1. Introduction
On 17 September 2014, the Financial Reporting Council (FRC), in its role as the UK regulator responsible for promoting high-quality corporate governance, issued an updated version of its Corporate Governance Code (the Code) (FRC, 2014a), together with the related document ‘Guidance on risk management, internal control and related financial and business reporting’ (the Guidance) (FRC, 2014b). The revised Code applies to all listed companies for accounting periods beginning on or after 1 October 2014.
Recognising that the revised Code represents a significant raising of the bar on risk management and presents an exciting opportunity for actuaries to help all listed companies – not just those in the financial services sector – to meet the challenges that will arise, the Institute and Faculty of Actuaries (IFoA) established the FRC and Risk Reporting working party (a multi-disciplinary working group with experience across risk, life, GI and pensions) to develop the profession’s response and to help actuaries make the most of this change to expand their impact and influence. As part of this work, the IFoA commissioned a survey of UK-listed companies, in order to gain an understanding of the impact of the updated Code and of how prepared UK companies are to meet its challenges. The final report on that research is available on the IFoA website (IFoA, 2014).
The IFoA held a seminar at Staple Inn on 24 November 2014 for the purpose of launching the research findings from that survey. This seminar brought together key stakeholders from the FRC, Institute of Risk Management (IRM), IFoA and a range of companies from a number of sectors, and provided a unique opportunity for interested parties to come together to discuss the impact of the changes in the Code.
This article provides a short summary of the findings from the survey and brings together key discussion points and opinions from the seminar.
2. Revised Code and FRC Guidance
After a brief introduction from the Chair of the seminar (Colin Wilson), David Styles (the Director of Corporate Governance at the FRC) gave a short explanation of the origins of the revisions to the Code in the 2008 banking crisis and in the reports, first, of the banking commission, which identified the issue of risk reporting, and then of The Sharman Inquiry (FRC, 2012). In particular, the Sharman Inquiry had identified a difference in perceptions between the accountants preparing going concern statements and the shareholders reading those statements, so an essential element of the changes is to separate an explicit Going Concern statement (based on accounting considerations) from a Long-Term Viability statement.
David Styles also explained that the chief aims of the new guidance are to ensure that future corporate reporting identifies the principal risks faced by the company, and that Boards are fully aware of their overarching responsibility for the company’s overall approach to risk management and internal controls.
3. Survey of Company Responses to the Revisions
Colin Ledlie, the Chair of the IFoA working party, presented a summary of the research conducted by ComRes on behalf of the IFoA. ComRes had interviewed 63 stakeholders between 3 October and 19 November 2014, from seven FTSE 100 companies, 20 FTSE 250 companies and 36 smaller UK-listed companies. Stakeholders were defined as key decision makers involved in implementing the revisions to the FRC guidance for their companies, and included Chief Financial Officers, Chief Risk Officers, General Counsels, Company Secretaries, Senior Finance Managers and Senior Risk Managers:
∙ The level of awareness was relatively high, with 75% of stakeholders saying they understood the revised guidance either “very” or “fairly” well.
∙ The extent of preparedness was much lower; although 63% say they have started work on assessing the impact of the revised guidance, a very low proportion have completed this work and 22% have not yet started to consider the potential impact.
∙ The elements of the guidance selected by stakeholders as being the most important were generally as expected:
○ integration of risk management with considerations of strategy and capital and business planning process;
○ definition of risk appetite;
○ quantification of risks; and
○ production of the Long-Term Viability statement.
However, a surprisingly low proportion of stakeholders (21%) identified definition and assessment of risk culture, bearing in mind that the new guidance expects companies to consider not only the desired culture within the company but also whether this culture has been embedded. There is a danger that the FRC’s intent to embed a healthy risk culture in organisations will not be realised if companies do not consider it an important part of their organisation:
∙ Companies may be underestimating the challenges of meeting the new requirements. The majority of stakeholders considered that the revisions will have little or no impact on their business in terms of their organisation’s risk management approach (78% think this), their organisation’s year-end risk or audit committee reporting process (63%) and their organisation’s risk disclosures in annual reports and accounts (62%). The first finding (impact on risk management approach) is the most concerning because the current guidance and the current processes in many firms are based on a traditional, control-focussed approach to risk management, whereas the new guidance is asking firms to embrace a much more advanced, enterprise-wide risk management process that encompasses many advanced elements such as a focus on culture, decision making and sophisticated quantification and modelling of risks.
∙ The challenge most commonly identified by stakeholders (by 63%) was the difficulty of quantifying long-term strategic risk. Of equal concern, though, the findings indicate that there remains a cultural challenge in some firms in getting business leaders to engage fully with risk management: 30% identified the ability to focus board attention on risk management as a challenge. This needs to be addressed if the guidance is to be fully effective and work as intended.
∙ In total, 62% of stakeholders are “very” or “somewhat” likely to seek third party assistance. The primary source of assistance in areas such as risk disclosures in annual reports and accounts is likely to be the organisation’s auditors. Nevertheless, in the context that 63% are challenged by the difficulty of quantifying long-term risk, the impact of the revised guidance on the actuarial profession could be extensive. However, there is a significant proportion of stakeholders who sit in the middle ground, and appear not yet to be firmly set on one course of action or another. The ultimate decisions of these people will be crucial in terms of understanding the likely impact on third parties.
4. Risk Reporting Practices
Professor Paul Klumpes gave a presentation on his research into risk reporting practices by FTSE firms, and into the effectiveness of those disclosures. He first summarised the revised Code as requiring four distinct but related disclosures, regarding:
∙ principal risks facing the company;
∙ long-term viability;
∙ going concern basis of accounting; and
∙ review of the risk management and internal control system.
He then explained the three disclosure indices he had applied in his research, relating to:
1. type of risk exposure;
2. risk tools and processes; and
3. risk monitoring and control procedures.
Professor Klumpes’ first finding is that the size of the company is a significant factor on index 1, where large (FTSE 100) companies scored more highly, but much less so on indices 2 and 3. Next, his breakdown of the disclosure indicates that, on index 1, market risk and business risk are the most important components of identified risk for large (FTSE 100) companies and that, on indices 2 and 3, market risk and non-quantifiable risks are the most important components.
Professor Klumpes’ next finding is that financial sector firms provide a significantly higher level of disclosure than manufacturing firms who, in turn, provide slightly greater details than either service or other firms. He then highlighted some work in progress that is seeking to link the level of risk disclosure with various performance metrics with the aim of demonstrating whether there is any evidence that improved risk reporting might be linked to improved financial performance. He noted that disclosure can also be determined in certain cases by whether the firm is politically sensitive and/or visible.
Finally, Professor Klumpes presented a few examples of good practice, including the business continuity plan of WHSmith and the supply chain contingency plans of Unilever. He stressed that examples of good practice are not just limited to large (FTSE 100) firms.
5. Panel Discussion
Colin Wilson then posed a number of questions for discussion to a panel of experts, comprised of David Styles (D. S.), Aaron Punwani (A. P., a consulting actuary with Lane, Clark & Peacock), Andy Banks (A. B., an actuary at Legal & General Investment Management, where he is Head of Corporate Governance) and Richard Anderson (R. A., past chairman of the IRM).
In answer to a question on embedding risk management into corporate culture, R. A. expressed the opinion that, outside the banking and financial industries, understanding of risk appetite is woeful and, in particular, stress and sensitivity testing is zero. He believed that companies are nowhere near embedding risk management into corporate culture.
D. S. responded that the FRC perceived one of the key roles for the board to be that of establishing the culture, behaviour and values of the company, particularly in respect of risk management. This is explicitly stated in the Preface to the Code, and reinforced by the questions for the Board to Consider in Appendix C of the Guidance.
A. B. said that, where companies carry out reviews of board effectiveness, these can give a good indication on how well the risk culture is being embedded.
A. P. believed the key to changing culture is for companies to realise that risk management is not a compliance exercise, but one which can result in real added value. To this end, he hoped that further research by Professor Klumpes and others would demonstrate a clear link between share prices and risk management performance.
R. A. spoke of the artefacts of risk culture and of how conversations on risk take place within companies. He likes to test this by first asking senior executives to whom they speak on risk issues and how the conversations run, and then asking the people to whom the senior executives have spoken.
A. P. said that a big challenge he faces as an actuarial consultant is in persuading companies that non-financial risks can be quantified. He uses the example of low-frequency general insurance risks to demonstrate that this can be done with limited data. This is especially true of correlations between different risks, but it is important to quantify them because risk diversification benefits can be the key to demonstrating long-term viability.
D. S. pointed out that continuity is an important element in embedding risk culture. The FRC is reviewing the issues around board succession planning and will consider the need to consult on these issues for the next update to the Code in 2016.
R. A. said that, in general, companies still need to realise that there is much more to risk management than colouring in risk maps, and that what they are doing to quantify risks is woefully inadequate. He believed that reporting on long-term viability represents an enormous challenge for many, and that many boards are still a long way away from linking risk management to strategy.
D. S. quoted the Chair of the FRC as saying that the best boards discuss long-term strategy, and these boards should be used to set an example. A. B. responded that shareholders should ask chairmen how their boards do discuss risk and long-term strategy.
6. Question and Answer Session
Colin Wilson invited questions from the audience.
Martin White asked how proper risk culture could be established while employees are paid for short-term performance, and in the form of share options. R. A. agreed that this is an issue, particularly in the banking industry, which has a warped sense of remuneration.
Fiona Morrison asked how she should respond to the FD of a non-financial company, who asks what an actuary can do to help him with the revised Code. A. P. answered that she should explain how the bar has been raised in terms of risk quantification and how the best quantification work has been done by actuaries in the financial services industry. Moreover, how actuaries can bring a disruptive intelligence that punctures apathy in risk management.
Chris Lewin asked if the FRC expect companies to disclose whether quantitative methods have been used in their risk management. D. S. said that, if relevant, companies should state that quantitative methods have been used or, if not, explain why no quantitative methods have been used.
