Address by Matthew Elderfield, Head of Financial Regulation, to the Galway Chamber, GMIT

Assessing Risk – A New Model for Ireland

It is a great pleasure to be here in Galway and an honour to have been invited to deliver the Paddy Ryan memorial lecture. From what little I have learned about him, it is clear that Paddy Ryan gave exceptional public service over many years to his native Galway. As a member of the Galway Chamber of Commerce and later Galway Corporation, he worked tirelessly to bring industry to this area. As a member of the Galway Harbour Board, a city alderman, Mayor of Galway and a member of Galway/Salthill Fáilte, he was a leader in developing the tourism potential of his city. While welcoming JFK to Galway as City Mayor in 1962 must have been a very special moment for Paddy, his achievements over many years of dedicated public service are an example to us all. In these difficult times it is especially important that people are prepared to contribute their time and expertise to public service and that those who are employed in the public sector apply their skills and expertise diligently and efficiently.

At this time of financial crisis, the Central Bank of Ireland and its regulatory staff, of which I am one, have an essential role to play in the public sector and we need to try to live up to Paddy Ryan’s example. But what is it that we actually do? Most people can see that we are working to sort out the banks, and, yes, this is certainly our top priority right now. But as a regulator at the heart of what we do is managing risk. We regulate 14,100 financial services firms all of which pose potential risks – to differing degrees - to the economy or to consumers. Our job is to regulate these firms, to manage these risks. Risk is everywhere. Galway’s original founders were fishermen who must have needed to consider risk carefully, placed as they were between the deep blue waters of Lough Corrib and the rather wilder Atlantic. The wrong decision in navigation or judging the weather could clearly have fateful consequences. In the same way, in modern Ireland, the Central Bank has to think very carefully about where to look in the firms we regulate and how to use our limited resources to best effect for Irish citizens and the Irish economy.

So, I want to take some time this evening to talk about the process of risk management by financial regulators and to explain some changes we are making to the processes we apply to managing risk across the full range of financial institutions in Ireland, not just the banks. In addition to addressing the banks, I see my other top priority is to learn the lessons of the financial crisis and to reform the approach to regulation so we avoid such severe crises in the future. Having a better approach to managing risk across the population of regulated firms in Ireland is crucial. So, we will implement a new formal risk assessment framework at the end of this year – which we call PRISM from Probability Risk and Impact SysteM. As the name implies this is designed to allow a more structured approach to assessing financial firms based on the impact they have on the economy or consumers if things go wrong and the probability that problems arise.

Probability and impact are important distinct concepts which combine to yield risk. We need to manage for high probability and low impact events in our everyday life – living in Ireland now rather than Bermuda I know that there is a good chance it’s going to rain every now and then, so I try to carry an umbrella but, if I get soaked, it’s not the end of the world – rather a low impact if damp event. But in Bermuda there is a risk of low probability and very high impact events – hurricanes. The chances of getting hit by a hurricane in Bermuda are much less than being rained on in Ireland, but the consequences are very serious so you make sure you are very well prepared. You make sure you are fully insured, buildings must meet certain strength standards and I had a hurricane emergency kit in my house, including water, tins of baked beans, a radio and some emergency supplies of Blackseal rum of course.

As a regulator you worry a lot about your high impact events, even if they are low probability, because the consequences are so severe for the economy and the consumer. Ireland is living through the economic equivalent of multiple hurricanes right now – the international financial crisis, a domestic banking crisis and a European sovereign debt crisis – with tough consequences for the citizens of Galway and elsewhere in the Republic.

Deciding Our Focus

One of the clear organisational lessons from the crisis then was that we, along with many global regulators, spent too little time rigorously challenging the really high impact firms – those firms whose failure, even if low probability, can seriously damage the economy of a country. There were many causes to the banking crisis in Ireland and there have been three good reports that explain these in some detail, by Patrick Honohan, Klaus Regling and Max Watson and, most recently, by Peter Nyberg. There are a number of themes in these reports and I won’t try to recount them all here. They certainly all highlight the problem of a lack of challenge, both within the Central Bank and Financial Regulator and also within the banks, and I want to come back to that in my conclusion. But I think they all point to the need for a more structured and systematic approach to assessing risk. That means having a better way of applying resources to risk, based on impact; a higher level of engagement and scrutiny with those highest impact firms, taking much less on trust; a more systematic way of assessing the probability of a problem occurring; and, above all, a system which obliges supervisors to follow up on risks in a conclusive manner where they have been identified.

To be a risk based supervisor we need to have a risk appetite. I want to spend a little time talking about this concept. Each time we decide whether to overtake a slow vehicle in front of us on the road we exhibit our own risk appetite. Our risk appetite may differ depending upon the circumstances: how far ahead can we see; is it raining or not; have we got children in the car; whether we urgently need to get to our destination, and so forth. If we never overtook anyone, we would be exhibiting a very low risk appetite. Doing so would undoubtedly be very safe but it might mean that we didn’t get very far on days when we got stuck behind a bicycle or a caravan. Perhaps most importantly, others might suffer because we had a low risk appetite for overtaking. Imagine a world in which the Garda and the ambulance service were never prepared to overtake to get to anywhere quickly and how many people would suffer as a result.

In a less dramatic fashion, the Central Bank has to set its own risk appetite. We could manage Ireland’s risk by forcing the banks to be so risk averse that they would stop lending money to anyone and simply keep gold in their vaults. We could force the insurers to be so risk averse that young and old people could get no insurance because 40 years old drivers with ten years no claims were the only people it was safe to insure.

Clearly doing any of the above would be a nonsense but, in deciding not to do all of the above, we have set ourselves a risk appetite - a level of risk within the financial system which we are prepared to live with. This means that firms will fail from time to time and consumers will sometimes be mistreated. This may not be that pleasant but it is reality.

So, our starting point for risk appetite has to be that we accept some failures in financial services will occur from time to time. The key is: failure and problems may be inevitable but we must decide how to deploy our resources to prevent problems occurring where they will hurt the most. Significant problems and failures with the banks have been unacceptable and imposed huge costs on society. Not just the direct costs of public support but also in terms of the impact on employment, consumers, the economy and the reputation of Ireland. Clearly our goal is to minimise the risk of failure and to minimise disruption involving the big systematically important banks.

But it is also clear that we cannot maintain the same level of scrutiny or seek the same level of low risk of failure for all of the 14,100 firms we supervise. There simply aren’t enough supervisors to go around to do that. This is another aspect of the Central Bank risk appetite – where do we deploy our staff. Take a look at the maths - 700 staff applied evenly over 14,100 firms would mean about one supervisor for every 20 banks and, equally, one supervisor for every 20 insurance brokers. Of course this would not work and doesn’t make sense: that would be way too many banks for one person to handle and would be excessive for looking after brokers. So we need to find an approach based on our risk appetite to allocate resources based on the impact of a firm on the economy or on consumers.

Impact Metrics

What I wish to outline now is how we are going to implement our risk appetite, how we are going to continue to make difficult choices, unpopular choices even, to ensure that our frontline staff can focus on the firms that really matter to Ireland.

Following consultation with industry, we are now starting to rank all regulated firms using quantitative metrics, to determine their relative impact. This is a difficult exercise that involves judgement as much as science. At the end of this process, all of our firms will be categorised as high impact, medium high impact, medium low impact or low impact. There will be very few high impact firms but they will be the firms that really matter for the future of the Irish economy. I’m not saying for a moment that large firms are necessarily the engines of growth going forward but I am asserting that they are the firms which will really damage Ireland if they get into trouble – as a Regulator you should always have a tendency to look on the dark side.

There will be many thousands of low impact firms. Collectively these firms are important but, individually, whilst their failure may be very unfortunate for the individuals closely associated with them, they will not break or make the Irish economy. And if they fail, there are rules in place to minimise the impact on the consumer. More on that later.

What our High Impact firm supervisors will do

To match our four impact categories, we will have four engagement models. The highest impact firms will have dedicated supervision teams following a pro-active programme of supervision - to ensure that the Central Bank always has a good knowledge of their strategy and business model. By this I mean what makes them tick – what pays the bills and makes the profits: it’s crucial to look at the substance of the business model of a firm, another lesson from the crisis. Supervisors will also be resourced to have a deep knowledge of the financials and of the men and women who govern these firms. We will expect firms to co-operate with this level of supervision though we don’t expect them to particularly enjoy it - we will make judgements on their leadership and the judgement shown by that leadership which will, at times, be uncomfortable for them.

In terms of outcomes, we will be seeking to ensure that they always have sufficient capital to cover the risks they are taking as well as having responsible individuals at the helm, able to keep an eye on the uncharted and often stormy waters ahead.

In terms of being risk based, we will not, of course, be just focused on size. Our supervisors will constantly be assessing the risk profile of a high impact firm. As part of the PRISM system, we are introducing a structured approach to assessing the probability of a problem occurring by seeking to identify issues that could cause prudential or consumer failures. When risks exceed our risk appetite - where the probability is too high - we will require action to be taken to mitigate the risks and deploy extra resources until the probability of that firm causing a danger to the Irish economy and Irish citizens recedes.

What is, however, fixed is that high impact firms will always have a high level of supervisory engagement – an irreducible minimum that will not fall, no matter how plausible the business plan, how good the apparent treatment of consumers or how large the corporate profits.

I’ve already touched on business model, financials and governance as being important things for us to look at and they will be key pillars of our risk assessment system. In terms of deciding what else we should routinely look at in our probability assessment, we have reviewed international best practice. Based on this international review and our own experience we will assess credit risk, market risk, operational risk, insurance risk, liquidity risk, capital risk, environmental risk and conduct risk at our firms going forward, in addition to the business model and governance risks I’ve already touched on.

Our new risk system will allow us to create a scorecard for each significant firm which can be discussed with the firm so that its leadership understands what we are concerned about and can work to put things right. We plan to communicate the results of this assessment directly at board level to ensure full engagement with the risks that have been identified.

This new risk system will enable us to track and group together timely information on our firms’ profiles against all of these risks. Any alarming spike in a particular risk type, a particular sector or a particular firm will prompt early and intense supervision with a view to mitigating the issue before it acquires crisis proportions. Of course we cannot assume we will always get it right, but by looking at the right risks in the right way with the right resources, we want to be knowledgeable and pro-active in our supervision of our large high impact firms – making early and proportional judgements.

Making judgements and taking action on them is important. Many good economists or regulators will analyse statistics, talk to key individuals and work out that there is a problem. All our staff must go beyond this analysis phase and not merely work out that they have a problem but work out how to solve it. We are already starting to set some firm’s risk mitigation programmes requiring them to deal with issues – these are specific actions required to reduce risks that have been identified. Our new risk system will help us track progress on mitigation in one place and we will continue to work to make sure that all our risk mitigation actions are outcome focused and result in problems being sorted out rather than simply analysed further. This to me is a very big point from the crisis and the various reports that I mentioned: if you identify a risk you must make sure that your mitigation is strong and conclusive enough.

Generally analysis is easier than problem solving. We will be intolerant of firms which don’t solve their problems but simply send us further analysis as to why something may not be a problem if only we shared their view of the world. So, we need to challenge firms’ management. They need to explain to us how they will mitigate for the risks they run. A systemically important bank should expect a much more intrusive approach than a fund or wholesale insurance company with a lower risk profile. I ask my staff to be “assertive” in this process. Risk-based supervision is not just about identifying risk and pointing it out to a firm’s senior management to sort as they think best. Our risk-based approach must insist that risks are not only identified but are also managed effectively.

High impact firms and those with a poor track record should not expect to receive the benefit of the doubt when the best approach to addressing a risk is a point of contention between us. We will have an open and engaged dialogue with a firm’s senior management. But, as I’ve said before, if we remain unconvinced by management’s plans we must be prepared to substitute our prudential judgement for their commercial one and say – “Just do it!”

The Middle Tier

We will follow a similar process, albeit with a lower level of resourcing, for our important medium high impact firms. Every medium high impact firm will be relationship managed by a named supervisor who will meet key management and review financial returns for that firm. We will conduct full risk assessments of all medium high impact firms on a rolling cycle. In contrast, for medium low impact firms we will conduct such assessments in a more focused manner and on a sampled basis. We hope this will incentivise them to conduct themselves in a prudent manner, treating their customers well. We will use our enforcement tools to deal robustly with those who fail to meet our standards, irrespective of their size.

Low Impact Firms

Who are the low impact firms and why is it ok to have a higher risk appetite for them? Retail intermediaries, such as mortgage and insurance brokers, would be an example. We regulate some 4,700 such firms. They don’t hold client money and their failure won’t cause economic problems or require taxpayer support. They can of course hurt consumers through, for example, mis-selling. But it would be impractical to apply supervisory resources on a basis of one supervisor to 20 firms or even one supervisor to 200 firms. We need to find a different approach – how?

For the many thousands of low impact firms, we increasingly need to use technology to help us to supervise them in an efficient way. We are investing in technology under the leadership of our new COO, Gerry Quinn, and we are rolling out a programme to automate our receipt and analysis of financial returns. Our objective is to have the capacity to get automatic alerts to dedicated triage teams when a low impact firm fails key financial health checks.

In addition to the above, our substantial Consumer Directorate will continue to engage proactively with bodies such as the Financial Services Ombudsman, the National Consumers Agency and the Money Advice and Budgeting Service and to undertake targeted thematic visits across firms in all four impact categories. This will help us to identify emerging risks for consumers and to focus our consumer resources on key issues. In our experience, consumers can be materially disadvantaged through interactions with both large and small firms – size is no guarantee of quality. When the Consumer Directorate finds evidence of misconduct it will work with our Enforcement Directorate to seek to deliver redress to the disadvantaged and to deliver clear messages to industry as to what is and is not acceptable conduct. We will seek to ensure that the financial penalties and other enforcement tools available to us are applied on non-compliant smaller firms in a manner that reflects not only the seriousness of the issue at hand but also acts as a meaningful deterrent to others.

I see a need to improve some basic compliance with a substantial portion of our smaller low impact firms. For example, about half of the retail intermediaries who are supposed to file returns with us do not do so. That is unacceptable and has to change. So, we are making it easier through providing an electronic filing facility. But we will also start to use our powers to fine or revoke authorisations of firms who refuse to pay their levy or who fail to file timely regulatory returns. These are the most basic things we expect a regulated firm to do to assure us that it is properly run. Those who refuse to pay their bills or file returns should not expect to continue to be allowed to provide financial advice and other financial services to Irish citizens. And it’s not fair to the hundreds of compliant firms in the sector. We will give time for the sector to get more compliant in the next couple of years but generally we will become less tolerant of poor compliance with basic requirements. These firms will not be getting the level of intense scrutiny as high impact firms so they need to meet their minimum regulatory obligations.

We will have to deploy a relatively small number of our regulators to deal with a very high number of small firms. We will have an expert team to cover each type of financial services firm but they will be supervising reactively, not conducting probability scoring assessments and instead dealing with firms usually just when they go wrong. In taking this approach we are making a conscious choice to focus our finite supervisory staff on our most important firms because those are the ones which we and Ireland cannot afford to have fail in a disorderly manner.

In terms of consequences, whilst we will be as efficient as our technology and modern supervisory techniques permit, small firms will fail from time to time. What would that mean in practice? Take a hypothetical Galway broker who fails or is involved in a mis-selling scandal: the client money is protected, the Investor Compensation Fund is in place to protect retail investors and the Financial Services Ombudsman can adjudicate and provide restitution in individual cases. These would alleviate the impact but they will not eliminate it. I guess what I am saying is that even in a reformed and risk-based approach to regulation, failures will happen. They won’t ever be welcome or desirable or pain free, but if we are doing a better job they will be acceptable when they occur with our lower impact firms if that is the hard trade off for keeping the high impact firms from damaging the economy.

Improving Challenge

Getting the process of risk assessment right is important. The Central Bank is a big organisation with a big job to do, and it’s important to have a rigorous process for assessing risks, with clear rules of the road for supervisors and supervised firms alike that are applied efficiently. We aren’t there by any means yet, but we will take a big step in the right direction at the end of this year by introducing PRISM and my goal is to ensure that the new risk assessment system is up and running fully in the next couple of years.

But systems and processes, while important, are only part of the challenge. Supervision is done by individuals, even if they work in institutions and apply agreed processes. So reforming regulation is also about culture and people.

This is another area where the Honohan, Nyberg and other reports made difficult reading. One common theme was a lack of challenge. This is another essential aspect of risk management. Processes can help, by prompting required challenge and setting up peer review or governance systems that are supposed to provide challenge. But effective challenge has an important cultural element, encouraging genuine discussion and debate, awkwardness even. The reports on the banking crisis highlight a lack of effective challenge in the board room of the banks and at senior executive level. In his report Nyberg pointed out that as controls at covered banks gradually weakened to allow increased growth, there was a collegiate and consensual style at board level with very little serious challenge or debate. Further, he concluded that non-executive directors did not appear to have the banking knowledge and expertise necessary to assess the lending and funding risks inherent in their bank business models, and, though formally independent, were in practice highly reliant on the knowledge, openness and ability of bank management. We are addressing that by reforms to corporate governance standards designed to broaden the gene pool of Irish corporate life and with tough new fitness and probity standards and a review of incumbent bank directors.

But it is clear from reading the Honohan and Nyberg reports that challenge was also lacking within the Central Bank and Financial Regulator. Nyberg concluded that the data was available to arouse suspicion about trends in the property and financial markets but was not acted upon and that the Financial Regulator approach was to trust bank leadership to make proper and prudent decisions as long as appropriate structures and processes were in place. One of the main lessons Nyberg advised was to make sure, in both public and private institutions, that arrangements and incentives exist for leadership and staff to openly discuss and challenge strategies and their implementation. “It must become respectable and welcome to express professionally argued contrarian views; neither this crisis nor many others have been or will be foreseen by the consensus view of professional or managers...... authorities as well as bank boards and management need to remain particularly vigilant and professionally suspicious during extended good times...”. This contrarian view may be identifying a low probability outcome – but it should not be dismissed and mitigation should be considered if it is high impact.

At the Central Bank we still need to make a lot of changes to encourage what one of my board members, Mike Soden, describes as “open dissent.” We are still very hierarchical and need to work in a more joined up way, encouraging debate and challenge between areas. We still are better at analysing risk than challenging ourselves to see if we have landed upon an effective and conclusive mitigation strategy. As a Central Bank, then, we still need to change our culture as much as our processes. If we aren’t better at challenging each other about management of risk, we won’t be able to raise our game to challenge the CEOs of the high impact firms we supervise.

What kind of supervisors do we need to do this risk assessment? All of this talk of risk appetite and culture is pretty abstract: what kind of person do we need to carry out this work? Well, a Super-supervisor would have the mathematical ability of George Boole to figure out a complex balance sheet, the interviewing skills of a Vincent Browne or Miriam O’Callaghan to get information from tight-lipped CEOs and the resilience and toughness of Brian O’Driscoll to deal with bruising encounters with recalcitrant firms. Plus twenty years experience at a leading international bank or insurance company would be useful along with a healthy dose of professional scepticism. This supervisory Frankenstein could be quite difficult to find!

This leads me to two brief final points. First, we have to be realistic in our expectations of what supervisors can do. We are working hard to learn the lessons of the past but we will make mistakes from time to time. And, second, to recruit and retain the right people to do the jobs, we need to match the specialist skills at the firms we supervise. This is effectively another aspect of risk appetite: if you don’t recruit and retain the right people to do supervision you are increasing your risk appetite. Our approach at the Central Bank is to recruit a mix of skills – industry experience, risk advisers, talented graduates. And we plan to increase our investment in training to improve our capabilities. We have done pretty well so far in our recruitment but I do worry about our ability to recruit certain specialist skill sets and what will happen when markets recover.

In conclusion, we will ensure that our new risk assessment system directs resources most effectively to firms that have the biggest impact on the economy and consumers. But at the heart of the system are individuals. I know we still have some way to go not just to build our risk assessment framework at the Central Bank, but to improve our capacity for challenge and to develop a culture that is focused on ensuring risks are properly mitigated, not just identified.

At the Central Bank we know we have an important responsibility to the public to fix the banks and improve regulation for the future. I’m hopeful that we can make good progress in the next few years on both fronts, to learn the lessons of the crisis and improve the performance of the Central Bank. In doing so, we will aim to live up to that high standard of public service that would be very familiar to Paddy Ryan.