Reactions magazine - CRO Risk Forum - Solvency II and ERM opinion

I covered the last one of these releases from Reactions magazine this time last year on the basis that it had some good all round coverage of ERM and Solvency II from Europe's highest profile risk executives, and again they haven't disappointed.

This recent release again has a veritable Who's Who of European CROs providing their take on a range of matters, so is definitely worth your time. It covers most of today's hot topics, including SIFIs, ERM, Solvency II, ORSA (in US), Internal Modelling and Emerging Risk.

I've taken the following from it;

Hannover Re CRO

• "...experiencing increasing requirements for internal model approval" - strange one this, as they have already converted to a Societas Europaea, potentially driven by a wish to escape a more onerous challenge in this respect from Bafin and the FSA - doesn't therefore sound like that tactic is of much use!
• Their internal model is currently S&P ECM III-approved - detail on the significance of that available here for those not familiar with their methodology etc, but of course a positive review of an ECM will impact both S&P's assessment of a company's ERM framework, as well as the amount of capital required to sustain a particular rating.
• The CRO uses the cost of the Risk Function against the capital savings from an approved model as a demonstration of the function's value - in the absence of a range of alternatives, I guess it's worth a shot.
• As CRO, has a veto of decision making at executive committee level
• Comments in a rather peeved manner that current draft Level 3 proposals insist upon separately staffed and operationally independent compliance, risk and actuarial functions (they appear to have everything balled up into a second line of defence 'risk control unit'  - bit confused by this, but I'm guessing he has seen something behind closed doors, and rightly doesn't appreciate EIOPA determining how a company should be departmentally structured.

SCOR CRO

• The financial crisis "...has shown that the diversification of financial risks disappears in extreme situations"

Kiln CRO

• "Every generation of activity since [Level 1] has produced ever increasing requirements for documentation"
• "We are wallowing in paperwork"
• As with Hannover Re, they cite S&P internal model approval positively against the developing EIOPA/national requirements - only 40 pages required to evidence a standard sufficient for S&P 'model approval'
• They differentiate between Strategic Risk and Emerging Risk, with the latter seen positively as product development opportunities.

FSA and cost of Solvency II in the UK - two tunnels or half a tunnel?

Andrew Bailey, incoming head of the PRA in the UK, was widely quoted yesterday as saying that the spiralling costs of Solvency II could ultimately cost "twice as much" as London's new £15bn choo-choo tunnel Crossrail. This was at a parliamentary select committee, which for non-UK readers is where second tier politicians jump on the latest bandwagons, so that fact that Solvency II is getting some air-time is telling in itself.

Not entirely certain what expenses are included in this £30bn mega-bill, but the number is surely as inconceivable as a 2014 start date unless we add FSA costs, industry costs and slap on some arbitrary figure for "additional capital the industry will probably need to hold" - which is of course what was contained in the Cost Benefit Analysis commissioned by the FSA published back in 2011. With much of that based on QIS5 standard formula results (but at least in the same ball park as £30bn), I guess we can swallow £30bn, albeit with a pint, rather than a pinch, of salt.

"But wait a second" keen readers of the FT cry, "this time last month a prominent CEO said the cost was supposed to be HALF that of Crossrail,". Has someone in the fact sheet-preparing department at the Wharf got their wires more crossed that a breakdancing electrician, and sold their boss a dud here? Has one of the journos at the Telegraph or FT misquoted someone? Either way, there's probably a salient lesson in there somewhere around looking before you leap, it just remains to be seen who's left with the proverbial, errr, mucky shoes.

Incidentally, the full text from a separate questionnaire which the UK Parliament's Treasury Select Committee asked Mr Bailey to respond to is available here - this is separate to the interrogation transcript where the "twice as much" quote was obtained from, but contains some insight into where prudential regulation is going as of next month when the PRA take the reigns, including some good news on the regulatory levy front;

"For the next year, we intend to levy just £0.1mn [for Solvency II]. The difference [from last year's £15m] reflects cut backs that we have applied to Solvency 2 preparation costs. Although it is hard to be sure of the final cost of Solvency 2 preparations given the uncertainty on timing and substance, I expect the overall cost to be considerably lower than previously estimated. This will be a saving for insurers."


However, when one reads that, in his own words, the new head of Prudential regulation in the UK is "...by comparison new to insurance, but [he takes] it very seriously", you truly hope if the £30bn faux pas is attributable to him, that it can be put right - with all the Solvency II scaremongering and doom-mongering, we could probably use a little realism-mongering...

• 
  

  
  
  
  
  

AKG - Solvency II perspectives from the financial advisory industry

In the absence of materials pointed towards the sector, AKG have released a Solvency II guide for financial advisers (sign-up required, but worth it), which provides a refreshing angle change from the usual bureaucrats vs lobbyists vs politicians chatter flooding the trade presses.

Solvency II and RDR -
"mess with me, you mess
with my whole family"

While Solvency II was clearly De Vito to RDR's Schwarzenegger over the last year and a half for the financial advisory industry (indeed all bar one of those surveyed by AKG's pollsters had been concentrating "exclusively" on RDR), there was at least some familiarity with the impact on product availability from the current impasse - Protection and Annuity rates, With Profits availability and Guarantee costs are all on the industry's radar.

While there was a couple of faux pas in the document (the official timeline is certainly not "established and managed by EIOPA", and as the world and her husband will tell you, the ORSA is not an annual report!), the document helps understand the concerns and needs of the distribution world at this uncertain time. I picked out the following;

• That CROs will be more concerned about risks posed by external distributors and advisors in future
• That advisers will likewise need assurance on product supplier risks, and that provider and product ratings from external sources "...will be crucial components in gaining this reassurance"
• That the alignment of capital and risk "...will undoubtedly drive capital light products in future"
• That the mainstream press hasn't yet "gone big" on Solvency II, but that advisers may get caught out when they do
• That the advisory industry wants "...a guide [to Solvency II] to explain in an easy-to-understand, jargon-free manner" - over to you FCA!
• There are concerns around the quantum and familiarity of products/providers once Solvency II goes live and we see new market entrants/consolidation

They conclude that "advisers should not panic about Solvency II and its implications". That has a whiff of Chamberlain about it to say the least, but the "panic" would be about convincing punters to pay more for guarantees or share the risks in insurance products in the near future, as opposed to the solvency adequacy of the providers themselves.

Preliminary full year results - Solvency II implementation costs and opinions

Now the UK preliminary full year results are starting to flow in, we can get more visibility on what was spent in last year's Solvency II phoney war. This is a topic I have covered for the last two years on this Blog (here touches on previous disclosures in particular) and bearing in mind most of the UK's Big Rigs are in the habit of disclosing the sums spent on preparation, it gives a good feel for where the implementation costs tally may finally get to.

So read on if you are interested in seeing if 2012, just like the popular 'Lovely Day' singer, was the year that the...errrr....Bill Withers (?)

Legal and General

• "Delivered the core components" of Solvency II, though there remains "much uncertainty" - go figure!
• £50m spent on Sol II and "other strategic projects" (no further split available) - this figure was £56m last year

RSA

• Costs of £32m (£30m previous year) for Solvency II
• Expect costs to fall by "around 50%" for the next two years
• "Rephased our implementation project to minimise costs"
• EC calibrated to 1-in-1,250 (S&P 'A' rated)
• In the AR&A, they add that they "...remain at the forefront for internal model approval"

Resolution 

• £76m spent on (predominantly) Solvency II in 2012, as opposed to £56m in 2011 - 2012 was of course the year that they dropped out of IMAP, so the spend dropped in the second half of the year
• Original provision for Sol II released from MCEV this year was £34m!
• Economic Capital coverage of 182%

Aviva

• £117m spent on Sol II specifically, against £96m last year
• "Well placed" for ICAS+ review 

Standard Life

• £112m spent on Sol II, RDR and other restructuring (no further split available) - was down as £59m specifically on Solvency II in 2011

Old Mutual

• Economic capital at risk managed to 99.93%, and currently at over 160%
• "Given the delay to the Solvency II go-live date", focusing on embedding ORSA and internal model during 2013
• No coverage of project spend - same as last year

Prudential

• £48m of Solvency II implementation costs in 2012 (£55m previous year)
• "...expects to engage in the initial stage of the FSA's proposed Individual Capital Adequacy Standards Plus (ICAS+) regime"
• Solvency II "may" provide a more risk-based capital framework, but "...we now know that it will not be implemented before December 31st 2015"
• "Continue to evaluate [their] options, including consideration of the Group's domicile"
• "...remain focused on preparing for implementation" despite uncertainty

And over to continental Europe;

Allianz

• "...adoption in 2014 is no longer guaranteed"
• EC coverage of 199%, calibrated to 99.5% VaR over 1 year - was previously calibrated to 99.97%, and Solvency II is used as rationalisation for the y-o-y change
• Rated 'strong' by S&P for ERM, and have had their internal model positively rated by them
• "Will take advantage of the delay in the implementation of Solvency II" to industrialise balance sheet production and internal model processes

Munich Re

• "..some uncertainty remains" around Solvency II, and they are banking on "at least two further years" delay
• Note that "...the risk that our Life primary insurers may not meet the capital requirements cannot yet be entirely excluded"
• Confident that "new opportunities...will exceed the challenges"
• Targeting 1.75 x 99.5% VaR over 1 year as their Economic Capital Target - this is a "...conservative approach, offering a high degree of security"
• Currently hold 129% of that figure
• Perhaps more significantly from an internal model perspective, hold 225% of 99.5% VaR over 1 year - if we considered that "conservative", I wonder what we might consider "liberal"?

Generali

• Economic capital ratio (calibrated by their internal model to ultimately deliver the required SCR percentile) of 159%, unchanged y-o-y, despite a lot of positive capital management activity (p33)
• Solvency I ratio is 150% (p31), up significantly on last year's 119%

Aon Risk Maturity Index Report 2013

With the potential for early implementation of Pillar 2 on the horizon for Europe's insurers, Aon's release of their latest research on Risk Maturity Index is perhaps a timely one, particularly for anyone in the small-to-midsize bracket who wants to get a feel for the proportionality of their current approach (and for UK IMAP candidates, whether it might fold under ICA+ questioning in the next two years!)

Their claim that that the Risk Management Index fills the current "void" which prevents interested parties from benchmarking their risk management frameworks against those of their peers, and indeed reaching recommendations on how to further enhance them has a whiff of bolshiness about it, but nevertheless, the output is valid for practitioners in all industries.

Fundamentals behind the research, conducted in conjunction with Wharton Business School, are;

• Aon's "Risk Maturity Index" is an online self assessment of risk management practices.
• It asks 125 questions regarding 40 "key components" of risk management - all tied in to the following 10 characteristics of risk maturity:

 1. Board Understanding & Commitment to Risk Management

 2. Executive Level Risk Management Stewardship

 3. Risk Communication

 4. Risk Culture: Engagement & Accountability

 5. Risk Identification

 6. Stakeholder Participation in Risk Management

 7. Risk Information & Decision Making Processes

 8. Integrating Risk Management & Human Capital Processes

 9. Risk Analysis & Quantification to Understand Risk & Demonstrate Value

10.Risk Management Focus on Value Creation

• Allows for a ranking between 1-5 across various sub-cuts of the data collected, and an assessment in aggregate of each firms "risk maturity"
• Data was then analysed against over 100 listed companies from 20 industries, geographically spread, to see if "risk maturity", or a lack of it, translated into anything measurable
• Over 500 companies have responded to the survey since 2011, this being its second periodic summarisation (results from first one summarised here).

The headline news was that a correlation was identified between organisations with superior risk maturity and stock price volatility, with a reduction of up to 50% potentially up for grabs between the 'best' and the 'worst' - a particularly visceral way to "derive and demonstrate financial value from...risk management frameworks" which, let's face it, is a hard sell for the best of us!

I observed some more general points from the white paper, namely;

• The insurance industry was third only to Aviation and Consumer Goods in the assessment of risk maturity - something to be learnt from these industries (in particular around Op Risk maturity in Aviation)?
• Only 15% of respondents were rated at 4+ out of 5, or "operational/advanced" in Aon's terminology
• Lower revenues seem to translate into lower risk maturity on the whole
• Responses from CRO's resulted in the best aggregate maturity scores, while Internal Auditor/CFO responses resulted in the worst aggregates - expected biases nicely exhibited

Of particular note though were the three areas of common differentiation between higher and lower rated firms which are worthy of more attention than might otherwise come from reviewing average maturity scores. 

Awareness of the complexity of risk - more mature organisations are able to demonstrate:

• Risk adjusted return expectations by business unit/department
• Documented and applied assumptions in forecasts/projections
• Supporting forecasting ranges with applicable historical data

Agreement on [risk] strategy and action - more mature organisations stabilise their performance by:

• Re-evaluating risk management strategy based on experience
• Reviewing and validating risk tolerances based on external conditions
• Evaluating strategic decisions with reference to quantified risk tolerances

Alignment to execute [the risk strategy]

• Communicating negative results and predictions (nicely tied into Risk Culture by Aon)
• Developing cross-functional risk understanding, and how organisational activity relates to overall risk management strategy 
• Incorporating risk/return approaches into strategy, in particular recognising up-side potential in decision making, rather than loss minimisation

These are particularly interesting findings for the EU insurance industry, who will be waddling into Live ORSA territory in the coming weeks and months. Fair to say that Solvency II Pillar II accommodates much of what is covered here, so worth thinking about leveraging this benchmarking work in one's 2013 activities.

Lloyds - cognition and how human factors affect risk perception

While the Solvency II world will be as grateful for as they are familiar with Lloyds of London's work in the Sol II sphere, they pushed out an intriguing paper for all risk practitioners this week around cognition, the impact of human behaviour, and our interaction with models when identifying and assessing risks.

This is a piece of academic research very much needed at this point in time, where the regulatory obligations around internal model challenge have yet to formally land, let alone be adequately road-tested, while at the same time the UK is continuing with its ICAS+ regime, where entrants will no doubt receive running commentary on their progress in upscaling both assumption/parameter challenge as well as model use.

Anyone involved in the 200-ish pre-applications for internal model use prior to Solvency II go-live in Europe would therefore benefit from a read of this, particularly if you are on the validation-side. I picked out the following;

Fundamentals which impact on modelling choices (data sets, interpolation/extrapolation, correlations, tail dependencies etc)

• "We are not equally aware of all risks...people make decisions based on a subset of the available evidence"
• "Expectations are strongly influenced by personal experience and current events"
• Tendency to "...lose sight of infrequent losses" in the face of more frequent visible events
• Tendency to procrastinate around risks which are difficult to assess
• "Some may query the relevance of human factors, given the prevalence of quantitative risk models - the suggestion being.modelling rules out biases"

Risk appetite

• "Low risk appetite can increase false alarms, and a high risk appetite increases misses"
• "The greater risk appetite of powerful individuals can stem from a tendency to focus more on rewards and successes, while people who are lacking in power are often more cautious and attentive to threats and potential obstacles" - is it this dichotomy which makes the role of the CRO ultimus inter pares in the boardroom?

Aide-memoire lists for risk practitioners

• How to counteract risk perceptions - p11
• Separating risk perceptions from immediate context - p13
• Awareness of bias linked to power - p16
• Risks in perspective - p20
• Behavioural principles which can create added value - p22

Clear Path Analysis - Interview with EIOPA's Montalvo

The guys at Clear Path Analysis have come through with another suite of exclusive Solvency II material, following along from their efforts in September 2012 and 2011 (sign up required if you are not already hooked up with them).

This is dominated by asset allocation and Pillar 3 requirements, and I'll cover through those in due course. It was the interview with Sr. Montalvo from EIOPA which immediately caught my eye, so I picked the following bones out of it:

• Solvency II is "...nothing more and nothing less than a risk-based supervisory framework"
• Solvency II "aims to be a neutral system" with regard to asset allocation
• "The new framework creates business opportunities rather than operational risks"
• "No Pillar prevails, all are equally important" 
• The capital weightings on asset lines are based on "...sound technical calculations that were taken by the supervisory community (and in particular by the actuarial teams involved)" - is this a tacit acknowledgement of a residual element of black-boxedness?
• On IFRS convergence "...we had to move forward because in the accounting areas progress was not being sufficiently made". 'Aimerez-vous rencontrer M. Kettle, M. Pot?'
• On early implementation, "...once we see how it is working, [EIOPA] will have the courage to say which things can be improved"

Perhaps his sweetest quote is worth isolating:

Elderfield speech to Institute of Directors in Ireland - 'the Gene Genie'

With all the subtlety of an American industrialist in Paris, Mr. Elderfield delivered a speech to the Irish IoD this week focused on the Central Bank of Ireland's refresh of its 3-year strategic plan, as well as reinforcing what it expects financial services Boards to be focusing on in the near future.

This of course should sit in the context of what I covered last week on thematic enforcement work in 2013. Aside from his comments around board diversity, namely that the CBoI's 'fit and proper' activity to date is "...broadening the gene pool of corporate life" (eeeewwwww!), emphasis was given  to three particular areas:

Risk Appetite Statements

• CBoI expects "... [a] high quality risk appetite statement that is well understood and implemented throughout the firm in practice"
• "...clear articulation of the acceptable level of risk...at different confidence levels, is an important discipline and an essential compliment to a well-articulated business strategy"
• That, due to disappointments in the past, Risk Appetite statements are "...certainly an area of increasing interest on [the regulator's] part, and where we are debating the best approach for encouraging improvements"

System of Governance and Risk Culture

• Boards should "...provide broad, challenging scrutiny of your firm's culture regarding regulatory compliance and internal challenge"
• Ensure that there are "...appropriately resourced and well-qualified risk management and compliance functions"
• "Think more fundamentally and strategically about the culture in the institution that you oversee"

I would add that a lot of this sits nicely with the FSB's Risk Governance paper which was released last week.

Board composition

• Expect directors to take a "...hard nosed view on Board composition, with a view to improving performance"
• Endeavour to attain the "...right gender diversity...and international experience"

With Risk Appetite and Risk Culture both having featured on the IRM's hitlist recently, the practitioners over there will have some assistance to hand from an industry body, however there should be some other useful stuff available in the tag cloud at the bottom of this page on appetite, culture and diversity if you are struggling for inspiration.

Adams speech to the Economist Insurance Summit - lessons from financial crisis

Some particularly useful context setting from Julian Adams last week for anyone in the Internal Model game, with this speech to the Economist Insurance Summit around what lessons could be learned by insurance supervisors from the financial crisis.

While he amusingly interchanges between "financial crisis" and "banking crisis" to emphasise that it wasn't our fault, and drops in the now obligatory reference to the importance of insurers as long-term investors, echoing the Commission's pleas from late last year, the majority of the speech focuses on why models go wrong (not the name of a ropey catwalk reality tv show...)

Insight on where the FSA thought firms were going awry in the Solvency II modelling preparations was delivered to the industry in the middle of last year, but I found this speech helpful in the context of proportionality i.e. what elements of economic capital modelling are worth spending extra time on theorising, documenting, debating and minuting for IMAP candidates. I saw the following comments as highlights;

Reasons for internal models in the banking industry being exposed;

• "...rested on assumptions which turned out not to hold when bad times came"
• "...review period" selected when parameterising
• "...insufficient rigour and independence from the front end of the business" when parameterising
• "...management attention too often focused on those parameters considered too conservative at the expense of those that were insufficiently prudent"
• "...destabilising feedback loops" where underestimation of risk (due to data selection) plus use of the model leads to a vicious cycle of unacknowledged over-accumulation of risk
• "...flawed technical assumptions" in tail-end probability estimation where data is drawn from "normal" times

Lessons for Solvency II

• "Data [should be] sufficiently robust"
• Assumptions should be "appropriately conservative"
• "[Supervisors] can be helped...by the much greater use of imaginative tests of resilience to deeply stressed scenarios"
• "...paucity of relevant historical data for the calibration of tail dependencies between risks"
• That "...the limitations [of capturing tail dependencies] are recognised, and conservatism built in to the calibrations"
• That "...correlations in the tail are likely to be assymetric in nature" for insurers
• That "...the adoption of quantitative techniques...will not change the nature of the risk itself"
• That supervisors "...must not blindly accept the outputs of these models"

Appreciating some of this is hardly new news, any increased documentation and rigour in the areas highlighted will no doubt be well received down at the Wharf.

Protiviti - top risks for 2013

Nice piece of 'top risks' benchmarking for practitioners was pushed out this week by Protiviti - heavily US-centric, cross-industry (around 25% financial services, but all respondents are C-suite types), and the 'risks' are provided as a selection of 20 pre-written items, but the work has still got some mileage, even if I am far from convinved by the early statement that "...the first question an organisation seeks to answer in risk management is 'what are our most critical risks'" with no reference to their strategic objectives!

Let's take that as an editorial oversight, and pick through the highlights;

• Unsurprisingly, economic conditions and regulatory change/scrutiny are top of the financial services hitlist of 'top risks' (and indeed other industries)
• CROs and Chief Audit Executives were less likely to rate a risk "less significant" than their first-line counterparts - nest feathering or legitimate conservatism?
• Financial services considerably more likely to deploy additional resource to enhance risk management capabilities in the next year

There is also a "suggested questions for Boards" list at the back, which covers (albeit in a rather flannel-y fashion) the kind of items which emerged in the FSB's risk governance recommendations from earlier in the week, such as;

• Is the Board sufficiently involved in/informed of the risk assessment process regarding the implementation of strategy (mergers & acquisitions, new lines etc)?
• Is the MI around the Risk Profile sufficient?
• Is there an existing emerging risk management process?
• Is the risk profile consistent with risk appetite?

A decent piece to run through your NEDs at the very worst, and potentially of some use for your emerging risk/reverse stress testing activities for 2013.

Omnibus II - back to October 2013

Following on from the barely noticeable number of previous posts on Omnibus II Plenary vote delays (here, here, here, here, here and here), we can now stick lucky number 7 in the pot, after the procedure file was updated today to show a postponement to October 2013 - whilst the delay was inevitable after EIOPA made it clear that the Long Term Guarantees Assessment report would only reach the co-legislators by July, the actual date helps with short-term planning for all stakeholders concerned.

I guess the big questions that emerge from a delay to October are:

• Whether it is enough time, factoring in the summer holidays, to consume the LTG report, acknowledge its outcomes regardless of which territory benefits most from the conclusions, and vote positively
• Whether it is actually too much time to pull apart the report's outcomes, and between the trilogue parties, industry lobbyists and any national political pressures than can be marshalled in the interim, October just becomes the next promises graveyard.
• The increasing proximity of this date to the campaigning for the 2014 EU parliamentary elections, which must surely impact on how the voting will go if the LTG report gives a duff outcome to those countries still writing swathes of guaranteed business
• The entry into the mix of Karel van Hulle's replacement (haven't seen a name yet)

Not certain if 2016 is exactly riding on Omnibus II approval by October, but one feels it would certainly help restore some credibility.

Munich Re on Solvency II Control Functions - an actuary for all seasons...

Munich Re have continued their infrequent-yet-valuable Solvency Knowledge Series with a piece on Key functions within the system of governance of insurers under Solvency II.

Of course to the grizzled old set of risk practitioners who have done the rounds for the last few years, the fundamentals of the directive's requirements on the four control functions are as basic as the ingredients list for a frozen lasagne. It naturally draws attention to the likelihood that there will be "some overlap" between the activities of Risk, Actuarial, Compliance and Internal Audit, as well as touching on outsourcing as "...an attractive way of meeting the wide range of requirements" for those

However I detected more than a whiff of controversy around the content of this particular publication (which I hasten to add is a smart read nevertheless), were one to take it at face value. In particular;

• Their use of the three lines of defence model in the publication - while perceived to be good practice for segregating operations from risk advisory from risk assurance, it is certainly not cited in any existing materials at Level 1, 2 or 3, and the structure may be disproportionate at the small end of the insurer spectrum. On top of that is the Actuarial function's acknowledged dwelling over a grey area between the first and second lines, in particular if they haven't catered separately for the reporting lines of reserving, pricing and capital management actuaries (p8).
• The comment that "The risk management function will no doubt have to include people with a professional scientific and mathematical background, ideally backed up by appropriate qualifications (eg actuaries)". Whilst, internal model or not, the Actuarial function will clearly have to provide "considerable support" to the Risk function, I don't see any reason at the small-to-medium level for the Risk function to include actuaries unless through choice, using the lever of proportionality.
• That the Risk function "...shares responsibility for the risk strategy" - I think the implication is that it shares responsibility with the Board, but the statement doesn't help identify a) who authors and authorizes it and b) who gets fired for its poor deployment! I am more inclined to think the Risk function owns the risk management system and is responsible for monitoring and reporting on the implementation of the risk strategy which sits within it. The FSA define their requirements on this page in any case.
• That the Risk function "...identify potential risks and recommend appropriate countermeasures to the Board" - as far as emerging risk/top-down risk assessment goes, I certainly expect the function to facilitate the emerging risk/scenario analysis/reverse stress test activities in this regard, but it is most certainly not a solo job.
• That "The compliance function...will have to include staff with a legal background" - appreciating what the wording of Article 46 implies in particular, this is more a proportionality/outsourcing issue for me than anything. Having said that, I'm sure any existing compliance professionals out their who didn't take the Bar might feel slighted by this! 
• That "all four functions have a direct reporting line to the Board" - not certain that this is so in the vast majority of cases. Certainly via Board committees the Risk and Internal Audit functions will be well catered for (and the FSB recommended even better than that for the Risk function last week), but I suspect an executive reporting line is as good as it gets for the other two functions in most firms.

Certainly plenty to engage the grey matt with regardless of your country of origin, even around control function crossover areas (which I presented on at the end of last year), so dig in.

Chartered Institute of Internal Auditors - recommendations for UK financial services

The Chartered Institute of Internal Auditors recently created a sub-committee to provide professional guidance "...designed to be a benchmark for effective internal audit in financial services in the UK", and they have just reported back with this feast of fun, which is a vital read for anyone working in control functions within financial services. The opinions they have used to create this guidance have been purloined not only from the profession itself, but also from other professions, regulatory bodies and executive/non-executive directors

They note in summary that there is "strong support for an unrestricted scope for internal audit", while drawing attention to disparity of opinion around matters such as: IA directly challenging strategy; IA reporting to Risk Committees (rather than audit committees) in certain instances; compulsory attendance of Chief Internal Auditors at Executive Committees; and the direction of managerial reporting lines.

The proposed guidance reads very much like the Corporate Governance Code, and is relatively light. It is broken into the following sections, where I have noted anything I found new or controversial alongside (my focus being predominantly scope creep into the Risk function's activity):

1. Role and Mandate of IA - increased focus on risk assessment and risk coverage adequacy
2. Scope and Priorities of IA - unrestricted scope ultimately advised; expected to "independently determine" key risks, and assess "the setting of, and adherence to, risk appetite"; assess the "risk and control culture"; allows for potential involvement of IA on "real time basis" in key corporate events (mergers, disposals, new lines of business etc)
3. Reporting results - factors in reporting obligations to both Risk and Audit Committees where appropriate, and builds in an expectation of an annual independent assessment of governance (which covers off one of the FSB's recommendations covered yesterday!)
4. Interaction with Risk, Compliance and Finance functions - nothing new
5. Independence and Authority - Chief Internal Auditor expected to be executive committee-equivalent, have the right to attend Excom, access to all MI, and report directly to either the Chairman of the Board, Audit Committee or at a push, Risk Committee. A secondary line to an executive director should only go to CEO
6. Resources - all resourcing decisions effectively divorced from the business, to reside with the Chief Internal Auditor and the Audit Committee
7. Quality assessment - external assessment of the function recommended periodically.
8. Relationships with regulators - nothing new
9. Wider considerations - expectation that the "tone at the top" of a firm should be what fosters acceptance of IA

Any controversy? Perhaps around the seniority of the Chief Internal Auditor, and their assessment of the setting of and adherence to Risk Appetite. I think my main concern as a risk practitioner would be the potential for differences of opinion around what constitutes "adequate" risk management, given the Internal Audit predeliction for COSO on all things risk-related, against the IRM or ISO31000. 

Let battle commence?

Financial Stability Board - Thematic review and recommendation on risk governance

The Financial Stability Board (FSB) have been sticky-beaking around systematically important financial institutions (SIFIs) with a relative unchecked remit ever since the financial crisis first reared its head. This week they have emerged with a very significant document for Risk practitioners across the globe, with a thematic review of Risk Governance (press release also available here). The participants were 36 banking and broker/dealer institutions of interest, as well as major supervisory bodies and NGOs.

On the basis that there isn't a single accepted global standard on the matter, the thematic review compares prevailing practices against an amalgamation of content from exising standards from the IAIS, OECD and other bodies. Of major interest to risk practitioners is the document's focus on areas which the IRM have covered recently, namely risk appetite/tolerance/limts/capacity and risk culture.

Bearing in mind the great and good from the prudential regulatory world are active participants in the FSB, the likelihood of their findings emerging in the regulatory principles of tomorrow are pretty high. Of course this research has been based on Non-Insurance SIFIs, and so insurers large and small who have been endeavouring to meet Solvency II Pillar II requirements will find themselves in a decent spot already.

On that basis, I noted the following;

General recommendations to supervisory bodies (p4)

1. Formal requirements on the independence and skillsets of Boards
2. Hold Boards directly accountable for risk governance, and whether or not their existing suite of risk MI is sufficient
3. Formally elevate the stature, authority and independence of the CRO role
4. Require an independent assessment of the effectiveness of the risk governance framework to be performed on an annual basis (a list of what Internal Audit would generally review in this context follows on page 24)
5. Engage "more frequently" with Boards and management to assess risk culture

Sound practices list p30-34 - highlighted below are elements which may be new to the UK in particular, were they to be introduced

• Boards - annual reviews of member qualifications, skills and time commitments; meet quarterly with regulators; "effectively inculcate" an appropriate risk culture
• Risk Committee - annual approval of risk management policies
• Risk Management function - CRO to have direct reporting lines to Board/Risk Committee as well as CEO; public disclosure of CRO firing/hiring; be "actively involved" in strategic decision making processes; meet quarterly with supervisors; stress testing "on demand" at the behest of the business

Risk culture and risk governance supervisory assessment

• Notes that supervisors need to strengthen their ability to assess a firm's risk governance "...and more specifically its risk culture"
• "More work is needed" on regulatory assessment of risk appetite frameworks
• "Risk culture plays a critical role in ensuring effective risk governance practices through changing environments"
• FSB have a working group exploring the potential for formal risk culture assessments, who are  reporting in September 2013

Risk management functions and CROs

• Acknowledges that there have been "[raised] supervisory expectations for the risk management function" since the financial crisis
• Highlights that "most firms note that the CRO has a direct reporting line to the CEO", though "access to the Board" apparently remains more of an expression than a vivid reality
• "Good progress" has been made on enhancing the stature, authority, and independence of the CRO position
• Rather non-descript comment that "the Chief Risk Officer and the risk management function are responsible for the firm's risk management across the entire organisation" - responsible for what element, not conduct surely?

Risk appetite/tolerance/limts/capacity

• Acknowledge a "lack of common terminology for risk appetite, risk profile and risk capacity...within firms, across firms and across national authorities"
• Definitions of appetite and capacity used by FSB largely line up with IRM's definitions (though the IRM use 'tolerance' rather than 'capacity')
• "Key features of a Risk Appetite Framework" are listed on p22 - however even those firms considered best in breed commented that there are ongoing "operationalising" problems with RAF rollout
• Suggest that breaches of 'risk limits' should lead to reductions in exposures (piii) - not sure why the alternative of increasing appetite is not acknowledged

EIOPA on Solvency II implementation - "no doubt about it"

Now that most Solvency II stakeholder's hands have been temporarily filled with the LTG spreadsheets and assorted accoutrement, Seniors Bernadino and Montalvo have hit the trade press with more aggression than an Irish prop forward in order to clarify their position on the drivers behind their opinion on interim measures at the end of 2012, as well as the ultimately likelihood of Solvency II implementation.

From Sr. Bernadino to the Actuary magazine

• On the shortcomings of Solvency I - "...if you have more risk, you should have more capital"
• "I think it will take until then [2016] to get started" on Solvency II
• "We [EIOPA] believe 2014 and 2015 can be used as an opportunity to enter into the system in a better way"

From Sr. Montalvo to Reactions magazine

• "Solvency II will be implemented, and there should be no doubt about it"
• "EIOPA will do the necessary work to make the implementation of Solvency II happen on January 2016"
• Emphasises that we are "not building from Solvency I", in the face of "Solvency 1.5" questions
• Notes that EIOPA's opinion on interim measures is borne from concerns that the delay may lead to "different national solutions [emerging] to the detriment of a good functioning market"
• "Differences between supervisory cultures" is part of the IMAP inconsistency problem - no implication that either the UK is doing too much or mainland Europe not enough
• Makes the point that stakeholders "...must avoid the temptation of re-opening more issues" - hard to think of any contentious issues which aren't already wide open for debate, but clearly some concern that the current smorgasbord could be supplemented.
• For those at the smaller end of the market, he gies a specific example of where an Actuarial function could be staffed by someone other than a "pure actuary"

All this in the week where a succession of industry figures in London lined up to flog Solvency II's hobbling carcass, whether it be the IMAP element (Hiscox), or the very premise of one-size-fits-all regulation (Pru). Not a good week to be trying to kill a horse in the UK gents...

Towers Watson on US ORSA, Economic Capital and modelling trends

Towers have released a few decent bits of material of use to risk practitioners over the last couple of weeks which are worthy of comment. One on Economic Capital for Life Insurers is effectively a sales aid for their RiskAgility modelling software, but actually captures the drivers behind the UK's efforts to improve their ICA models to meet Solvency II requirements.

In particular the references to how firms ought to be making their model output 'useful' where they currently fall short (capital by business/risk/product, daily runs without running ALM models and ability to produce "what if" analysis) should be featuring highly on the agendas of both embedded use practitioners and AMSBs during 2013. Of course the sad part for any users of the software comes with the statement that RiskAgility is built "...specifically to deliver monte carlo simulation of 1 year VaR economic capital" - love to hear how the lack of multi-year is being dealt with in firm's ORSAs!

A second publication on ORSA preparedness in North America is also worth a read, even if only for us EU-based practitioners to have an opportunity to live vicariously through a country which will actually get it implemented! It is a relatively small quantum of respondents (mostly CFOs), and around half think they will be exempt on size grounds, but the perceptions which emerge are still valid, and one should be prepared to encounter this either side of the Atlantic;

• 21% see it as a compliance exercise, while 60% think it will improve ERM and capital/strategic planning
• Only 22% see their prevailing ERM frameworks tightly liked to strategic and capital planning
• Only 40% are ready to implement an ORSA in the next 6-12 months
• Concerns remain around resource requirements for educating "key personnel" and directors/C-suite - 45% and 66% respectively felt they have work to do in this area without necessarily having enough staff to do so.
• 13% of respondents didn't see their risk management departments contributing to the ORSA process (I'll get my coat then...)
• 3 year projection of capital requirements is the most common planning period envisaged

The same North American slant is then given to a financial modelling survey, which gives us another chance to peek over the fence. They found the following;

• Reasonable amount of dissatisfaction around run-times
• Around half planning to change their model governance processes in the near future

Looks like the NAIC/EIOPA covergence work should be a walk in the park then, at least on these topic...

Central Bank of Ireland - Prudential regulatory agenda for 2013

A pretty meaty speech was delivered last week by the CBoI's head of life insurance supervision, covering the prudential regulatory agenda in Ireland for 2013 and beyond. In essence it is a rather sobering take on the flipside of the Celtic Tiger's death and its impact on what was an effervescent, if still fledgling, cross-border insurance industry, noting that new business volumes recorded in Ireland have declined for the 5th year in a row, and currently aggregate out at a break-even APE/PVNBP margin.

I found there was actually a lot to take from this on the ORSA front, and would recommend any readers on the Emerald Isle pick the bones out of it, in particular that the regulator "expects to see";

• Strategies reflecting "current market realities" - highlighting excessive commission to brokers, swollen lapse/surrender rates and reduced margins from over-competition.
• Tight management of costs
• Increased efforts put in place to retain existing in-force business
• "Credible business plans"
• Viable alternatives to grow business through distribution or product range changes (online facilities highlighted specifically)

While much of this may read as common sense, one can reasonably assume that the CBoI is not seeing enough evidence of this in the Financial Condition Reports and strategic plans that currently cross their desks, and are expecting a much meatier ORSA-type approach to managing strategic risks over the business planning period in the immediate future.

FSA and ICA+ - making the best of a bad hand...

The FSA released the letter we've all been waiting for at the end of last week regarding their plans for  allowing UK firms to use their intended Solvency II-ready internal models to calculate their compulsory Individual Capital Assessments between now and the go-live date of Solvency II (don't laugh, it's still possible that it might go live ;-) )

I suspect a mix of suitability, financial necessity and pragmatism has led the regulator to pursue a relatively relaxed take on ICA+ , for example;

• It is "not a condition for IMAP review or approval"
• It "does not require Solvency II tests and standards [for internal model approval] to be met"
• Firms will confirm the scope of material which needs to be reviewed for ICA+ assessment, rather than the FSA themselves
• They also confirm that it is "not [their] intention" to bring in Solvency II reporting requirements "...any sooner than required by EIOPA"

That said, while the FSA try to thin out the field by noting that ICA+ is "most appropriate" for firms who are both in IMAP and due for a business-as-usual ICA review in the next two years, it would make sense for anyone in IMAP to pursue ICA+, more than anything because of the interminable delays in Europe might put a firm outside of ICA+ at a competitive disadvantage on the capital front.

The onus therefore appears to be on the industry to quantify and explain the differences between the inputs, processes and outputs of their ICA models and Solvency II models, as well as demonstrate how their ORSA processes address the existing requirements of INSPRU, specifically targeting INSPRU 7. There is also a sneaky request for a self-assessment of progress towards achieving compliance with the Solvency II tests and standards for internal model approval.

From a practitioner's perspective, I had a particularly large chortle at the requirement for all materials being used in the ICA+ assessment to have been approved by the firm's Board - I'm sure they are looking forward to another two years of swollen board packs...

There is more information to follow from the FSA in Q2 of this year, presumably on the basis that the  LTG assessment activity they are on the hook for will have concluded, and more focus can be shifted to this pioneering work. Congratulations to them for not overegging this particular pudding, on paper at least.

EIOPA's Long Term Guarantees assessment - long time coming

So EIOPA have finally released the specifications for the Long Term Guarantees assessment (press release here), the second most eagerly awaited release this year behind Kate and Will's baby. Relatively straightforward timetable of events expected by EIOPA it would appear;

• End of March - completed templates submitted to national regulator
• April and May - national regulator and EIOPA will analyse and synthesise results
• Second half of June - technical results to be provided by EIOPA to the trilogue parties
• Mid-July - report provided by the Commission to the co-legislators

I am stressing the second half due to the current procedure file for the Omnibus II Parliamentary Plenary session pointing at a 10th June date, which is of course too early to consider that report in making a decision on Omnibus II. That leaves one more Plenary window in July before the summer recess, so we can probably bank on a postponement to September at the very least, particularly as the report is bound to contain more contentious bones than a frozen beefburger...

A few things of note in the suite of materials published by EIOPA today, of which the presentation slides are perhaps most useful;

• Objectives of the assessment include "possible competition distortions" and "impact on long-term investment", which have surely topped the list of differences between trilogue parties and indeed individual countries to date.
• Predominantly based on YE 2011 balance sheet, but will test pre and post financial crisis positions as well (2004 and 2009)
• Can optionally use internal models for capital and risk margin calculation, provided the entity is in a national IMAP.
• At least 50% of Life non-linked TPs and 20% of Non-Life TPs in each country must be covered (hence the industry has been quite vocal about doing this at financial year-end!)
• 13 scenarios included in the assessment, of which one does not include any of the proposed measures - not sure if that reduced quantum addresses the concerns of the FSA's Insurance Standing Group back in September, when the number sat at 18.

The main meat in today's releases are of course for the digestion of your friendly local actuaries and accountants - best of luck!

EIOPA, Parliament, IRSG and LTGs - momentum sustained?

I guess I should start with a Blein Vie Noa to one and all - after a relaxing few weeks in France I am now back on the beautiful Isle of Man sizing up opportunities for 2013 and beyond.

I didn't expect I would be missing much over the festive period and, other than the FSA sacking-off their proposed January IMAP industry briefing in favour of a (yet to be delivered) letter, things did go quiet. Freshfields kindly filled some airtime by pulling together another of their "where are we now" summaries that remain excellent (and free) materials that I would recommend punting on to your non-executive directors.

Luckily the noisemakers got back in the game as soon as school restarted, focused largely on the content of EIOPA's Insurance and Reinsurance Stakeholder Group's minutes. This meeting was held in October, so in terms of new news, it is right up there with "Earth is not flat". That said, we don't all have access to the inside track before publication of such materials, so it was interesting to pick through the doc for steers. I noted the following;

• Continuing problems with terms of reference for the LTG assessment (indeed the LTG sub-group note on p7 that there isn't even a EU-consistent definition for LTG!) - still looking like it will impact on the designated Plenary session for Omnibus II due to a combination of last minute delivery of the technical specifications to the industry itself as well as the output report to the Parliament, who themselves were reported today as being less than impressed with the final TORs. The potential number of scenarios in the assessment also clearly remains a sore point.
• Acknowledgement that "Autumn 2013" is now "best case scenario" for Omnibus II adoption, though, according to van Hulle at the last EIOPC meeting, the Commission and Parliament remain almost diametrically opposed on what should materialise at Level 1 and Level 2 (full minutes from EIOPC here)
• Confirms the ex-ante approach is favoured by Parliament and Commission (significance covered by Gideon here), and that Parliament have no wish to commit to an implementation timescale.
• The Council members are being "heavily lobbied", fostering implementation uncertainty.
• Attending stakeholders supported a definitive 2016 date.
• The IRSG's Governance sub-group flag up consistency issues around Fit and Proper regs as well as the "AMSB" term that I'm sure we have all had practical issues with over the last 2 years!
• Proportionality remains a "main concern" for mutuals, as well as smaller insurers - despite having a designated sub-group, any substantive guidance on applying the proportionality principle looks a distant prospect at best.
• Astonishingly, minutes from May 2012 could not be approved due to EIOPA's "workload" - small instance of an institutional tardiness problem?

Whether or not the industry is losing it's appetite for the Solvency II banquet, when you check out EIOPA's workplans for the next couple of years, at least one body will be filling its face!

Another interesting piece came out in the last week, when InsuranceERM pushed out the findings of a Solvency II roundtable (no sub required), bringing in a few UK-based CROs and the like, ostensibly to chew over the loss of momentum in the project. A few noteworthy bits jumped out;

• Solvency II balance sheet appears to be off the agenda for ICA+, for both regulator and industry
• Perception that, with the transition of regulatory "ownership" to the Bank of England, there is a decreased likelihood that the industry will be able to use Solvency II as a capital release mechanism
• A suggestion that the FSA was more minded towards EIOPA's opinions than the industry's during IMAP 1.0, something which has seemingly reversed with the advent of ICA+

One certainly hopes that the UK industry and regulator can make a decent fist of this indeterminate transition period without having to break the bank...