Precedents in other sectors
The pensions risk management requirements of The Pensions Regulator's General Code should not have come as a surprise. Listed and private companies, the government sector, charities and higher education are all covered by established codes of corporate governance that require effective risk management. Many of these codes have been in place for years, with organisations having had time to adapt to them, try out approaches and then optimise them. The Pensions Regulator (TPR) has simply acted to bring pension schemes into line with risk management practices already established in these sectors.
From the Turnbull report in 1998, which first made risk management a board-level responsibility in listed companies, and the subsequent ‘Orange book’ developed by the UK Treasury, which became mandatory throughout the public sector, risk management has undergone a pattern of staggered development as organisations wrestled with, at first unfamiliar, concepts and arrangements. Codes and guidance were revised and made more precise and organisations gradually got on top of ‘Enterprise Risk Management’.
Looking at established listed companies, we see organisations that have, for the most part, well-developed, structured risk management arrangements. Risks are identified and assessed using a rolling ‘always on’ approach. Mitigation is applied and tracked through to completion. There is effective internal and external reporting on risk.
Some organisations have gone a step further and developed risk cultures in which personnel have a rounded understanding of risk and a shared ‘risk mindset’. Good risk management is seen as being an enabler; something that is an essential part of achieving corporate aims.
Transferability to the pensions sector
So how much of this is transferable to the pensions sector? Well, actually, quite a bit. Often schemes don’t need the complex structures and tools that larger corporates have but the principles remain valid and the practical responses taken in other sectors are instructive:
- Risk registers, check
- Risk management frameworks, check
- Risk management functions, well, yes, not so much because the codes say so, but because that is the practical way to implement.
The Own Risk Assessment (ORA) in the General Code is a little different from the approach in other sectors, but it does support a process of review and reflection similar to that undertaken by corporates when they prepare the principal risks and uncertainties sections of their annual reports.
Learning from the experience of other sectors
It took time for other sectors to get to where they are now, with some false starts made along the way. Gradually, a consensus developed, so pension schemes can learn and avoid some of the pitfalls others have fallen foul of.
One issue that affected these early efforts and which can be seen today in many pension schemes, is ensuring that risk processes are ‘always on’ and not operating on an intermittent or occasional basis. Some method is required to enable schemes to be responsive to developing risks; to see risks coming and do something about them in a timely fashion.
A combination of horizon scanning and intelligent curation, underpinned by a work-on-risk mindset, will all be key elements of an ‘always-on’ approach. Of course, there’s more to it than that, and that’s where the Risk Management Function comes in.
Risk management function (RMF), framework and risk registers
Corporates have risk management functions. They might not be called that, but somewhere there is always a team which undertakes the required tasks to make the risk management system operate on an ‘always on’ basis. They gather risk information, update risk registers, track risk mitigation, take action (within their delegated authority) and report up to the board. They operate the system, whilst directors are freed up to adopt an oversight role, think holistically, and make the key decisions on risk strategy and resourcing.
The Pensions Regulator has left options open in terms of how the RMF is constituted and has not been prescriptive as to how it operates. However, there are clear learnings from other sectors which suggest how the RMF should operate.
The RMF is an essential enabling factor to make risk management work for pension schemes and is a key link that has been missing for many schemes. It undertakes the tasks necessary to keep the risk management process functioning on an ongoing basis. In particular, we consider that the RMF should be close to scheme activity and active in horizon scanning to identify changes in risk exposure throughout the year and updating trustees in line with developments. Typical tasks might include, updating risk registers, ‘curating’ (selecting on the basis of agreed criteria) risk information and reporting on such to board/sub-committee, tracking of risk mitigation actions, and taking actions to support the preparation of the own risk assessment (ORA).
A further consideration is consistency. It’s no good having a process that meanders or changes from month to month. Rather, the process needs to be defined, codified and adhered to. This is where the risk management framework comes in. The framework is the rulebook for the system which defines the responsibilities, the activities and sets the timetable.
