Chapter 2: Introduction to FIRM 2.1. Introduction This Chapter deals with the whys and wherefores of risk analysis. In that context, a look is taken at the objectives of the institutions subject to DNB s supervision and at the objectives which DNB pursues given its regulatory tasks. In cases where the manner in which an institution pursues its objectives does not match the statutory framework or DNB s supervisory objectives, DNB will consider intervening. To do so, the supervisory authority must be able to rely on clear standards and on an adequate analysis of the situation. All this has consequences for the design of a method of risk analysis. The way in which FIRM provides support to this process is explained below. 2.2. Frame of reference for risk analysis 2.2.1. Corporate objectives FIRM seeks to assess risks and risk controls within supervised institutions. For a proper assessment of these risks, it must be clear which objectives should be reflected in the risk analysis. The institutions which are subject to DNB s supervision differ markedly in terms of nature and volume of operations. Considering these differences, the corporate objectives will also differ. In the pursuit of their objectives, institutions will attempt to optimise (added) value on behalf of their external and internal stakeholders 1. The various categories of stakeholders do not, however, all attach the same meaning to value. Thus, employees will tend to equate value with continuity of employment and high pay levels. Managers, though, may benefit more from high annual profits because of performance bonuses. Customers, on the other hand, will prefer low fees, while pensioners will assign priority to their retirement payments. Furthermore, it should be realised that individuals within a company will not always act in the corporate interest, but may also tend to act in their own interests. In this interplay of forces, government agencies and supervisory authorities will seek to enforce adequate compliance with legislation and regulation. It stands to reason that the corporate objectives and the interests of the various stakeholders may be mutually conflicting. It is the company s which must strike a proper balance. That is why the highest echelon within a company is responsible for defin ing the limits within which individuals should perform their activities. Within each company, controls should be in place to ascertain to what extent the activities are performed accordingly. The design of such controls should match the level of the risks to be controlled. A risk analysis by the company itself is indispensable in this regard, and is indeed required by DNB in various regulations. It is the supervisory authority which must assess whether the choices made by corporate give rise to undesired risks from a supervisory perspective. This supervisory perspective is worked out in more detail in section 2.2.2. Supervision can never seek to eliminate all risks in full. This should be duly allowed for in the set of standards against which institutions are assessed by the supervisory authority. 2.2.2. Risks in relation to supervisory objectives Risk analysis is performed by the supervisory authority in order to gain an insight into the risks related to the activities undertaken by the institutions and into the extent to which such risks pose a potential threat to the achievement of the supervisory objectives. By scoring the risks and the controls, risks, controls, activities and institutions are graded, thus providing input for an allocation of scarce supervisory resources in the most efficient manner possible. This contributes to the achievement of DNB s supervisory objectives, as they have been embedded by the legislator in the various pieces of supervisory legislation. 1 These may be shareholders, but also employees, customers, pensioners, etc. Chapter 2 Introduction to FIRM Page 1 of 6
The various pieces of supervisory legislation serve a number of overall objectives, such as protection of creditors, protection of the interests of policy-holders and protection of the integrity of the financial system. An analysis of supervisory legislation shows that these objectives may be pursued in actual practice by focusing risk-based supervision on: solvency; liquidity; organisation and control; business integrity. These four themes constitute the pillars of the risk analysis within FIRM. In cases where this Manual refers to the impact of risk events on the supervisory objectives, this concerns the impact on one or more of these pillars. A risk-based approach is also possible for supervision of compliance with a number of specific Acts (Disclosure of Unusual Transactions (Financial Services) Act and Identification (Financial Services) Act) as well as for material compliance. Thus, all aspects of micro-prudential supervision (aimed at individual institutions) are brought within the scope of FIRM. Macro-prudential aspects, financial stability and payment system operations, which are aimed at several institutions, entire sectors or even the financial system as a whole, remain beyond the scope of FIRM. Chapter 2 Introduction to FIRM Page 2 of 6
2.3. Outline of FIRM; assessment by supervisory objective In line with the supervisory objectives listed in section 2.2.2 above, the following sub-analyses are performed within FIRM: solvency and solvency ; liquidity and liquidity ; organisation and control; business integrity. Depending on the statutory objectives for each individual type of institution, one or more of the above analyses are performed. Together, these elements constitute the institution s risk analysis dashboard and provide input for planning supervisory work and possibly interventions at institutions. This may be represented schematically as follows: FIRM dashboard 2.3.1. Analysis of solvency and solvency Within FIRM, this assessment is performed for each institution/licensee 2 subject to direct supervision. This does not, of course, hold for institutions not supervised by DNB, with respect to solvency. Basically, the financial is monitored by means of prudential analysis of reports that are completed and submitted periodically by the institutions. These returns, however, contain historical data. Since the institutions financial must continue to be safeguarded in the future as well, it is essential to complement this analysis of historical data with an analysis of the way in which the institution itself manages and controls its financial. Within FIRM, the corporate units undertaking these tasks are denoted as the group functions Solvency Management and Liquidity Management. 2 Within larger groups of companies or conglomerates, a single organisational structure may encompass several supervised institutions or licensees. Chapter 2 Introduction to FIRM Page 3 of 6
The analysis of the solvency and of solvency consists of the following steps: Obtaining information on current solvency adequacy of current solvency quality of solvency Evaluation and possibly intervention Institutions subject to this regime must submit periodic reports to DNB showing the ratio of actual to required solvency. The relevant key indicators, which may differ by type of institution, are entered into FIRM and are updated on an ongoing basis. For further details, the reader is referred to Chapter 4. Periodically, the supervisor translates the ratio of actual to required solvency into an assessment of the adequacy of the solvency (the available options being ample/adequate/inadequate/highly inadequate). In addition to the solvency, the quality of solvency is also assessed within FIRM. To that end, in the breakdown of the organisational structure, a separate activity (group function Solvency Management) is added for each licensee, to which the template for Solvency Management is linked. In respect of this activity, the supervisor assesses the quality of the way in which the institution concerned (group or individual licensee) manages and controls its solvency. For further details, the reader is referred to sections 3.2.5 and 6.4. Subsequently, it is up to the supervisor to decide whether the current solvency, combined with his/her assessment of the quality of solvency, is acceptable, also with a view to the future. A tight solvency (though not below the statutory minimum) in combination with very sound solvency might be acceptable whereas an easy solvency in combination with moderate solvency might not. The assessment of the solvency and of solvency adds to the overall picture of the institution s risk, with the assessment of the level and the control of the individual risks being complemented with an insight into the manner in which the institution manages its financial buffers (which, after all, serve to absorb risks) in the longer term. This assessment is in line with developments within the framework of Basel II (ICAAP), economic capital, the Financial Assessment Framework and Solvency II. 2.3.2. Analysis of liquidity and liquidity (for banks only) The analysis of the liquidity and of liquidity consists of the following steps: Obtaining information on current liquidity adequacy of current liquidity quality of liquidity Evaluation and possibly intervention For more information, the reader is referred to the preceding section on solvency. The assessment of liquidity is performed in much the same way as that of solvency. Chapter 2 Introduction to FIRM Page 4 of 6
2.3.3. Analysis of Organisation and control The risk analysis provides a structured way of gaining an insight into the extent to which such aspects as strategy, policies, an institution s activities, its in-house processes and its interaction with the outside world may give rise to risks and an insight into the extent to which such risks are identified and controlled by the institution itself. In order to permit the analysis to be performed in a structured way, the relevant sources of risk, denoted as risk categories, and the possible forms of internal control, denoted as control categories, have been identified within FIRM. Within FIRM, the following risk and control categories are distinguished: Risk categories Financial risks Non-financial risks Control categories Matching/interest rate risk Environmental risk Risk-specific control Market risk Operational risk Organisation Credit risk Outsourcing risk Management nsurance technical risk T risk Solvency ntegrity risk Legal risk Liquidity Thus, an assessment framework has been created that can be applied to all types of supervised institutions. For a substantive explanation of the above risk and control categories, the reader is referred to Chapters 5 and 6. A risk event may, directly or indirectly, lead to impairment of one or more supervisory objectives (solvency and liquidity objectives or objectives relating to organisation and control and business integrity). The risk analysis seeks to ascertain the probability of a risk event and of a consequent significant to high impact. By assessing the probabilities of risk events, the risk are ranked and, in combination with the assessment of the quality of control, input is provided for the planning process. The concrete analysis of organisation and control consists of the following steps 3 : aking stock of units and functional ctivities Assigning weights to units and functional ctivities Assigning templates to functional activities default risk weights nd risk scores the quality of control Within the organisational structure as laid down in the process, the risk analysis is performed at the level of the activities (hereinafter referred to as functional activities). In order to achieve an analysis which is consistent across similar institutions, use is made of preprogrammed risk profiles (denoted as templates) for the frequently perceived activities (denoted as 3 Depending on the complexity of the organisation, one or more of the steps relating to the breakdown, as listed here, may not apply. Within the FIRM application, a number of steps have already been predefined, depending on the type of institution. Chapter 2 Introduction to FIRM Page 5 of 6
functional activities). For each functional activity, the templates show which risk categories are considered relevant and how they are ranked in terms of significance. Furthermore, all risk categories and underlying risk items have been assigned default scores. Default weights are used to express the relative significance that is attached to the various risk categories from the perspective of DNB s supervisory objectives. In addition, weights are used to explicitly accentuate certain risks within certain functional activities. The use of default scores for risk categories is based on the assumption that the inherent risks (abstracting from any form of control) will be comparable in terms of nature and magnitude for comparable activities. Hence, within the frequently perceived functional activities, the expected probability of a risk event materially or essentially impairing DNB s supervisory objectives has been predefined for each risk. Once the supervisor has assessed the level of risks, he/she must assess the quality of control within the institution s individual functional activities. This concerns the assessment of risk-specific controls and of the control categories Management and Organisation. The assessment of the control categories Solvency Management and Liquidity Management has already been discussed in the preceding section. In this Manual, assessment criteria are given for each control category. For further information, the reader is referred to the Annexes. The resulting scores for inherent risks and control provide an indication of the degree to which the institution is able to mitigate the risks in an adequate manner. Low scores indicate that, in the supervisor s view, risk control is insufficient and, hence, that substantial residual risks are present. This may be a reason for intervention at the institution concerned. The FIRM application includes an aggregation algorithm for aggregating scores by, among other things, line of business, organisational unit and risk and control category. This permits analysis within and across institutions, providing a basis for prioritisation within the supervisory planning process. 2.3.4. Analysis of Business Integrity In various pieces of relevant legislation, integrity is included as an important (separate) supervisory objective. Within FIRM, the integrity risk is among the risks that must be assessed. In cases where integrity risk is relevant within an activity, it has been included in the template. This serves to identify the integrity risk and to ensure an assessment of the quality of the relevant risk-specific controls. Moreover, the risk-mitigating action of the group function Compliance is taken into account. In view of the fact that integrity is among the explicit supervisory objectives, it is presented separately within FIRM. The total of the aggregated scores relating to the integrity risk and its controls is shown separately on the FIRM dashboard. In fact, this represents an integrity-risk-specific cross-section of the institution. Chapter 2 Introduction to FIRM Page 6 of 6