The Chairman (Mr P. O. J. Kelliher, F.I.A.): Tonight’s discussion is on Investigating Risk Reporting Practices in the Global Insurance Industry by the Risk Reporting Working Party.
Tonight’s speaker, Professor Paul Klumpes is Professor of Finance and Risk Accounting at the Nottingham Business School. Prior to that he was at the EDHEC business school in Lille in France, where he was Professor of Accounting. He is an accountant by trade and we made him an Honorary Fellow of the Institute, back in 2008. He is also a Member of the Risk Management Thought Leadership Sub-Committee and heads up the Risk Reporting Working Party.
Prof Klumpes, H.F.I.A.: Introduced the paper. The full text of his introduction is given at the London discussion on 23 September 2013.
The Chairman: I should now like to invite John Gill to open the discussion on the paper.
Mr J. E. Gill, F.F.A.: In the aftermath of the financial crisis, the issue of risk disclosure remains of paramount relevance to investors, customers, regulators and governments. I therefore welcome the aims of the authors of this paper to move the issues forward and enhance the role of the actuarial profession in “lifting the veil”.
I will concentrate my remarks in three areas: How users of external reporting can be best served; some reflections on my experience of what forms of internal reporting have been most effective in driving strategic decision making; and finally the role of the profession in driving the public policy implications.
The paper clearly highlights, in sections 1 and 2, the range of challenges that face users of externally reported disclosures in drawing conclusions. I note in section 2.1 the comments on the potentially misleading impact of risk-weighted asset ratios within Northern Rock and UBS. Of course, the use of risk weightings applied to assets was the attempt under Basel 1 to apply a proxy measure to the relative riskiness of these assets. In hindsight using a single ratio for all mortgages was of course overly simplistic – particularly where there was strong evidence that the combination of secured and unsecured elements meant that many of Northern Rock’s mortgages had fundamentally different characteristics from “standard mortgages”. Notwithstanding asset quality issues, in my view the key disclosures that would have shed light on Northern Rock’s potential vulnerability would have been around its key business model issue, i.e. its skewed dependency on wholesale funding markets combined with rapid new business growth. Interestingly, this combination was not a secret and was clear from an analysis of their accounts. It is for this reason that the FSA and its successors now place such weight on Business Model Analysis.
In the insurance realm, I would cite another clear example of where business model analysis of publicly available information would have helped users. At a Faculty Sessional meeting in 1990 the management of Equitable Life expounded the key elements of their business model in the “With Profits Without Mystery” paper. Many speakers that evening identified serious concerns with the concept of running market risk combined with a deliberately restricted estate. Evidence of Equitable Life’s subsequent new business expansion was also publicly available via analysis of DTI/FSA annual returns. Even simplistic Business Model Analysis would have clearly identified that these factors together made Equitable highly vulnerable to other risk events in the course of its normal business, for example, unfavourable legal interpretations.
My point from these two examples of failed firms is that the risk reporting that would have been of most benefit to users is an appropriate business model analysis of the impacts of a combination of key factors. Whilst my point may be obvious, I am not convinced that current guidance for firms, despite its ever-increasing volume on risk disclosure, ensures this happens. So, if we do need more guidance, then perhaps this should be for users rather than disclosers; a point to which I will return later.
Sections 3 and 4 look at techniques for analysing reporting quality, specifically using statistical analysis by risk classification and quantity (but not necessarily quality) of disclosures. As highlighted in section 3.4, the difficulties of this approach are in revealing the inter-relationships of strategic risk, ERM practice, capital management and risk reporting. Taking these together requires appropriate business model analysis, and whilst the authors’ analysis is interesting, without that business model context it can only be of limited utility to users.
I turn now to the internal reporting processes highlighted in section 5 and the conclusions drawn in section 5.4.
The paper cites “only equivocal evidence” of internal risk reporting being useful and relevant to strategic decision makers. My observations are based on my experience of only one financial services group where I act as business unit CRO and Board member for the insurance company and subsidiaries. Executive and non-executive directors at both PLC and subsidiary-regulated entities take their risk responsibilities very seriously and I have observed strong engagement. For example, Solvency 2 preparations over the last few years have included numerous Board training sessions that have been enthusiastically received.
Economic capital requirements, resilience to market stresses and dividend paying capacity are illustrated by detailed reporting and subject to holistic discussion by Boards. Operational risk indicators: risk events, losses, breaches, etc. and how these testify to the strength of the risk culture are monitored and challenged strongly. So I have no doubts that internal risk reporting is useful and relevant in terms of understanding and managing business risks. Further enhancements can be achieved to ensure that risk reporting is genuinely driving strategic business planning. In my organisation business plans are stressed to ensure they lie within agreed risk appetites – although this is effectively an iterative process that I think the risk function can still do more to influence. I do not believe it is the role of the risk function to define what the business must do (subject to certain extreme circumstances), but its reporting and advice will frequently limit the choices of strategic decision makers significantly.
One final element of internal reporting as a recent development I would praise is the ORSA. My preferred induction process for any new executive or non-executive is to ask them to read the ORSA before anything else; it is undoubtedly the quickest way to get them up to speed.
Section 5.4 also questions how influential the actuarial function is in internal reporting in insurance companies. I can only share some observations from my experience. Within the firm, where I operate, the actuarial function holder sits in the first line and has control over both production and reporting processes on key financial risks. Within second line risk I have a financial risk director and with profits actuary to challenge and provide additional advice to Boards. These first- and second-line functions operate collaboratively but with frequent, strong internal challenge. This structure has facilitated actuaries having strong control over both the form and substance of the risk reporting with appropriate access to, and engagement with, risk committees and boards.
The final conclusion in section 5.4 is that risk reporting remains only one part of the overall MI. The existence of risk committees at Board and executive levels means that risk reporting is subject to more formality and regularity that any other forms of MI today. For example, I am not aware of any Boards that have a specific “Sales” MI committee! However, is this volume of risk reporting working? In my observation, Boards have never been better informed and have never been more strongly engaged in risk issues. This is not a guarantee that their decisions will be better, but they are positive ingredients.
Lastly, I turn to the conclusions set out in section 6.
I agree with the insight highlighted on page 30 on the importance of ensuring a holistic approach to meet the needs of all stakeholders.
My personal experience is at odds with the conclusion on page 31 about limited influence of the actuarial function in the design and review of internal risk reporting.
On the public policy challenges set out on page 32, I would advocate a different approach. It is now no longer the position of the actuarial profession to provide guidance on the form or content of reporting. For example, part of that guidance setting is now in the hands of the FRC, and I would refer to the publication in the last 2 weeks by the FRC on consultation on draft guidance to the directors of companies applying the UK corporate governance code in respect of risk management, internal control and the going concern basis of accounting.
Instead, however, I would propose that the profession could better serve the public interest by provision of “how to use and interpret” guides for users of risk disclosures. I suggest that this is where the profession’s research resources could be better used to give a practical outcome. It is somewhat ironic that the sessional meeting in 1990 I referred to earlier was, in practice, an example of where the speakers in various forms provided a real example of how to interpret one “destined to fail” firm’s disclosures. It is, of course, a matter of regret to all that the free business model analysis provided on that evening by speakers was never really shared outside with the profession.
In conclusion, I thank the authors and commend them in their desire to move the issue of quality of risk reporting forward. The paper clearly illustrates the challenges that users of risk reporting face in making informed decisions. It is right that the profession should attempt to lead in this field and this paper is a valuable contribution to stimulating the debate on how this can be achieved.
The Chairman: I should now like to open the discussion to the floor.
Mr A. J. Clarkson, F.F.A.: I should like to thank the authors for their paper. I will focus my comments on three areas:
1. Internal risk reporting;
2. The link between internal and external risk reporting and the effectiveness of external risk reporting; and
3. The specific recommendations in the paper.
I will start with internal reporting. In my view, risk reporting is effective if:
∙ It feels real for decision makers and focuses on what they can influence;
∙ It supports real-time decision making;
∙ It is readily accessible and highlights clearly the key issues;
∙ It is forward looking; and
∙ It identifies key emerging issues whilst there is time to respond, before key financials are threatened.
It is important that companies do not get embroiled in more and more detailed modelling; and as actuaries we have a tendency at times to take that approach. From a risk-management perspective the key is being able to make real-time decisions. The modelling needs to be good enough to support decision making; no better and no worse. That is where the real challenge lies, and an area where actuaries ought to be able to add value.
I also think it is important that companies think carefully about the volume of data included in risk reporting packs. If large volumes of data are presented and the risk committee members do not have time to review all that data, then the company is potentially getting a false sense of security around the level of review provided. Equally, members of the risk committee are potentially exposed if a subsequent issue arises that could have been spotted from the information provided. I think a risk professional is paid to form judgements on the key information to present to the risk committee. Clarity of responsibilities between the risk professional and the risk committee is key in this respect.
I agree with the paper that emerging risks and strategic risks are very important. These are not best dealt with by capital and measurement in all cases. Companies need to understand these risks, identify key early warning indicators and understand potential responses. Reverse stress testing and recovery plans can assist with this. My experience is that regulatory oversight considers these and recognises the limitations of financial analysis.
A final comment on internal reporting. Section 5.3 suggests that risk reporting is not viewed very positively by companies. If, as suggested, the response is from CROs, I am surprised, as I would have thought a key role of a CRO would be to address this if they held that view.
Turning to external reporting, section 2 notes that most recent developments are around footnotes. I think it is debatable whether these additional footnote disclosures have really improved understanding of external stakeholders. I suspect companies at times have focused on keeping in line with others, without giving too much away. Should they take a step back and ask if they were an external stakeholder, what are the key things they would need to know to fully understand the risks? In doing this, a key challenge to overcome will be concerns around confidentiality. To that extent I think that more guidance would be helpful.
However, the difficulties in producing standards should not be under estimated. For example, whilst economic capital may be a popular metric for internal risk management, many companies do not yet disclose this and those that do potentially use different calculation approaches. Would any comparison of such disclosures be misleading as a result? Also, the impact of changes in market conditions varies depending on the starting conditions and whether or not a stress event happens on its own or at the same time as other risks. And the extent of these differences will vary by company. Different stresses will make some companies appear less risky than others, and vice versa. Reaching agreement on appropriate stresses to consider would not be easy.
Section 2 of the paper notes that the general vagueness in insurers’ risk reporting is in stark contrast to banks. But do external commentators really understand bank risk exposures any better than those of insurers? The paper discusses this general theme. It is important that any guidance does not overly concentrate on quantitative aspects. Qualitative aspects are also important, such as understanding how management might react in different circumstances. In terms of potential external disclosures of such responses, there would again be difficulties around confidentiality.
When considering a company’s attitude to risk from an external perspective, ultimately culture is key. And a culture of risk taking may go alongside a culture of a lack of transparency and a desire to paint an overly attractive picture. Basically, does a company take risk seriously? This is difficult to address through guidance on external disclosures.
Finally, turning to some of the proposals in section 6.
I have similar views to the opener in terms of it no longer being the profession’s place to provide guidance. We could set out best practice, which might be useful. I have some sympathy with the opener’s suggestion that the profession could usefully produce “how to use and interpret” guides for users of risk disclosures. We also need to recognise that need to work alongside other disciplines when developing risk reporting. In doing this we should recognise as actuaries we are not the only people who can add something valuable in this area. Some of the elements such as emerging and strategic risk are not always where our profession’s strength lies.
In terms of the recommendation about the actuarial profession doing more sophisticated research, I would focus this on ability to produce real-time risk reports and what constitutes “good enough”.
Mr P. Turnbull, F.I.A.: This is an interesting paper. I am sure that papers like this will raise the profile of risk reporting. I am a practitioner within life assurance. I have a love/hate relationship with risk reporting. Sometimes it is useful, but at other times it is confusing and unhelpful.
Just going through the paper a little bit, I noticed the comments on bank risk and risk-weighted assets. I was not entirely sure why re-rating risk weights was the solution to the problem, because you could simply require more core Tier 1 to be held if you had doubts about the risk rating, although if the comment was very much focused on the quality of risk weighting, distinguishing between bad and good assets, maybe that needed improving and I would fully agree with that.
I also noted the comment that was made by Mr Clarkson on the use of wholesale markets by Northern Rock. I am not sure why that was necessarily a bad idea. The alternative is to fund banks by using deposits that are essentially guaranteed by the Government. So that provides a lot of funding that is Government-backed. I think that there are pros and cons to each, although I think that a number of people would argue that deposits are better. I confess that I am not fully in agreement with that.
I think all risk reporting involves simplification. Having reviewed numerous risk appetite statements I particularly note that they inevitably reduce the reporting of substantial wide-ranging risks to quite simplified measures. In view of the vast range of risk appetites involved, I agree that this simplification is necessary. But it does mean that any reporting is necessarily simplifying, particularly external reporting, and I think that there is absolutely no substitute for making sure that there is a group of people within a company that fully understands the nature of the risks and what is going on within the company. The quality of that understanding within the company is something that is not measured.
I would ask the authors of the paper; do they think that any of the improvements in risk reporting that have been evident over recent times would have prevented the collapses of Enron, Northern Rock and Lehman Brothers, and the credit crunch generally?
Prof Klumpes: I think that that is debatable because, in a way, if the markets were really efficient they would have seen Northern Rock for what it was. However, it is the case that a lot of the hedge funds and other kinds of players in the market, had they been given more neutral, substantive information about the background to Northern Rock, that may have actually helped mitigate the crisis that occurred.
It is ironic that the very day that there was a run on Northern Rock I was presenting a paper at the ICAEW, talking about the concept of risk capital. A member of the audience, who was a prominent member of the IASB at that time, asked “What is risk capital? We do not know what that is”. Part of talking about risk reporting is actually having a slightly more mature conversation that goes beyond a monetary number and actually says, “This is the number we really need to allocate capital in the worst scenario”, as opposed to “this is the capital that was available or was consumed”, which is the number that the auditors want.
Understanding the dynamics of the kind of markets that Northern Rock was getting into, and actually having that a little more discussed and informed, would have helped.
The Chairman: I would also like to add just another remark there in terms of this. One of the problems that we have with the financial crisis is that not only were risks not disclosed to stakeholders, but in a lot of cases the actual institutions themselves did not understand the risks they faced.
The first thing that we need to have is an understanding of the risks faced. If you do not have that then obviously no amount of risk reporting is going to help.
Mr Gill: May I add a couple of things about that? As I said in my remarks, I think that the key risks in Northern Rock were indeed publicly disclosed. They might not have been in a document that said “These are the key risks”, but the data was certainly there. Professor Klumpes commented from the floor that wholesale funding is not a bad thing in itself. As someone who was a finance director or chief executive of a bank that relied on wholesale funding, I fully agree.
The issue with Northern Rock was that it was skewed, its dependency on wholesale funding was skewed, relative to all its peers in a substantial fashion. That risk was very clear. I do not believe that Northern Rock ever put out a document in their report and accounts that drew attention to that, but professional investors should certainly have been aware of it.
Prof Klumpes: I think that that is a very interesting comment. Let us clarify, when we are looking at risk reporting, that there are three elements of risk reporting. One could be, as a bank, you are worried about the assets of risk. Obviously, banks are more concerned; risk weighting of the assets is important. I guess that the cynical observation for insurers is that surely it is the liabilities that are more important.
The second comment is that investors who trade on the margin are worried about earnings at risk. They are more concerned about what is left to them if something goes wrong. So they want then to translate disclosure into what is the bottom line impact on the dividend or whatever. Finally, the regulator is not worried about either of those but is perhaps more worried about cash flow at risk, actually saying at the end of the day the reason Northern Rock created a crisis was not because it did not manage its assets properly or its earnings properly, but there was not enough cash to pay the depositors at the till.
We need to be clear about that. I suspect that the reporting of cash flows is actually an area quite deficient in banking simply because the analysts wanted an indirect approach to cash flow, which means you do not know what the operational cash flows are, you just know the difference between cash flow and earnings.
The Chairman: Any other questions?
Mr A. Marshall, F.F.A.: I was wondering whether there is a danger here, like all financial information, that we concentrate on large shareholders and rating agencies and develop information that is too complex in nature for smaller shareholders or policyholders to understand. That is something we need to look out for.
It is not easy to produce information that is understandable to Joe Public. We should bear that in mind as we continue to develop in this area.
Prof. Klumpes: I will say ethically that I completely agree with that. I have been talking to the UK Shareholders’ Association. There is a major issue concerning information overload. That is, there is a lack of comprehension by the retail investor who does not necessarily understand and have access to the Reuters screens and all the databases that the consultants and the big guys have. One of the reasons why we might have low book to market ratios for financials is simply retail investors do not understand it. All they get is a lot of confusing information.
I completely agree with you that there needs to be more effort to communicate and educate the retail investor, and even investors who reside offshore. A lot of active firms in the London market are owned by the Japanese, or whoever. I know that these firms are having a lot of trouble trying to understand what the deep risks are. It is important to be prepared to have that conversation.
Mr H. Taylor, F.F.A.: This is a very interesting paper. The concept of reporting and public availability of information about the nature of risk that retail customers invest in is something that is growing.
Just to broaden the discussion slightly, I mention a final point: The DWP have recently produced a paper on an alternative type of pension arrangement that they are looking to develop in the UK-Defined Ambition. There is a number of different varieties of it.
What will be interesting to see will be how the FCA tackle the potential issue of reporting on the nature of the risks that individual pension investors in any such new arrangement will bear. The nature of the risks will be quite different from the risks associated with defined benefit pensions, and certainly will be quite different from the nature of the risks associated with money purchase arrangements, or DC, as it is currently known.
This whole area of risk reporting across the entire actuarial profession is certainly an area where actuaries should be getting much more heavily involved, and the objective is ensuring that the nature of a competitive market does not create risks that are either unmanaged or unrecognised; and, second, retail investors have a choice as to which bits of the market they put their savings into and can get understandable information about the nature of the risk associated with that.
The Chairman: I suppose that is going more from risk reporting in terms of the report and accounts and FSA returns into the general area of disclosure of risks to the public, not in terms of the business itself but in terms of the products it sells.
Prof Klumpes: I will mention that, as an accountant, one of the problems is that accountants always want to put a fair value on things. If you translate that into ideological language, then aggressive Scandinavian-based pension fund management systems will adopt their value and then discover that there is a crisis and they are under water. If they were a bit more relaxed and took an owner’s risk, fundamental long-term perspective, then in fact the pension funds were not under water at all, it is just that there was a bad market and they did not need to dissolve their entire equity portfolio because fair value said it is a bad risk. I think owner’s risk means, again, moving away a little bit from the mantra of valuation and actually taking a slightly more long-term perspective.
The Chairman: I now invite Colin Ledlie to make a few closing remarks.
Mr M. C. Ledlie, F.F.A: I should like to thank the authors for their paper, which has been a really useful contribution to a really interesting and important topic. I am going to give a few observations of my own and then I will try to pull together some of the themes that we have had in the discussion.
First of all, on internal risk reporting. As someone who has been a CRO quite recently, this was something that I always found to be quite a challenge. How do you make the reporting meaningful and have real substance to it, to ensure it is going to pass muster when it is subject to external scrutiny by regulators, which will surely happen, but also make it engaging and understandable by Boards and risk committees who will have a broad range of different capabilities and understanding of the information provided?
It is not easy getting the right size, the right presentation of that material, the right complexity, the right detail, so that every Board member can get, and is engaged with, the material which is so important.
Mr Gill, in his opening comments, highlighted his experience of those risk committees being highly engaged and interested in it. He is certainly right that there has never been more focus than there is today on risk information presented to Boards, the volume of material that is presented and indeed the expectations from the lists that were presented by Professor Klumpes earlier on one of his slides from various reviews, post the financial crisis. There is a lot of guidance out there to try to help firms with this. It still remains difficult, and there is relatively little guidance and support provided to risk teams producing information. Risk teams are very much on their own, to some degree, in pulling together what works best for their Boards and their committees.
Mr Clarkson, in his contribution, provided a really useful list of features of effective internal risk reporting which I thoroughly agree with. He focused on the real-time decision-making and the actual usefulness of the information. And I guess he is presenting to us the idea that in judging the volume of material, the critical factor is how useful that information is and will it be something that drives decisions?
A couple of comments were made on the overall importance of having people that fully understand the risks within the business, and companies that understand the risks themselves. The reporting is not going to be of any use or of any quality if the firms themselves do not understand the information. That is a key area where actuaries have a really critical role in firms because they really do have that deep knowledge of the insurance and other risks within financial firms.
Turning then to external reporting. Again, this is not easy either for firms to get the right information presented. There is a real danger with the amount of accounting regulation, the amount of reviews that have been done into risk reporting externally, and the regulatory expectations that the information that is presented in a report and accounts is actually very long, very complex but of little use.
I thought that the tables presented by the authors were quite useful but they did not bring the subject to life for me.
I thought it would be interesting to go and look at the specific disclosures of a couple of the firms and go through that rather tedious job of actually reading the risk disclosures. I picked one of the firms that was rated most poorly, a Japanese firm.
My observations on that were that the disclosures were nicely written. They provided a nice narrative of their internal processes and you got the sense that this is a firm that probably has a pretty good internal process as far as risk management is concerned. But as far as I could find there was zero quantitative reporting within the annual report and accounts.
I then looked at one of the most highly rated companies, a large European insurer. This was heavy going. The overall report and accounts were some 400 pages of which probably about 10–15% was on risk reporting. It was full of quite defensive legalistic statements. It didn’t feel as if the CRO was writing it but probably the legal team, for example, a statement of the obvious like “A downgrade in our credit rating could adversely impact our business, results of operations and financial condition”. There were examples of 58-word sentences within the very lengthy risk disclosures. It read like a typical prospectus for sale of a company.
There was a little bit of quantitative information in this more advanced example, but not a lot. These were really just a few sensitivities. I have to contrast the information that I know is available within firms, the detailed internal models that we produce, a detailed quantitative understanding and an ability to rank all our risks that we are exposed to and in-depth assessments of reverse stress testing and scenarios, and how little of that seems actually to flow through in the external reporting.
I think that is what I heard from the debate today as well. There is a lot of information out there but there is a question at the moment about how useful that is.
One question asked was would the risk reporting that we see today have helped in avoiding the major failures in recent years? I think that I can summarise the answer as being “No” to that question. Should it? Perhaps it should be helping us more to avoid these situations. After all, that is what we want our risk teams to help firms do, and perhaps the reporting to provide a better guide to where those issues will exist.
I think that there is an enormous way to go in external risk reporting. Internal, yes, I think, as echoed by some speakers, is pretty good. But externally I think it is very weak and really does not provide the reader of the report and accounts and other disclosures with enough information to get a really good understanding of the business and the risks associated with those businesses.
There was a helpful contribution trying to expand the debate into risks for retail investors. This is another interesting area where probably more could be done and where the profession could have a role in helping develop risk reporting to a different audience.
In conclusion, this is undoubtedly an area where further work could be done by the profession. There was a consensus view I think that it is not the role of the profession to issue formal guidance. Indeed, my personal view is that this would not be helpful. There is quite a lot of accounting guidance out there already, and the more rules and guides that we have on risk reporting, the more formulaic and tick box the reporting could become. People perhaps need general high-level principles about what the risk reporting should be achieving, and then leave professionals in firms to embrace that end objective and deliver something which provides meaningful and useful information to the end user.
If there is not a role for formal guidance, I think that there is certainly a role for help. I would have loved to have had more help in my role as a CRO previously in terms of finding ways of communicating information effectively to a wide-ranging audience. Anybody that has good experience, has done things that worked really well for them, then that is to be welcomed and it would be great if people could share that. The more that we can share that information as a profession, the better we will all become in this difficult area. However, we should be very cautious about being prescriptive in this area.
It is certainly something that I think more work could be done by the profession to drive this area forward. The more we have to guide best practice, the better. Mr Gill’s suggestion about information for users of risk reporting and how to interpret what is produced by firms and what to look for would also be a fruitful area of further investigation.
The Chairman: It remains for me to express my own thanks on behalf of everyone attending, to Paul Klumpes, the author, to John Gill, the opener and Colin Ledlie, the closing speaker.
