System of Governance - EIOPA's FINAL preparatory guidance for national supervisors

Based on feedback received since their initial consultation paper was released, EIOPA make the following generic clarifications/statements in the preamble of their guidance doc for System of Governance preparations;

• That proportionality will not be defined or presented as examples in the guideline text (p5-6)
• That NCAs are "expected to...review and evaluate the quality of the information provided to them" - bad news for the PRA, who were clinically uninterested in reviewing Solvency II reporting attempts according to one blogger (p6)
• The emergence of a new ORSA acronym, "FLAOR", which looks more like something an amused teenager would write on Facebook (p6)
• The expectation that 2015 will see submissions of (2014) ORSAs to NCAs (p7)
• While there is no generic take on what enforcement action should take place in this interim period, firms are expected to (a) Discuss any negative findings from their ORSA/Governance systems with their supervisor, and (b) To produce SCRs using information of appropriate quality. Enforcement action in the absence of this WILL NOT consist of capital add-ons, apparently (p7)
• That the submission date calendar for all of the information expected will be reviewed at the end of this year, so that EIOPA can take Omnibus II progress into account (p8)
• That the explanatory text in each set of guidance is NOT part of "Comply or Explain" (p9)
• That the reasons behind a negative "Comply or Explain" decision from any country will be kept secret as standard (p10, and disgraceful, frankly).

They then go on to focus on some of the larger bones of contention within the 52 guidelines provided. The following generic points stand out for me as a practitioner;

1. There is almost no discernible movement in EIOPA's position, even after a volumous lobbying effort;
2. That explanations for the inclusion of contentious content are generally forthcoming, though on a number of occasions, flimsy;
3. That planning for 2014 full-year mothballing of Solvency II programmes is not an option, particularly for ICAS+ candidates - some may get away with a few months of inertia, depending on the quality of their paperwork (strategies, policies, process guides/maps, terms of reference, charters etc).

The following supporting arguments for EIOPA's final view were, in my mind at least, poorly formulated, regardless of whether the end result is still agreeable;

3.48 (Guideline 6)

- Refused to add more definition around what constitutes a "significant decision", which is poor form.

3.58 (All of Chapter III)

- That the expectations of Risk Management in insurers  "...comprise risk management standards which are considered to be matter-of-course and wide spread activities" - extraordinarily loose, considering the lack of a majority-accepted global, or indeed pan-European standard on the subject (IRM/ISO/COSO/FERMA/FSB's efforts notwithstanding)

3.65 (Guideline 19)

- That, while it is "not an easy task", Operational Risks should be quantifiable, and therefore subject to tolerance limits - I don't think it would have hurt to suggest (or even compel the use of) a method if it is that difficult.

3.68 (Guideline 25)

- That firms should maintain Investment Risk-related KRIs outside of what might be provided by normal parties (for example, ratings agencies), which would help "...increase overall risk management" - not entirely convinced that a generic "increase" is any kind of worthy ambition. 

3.74 (Guideline 31)

- That a capital management policy and capital management plan is both necessary (though for not entirely convincing reasons when tying back to the Directive)

3.78 (Chapter VI [Internal Control])

- That there is already plenty of clarification on what the Compliance function is charged with. I would agree in principle, but have heard evidence to the contrary in practice.

3.81 (Chapter VII [Internal Audit])

- That they neither wish to mandate or discourage rotation of Internal Audit staff or whistleblowing direct to NCAs - in which case, why mention it!

3.110
- A bizarre comment in response to a suggestion that a public statement should be released by the AMSB annually regarding the discharge of responsibilities around the system of governance that the Directive "...only deals with internal governance, not corporate governance" - think I know what they are fishing at, but terribly worded.

3.144
- Justify their decision not to define risk appetite and risk tolerance in the context of these guidelines

They have however provided some more defendable clarifications, for example;

3.51 (Guideline 11)

- Clarified that the gold-plated "Fit and Proper" requirements apply to AMSB/Control Function staff only, as well as specify what is expected from Outsourcers.

3.57 (Chapter III [Risk Management])

- That in the context of separating the duties of the Risk and Actuarial functions, the Directive is abundantly clear and that undertakings "...cannot deviate from [the Directive's] distribution of tasks"

3.62 (All "Policy"-related guidelines)

- That efforts should be targeted towards drafting the required documents during the preparatory phase. I would imagine this would be "re-working" in the UK, where such activity is most probably long done.

3.67 (Guideline 19)

- That there is no compulsion for firms to operate an electronic database to store operational risk events

3.85 (Chapter VIII [Actuarial])

- That, regardless of the absence of a valuation framework for TPs, the processes behind their co-ordination and calculation justify early activity, rather than "wait and see" on Pillar 1.

3.124
- Regarding Op Risk, activity will have to include "...identifying all operational risks that have crystallised and their near misses" (my emphasis)

Relatively easy in summary then - if it was a gap/issue in your system of governance in March, it probably still is, so go and fix it!

The PRA's take on EIOPA's Interim Guidelines - far from a 'Tragedy'...

The Prudential Regulatory Authority have celebrated their second week in office by hosting a number of industry briefings regarding EIOPA's Solvency II Preparation Guidelines. One Blogger keenly dripped some of the materials discussed out yesterday, but I've had a look through the briefing materials released today on the PRA's site to see if there are any messages worth amplifying.

Steps - appropriate?

From a calendar perspective, the PRA are planning some technical workshops with "industry representatives" in early May, to be followed by an industry briefing later in that month. The output from the workshops appears to be a major influencer on whether the PRA will "comply" with EIOPA's guidance or "explain" why they won't.

With final versions of EIOPA's guidelines expected by September/October 2013, the national regulators have an additional 2 months from publication to formally confirm their "comply or explain" position.

Reading between the lines this looks (for now at least) as a foregone conclusion however, with this comment from the internal model pre-application slides;

"We expect firms to have regards to the interim guidelines and take appropriate steps to prepare for Solvency II" 

Three slide sets have been released - anything new, or worth reiterating, below;

Internal Model Pre-Application

• Model change - to be monitored throughout pre-application.
• Colleges - Evidently notable divergences in assessment practice across the union which the Guidelines hope to fix, but "no direct implication for firms".
• IMAP - while EIOPA's guidelines "will be considered as part of IMAP reviews", they don't (in the PRA's mind) touch on anything which wasn't already part of existing L1/Draft L2/pre-application L3, so no surprises on that front. They do however highlight the elements on Expert Judgement and Validation as providing more clarity on supervisory expectations.

ORSA and System of Governance (combined)

• No PRA expectation of  a full/'live' ORSA or Solvency II-compliant systems of governance by 2014
• Neither are there any expectations for firms to make changes in investment strategy/capital strategy/outstanding Pillar 1 elements - at least not due to Solvency II in its current form.
• For System of Governance, the PRA's slides highlight areas where EIOPA's guidelines exceed expectations of the PRA Handbook - these include Board MI; revisions to control functions; revisions to Risk Management Policy; Prudent Person Principle; and calculation of TPs.
• For ORSA, the slides clearly indicate that dry runs and ORSA process development should be the immediate focus, and it should serve to reaffirm best practices that already "underpin the ICAS".

Submission of information to supervisors

• Only a subset of the full package recommended by EIOPA in July 2012
• EIOPA want to see at least one round of annual submissions, and two rounds of quarterly submissions before Solvency II goes live, with 2016 seemingly the preferred year.
• On that basis, firms will have 20 weeks (26 weeks for groups) after year-end 2014 to submit annual template obligations.
• They will then have 8 weeks (14 weeks for groups) after quarter end Sept 2015 to submit their quarterly template obligations.
• As per ORSA, firms which are involved with internal model pre-application will need to perform both standard formula and internal model work in this area.
• Also as per ORSA, thresholds for participation based on TPs (Life firms)/Premiums (Non-Life).
• Narrative reporting requirements are "significantly reduced"compared to final requirements - however, there is plenty of crossover between what one might document during ORSA processes and what is expected to appear in RSR/SFCR, so firms shouldn't struggle in this regard.
• The concept of a "Reporting Policy" document (guideline 33 in the consultation) covering who will be responsible for what in the submission of information to supervisors, is referenced in these slides. This hadn't featured on my radar before as 'compulsory', so documenting this early, even just as process steps/maps, seems like a move that the PRA would appreciate.

EIOPA consultation on "Solvency II Preparation Guidelines" - Wham!

In between Mickey Mouse cartoons today, my young lad said "EIOPA just don't publish enough consultations about Solvency II, I hope we see some more soon" - well wait no further son, this year's motherload has just arrived!

EIOPA Guidelines - supervisors have
been 'hanging on like a yo-yo'

What was mooted back in December as EIOPA's interim measures, intended to make sure that impatient  individual national supervisors didn't 'plan on going solo' have been released today for public consumption and comments, covering the 4 areas "fundamental to ensure effective preparation for Solvency II".

The consultation is open until June 19th, but the guidelines once finalised will apply from Jan 1st 2014.

EIOPA will apply them proportionally to the national supervisors, who in turn are asked to "...regard the burden on small and medium sized undertakings" when incorporating these guidelines into national regulatory landscape. May be the first acknowledgement of disproportionately burdening SMEs I have seen from EIOPA!

Those 4 areas are:

1. System of Governance (L2 final advice here)
2. Forward-looking assessment of Risk/ORSA (issues paper here)
3. Submission of information to national authorities (L2 advice here)
4. Pre-application for internal models (L3 guidance here)

I'll pick these off as separate posts and link them back to this page, so sers toi in the meantime and happy reading!

KPMG on the Solvency II Reporting package

You can always rely on one of the big 4 to do the admin around EIOPA's releases, formatting and paginating it into a handy A4 slice of pure Gauguin - KPMG to the rescue this time, breaking out EIOPA's work on the Pillar 3 reporting and disclosure package into something slightly more edible for Boards and senior management.

Really one for the specialists on reporting templates content, rationale for why thing dropped out or emerged pre and post-consultation, and outstanding issues from a practical perspective - I am slightly divorced from this element at the moment, but have certainly heard the rumblings around look-through requirements, quarterly balance sheets and detailed asset lists etc on various grapevines, and with time ticking on, these kinds of materials can only help to aid prioritisation of the required BAU activity to populate the things!

The introduction of data requirements for EIOPA around financial stability (particularly Lapse information) seems very controversial - I have always found it the most closely guarded, and indeed requested information from interested third parties (analysts in particular!).

You should enjoy the sectioned material towards the back, which includes some free KPMG comment - if that is the house line, you may be able to save yourself a few quid!

Ernst and Young on Solvency II Pillar 3 - a likely story (sadly)

Time for a walk (actually more of a sthaager for a Manxman!) into the less familiar territory of Pillar 3, or "the output" as some traditionalists may label it.

E&Y dropped a Pillar 3 preparations survey out to a relatively small (53 respondents) but nicely spread (8 countries, and roughly split into Life/Non-Life/Composite) sample, and as one might expect, preparations were found to be slightly underdone by the majority.

They note that even for companies who have completed their gaps analysis between BAU and Solvency II demands, there remains some meaty outstanding issues such as reporting granularity; capturing synergies for other requirements (namely ORSA); policy drafting and implementation around data governance, and process redesign. Appreciating that some of these matters are still up for debate, some aspects of this gap list should be closed by now, and I suspect that the regulators will not look favourably at firms who continue to nudge this topic into the 2013 space.

Other aspects which jumped out include;

• Only a third of respondents have completed a gap analysis of QRTs against capabilities
• Less than a fifth have mocked up an SFCR/RSR, despite the prescriptive nature of Level 2 on the reports
• Interestingly, two-thirds have designated their finance functions as primarily responsible for Solvency II reporting - some have parked it with Risk which, while appreciating a three lines of defence model is not compulsory, seems very wrong regardless of the function's skillset.
• Three quarters expect to achieve reporting compliance only after "significant" or "fundamental" changes to their existing processes
• Some firms were identified as planning to speed up their existing processes to meet the proposed reporting deadlines under Solvency II, which seems an excellent idea

Pillar 3 is likely to be an even more bountiful smorgasbord after EIOPA released their feedback statement on their consultations around the Solvency II reporting package today. I suspect I don't have the ambition to swallow the 88 pages today (or perhaps any other day!), but Will Coatesworth neatly tweeted the big message earlier which the industry tried to avoid, which is that quarterly balance sheets look like they are here to stay as part of the reporting package.

Good news for regulators, consumers, and anyone who is punting round Pillar 3 software solutions I guess!

UK Treasury - Consultation on Solvency II

I have had a look through the UK Treasury's transposition of Solvency II consultation paper today (the purpose of this is to ultimately confirm which UK law and statute changes will need to be made to accommodate it, rather than the FSA's consultation, which was focused on replacing the existing handbooks with SOLPRU).

Strangely, at 100 pages, it is a pretty good read, and you should not be shy in purloining some of their idiot's guide material at the start for board presentations and staff briefings. However, the really meaty stuff comes in around halfway through, where they get to cost/benefit analyses (much of which leans heavily of the E&Y research referenced by the FSA numerous times already).

A few things jumped out, namely;

• £1.53bn as ongoing cost to UK industry (NPV over 10 years) - that's to go alongside the £1.9bn of transition costs!
• Sat alongside £3.52bn of "key monetised benefits", NPVd over 10 years - I'm no mathematician, but I guess that means it's a winner for the industry!
• Between 550 and 600 UK firms expected to be covered (Lloyds syndicates included) - this seems much lighter than the CEA figures from the other week, which had over 1,000 UK insurance entities. Are there relly that many below the de minimus level?
• No "gold plating" of Solvency II - bare minimum "copy-out" approach confirmed.
• Table included which shows the scale of the changes for firms with comparable data between Solvency I, ICAS and Solvency II.
• Still includes an estimate of 100 model candidates who will "ultimately" use an internal model, though it states that only a third of these will look for day-one approval. I'm struggling to reconcile this [100 in IMAP at outset, now down to 77, but only 33 will be approved on day 1!]
• Shows all the detail of how the FSA came to £110m as the cost between 09/10 and 13/14 (based on timesheets!) and the ongoing costs post-2014, broken down by FSA business area. Important note here is that half of the ongoing costs from 2014-2016 are for actuarial resource to assess internal models. Nice to know the logic behind the special project levies for those years

Plenty of flannel towards the back, which you are probably familiar with, but if not, knock yourself out!

ORSA Consultation Paper from EIOPA - bon effort!

As I don't expect everyone had the time, inclination or even the document to see how the pre-consultation team of CEA/AMICE/CRO Forum/CFO Forum etc got on with the ORSA document, I had a cross-cast of the two to see if any substantive changes were made. The following caught my eye in the public consultation paper released yesterday;

• Almost complete removal of the participation of the supervisory authorities in ORSA - this is now being left to Supervisory Review Process guidelines (it was shoehorned in to the pre-consultation in a way that made its removal inevitable sadly).
• ORSA Policy content trimmed down in one respect (removing some actuarial-themed material, which will inevitably end up in the ORSA Report), but added in a section on data quality.
• Made the section on checking SCR assumptions to make sure they fit one's Risk Profile much more confusing by neglecting to state whether "SCR Calculation" in the paper means "Yours" or "Theirs" - it does eventually come out in the wash that they are talking about any mismatch in reality between the assumptions one uses to generate their SCR (whether internal model, partial model, some USPs or full standard formula) and those which would actually fit the business, but it is a poor piece of drafting.
• More rigorous on being able to justify frequency of regular ORSAs
• New section on applying the proportionality principle for methodological complexity, frequency and granularity of ORSA
• Finally had the courage to write the words "ORSA" and "Report" in the same sentence! This was skilfully avoided in the pre-consultation, I guess to enforce the (still legitimate) fact that ORSA is a process, not a boiler-plate report production job
• Having removed the pieces on supervisory participation, they naturally had to lose a piece on how the ORSA output would make its way to the regulator. It was planned to put it in with RSR (and was very convoluted), but now there will seemingly be an opportunity (not guaranteed) to put forward the internal ORSA Report to satisfy regulatory obligations
• More explicit on covering less-than-easily quantifiable risks, and allows for mitigants other than capital to be used in their regard over the business planning period, provided they are not material. I hasten to add here that they have changed the language on reputational and strategic risk from being "less quantifiable" to "non-quantifiable", which is a bit of a cop-out.
• Much more explicit on capital management, both planning and execution over the business planning period - I guess this is a result of pressure from both the SIFI angle as well as Eurozone/Credit Crunch
• Leaves an open ended question on whether the ORSA Process includes or uses the outputs of tests which are associated with ongoing compliance with Articles 120-125, but the option is there for both
• Spectacular typo on page 25 - looks like one of the bullet points has not made the cut, as we jump from A to C!
• Late Psot Script - missed the omission of the requirement to independently assess the ORSA Process - no doubt everyone's internal audit functions are breathing a sigh of relief!

All in all, a good attempt and I feel more than prescriptive enough for the public consultation to drive it further forward. Perhaps a missed opportunity on the regulatory requirements front to iron out what they ought to get out of the industry's ORSA reports from a wide range of stakeholders, but hey, you can't have everything...

ORSA Consultation - out now!

Short and sweet - get your EIOPA ORSA Consultation paper here,  and your template for comments here - let's get to work!

FSA - Operational Risk Framework enhancement consultation for banks

Consultation alert! Anyone who likes their operational risk benchmarking and best practice will want to give this document released today their attention (divided though it may be by being Bank-oriented).

Whilst "the aim of this guidance is to assist supervisors in assessing and challenging firms' documentation and the way it is managed" as well as to "help Operational Risk functions at firms to meet the standardised approach requirements for operational risk", it actually reads like a best practice list which, in the shadow of Basel's efforts last week, is worthy of the attention of the insurance industry. My take was;

• Heavy on document maintenance (definition/descriptions/formula consistency)
• "Good practice" to map SYSC/BIPRU references to op risk documentation "on a periodic basis"
• Firm wide terms of reference, naming conventions and mutual references in documents noted as "good practice"
• Created 3 tiers of a "possible document hierarchy" which could be linked together in a firm-wide documentation map
• "Good practice" to implement controls around documentation ownership, and a central register of all documentation "could be practicable"
• Very unwieldy list of categories recommended for the document register
• "Recommended" that firms identify all policies and documents that are critical to the operation of the firm
• Practice of sticking revised documents on shared drives/intranet pages actively smacked down, advocating a proportional approach ranging from memos to formal training workshops
• Advocates KRIs (or KCIs, which was a new one on me!) for documentation monitoring - I actually quite liked their suggestions
• Recommends that firms meet a "use test" for documentation

Not seeing exactly how any of this might transfer over to the Insurance industry, but it doesn't augur well for anyone without SharePoint!