Solvency II Updates and Corporate Governance in Financials - PRA "Back for Good"?

A few releases of note out of the UK regulator over the last working week or so means I had some catching up to do - sometimes it feels like "All I do each night is PRA"...

They started off with a Director's Letter just before the bank holiday weekend. A general unwillingness to crack whips was present throughout this doc, even at this late stage, with a few references to "inform your supervisor" as opposed to "just do it".

The letter states that the PRA were due to publish some of their findings from their balance sheet review work by the end of the month - not done as yet, hopefully turns out to be money well spent

Regarding Standard Formula appropriateness:

• They stress that firms must identify deviations from Standard Formula from their risk profiles, and include an assessment of the significance of that deviation in their ORSAs (emphasised in their October industry presentation from p6)- is the implication here that firms are not doing this at all at the moment, or just not reporting it in ORSA?
• Highlight that "supplementary information" used to explain such deviations will also be assessed by the PRA. Does this add significance to one's qualitative commentary around Standard Formula/Risk Profile deviations? Can a good explanation be the difference between having to IM/PIM at the earliest opportunity against being given a couple of years of capital add-on breathing room?
• The PRA note that, "...where a firm's conclusion on this question is not appropriate", it will intervene. It is not clear how a firm's conclusions about its deviation between SF and its Risk Profile could be considered "not appropriate", but I imagine that anything which attempts to dodge USPs/PIM/IM ONCE the divergence hits the limits in the Delegated Acts (276-287) would be frowned upon. There is certainly no appetite at the PRA for renewing capital add-ons in perpetuity (slide 13), which given the UK's familiarity with ICA and ICG, might be a desperado's first chance saloon.
• The PRA are planning "specific interventions" on this front (detailed here), but not necessarily in time to correct before 2016.

Regarding Internal Models

• Not happy with "wide variation in quality of IM Change policies. Sounds like firms are doing their best to avoid change criteria that results in frequent submissions for reapproval, which one would expect!



IMAP Submissions
- Everything Changes

• PRA seemingly expecting firms to have not only taken on board their feedback, but also had their IMs revalidated, before submitting their IM application. Given that validation will be chalked down as a 'once-a-year' job at the moment (despite the IRM's efforts), that seems highly unlikely. They give themselves a get-out-of-jail-free card though by stating that firms must be confident that any changes in their IMs both address PRA feedback and meet the tests and standards for model approval.
• They appear to advise against submitting applications if you have a material change in the pipeline.
• Heavily critical of Board involvement in validation. Here they look for evidence of Boards "overseeing and influencing" the validation process, whereas previous PRA presentation slides  did not have such expectations of Boards (slide 8 here), or indeed expected more (slide 9 here)!
• The expression "internal management loadings" appeared in my life for the first time, which sounds to a non-technical person like myself that firms are effectively "dumbing-up" the capital requirement currently delivered by their IM in order to plaster over mathematical or data weaknesses. PRA certainly not impressed by industry suggestions to date.
• Given the number of firms who must have dropped out of looking for Day 1 approval, they still shake the pineapple tree here in order to remind applicants that contingency plans should be ready in the case of application failures. "Many firms still have a considerable amount of work to do" sounds to me like some applicants are being pre-warned of their imminent failure!

The PRA also released a consultation paper entitled Corporate Governance: Board Responsibilities, which has the rather light ambition of identifying "key aspects of good board governance to which the PRA attaches particular importance in the conduct of its supervision".

A few straggler items in it;

• That failures in governance and/or risk management have been a key factor in "many" financial sector failures - as opposed to "all"
• That they consider the FRC's Corporate Governance Code, amongst others, a "comprehensive guide to good corporate governance" - given the firms experiencing the financial sector failures were most probably complying with it, not a great advert!
• "Culture is the collective responsibility of the Board" - a bit of a nowhere comment, but instinctively, I don't see how this can be right. They can be accountable to both supervisors and shareholders/members for cultural failings, but where could such a responsibility materialise into demonstrable actions? 
• "...the Board is responsible for the oversight of, but not for managing the business" - in relation to my comment directly above, can both statement be correct?
• "The Risk Control Framework should flow from the Board's Risk Appetite" - I'll work on the premise that this is missing the word "statement" at the end of the line
• Section 11 on remuneration expects that incentives are aligned with "prudent risk taking" - what if prudence is too conservative for one's risk appetite?

Into some of the expected themes;

• Strategy to be "owned by the Board as a whole"
• They wed Culture and Remuneration "...to encourage and enforce the kind of behaviours the Board wished to see"
• They want a "well articulated and measurable" Risk Appetite Statement which can also be "...readily understood by employees throughout the business". Doesn't seem feasible, given the metrics commonly used in risk appetite statements are not exactly Finance 101 (Solvency/Liquidity/Earnings-related),
• "It is the responsibility of the Board to ensure that the effectiveness of the Risk Control framework is kept actively under review" - has at least an air of COSO about it, don't think it was deliberate
• Big section (6) on responsibilities and accountabilities of exec and non-exec directors.
• Followed in 7.1 with "...non-executives should not simply delegate responsibility for major decisions to individuals among them who are considered specialist in the area" - this has internal models written all over it (p5-6)!

Happy to see this second document, though I don't know what it adds to firms' understanding about what is "good and bad".




PWC's Risks in Review - White Paper, Black Sabbath...

A quick dive into the wider world of ERM, courtesy of one of our Big 4 friends, ambiguously titled Risks in Review.  PwC's document (short sign-up required) is US-centric and multi-industry, so for the Solvency II crowd you might need to sift for the goodies (a good illustration of which side of the Atlantic it leans towards is that CFO.com reported on its highlights), but for anyone in the ERM space, there should be something for you here.

A bizarre stat is laid out at the beginning in that 73% of the 1,200+ senior executive[s] and Board members respondents to the survey agreed that "risks to their companies are increasing". Whether this be in reference to the number of risks faced, increases in the likelihood/severity of one's existing risk universe, or their perceptions on emerging risks, it certainly suggests that exogenous and endogenous concerns have not abated in the minds of corporate leaders. However, given the risk immaturity within firms that the rest of the document serves to highlight, the lack of definition is rather unhelpful.

Appetite - For Risk or Bats?

As the survey covers multiple industries, it has the more generic risk classifications in mind (i.e all major quantitative risk balled up into "Financial Risk"), which will no doubt gnaw at anyone on the financial services side, but at the same time, it's not all about you!

The pat on the back for those surveyed is the sobriquet of "true risk management leaders", handed out to 12% of respondents. It frankly doesn't feel like a valid aspiration for an entity, more that being a "risk management leader" would be an implicit part of the make up of any firm which successfully delivers on its strategic objectives.

That aside, the Leaders (of which financial services companies "...represent a sizeable portion" of!) are congratulated for;

• Aligning RM Programs with their businesses.
• Communicating Risk Appetite and Risk Tolerance through the business - nothing on hard risk limits in the paper though
• Being "able to take greater business risks" - I don't necessarily make the link between being "good" at risk management equating to taking greater risks, unless that is part of the business strategy one has aligned the RM Program with.
• Take aggregated views of risk over multiple areas
• Using techniques such as emerging risk identification/forecasting, scenario planning and stress testing

Laggards on the other hand

• Have no formal Risk Appetite Framework (only 38% of respondents do)
• Don't integrate Risk Management Strategy with business strategy (only 31% do)

They also hook the leadership qualities of risk management to some quantitative "value of good risk management" work on p5 (a topic which Towers Watson recently tiptoed around due to a lack of quant), namely that their profit margins and margin growth will outstrip peers. The growth of profit margins might be a bum steer, as the macroeconomic environment is perhaps less kind to industries other than financial services, who of course would have seen margins peak comparably faster over recent years due to the size of the trough in 2006/08!

As ever, the lexicon used in papers such as this takes a dip in the lake of dubiosity, for example:

• That companies should "...treat risk management strategically" - as opposed to what, "operationally"? This kind of expression suggests that risk is not already considered in strategy, which feels unfair and unrealistic, even on the immature firms surveyed. That there isn't a functional ERM Framework to enhance that work does not mean it isn't done at all.
• Risk Appetite Framework should have "buy-in" from senior management and the Board. Why "buy-in"? They should be deeply involved in the construction of an RAF, and their successes or failures as management should be inextricably linked to operating in line with it, not asked to nod in approval at the next Board/EXCO
• "Having a clearly defined risk appetite framework allows companies to quickly assess strategic decisions in the context of risk" - that of course was not a given...
• They also follow the tactic used in the Towers Watson paper in referring to risk management "programs" as opposed to "systems" or "frameworks- again, I'm not trying to labour the sematics of it, but a Programme for me has an end, and the work of a risk management function simply does not. This is perhaps just a psychological angle being worked here to drill into prospective clients that Programs can be boosted with a burst of external advice, but I find it increasingly disagreeable, particularly given the risk management leadership traits highlighted in this document, which most certainly do not lend themselves to the workings of a transient Programme.

Other stand out points would include

• Alignment of RM Programmes against each business function (p9) - horrible result for Sales & Marketing, even for Leaders, and suggests it is an area for us all to redouble our efforts
• Similar to Towers, talk of firms "drowning in data" - cannot fathom this for the life of me, but perhaps that's because I can use pivot tables and SQL server!
• GE Capital's approach to administering Risk Appetite (p16) - very clean, and in a manner which the CRO Forum would appreciate.
• Finally, a really nice section on p19 which shows the discrepancies between executives and risk professionals regarding their own firms' prospects. The Fannie Mae CRO suggests that Risk Management staff are "paraniods by profession" which given his employer's recent history, doesn't mean people aren't out for you!

IRM on Internal Model Validation - Red Card or Green Card?

Cyclic Validation - Quelle horreur...

Just back from Paris, where I spent a weekend queueing behind selfie-taking tourists before taking out a second mortgage to buy bottled water. A beautiful place, though I found Depardieu was much quieter off-screen...

Onto the topic in hand, the PRA were pretty vicious back in the day on Validation efforts in their infancy, with Julian Adams lambasting both progress ("significantly behind") and validation scope ("narrow"). Given that the Solvency II sabbatical which bridged half of 2012 and all of 2013 gave firms time to catch up and widen, you might think that those with internal model ambitions would be pretty tidy by now. The PRA have even told firms how they believe "good" model application paperwork to look, carving out for themselves and the Validators of the world an easy-to-read "model reviewer" level of detail (p1).

In those salad days, Internal Model Validation felt to me like it would be the chernozem of the nascent Risk Management profession in insurers; a skill set that a quant or a non-quant could acquire, apply, and ultimately ease through the promotional path within insurance entities, given the depth and breadth of technical and strategic information the process challenges...

...but the moves never came. Despite the actuarial world themselves happily disassembling the complexities of quantitative modelling into easy-to-digest IM Validation themes, the non-quant world has waited patiently to see if anything of substance would emerge from one of its representative bodies.

And this week it arrived! The Institute of Risk Management has delivered, as part of its Internal Model Industry Forum (IMIF), a white paper on the validation cycle.

The IRM have been active in this area prior to the formation of the IMIF. I have covered an ERM in Insurance event at the start of 2014 here, while this more volumous slide pack featuring a number of the Billy and Betty Big Biscuits of the field emerged from summer of last year, when the IMIF seemed to come to fruition. This white paper itself appears to move along the concepts and ideas inside an IRM slide deck from last Christmas.

Given that the IRM is not-for-profit, there is always a likelihood that sponsors will unduly influence the products (indeed the IRM Chair notes in this that they rely on "enlightened industry support" to knock these documents out).

Sadly in this case, the sponsors include Three of the "Big 4" (with the fourth on the IMIF steering committee) , leaving the document dripping with consultancy hallmarks rather than pragmatic solutions to execute the tasks in hand.

That view is reinforced somewhat by this follow-on presentation to the IMIF from last week by this white paper's workstream lead and supporting consultant - one selected industry comment on slide 8 (presumably from a chocolate bar shortly before it ate itself) reads, "validators should really be experienced modellers"!

A few general points jump out of the white paper;

• That a firm's IM is "...at the heart of risk and capital evaluation" - I thought it was supposed to "inform" this evaluation, not dominate it (slide 3 here, as well as Julian Adams's speech from a couple of years ago [p4]).
• Is the insurance industry "...increasingly reliant on sophisticated models" - maybe in terms of AUM/Market Cap, but given the UK IMAP queue is down to approximately 40 firms out of over 400 (p4), and that number has steadily reduced over the last 3 years, feels a touch disingenuous. I've no doubt the firms represented on the Steering Group are "...increasingly reliant" though
• The document claims to set out "best practice principles" - not sure if "practice" and "principle" share the same bed, but that aside, would anyone find it remotely acceptable to have the consultancy world fund a document which details "best practice" on IM Validation?

And a few stand out elements from the proposed Validation Cycle, which is heavily influenced by EIOPA's guidelines:

• "Best practice now requires firms to demonstrate, with evidence, that the cycle...[is] being actively and effectively carried out" - how can best practice "require" anything from anyone?
• "...resulting best practice that is emerging" (p4)  - how is any practice considered "best" at this stage of proceedings, when we are literally practising! Against what criteria?
• References to "model risk impact assessment" and the "model risk assessment process" (p5) seem to come from nowhere. Alluding to something formal, but not very clear
• Lot of coverage of "triggers" of IM Validation, which feels like a fishing expedition for the paper sponsors, rather than direct address of L2 Art 241 - the number of areas of "change" to consider as IM Validation triggers covers pretty much any change, anywhere, both inside and outside of an insurer (p8)! Most would also be ad-hoc ORSA triggers in my experience, so this potentially sets up insurers for a bucketload of work every time they hear a pin drop.
• Formulaic and periodic IM Validation a "needless cost"? Surely periodic validation, no matter how badly executed, is compulsory (L1 Art 125)?
• The Trigger Impact Assessment stage (p10) is barely legible - "The trigger impact assessment against model risk appetite stage" - and terminologically it is all well above legislative requirements.
• "Unexpected triggers" (p12) get a mention. Again, not making sense to me - you either know your triggers or not.
• "Model validation is complex" and "less than black and white" (p16) - certainly is if you try and follow this process! A focus on plain questions and less quant can only help the models non-expert users (slide 7).
• If the validation cycle, processes and execution are "continuously evolving" (p18), are they reliable? Feels difficult to meet L2 Art 241.3, at least from a planning and execution perspective, if the process is constantly being tinkered with 
• "Developing a communications strategy" (p20) as part of the validation scoping and planning stage feels terribly over-elaborate.
• "Robust planning" expected to be common (p22), which doesn't necessarily marry up with the expectation of dynamic rather than cyclic validation in future (p10)

I think it is right to take the hump to a certain extent here. The PRA have been cunningly silent on capital add-ons to date, but given the implication that they will not be applied and renewed ICG-style (slide 13), there is likely to be many more less monied Partial IM applicants to follow over the next couple of years. Having the most influential consultancy firms decide on what is "best" in the validation world (and for it to have this many bells, whistles and legislative off-roads) feels like setting those firms up for either a fall, or another bill.

The PRA actually delivered something with much less padding to the IRM back at the end of 2013, so I'm struggling to see why that has justifiably been turbo-charged. Given they have three of their finest involved with the IMIF, but are continuing to be directly vocal on this topic (as recently as March 2015), it sends a worrying message to the capital add-on brigade that the IMAP early birds will be setting disproportionately high bars for 2017 and beyond when they deliver their PIMs.

Ultimately, I was disappointed by the publication, which reads more like a flannel manual, and is certainly not the kind of Risk Profession contribution that the topic so badly needs if the PRA's dreams of Board's "directing" and "owning" the IM valdiation process (slide 9) are ever going to come true. The 200 page novella world of Validation Reporting feels closer than ever...

Towers Watson's Global ERM Survey - Knowing ERM, Knowing You...

A couple of treats from two of the powerhouses of the 'writing things down' industry on the practical use of ERM to drive decision making, rather than simply accompany it.

Towers Watson are targeting the Solvency II audience (at least on this side of the Atlantic) with a timely release of the results of their 8th Biennial Global ERM Survey. I say the results, as there is no sign of the full survey itself - any closer to their chest, it would be an areola's backpack...

As ever, these kinds of publications oscillate between flannel and insight, so while I cover those below, feel free to read the infographic and call it quits!

General observations from the main press release include;

• Three-quarters of (the almost 400) respondents say they are viewed as "important strategic partners" by the Board and Executive - I'm less inclined to see that as a mark of superiority, given that risk functions in some firms won't have the ambition or aptitude to achieve that status
• Implication that some respondents do not have a risk appetite framework in place - very worrying, unless this is just bad wording.
• Some firms said to be only "...using ERM for regulatory compliance". It may depend on jurisdiction, but I'm not inclined to agree that is even possible.
• The "ultimate vision" for a firm's ERM capabilities is referred to, which is a brow furrer, even conceptually. TW seem to bundle up risk culture, risk monitoring and risk tolerance into the "Vision" bucket, in case that term takes your fancy.
• The expression "very strategic approach" appears in print for the first time!

Getting Value from ERM?
- "Kiss my Face"

From the more elaborate Q&A document, we find the main granular material which TW were prepared to publish. Fortunately for readers this side of the Atlantic, the EMEA Director Mike Wilkinson holds sway over much of that conversation, including his tale of the firm who recently had an ERM/Business Strategy-inspired "Aha" moment.

That session contains a fair bit of contention, such as;

• Asking the questions "What's the purpose of risk management" or indeed the "purpose of your ERM Program" in the Q&A - if these had been directed to the respondents themselves, it would have contextualised a number of the seemingly negative responses i.e. If the purpose of your ERM Program is "don't get shut down", you are probably less bothered about being a "strategic partner"!
• That the business should "...challenge the risk group to create reports that help them make decisions" - Excel Jockey is hardly the work of a strategic partner...
• In a similar vein, that insurers are "drowning in data, drowning in metrics" - hardly a new phenomenon, and doesn't give any credit to the critical faculties of employees to filter what they do have.
• "...many [internal capital] models have matured" - a sharp intake of breath can be heard down at Moorgate!
• That "...an ERM Program can't properly be assessed until it has been in place for a while" - pretty sure the S&P crowd wouldn't hold off assessing you while you "embed"

Mike in particular does manage to keep a good focus throughout the Q&A on maximising trade-offs between risk and return being the big differentiator between Risk functions who are capable of influencing strategic decision making, and those who are perhaps more likely to be tabling red-amber-green reports tracking the outcomes of decisions which have already been made.

Other strong points include;

• In the context of Risk Tolerance, how to cater for the discretion required by an insurer's asset managers in handling investment portfolios.
• Touches on a couple of pieces which stood out in the CRO Forum's Risk Appetite publication last month, namely around the increasing number of measures being used to run businesses other than capital, allowance of movement within risk tolerance levels, and whether firms have effectively articulated their organisation-wide Risk Appetite and Risk Tolerance limits down into its subsidiaries/departments.

One aspect which gnawed at me throughout this reading is the constant referrals to "ERM Programs" - I don't think I am bathing in semantics to suggest that Programs normally start and end, whilst ERM would surely constitute a Framework. You might choose to redecorate the Framework periodically with a Program (Solvency II a prime example), but you wouldn't expect a Program to "mature" or "evolve", you expect it to conclude!

Nitpicking?

Central Bank of Ireland speeches - "and there's more"...

Solvency II-ready?
"It's the way I tell them"...

I rejoiced on Friday at the sight of more speech material emerging from the Central Bank of Ireland directorate, if only due to the Frank Carson* gag I could wheel out due to the volume of their recent speech-giving...

As an industry we should always be happy to hear the regulator on lead vocals, so I gave the pair of speeches released a once-over to see what Irish concerns have justified the recent bounty of public addresses.

Deputy Governor Cyril Roux was very targeted in his speech, delivered to PwC's Annual CEO Dinner. It apparently gave him "great pleasure" to be in PwC's offices, which presumably means they weren't on the meter...

Some of the statistics and comments served to highlight that Ireland is something of a special case in the context of Solvency II, in that two-thirds of Irish gross premiums are to cover 'foreign risks', and that many insurers under their auspices will not have proximity to or oversight of much of their distribution network.

A few messages jumped out from the rest of the speech;

• A lot of positive messages had a caveat implicitly wrapped with them - "...we are in the main satisfied with your engagement with the Central Bank"; "On the whole international firms generally file returns on time..."; "I also commend your general adherence to our Corporate Governance Code..."
• Goes as far as using the IMF's recent review findings to tell firms to stop poaching regulatory staff while simultaneously complaining about turnaround time!
• Nice point about keeping focused on current risks through the PRISM framework, rather than drifting into Solvency II mode before 2016.
• Having recently been complimented by Sr. Bernadino on Ireland's reserving governance (p12), he reinforced that assumptions pertaining to reserves are expected to be "critically debated".
• On ORSA, that the CBoI "...expects to see Boards actively directing the use of risk management tools...such s stress or scenario testing"
• On Internal Modelling, he not only expects Boards to "...have sufficient knowledge and skill to challenge the model outputs", but adds that they "...like to see a Board direct the modellers in their firms to run specific stresses and scenarios prior to an item being discussed at the Board" - a big advance on previous murmurings on use test from supervisory bodies.
• Pulls up firms who are seemingly not tailoring their model's parameters for the Irish-specific business.
• Similarly a message of insisting that cross-border distributors tailor Group-driven materials and processes for the Irish market such as "...group policies and output, such as the ORSA, and internal model...".
• A cute but important distinction that "embedding" Solvency II, rather than complying with it on paper, is still going to take considerable effort.

Sylvia Cronin's speech (well, the Solvency II aspect of it) stayed along the same lines as she pursued at the Industry event in late April, where she was harsh on a number of specific elements in preparatory phase ORSA Reports which had been observed.

In a section of the speech covering "challenges to be overcome", a number of pieces of insistent ORSA direction are given, for example;

• "Your Board must use the ORSA to more fully align business strategy and capital"
• "You also need to use it as a lever to discharge your core responsibility not to take on risks and exposures which the capital base does not support".
•  "...there is a lot of work yet to do by firms to get this element of the new regime embedded to the extent we required" - I add here that, given they will have only reviewed 2014's preparatory phase ORSA Reports and Processes, is this not a given, particularly after CBoI sponsored a template-filling approach for the smaller firms?

On the wider world, the speech covers;

• That Solvency II sets out "clear standards and expectations around your internal control and risk management" - agree on the latter, but the former?
• Believes that the "scope for subjective judgement" may open up regulatory arbitrage opportunities, and that "a number of iterations" will be required before EU-wide consistency is achieved, in a sly dig at, errrr, everyone in mainland Europe! 
• Similarly, the volume of cross border business HQd in Dublin poses a problem due to the geographical boundary of CBoI's "prudential remit"
• Reinforces the message fro April that Pillar 3 readiness is a growing concern
• A large suite of views on Conduct Risk, where "culture" and "conduct" are hogtied together as the grimmest twins since DeVito and Schwarzenegger - that message won't be changing in a hurry, so I strongly recommend your work in that area caters to the supervisor's tastes.

Useful insight from what appears to be a supervisor with their sleeves rolled-up - keep up the good work.

* PS I know the connection is tenuous as he's a Belfast man, but give me a chance!

Solvency II Industry Forum in Ireland - Clint and Chocolate

Having treated the speech by EIOPA's Chair as the main course a few days ago, I'd better take a look at the hors d'ouevres and pudding. At the CBoI's industry event in late April, a couple of their biggest hitters delivered speeches of their own, with a similar tone to the PRA's effort in October (i.e. a considered yet firm rollicking).


Solvency II Marathon
- no Snickering...

Sylvia Cronin's speech, in which she referred to Solvency II as the "Marathon of Marathons", shone some light on how Ireland plc has dealt with ORSA during the preparatory phase. If you remember, the CBoI kindly provided ORSA templates for the entities lower down the PRISM spectrum, which I felt at the time was fully justifiable, and a tactic other NSAs should have adopted.

It wouldn't appear that the industry has performed exceptionally in their 2014 efforts, with Ms Cronin drawing attention to the following flaws in execution

• Variances in ORSA Report content between firms in similar sectors  "cause for concern" - a slightly worrying comment, given that some firms will be over-elaborating with content with the help of their friendly consultancy firm.
• Boards were aggressively called out on the "ownership" front. If your Boards have been ambivalent to-date with regards to participation in the ORSA process, they will seemingly get a hard time from now on.
• ORSA Process "...as important as the document itself" - music to my ears, and still a surprisingly difficult concept to convey
• The "so called use test" is referenced around ORSA, and not in the context of internal model applicants - no idea what that is about, so will assume it was a clumsy turn of phrase, rather than a new element of legislation
• Stress testing seen to be "too benign", with firms ignoring key risks and hard-to-quantify risks. Given that the UK firms received similar feedback on their 2014 ORSA stress testing efforts, it doesn't appear to be a country-specific failing.
• 'Local' (i.e. Irish) ORSAs which filter into wider Group ORSAs have not been adapted to fit the business model of the Irish entity. Good issue to pull firms up on, if they are relying Head Office to provide them with process and reports in template format 
• Business plan and forward looking time horizons not considered plausible, possibly a by-product of the lack of Board involvement in the ORSA Process

On the Pillar 3 front, she noted the following

• Pillar 3 is now a "cause for concern" - decisions by firms on architecture and expenditure "now overdue".
• Only half of High or Medium PRISM firms have participated in external user testing on Pillar 3. This still feels proportionally more than the PRA have tested out, though it is still viewed as a negative by the Bank.

"Problematic Applicant"?

Cyril Roux on the other hand wanted to reflect on "the good the bad and the ugly of Solvency II" in his address. While most executives paying for Solvency II programmes in EU insurance entities would suggest that "A Few Dollars More" is a more apt Clint Eastwood hook, he took a more macro view during which he;

• Patted the Irish regulator for its "good work" putting the house back in order after the laissez-faire approach at the start of this century. 
• Also reiterated that Pillar 3 preparations are light in the country, urging firms to "...devote the resources necessary"
• Dwelled heavily on the subjects of investment risk appetite and prudent person principle
• Pointed at "problematic applicants" who can now seek approvals to do business in the EU regardless of the supervisor's thoughts about their business models
• Called Solvency II's quantitative requirements "ill conceived" and "overboard" and "clearly too complex"
• Commented that SCR is "unlikely, unreliable tool to manage capital" - "...certainly the supervisor will not be using it for more than its worth".
• Gave short shrift to the abolition of prudential reserving under Solvency II, and indeed Bernadino referred glowingly to the Irish approach to reserving governance (presumably to counteract this grievance?) in his keynote speech.

A lot to be taken from these speeches if you have any dealings with Irish insurers, and with the clock ticking, I can't imagine there will be better steers than these during the preparatory phase.

EIOPA Chair's speech in Ireland - Nothing Compares to U2...

The huff has concluded it would appear – EIOPA’s gaffer has returned to the speaking circuit after a few weeks where the institution’s communications had been reduced to Post-It notes on the fridge after the EU butchered their budget.

Bernadino - dodgy stand-up

 

A recent Solvency II industry event was held in sunny Dublin, with Sr. Bernadino providing the keynote address. He chose to start and conclude with U2 jokes, which were as lame as a constipated flamingo (I would have thought Ben Folds Five or Lulu would be top of his playlist right now…)

That aside, the meat in this musical sandwich was pertinent to the whole industry, so I've picked out a few highlights;

General

• Wants to outline EIOPA’s move “from regulation to supervision” (p2), though goes on to say that “…EIOPA does not replace NSAs. The responsibility of the day-to-day supervision…rests with the NSAs” (p10). I think this subject warrants clarification from NSAs and EIOPA in concert, given we can see how having a remit-less overseer is putting the PRA on the back foot
• Acknowledges that the result of the mathematical squabbles is “…perhaps a too complex SCR formulation” (p3)

ORSA

• ORSA considered to be “…best practice at international level” (p4) – not sure if he means ORSA in general IAIS terms, or the ORSA concept he has curated within the EU!
• While he drops some of the usual ORSA bluster in about it being a “game changer”, he beefs up on the Board’s obligations, citing their "fundamental role to play", and stating in particular that "they need to set, communicate and enforce a risk culture".
• Of particular significance to his Irish audience was his emphasis on risk culture as "..an appropriate balance with the natural sales driven culture". This is perhaps the first instance where I have seen insurers' distribution arms formally considered by a supervisory body to be the enemy of 'risk culture', and for EIOPA's chair to choose Ireland, a country which has for years marketed itself as a cross-border sales centre on the right side of General Good provisions, is shown at the end speech to be a pre-emptive strike.

Internal Models

• Like his associates at the PRA, he notes that the use of internal models on the banking side "has been subject to increasing scepticism" in justifying the rigour of the Solvency II approach to modelling
• Worried that models will become a "capital optimization tool" - the PRA's NED briefing (slide 8) paints a similar picture if you read between the lines regarding missing risks and experience not reflected in parameter setting.

EIOPA's workload

• "Current different supervisory cultures" in the EU are creating work for EIOPA, noting that "our feedback can sometimes be challenging". Wonder who they're getting at there, France!
• They appear to be developing a Supervisory Handbook of good Solvency II practices. Chapters are already written on Risk Assessment, Boards and Governance, PPP and proportionality in Key Functions to name a few. Something to look forward to no doubt

Ireland-specific

• Go out of their way to applaud the onerous reserving governance in Ireland (here?), considering it practice which other countries should emulate.
• On the other hand, "...in the specific case of the Irish insurance market" he targets the country from a conduct risk/General Good perspective as one of the main cross-border players in the Union.

One can't help but feel the latter part of the speech was deliberately laid at the feet of the Irish, rather than aired in a more generic manner, given the country's continued corporation tax-related appeal to cross-border distributors. I guess when it comes to identifying the perfect audience to sketch out EIOPA's inevitable foray into Conduct Risk regulation, Sr. Bernadino found what he was looking for...

Love RAFs? CRO Forum's Risk Appetite survey

The CRO Forum have recently published the results of their 2014 survey on Risk Appetite development in insurance entities. It is perhaps the oldest drum in Risk Management Town, but one we are always happy to hear the beat of, and while we shouldn't expect a forum with such luminary members to deliver any shocking results, a careful sift through the carcass is always a smart idea.

The Cure - to tolerance breaches?

The final presenter at the PRA's recent NED briefing noted that Risk Appetite is "no longer an aspiration", a comment I felt was further behind the times than Nana wearing Juicy Couture. That said, on page 8 it suggests that less than a quarter of firms are "very satisfied" with their RAF maturity, and over a third feel they have "a lot of work to do", so perhaps he hit the nail half on the head...

This document should clarify whether that caution is justified, and with 48 responses from the top table, it should be a reliable benchmarking tool. Despite starting like a GCSE essay ("the topic of Risk Appetite has exploded"?), it contains some useful, if a little dry, benchmarks, such as;

• Principles for a RAF (p3-4) - hard to argue with
• Main goals - dominated by preserving capital, while only a third are looking to "improve shareholder value" or "optimise capital"
• Main stakeholder list (p5) seems good in breadth and priority
• Almost everyone is using regulatory capital in some way as a Risk Tolerance measure (p9)
• Stress and Scenario testing is being used by 80% to set Risk Tolerance levels, which feels at the right end of expectations
• 60% report quarterly, with most others slightly more or less frequent

It takes a few odd turns, in particular;

• One of the main objectives cited (p4) seem to be centre around boiling down things into a single document. I appreciate that pressure, but surely we feel that a RAF has a more substantial objective that document consolidation?
• "Development of a Risk Appetite Statement is an evolution" (p6) - don't agree at all, it is a task, otherwise it would never get done.
• Coverage of Risk Appetite Statements as "regulatory requirements", in particular under Solvency II. Just because the industry is choosing to discharge its obligations in EIOPA's Guidelines (SoG 15 & 16) by producing a single statement document, it doesn't make a Risk Appetite Statement a requirement.
• Less than half are using a "1-in-x" loss that would breach regulatory capital in their Risk Tolerances - just feels like a very obvious one to use, so suprised by that number

Some of the more practical issues faced by firms are well covered, for example;

• Difficulties for Groups when setting risk appetite. Does the parent/head-office set overall appetite, and the children sub-divide it by business unit/risk category/Both? Do the children set their own appetites and feed them up for aggregation?
• Listing Risk Concentration targets looks awkward across the board (p5). While firms seem to be able to quantify Liquidity and Capital targets in their Risk Appetite Statements, other categories are much less consistently quantified. Market, Credit and Insurance Risk appear to be quantified by less than a third of respondents, preferring to address these in separate policies/guidelines (a Solvency II by-product perhaps?).
• Setting Risk Tolerance levels is highlighted as a "minor" improvement required by over 60% of respondents.
• There is a veritable bombsite of Earnings at Risk metrics in use, which is healthy for the industry I guess (p10).
• What does one do when Risk Tolerance level is breached? Around a third are not OK with limit breaches and demand immediate rectification, while two thirds allow for a "Cure Period" to return the Risk Profile to its required form. A "Cure Period" seems the fairest breach rectification approach to me - after all, I don't care if Monday's blue...

A worthy benchmarking document, so fill those boots.

Pillar 3 implementation phase - "I can change, I can change"...

There has been a bit of noteworthy activity on the Pillar 3 side over the last few weeks, which I will cover below if I can keep awake long enough.

Pillar 3 Deadlines - "take it easy fella"

Pillar 3 was shouldered in to the NED briefing at the end of March (slide 19), and in a style similar to South Park's Saddam Hussein charicature, they effectively told the audience to "relax guy"...

Were those calming words justifiable? Given the PRA's admin function was seemingly on a "no uploading" break for Lent, we have in the last couple of days seen a whopping 3 months worth of minutes from their Regulatory Reporting Industry Working Group (or "Pillar 3 whingepit" as it more commonly known) made public. Interesting snippets include;

Jan 2015 - PRA full working group

• Publication of example reporting schedules for anyone without a December year-end
• "Early May" appears to be the starting point for any Category 1-3 firms who need to test out the PRA's QRT recepticle handiwork
• Firms "must submit data in XBRL" from July of this year, in case there were any chancers out there
• No additional information about the spectre of external auditors poring through your reporting efforts until Q2 2015 (i.e. now!). This will be in the form of EIOPA Guidelines, from which the PRA will "determine its position".
• About 20% of firms responded to the PRA's readiness survey that they are behind the curve
• Sourcing asset data still noted as an "issue", as well as vendor limitations, which would be of some concern for anyone who has splashed out on a software solution.

Feb 2015 - PRA testing sub-group

•  Problems around compatability of firms' earlier efforts appear to emerge every time EIOPA apply a hotfix to their taxonomy
• EIOPA filing rules and guidance were scheduled for Q1 2015 release - I can't seem to see them (though I haven't looked hard), so their timeliness maybe a victim of the EIOPA budget cuts?
• Firms are directed to the draft ITS to distinguish between preparatory requirements on Reporting and "live" requirements. This seems to be a repeated message, so presumably firms are not reading this document properly. 
• First testing cycle kicked off on 27th Feb, with (9) firms down at the PRA's offices. Second cycle scheduled for soon/now in April, performed externally to "test connectivity"
• Firms were effectively encouraged to sent in any old tat in XBRL, which the PRA would feedback on.

March 2015 - PRA testing sub-group

• Initial testing of the PRA's facilities doesn't appear to have been discouraging
• Less that half a dozen firms will be kicking the tyres in the second test phase
• EIOPA effectively overrule the PRA by allowing old and new taxonomies to be used in the preparatory phase.
• The PRA's (unpublished?) validation rules will not be applied during the preparatory phase, which will be light relief to some firms.

This information seems to support rather than contradict the more general yet widely reported Grant Thornton survey which suggests there will be a good number of firms who will struggle with their 2016 obligations, let alone 2017's. They made the following points;

• GI and composite firms seemingly the most worried
• Half of firms are planning to create their own reporting solution (based on T4U?), mostly Lloyds and GI firms. Are these "have-a-go heroes" the hidden issue for the PRA, given their restricted testing group.
• Around 20% are behind schedule on QRTs
• A third have done little if anything on the SFCR/RSR front – the PRA have stated that these are required "in year 1" (Q17, and yes, both of them!)
• Compared against an earlier survey they conducted, the one topic which hasn’t alleviated any concerns is the ability to extract data from internal IT systems.
• Majority of firms are having a single dry run for quarterly and annual QRTs

Should anyone be worried given the granular information above, or is Pillar 3 still tomorrow's problem?

Jurassic Talk - enhanced NED challenges during Solvency II preparations?

 Britain's youngest NED

Given that there won’t be a heck of a lot more briefing done on the Non-Executive Director front, I’ve given the PRA Industry Event slide pack published the other week a bit more of a going over to see if the left and right hands are pushing the Solvency II wheelie bin in the right direction. I haven’t gone as far as watching the 1h 30m video of the event yet – if I wanted to watch a room full of fidgeting old men in ill-fitting suits I’d just go to Bridge Night at the bowling club…

I can’t say I was massively enthused by the read of the slides as an individual who is frequently delivering material to the very audience the presentation was aimed at. I would highlight the following oddities;

Internal Model-specific (slides 6-12)

• That Solvency II “sets a high bar” for model approval – that feels a little disingenuous given that the PRA has had the whip hand in the IRSG’s internal model committee for years, and has evidently driven their CAT. Fair to say that the PRA set the "high bar" on behalf of the rest of Europe.
• From the “lessons learned” section they suggest that some IMAP/CAT firms have used assumptions which are not matching their experience. Is that not bravado bordering on criminality? Doesn’t feel like small beer, so unless the PRA are splitting hairs with that comment, I trust the protagonists had a strip torn from them.
• Some models ignoring “Key Risks” faced by a firm – how can this be? If this is about cheeky risk selection (i.e. let’s use SF, but model Market Risk as we get a good number from it) all well and good, but to say that firms are ignoring them is not a good steer, and if they are, then how is punishment not already being dispensed?
• For Use Test purposes, NEDS told to have “belief” but not “blind faith” – this feels like Bank Creep, given that the PRA  have been vocal (here and here) on firms blindly following models after the banks got caught with their trolleys down a few years back (nice PRA summary here). Doesn’t feel especially fair to tar insurers with exactly the same brush in advance, even if it is smart!
• “Boards need to own validation design” – just sounds meaningless when you read it back. If you want them to “do” the design (which Andrew Marshall’s later slides deriding the efforts of the validation contracting community suggest also support), then just say it.
• The “Key Questions” slides contain some very ropey gear. “Does the output of the model give a credible answer”? “Can the firm survive on the Standard Formula”? The terms used are so flimsy that one could spend hours arguing the toss about their definition – “so what is survival – EC+, SCR+, MCR+ with recovery plan” etc.

ORSA and SoG (slides 14-18)
Starts with a bit of good news – some generic industry feedback is seemingly due within the next couple of months (pertaining to our 2014 ORSA efforts?). The slide summarising findings to date is also a useful yardstick for those who can’t wait that long.

For System of Governance, the executive world should prepare themselves for NED questions regarding whether or not they (as opposed to their underlings and contractors) are reading EIOPA's Guidelines. Let's hope they have!

On the gnarlier side;

• Seems to be an obsession with assigning named individuals (as opposed to roles or teams)  to perform mitigating tasks relating to anything ropey uncovered during the ORSA
• “ORSA should be holistic” – at what point is that breathtakingly grim term going to be put to pasture? For a NED briefing, the use of plain English should be considered par for the course. It is followed two slides later by “top-down/bottom-up” which is equally non-specific.
• “ORSA is not a compliance exercise resulting in a report to the PRA” – I think you meant to say “not ONLY...”!

The final slides from Ian Marshall’s presentation are revealing more due to the clumsy terminology often used at the table with NEDs (“Key Drivers” and “Key Correlations” for example – if you mean “most money riding on it”, then say it!). Also, the idea that Risk Appetite is “no longer an aspiration” is worrying – I would have given the insurance industry credit that it ceased to be aspirational some time ago, and doesn’t need a 2015 ‘tick’, but then I am a trusting fellow.

Does anyone think, off the back of these slides, that their NEDs will be chomping at the bit at the next Risk Committee/Board meeting using the ammunition supplied here?

Maybe I’d better watch the video after all… 

Solvency II - things what happened in the last couple of months...

She might not be singing yet, but just like my nana at Pilates, the Solvency II fat lady is taking some deep breaths. As I have spent the last couple of months at home in au-pair mode, gladly leaving the rest of the world to waffle about ERM and Solvency II, I thought I would throw together a catch-up post, given that applications for some of the Solvency II goodies have been open since 1st April.

Starting at the top, the UK Government managed to stay sellotaped together long enough to get the fundamental Solvency II legislative work pushed through Parliament before they disbanded for the General Election. The documentation is available in full here, with synopsis here. Interestingly, this formally obliges the PRA to review capital add-ons "at least" once a year, as well as to provide specific reporting to EIOPA on the topic. There is also a little more meat around the sticky issue of firms who breach their MCR, then look unlikely to rectify the matter.

The Government also released the findings of their Regulatory Policy Committee (RPC) in assessing whether Solvency II was going to be a blessing or a curse for Britain. This is actually a very handy drop-in document for your NEDs/peripheral programme figures, and is worth pushing on to them.

They do make the rather controversial statement that on top of the estimated £2.6bn cost to the industry of implementation (!!!!!), the ongoing costs of c.£200m a year will be due to reporting obligations (fair enough) as well as the need for a remuneration policy (hmmm?). Rather disparagingly, the Treasury merely estimate "un-quantified administrative benefits" off the back of improvements in risk management and governance arrangements.

The PRA have recently released the Policy Statement covering their final rules for Solvency II implementation, which on paper should contain no surprises (other associated materials available here). Generalist media chatter (here and here for example) was pretty underwhelming, and while Mark Carney emphasises in the statement that Insurers must be "robustly supervised", Andrew Bailey stated merely that while the "...new regime will not be perfect...it is a welcome step in the right direction"

On a lighter note, the European institutions got a bit beefy over the new year when the newly installed Commissioner Hill had his ears chewed by ECON's new Chair regarding a range of issues or unanswered questions regarding the Delegated Acts. Having given himself a couple of weeks to digest, he pinged out a reply thanking ECON for pointing out three typos, and otherwise defending his corner. Much of the background noise in this correspondence regarding infrastructure investment and EIOPA funding has had a life of its own for some time now - indeed, EIOPA's dummy was definitively spat on the matter last week when they "reprioritised" their 2015 work plan to account for budget cuts.

B-ABI - got back?

NEDs have recently been the beneficiaries of a webcast featuring the juicy double of Huw Evans and Paul Fisher discussing the implications of Solvency II's progression for NEDs. For anyone struggling to get their NEDs to read overinflated board packs these days, a diversion to this footge would be a smart idea (video 1 is more chatter, so start at video 2).

A parallel release for NEDs came from the PRA in the form of a slide pack and a monster 1hr 30m recording of the presentation which it accompanied. Clearly the PRA have seen enough gaps in the efforts of NEDs to date to go to these en-masse tutorial lengths, but the material on validation and ORSA in particular should be swallowed whole.

Delegated Acts in the clear - like we ever doubted it...

The last attempt to delay the inevitable has finally run its course - the Green Party-led resolution to throw the Delegated Acts back onto the 'to-do' list was given a thorough shoeing yesterday at the EU Parliament's Plenaty session, with the 189 votes in support slightly outweighed by the 512 against it (p9 here). I haven't seen Greens get wiped off the table that aggressively since I tried to feed runner beans to my toddler...

The news was gently broken by Catherine Stihler, the new rapporteur, yesterday - refreshingly, the parliamentarians were focused on the impact of policyholder security, rather than how beholden they should be to EIOPA's mathematics, and after their back street horror-show of a website upgrade this week, perhaps the less we rely on their efforts the better!

For some UK-specific giggles, you will be delighted to know that the ex-City boy gin magnet Nigel Farage and his UKIP government-in-waiting all voted with the Green Party on this matter (p68 here).

I won't bore myself with the legislative procedure from this point, but given ECON, and now Parliament as a whole, don't have a problem with the Delegated Acts as they stand (and the three month whingeing period expires on January 9th 2015), we can all go back to work...

Solvency II Delegated Acts - Grinched by EU Parliament?

Short and sweet - the expected promenade facile of the Delegated Acts through the EU Parliament and EU Council, which looked certain up to a few days ago (p16 here and here), has apparently come to a shuddering halt due to the intervention of Parliament.

Grinch - coincidentally Green?

This document published on the Parliament's website today appears to have made the timeline-followers worst nightmares come true, namely that an additional 3 months of delay on the Delegated Act sign-off may prevent some of the "...from 1st April 2015" approvals from being written into law by, well, the 1st April 2015!

As yet I have seen or heard nothing on the matter in the mainstream media, but given how annoyed Sven Giegold appeared to be when the Acts were tabled, it shouldn't be too much of a surprise that some flabby parliamentary procedure exists that allows for the (presumably positive) opinion of ECON to be overriden when it came to clearing the document through Parliament's main hall.

Naturally, Herr Giegold's name is on the front cover of the motion, but I can't seem to establish whether an additional 3 month delay is a fait accompli, given my lack of knowledge on Parliamentary procedure. I believe the Greens alone certainly constitute "...a political group or at least 40 Members", so they certainly have enough bulk to put this on the table at next week's Plenary (Wednesday by the looks of it), but I imagine having enough pals to table this resolution is not the same as having enough to pass it!

More to follow I hope, given how sparsely populated my legislative contact book is...

PRA Pillar 3 Working Group - testing commences

Bit of activity on the Pillar 3 front, with the PRA's industry working group publishing minutes from their 'recent' meeting (i.e. 2 months ago).

Rather than another bleat about late delivery in contravention of their Terms of Reference (bottom of last page!), let's enjoy the content for what it is, which is incredibly useful.

Data Collection and xBRL
A few basics were formally tabled, such as the PRA completing their vendor selection for a data collection system, and a note that the xBRL process chosen across the EU has "some commonality". Of particular interest is the commencement of a testing sub-group which has been charged with assisting the PRA in getting their technology up and running with sample data, and that work is apparently ongoing as we speak.

They have planned to allow selected submittors to dry-run their facilities in Q1 2015, before opening it up to all other firms obliged to submit material in the preparatory phase in Q2. Not sure how much lag this set-up allows, so let's hope they get happy before Christmas!

External Audit and Pillar 3
Another sore point has been the potential inclusion, on a short or long-term basis, of external auditors in the preparation and delivery of Pillar 3 reporting (raised on the Solvency II Wire last month). The PRA opine that external audit requirement guidelines "...are not scheduled to be included" in the forthcoming ITS, and that EIOPA has not decided when to issue public consultation on the matter, though they will at some point.

Clearly the PRA have ambitions to continue their existing requirements for the external audit of regulatory submissions, as evidenced by their preparatory phase approach to gaining comfort on Solvency II Balance Sheet components of all IM applicants and larger SF firms, which will pad out a few partner's wallets at the Big 4 (though perhaps for the right reasons).

Lobbying and questions
Effectively told the attendees to direct more questions to EIOPA rather than them, and in particular to wait for EIOPA's second set of ITS, due any day now. On the basis that ITS will (probably) be accepted by the Commission as delivered, the PRA are reminding firms that this is effectively the only window for the industry to bleat.

Board sign-off of QRTs
A huge bugbear across the industry was the implication, reinforced through the PRA's Pillar 3 Q&A document (Q20, last page), that June 2015 would see piles of QRT material tabled at Board meetings across the UK for them to formally approve. They confirmed at this meeting that the Board "...may choose to delegate aspects of the process for operational reasons" - CFO sign-offs all round!

Asset Data, and interaction between Asset Managers and Insurers
A slightly odd, but very relevant point was raised regarding Insurers interacting with their asset managers to ensure they get the right quantity and level of granularity in their asset data to populate the QRTs. The PRA are naturally concerned about this, given the shortening timeframe, and given that the asset management industry themselves appear to be making some voluntary efforts, it feels like the insurers have some work to do.

Approved Persons in UK under Solvency II - "SIMF-ly The Best"?

The UK prudential and conduct supervisors doubled-up this week with a barrage of paperwork regarding "Fit and Proper" assessment of senior staff members in Insurers under Solvency II.

This was already acknowledged as an area where intelligent copy-out wouldn't quite cut the mustard for UK plc, so no doubt the Compliance functions of insurance entities have been looking forward to these publications appearing. Given the light touch on the topic in the Directive (Art.42) and Delegated Acts (Art.273), this is very much welcome gristle.

Evidently "Proper" - but "Fit" enough?

While the maintream media has cranked out some comment already on both the FCA (here) and PRA approach (here, here and here), they are naturally broad with their brushes. I thought I would cut it up into my much more insular world of "what does it mean for Key Functions under Solvency II".



PRA Consultation Paper

• The regulatory framework for individuals will be called the Senior Insurance Managers Regime (SIMR), and will come into force from 1st Jan 2016. 
• The CP is targeted at ensuring fitness and propriety of individuals running an insurer, or performing a Key Function.
• NED's have been left out of this paper, as there is a wealth of comment already provided on a separate joint FCA/PRA consultation from the Banking industry.
• That said "...the regime for insurers should not be identical to the regime for banks". 
• While Controlled Functions continues to exist as a PRA term, it will be interchangeable with the term Senior Insurance Management Functions ("SIMFs"), which I have used below.

Going into detail, we find the following;

• CEO, CFO, CRO and Head of Internal Audit are all SIMFs, with Chief Actuary, WP Actuary and a couple of Lloyds-specific roles also lined up.
• Some Group-specific SIMFs also created.
• Any Solvency II "Key Function" holders who are not SIMFs will simply be assessed within the business, with the PRA having right to overturn. I thought this would include the Head of Compliance, but they are picked up by the FCA (below). Not sure who else could be Key Function but not a SIMF, unless some SIMF role-holders don't plan to also do a day job.
• List of new Core Responsibilities provided which need to be allocated to one or more SIMFs (2.21). These include the old chestnuts of remuneration policy and "culture" in its broadest sense, as well as performance of ORSA.
• A form will follow which needs to be completed by firms for all prospective SIMFs and Key Function holders containing "relevant information" on them - I suspect this will be a LinkedIn cut-and-paste job.
• Obligation to make and maintain a "Governance Map" listing the positions and key functions which run the firm, the allocation of management responsibilities (including the new ones in 2.21 presumably) and relevant reporting lines. Oddly, the PRA think "...there will be some costs in compiling and maintaining the Governance Map", when it feels like a lazy Thursday morning for Company Secretarial to me...
• Some reinforcement of Conduct standards for SIMFs and Key Function holders, with Key Function holders having an additional policyholder protection-related standard added to their armoury.
• Emphasise that Fit and Proper needs to be assessed on an ongoing basis, as opposed to periodically, which effectively gives the regulator a get-out-of-jail when a bad apple SIMF mismanages a firm (i.e. "why didn't you pick it up internally first?").
• Solvency II brings in a legal requirement for firms to satisfy themselves of a candidate's fitness and propriety before sending applications to the PRA. They therefore plan to assess whether firms recruitment processes are "appropriately rigorous", which feels like a step into the un-assessable (if that is even a word).

Proposed Supervisory Statements are appended to their document covering the assessment of fitness and propriety, and the application of new conduct standards. From those I would highlight;

• "The norm" is for single individuals to perform SIMFs
• That firms may add to the list of conventional Key Functions using a bullet-point checklist
• Firms can "...freely decise how to organise each function in practice"

FCA Consultation Paper

• The existing Approved Persons Regime will be adapted to fit Solvency II and PRA/EIOPA requirements, as well as existing application forms.
• "Pre-approval" will therefore still exist in 2016.
• While the PRA pick up approval of most Key Functions under Solvency II, the FCA keep hold of the approval of Compliance Function heads, which don't feature in the SIMF list.
• Give themselves some leeway to impose approval and conduct obligations on "certain other functions" in insurers
• Appear to be combing over conduct-related rules from their work with the banking industry

Frankly, the amount of crossover between prudential and conduct regulators, existing and new rulebooks, and banking and insurance industries, makes this particular topic an awkward read, which is why I don't work in Compliance!

Levity aside, the outcome of these consultation papers will have a significant effect on insurers existing onboarding and approval processes, content of executive job specifications, and indeed the fundamental operacy of governance systems, given the level of prescription involved. Now would be a good time to start briefing!

EIOPA's Implementing Technical Standards on Internal Model Approval - ready to "submit"?

EIOPA have kicked into life at the end of October like Freddy Krueger on laughing gas, releasing a swarm of consultation papers and summaries. While the releases on Colleges of Supervisors or the calculation of the risk-free interest rate will be of interest to some, my own interest was in a subset of their draft Implementing Technical Standards on Solvency II Approval Processes

I have tried to cover the distinction between ITS and the other weaponry in the hands of EIOPA and legislators here. The aggregated feedback received by EIOPA on the suite of Solvency II approvals covered by ITS is neatly summarised in this doc, with EIOPA adding dollops of proportionality into the summary, to effectively remind supervisors not to treat the applications of giants and pygmys with the same vigour. Given the audience reaction to the UK regulator's industry event a couple of weeks ago, I think 'proportionality' may need to become the PRA's middle name (though it probably works better as its first name...)

Clearly, two big moans have been common threads in the responses received, and both have been rebuffed. The concept of supervisory requests for supplementary information "stopping the clock" on one's approval window has been retained, while the idea of "no answer in 6 months equals approval" has been firmly rejected.

Internal Model approval
- "Easy, Easy"

Of more interest to me than the other approvals covered by the consultation is the Big Daddy himself, Internal Model Approvals. From a UK perspective I have covered this in multiple posts previously (here, here, here and here for a start) , and was interested to see if any more whistles and bells had been added to what is already an area causing serious fatigue within the UK's potential applicants, not to mention a few dozen corpses from the c.100 interested parties back in 2011 (slide 4 here).

I thought the following was worth highlighting;

• Given that the Delegated Acts are already loaded with granular Documentation requirements for IM applications (articles 243 & 244), the ITS insists on a few more pieces! Having cross-referenced between the DAs and the ITS, I reckon the items listed in Article 3 d, h, j, p, q and r are all new requirements, though none would be a stretch to produce.
• Expectations that your model has been in use prior to application (Art 2 (3 a ii)), and is integrated into your current system of governance (Act 2 (c)) - perhaps this is the effort which firms with capital add-ons will be compelled to do in 2016 & 2017 in advance of model applications?
• Results of your "last" Validation Process must be submitted in a Model application (Art 2 (m)) - again, suggests there will need to be a year's worth of "live" modelling in advance of making an application
• The supervisors have 30 days to assess the "completeness" of an application - this feels weirdly generous, given those 30 days count towards the overall 6-month assessment window (provided the application is complete).
• Despite the PRA's firm assertion on Oct 17th (slide 8) that conditional approval for Model applications is not available, Articles 3 (8) and 5 (4 b) both suggest otherwise, namely that proposed "adjustments" or "terms and conditions" can be accounted for in their decision. 
• As much prominence being given to Model Change process and Model Change policy as the initial Model Application process - applications can actually be rejected on the strength of the change policy (Art 5 (2)). Despite that, the articles designated for these areas (Arts 7 & 8) are relatively straightforward.

There is no real reason why these ITS for IM approval won't sail through at the Commission, so best to prepare accordingly. However, UK applicants with 2016 modelling ambitions will of course need to wait further for EIOPA's Common Application Package before they can finalise this montagne de papier.