting for regulatory clarity may be significant - as significant as consultancy spend preparing for something which never arrives perhaps?
• That compliance functions are naturally struggling to cope with the current volume of initiatives

Solvency II-specific

• They extrapolate an estimated €550m cost of Solvency II compliance preparations in 2012 into a €1.5bn-€1.8bn 'top 40 insurers' number, and a €2.4-€2.9bn figure for the whole industry - feels a bit light, bearing in mind 'UK plc' must have done the best part of £1bn on Solvency II alone in 2012.
• They quote one strategy director as saying that "Solvency II is killing European M&A..." - p10

Their recommendations (from p19) are too woolly in aggregate to help a normal practitioner - they are probably targeted more towards programme directors and managers - but the recommendation  to establish a Regulatory Assessment and Response Executive with a suitable remit is a smart idea, even if from a practical perspective this might need to either be balled in with the responsibilities of an existing executive, or only be a mid/senior management role, in smaller companies. 

These recommendations also include the marvellous suggestion to "embed a new modus operandi" - an expression normally reserved for profilers of serial killers, and perhaps the hardest sell since Isle of Man beach holidays.

PS I apparently missed the memo where the oft-ridiculed speech of Donald Rumsfeld used to support war against Iraq became de rigeur in risk management/insurance white papers. If there is one "known known" in this world, it is that I will never use that expression on the job!

Omnibus II Plenary delayed until March 2014 - 2016 out of the question?

Confirmation was provided today, if needed, that the Omnibus II Plenary vote was being pushed back into 2014 - that it needs until March 2014 perhaps underlines the swell of discord at the trilogue table, all of whom have seemingly been digesting EIOPA's long term guarantees report for, well, a long term...

Solvency II Spuds - hoofed

While July and August naturally died a death while the Eurocracy topped up their tans, any thoughts that compromise and camaraderie were on the various parties minds can now be unequivocally hoofed in the spuds, as can any notion of January 2014 being a meaningful date for anyone aside from EIOPA, its national satellites, and the 'soft launch' we have seemingly acquired.

A few of the Big 4's rather underemployed Solvency II experts have commented today on this latest delay and the rammifications, which contrasts against the optimism shown yesterday on Risk.net  by Insurance Europe in particular. I guess what is particularly disappointing is that the ITER listings haven't changed in respect of Omnibus II before and after the summer break (here and here), so why wasn't something said earlier?

I had already blogged on the shifting sands before the summer break, and the stance of BaFin in particular, and it would appear a market analyst sees the German approach (including an uncited reference of a desire for 20 year transitionals) as being a genuine show stopper, rather than a mere irritant.

That may be a touch dramatic, but by shifting the Plenary vote to March, when retiring/deselected MEPs will be on autopilot, and careerists will be electioneering (indeed, Primary activity starts before the end of 2013), is the trilogue's hope that this might squeeze through via fatigue-inspired lack of inquisition? Does the alternative of a fresh crop of politicians picking holes in the work of technical experts from summer 2014 bear thinking about?

Finally, with Sr. Bernadino having already pronounced that 2016 would not be viable without Omnibus II agreement having been reached by the end of this year, can we provisionally move on to 2017 as the new 'go live' date?
 

FTSE and European Insurers - Economic Capital and Solvency II trends - money pit filled?

Interim Results season - without question, the most exciting time of the summer for me (although to qualify that, I do live on the Isle of Man and blog in my spare time). As good an opportunity as any to peer review where the big boys are at in the UK and Europe, both on Solvency II preparations/costs and economic captial positions.

Solvency II project costs - on the wane?

As I had mentioned in an earlier post, the FTSE-listed insurers have gone noticeably quiet on both Solvency II and, in the UK's case, the havoc it was inevitably going to wreak in its 2012 form - while the 2013 silence "speaks volumes" as to the priority of the dossier, it is a smart idea to see what impact the threat of a 2014 start has had to EC positions of major insurers over the last 12 months (i.e. after last year's whingeing, did any of them actually do substantive capital-related activity!)

A few notes for each below;

Aviva

• Solvency II project costs of £44m - well down on £77m in 2012 year-to-June
• "...there is still significant uncertainty over the detailed requirements [of Solvency II]"
• Pro-forma economic capital surplus of 175%, up from 172% in December
• IGD coverage 1.8 times, up from 1.7 times in December

Axa

• Nothing on Solvency II at all or project costs
• Solvency ratio down to 218% (from 233%) since December - interest rated attributed
• Economic solvency ratio (calibrated to 1-in-200 VaR) down to 204% (from 206%) since December - dividend and market risk elements attributed

Allianz

• Nothing on project costs
• Solvency ratio (based on FCD) of 177%, down from 197% this time last year - change in accounting standards attributed
• "...Allianz continues to be exposed to two external forces that adversely affect our risk profile and would not normally be associated with our core operating activities: the European sovereign debt crisis and regulatory developments – especially the European solvency directive, Solvency II"
• No reference to economic capital or modelling

Legal and General

• "Investment projects and expenses" (which covered Solvency II last year) were £20m - £23m in 2012 year-to-June
• "...remains uncertainty both to the implementation timescales of Solvency II and the final calibrations that will be used for long term business"
• IGD surplus unchanged at £4.1bn, coverage ratio down to 226%

Old Mutual

• No mention of Solvency II project costs, same as last year
• EC coverage of "over 160%", calibrated to VaR 99.93%
• FGD surplus of 160%
• Dividend outweighed operational cash flows in the 6 month period, though this was due to the special dividend paid last year after a massive disposal

Resolution

• Solvency II project costs of £10m for the half year - well down on the £48m for 2012 comparable!
• "Proposals for Solvency II continue to be the subject of debate"
• EC Coverage of 192% - (194% in Dec - quantum increased by £200m though)
• IGCA coverage of 221% (222% in Dec) - sold a business unit, which helped cover dividend

Prudential

• £13m Solvency II project costs for the half year - £27m in 2012 year-to-June
• "...deferral until 1 January 2016 or beyond appears likely"
• "...we now know that it will not be implemented before 1 January 2016" - my emphasis
• "[potential for] optimising the Group’s domicile as a possible response to an adverse outcome on Solvency II" remains on the table, a copy/paste threat left in from last year.
• IGD coverage of 230% - quantum lower by over a billion since Dec, due to a change in requirements in their US business

Standard Life

• £36m Solvency II "and other programmes" costs for the half year - £42m in 2012 year-to-June
• Solvency II project "...continues to respond to changes in requirements"
• IGD down £500m since half year after accounting for a special dividend, and surplus generation down year-on-year (attributed to new business strain)
• IGD surplus of 185%, down from over 200% at YE2012, but up 11% from this time last year
• Not a single reference to "economic capital" in the document

Generali

• No mention of Solvency II
• Solvency I coverage at 139% - up from 130% this time last year
• Economic capital coverage of 167% - up from 159% this time last year

RSA

• Solvency II project costs down to £10m (was £16m  in 2012 year-to-June)
• "There remains continued uncertainty as delays in agreeing the rules have caused the planned implementation date of 2014 to be delayed."
• IGD covered 1.7 times - down from 1.9 times since December - dividends again cited in explaining the dip.
• Economic capital (calibrated to 1-in-200 VaR) £1.3bn, up from £1.2bn in December.

So a trend of steady Solvency I ratios, and no sign of any war chests being created by holding excess cash back - quite the opposite in some cases, with dividends (special or otherwise) on the high side. With project costs diminishing and barely a passing comment on the Omnibus II impasse, it looks very much like Solvency II is yesterday's news in the boardrooms of major insurers. 

That said, in just those insurers covered above there has been over £100m confirmed spend in the last 6 months on Solvency II preparations, during which time the implementation date has (informally) moved at least two years, IMAP has been elongated, and the LTGA panacea has turned out to be anything but. That's hardly chickenfeed, and the rest of this year can only get busier for the UK with ICAS+ and EIOPA Interim Guidelines to contend with.

I hope Finance Directors don't get too excited by the dwindling project spend though - we haven't started Pillar 3 yet, apparently!

PwC and CSFI's 2013 Insurance Banana Skins survey - "Conduct Risk" firmly a la mode

Following on from the 2011 version, PwC and the Centre for the Study of Financial Innovation have pumped out another version of their Insurance Banana Skins survey, identifying how well the insurance industry feels it is prepared to handle a list of pre-identified risks. The average response on a scale of 1 to 5 was 2.97, which rather unrevealingly suggests the industry is averagely prepared to manage its collective risk profile.

EU Legislative process - not for vegans

This survey was conducted during March/April 2013, and elicited 662 responses from 54 countries, with two-thirds of respondents coming the insurance industry (the rest consultants/brokers etc). Almost half were European, so no surprises that the risks emerging from the regulatory environment were top of the pops for the second survey in a row. Solvency II gets a particularly flavoursome mention, with reference to its struggles to get through the "Brussels Sausage Machine"...

Bearing in mind the exquisite pressures being applied by the EU machinery to quantify risk, this publication is a welcome return to horizon scanning, qualitative assessment and emerging risk, all of which is handy for the ORSA posse, who according to recent surveys, should be all over this during 2013.

Some very interesting snippets emerge from the report, in particular;

• "Conduct Risk" - if ORSA was the new boy in 2012, then its 2013 counterpart is surely Conduct Risk, which I suspect didn't warrant a category of its own in many risk managers thinking until the return of twin peaks regulation in the UK. Conduct Risk has shot up the charts in its significance for insurers, now sitting 4th (from 18th last year)! Specifically, the suggestion that insurers are now "...looking beyond conduct risk as simply a compliance exercise" makes you wonder what some firms through were acceptable products in the last 10 years!
• "Guaranteed Products" - was not listed last time around, now jumps to number 6
• Actuarial Assumptions (which can easily mask the emergence of a number of the risks listed) unchanged at 12th
• Capital availability down from 2nd last time to 16th this year - interim period been spent squirrelling capital away, or happy that the onerous elements of Solvency II are (thanks to Germany) in the distant future?
• Reputational risk still in mid-table, at 14th

And sectoral/country specific;

• Surprisingly, the Life sector doesn't have actuarial assumptions in its top ten concerns
• Equally surprisingly, the non-life sector doesn't have regulation in its top ten concerns - clearly happy with their proposed Solvency II lot!
• That reputation doesn't feature in reinsurer's top ten - with customers likely to be eager yet more discerning  under Solvency II, one would think this is an area for enhancement in order to stand out from the similarly-rated crowd
• The quality of risk management appears to have spiked as a concern largely due to the emergence of emerging market firms into the space playing catch-up (on paper at least), as well as concerns that some firms are playing at risk management without making necessary adaptations to the prevailing risk culture.

Moody's survey on Solvency II compliance preparedness - the chilly third pillar

So from what I can gather it has been a terrible week for the Girondins, with a freak hailstorm wreaking havoc in a thin strip along the vineyards of Bordeaux's Entre-deux-Mers appellation - my in-laws were seemingly spared further down the river, noting that it was merely "un peux froid".

On Ice - Solvency II programmes
and this year's white Bordeaux?

And speaking of a great deal of hard work getting aimlessly destroyed by an unpredictable European storm, Solvency II (do you see what I did there?) appears to have at least enough juice in the tank to have encouraged Moodys to survey practitioners on the preparedness of the industry to achieve compliance before the deadlines currently on everyone's lips (i.e. 2014-2015 for EIOPA Guidelines, 2016 for "go-live").

That survey is available here (short sign-up required, but worth it), with a very short summary here. The media have touched on the survey (here), but only seem to have read the summary, so I've picked through the whole shooting match to see what else was worth knowing.

The sample is small at 45 contributors, but they have all been interviewed one-on-one in Q4 2012/Q1 2013, so the responses are not too dated, particularly as many Solvency II programmes have been running on meagre rations since January of this year. Coverage of 12 EU countries is included in the 45 people, with a decent split of size and insurance type. Majority of respondents were CRO/equivalent, with a few accountants, actuaries and programme managers thrown in for good measure, and just over half are on Standard Formula.

Talking points for me were;

• That 22% have frozen Pillar 3 activity, while 11% have frozen all Solvency II activity
• Half are using Standard Formula to curb costs!
• In addition to that, 20% say that the Use Test is a barrier to using models!
• 27% are approaching Pillar 1 and Pillar 3 with a tick-box mentality (i.e. happy to use multiple manual processes/excel-based tactical solutions to deliver the balance sheet and reporting template elements), while 44% have worked exclusively on Pillar 1 at the expense of Pillar 3
• Solvency II project investment levels are "considerably more" in the UK and France compared to Germany - makes you wonder why they have such a long face!
• 67% have increased their control function staffing by 10% or more - 31% have increased by 50% or more.
• Only 7% note "capital reduction" as a perceived benefit of Solvency II, with 33% selecting improved capital planning (regardless of quantum) as a benefit.
• Only 6.7% say they are receiving "high" levels of support from their national supervisory authority.

Seemingly the stats are a hostage to the sample - I'm sure the PRA would be apoplectic if this was the position of Insurers of Britain plc, but for me the big story is the indiscriminate swelling of Risk/control functions in smaller organisations that evidently are only ticking boxes. Feels a tad disingenuous to pump the staff numbers up to demonstrate compliance, but I suppose it's not me they need to satisfy!

Insurance Europe on EIOPA's place in the European System of Financial Supervision

As a response to the European Commission's consultation on the new European System of Financial Supervision (ESFS) - you know, the one that gave birth to EIOPA and the other two ESAs - Insurance Europe have laid some home truths down in this questionnaire document regarding the performance of EIOPA to date, as well as problems they see on the horizon once Omnibus II gets through.

Due to the lack of transparency in much of the work performed by EIOPA to date (a by-product of their remit being squirrelled away in the Omnibus II dossier?), I found some of this comment very revealing from a body which I expected would be relatively pally with them. Specifically, I noted the following opinions;

• That ESAs should not issue Guidelines that circumvent legislative powers - these generate blurred lines between technical matters (where their input is welcome) and strategic/political matters (where it is not). Precisely here that would leave EIOPA's Solvency II Interim Guidelines in their ideal world is another thing I guess, though they go on to say that the "...level of detail on the Solvency II implementing measures is alarming", and indeed were pretty vocal in their public response to them.

  

  EIOPA Guidelines - back door regulation?

• That there is an absence of clear definition in EIOPA's materials around where Regulatory Technical Standards (RTS), Implementing Technical Standards (ITS) and Guidelines differ - going on to suggest that there is an element of "regulation by the back door" in the Guidelines issued to date.
• Concern regarding the level of power left in EIOPA's gift to adopt RTS, citing as an example that EIOPA have brought back (as part of L3 consulations) a proposal to make external auditors review SFCRs - this proposal having already been jettisoned by the Parliament at L1!
• Suggest that the Commission should have a vote in contentious decisions within EIOPA (the Commission attend in a non-voting capacity currently) 
• A diva-esque rant (p12) about the quality of EIOPA's processes and outputs during consultations (lack of feedback, poor quality documentation), as well as suggesting that consultation participant quantums are overweight in academics at the expense of the industry.
• That some of the membership of Insurance Europe would welcome qualified majority voting in the ESAs weighted by size (let me guess who!).

So without having been handed their full schmorgasbord of powers, EIOPA are already being lambasted for their use of them - tough break!

Germany, BaFin and Solvency II - Tchüss wisely...

With the British Lions rugby team having had such a marvellous summer, it's nice to see that the spirit of "getting one's retaliation in first" has been brought back to Europe with them. The Executive Director of insurance at BaFin, the German regulator, came out swinging late last week (while the rest of Europe was lotioning up), and delivered his two'penneth worth on, amongst other matters, the Long Term Guarantees situation currently holding up Omnibus II.

Omnibus II trilogue - work to do

This is the same man who has recently been quoted as saying that delays are not a problem, as "Solvency II was not designed for today". Which is true - strictly speaking, it was designed for about 8 months ago!

The German contingent have been labelled in a number of articles (here, here, here and here) as a major source of legislative delay (presumably ever since they twigged that the proposed design of the extrapolation element was massively unfavourable to their industry), and the lobbying angles pursued here are not really new news, but to emphasise;

• Concerned about the increase in interest rates at Central Bank level - "should be carried out gradually", though rather disingenuously saying that they would have no influence in that - BaFin may not, but Chancellor Merkel and the overflowing pot of export surplus certainly does!
• Solvency II go-live of Jan 2016 "absolutely realistic" provided the trilogues are finished this year - I've noted in earlier posts that the official schedules of the co-legislators are looking shoddy in this respect, so I'm more inclined to side with S&P (and indeed the president of BaFin!)on 2016 being on shakier ground than a Hippo's decking..
• That transitional periods should be determined individually in accordance with a firms existing maturity profile - they want to avoid an insurer "falling over" just to meet the new regulation. Worrying that after 10 years of efforts, Solvency II compliance still carries such a credible threat of business closure! 
• As they have so many insurance contracts (90m cited), they would simply "say goodbye" in a worst-case scenario if they don't get their way on transitional periods.

So the likelihood of the German industry "taking one for the team" here is pretty small, and with Hrs Balz and Giegold having made it pretty clear that the LTGA result will not elicit a swift conclusion to trilogue negotiations, it looks like there's still plenty of talking to be done...

Deloitte's 8th Global Risk Management Survey - cause for concern?

A survey from Deloitte has recently hit the news stands, namely the 8th edition of their Global Risk Management Survey - I thought I'd postpone my August holidays to pick through the bones of it (?).

The data was gleaned from an online survey they sent out to CRO/equivalents back in Sept-Dec 2012, so is a bit dusty, and there were 86 respondents, so a half-decent sample. It isn't dominated by a particular sector or continent (p7), but there are more conglomerate/bank-heavy respondents than pure insurers.

There is an infographic for those of a short attention span with a few headline numbers, but having sifted through the larger doc, I found the following elements worthy of note;

Boards, Committees and Risk Management

• 80% of Boards are reviewing and approving Risk Management Policies/ERM Frameworks and Risk Appetite Statements. Bearing in mind the types of organisation in the sample, that is disappointingly low.
• 25% don't review individual risk policies
• 23% don't review strategy against risk profile
• Almost half don't invite CRO to EXCOM meetings
• Almost two-thirds delegate risk oversight to satellite committees (and two-thirds of those delegate to a Risk Committee)
• Only half have their Risk Committee chaired by an INED.
• Use of specific management risk committees for individual risk types tends to cluster around the 40-60% bracket (for example, 60% have an ERM committee, while 44% have an Op Risk Committee). Heavily weighted by organisation size i.e. larger ones tend to have them! 
• Emerging risk reporting not supplied to 30% of Boards
• Model validation results not supplied to 70% of Boards!
• 66% (of insurance respondents) have their Boards responsible for reviewing economic capital results

CRO and Risk Management Function

• 97% of large respondents have a CRO, 81% of smaller firms 
• 88% using "3 Lines of Defence" (almost all of the larger respondents do)
• 62% have an "ERM Programme"
• 58% increasing risk management budgets (still!)
• In the list of tasks currently performed by CROs, the fact that only 63% are involved in the approval of new business lines/products is pretty telling, and not in a good way.

Other control functions

• Almost half of respondents said that Internal Audit and the ERM Framework do not use common risk categories and language.
• 33% do not have a independent model validation 'function' (remember, the banks are in these stats as well!) - most of those who have made provision park it in the Risk Management function.

Risk management techniques

• 90% using some form of stress testing in the business, with most saying the outputs are used in business planning, strategy setting and identifying risk tolerance. More than half however don't use the outputs in the allocation of capital to lines of business.
• 74% have some type of Stress Testing policy
• Over 20% either do not have a Risk Appetite Statement, or only have a quantitative one
• Almost 70% still use regulatory capital as one of their quantitative measures in their Risk Appetite Statements
• Risk limits tending to be set at enterprise level, as opposed to business or desk/subsidiary level - stats are a little murky due to the emphasis towards banking sector.
• Model risk and Liquidity risk seem to be the risk types least factored in to companies ERM programmes

Management of Key Risks

• Full list on p24, with the percentage shown representing the number of respondents who thought their management of each risk was "extremely" or "very" effective - stand outs were that perceptions of the effectiveness of the management of Operational, Model, Outsourcing and Data risks appear to be much lower than one would hope, with Lapse risk management ranked unusually high.
• Op Risk KRIs and Loss data only collected in 60% of respondents
• Just over half are modelling Op Risk in some way - varying degrees of complexity experienced
• Most are using stress testing and/or reserving to assess Insurance risk - over 40% not currently using EC, and over 50% not using VaR.

Risk and Reward

• Almost 60% of remuneration schemes have no clawback provisions
• Almost 70% of schemes do not align incentive payouts with the term exposure of the underlying risks

Solvency II-specific

• 92% (of relevant responders) will focus resource on ORSA in next 12 months
• 77% will focus resource on Data Quality in next 12 months
• 69% will focus resource on Documentation and Reporting in next 12 months
• Less than 25% rate their processes and systems for Data Governance extremely/very effective.
• Declining trend of insurers who will be modelling economic capital (p19)
• Only 80% actually calculate Economic Capital
• Some very grim stats on p21 covering which risk types are modelled for EC purposes (underwriting risks seemingly very low on the list)

There are a number of areas touched on here which fall short of pending (or indeed actual) national/international regulations and codes, never mind "best practice". Perhaps we can account for the innate conservatism of CROs in their responses, and assume things aren't quite as bad as they have self-assessed here?

FTSE and European Interim Reporting - Solvency II off radar

So it's Interim Reporting time again for Europe's beleaguered insurers and as far as internal models go, another one has apparently bitten the dust - Old Mutual formally withdrew from the PRA's Internal Model Application Process in early 2013 "...as a result of delays in Solvency II implementation" (p14), joining Resolution on the sidelines.

Solvency II - 'Time of your life'?

This time around there appears to be a conspicuous absence of comment on Solvency II and indeed Omnibus II, unlike this time last year, when every firm had an opinion about Solvency II's legislative progress and its financial cost.

This is not so unusual for the mainland Europeans such as Allianz, Axa and Munich Re (all of whom had nothing new to say at the half year), but the UK firms have normally used the Interim Report as an opportunity to sound off. With Old Mutual (above) and  Legal and General so far only offering minor comments on "delays" and "uncertainty", have both the industry and the legislators given up forecasting the end game, and put the Solvency II "baby in the corner"?

Hopefully the remaining big hitters such as Pru, Aviva and Standard Life will have something to say over the next couple of weeks.

Central Bank of Ireland - Corporate Governance Code refresh

The Irish approach to corporate governance in financial services, at least up until the onset of the financial crisis in 2006/07, resembled something of an all-you-can-grasp buffet for a select number of executive golf club pals and octogenarian ex-politico Non-Executive Directors (NEDs), having their voting arms operated a la Weekend at Bernies.

Ireland pre-2007 - Waking NED?

The new FSA-flavoured approach brought in by Matthew Elderfield in 2009 (elaborated on here) fortified by the findings of a devastating 2011 report summarising the truly horrid governance practices in the Irish banking industry, has led to a change of regulatory tack at the Central Bank of Ireland that represents the biggest volte-face in Europe since the Macarena.

Alongside PRISM, a piece of revolutionary work in the assessment of financial institutions by supervisory bodies, the CBoI also made substantial changes in areas such as Annual Compliance Statements, Fitness and Probity of directors, Risk Appetite Statements.

All of this ran off the back of Mr Elderfield's first major gig in 2010, a full revamp of the Corporate Governance Code, which could hitch a ride off the back of the work of the FSA and CEIOPS (at the time!) and deliver a more substantial suite of obligations to a cabal of directors who, after feasting on carrots for years, desperately needed the stick.

This makes the release of yesterday's consultation on the Corporate Governance code a touch baffling, as the ink is barely dry on 2010's effort - it perhaps reflects that the regulator has reached optimum staffing levels if they can review it so regularly! Having said that, the level of divergence from accepted CG practices in the UK was flagged by Grant Thornton back in 2011 as being substantial, so a point-in-time revamp should not be so unwelcome, regardless of the proximity to the last one, and of course, all of this activity was too late to prevent Quinn Insurance from going down.

They emphasise that this review takes into account developments in the Solvency II space, as well as on-the-ground experience and publications from other parties of interest. Of particular note was their emphasis that, where national regulations are not as stringent as relevant EU or international one (or indeed vice versa?), the most onerous one should be complied with. In a number of instances around corporate governance, this will mean the CBoI outranking Solvency II as the more onerous of the two!

While these are proposals rather than stitched-on changes at this point, the CBoI doesn't have a great track record for backtracking these days. Highlights for me were;

Risk Committees

• Require a majority of NEDs on Risk Committees, and must be chaired by a NED

Committees in general

• Require the Risk Committee and Audit Committee chairs to sit on each other's committees
• Require the Remuneration Committee chair to sit on the Risk Committee
• In High Impact firms, the Risk Committee and Audit Committee Chair may not be the same person
• Must be at least 3 members of Risk Committees and Audit Committees

Chief Risk Officers

• They note that it is "Generally accepted best practice" to have a CRO who, amongst other tasks, is charged with "...facilitating risk appetite setting by the Board". In addition;
• All "High Impact" firms will be required to appoint a specialist CRO
• Firms with a lower PRISM rating may have a CRO who is shared with another control function, "...provided that there is no conflict of interest between the two roles". Can't help but feel that this might rule out CRO/Chief Actuary dual roles, but allows for CRO/Head of Compliance and CRO/Head of Internal Audit, which would be to the chagrin of the Society of Actuaries in Ireland!
• CRO to have direct access to the Chairman of the Board

Board Meeting frequency

• Seem to acknowledge that the compulsory 11 meetings per year for High Impact firms may be a touch much, so are looking for comments
• Also acknowledge that compulsory 1 meeting per calendar quarter is a bit constrictive for the smaller firms, so may relieve this to be pragmatic

Chairman and CEO

• Some of the restrictions around number of roles held at any one time to be relieved for smaller firms, but seemingly only to populate inter-Group roles.

Board Diversity

• Acknowledges that, while the debate in the EU is gender-centric, that diversity of all types is a worthy target for Boards, but falls short of compelling firms to do anything at national level, choosing to seek comments and wait for the supra-national activity to drive any compulsion. This seems to fit with the thinking of Irish directors published back in 2011 i.e. no "Golden Skirt" quotas.

Random

• "...appropriate Risk Culture" makes its way in (6.3), perhaps cognisant of the FSB's proposals
• Built in a piece which allows for video-conferencing rather than physical attendance at meetings (7.5)
• Board responsibilities updated (13.1)
• Compulsory Board skills matrix (14.9)

Solvency II, Omnibus II and Trilogue - two steps forward, two steps back?

Headline results from an Economist Intelligence Unit survey have been published this week, apparently suggesting that most global insurers continue to see Solvency II as their biggest regulatory challenge. Despite its prominence in the agendas of insurers' committees, boards and control functions, the legislation appeared to have taken a back seat in the decision-making fora of the European Union since the publication of EIOPA's LTGA in June.

So while the EU Parliamentarians go off for their hard earned 5 weeks in the sun (and by association Omnibus II/Solvency II will temporarily sit untouched like a pair of pink booties in Buckingham Palace), we can try and work out what the crack is with the dossier!

Trilogue
So with the Trilogue process itself necessarily one of closed doors, secret handshakes and unpublished shady deals, at least we formally know that they reconvened before the summer holidays thanks to Sharon Bowles' diary handler! Other than InsuranceERM's piece on a "muted start" to the negotiations (subscription only), the well is pretty dry on comment, suggesting that they got off to an inauspicious (re)start.

Parliament
As far as the latest ITER listings go (p1), ECON will not be considering the dossier again until 18th November 2013. From what I can read of the Parliamentary calendar, that is too close to supply the November Plenary with anything to vote on, and the December one is scheduled early in the month. Fair to say that, as indicated by Burkhard Balz last month, the Parliament won't vote on Omnibus II before 2014?

Council

Bed made - but covers stolen...

So the Lithuanian presidency is in town, and apparently sees the Omnibus II dossier as having "high importance" (p3) within their recently published work programme. ECOFIN have a state of play meeting provisionally scheduled for 15th October 2013.

That said, when pressed for comment when attending ECON before the summer holidays, they seems to have learned from the Paula Abdul school of making progress: for the two steps forward indicated by the Lithuanian Finance Minister's comment that the Presidency is committed to resolving, amongst other dossiers, Omnibus II (p12), he immediately takes two steps back by noting one of the key tactics will be "...focusing on uncontroversial technical issues to facilitate progress" (p13) - might be OK for some of the multitude of delayed dossiers, but not this one!

EIOPA
EIOPA naturally consider their work largely done for Omnibus II, and consider the report a "reliable basis" for making decisions on LTGs, and ultimately Omnibus II itself. Sr. Bernadino did however admit at the ABI conference a week back that, for 2016 to remain a viable "Go Live" date, political agreement on Omnibus II would be needed by the end of this year. Judging by Parliament's position above, I guess 2016 is out then!

European Commission
While Commissioner Barnier had lavished praise on EIOPA's, errr, "very good [LTGA] report", the Commission has lost its Solvency II specialist to retirement during this year, which might lead some observers to believe the Commission will be less effective as a negotiator while the new boy learns the ropes. However, Gideon managed to get some words from Karel van Hulle's replacement a couple of weeks back, and his modus operandi doesn't sound like one which will lead to a swift decision at the expense of one or two angry outliers in any case.

Specifically his comment that "We need to find a solution that works for almost all Member States. That is our ambition. So we don’t like to get the project through, just about ", suggests that anyone at the table with a gripe will get some airtime. With the LTGA outcome causing more gripe than at a constipated nursery, I suspect that the delays caused by the current 5 week vacance soleil will be a mere drop in the ocean...

PRA's take on EIOPA Guidance - no truck with dual reporting?

One of the Barnett Waddingham crew was kind enough to make a few notes about the PRA's current position, presented in an industry briefing back in early June (slides seemingly unavailable). While it didn't touch on pre-application for internal models, it did publicly tease out a few more details on ORSA and System of Governance from those already available, for example;

• The concept of a "Glide Path" towards ultimate Solvency II compliance, which is being agreed between firms and the PRA, to make up for the lack of certainty around both EIOPA's requirements from 2014 and of course the ultimate 'Go Live' date itself - gives both parties plenty of wriggle room in their preparations
• PRA are currently doing an "EIOPA vs PRA" comparison, but are not looking to change the PRA Handbook (which would neccesitate a consultation period, and therefore wouldn't be ready for 2014)
• That the PRA are not especially enamoured with their reporting requirements up to EIOPA!
• That the PRA believe that the trilogue discussions will be concluded before EIOPA's guidelines come into force. That seems less likely with every passing day
• That the PRA do not have the resources to feedback on any of the firms' efforts in the Solvency II reporting space

I guess the slightly odd thing is that the PRA have just announced a radically reduced Special Purpose Fee for Solvency II preparation (only £3.1m for IMAP, and a rebate for non-IMAP due to underspend last year - compare that to previous years!). Could they perhaps have just hung on to a bit more cash to provide a more substantial service in the next 18 months, or have they also given up the ghost on anything of substance happening in the foreseeable future?

ABI and PRA on 'Meeting the Challenges of a Changing World' - Solvency II in particular...

Low Yield issue - not just for insurers

While I disposed of my son for the summer last week for an extensive potty training course in Bordeaux (PS you might want to avoid the 2013 whites!), the ABI gathered the great and good for their biennial conference, themed Meeting the Challenges of a Changing World.

A corresponding publication from the ABI which the event hung its hat off to a certain extent is particularly useful for anyone in the emerging risk/ORSA/reverse stress testing space, touching on 7 specific 'challenge' themes, which are themself further broken into sub-categories. With the ABI providing a mouthpiece for the interests of the UK insurance industry (and being currently Chaired by an avid opponent of Solvency II), it was worth picking up on this document's take on Solvency II, specifically;

• That it could be a future constraint on the nascent equity release market
• Its well documented "...potential effects on infrastructure financing"
• That British insurers should "...[continue] being proactive and engaged in trying to shape vital regulation such as Solvency II rather than simply criticising it from the sidelines". Not sure if the implication is that the UK is drifting from the box-seat in this regard, but certainly in the context of the next decade, a slated in/out referendum on EU membership may make proactivity on Solvency II a moot point!

The regulatory meat in this lobbyist event sandwich came from a keynote speech by the PRA's Andrew Bailey which, in the process of publicly revealing a few nuggets of truth, still left me safe in the knowledge that insurance is still the banking industry's boring cousin - that he needed to "...make clear at outset that insurance supervision matters as much as banking supervision" and stress that "...insurance supervision is a skill on its own" while supporting most prevailing regulatory techniques with the prefix 'what we learned from Banking is...' tells its own story.

That aside, the following comments are worthy of highlighting;

• The PRA's current trend of using "business model analysis" in their supervisory work - surprised that this was not already par for the course frankly (what else other than the types of analyses referenced at the bottom of p4 would you be doing?), but one would expect that the advent of ORSA will enhance everyone's activity in this field soon.
• Taking that into account, it is "...logical for us to make early adjustments to our existing regime to incorporate the ORSA under ICAS+"
• The suggestion that management "...take responsibility for understanding and mitigating the risks in their business" - 'managing', rather than 'mitigating' surely, we'll tolerate anything within appetite!
• That the truly woeful "Solvency II/Crossrail" costing analogy used by Mr Bailey to a parliamentary select committee was the PRA "...making a point on behalf of firms".
• That "PRA have not withdrawn from involvement in Solvency II, far from it", though recognises that the result around the classic matching adjustment is not what UK plc would wish for - goes on to comment that we "...still have a good way to go to make the Solvency II regime manageable in its use and implementation"
• That, as far as Sol II's legislative progress is concerned, negotiations "...continue over summer, with a conclusion expected in the autumn", and that the official implementation date discussed recently on this blog is "clearly unrealistic".

In a week where a wall of silence has descended upon the co-legislators and the Commission, it is reassuring to see at least one NSA body with a solid-ish implementation plan, regardless of the immediate lack of things to implement - however judging by the words captured by Gideon of Dr. Wiedner, the lightly briefed (and from what I could read, lightly fed) replacement of Karel van Hulle, I suspect that Solvency II on the whole remains "Klaus but no cigar"...

Chartered Institute of Internal Auditors - final guidance on Effective Internal Audit for financial services

The Chartered Institute of Internal Auditors have followed up on their consultation earlier this year on Effective Internal Audit in the Financial Sector with this final set of recommendations.

Doesn't appear to have been any seismic changes as a result of the consultation, though the "need for proportionality" has been recognised, and clarification has been added that the content itself has not been mandated by the profession as best practice.

Interestingly, huge emphasis has been put on clarifying the primary role of Internal Audit as being the "protection" of a firms's assets, reputation and sustainability - does the profession feel well resourced and equipped to handle reputational defence? - while a few other elements sprung out at me;

• A focus remains on IA challenging the "tone at the top", as if the expression now carries so much weight and definition that professional guidance can be hung from it.
• "Risk Appetite" is again not defined, however IA are on the hook for assessing that it has been established and reviewed by senior management
• Emphatically declares that "...the assurance map cannot be carved up between the Risk, Compliance and Internal Audit functions", stressing that IA will be expected to include the challenge of the work of other control functions in their audit plans
• Built in some leeway around their earlier suggestion of compulsory attendance of IA function heads at Executive Committee meetings (ostensibly in order to understand strategy) - for insurers, one could anticipate that the advent of ORSA may take care of that knowledge gap 

Certainly the PRA/FCA have been fast to come out with support for the final version, so I guess all control functions had better make their peace with the content and prepare appropriately.

EU Commission and Quick Fix 2 - Silence is golden (delicious)...

We are a good week down the line since Solvency II technically became a rolling ball, at least from a 'transcription into national law' perspective, and the party has barely stopped around the EU...

Man from Del Monte
- he says 'Non-Compliant'

Joking aside, the wonderfully obscure lobbying miscreants at ICODA released findings (expanded on here) of a straw poll they had issued to all member states around their preparedness to implement both Solvency II and EIOPA's interim measures. Not even half of those polled responded, and only 6 responded in full, so the sample isn't ideal. That said, there are enough seeds of doubt sown by the responses to grow a Del Monte-style orchard of non-compliance by next year.

As one would have anticipated off the back of the last-ditch attempt to secure a second 'quick fix' Directive, there would appear to be major concerns around NSAs meeting the requirements as at 1st Jan 2014, for example;

• All respondees are in favour of 'Quick Fix 2'
• 40% don't feel adequately prepared for ORSA obligations
• Half are not prepared for internal model pre-application obligations
• A quarter are not prepared for submission of information obligations

Is 'Quick Fix 2' simply being seen by some of the straggling NSAs as an opportunity to postpone the inevitable rather than to actually prepare for it, thus avoiding the decadent yet ultimately unnecessary project spend of the early adopters? Indeed, is 'Quick Fix 2' even legally possible now that the date for transcription into national law has passed?

I took the opportunity on Monday 1st July to contact representatives of note to ask where the legislation currently stands, specifically around the potential for retrospective 'Quick FIx 2', and received the following cavalcade of replies in the last 7 days;

• EU Commission - nothing
• An EU Parliamentarian heavily involved in Solvency II - nothing
• EIOPA - a holding e-mail thanking me for my question

I hope that world exclusive information helps you all with your preparations!

Late post-script - I didn't bother checking in with the Council, but they have surprisingly made public comment today due to the changeover in presidencies to the Lithuanian delegation. Knowing the guys in Vilnius are big fans of the whole Solvency II shooting match (?), it was interesting to see they only have "...continued negotiations on the Omnibus II insurance dossier" scheduled over the next 6 months, as opposed to something more positive. We'll certainly be seeing Santa before the Parliamentary Plenary vote then, big question is will we also see the 2014 Easter Bunny?