Accenture Insurance Sector research - Global Risk Management survey

Flood Risk?

A nice generic risk management benchmarking piece from the guys and girls at Accenture came out this week, and after I spent last week at the Leicester rugby game, I was happy to see another 15 "tigers", albeit this time scattered throughout the survey paper itself, presumably as a subtle metaphor for "death by tiger" risk...

It is made up of 98 C-suite respondents (nicely spread across disciplines), is Insurance sector-specific, and Global in coverage (one-third Europe, half N.America), so should be useful to any reader for trend-spotting and Board briefing.

From the document itself, I've pulled out the following;

Risk Governance

• 98% have their "risk management owner" reporting to the CEO
• 96% have a senior executive (regardless of title) as "risk management owner"
• 80% have their "risk management owner" report regularly to the Board
• 55% had a titled CRO
• A number of those stats (whilst improved since their last survey) are a poor reflection on the Global insurance industry, but perhaps reflect where corporate culture is outside of the EU/US axis
• Of the governance bodies, I was surprised to see only 60% of Life companies have an operational risk committee

Solvency II/Non EU equivalent legislation-specific

• Over 80% of Life and P&C respondents seem happy that they are preparing well for their regulatory initiatives (Solvency II or local equivalent).
• Other than Internal Model development, the main outstanding issues for Life insurers to be prepared for Solvency II/equivalent is IT architecture and Data Management/Integration. For P&C, documenting risk processes and developing a meaningful Use Test are also worrying at least half of respondents.
• Issues such as training and education, risk culture and risk governance documentation are relatively low on the priority list.
• Conversely, when asked on a 1-5 scale about specific areas of risk governance, respondents were more positive about their Data preparations than their risk governance - go figure!
• Use Test preparation remains a laggard throughout.

Generic

• Top external pressure was Legal risk, and by a good distance. Regulatory risks relatively low on the list, perhaps reflecting Europe's low weighting in the quantum surveyed.
• Risk Management seemingly well integrated with strategic deployment, but not with product development or reward.
• Poor statistics around embedding risk management into core functions.
• Two thirds of Life respondents noting that a lack of "early warning capabilities" impedes emerging risk management.
• Over half of Life companies said investment benefits ("above and beyond" continued compliance with regulations) would come from better reporting and better integration of Risk and Finance.

There is some of the softer stuff on aspirational elements of risk management thinking at the back, but if you just want to check against your peers, you can save that for a rainy day.

Omnibus II text released - first casualties emerging?

It was left to COREPER to announce that the Council and Parliament have agreed on the compromise text for Omnibus II, leaving the formality (!) of the Plenary vote on February 25th as the final hurdle before, well, the next set of hurdles. But here she is - 156 pages of over-masticated Eurobelch that has held the authors hostage for years like a slaphead in Rapunzel's spare room...

Omnibus II draftsmen - you're free to go

Chris Finney has already picked a couple of bones out of it, which look good for any EU multinationals with non-equivalent subs on the face of it. I'm not inclined to peel it apart on screen (I'm sure someone will do that for us in the next couple of days), but since the Commission's original proposal we do get;

• An enormous amount of preamble to factor in EIOPA's new role, which gets more elaborate with every paragraph,
• References to IAIS developments for future considerations on the equivalence front (will that be enough to cover the States and Canada long-term?)
• Some hard coding of references to "20% of market" for exemptions from reporting requirements,
• Visibility of the drop dates being proposed for EIOPA to deliver implementing and regulatory technical standards to the Commission - a reasonable amount are due in less than a year, including on model approval and "major" model changes.

As EIOPA will be penning all technical standards for the Commission, and relations between the two seemingly cordial, we might assume that EIOPA's views (which were almost immovable during the consultation on their preparatory guidance) will inevitably come to the fore in the final set of implementing measures.

Whatever comes of it, it would appear that the trilogue negotiations haven't quite done the job for the German contingent, with Hr. Hufeld from BaFin suggesting there are "5 to 10" insurers under his watch in danger of failure, a week after the German Government referred to a "balanced package" of help for their (seemingly) beleaguered industry which will be introduced in early 2014.

"Das Gleichgewicht wird zum Verlust..."

Financial Stability Board - Principles for an Effective Risk Appetite

Christmas has come early everyone - the Financial Stability Board have released their Principles for an Effective Risk Appetite Framework today, and I'm greedily ripping in to it before JC's birthday like a spoilt, yet handsome child...

FSB's RAF Principles published- 

send the car back lads...

There has been a reasonable amount of traffic on Risk Appetite this year (here, here and here for a start), after the FSB but announced their consultation earlier in the year, I've been on tenterhooks. This was following of the back of a thematic review on Risk Governance as a whole by the FSB, which they published back in February.

So where do they take this deep dive into Risk Appetite? Other than awkwardly shoehorning in the soup de jour of "SIFIs", they stick to the hard areas which will get every risk practitioners' attention (namely, Risk Appetite Framework, Risk Appetite Statements, Risk Limits and Roles and Responsibilities), though "for clarity and simplicity", they jettison the use of Risk Tolerance. Definitions are supplied on p2-3, which you may find useful as anchor references.

They somehow make room for anodyne flannel in this very short document, for example;

Risk Appetite Frameworks

• Should "facilitate embedding risk appetite into the financial institution’s risk culture" 
• Development and establishment is an "...iterative and evolutionary process that requires ongoing dialogue throughout the financial institution to attain buy-in across the organisation" (groan)

Risk Appetite Statements

• "Risk appetite may not necessarily be expressed in a single document; however, the way it is expressed and the manner in which multiple documents form a “coherent whole” need to be carefully reviewed to ensure that the board obtains a holistic, but compact and easy to absorb, view of the financial institution’s risk appetite"

Risk Limits

• "Having risk limits that are measurable can prevent a financial institution from unknowingly exceeding its risk capacity as market conditions change and be an effective defence against excessive risk-taking" - tell that to Lehmans!

However, the salient points for me were as follows;

Risk Appetite Frameworks

• RAF "...sets the financial institution’s risk profile" - not convinced on that one, but may be semantic issue
• "explicitly defines the boundaries within which management is expected to operate when pursuing the institution’s business strategy"
• Should "be adaptable to changing business and market conditions" to allow for limit increases where appropriate

Risk Appetite Statements

• "[should] address the institution’s material risks under both normal and stressed market and macroeconomic conditions"
• "...should establish quantitative measures of loss or negative outcomes that can be aggregated and disaggregated"
• "...include key background information and assumptions"
• "...include quantitative measures that can be translated into risk limits"
• "...be forward looking and, where applicable, subject to scenario and stress testing"

Risk Limits

• "[should] be set at a level to constrain risk-taking within risk appetite"
• "...should not be strictly based on comparison to peers or default to regulatory limits"
• "[should] not be overly complicated, ambiguous, or subjective"

Roles and Responsibilities

The Board

• ...must establish the institution-wide RAF and approve the risk appetite statement, which is developed in collaboration with the chief executive officer (CEO), chief risk officer (CRO) and chief financial officer (CFO)
• FSB specifically comment that Boards who "receive" or "note" Risk Appetite Statements have a lower understanding of risk appetite (so don't sponsor it!)
• " [should] regularly review and monitor the actual risk profile and risk limits against the agreed levels (e.g. by business line, legal entity, product, risk category), "including qualitative measures of conduct risk"
• " [should] ensure risk management is supported by adequate and robust IT and MIS to 
• enable identification, measurement, assessment and reporting of risk in a timely 
• and accurate manner."

CEO should

• "...be accountable, together with the CRO, CFO, and business lines for the integrity of the RAF"
• "...ensure that the institution-wide risk appetite statement is implemented by senior management"
• "...provide leadership in communicating risk appetite to internal and external stakeholders" 
• "...establish a policy for notifying the board and the supervisor of serious breaches of risk limits and unexpected material risk exposures"

While there are specific sections for the obligations of CRO, CFO, Internal Audit and Business Unit Management, they don't necessarily expand much further than what I consider to be normal functional expectations, so I haven't elaborated on them.

One should certainly therefore expect a much more aggressive approach from supervisors in future off the back of this - combing through strategy and board papers for evidence of Risk Appetite in application, and making sure that Risk Appetite Statements are not just 'rubber stamped', for example.

I certainly don't see much in this for stakeholders. Nothing particularly new is brought to the table here, and if this is the results of peer review and shared experiences, then clearly there is concurrence on how an RAF should be constructed, what a RAS looks like, and who should do what in regard to continuous monitoring.

The skill will be for risk practitioners to convince their CEOs/NEDs that, this is no longer a sidecar activity in the ERM best practice space, but a nascent global minimum standard which will invariably surface in national regulations in the forthcoming moths and years.

Fit and Proper Persons in financial services - judge not, lest ye be judged

A quick note on the high-profile leadership-related crises which have reared their heads over the last couple of weeks, and whether the risk management professionals of the world can learn from them.

Two stories related to the flip-side of the kind of driven, charismatic figures that can progress rapidly through their chosen careers while coping with some rather spectacular character flaws. One being the ex-Chair of the UK's Co-operative Bank (already in financial turmoil), caught in a drugs and prostitutes sting this week, which has followed on from the city mayor of Toronto, who has been drawn into a similar web of videotaped misbehaviours.

Sticking with the financial services example, we have a number of issues which should interest the risk pros;

• A Chair with no financial services experience or qualifications (Northern Rock encore un fois!) ...
• In an organisation undergoing a massive transformation after acquisition...
• With a previous (if expired) criminal conviction...
• Who had resigned from public office while in the role due to pornography-related misuse of office equipment (reported at the time as due to "increasing responsibilities" at Co-op!)
• Who then (allegedly) used his work e-mail to solicit prostitutes (bottom of article)
• And all of this post-dating the nadir of the financial crisis, when one would have naturally thought that both institutions and the regulator would have been on point on such a matter.

Some elements of the story are dominating the headlines, such as the gender of the prostitutes, the type of drugs used, or the fact that the Co-operative movement, purporting to have a higher calling than the soul-hoovering plcs, should perhaps be impervious to such matters. 

For me, we have a straigthtforward case of significant internal control failings across departments, a failure to hold senior management to account when breaching internal policies, and a very strong working example of a reverse stress test, combining a number of risk factors which in concert deliver a failed business model. On that basis, I would think that the business-as-usual risk teams across the country will be analysing this one until the cows come home.

How much of a bum-paddling the FSA/PRA deserve on this is another matter. Whether light-touch or prescriptive, I think regulators in many countries will wince at the details of the approval of Rev. Flowers' appointment once this one plays out at Treasury Select Committee over the coming weeks (I have no insider information, but let's face it, we'll be watching through our fingers!). 

For context however, in 2009 the FSA (as it was then) made a formal submission to the TSC addressing many of the failings uncovered by the retreating tide post-Lehmans/Bear Stearns/Northern Rock, and what Hector Sants & Co had planned to make up the shortfall. 

The TSC made a number of comments (sandwiched within the FSA's submission) which are worth highlighting today - I have emphasised the parts which should now echo in eternity;

The FSA's assessment of whether senior bankers were fit and proper for their posts appears to have been little more than a tick-box formality, unless the applicant had a criminal record or gave some other evidence of a shady past. That bar was demonstrably set too low. We welcome the acknowledgement from the FSA that a candidate's competence, as well as their probity, will now be thoroughly reviewed before taking up a senior post in a bank. We recognise that there may be some dangers in the FSA assessing competence, not least because the FSA will become exposed to accusations of incompetence itself, if it makes a wrong judgement

We recommend that the FSA assess whether bank executives should possess relevant qualifications. We would like to see banking qualifications become one of the core indicators against which the FSA can assess a candidate's competence. If a candidate has no relevant qualifications, the onus should be on them to prove to the FSA that they have relevant compensatory experience

And from the PRA themselves...

We strongly agree that it is important for bank executives to have the right level of skills and experience. As noted above, we have recently written to all CEOs of relationship-managed firms reminding them that it remains the firm's responsibility to ensure that the candidates they put forward are fit and proper to perform the role in question, and that firms should, therefore, have robust recruitment, referencing and due diligence processes in place

It was only three years ago - at what point do we (grim pun intended) practice what we preach on corporate governance in financial services?

Omnibus II a done deal - Greens left feeling, errr, green?

So, having become bored with collapsing into their own tedium like a room-temperature flan, the Omnibus II negotiations reached an inevitably grim climax yesterday, with a deal bashed out to everyone's mutual distaste at the last possible minute - the basic details are here from the European Commission.  

Bearing in mind the volume of noise on the subject over the last 24 hours in particular, I figured I'd better pull a consolidation post together for my own benefit if nothing else!

The highlights are (apparently - no text released as yet);

1. Transitional measures extended for 16 years
2. Massive equivalence carve out (10 year "temporary" renewable facility)
3. Transposition date moved to end-March 2015
4. Matching adjustments and volatility adjustments more generous to the industry than recommended
5. The generosity of those adjustments countered by some qualitative measures around planning and disclosure.

Winners?

• Industry - Allianz's CFO rather boldly speaks on behalf of the entire European Insurance Industry, stating the deal is "...ambitious but acceptable". Prudential's CEO thinks it is "great progress" and "a good package", while Talanx "welcome the decision very much".
• Heavily indebted governments and companies - Burkhard Balz is happy to trumpet that "...we have also ensured that insurance companies will be able to continue to fulfil their role as long-term investors" through the lengthened transitionals and juicy adjustments. This will hopefully encourage insurers to splash some cash on long-term debt instruments and infrastructure projects where they may otherwise have stayed shorter-term.
• EIOPA - While they were happy to simply "welcome" the agreement, Sharon Bowles emphasises that "This marks the point at which Eiopa becomes fully fledged".
• Sharon Bowles - has surely enhanced her reputation by finally landing the most fraught European negotiation since the Abba reunion.
• Consultancies - will surely use the "tight timescale" routine to press gang the nation's NEDs and Execs into writing one more cheque.

Ambivalent?

• Insurance Europe didn't have much to say, other than acknowledging that the deal is not ideal, though provides a "workable base". They remain concerned about the "ambitious timetable".
• Groupe Consultatif also reinforce their continued support.
• The European Council apparently couldn't be bothered to send a big hitter to trumpet the big news, leaving it to one of the COREPER lads (well, an ambassador)!

Losers?

The Left - while it is no surprise that Sven and the Greens were left sulking (and doesn't the boy blog well!), the extent of his rancour, whether Party line or personal, doesn't augur well for when he and the ECON crew take it through Plenary, for example noting that the deal;

• "...[is a] flagrant violation of common market principles"
• "...[is a] grab bag of goodies"
• "...ignores the advice of the European Systemic Risk Board"
• "...resulted in the EP adopting a far more industry-friendly package in self-denial of the original mandate voted by ECON "

Perhaps most bitterly, he then promises to "...personally make sure that all companies making use of the agreed privileges will be named and shamed on a website including their brands and the billions of missing capital". 

You don't want to make the Greens angry now, do you...

Standard and Poors on European ERM - momentum lost after Solvency II delays?

S&P released these pearls of wisdom regarding ERM within European insurers, specifically whether the additional breathing space offered to Solvency II may put the brakes on developments.

There's certainly no sitting on the fence with them - they start with the following as a statement of fact;

...the delayed start date of Solvency II has prompted some insurers in the region to reduce their efforts in developing ERM

Unsupported, but probably fair! They are also overwhelmingly positive on Solvency II on the whole, for example;

Solvency II remains a major driver of ERM improvements in Europe

the Directive has firmed up insurers' approaches to risk appetite, risk governance, and risk reporting

The introduction of the Own Risk and Solvency Assessment (ORSA) process...has helped to embed risk appetite in insurers' operations

Solvency II has brought risk management to the fore in insurers' strategic planning 

Easy to take any of those comments to task in the UK and Ireland, where national corporate governance code revisions, listing requirements, IAIS considerations and developments in both the actuarial and  nascent Risk professions are all taken very seriously by the respective industries, all the while cognisant of the shadow cast by Solvency II. In addition, the disciplines espoused by S&P's ERM assessments are practiced to a decent extent in existing ICA/FCR processes/reports, regardless of how 'ORSA-fied' they have become over the last couple of years.

This potential slight to the Western world is remedied on p7 however, where the research acknowledges that Western Europe effectively leads the way on ERM, and in the appendix (p8-12) where the league tables sit Germany and the UK firmly at the top of the ratings class.

They ultimately get to the real crux of their fears with this;

We would view negatively any evidence of a reduced role for economic capital in insurers' capital management arising from the delay

They are also gunning for insurers who continue to sell uneconomical products in the face of sustained low interest rates (p4), and validation standards in internal modelling (p5).

One would hope that, certainly in the UK with ICA, ICA+, and a supervisor who is continuing to staff pre-application for internal models adequately, that momentum around using economic capital in decision making will not be lost during 2014, particularly now that the PRA have as good as said that they accept EIOPA's preparatory guidance.

So give this a read if you want to know where your firm lies in the S&P ERM rating table, and if their opinion matters to your bottom line, be sure to quote this material when your Programme sponsors try to take the pace of 2014 Solvency II activity!

 

 

The PRA Consultation on EIOPA's Preparatory Guidance - priorities for 2014 and 2015

After 10 years, it's finally getting interesting - the PRA today have dropped out a consultation paper on applying EIOPA's preparatory guidelines to PRA-authorised firms (CP 9/13). You can get at the EIOPA materials through this post for convenience.

The content will, subject to any intense lobbying by industry, be adopted as a supervisory statement (section 233) to cover the 2014 and 2015 calendar years, with the expectation remaining that 2016 is our "go-live" date. It covers the following aspects of the preparatory phase;

• The PRA's expectations of firms as they prepare for Solvency II;
• The PRA's approach to implementing the guidelines; and
• The PRA's interpretation of aspects of the guidelines.

They are at pains to highlight that these are "preparatory" guidelines, and provide the traditional spiel on "nature, scale and complexity", so incremental progress is to be expected during the period in question. What that means in practice is perhaps another thing - can you show measurable 'incremental progress' for materials which are only on an annual review cycle, for example? - but that aside, it's worth picking the bones out for your respective programmes, and perhaps most importantly, getting your feedback in by November 15th if you don't like it!

Perhaps the most noteworthy aspect of this CP is that in no way is it suggestive of the PRA rejecting any of EIOPA's guidance (remember, they have until the end of November to voice any protest). That of course makes preparatory work much easier to plan for, as the UK will seemingly be doing it all!

My thoughts on the specifics were as follows;

System of Governance (SOG)

• Emphasise that the SFCR requirements around SOG are also catered for in EIOPA's work (3.7), so a smart move would be to factor that into your drafting plans during 2014
• General governance requirements "largely consistent with SYSC", though individuals holding key functions might expect a personal visit in the next two years (3.10)
• Similar position for Risk Management Systems (3.12), stressing the commonality of requirements with existing PRA obligations, but stressing in particular that firms should be "...including suitable mechanisms and methodology for connecting to their ORSAs and for carrying out regular stress and scenario tests" during the preparatory phase.
• That Prudent Person Principle is not a new concept to the PRA, but firms would be expected to review investment strategies in line with PPP over the next couple of years. A concession is seemingly made regarding the provision and review of third-party data by investment functions for smaller firms. 
• On the (new) requirement for a Capital Management Policy/Medium Term Capital Plan (3.16), they are not moving, despite the howls of protestation - "The PRA regards the development and implementation of such policies and plans as an integral part of sound risk and capital management for all firms, especially as their management and Boards assess the implications of the forthcoming Solvency II own funds and capital requirements"
• On internal controls, they appear to be fishing for firms to analyse whether their existing framework is Solvency-II ready, and then piggy-back of that self-assessment (3.17)
• Same for Internal Audit function readiness! (3.18)
• Actuarial function get a more bespoke treatment (3.19), with all firms asked to "carefully consider" the functional structure to avoid conflicts of interest. They also reserve the right to "...review firms’ analysis of the areas required for improvement, and understand the actions the firm is taking to resolve these".
• Outsourcing similarly gets additional treatment by the PRA (3.22), who are "particularly interested" in changes made specifically with Solvency II readiness in mind

Useful quotes

...the PRA articulates its expectations of firms in the preparatory period, including that firms should read, assess and implement the substantive provisions of the guidelines in order to achieve the intended outcomes (2.5)

The guidelines and this statement are designed to work towards a consistent and convergent approach in preparations for Solvency II and not its early implementation (2.6)

 The PRA expects firms, when asked, to be able to explain what governance changes they need to make to satisfy the guidelines, how they plan to make those changes, what progress there has been to date and any particular difficulties they face (3.4)

The PRA expects firms to be able to document their overall approach to outsourcing, including contingency plans in the event of a service provider failure, to ensure that the efficiency of the service remains unimpaired and uninterrupted. (3.22)

During the preparatory period, the work of the actuarial function will now focus on co-ordinating the calculation of technical provisions, providing an opinion on the underwriting policy and reinsurance arrangements and contributing to the development and performance of the internal model in the pre-application stage where relevant (3.19)

During the preparatory period, the PRA encourages firms to consider how to manage the transition to the new regime and to assess the impact on existing asset portfolios of Solvency II requirements. This need not necessarily mean that changes have to be made to firms’ investment strategies or portfolios but firms are encouraged to work on an incremental basis towards demonstrating that they meet the requirements of the PPP (3.14)

During the preparatory period firms should review their existing policy for assessing fitness and propriety and whether it needs updating in advance of Solvency II (3.11)

FLAOR/ORSA

• PRA only planning to review assessments "...on a proportionate basis" during preparatory phase - they elaborate further by stating "Due to the high number of ORSAs which will be submitted, the PRA expects that it may have to stagger its review of these during the preparatory period in a way that is risk based and proportionate". Does that mean "Top Ten & Lloyds & IMAP" get the works, with everyone else getting a lite-touch?
• Expectation that improvements are identifiable between the 2014 and 2015 FLAORs - the PRA will contact firms individually if they are within the threshold limits which enact guidelines 14-16.
• On ORSA documentation, "...firms should recognise the need for effective documentation and record keeping", for both Policy and Report (4.7)
• Note that the Board's involvement in ORSA is "...far more extensive than setting risk appetites and tolerances", and leave an open threat to go through Board packs/agendas to ensure this is the case (4.8)
• Smaller firms get permission to use their internal ORSA Report as the ORSA Supervisory Report, provided it has enough detail. Larger/riskier firms may conversely be asked to supplement whatever they submit. (4.10)
• PRA actually considering issuing a "summary sheet" to firms in order to help gather information consistently (4.11). Here comes the ORSA Template!
• Expectation that 2014 projection work is done on existing basis, and 2015 (ideally) on Solvency II basis (4.15)

Useful quotes

The preparatory period is a time of development for firms in designing, compiling and trialling these assessments (4.3)

To help capture [ORSA] data and information in a consistent way from firms and facilitate review the PRA is considering whether it may be beneficial to provide a summary sheet to firms (4.11)

The PRA does not intend to prescribe when firms should submit their ORSA...Firms should inform the PRA when their ORSA will be submitted well in advance of the submission date (4.19)

The PRA expects the Board to play an active part at various stages, providing initial steering on how the ORSA should be designed and documented, challenging on risk identification and mitigation along the way and culminating in the Board approving and communicating the finished product. (4.8)

The PRA expects all firms to develop a qualitative process to develop an ORSA which can be documented and reviewed by the PRA in line with its overall proportionate approach.(4.6)

Submission of Information

• Confirms that XBRL is required prior to 2016 as submission format for QRTs (5.7)
• Suggest that policies and procedures around reporting in firms may need "potentially significant revision" in light of Solvency II. (5.15)
• Rather obscurely, they write, "The PRA does not expect that preparatory reporting will be subject to a requirement for external audit but it may draw upon audited inputs" - as I recall the participation of external auditors in QRT-type reporting has been a massive bone of contention in Brussels (indicated within these IRSG comments from last year, but I'm sure there's a more recent story), but potentially not a welcome development.

Internal Model Pre-Application

• They isolate the Model Change policy as an example of something which should already be tested for its appropriateness (6.5)
• Still expect firms to come forward and brief them on "significant" changes during pre-application.
• Surprisingly, very little else,

Useful quotes

...it is important that where models are sufficiently stable, firms are beginning to demonstrate their use and continue to refine their models with the benefits of experience (6.5)

I may fire some feedback in, but ultimately I suspect this lady is not for changing...

Governance Matters correspondence with the European Commission - Klaus but no cigar?

I mentioned that back in June that, as part of the EU-wide informal Solvency II shutdown, that I had fired off a couple of notes to various EU bodies to see whether or not a second "Quick Fix Directive" would be needed, or if the Commission were going to start proceedings against anyone who hadn't transposed Solvency II into national law (given that, after the 30th June, this was, on paper at least, a possibility).

We of course have had all of the information required on the matter since last week, and can now safely plan programme activity for 2014 and 2015, knowing that any forks in the road come Feb-March time may add another year to kick-off, but won't substantially change what supervisory authorities will expect from the industry.

That said, I was surprised and delighted to receive a reply from Dr. Wiedner on the matter today (below), albeit with an "after the Lord Mayor's Show" feel about it! In it he acknowledges that the threat of proceedings is indeed a viable one, but one which of course wouldn't be pursued in light of Quick Fix 2 (we'll work on the premise that it will sail through co-decision!).

 

So if you want your bureaucratic doors opened gently and without haste, you know where to come!

Workplace stress, and the need for inverted commas

A quick one on the news today that Hector Sants, ex-Chief Executive of the PRA, has been signed off with exhaustion and stress 8 months after taking on the role of Chief Compliance Officer at Barclays Bank.

There is no question that the role he has taken on is a beast - along with the conventional mis-selling/malpractice stories unwinding in UK banks (PPI, Personal loans, Interest Rate Swaps, LIBOR), they are also getting the third degree over their curious ability to have avoided a bail-out back in 2007/08, when all around them failed. As far as control functions go, it is as big a job as UKplc has to offer.

The top boy over at Lloyds had experienced something similar last year (emerging as insomnia in his case), and has thankfully got his mojo back, having recognised that one can't do everything when you're driving a bus of that size. Some of the media still fancied a nibble at this, from Peston's glib headline, a full piece following the announcement on "failing the stress test", though neither plumbing the red-top depths of capitalising the word "stress" as if the very concept bent the laws of credulity.

Perhaps the unsavoury element tonight is that this kind of reporting still seems kosher (for example, some outlets seem to need to use quotation marks around "exhaustion and stress", while others don't). I have no experience with stress in the workplace, and don't propose to start campaigning on the matter - when a man is ill though, it's pretty poor form to bleat about journalist-inspired "controversy" around his pay package or knighthood. Get well soon yessir...

  

PRA and Early Warning Indicators - Knowing me, knowing EWI...

Couple of interesting bits have popped up in the last week on the PRA's Early Warning Indicator (EWI) initiative, which I had touched on earlier in the year. At that time it was a little hard to establish the lie of the land, other than the PRA approach to preventing potential 'gaming' of internal model capital requirements was markedly different to that of their European NCA counterparts, and that EIOPA fancied their chances of doing the job on the NCA's collective behalf.

Julian Adams gave a speech at the Insurance Institute of London last week where he commenced with a rather familiar lament about how, at the outset of the FSA/BoE splice, "...we knew that there was some concern in the insurance industry that the Bank didn’t understand insurance". After collecting the award for 'understatement of the year', he then waxed lyrical about the five lessons learned by the BoE from the financial crisis, and how these are being applied currently to insurance supervision in the UK;

1. "...the need for a prudential supervisor to focus on the risks that might materialise for firms in the future"
2. "...not enough to focus on static point-in-time assessments of firms’ solvency positions"
3. "...for some issues it is not enough to just look at the risks within individual firms and address them at an individual firm level. Instead, we need to supplement this analysis with work across the system as a whole"
4. "...the need for clarity about the objectives of prudential regulation"
5. "...the need to have multiple reference points when assessing firms’ capital positions. Simple crude measures are not sufficient in themselves, but neither are complex models"

The last one is of course our context setter for comments later in the speech justifying the EWI approach, which for me reads as a laundry list of why existing model validation activity, assumption setting processes and expert judgements must be considered ineffective by default, rather than after PRA review.

One brush - two industries?

Most significantly from a strategic perspective is the confirmation that the PRA "...wouldn’t expect firms who fall beneath [the EWI limits] to release capital until we, and they, have reviewed the appropriateness of the modelled calibration".

Alongside this speech, Chris Finney has published a scathing article on the PRA's approach to EWIs, focusing on its legality at both national and EU level, its unwillingness to consult on the matter, and ultimately how the PRA's experiences with banks a few years back (well. the FSA/BoE, but let's not split hairs) have seemingly allowed the insurance industry to be smeared with the same tarry brush.

With the PRA seemingly using their "lessons learned" rationale alongside the equally informal "interest" of the IAIS and EIOPA in non-modelled capital backstops, is that really enough to fend off (current) UK statute and (pending) EU law if the industry fights back?

Solvency II, 2016 and "Quick Fix 2" - Let the music play...

So despite my best baiting at the start of the summer, it has taken until this week for the big news regarding Solvency II to emerge, namely that, via Quick Fix 2, a layer of formality is likely to be given to the year 2016 as the "go-live" date by the European Commission, provided this draft Directive gets safe passage. Apparently, assurances were given by the co-legislators (p3) that this should be enough time to get it done.

Let's have a look at what exactly has been pushed out, and by whom;

Commission - statement from Michel Barnier
- "The Commission [on 2nd Oct] at my request put forward a draft Directive postponing the application date of the Solvency II Directive to 1 January 2016"
- Current trilogues are "progressing well" and an agreement between the co-legislators is "within reach", which seems to tally with Gideon's report from last week - the Council's "state of play" meeting is still scheduled for 15th October, which being prior to that last trilogue meeting, may help all parties.
- Mr Barnier "...has always wanted rapid application of Solvency II", in case anyone thought otherwise.
- EIOPA's LTGA report is an "excellent" one, in case anyone thought otherwise.
- Postponement done "...only after obtaining assurance from the Council and the Parliament that they would not further change this new application date of Solvency II"

Consultancies
- Apparently KPMG reckon that the industry is breathing "...a sigh of relief", while PwC reckon the date set is indicative that Omnibus II will be settled "...ahead of the Parliamentary elections in 2014". Deloitte's finest highlights that the extended transposition period (effectively doubled) will aid NCAs in giving permission to arbitrary things such as day-one model applications, USPs etc.

Lobbyists
- Insurance Europe don't like it! Still seen by them as an "ambitious timetable", which will lead to a "...significant increase in costs for the industry", which makes one think that the "sigh of relief" heard by KPMG was their own relief at securing two more years of advisory cash...

How much scope is there for something to go wrong now, given the benevolence/pragmatism of the Commission in granting this two year kick-on? Chris Finney covers that off here, most pointedly with the fact that a number of the co-legislator top-dogs giving their "assurances" may have gone to pastures new well before 2016.

PS Programme Managers and CFOs - Try not to laugh or cry at point 4 on the draft Directive document - "The proposal has no implication for the EU Budget".

Reporting/Submission of information to NCAs - EIOPA's FINAL preparatory guidance for national supervisors

And last, but not least, EIOPA have produced their final preparatory guidance to NCAs regarding the submission of information by firms to their supervisors, covering both quantitative reporting templates (QRTs) and narrative reporting. The consultation paper (summarised here by the PRA) caused quite a stir due to the volume of requirements during what is purported to be the 'preparatory phase', and even EIOPA's own Insuarnce and Reinsurance Stakeholders Group (IRSG) put the boot in on a number of elements.

It was of course natural that a combination of parallel running, legacy system horror-shows and potential ambivalence from third party information vendors was going to make this consultation the most controversial, but that said, the outcome appears to be pretty fair insofar as concessions have been made by EIOPA while still keeping the pressure on over-reluctant firms to construct the required processes in a timely manner.

One attempt at quarterly reporting is therefore retained (set for Q3 2015) as well as one run at completing annual templates, based on YE 2014.

The preamble borrows from the other preparatory guidance documents without anything new, so ignoring that, the following items jumped out at me thematically;

Concessions
3.54 Despite the gibberish in paragraph a), this effectively allows for some simplification in the quarterly reporting during the preparatory phase
3.55 Captives are excused for the quarterly run in Q3 2015

Parallel run costs/strains
3.58 As with other papers, EIOPA don't care!

Template changes
3.62 A change log covering amendments between the original template release and those now available has been included to help firms level any work already done in this space. A surprisingly large number of changes made, magnifying the difficulties faced by firms, NCAs and ultimately EIOPA.

Legal entities which are below the threshold
3.72 If a legal entity is below the reporting threshold in isolation, but forms part of a group which is above it, the LE will still have work to do

Annual reporting
3.76 An extra two weeks added to the submission deadline (now 22 weeks for solos, 28 for groups)

Quarterly reporting
3.81 As above, the requirement to report on Q4 2015 has been removed, a practical attempt to manage the myriad other reports expected from firms in early 2016.

XBRL
3.83 Up to each NCA as to whether they demand firms use XBRL in submissions - I think some of the supervisors may already favour it or have indirect experience of handling it (UK, Ireland, France)
3.84 EIOPA will provide a tool to aid firms in doing this, should they want/need to

Internal Model applicants obliged to complete Standard Formula templates
3.94 Confirms that IM applicants will need to complete both, though their SF template work will be governed by the pre-application for internal model guidance (due to the different timescales applicable to that work)

Narrative reporting
3.102 Not negotiable - get it done!

Balance Sheet
3.106 Statutory accounts figures must be included

Assets
3.111 Unit-linked assets will not be exempted - also a clumsy reference to "contagious risk", one of many which betray mother-tongue related drafting problems

Particularly telling is that while the IRSG were obliged on some of their issues, they were not able to drive home all of their agenda - they had asked for and additional 4 weeks for completion of all templates for example.

Unquestionably a great deal of work to do for both firms and NCAs on this matter, and with existing reporting teams no doubt working to tight schedules, the sooner 2014 programmes factor in this disruption the better.

Pre-application for Internal Models - EIOPA's FINAL preparatory guidance for national supervisors

So the March consultation document for internal model pre-application brought a few eye-openers for those countries partaking in a less onerous application process than that favoured by the UK, with the detail in it suggesting that the UK very much had the whip hand in its drafting.

On the basis that there were still areas which even the most hardened IMAP-veteran may have winced at, it was interesting to see if anything got dropped in the lobbying stampede. On that basis, the final guidance for internal model pre-application covers the following in the preamble;

• 3.10 - That it is not in the NCAs gift to conduct pre-application preparation along the lines of provisional approval or to provide "roadmaps" to compliance (which may explain the PRA's caginess with the industry). It is purely about a firm's preparedness and suitability to submit an application
• 3.33 - On request, EIOPA have introduced a compulsion for NCAs to provide "regular feedback" to firms
• 3.35 - Confirms that not all model changes need to be reported to NCAs during pre-application, just those considered "relevant" by firms themselves

It is fair to say that the lobbying in this space has been noticeably more successful than for ORSA or System of Governance, no doubt due to the smaller sub-set of affected stakeholders having a more concentrated relevance. That said, there were still a number of rebuffs from EIOPA, particularly where the lobbying looked more like whinging about paperwork volumes! Highlights below;

Model Change Policy

3.38 - No danger of EIOPA supporting the recommendation to "fast track" model change approvals if a "major change" is required at short notice. They instead recommend "proactivity" with NCAs. Not sure what this does for the world of opportunistic acquisitions though

3.40 - Fudged the question as to whether parameter changes are considered "major", offering an answer of 'it depends' which, for me at least, leans more towards 'yes they are'.

Use Test

3.42 - Confirms that evidencing "use" is not compelling use of model outputs over and above other techniques

Assumptions and Expert Judgement

3.46 - Documentation and validation of assumption setting and expert judgements considered "crucial" in order for undertakings to counter the lack of data and subjectivity in those processes

3.47 - A guideline has also been amended to confirm that the materiality principle applies for this topic

3.48 - Only the most material assumptions will need AMSB sign-off

Methodological Consistency/PDF/Calibration

A number of changes made to clarify guidance in these areas

Profit and Loss Attribution

3.64 - No escaping the requirements to produce P&L attribution granularity at Legal Entity level, as well as by risk driver

Validation

3.68 - EIOPA do not accept that those who build models may also validate them

Documentation

3.70 - That the guidance around the documentation of the internal model should provide "...[protection] from key-person risk", which I have never seen offered as justification from the supervisory end before

Ultimately, there have been no huge concessions from the position in March, which one would think will cause a number of the more liberal EU regulators to give serious consideration to "explaining" rather than "complying" - that said, with this having been written in Union Jack ink, my British cousins should simply get their transition planning updated accordingly.

EIOPA's FINAL preparatory guidance for national supervisors - it's on at last!

Sporting less change than a busker's flatcap, EIOPA have published their final version of the preparatory guidance for the EU's National Competent Authorities (NCAs) to get themselves ready for Solvency II ahead of the anticipated implementation date of 2016. You can catch my post on EIOPA's consultation papers here if you want to dig out their position prior to the consultation, which saw over 4,000 comments offered.

EIOPA - Thanks for the feedback,
here's your change...

Over the last week, while I have been recuperating from yet another rugby injury, there is plenty of chatter recently about the kick-off date, Omnibus II's progression through trilogues (and hopefully parliament before the May 2014 elections), etc elsewhere, so I've just had a run through the final guidance to see what got lobbied out, and whether that is a win for all stakeholders, or just the industry. As the PRA have already made it clear that should the go-live date move, their expectations on supervisory reporting will also move (p3), whether it is 2016, 2017, etc. is kind of a moot point.

The mainstream press has trumpeted the big wins as being in the reporting space which, judging by the IRSG's scathing take on that topic, should be no surprise to anyone. However, it would appear that EIOPA have refused to bend for much else, adopting a relatively sniffy tone in response to stakeholders concerns/complaints.


Below are links to separate blog posts covering the more contentious highlights for each of EIOPA's 4 hot topics, while Mike Claffey and the Milliman crew have quickly summarised the changes here;

System of Governance - Final Guidance (EIOPA Doc)

ORSA/Forward Looking Risk Assessment - Final Guidance (EIOPA Doc)

Reporting/Submission of information to NCAs - Final Guidance (EIOPA Doc)

Pre-application for Internal Models - Final Guidance (EIOPA Doc)

ORSA/Forward Looking Assessment of Risk - EIOPA's FINAL preparatory guidance for national supervisors

EIOPA reuse the preamble from the System of Governance guidance in their ORSA/FLAOR guidance, save for confirming that an assessment of overall solvency needs will be expected in 2014 and 2015 (more on that later). I will use ORSA rather than EIOPA's shiny new acronym for my own convenience throughout this post!

It ultimately reads in parts as a circuitous and convoluted piece due to the way that EIOPA have had to splice the ORSA requirements into three component parts, as per Article 45.1 of the Directive, to accommodate the postponement of some elements until 2015. An horrific example of this is point 3.112, which to paraphrase Chris Morris, reads like the ramblings of a drugged horse.

That said, they have clearly had to contend with a mountain of feedback since the initial consultation paper was released, and have done a better job of explaining why most comments were, in EIOPA's view at least, misguided.

Again from the practitioner's perspective I would highlight in general that;

1. There is almost no discernible movement in EIOPA's position, even after lobbying;
2. That explanations for the inclusion of contentious content are generally forthcoming, though for this subject are more forthright and pragmatic (perhaps naturally due to the lack of L1 and L2 substance);
3. That 2014 ORSA is a genuine piece of work which will require the attention of the most senior staff in insurance firms - it would be a brave company that play-acts at any elements of the documentation, processes and outputs of the assessment.

Supporting arguments for EIOPA's final views are listed below, along with any relevant commentary from my practitioner's angle; 

Clarification re Omnibus II
3.49 - If go-live in 2016 does not happen due to further Omnibus II delays, "...undertakings will still be expected to perform the [overall solvency needs] assessment from 2014 onwards"

Clarification re continuous compliance with SCR and Technical Provisions calculations requirements, and the deviation from SF SCR assumptions assessment
3.50 - Confirm that these elements are postponed until 2015, and that technical specifications will be forthcoming from EIOPA by year-end to aid in the conduct of some of this activity.

Parallel running Sol I/Sol II concerns
3.53 - basically, not EIOPA's problem!

Compulsion for model applicants to also use SF in the assessment
3.54 - clarify that this in NOT about benchmarking models, rather "taking into account contingencies" should a firm's model not get through IMAP. A thoroughly negative and unsympathetic approach from EIOPA on this one I'm afraid

Timing
3.58 - "EIOPA considers it necessary that all undertakings perform the assessment of overall solvency needs at least two times during the preparatory phase, once in 2014 and once in 2015...[and] at any time during 2014"
3.60 - Stress that "...it is for the undertaking to decide on the appropriate reference date for its FLAOR", though couched in an expectation that financial year-end is most likely.

Guideline 5 - Delegation of activity by the AMSB
3.73 - "not acceptable" to delegate full responsibility for ORSA to sub-committees of the AMSB

Guideline 7 - ORSA Policy
3.62 - "...it is necessary to develop a full policy during the preparatory phase"
3.63 - "...[The ORSA Policy] may be part of the policy on Risk Management", though must be clearly identifiable

Guideline 8 - Record of the ORSA
3.64 - Rather bizarrely suggest that the ORSA Record is "...no less, but maybe even more important during preparation that after the start of Solvency II", but either way the message is clear - maintain the records carefully

Guideline 9 - Sharing information internally
3.77 - "It is for the AMSB to decide which parts of the information will be distributed to whom" - clearly some panic amongst respondents that they may have to start telling the 'proles' about their future employemnt prospects!

Guideline 10 - Supervisory Report
3.66 - EIOPA "...does however not expect that the first report will necessarily already be perfect"
3.69 - AMSB sign-off, accepting the results of the ORSA is the trigger for the 2 week window in which to submit the Supervisory Report
3.70 and 3.71 - Some rather confused paragraphs which seem to indicate that, if there is enough resistance to the results internally, that extra time may be afforded to the firm

Guideline 11 - Valuation bases
3.79 - EIOPA scrutiny postponed until 2015, but justifications on bases used expected

Guideline 12 - Overall Solvency Needs assessment
3.83 - EIOPA expect "...it will take several years" before this assessment is good enough, hence they expect the preparatory phase to include practice!

Guideline 14/15 - Continuous compliance with SCR requirements and Technical Provisions calculation rules
3.85 - Postponed until 2015, and again justify activity prior to Solvency II going live by using a practice makes perfect mantra, noting that attempting to do this will "...intensify the learning experience"! I wonder if anyone ever used that phrase in their budgeting requests...

Guideline 16 - Deviation of one's Risk Profile from SF SCR assumptions 
3.89 - Postponed until 2015, and also note that quantifying one's deviation from the SF assumptions will not be necessary "...if there is no indication that the deviation is significant". I guess modellers will have to wind their necks in around Credit Risk assumptions in particular on this matter, bearing in mind the diversity of methods currently on display.

Ultimately, little opportunity for shortcuts then, but perhaps enough time to review what's already in place before resource planning your 2014 activities.

System of Governance - EIOPA's FINAL preparatory guidance for national supervisors

Based on feedback received since their initial consultation paper was released, EIOPA make the following generic clarifications/statements in the preamble of their guidance doc for System of Governance preparations;

• That proportionality will not be defined or presented as examples in the guideline text (p5-6)
• That NCAs are "expected to...review and evaluate the quality of the information provided to them" - bad news for the PRA, who were clinically uninterested in reviewing Solvency II reporting attempts according to one blogger (p6)
• The emergence of a new ORSA acronym, "FLAOR", which looks more like something an amused teenager would write on Facebook (p6)
• The expectation that 2015 will see submissions of (2014) ORSAs to NCAs (p7)
• While there is no generic take on what enforcement action should take place in this interim period, firms are expected to (a) Discuss any negative findings from their ORSA/Governance systems with their supervisor, and (b) To produce SCRs using information of appropriate quality. Enforcement action in the absence of this WILL NOT consist of capital add-ons, apparently (p7)
• That the submission date calendar for all of the information expected will be reviewed at the end of this year, so that EIOPA can take Omnibus II progress into account (p8)
• That the explanatory text in each set of guidance is NOT part of "Comply or Explain" (p9)
• That the reasons behind a negative "Comply or Explain" decision from any country will be kept secret as standard (p10, and disgraceful, frankly).

They then go on to focus on some of the larger bones of contention within the 52 guidelines provided. The following generic points stand out for me as a practitioner;

1. There is almost no discernible movement in EIOPA's position, even after a volumous lobbying effort;
2. That explanations for the inclusion of contentious content are generally forthcoming, though on a number of occasions, flimsy;
3. That planning for 2014 full-year mothballing of Solvency II programmes is not an option, particularly for ICAS+ candidates - some may get away with a few months of inertia, depending on the quality of their paperwork (strategies, policies, process guides/maps, terms of reference, charters etc).

The following supporting arguments for EIOPA's final view were, in my mind at least, poorly formulated, regardless of whether the end result is still agreeable;

3.48 (Guideline 6)

- Refused to add more definition around what constitutes a "significant decision", which is poor form.

3.58 (All of Chapter III)

- That the expectations of Risk Management in insurers  "...comprise risk management standards which are considered to be matter-of-course and wide spread activities" - extraordinarily loose, considering the lack of a majority-accepted global, or indeed pan-European standard on the subject (IRM/ISO/COSO/FERMA/FSB's efforts notwithstanding)

3.65 (Guideline 19)

- That, while it is "not an easy task", Operational Risks should be quantifiable, and therefore subject to tolerance limits - I don't think it would have hurt to suggest (or even compel the use of) a method if it is that difficult.

3.68 (Guideline 25)

- That firms should maintain Investment Risk-related KRIs outside of what might be provided by normal parties (for example, ratings agencies), which would help "...increase overall risk management" - not entirely convinced that a generic "increase" is any kind of worthy ambition. 

3.74 (Guideline 31)

- That a capital management policy and capital management plan is both necessary (though for not entirely convincing reasons when tying back to the Directive)

3.78 (Chapter VI [Internal Control])

- That there is already plenty of clarification on what the Compliance function is charged with. I would agree in principle, but have heard evidence to the contrary in practice.

3.81 (Chapter VII [Internal Audit])

- That they neither wish to mandate or discourage rotation of Internal Audit staff or whistleblowing direct to NCAs - in which case, why mention it!

3.110
- A bizarre comment in response to a suggestion that a public statement should be released by the AMSB annually regarding the discharge of responsibilities around the system of governance that the Directive "...only deals with internal governance, not corporate governance" - think I know what they are fishing at, but terribly worded.

3.144
- Justify their decision not to define risk appetite and risk tolerance in the context of these guidelines

They have however provided some more defendable clarifications, for example;

3.51 (Guideline 11)

- Clarified that the gold-plated "Fit and Proper" requirements apply to AMSB/Control Function staff only, as well as specify what is expected from Outsourcers.

3.57 (Chapter III [Risk Management])

- That in the context of separating the duties of the Risk and Actuarial functions, the Directive is abundantly clear and that undertakings "...cannot deviate from [the Directive's] distribution of tasks"

3.62 (All "Policy"-related guidelines)

- That efforts should be targeted towards drafting the required documents during the preparatory phase. I would imagine this would be "re-working" in the UK, where such activity is most probably long done.

3.67 (Guideline 19)

- That there is no compulsion for firms to operate an electronic database to store operational risk events

3.85 (Chapter VIII [Actuarial])

- That, regardless of the absence of a valuation framework for TPs, the processes behind their co-ordination and calculation justify early activity, rather than "wait and see" on Pillar 1.

3.124
- Regarding Op Risk, activity will have to include "...identifying all operational risks that have crystallised and their near misses" (my emphasis)

Relatively easy in summary then - if it was a gap/issue in your system of governance in March, it probably still is, so go and fix it!

Financial Reporting Council - documenting 'principal risks' in Strategic Reports

I had recently spotted that the UK's Financial Reporting Council had issued draft guidance on the compilation of the Strategic Report for listed entities. This segment of a company's Annual Report and Accounts (currently called the 'Business Review') has been a rather ubiquitous and clunky affair regardless of industry, delivering little information to prospective and existing shareholders about how the company's risk profile, appetite, preferences etc. are catered for when executing its strategy.

Strategic reporting for UK companies 
- elimination of flannel?

Insurers have been prominent in efforts to improve this, though driven more by the need to pacify the FSA/PRA than by Parliament - see "risk appetite" break out from its box in  Aviva's AR&A between 2007 and 2012 for example - but the fact that a substantial piece of statutory reporting generally in the hands of executive management can potentially stray from the lexicon and structure of their increasingly professionalised Control Functions (and for banks and insurers, potentially their Internal Models), is clearly one that warrants some focus.

The Strategic Report will be compulsory content for Annual Reports and Accounts from October (Companies Act 2006 414C). The FRC's (non-mandatory) guidance regarding the incorporation of risk-related material into this section is to address the requirement on p2 that the Strategic Report;

...should include a description of the principal risks and uncertainties facing the company

The FRC's specific definition of Principal Risk is found on p35 of the draft guidance as;

A risk or combination of risks that can seriously affect the performance, future prospects or reputation of the entity. These should include those risks that affect the viability of an entity.

The draft guidance (p23) aims to tack on a few definitional aspects of how "risks and uncertainties" are reported in the context of strategy, most pointedly;

• [The risks] should be limited to those considered by the entity’s management to be the most important to the future development, performance or position of the entity. They will generally be matters that the directors regularly monitor and discuss because of their likelihood, the magnitude of their potential effect on the entity, or a combination of the two
• Principal risks or uncertainties with potential effects of such a magnitude that they may threaten the entity’s viability (ie its solvency and/or liquidity) should be explained fully and given due prominence
• Directors should consider the full range of business risks including commercial, operational and financial risks
• The descriptions...should be 
  sufficiently specific that a shareholder can understand why they are important to the 
  entity. This might include a description of the likelihood of the risk, an indication of when 
  the risk might be most relevant to the entity and its possible effects. Significant changes...

  such as a change in likelihood or possible effect, or the inclusion of new 

  risks, should be highlighted and explained. An explanation of how the principal risks and 
  uncertainties are managed or mitigated should also be included.
• 
  

  Where the risk or uncertainty is more generic, the description should make 

  clear how it might affect the entity specifically.

Prudential provide a good example here (from p72) of how this is currently done by an insurer - the fact that it is buried in 75 pages of 'Business Review' underlines why the streamlining of this work has become of statutory interest!

Interestingly, the FRC note that definition for "principal risks" has been developed/derived from previous FRC work, supplemented by work from the Sharman Inquiry - all of that therefore feels well divorced from anything produced by the IRM/Actuarial Profession/EIOPA around risk categorisation, and leads to the same bridging work I have been involved in previously; namely, reconciling how one manages and monitors risk within the business against what one reports externally. Might we have expected to see some kind of compulsory categorisation of "principal risks" in here that favours the financial services industry who arguably carry the largest set? 

Much of the other compulsory material in the Strategic Report (with exemptions) touches on other topical or sensitive matters such as;

• Inclusion of key performance indicators in the report ("...where possible, they should be accepted and widely used")
• Information on environmental matters, staff and social/community/human rights issues
• Information on gender splits at Board, Senior Management and All-company level

I may throw some feedback in to the FRC on this paper- comments welcome until late November. Externally, the main change for insurers will be trimming down some of the fluff and flannel already produced in the space. Internally, aligning the concept of "principal risks" with existing ERM programme/Internal Model lexicon may be a bigger job for anyone operating on a shoestring.

Towers Watson - 'Risk Appetite revisited' (did we ever leave it?)

I have been doing a little work on Risk Appetite in the background recently, so was intrigued to have a read through this recent release by Towers Watson on the subject, seemingly targeted at North American and UK markets, but relevant to any practitioner in this space. Somehow I wasn't put off by p6 when, in response to the hypothetical question 'What is Risk Appetite', they responded with, "...we do not want to focus too much on the issue..."!

Appetite - second helpings?

I had blogged earlier this year on Risk Appetite, covering the expectations of EIOPA on the matter (which are few), as well as the more pokey/proddy stakeholders like the PRA/Central Bank of Ireland/S&P (which are several!), so the backdrop of risk appetite's practical significance to insurers doesn't need to be repeated here, more how consultants and practitioners are improving their game on the ground. Worth noting here that a few of the other consultancies have proffered their two cents on the matter over the last year or so (here, here, and here).

While interest in 'risk appetite' is currently piqued at governmental level thanks to the forensic examination of the banking industry's failings (multiple references in Parliamentary Commission evidence here and here for example), the driver of activity in the UK and Ireland is predominantly from the regulatory compliance perspective rather than expectations of bespoke, strategy-driving activity. In addition, we now see the emergence of Internal Audit as a party with a vested interest in the matter, which has the potential to draw the subject even more to a tidy, but ultimately superfluous documentation exercise.

With that in mind, Towers note that this paper is focused on "...enhancing risk appetite by improving its articulation, via clearer linkages to mission and strategy", and a rather derisive tone is therefore applied throughout regarding the familiar quantification methods preferred by regulators to monitor likelihood of insolvency in the next 12 months, giving equal billing to non-monetary capital and qualitative measurements. The paper also crosses some familiar ground, such as a lack of consistent terminology, which it tries to address (below).

Oddly, the document does not reference the FSB's thematic review of risk governance earlier this year, which will surely drive efforts in this space in the medium term, if only due to the paucity of certainty on the subject. That the FSB believe that regulators have "more work to do" is striking, and while they also bemoan the lack of common terminology, they don't let that prevent them from offering definitions of their own, as well as listing their "Key features" of a Risk Appetite Framework.

More obvious statements

• "..clearer linkages are needed to mission and strategy for risk appetite to be effective"
• "risk appetites must include boundary constraints"
• "We suggested that greater clarity around the definition of risk is needed..."

Definitions

• Risk - "In this context, risk should be defined in terms of those events and circumstances that may result in an insurer failing to deliver on its mission."
• Risk appetite - "...the manner in which a company expresses an identified set of risk-trading opportunities, and sets boundaries on its risk-trading among those opportunities, aligned with successfully delivering on its mission."
• Risk strategy - "The company’s risk strategy articulates how risk fits with the mission".
• Risk tolerance - "Risk tolerances are a quantitative extension of the risk strategy...risk tolerances must be measurable...[and] place quantitative boundaries on the company’s strategy"
• Risk limits - "Risk limits are more granular tolerance levels expressed for specific risk sources, business units, and/or products that are used to implement the risk tolerances."
• Risk appetite statement - "...risk appetite statements should be taken as the combination of risk strategy tolerances and preferences, bringing together qualitative and quantitative enterprise perspectives on risk as both opportunity and threat."
• Mission - "mission is the insurer’s unique multi-period and multi-stakeholder value creation proposition."

Technical suggestions

• They promote four facets of risk assessment: size, likelihood, impact and significance.
• For those working on statement content, they recommend "...since published mission statements can be fairly terse, the risk appetite may need to look beyond the explicit elements of the mission and consider elements that are implicit." Instinctively that feels unfair, but I guess the world of implicity is one for the second line to inhabit, while the first line concentrate on value-adding.
• Concept of adaptive buffers sits nicely with me - the most visceral ones being economic capital and reinsurance/hedging/liquidity facilities, but TW attempt to expand that over qualitative areas of the risk appetite statement
• Risk preference ranking of 0-4 depicted at the back is a handy schematic

Sore points

• "Some take the view that risk appetite can be expressed as a single metric, or perhaps a small set of metrics, that capture the organisation’s willingness and ability to bear risk." - that 'some' would include the FSB, COSO, the Central Bank of Ireland and the IRM, so I wouldn't be too sniffy at efforts to-date
• "Much of the work to-date on risk appetite statements has been driven by solvency supervision requirements, many statements tend to focus primarily on potential losses of capital"- a natural and by no means unwelcome by-product of having regulators in the box-seat, as opposed to stakeholders combining their efforts to establish compulsory risk appetite statement content?
• "While most insurers have, by now, developed risk appetite policy statements and discussed them with their boards, many have expressed dissatisfaction with the exercise" - that feels a rather loose statement, and if true says more about the personnel charged with performing the work.

I'll take a look at the diversity of definition in the risk appetite space across different bodies in a separate post - for now, just enjoy this tidy piece of work for what it is.