Category: Economics and Banking

The Financial Stability Institute has issued an occasional paper entitled “the “four lines of defence model” for financial institutions.” It takes the so called three-lines-of-defence model further to reflect specific governance features of regulated financial institutions. The paper highlights issues which exist in the current “recommended” approach, and specifically limitations of internal audit. Embedding the external auditors’ role in the structure of the defence system could mitigate the shortcomings of the traditional three-lines-of-defence model and increase the soundness and reliability of the risk management framework.

Since the Global Financial Crisis of 2007–09, the design and implementation of internal control systems has attracted serious academic and professional attention. Much research on the effectiveness and characteristics of internal audit functions has been conducted under the sponsorship of the Institute of Internal Auditors Research Foundation (IIARF) and published in academic and professional journals. The guidelines issued by the Basel Committee on Banking Supervision (BCBS) in 2015 on corporate governance principles for banks emphasise the importance of proper risk management procedures, including, in particular, “an effective independent risk management function, under the direction of a chief risk officer (CRO), with sufficient stature, independence, resources and access to the board.” Furthermore, “the sophistication of the bank’s risk management and internal control infrastructure should keep pace with changes to the bank’s risk profile, to the external risk landscape and in industry practice” so as to identify, monitor and control risks on an ongoing bank-wide and individual-entity basis.

Despite these efforts, there has been little systematic analysis of how the design of an internal control system affects the efficiency and effectiveness of corporate governance processes, especially at financial institutions such as banks and insurance companies. The “three lines of defence model” has been used traditionally to model the interaction between corporate governance and internal control systems.

Recent significant risk incidents and corporate scandals caused by misconduct in financial market operations indicate that banks need to further enhance corporate governance measures. But, most importantly, such incidents have led to a further prioritisation of governmental and supervisory agendas relating to the potential systemic implications of weak internal control systems. This calls for a greater prominence of microprudential policies relating to misconduct at banks. It also calls for closer cooperation between regulators, and external and internal auditors, so as to win back public trust in financial institutions.

Specifically, four areas of weakness exist:

1. Misaligned incentives for risk-takers in first line of defence
2. Lack of organisational independence of functions in second line of defence
3. Lack of skills and expertise in second line functions
4. Inadequate and subjective risk assessment performed by internal audit

In order to account for the specific governance features of banks and insurance companies, they outline a “four lines of defence” model that endows supervisors and external auditors, who are formally outside the organisation, with a specific role in the organisational structure of the internal control system.Building upon the concept of a “triangular” relationship between internal auditors, supervisors and external auditors, they examine closely the interactions between them. By establishing a fourlines-of-defence model, they believe that new responsibilities and relationships between internal auditors, supervisors and external auditors will enhance control systems. That said however, they also highlight the risk that new problems could be caused by inadequate information flows among those actors.

Regulatory capital ratios, as well as other indicators of financial strength, such as liquidity and leverage ratios, are produced alongside banks’ standard financial reports but are not audited in the same way. This may create an expectations gap for society: what may be a bank’s most looked-at indicator is not audited. External auditors could perform assurance tasks related to such regulatory requirements (including capital ratios and risk-weighted assets, and leverage and liquidity ratios). Requirements for the independent scrutiny of regulatory capital information have evolved piecemeal across the world; some countries mandate publically available assurance reports, some only require financial institutions to inform regulators while others have no reporting requirement whatsoever. Given the size and importance of the banking sector – and the systemic risk posed to global financial markets – credibility and reliability are crucial.

They explored developments in a number of countries to illustrate the importance of increased cooperation between bank supervisors and external auditors:

1. United Kingdom:
The Prudential Regulation Authority (PRA) of the United Kingdom recently issued a consultative document59 laying out the rules for external auditors of the largest UK banks for the provision of written reports to the PRA as part of the statutory audit cycle. The PRA asked external auditors to contribute to its supervision of firms by directly engaging in a pro-active and constructive way to support judgment-based supervision and help promote the safety and soundness of firms supervised by the PRA. The insights gained by auditors when they carry out high-quality audits should help enhance the effectiveness of the relationship between the auditors and the supervisor.

There have been improvements in the last few years such as a closer and more frequent engagement between supervisors and external auditors. The PRA keeps monitoring the quality of auditor-supervisor dialogue. In a survey of external auditors, it was noted that the vast majority of engagements was considered only ‘reasonable’ and that the PRA’s aim was to improve this engagement in the longer term. In particular, in individual cases both supervisors and auditors considered that there was room for improvement in the frankness with which information was shared, how often it was shared and what was covered in bilateral meetings.

2. Switzerland:
For many years, the Swiss Financial Market Supervisory Authority (FINMA) has adopted a dualist approach whereby on-site examinations are outsourced to approved and licensed external auditors. A recent IMF assessment 60 noted significant weaknesses in Swiss supervision. FINMA should provide more guidance to auditors to ensure greater supervisory harmonisation across entities and should complement the auditors’ work with its own in-depth examinations of selected issues. In addition, the payment of auditors by a supervised entity was viewed critically as auditors should not be paid by a supervised entity but rather by a “FINMA administered bank-financed fund”. The IMF also noted that FINMA’s on- and off-site supervisory resources had been increased in recent years but still needed to be strengthened. Resources were insufficient to supervise and regulate the entire banking system in a way that met the Core Principles for Banking Supervision, including sufficient in-depth on-site work and oversight of supervisory work done by external auditors, particularly for small- and medium-sized banks.

3. United States:
A recent IMF report examined the relationship between supervisors and external auditors, and noted “that supervisors meet periodically with external audit firms to discuss issues of common interest relating to bank operations”. It also noted that there was no “safe haven” protection for external auditors in reporting issues to regulators. However, according to Part 363 of the Federal Deposit Insurance Corporation (FDIC) rules, a bank must inform its supervisor within 15 days of having received written information from the auditors about a violation that was committed. This gap is somehow mitigated by the frequent contact between supervisors and auditors in the course of examinations and planning. Furthermore, although the supervisors cannot set the scope of the external audit, they could encourage the auditors to include new issues. However, the report highlighted weaknesses relating to the fact that supervisors do not have legal powers to add specific issues to the scope of the external audit in order to address issues that are not normally covered by such an audit.

4. Hong Kong:
The Hong Kong Monetary Authority (HKMA) devotes significant efforts to ensuring effective communication channels with external auditors. Furthermore, its powers to commission external auditor reports for supervisory purposes further supports the relationship between the HKMA and the external auditors, and the understanding of the HKMA’s supervisory concerns. However, a recent IMF report63 states that there are two areas in which the HKMA lacks powers and where the legislative framework could be enhanced: the HKMA lacks powers to reject the appointment of an external auditor, when there are concerns over its competence or independence, and it does not have direct power to access the working documents of the external auditor even though the HKMA is able to address issues that arise by indirect means. While the HKMA has been able to work around these restrictions, amendments to the relevant legislation should be made.

Durable financial stability requires more than microprudential standards that bolster the resilience of individual firms. It also requires a macroprudential perspective, with flexibility to respond to shocks wherever they occur; with higher standards for systemically important firms; and to increase levels of resilience when risks increase.

Mark Carney, Governor of the Bank of England, Chairman of the Financial Stability Board and Vice-Chair of the European Systemic Risk Board, (ESRB) has addressed European Parliament’s ECON Committee.

The ESRB is the only hub where all the relevant authorities are present, including central banks, bank supervisors, and securities authorities. Through our regular dialogue we can establish and update best practice.

Consider residential real estate. This year ESRB’s work emphasised how these markets were influenced by structural differences, from Loan-to-Value restrictions to tax treatments, across the EU.

Its analysis identified the tools authorities may use to respond to different vulnerabilities, ranging from capital measures to restrictions on debt-to-income ratios and collateral.

Key lessons of the analysis include that:

1. flexibility is needed in both design and calibration of macroprudential tools;

2. no single tool can combat all property risks;

3. tools need to be appropriate to domestic circumstances; and

4. domestic policies are more effective for both domestic and EU financial stability if their spillovers are managed.

The ESRB has built a framework to assess and manage such spillovers, which should be agreed soon and be operationalised early next year. Its central feature is reciprocity – eliminating regulatory arbitrage to give domestic policy greater traction. It will be member led, but, importantly, backed by ESRB recommendations. Compliance will be on an “act or explain” basis but the presumption will be that many exposure-based measures (e.g. LTV, LTI and maturity) will be reciprocated.

This is significant. The ESRB has been notified of macroprudential actions 69 times this year, and 173 times since the introduction of the CRR/CRD in 2014. Although many notices are procedural, they show the direction of travel. More countries are using macroprudential tools, creating an increasing need for a “clearing house” that is both comprehensive and timely.

The ESRB will also evaluate the ways national macroprudential authorities might apply countercyclical capital buffers against financial exposures from countries outside the EEA – a tool given to the ESRB under Union law. That will further bolster collective resilience against the global financial cycle and spillovers from outside the Union.

While risks in property markets reflect national differences, other risks such as misconduct have more common determinants.

In the past five years, misconduct penalties imposed on EU banks have totalled €50bn.

Those costs have direct implications for the real economy. At 5% leverage, that capital could have supported €1 trillion of lending capacity.

More fundamentally, repeated episodes of misconduct undercut public trust in the system.

The ESRB’s work has helped catalyse sensible actions to begin the process to rebuild that trust.

First, it has proposed capturing misconduct costs in stress tests to ensure banks remain resilient even under severe outcomes.

The Bank of England has followed this approach in its most recent stress test which included and additional £40bn of misconduct costs. These costs were calibrated to have a low likelihood of being exceeded and are therefore, by design, much larger than the amounts already provided for by banks.

Second, the ESRB has also proposed tackling misconduct at source by increasing individual accountability. This can be done by reforming remuneration – using variable pay, combined with Malus and Clawback, to hard-wire stronger incentives for good behaviour within firms. The UK is committed to this approach with the toughest remuneration regime in the EU, including the longest deferrals and claw backs.

However, the effectiveness of such measures across the EU is being tempered by the bonus cap. For example, in 2013, the ratio between fixed and variable for material risk takers at major UK banks was around 1:3 – meaning three quarters of remuneration was at risk from individual misconduct. The next year, when firms first had to apply the bonus cap, that ratio had fallen to around 1:1, with the overall level of remuneration unaffected.

Prompted by the ESRB, the FSB is now examining the impact of various compensation tools on misconduct, and if appropriate, it will recommend improvements to next year’s G20 summit.

Reforms to compensation are necessary but not sufficient. ESRB reports have rightly stressed that more should be done to hold senior individuals to account.

Prompted in part by the ESRB, the FSB members will share experiences on the role of bank regulatory powers to address misconduct and on approaches to enhancing individual accountability.

In the UK, we are implementing a new regime to ensure senior managers right across the financial system are held directly accountable for failures in their areas of responsibility. That will be buttressed by clear code of conduct, designed by practitioners, to ensure high standards are understood by all.

The Bank for International Settlements has released a document which sets out supervisory guidance on sound credit risk practices associated with the implementation and ongoing application of expected credit loss (ECL) accounting frameworks. The move to ECL accounting frameworks by accounting standard setters is an important step forward in resolving the weakness identified during the recent financial crisis that credit loss recognition was too little, too late. It is also consistent with the April 2009 call by G20 Leaders for accounting standard setters to “strengthen accounting recognition of loan loss provisions by incorporating a broader range of credit information”.

This guidance, which should be viewed as complementary to the accounting standards, presents the Committee’s view of the appropriate application of ECL accounting standards. It provides banks with supervisory guidance on how the ECL accounting model should interact with a bank’s overall credit risk practices and regulatory framework, but does not set out regulatory capital requirements on expected loss provisioning under the Basel capital framework.

The failure to identify and recognise increases in credit risk in a timely manner can aggravate underlying weaknesses in credit quality, adversely affect bank capital adequacy, and hinder appropriate risk assessment and control of a bank’s credit risk exposure. The bank risk management function’s involvement in the assessment and measurement of accounting ECL is essential to ensuring adequate allowances in accordance with the applicable accounting framework.

Supervisory guidance for credit risk and accounting for expected credit losses

• A bank’s board of directors (or equivalent) and senior management are responsible for ensuring that the bank has appropriate credit risk practices, including an effective system of internal control, to consistently determine adequate allowances in accordance with the bank’s stated policies and procedures, the applicable accounting framework and relevant supervisory guidance.
• A bank should adopt, document and adhere to sound methodologies that address policies, procedures and controls for assessing and measuring credit risk on all lending exposures. The measurement of allowances should build upon those robust methodologies and result in the appropriate and timely recognition of expected credit losses in accordance with the applicable accounting framework.
• A bank should have a credit risk rating process in place to appropriately group lending exposures on the basis of shared credit risk characteristics.
• A bank’s aggregate amount of allowances, regardless of whether allowance components are determined on a collective or an individual basis, should be adequate and consistent with the objectives of the applicable accounting framework.
• A bank should have policies and procedures in place to appropriately validate models used to assess and measure expected credit losses.
• A bank’s use of experienced credit judgment, especially in the robust consideration of reasonable and supportable forward-looking information, including macroeconomic factors, is essential to the assessment and measurement of expected credit losses.
• A bank should have a sound credit risk assessment and measurement process that provides it with a strong basis for common systems, tools and data to assess credit risk and to account for expected credit losses.
• A bank’s public disclosures should promote transparency and comparability by providing timely, relevant and decision-useful information.

Supervisory evaluation of credit risk practices, accounting for expected credit losses and capital adequacy

• Banking supervisors should periodically evaluate the effectiveness of a bank’s credit risk practices.
• Banking supervisors should be satisfied that the methods employed by a bank to determine accounting allowances lead to an appropriate measurement of expected credit losses in accordance with the applicable accounting framework.
• Banking supervisors should consider a bank’s credit risk practices when assessing a bank’s capital adequacy

In June 2006, the Basel Committee issued supervisory guidance on Sound credit risk assessment and valuation for loans to address how common data and processes may be used for credit risk assessment, accounting and capital adequacy purposes and to highlight provisioning concepts that are consistent in prudential and accounting frameworks. This document replaces the Committee’s previous guidance.