Women in Financial Services
E2W member Anita D. Millar Reframing Board Priorities in terms of three Rs: Resilience, Responsibilities, and Relationships
Tina.Freed / 03 Aug 2020
Origionally posted by CIO Success, the full article can be found here.
E2W member Anita D. Millar: Reframing Board Priorities in terms of three Rs: Resilience, Responsibilities, and Relationships
Anita D. Millar is a risk and public policy professional with over 25-years of experience of working in financial services . Her career spans frontline risk management, audit, and consulting in the regulatory sector.
Key Messages
- Resilience is a board level issue for financial services (FS) and non-FS firms.
- Resilience must be balanced (and potentially shaped) by a board’s responsibilities to its workforce and shareholders, and its relationships with customers, suppliers and other stakeholders.
- Do not confuse minimising risk with maximising resilience.
- Digital resilience is a business issue, not just an IT or cyber-security issue, and can bring untapped productivity gains.
- Success in managing and meeting operational resilience and sustainable finance obligations will be determined, in part, by board engagement along with digital capabilities (particularly in relation data consumption and reporting).
Introduction
The first principle of the UK’s Corporate Governance code is: A successful company is led by an effective and entrepreneurial board, whose role is to promote the long-term sustainable success of the company, generating value for shareholders and contributing to wider society.
But does this principle reflect our times?
As economies, companies and the workforce emerge for the shadows of Covid19, the theme of resilience is everywhere; so the case for reframing board principles and priorities in terms of resilience (rather than sustainability) is already becoming apparent.
Long-term business resilience serves the interests of shareholders but must be balanced with the board’s responsibilities to its workforce, as well as its relationships with all internal and external stakeholders. In this light, reframing board priorities in terms of the three Rs – resilience, responsibilities, and relationships – has resonance.
While the UK’s Corporate Governance Code recognises wider board responsibilities to its workforce and other stakeholders, the three Rs are not a simple repackaging exercise. In the post-Covid19 environment (where climate change concerns will re-emerge) it will be essential for boards to strengthen the connections between (potentially radical) changes to business and operational models, and measures to support the health and wellbeing of their workforce, financially or logistically challenged suppliers, delivery of government programmes (to staff and/or clients), and society at large.
Resilience
So, what is resilience? The Stockholm Resilience Centre suggests that: Resilience is the capacity of a system, be it an individual, a forest, a city or an economy, to deal with change and continue to develop. It is about how humans and nature can use shocks and disturbances like a financial crisis or climate change to spur renewal and innovative thinking.
This is a broad definition. However, if viewed from the perspective of a company’s business model, it has the benefit of conveying a sense of dynamism. It also avoids equating maximising resilience with minimising risk; thereby recognising that without risk, a firm may miss opportunities to build resilience. This provides scope for financial and non-financial institutions to set resilience tolerances (and risk appetites) at levels that are appropriate to their business.
In this light, perhaps it is not surprising that resilience is now used to frame any number of vulnerabilities or challenges arising from:
- Chokepoints in supply chains
- Company balance sheets now exposed as having relied on debt rather than equity
- Operating a business in a digital environment
- Important business services provided by financial firms
- The financial impact of climate change on the business models of the largest UKbanks and Insurers
The list of potential case studies are already fairly long, and could be longer, so our further exploration of this concept focuses on three cases: digital resilience, operational resilience of key business services, and building resilience in the context of climate change. Consideration is also given to the other two Rs – responsibility and relationships. The extent to which these might be overlooked, or are already shaping how resilience is being instilled in financial and non-financial firms.
Digital Resilience
Digital technologies have become core to many businesses seeking to offer their customers a reliable and efficient delivery service. Firms such as Domino’s Pizza or Ocado, both early movers in this sector, are so data and digital intensive, some might even call them technology firms that respectively sell pizza and groceries.
In contrast, the legal sector has been relatively slow to adopt digital solutions, but is now relying on digital technologies to streamline administrative functions and access client files (via cloud services)
24/7.The shift to digital solutions is set to accelerate with adoption of software solutions, such as DocuSign, and the emergence of leaders looking for opportunities to redefine corporate legal departments.
In financial services (FS), Fintech firms are now pervasive and the payment services directive (PSD2) has boosted innovation and competition. While digital payments have been growing, it is estimated Covid19 has accelerated this shift by two years.
Further changes in the payments sector are on the horizon with the possibility that central banks will develop Central Bank Digital Currencies (CBDC) and offer them to the public as a complement to physical banknotes. Such proposals would help to promote further competition and innovation in this sector.
Digital resilience should be a priority for all boards, whether firms are seeking to develop digital businesses or digital capabilities. It should not be treated as a technology or cyber-security issue that is the sole responsibility of the chief technology or information officer. Instead, it needs to be viewed as a wider business issue and embedded in how the board and senior management view the risks and opportunities facing the firm.
Moreover, the involvement of the wider board and senior management should help to ensure that opportunities to address the other two Rs are not missed. In particular, the possibility of using digital technologies to support and empower employees (from all demographics) have yet to be fully explored, although the productivity gains could be significant.
For instance, few inroads have been on replacing spreadsheets (like Excel) with sophisticated tools that allow data to be understood, manipulated and analysed without resorting to programming. With training, such advances in front-end tools would move the ownership of data and analytics from a few, to potentially everyone employed in a firm. This could, in turn, promote further collaboration, problem solving and innovation. The key challenge for firms, apart from training, is to ensure that the data being delivered to new front-end tools are useful and reliable. With advances made in artificial intelligence, this may be in the grasp of many firms, but not on their radar as they grapple with the technology to collect and collate raw data and/or meet new reporting and disclosure requirements. Nonetheless, the possibilities for creating such capability should not be overlooked, particularly for the FS firms in the scope of the emerging operational resilience regime or sustainable finance initiatives.
Operational Resilience
With many business leaders now thinking about digital resilience, it is perhaps unsurprising that the Bank of England (BOE) is spearheading a new regulatory regime aimed at ensuring that the UK’s financial sector will remain operationally resilience in the face of disruptions to important business services undertaken by regulated entities within the scope of the regime.
Work on this new regulatory approach began before the onset of Covid19,18 but the challenges and changes that come with Covid19 will undoubtedly inform the framework’s development and implementation.
Each regulated FS firm, in the scope of the regime, will be individually responsible for setting clear impact tolerances for important business services. Unlike risk appetite levels set for credit, market risk, or operational risk, impact tolerance levels are not to be breached.
Tolerances will be set in relation to the potential impact of a business service disruption to: financial stability and safety and soundness (banks and deposit-taking institutions); degree of policy-holder protection (insurers); transfer or efficiency of payments (recognised payment system providers and specified service providers); or the operation of a financial market infrastructure (e.g., Central Counterparty Clearing House (CCP), Central Securities Depository (CSD)).
FS firms will be required to undertake an extensive mapping process to identify and document how each important service is delivered, anticipate how it could be disrupted and take steps to prevent, adapt, recover and learn from them.
A key feature of this regime includes the requirement to use scenario analysis to identify vulnerabilities (that could translate into risk tolerances being exceeded) as well as possible responses. To ensure this assessment remains meaningful, the scenarios (deployed by each firm) are expected to evolve with changes in the environment.
So, for example, if a retail bank assesses that telephone consumer authentication is an important business service, scenario testing may identify challenges associated with remaining within an impact tolerance of a 12-hour disruption. The mapping exercise may also identify several key supporting resources (e.g., a voice recognition programme) and two interdependent business services (e.g., telephone and online authentication) that use the same customer account database. Further scenario testing may reveal that these two services could fail at the same time, which would then prompt more investigation and investment by the FS firm.
The stewardship responsibilities of the board under this framework are significant.
Board responsibilities go beyond merely approving those business services deemed as important and their impact tolerances. The board must also be satisfied that the entity has met all the underlying requirements concerning the strategies, processes and systems used to identify important business services, set tolerances and perform mapping and testing. Overall responsibility for implementing operational resilience policies and reporting to the board, falls to the Chief Operations Senior Management Function (SMF) 24 (under the UK’s SMCR regime).
Returning to the other two Rs, it could be argued that operational resilience considers both an FS firm’s responsibilities to its workforce as well as its relationships with consumers, regulators and wider society.
For instance, with the focus on important business services, FS firms should be able to identify when staff might be put in an untenable situation or where customers and the wider society are put at economic risk. In regard to the latter, this could take the form of a disruption in the bank’s controls that escalates and negatively affects the confidence in the wider payments system. Furthermore the requirement that FS firms self-assess, document and communicate their approach to UK regulators, will reinforce their responsibilities and relationship with their FS supervisors.
Sustainable finance and building resilience in the context of climate change
Building digital and operational resilience should also help FS firms in the area of sustainable finance (which covers a range of risks). Data is key in sustainable finance as well as understanding your business and your clients.
However, if resilience is about tackling and overcoming change (in the context of sustainable finance) is it any different from sustainability?
In sustainable finance, these concepts are sometimes used interchangeably, but confusing them could be dangerous for boards trying to come to grips with the specific implications of climate change – for their balances sheets and their suppliers, customers, clients, and investors.
Assessing the implications of climate change for an FS or non-FS business requires tools and data as well as an understanding of the myriad of frameworks (TCFD), reporting standards (SASB, CDSB), and incoming regulation (EU regulatory regime) which, to varying degrees, include related environmental, social and governance (ESG) concerns.
The resources and time required to create an institutional understanding of how these various frameworks/ standards/ rules relate to each other, should not be underestimated. Let alone the resources and knowledge required to build systems that can deliver reliable data on the profiles of reporting firms.
Moreover, much of the data is a product of classification systems (or taxonomies) that are insufficiently granular. Even the EU taxonomy, which maps economic activities to sectors, reflects trade-offs between granularity and flexibility as well as complexity and clarity.
Notwithstanding these trade-offs being remedied, reporting and manipulating ESG data directly (or indirectly) linked to the 17 Sustainable Development Goals (SDGs) developed by the UN, does not translate into building a resilient balance sheet or business model.
Although laudable, the SDGs focus on avoiding an outcome. In particular, SDG13 is concerned with, in this century, avoiding an increase in global temperature that is 2 degrees Celsius above pre-industrial levels rather than tackling and overcoming the climate challenge without becoming overwhelmed by it. So, for example, even if SDG13 anticipates direct air carbon capture (DAC) technologies, it does not explicitly anticipate solutions such as the creation of net zero carbon synthetic fuels and the speed that they might be implemented and work alongside other technologies.
So while assessing sustainability is essential, shifting the focus to resilience adds a further dimension and puts resilience to climate change within a board’s remit.
For many FS firms, the question of business model resilience to climate change will be brought into sharp focus by the BOE’s plans to stress test the resilience of business models – of the largest banks, insurers and the financial system – to the physical and transition risks from climate change. In fact, one of the desired outcomes of the exercise is to encourage FS firm boards to take a strategic, long-term approach to managing climate change risks.
Known formally as the 2021 biennial exploratory scenario (BES) on the financial risks from climate change, the stress test includes a few key features that help to highlight the scale and objectives of the exercise. These include:
- The deployment of three different scenarios, with timelines that go out 2080, and include macro-economic variables. The three scenarios are: early policy intervention on climate change (as signposted by government policies); late policy action (involving a 10-year delay); and no (additional) policy action beyond what has already been announced.
- Counterparty-level modelling. For example, exposures to corporates would be analysed at the level of the individual company. This would include modelling cash flows and collateral values and reflect judgements about how companies would be positioned (so includes an assessment of current corporate mitigation and adaptation plans).
- Fixed BES participant balance sheets. In Part I of the exercise, it is assumed that the nominal size and composition of balance sheets (of 30 June 2020) do not change for the time horizon of the scenario and there is no management action. Thus, the resilience of a fixed balance sheet can be investigated at different points in each scenario.
- In Part II of the exercise the fixed balance sheet constraint is relaxed and BES participants may change their business models in response to the scenarios.
At first glance, the BES is solely aimed at assessing the financial resilience of FS firms. Nonetheless, this does not mean that board responsibilities and relationships (i.e., the other two Rs) are completely overlooked. For example, each scenario includes assumptions regarding consumer behaviour and appetites, and Part II of the exercise potentially provides scope for participants to consider the wider implications of stepping back from key services and rebalancing their balance sheet.
No doubt, some observers might suggest that the BES should go further. Arguably, a strategic response to climate change, must actively consider the welfare of the FS firm’s workforce and issues that might have previously come under the heading of corporate social responsibility (CSR).
Conclusion
Even if the UK Corporate Governance Code is not amended to explicitly refer to the concept of resilience, this concept of resilience is here to stay. However, the degree to which it is informed and balanced by other board responsibilities and relationships, remains an open question. It may be that the final answer depends on the culture of each firm and how the experience of Covid19 informs how firms approach their responsibilities to the workforce, and their relationships with stakeholders and the wider community.
Back to blog