The most critical aspects of the Solvency II use test are the buy-in, understanding and behaviour needed to make sure that risk considerations are at the forefront of decision making – the ‘people test’. How can you make sure that your people pass the test?
‘Solvency II is not just about capital. It is a change of behaviour’, said Thomas Steffen, former Chairman of the Committee of European Insurance and Occupational Pensions Supervisors (CEIOPS), at the launch of the Solvency II draft framework directive in 2007. [1] This change of behaviour will be a critical element of meeting the use test.
Supervisors will be looking beyond your capital adequacy to how risk and capital evaluations are used within the business, how well senior management and frontline teams understand the risks facing your company and whether they take appropriate account of the risks when making key decisions. In short, they don’t just want to know about the engine, but also how it’s being driven.
Instilling the necessary risk awareness into the behaviour, decision making and underlying culture of the organisation – we call this the people test – is often easier said than done.
The financial crisis highlighted what the European Commission has described as the ‘absence of a healthy risk management culture within many financial institutions’ [2], which manifested itself in a lack of oversight, inappropriate incentives and excessive risk taking. Many people at the sharp end of the business saw risk management as little more than a regulatory chore, with limited value or relevance to their priorities. As a result, even where sophisticated risk and capital models were in place, the evaluations were often misunderstood or simply ignored in the pursuit of top line revenue.
1 European Commission media release, 10.07.2007 | 2 Corporate governance in financial institutions and remuneration policies, published by the European Commission on 02.06.2010
With regulators now determined to take ‘tough action’ against companies with a weak risk management culture, there could be a high price to pay if your organisation fails to meet the people test. Internal models may fail to win approval however sophisticated the systems and methodologies being used. You’re also likely to face closer attention from supervisors and the possibility of capital add-ons. Further scrutiny is coming from rating agencies, with Standard & Poor’s viewing the risk management culture as the critical foundation of its enterprise risk management rating framework.
Hector Sants, Chief Executive of the UK Financial Services Authority, in October 2010[3]
At the same time, there are clear competitive advantages for getting this right. Being able to demonstrate that risks are appropriately evaluated and managed across your organisation is likely to result in less intrusive supervision and greater comfort for your board. This will let you get the full payback from your investment in new risk and capital modelling capabilities as your people will have a better understanding of the outputs and how they can be used most effectively. The benefits include a better understanding of the risk issues, how much risk you want to take and at what price. You’ll then be able to give your frontline teams more licence to capitalise on opportunities, confident in the knowledge that they’re taking proper account of the risks.
3 ‘Can culture be regulated’, a speech by Hector Sants, Chief Executive of the UK FSA to the Mansion House Conference on Values and Trust, 04.10.2010
So what does the people test involve in practice? You‘ll have risk limits, underwriting guidelines and other control procedures in place. What you might not have is a risk-aware culture that permeates all levels of the organisation, within which your people are clear about what is required from a risk perspective. Your people workstream will, as a result, need to look at how to make risk management a more prominent feature of such key areas as reward, training, performance management and governance structures (see Figure 1). However, the changes will only be skin deep and unlikely to convince supervisors without an underlying culture that promotes the necessary risk awareness. So what are the key features of an effective risk culture, how does this culture manifest itself and how can it be instilled into the organisation?
The risk culture can be defined as the norms of behaviour that determine your company’s ability to identify, understand and act upon current and future risks. For example, an important feature of an effective risk culture would be all employees taking active responsibility for the risks they take and recognising the contribution of effective risk management to their own performance. Another feature would be a clear understanding of the risk appetite within the business, where risk teams are encouraged to contribute to, and challenge, decisions.
To develop a risk culture with these hallmarks, it’s important to look at the working practices that drive your business and how these can be changed in a sustainable way. The practicalities of how the business operates, makes decisions and organises itself will be quite different as a result. While changing what may be ingrained ways of working will clearly take time, stressing the benefits will help to sustain the momentum of change and present the risk culture as more than just a compliance exercise. For example, your company might be looking to make acquisitions in the lead-up to Solvency II. Using the internal model to help assess the impact of potential transactions on the risk and capital profile of your business would be an instance of a working practice that builds effective risk management into decision making. As such, it would also help you to pass the use test.
As Figure 2 highlights, there are a number of levers that can be applied to instil and support a strong risk culture, built around the core themes of leadership, communication, accountability and infrastructure. The starting point is the tone from the top, helping to define expectations about behaviour and promote organisation-wide understanding of risk management roles, responsibilities and accountabilities. Some of the levers will be reasonably familiar. They include making sure your people have the necessary training to understand the model outputs they receive and how to apply them in risk-weighting their decisions. They also include encouraging staff to think about the risk implications of their decisions through the integration of risk metrics and desired behaviour into their objectives and incentives.
Some levers will be less familiar, for example being clear on how you will actively engage business teams to understand what kind of risk and capital information would aid their decision making. It’s also important to break down barriers between business, risk and compliance teams. This might mean encouraging them to work in close physical proximity with each other, rather than seeing themselves as separate arms of the organisation.
Changing the way your people think about and manage risk and the culture that drives this are at the heart of Solvency II. Meeting the people test will require a clear understanding of how Solvency II will affect the way people make decisions, how they apply risk and capital evaluations, and how to make the necessary changes in the most effective way.
Fail to meet the people test and you could find yourself missing out on model approval and facing more intense supervision. Get it right and you’ll be able to capitalise on your investment in risk and capital modelling by making sure that the outputs are understood and used in the most effective way. In short, meeting the people test is vital for compliance, but it also makes good business sense – what is the point of having a great model if you don’t know how to use it?
PwC is helping a range of insurers get to grips with the practicalities of Solvency II implementation. If you would like to know more about instilling risk awareness into the culture and decision making of your organisation, please contact the authors.
www.pwc.com
© 2010 PricewaterhouseCoopers. All rights reserved. "PricewaterhouseCoopers" and "PwC" refer to the network of member firms of PricewaterhouseCoopers International Limited (PwCIL). Each member firm is a separate legal entity and does not act as agent of PwCIL or any other member firm. PwCIL does not provide any services to clients. PwCIL is not responsible or liable for the acts or omissions of any of its member firms nor can it control the exercise of their professional judgment or bind them in any way. No member firm is responsible or liable for the acts or omissions of any other member firm nor can it control the exercise of another member firm's professional judgment or bind another member firm or PwCIL in any way.