Assurance

Moving towards a global vision for connected standard setting

2020-03-12T09:59:22+00:00

I spotted a recent article in the Responsible Investor: ‘Europe’s Green Deal and ESG reporting standards: From (alphabet) soup to nuts’ (20 February). Aptly titled, it describes very well the challenge we face with non-financial reporting: it is fragmented, not underpinned by a global standard, and held back by inertia in the system. The author explores European moves to show leadership in this area, with the European Commission’s announcement that it intends to start work on its own standards on ESG. The article points out that this will lead to a different sort of fragmentation and would not deliver an outcome of consistent global data sets for critical ESG information.

This issue is particularly stark for climate change, where the TCFD recommendations have achieved considerable momentum towards becoming a global standard. Indeed, Mark Carney is looking to COP26 to make TCFD mandatory. TCFD has attracted great support from investors, companies, regulators, policy makers and civil society. It is becoming (in Mark Carney’s words) the ‘go-to standard’. But TCFD’s value as a standard will be enhanced by achieving consistent measurement and metrics – for example, on how to measure and report on emissions by scope, energy intensity or water withdrawal in areas of high stress. Without this rigour, we will not be able to achieve the accountability and transparency that we need.

And so I believe we should call both for mandatory TCFD reporting and the development of related standards for metrics as an outcome of COP26.

How do we move away from the ‘alphabet soup’ and avoid the pitfalls described by Responsible Investor, against the background of a multitude of reporting frameworks and standards and emerging practices in measuring and reporting on ESG factors?

I was privileged last year to chair a task force set up by Accountancy Europe to consider just this. We published our ideas at the end of last year in a paper in their Cogito series: Interconnected Standard Setting for Corporate Reporting. It focused on this central issue: how do we get to a global, core set of standards on non-financial or ESG information to achieve consistent, comparable metrics?

We proposed a vision for achieving a connected approach for corporate reporting. The key ingredients of the proposed model are to:

Establish a new international non-financial reporting standard setter to sit alongside the existing IASB and create the right mechanism to ensure independent, high-quality standard setting is preserved, involving multiple stakeholder participation and robust due process.
Evolve the current IFRS Foundation governance model, in recognition that climate and ESG matters relate closely to public policy. This means that policy makers and multilateral institutions need to have a mechanism to exercise effective oversight and to direct the standard setters consistently with the aims of public policy.
Establish connectivity of non-financial information to financial performance through a framework for connected reporting. This is critical to giving stakeholders insight as to the resilience and long-term prospects of the company.

However, is achieving a core base of metrics on non-financial information enough? Many stakeholders want to go further than ‘the core’ and in fact, many companies are already reporting with a wider perspective. And wider policy objectives such as sustainable investment and the European Green Deal are driving European reporting priorities.

Perhaps it is helpful here to think of ‘building blocks’ – a phrase that was mentioned to me recently and which I now unashamedly borrow. We should achieve a core building block that is globally consistent. Then we might add on further blocks that are developed and issued at regional or local levels to reflect the maturity of adoption of sustainable business and investment in policy and practice.

Is this approach realistic? I think the consensus among stakeholders, especially on the urgency of a standard and mandatory disclosures for climate change, could provide the momentum to move ahead quickly. Indeed, I believe that Europe is in a very good position to act to accelerate the process. Being at the global table and shaping the outcome, acting as the first mover and adopter, will put Europe in a great leadership position. This will demonstrate vision and make a real difference, particularly on climate change where the world has committed to a global target. This view was reinforced by Steven Maijoor, Chair of ESMA, when he said, ‘Given the global reach of the challenges posed by the transition to sustainability, Europe can play a leading role in promoting this consolidation at international level’.

Further, we can build on the work of existing bodies and the standards, frameworks and metrics already developed. They have achieved considerable uptake in the market. A lot of very good work has been done by CDP, CDSB, GRI, IIRC and SASB. Between them they cover the needs of our entire corporate reporting system in a complementary fashion. We should therefore bring the elements together in a way that would allow us to achieve our vision.

By developing global standards for core metrics, we achieve consistency and comparability in disclosures. This is what stakeholders are asking for and what the market needs. There is a global consensus to drive this agenda forward, especially on climate change. This should be our most urgent goal for corporate reporting – and in doing this, we will be delivering a solution that is essential to direct capital to sustainable enterprise.

Veronica Poole – Partner, Global IFRS leader | UK Head of Accounting and Corporate Reporting

Veronica Poole is a partner at Deloitte, global IFRS leader and the head of corporate reporting. She chaired the Accountancy Europe task force that prepared the paper Interconnected Standard Setting for Corporate Reporting

Changes and Concerns in the Peer-to-peer (P2P) lending market

2020-02-11T09:42:17+00:00

Following the collapse of two major Peer-to-peer (P2P) lending platforms in the last year, Lendy and FundingSecure, with a combined loan book of £240 million, the sector has found itself in the midst of increased scrutiny and regulatory change. With institutions such as Funding Circle cutting expected returns after reporting sharp rises in loan defaults,¹ the industry as a whole is under pressure. Despite the numerous disturbances the P2P sector has experienced in the past year, we highlight the collapse of Lendy as it stressed several wider issues in the P2P market.

What happened with Lendy?

Lendy originally introduced themselves into the P2P market in 2012 by providing bridging loans before moving into lending for property development. Lendy quickly saw their market share grow through soaring demand for their high, targeted rates of return and they thrived on the wider development of the market.

Following increasing rates of default, retail lenders began to face losses, eroding the value of Lendy’s loan book and creating liquidity issues for the business. Lendy appealed to the FCA for help after one of its biggest borrowers threatened to sue the company, before going into administration in May 2019 with a loan book of £152 million. At the time of publication, administrators stated that £130 million is still outstanding.²

Wider issues within the P2P market

As Deloitte have previously demonstrated, P2P lending has vast potential to disrupt traditional banking. We highlighted however, that banks hold a powerful competitive advantage, which would only grow if base rates rise.³ With rates rising after record lows, banks’ low-cost funding models have led to the developing P2P lending market, continuing to take greater risks to retain a foothold. This has raised a number of regulatory considerations.

The lack of transparency of P2P platforms has been highlighted by retail lenders who are largely unaware of the idiosyncratic credit risks of the agreements they have entered into. Advertisements promised lenders high rates of return that are only realistic under specific financial circumstances, without clear acknowledgement that the return rates stipulated are merely targets, and not guaranteed. This is particularly important as a recent survey highlighted that approximately half of P2P investors had invested more than double their annual income in such investments.⁴

In the event of loan default, frustrations have been expressed by lenders over the lack of information they receive over the recovery of their loan. Following the collapse of Lendy, concerns regarding the firms’ wind down arrangements were raised, with the administrator forecasting that investors may only receive half of their initial investments, with many losing most, if not all of their capital.⁵

These transparency concerns were covered by the FCA in a recent policy statement, which laid down new rules surrounding loan-based P2P platforms⁶ as well as through a “Dear CEO letter” which emphasises wind down arrangements.

Regulatory Changes

The FCA’s policy statement, released in June 2019, highlighted regulatory changes that all P2P lenders must adhere to before December 2019, prompted by a series of concerns in light of Lendy’s collapse.⁹ The review highlighted scope for increased regulatory scrutiny, where platforms were criticised for not being transparent about the true nature of the risk that lenders faced. This created a belief that the highly marketable high return rates were fixed and guaranteed. The FCA also called on P2P platforms to improve how they provide information on the services that they provide, in order to increase overall transparency of the industry. P2P platforms must state the expected and actual default rates of all P2P agreements, the risk categorisation of loans, and the levels of actual return achieved when a target return rate was stipulated. Platforms must also appropriately disclose that there is no protection of funds under Financial Services Compensation Scheme (FSCS).

As well as the marketing restrictions placed on P2P firms, the policy also introduced a requirement for platforms to assess investors’ knowledge and experience of P2P investments. This involves introducing a requirement that an appropriateness assessment, to assess an investor’s knowledge and experience of P2P investments, be undertaken, where the investor has not received any external advice.

Additionally, through a ‘Dear CEO Letter’ issued in March 2019 and aimed at P2P platforms, the FCA expressed concern that P2P platforms’ wind-down plans were insufficiently adequate and could cause potential harm to consumers. The FCA stated that a review of the viability of their safeguards must be carried out.⁷ In the event of platform collapse, the firms’ must keep an up-to-date resolution manual that would inform lenders about the situation of their funds should a platform become insolvent.⁸ Wind-down plans are important safeguards for platforms, and the FCA policy states that P2P firms must be able to explain to each lender the firm to which the arrangements have been made, and how the lenders’ money will be held. In addition, they found that many platforms did not have appropriate governance in place to develop their wind-down plans.

The policy statement attempts to strike a balance between restricting an emerging part of the lending market, and the need to protect inexperienced retail investors and lenders. These regulations will attempt to create a transparency whereby all parties are aware of the risks that are taken, and how the platforms will deal with collapse.

The previous impetus of the market has further slowed down by regulatory changes and the exit of Landbay and Zopa, two of the most prominent P2P lenders who have both announced changes to their business models and withdrawal from the market.⁹ Landbay will transition towards institutional lending whilst Zopa has just received a £140million capital injection to become a challenger bank in the retail banking space.^{10 11}

How Deloitte Can help

Market disturbances, such as that of Lendy and FundingSecure, have highlighted the collection of risks involved in P2P platforms’ strategies, operations and governance models. Amidst the turbulence in this space, Deloitte is well positioned to bring our collective experience together to support market participants in ensuring compliance with new regulatory requirements, outline and manage collective risks according to these requirements, and where necessary, bring our experience with litigation protocols and regulatory investigations to support firms through challenging times.

------------------------------------------------------------------------------------------------------------------------------------------------------------

¹ https://www.fundingcircle.com/blog/2019/04/

² https://lendy.co.uk/cms/wp-content/uploads/2019/12/Joint-Administrators-first-progress-report.pdf

³ https://www2.deloitte.com/content/dam/Deloitte/de/Documents/financial-services/deloitte-uk-fs-marketplace-lending.pdf

⁴ https://www.fca.org.uk/publication/consultation/cp18-20.pdf

⁵ https://lendy.co.uk/cms/wp-content/uploads/2019/07/Lendy-Ltd-Joint-Administrators-Proposals.pdf

⁶ https://www.fca.org.uk/publication/policy/ps19-14.pdf

⁷ https://www.fca.org.uk/publication/correspondence/dear-ceo-letter-loan-based-crowdfunding-wind-down-arrangements.pdf

⁸ https://www.fca.org.uk/publication/policy/ps19-14.pdf

⁹ https://blog.landbay.co.uk/blog/2019/11/28/dear-retail-investor

¹⁰ https://blog.landbay.co.uk/blog/2019/11/28/dear-retail-investor

¹¹ https://blog.zopa.com/2019/12/03/zopa-group-announces-140m-fundraise/

Mark Cankett – Partner, Banking & Capital Market Team

Mark is a Partner in our Banking & Capital Markets Assurance Group in London and a co-lead of our Algorithm Assurance team. He has a broad experience across financial services audit, assurance/advisory, regulatory compliance, regulatory investigations and financial services disputes. Mark’s experience has provided him with a strong understanding of algorithmic trading risk and control frameworks across the FS industry. From a regulatory standpoint he maintains close interaction with the UK authorities on this topic and participates in FMSB committee meetings.

Email | LinkedIn

Stephen Farrell – Partner, Banking & Capital Market Team

Stephen is a Partner in our Banking & Capital Markets Audit Group and has a leadership role in the Firm’s financial benchmark assurance and advisory engagements. He has extensive experience in financial services audit, internal audit and regulatory projects. He has worked with a range of banking institutions, having developed a thorough technical understanding of banking products and treasury control practices. He sits on a committee of the FICC Markets Standards Board.

Email | LinkedIn

Gabriela Rodriguez Elesgaray – Senior Manager, Banking & Capital Markets Team

Gabriela is a Senior Manager in the Banking and Capital Markets Audit & Assurance Group and a member of the FS Disputes team. Gabriela joined Deloitte in 2012, following a career in Investment Banking, and has since applied her broad experience and knowledge of derivatives and structured products to a wide range of projects, such as market misconducts, remediation and disputes. Her disputes work includes providing litigation support in a variety of complex expert witness engagements.

Email | LinkedIn

Mayank Varyani – Senior Associate, Banking & Capital Markets Team

Mayank is a Senior Associate in the Markets Assurance & Advisory team within the Banking and Capital Markets Group and a member of the FS Disputes team. Mayank has been at Deloitte since 2019 and has since been involved in a variety of different projects ranging from External Audits, Securitisation and EU BMR. These experiences have provided him with grounded understanding of Banking products, regulatory requirements and a keen interest in the P2P market.

Email | LinkedIn

Nick Main – Associate, Banking & Capital Markets Team

Nick is an Associate in the Markets Assurance & Advisory team within the Banking and Capital Markets Group and a member of the FS Disputes team. Nick started his career at Deloitte in 2019 and has since been involved in a range of projects which have provided him with a prominent understanding of financial products, regulatory requirements and changes.

Email | LinkedIn

BlackRock calls for enhanced disclosures this year in the face of climate urgency

2020-02-05T07:18:00+00:00

The annual letter to CEOs from Larry Fink, Chairman and CEO of BlackRock, acts as a barometer in the responsible capitalism debate. Over the years, these letters provide progressive insight into investor thinking and can almost be seen as a chart of progress towards a more inclusive view of capitalism and purpose-led business.

This year’s letter predicts a fundamental reshaping of finance, brought about by climate change. And it calls for companies to enhance their sustainability and climate disclosures – and act this year to adopt the standards of the Sustainability Accounting Standards Board (SASB) and the recommendations of the Task Force on Climate-related Financial Disclosures (TCFD).

It also sets out BlackRock’s plan to make sustainability the firm’s investment standard: alongside the introduction of enhanced approaches to analysis and investment, Larry Fink also promises to be more active in voting and to divest from companies that generate more than 25% of their revenue from thermal coal¹.

Larry Fink’s observation on system change echoes the view of the governor of the Bank of England, Mark Carney, on the risks of climate change to capital markets: ‘Changes in climate policies, new technologies and growing physical risks will prompt reassessments of the values of virtually every financial asset.’² In fact, because markets respond to future risks, Larry Fink predicts capital reallocation sooner than many will anticipate. The scale and relevance of these risks to business has been highlighted once again in the World Economic Forum’s Global Risk Report 2020, also recently published – where climate action failure alongside biodiversity loss, extreme weather and natural disasters, are seen as the top risks.

It is therefore not surprising that BlackRock has joined Climate Action 100+ and is moving towards sustainable investment practices. This is a powerful development, given the size and scale of BlackRock. Investor actions such as this do have the power to drive market behaviours (another good recent example is Japan’s GPIF’s stance on short selling).

But I also think it is significant that Larry Fink highlights the opportunities for growth and for green finance. He does this in a way that connects the response to climate change to the purpose of the business for long-term value creation: ‘Each company’s prospects for growth are inextricable from its ability to operate sustainably and serve its full set of stakeholders.’

In pursuit of this goal, I think the letter’s call for systemic reporting on ESG and climate change can achieve substantial leverage. BlackRock asks its clients – by year-end – to adopt both the SASB standards and to make disclosures based on the recommendations of TCFD. I welcome this direction, and its reason: to help ascertain whether companies are ‘properly managing and overseeing ESG and climate risks within their business and adequately planning for the future’.

With my corporate reporting hat on, Larry Fink’s letter shows that taking an ‘investor lens’ for reporting on these wider factors is appropriate: it can help drive capital to sustainable enterprise and encourage business to embrace more fully its role in delivering shared prosperity and equitable growth. The rationale underpinning this linkage is neatly summarised in the consultation paper issued at the World Economic Forum on common metrics, prepared in collaboration with Deloitte and others: ‘By measuring and reporting on aspects of prosperity more holistically, companies and their stakeholders can become better informed to protect and enhance assets that contribute to long-term value creation and to society and the SDGs, even when there is not yet a direct link to financial performance’. This statement makes the strong case for connecting wider ESG reporting to financial impact and performance, in the interests of the pursuit of business that embraces purpose and profits together.

However, in welcoming the call from BlackRock, I believe we need to move further and create a system change in standard setting. There is now a large proliferation of voluntary standards, codes, tools and methodologies, developed with genuine intention to provide solutions as to how business works in the context of people and planet. But the number of competing offerings is hindering comparability between reporting organisations and leading to complexity in reporting and greenwashing in the system. It also acts as an excuse for those who prefer to remain opaque or not to report anything. The only way of resolving this is to create global standards for non-financial information, building on the best of what we already have. Moving to standards allows consensus to be achieved among market participants (for example, companies, investors, policy makers, regulators and civil society). This direction was acknowledged as an objective in the WEF paper on common metrics.

How to achieve this, given the urgency of achieving what Larry Fink sets out, will be the subject of my next blog. I shall refer in this to the paper on interconnected standard setting, published in December 2019 by Accountancy Europe.

Further resources:

View our website on climate change, which includes learning videos produced in collaboration with the ICAEW.

Follow this link to read our ‘Closer Look’ publication on climate change and reporting

---------------------------------------------------------------------------------------------------------------------------------------------------

¹Details are set out by BlackRock in a letter to clients.
²https://www.bankofengland.co.uk/-/media/boe/files/speech/2019/remarks-given-during-the-un-secretary-generals-climate-actions-summit-2019-mark-carney.pdf?la=en&hash=C0D3A9F2C86647B04D88E7C0DC23264639D03BE2

Veronica Poole – Partner, Global IFRS leader | UK Head of Accounting and Corporate Reporting

Veronica Poole is a partner at Deloitte, global IFRS leader and the head of corporate reporting. She chairs the DTTL Global IFRS Leadership team (GILT), which provides Deloitte member firms around the world with the guidance and support they need in order to deliver best-in-class IFRS services to their clients, from both a technical and practical perspective. In addition, Veronica is a member of both the DTTL Global and UK Audit Quality Boards.

Accelerating the response to climate change: leadership and momentum

2019-12-13T08:53:54+00:00

The business case for addressing climate change is increasingly clear to companies. But it may be harder for them to assess the scale and urgency of the task that faces us all. A recent article in The Economist neatly captures the challenge – and what a challenge!

‘Reversing the 20-fold increase in emissions the 20th century set in train, and doing so at twice the speed. Replacing everything that burns gas or coal or oil to heat a home or drive a generator or turn a wheel. Rebuilding all the steelworks; refashioning the cement works; recycling or replacing the plastics; transforming farms on all continents. And doing it all while expanding the economy enough to meet the needs and desires of a population which may well be half again as large by 2100 as it is today.’ (21 September 2019)

There are good examples of corporate leadership. For example, I was really pleased to announce four examples of climate leadership at the recent Finance for the Future awards: Ecology Building Society, SSE plc, Stora Enso and Imperial College Business School.

The awards recognise that leadership may take a number of forms. It can be seen in new or purpose-led enterprise providing innovative solutions. But it can also be seen in large, carbon-intensive companies making clear commitments and putting in place plans and targets to support the transition to low-carbon business. Together, these examples are accelerating the response by sectors to climate change and providing solutions to enable the transition. And these companies show that thinking on climate change should be embedded within the strategy and business model of the organisation and not seen as a separate silo.

Corporate leadership is not enough on its own, of course. We also need to direct capital to sustainable enterprise. Many investors are showing leadership, especially through groups committed to ensure action on climate change is taken by companies that they invest in. For example, the Climate Action 100+ group of investors has written in its 2019 Progress Report: ‘Climate change requires that companies we engage with undertake demanding shifts in strategy, capital allocation and technological deployment.’

As a result, transparent and clear climate and broader ESG information is critical. This is the way that investors understand how resilient business models might be in light of the complex and interconnected risks that companies face. It is also essential for companies to develop high-quality measurement in order to manage their businesses effectively.

The accounting profession is in a unique and critically important position to support this goal - not only as trusted advisors to the boards of companies, but also as auditors that challenge the information that companies report.

But it is also becoming clear that we need to develop a more connected system for standard-setting that includes climate change and ESG. For example, a group of investor bodies have written that, ‘it is incumbent on the standard-setting organizations to present a coherent vision of how these standards can and should fit together¹. And standard-setters themselves have heard this call. Feedback received as part of the Corporate Reporting Dialogue’s alignment project suggests stakeholders believe that, ‘what is really needed is one strong, internationally-recognised and used set of standards for environmental, social and governance (ESG) reporting’. The case for action to develop a global solution for standard-setting in this area is now approaching a tipping point.

We need political and regulatory leadership to promote transparency and action. A good example of leadership is the European Green Deal that aims to make Europe the first climate-neutral continent by 2050. In the UK, we can point to the UK government’s Green Finance Strategy, and its expectation that companies will be reporting using the TCFD recommendations by 2022. Regulators such as the FRC have welcomed the strategy and made clear their own expectations of companies and auditors. And the FCA has said it will consult on further climate-related disclosures by certain firms.

Leadership on multiple fronts can help to address the urgent challenge we face. Leadership by business, policy makers and regulators, and action to ensure consistent information is available to direct capital to sustainable enterprise, will be important drivers of the global transition to a low-carbon economy.

See our learning programme produced in collaboration with the ICAEW here.

Veronica Poole – Partner, Global IFRS leader | UK Head of Accounting and Corporate Reporting

Veronica is a Senior Accounting Technical Partner and DTTL Global IFRS Leader and UK National Head of Accounting and Corporate Reporting. She chairs the DTTL Global IFRS Leadership team (GILT), which provides Deloitte member firms around the world with the guidance and support they need in order to deliver best-in-class IFRS services to their clients, from both a technical and practical perspective. In addition, Veronica is a member of both the DTTL Global and UK Audit Quality Boards.

Understanding sensitivity disclosures on expected credit losses

2019-12-02T08:38:14+00:00

Since its introduction IFRS 9 has caused considerable interest, especially with respect to the potential volatility that it may cause. How a firm’s ECL may change under different economic scenarios is important in understanding whether its estimates are “unbiased” (including whether an appropriate level of both upside and downside credit risk has been incorporated) and in understanding potential earnings (and capital) outcomes in different economic environments.

The interaction of the standard’s objective to “bring forward” future loan losses to today’s P&L with the non-linear¹ impact a distressed economy can have on loan losses increases volatility compared to IAS39, where losses were booked only when loans went bad. This means that if a firm’s view of the future economy deteriorates, and their expectation of future credit losses increases, a material P&L charge could be incurred today despite no cash losses having materialised.

Information touching on these areas is presented as part of “estimation uncertainty” disclosures in firms’ accounts under IFRS and also via regulatory stress testing disclosures.

Firms’ sensitivity disclosures are evolving and each set of disclosures, both accounting and regulatory, has its own limitations for understanding economic sensitivity. Because of these limitations, sensitivity disclosures should not be used as a proxy for forecasting banks’ performance under different economic conditions while stress test results are an imperfect worst-case representation of volatility under stress.

Insight into sensitivity is obscured for some firms that are currently using large post model adjustments to reflect downside risk not currently being captured through their models or economic scenarios. Comparison between firms is difficult because of differences in disclosure, differences in credit fundamentals (i.e. loan portfolio mix, credit management and recovery practices) and differences in models (i.e. modelling choices and the performance of those models).

Sensitivity disclosures are in the spotlight of analysts and regulators at the moment. We would expect a greater degree of consistency to emerge over time and expect the impending second DECL report to support that.

What sensitivity disclosure is required?

The requirements are set out in IAS 1 Presentation of Financial Statements:

An entity shall disclose information about the assumptions it makes about the future, and other major sources of estimation uncertainty at the end of the reporting period, that have a significant risk of resulting in a material adjustment to the carrying amounts of assets and liabilities within the next financial year.

Estimation uncertainty is not a defined term, but the standard explains how it can be disclosed:

The assumptions and other sources of estimation uncertainty […] relate to the estimates that require management's most difficult, subjective or complex judgements. […]

Examples of the types of disclosures an entity makes are:

(a) the nature of the assumption or other estimation uncertainty;

(b) the sensitivity of carrying amounts to the methods, assumptions and estimates underlying their calculation, including the reasons for the sensitivity….

Further recommendations on how these disclosures can be presented were included in the initial report published by DECL, a disclosure taskforce group set up by UK regulators and including members representing the major UK banks, investors and analysts, whose initial recommendations were published in November 2018 with a follow-up released later this year. The key additional recommendations were that:

Multi-factor sensitivity analysis should usually be primarily based on the same economic scenarios that are modelled for the purposes of estimating ECL... if single-factor disclosures are provided, usually they would be provided in addition to multi-factor sensitivity analysis and they should be accompanied by an explanation of their disclosure explaining the limitations of any sensitivity/uncertainty disclosures.

Note that the report included other recommendations as well, but in this blog we will focus specifically on multi- and single-factor sensitivities.

What has been published? Multi-factor sensitivities

All major UK banks (other than those using monte carlo approaches) published a form of scenario-based sensitivity analysis. These disclosures present ECL at the reporting date under the assumption that 100% probability is assigned to a particular macroeconomic scenario. Below is how this disclosure was presented in the Barclays accounts:

Most banks updated the allocation of exposures between Stages 1 and 2 for each specific scenario used in the sensitivity analysis (“re-staging”). This is different to reported staging, which is based on weighted Multiple Economic Scenarios (MES).

For downside scenarios the ECL is higher because Probability of Default (PD) and Loss Given Default (LGD) were re-measured and because lifetime credit losses were recognised for additional accounts that were moved to Stage 2 based on the “forward look” which would have been considered as Stage 1 with only 12 months’ losses recognised for weighted MES.

This approach is similar to the BoE’s ACS stress test, where “perfect foresight” of a single distressed scenario is used throughout the stress, and results in a large increase in Stage 2 accounts on day 0 as the expected impact of the future economics is reflected in the “forward-look” aspects of staging. However, it differs to stress testing because firms have mainly reflected changes in the ECL model outputs rather than also flexing post model adjustments. Because, in some banks, PMAs constitute a significant proportion of overall ECL, excluding them may represent a significant limitation of the sensitivity disclosures.

For example, Barclays noted:

One consequence of “re-staging” is that it is not possible to recalculate the weighted average ECL in the financial statements from the outcomes of the individual scenarios. This was highlighted by Barclays:

Some other banks did not “re-stage” (e.g. Lloyds) and all loans were treated as if they stayed in the same stage as the statutory results. This means that the disclosure does reconcile to the reported statutory numbers and will give a structurally lower sensitivity for downside scenarios compared to firms that re-stage.

The balance of Stage 3 impaired loans is the same under all scenarios for some firms. This happens because Stage 3 loans are only recognised as such when there is an identified loss event at the reporting date. Macroeconomic forecasts do not impact it, hence the composition of Stage 3 does not change. This differs to Stage 2, which is driven by the expectation of future deterioration in risk, and to stress testing, where the prediction of future Stage 3 population is an important part of the exercise.

Strictly speaking, different scenarios should give a different ECL for Stage 3. For example, when the recovery strategy is for real estate collateral to be sold, recovery will be impacted by different forecast property prices.

However, the time horizon for recovery of Stage 3 exposures is normally relatively short, and the expected cash flows are not materially impacted. This led some banks to conclude that the impact of different scenarios on Stage 3 ECL is too immaterial to be presented in sensitivity disclosures. For example, RBS noted the following:

What has been published? Univariate sensitivities

Some banks also disclosed univariate sensitivities which showed the impact an arbitrary (albeit realistic) change in a single input parameter (such as PD or HPI) would have on the ECL value. For example, LBG presented the following:

These disclosures are useful to stakeholders, but it is important to understand their limitations.

As this kind of analysis is presenting the sensitivity to each parameter on its own, it is not appropriate to aggregate the results of each single-factor sensitivity because of the correlation of the effects of the parameters. Furthermore, a single-factor sensitivity analysis should not be extrapolated due to the non-linear effects of more extreme economic conditions.

The way in which the sensitivity is applied can also lead to different results between firms. For example, Lloyds note that they have phased in their univariate sensitivity from the Base Case starting point over three years. A different approach/shape to applying the same sensitivity would give a different outcome.

Key observations from published sensitivity disclosures

Below we have summarised key observations on sensitivity disclosures from the analysis of 2018 annual reports of major UK banks. We excluded Standard Chartered from this analysis as they adopted a Monte Carlo-based methodology rather than the one based on discrete scenarios.

	Exposures re-staged in sensitivity?	PMA included in sensitivity?	Univariate sensitivities included?	How many univariate sensitivities?	% Difference downside /reported ECL	% Difference reported ECL /base case ECL
RBS	Yes	Silent	Yes	3	31%	N/A base not disclosed
HSBC	Yes	Silent	No	-	99%	N/A base not disclosed
Barclays	Yes	Excluded	No	-	58%	2%
Lloyds	No	Excluded	Yes	4	46%	6%
Santander	Yes	Silent	Yes	1	143%	22%

What have the regulators said?

In October 2019 the FRC published a thematic review of IFRS 9 disclosures in the first year of application. They had a view that disclosures regarding the application of MES and methodology were generally good but that there is scope for improvement in the disclosure of assumptions underpinning firms’ scenarios.

They also noted that firms “made a reasonable attempt to show the sensitivity of the ECLs to changes in economic variables” but that there was still scope for improvement. In particular they highlighted the lack of consistency between firms and that they consider banks should “not assume that sensitivities will not affect Stage 3 provisions”.

As such a critical window on firms’ ECL approaches it seems inevitable that both regulators and auditors will guide more firms to improve their sensitivity disclosures and encourage convergence in the information provided.

--------------------------------------------------------------------------------------------------------------------------------------------------------

¹To illustrate, if we have a mortgage with LTV of 75%, expected losses will be negligible until house prices fall significantly enough so that net recoveries from the sale of the collateral do not cover the exposure. Until that point, there will be very little sensitivity of ECL to forecast house prices, but after this point, the losses will start rising very quickly, resulting in a non-linear relationship between house prices and credit losses.

Richard Tedder – Partner, Banking and Capital Markets

Richard is a Partner in Deloitte’s Audit & Assurance function and leads the Credit Risk team. He has 20 years’ experience working in both banks and advisory roles.

Mikhail Osotov – Senior Manager, Banking and Capital Markets

Mikhail is a senior manager in Deloitte’s Credit Centre of Excellence with over 10 years of experience working with banks and other financial institutions. He specialises in credit risk and loan impairment.

IFRS 17 for Internal Audit – IFRS 17 Assurance Timeline

2019-11-04T13:16:06+00:00

In late 2018, the International Accounting Standards Board (“IASB”) extended the effective date for IFRS 17 Insurance Contracts, originally 1 January 2021, by one year to 2022. While at the time of writing some are in favour of further extension, 2022 remains the effective date in the current version of the Standard.

Internal Audit functions in the UK are at different stages with regard to IFRS 17 assurance planning. Many have completed audits of programme readiness during 2019, with some also auditing implementation milestones achieved by the business. However, a minority of organisations have stood back and built an end-to-end IFRS 17 Assurance Timeline that tracks the business journey from development to implementation and into business as usual.

Assurance Timelines are a powerful way for IA to clearly set out its view of the topics within IFRS 17 where assurance is most needed, define the critical path to delivering an effective assurance, and demonstrate appropriate coverage of the programme as a whole.

The Audit Universe

Developing an organisation-specific audit universe for IFRS 17 is the first step towards building an effective IFRS 17 Assurance Timeline. Some of the areas impacted by IFRS 17 implementation may not be obvious, such as remuneration, binding authorities (and other contracts which may refer to IFRS 4 insurance accounting definitions), management information, Key Performance Indicators, SoX documentation, GDPR and more. Internal Audit teams should engage with internal IFRS 17 specialists, the project implementation team, Finance, Operations, actuarial staff and senior management to obtain in-depth insight into the organisation’s IFRS 17 objectives and the expected impacts on business processes, and to identify new risks that may arise as a result.

Obtaining additional information from external sources such as IASB interpretations, IFRS 17 publications, external technical accounting forums and working groups would greatly help Internal Audit teams to develop a comprehensive audit universe for its IFRS 17 Assurance Timeline.

The following table set outs the areas that would typically be expected to be impacted by IFRS 17.

Area	Processes
Policies and Methodology	Accounting Policies (transitional and ongoing, including IFRS 9 for deferring organisations), actuarial methodology, financial reporting (statutory and Group), management of accounting mismatches, financial controls and related documentation.
People	Training, project resources, budgets, conflict management, cross functional knowledge, technical knowledge and availability of actuarial resources.
Operating Model	Reserving Committees, Assumption Change and reserving processes, operational readiness, models and model governance, the collaboration of Finance and Actuarial teams, internal and external reporting, and external stakeholder management.
Data	New data requirements, data quality, data transformation, transition plans and data protection.
System Technology	Data availability, new systems and significant change to existing ones, and the structure of the general ledger and chart of accounts.
Performance Management	Key Performance Indicators, management information, business planning and forecasting, and profit/premium income-based remuneration.

Assurance Timeline

Our one-page guide to the IFRS 17 Assurance Timeline provides over 20 questions that Internal Auditors can ask themselves to develop an effective Internal Audit Assurance Timeline, satisfying the assurance needs of the business associated with IFRS 17 implementation. The questions cover the areas set out below.

Significant assurance areas

Within the IFRS 17 audit universe there will be certain elements that Internal Audit and stakeholders feel are critical to the success of the programme, and therefore are areas where assurance is most needed. These should form the spine of the Assurance Timeline and be protected from scope creep or slippages. Avoid the pitfall of failing to engage with stakeholders when doing this, as this can result in conflicting opinions on the objectives of Internal Audit’s work on IFRS 17.

Alignment to implementation programme

One of the major benefits of creating an Assurance Timeline is that it can serve as a straw man to challenge and refine planned audit timings with the business, and the overall schedule of planned audit activities. This will also enable Internal Audit to confirm lead times to bring in or develop the right skills within the function to effectively challenge the business in significant assurance areas, and to discuss and agree with the business where auditors can and cannot flex timings to match changes in the IFRS 17 programme.

Key stakeholder buy-in

While having an IFRS 17 Assurance Timeline is valuable to Internal Audit in its own right, the real value comes from having agreement with key stakeholders on the end-to-end assurance areas and identifying where stakeholder objectives are at cross purposes at the beginning, rather than the end, of the project. Internal Audit may also build in IFRS 17 continuous monitoring inputs and define ‘audit triggers’ that can be agreed with the business in advance.

Holistic assurance

As well as ensuring significant assurance areas are covered, Internal Audit can use its IFRS 17 Assurance Timeline to illustrate to stakeholders which aspects of the programme will and won’t be covered. This can help to re-define audit scopes to better meet the needs of the business. It also presents an opportunity to explore where Internal Audit can seek to rely on second line assurance, if applicable, and to pinpoint where ongoing initiatives such as the use of data analytics or data science can be embedded into the plan.

Critical path for assurance

One of the threats to both IFRS 17 core implementation plans and the corresponding IFRS 17 Assurance Timeline is from unidentified interdependencies between stages of the programme that lead to re-work or hinder future progress. When finalising the Assurance Timeline, Internal Audit should confirm that the phasing of audit activities is appropriate both to the business and the function itself, including allowing time to remediate audit findings. Internal Audit should remain alert to emerging changes to the programme, whether driven by internal or external factors.

Developing an IFRS 17 Assurance Timeline is paramount to spark discussion with stakeholders, confirm the rules of engagement and record agreement of the input and insight expected from Internal Audit at the outset. In some cases it can also bring into sharper focus the organisation-wide impacts IFRS 17 has on an insurer, leading to increased demands on Internal Audit and its people. Being proactive and tackling the matter early is therefore critical to ensure effective and insightful assurance is delivered, both during IFRS 17 implementation and beyond.

Download the summary here

Link to our previous publication.

Check out our webpage to know more and to get updates on IFRS 17, subscribe to our newsletter.

Charlie Scarr – Senior Manager, Audit & Assurance

Charlie has been a Senior Manager within Deloitte’s Insurance Audit group for the last 3 years. He is a qualified accountant with 9 years of experience providing audit and assurance services to general and life insurance clients. He focuses on the provision of internal audit and controls advisory services and manages a portfolio of internal audit engagements.

Charlie began his career with Deloitte with a focus on SOX controls and spent two years seconded to Deloitte Canada leading the audit of a leading US listed life insurer. Since returning to the UK in 2017, Charlie has continued to manage the delivery of a portfolio of client internal audits as a key member of Deloitte’s Insurance Internal Audit team, working in the main with large global insurers.

Charlie is the Insurance Audit group’s lead on IFRS 17 for Internal Audit, delivering training, advice and support to assurance teams on the subject. He specialises in audits in the areas of Finance and financial control. As well as delivering and managing internal audit programmes, he has also worked on IFRS 17 deliverables for London Market clients.

Email | LinkedIn

IFRS 17 for Internal Audit – Implementation Roadmap

2019-09-18T12:27:20+01:00

This is the first in a series of posts focusing on themes and hot topics relevant to Internal Audit functions in organisations in the process of adopting IFRS 17 Insurance Contracts.

IFRS 17 is the most significant change in insurance accounting for a generation. For many insurers, particularly in the Life Insurance industry, understanding and delivering the necessary changes is complex and permeates the entire organisation. With this in mind, it is clear that an effective implementation plan that is well understood by its users is critical to an organisation’s IFRS 17 project running successfully.

Although there will have been iterations, most organisations’ implementation plans will now be close to their final form. A simple first step for Internal Audit is to understand management’s implementation plan in detail from methodology, Proof of Concept, build, dry runs right up to go-live including any regional rollouts and dependencies. Internal Audit should benchmark the status and costing of management’s IFRS 17 programme to similar organisations in the industry, and challenge the reasons for both positive and negative variances to peers.

Internal Audit can consider the above and management’s own risk assessment around project delivery when evaluating the implementation plan. Common areas of focus for auditors reviewing an IFRS 17 implementation plan include:

Governance – because technical accounting decisions made early in the project will define many subsequent actions in the programme, there should be appropriate governance to challenge and anticipate downstream dependencies stemming from accounting and architecture decisions.
Phasing – because IFRS 17 impacts so many parts of an organisation, IFRS 17 implementation will involve a number of workstreams that depend on each other. Strong implementation plans will identify interdependencies and the associated risks and seek to manage the sequencing of activities, mitigating the risk of delays to delivery.
Testing and Dry Runs – the scale of validation of data, technology, financial close processes and other aspects of IFRS 17 implementation will vary by organisation based on the nature of its insurance business and certain accounting policy and methodology decisions made. Internal Audit should understand whether the implementation plan accommodates sufficient testing time.
Suppliers – IFRS 17 will typically require the involvement of a number of external suppliers. Auditors should check that implementation plans are designed to manage execution risk as it relates to suppliers, including availability, oversight, cost monitoring and more.
Resourcing – IFRS 17 will demand significant internal resource to ensure a successful implementation, however BAU reporting will continue until 2022. Resourcing plans can make or break a project, so Internal Audit should seek to understand how the business has set itself up for success and performed contingency planning around resourcing.

For individual organisations, there are likely to be a number of other risk factors that might impact delivery of IFRS 17, both internal (such as turnover of key project staff) and external (such as late clarification of requirements by the IASB) that can be layered into audit scopes.

An audit that considers an organisation’s implementation roadmap – whether on its own or as part of a broader scope – is a way to provide timely feedback and insight to the business on potential areas of delivery risk that management may not have identified. As insurers’ implementation plans crystallise, auditors should grasp the opportunity to provide confidence to management that plans are sufficiently accurate and granular to lay the foundations for successful project delivery.

Download the summary here

Check out our webpage to know more and to get updates on IFRS 17, subscribe to our newsletter.

Charlie Scarr – Senior Manager, Audit & Assurance

Email | LinkedIn

“Minimum” controls: how much is enough ?

2019-07-05T10:02:29+01:00

Current controls climate in the UK

Financial controls are increasingly in the spotlight. Regulator and investor interest is shifting from historic financial metrics to looking for the signs of a well-run business, a strong management team and a positive future outlook. This is becoming more evident with the Government consulting on a strengthened framework around internal controls, on a similar basis to Sarbanes-Oxley in the US, in light of recent audit failures and auditors contemplating publicaly calling out control failures.

It is more important than ever for companies to be forward thinking in the value they place on controls and to be proactive in how they explain that investment to their stakeholders.

A well run business, underpinned by an effective control environment, that maximises the use of technology, is more likely to win in a challenging and disrupted market, adding more value to its investments and managing its costs.

A modern approach to financial control, that focuses on “what could go wrong?” and leverages technology whilst understanding the incremental risks it brings, is an asset to any business that will save cost year on year and support a strong business culture of getting it “right first time”.

What’s the business case ?

It can be difficult to attribute the benefits of financial controls to a return on investment, at least until it’s too late and losses have occurred. The gap that failed will be plugged, but where the culture is not about getting it right, there will always be another costly surprise ahead.

Focusing on the right controls at the right level of depth will:

save the time and cost spent on fixing issues later;
enhance profitability by making systems, processes and people more efficient;
build stakeholder credibility; and
support a strong business culture of getting it right first time.

In the same way a company invests in an insurance policy to safeguard its business, protecting cash and assets from future losses is a component of sustainable success.

Using a net present value model can calculate the benefit or cost, however given the difficulty of reliably estimating the probability, timing and quantum of future losses, the value of such decision making tools, in all but the most mature control environments, is limited.

One only need look at recent news headlines and ask “had controls had been in place, would the company have issued a profit warning?”, “would a fraud have been prevented?” or “could the company have survived?”. There were 89 profit warnings, across all FTSE indices, in Q1 2019 with 44% of these making warnings in the previous 12 months. Whilst these might not be directly attributed to weak control environments, the precedent in the US for fraud and failures being addressed through a strong control environment is well understood.

Controls are essential to any strong company and there is no robust argument that appropriate controls are not cost effective and an essential component of value.

How much is enough?

If “minimum controls” means “de-prioritised”, “ad hoc” or “not evidenced” then that’s not enough. If “minimum” means “enough to prevent or detect errors” that’s good. Clearly “minimum” is a subjective term and we prefer “Key” or “Critical”, but the real answer lies in defining and communicating what is right for your business.

Starting with a thoughtful financial risk assessment is hugely important. In our experience, financial risk assessment is regularly performed at too high a level, often as part of a wider business risk assessment, to enable the Board to properly understand the financial risks or to identify the essential financial controls.

There truly is no ‘one size fits all’ approach although it is widely accepted that there are a number of good practices that can be applied across many organisations. However technology change is bringing new risks and opportunities. Good practice is shifting towards automated preventive controls away from manual detective controls and control data analytics regularly provide more insight than a traditional review. Not all companies are quick to eliminate traditional, but now redundant, controls.

Key features of a modern controls framework are transparency evidencing ongoing effective operation, focus on culture, standardisation, consistency, automation, removal of redundant controls and sustainability. Controls should reflect the way the business is run, not be a separate compliance exercise.

Documentation is about sustainability and reducing key man risk, consistency, transparency and rigorous thinking in terms of how the control addresses the risk which we’d argue has value to any business. Knowing your team is doing a really good job and being able to demonstrate that, is more valuable than believing nothing has gone wrong so far.

Ultimately, ‘enough’ is determined by each organisation through a high quality financial risk assessment and the identification and tailoring of automated vs manual controls. We believe that ‘minimum controls’ should include ‘enough’ to protect from reputation damaging fraud, significant error and ultimately failure. This requires a level of built in contingency to be strong enough to withstand unexpected events and issues and a regular reassessment of risks. Company stakeholders in the current climate want to be reassured by language such as strong, not minimum.

By implementing a strong financial controls framework a business will be in a confident position to drive the business forward to success supported by their stakeholders who are assured of the sustainable future performance of the business.

Sonya Butters – Partner, Accounting Operations Assurance Leader, Audit & Assurance

Sonya is a controls specialist, Audit partner and the leader of our Accounting Operations team. Accounting Operations is a team of audit trained accountants who support our non-audit clients in modernising their finance functions, embedding controls and being ready for audit. She works with UK and US, private and listed companies. Her project experience includes US and UK IPOs, SOX and JSOX implementations, controls and finance transformation and close optimisation.

Dan Cane – Director, Accounting Operations Assurance, Audit & Assurance

Dan is a Director in our Corporate Assurance Practice in London. Dan has significant experience in delivering finance transformation, focusing on developing and enhancing internal control environments and improving management information. He has worked with clients to facilitate their risk identification processes, helped them implement control frameworks and supported them to streamline and standardised their financial processes.

Dan uses his experience and expertise in finance optimisation and controls to advise clients across a variety of sectors.

Sophie Parry – Senior Manager, Audit & Assurance

Sophie is a Senior Manager in Deloitte Private in London with over 10 years of experience in the Consumer Business industry, spanning across Audit and Assurance. I have extensive experience providing Audit & Assurance services to a range of businesses, from multinational FTSE 100 clients to smaller private entities. Within Audit I have specialized in real estate, hospitality and retail. Within Assurance, I sit within both THL Advisory and Controls Assurance, plus am helping lead the proposition for Front Half Assurance services in the UK. I also have secondment experience to a high profile FTSE 30 business and have enjoyed an appraisal role within the group for many years.

The financial impacts of climate change – the time to act is now

2019-06-26T10:18:25+01:00

‘A transition to a green and low-carbon economy is not a niche nor is it a “nice to have” for the happy few. It is crucial for our own survival.’ These are not the words of an NGO – they come from a report issued by a group of over 30 central banks, including the Bank of England. The report says that climate-related risks fall ‘squarely within the mandates of central banks and supervisors’.¹

Climate change is not only a systemic risk to financial stability. It impacts all businesses in all sectors, whatever their size. We don’t need to look far to find compelling facts to support these claims. For example, a United Nations (UN) study has concluded that some 5 billion people could have poor access to fresh water by 2050. And a further UN report has modelled the financial risk of a transition to a low-carbon economy to be over 13% of overall portfolio value – in the order of just under $11 trillion.

Business is responding. This is a clear conclusion of the Task Force on Climate-related Financial Disclosures (TCFD) in their 2019 Status Report. TCFD is achieving stronger endorsement – and increasing disclosure quality. It also offers a promise of more to come. Over 90% of the preparers who responded to the report’s survey said that they will implement TCFD recommendations, and of those, two-thirds say they will do so within the next three years.

It is pleasing to see recognition in the TCFD progress report of the areas where businesses are already improving their thinking and reporting. Better understanding of the impact of climate change on the company. A clearer picture of the risks and opportunities. Selecting and disclosing metrics. These are helping investors to incorporate climate-related financial disclosures into their decision-making processes.

But it also clear from the progress report that companies still find it hard to assess the resilience of their business, to embrace scenario planning, and to integrate their climate-related risks into their enterprise risk management process.

It is therefore not surprising that investors say they want more clarity still on the financial impacts. The TCFD survey reveals that less than one quarter of the respondents have involved the finance team in implementing the recommendations – more input from them could drive this change.

We are helping to push this agenda forward. We have launched a new learning programme, developed in collaboration with the ICAEW, which seeks to help directors and finance professionals to implement change, manage risk and take advantage of the opportunities created by climate change. It also considers impact on financial statements and how to translate climate change effects into tangible measurements. Finance professionals can use the materials to evaluate the financial impacts and question assumptions across the financial planning, management and reporting cycle. And this equips finance teams to enhance climate-related financial disclosures, and therefore provide better information to investors.

Climate change is an existential threat that demands urgent attention. There can be no more ‘business as usual’ if companies are to protect their value, manage risks and future-proof their organisations. Our new website sets out the business case for action and practical steps for change, to help companies place their climate change response as a key element of their business models.

_________________________________________________________________________________

¹Foreword to A call for action: Climate change as a source of financial risk, Network for Greening the Financial System, April 2019

Veronica Poole – Partner, Global IFRS leader | UK Head of Accounting and Corporate Reporting

MiFID II RTS 6 Requirements: Annual Self-Assessment - Guiding your firm through uncertainty

2019-05-20T13:11:58+01:00

The finance industry is becoming increasingly automated with many banks and financial institutions using or interacting with algorithms. The amount of trading algorithms has significantly increased in recent years. This trend is driving efficiencies, lowering costs and enabling firms to gain a competitive advantage. However, there is now a heightened regulatory focus with specific requirements over algorithms to ensure accountability and fairness in their use.

Algorithms that fall under the purview of the Article 17 MiFID II requirements could be client facing, assisting or recommending financial instruments to be purchased or sold and/or executing orders themselves on behalf of clients or the firm. RTS 6 requires firms to annually perform a Self-Assessment and validation process where firms engage in algorithmic trading activity¹. Since the implementation of MiFID II in January 2018 many firms have completed or are in the process of completing their first round of Annual Self-Assessments.

The scope of RTS 6 is broad and applies to firms that fall under the definition of an investment firm within MiFID II². It should be noted that the exemptions that insurers, emissions operators/dealers, CIUs and own account commodity dealers are usually granted under MiFID II will not apply if they are members or participants of regulated markets or MTFs³. Furthermore, RTS 6 also defines and differentiates between investment decision and order execution algorithms⁴.

Against this backdrop of regulatory requirements and complexity in its interpretation our team has worked alongside industry leading market participants to help them navigate through the Annual Self-Assessment, gaining an insight into the challenges surrounding the process and designing an approach to overcome them.

Key Areas of Challenge

There have been a number of challenges faced by firms throughout the Self-Assessment. In our view, many firms have faced issues when embarking on the Annual Self-Assessment in terms of distinguishing between their responsibilities to separately assess, validate and audit their algorithmic trading controls. Identifying appropriately skilled resources across the three lines of defence has also been a key issue.

In the context of these challenges our Algorithm Assurance team has detailed below a high level view on how firms should approach the Annual Self-Assessment across the key stages of planning, assessment, validation and audit.

Planning

The planning phase is crucial to ensure that across the firm all functions understand their responsibilities and are agreed on the timeline and scope of the Self-Assessment process. If not done properly, there is a risk that an inconsistent approach is applied across business lines which could delay the completion of the validation report and require elements of the assessment process to be revisited.

The Business, Compliance, Risk Management function and Internal Audit should convene before the Self-Assessment process commences and agree on the following:

The period being assessed and the assessment date.
Key definitions to be agreed allowing all stakeholders to understand what is in scope
The timing of the Self-Assessment, validation report, audit procedures, audit report and any relevant approvals.
The scope: which algorithms and legal entities are regulated by MiFID II and will form part of the annual Self-Assessment and which articles of the regulation apply (for example, is the firm a Direct Electronic Access ‘DEA’ provider thus making the DEA requirements in RTS 6 applicable?).
Roles and responsibilities of each stakeholder in the process.
The format of the validation report.
The level of evidence and testing required. For example, will this include testing for operating effectiveness of controls over the period?
Control Owners and approvals - who will be signing off on the Self-Assessment (e.g. will this require Senior Manager sign-off?) and validation report (e.g. Head of Risk or Risk Committee?)

Planning is an important step to guide the path forward, although it is also necessary to allow for flexibility in the planned approach (and timelines) to allow for inevitable issues and challenges that may arise throughout the execution of the work that may require certain elements of planning to be reassessed.

Self-Assessment (performed by Control Owners):

The Assessment phase can be observed as being similar to other traditional Internal/External Audit processes across the bank. Control Owners will have to attest compliance and agree remediation if deficiencies have been identified. Key considerations in this phase are listed below:

Each function should attest to their compliance with the requirements relevant to that function for RTS 6, 8 & Article 17 of MiFID II.
Each function should maintain appropriate evidence regarding operation of key controls and provide evidence of this to the Risk Management function.
Where non-compliance has been identified, key stakeholders must be consulted to agree appropriate remedial action and document this in the report.
The Self-Assessment must also include consideration of factors in Annexure I (i.e. nature, scale and complexity).

During this phase of work it is also important to keep in mind the independence of each function as part of the Self-Assessment process. If there is substantial support from the validation team in producing the Self-Assessment there will likely be challenges raised (e.g. by Audit) regarding the ability for that same team to then validate the assessment.

Validation (performed by the Risk Management Function):

RTS 6 Article 9(2) ascribes responsibility to the Risk Management function for drawing up the validation report. However, from a practical perspective we have seen Business Control, Op Risk and/or Compliance undertake the validation review of the Control Owner’s compliance statements. In our experience the Risk Management function often disagrees with initial conclusion, due to a lack of clarity on up front definitions or the process applied in executing the work. It is also necessary for the Risk Management function to determine what additional steps need to be taken to ensure compliance. A summary of key considerations for the validation phase are highlighted below:

Validation should be in the form of a design effectiveness or operating effectiveness test of key controls. We have noted through our discussions with firms that the extent of testing remains an area of inconsistency across the market. Evidence of the functioning of the control should be reviewed to assess whether the Risk Management function agree with the Control Owner’s conclusion, providing challenge where necessary.
For items assessed as non-compliant, there should be an assessment to ensure that the documented remedial action is sufficient to remediate any issues identified.
Where additional non-compliance has been identified, appropriate remedial action must be agreed.
In assessing the conclusions for each article, the Risk Management function should also assess any existing remediation plans and whether these indicate compliance or non-compliance with the relevant requirements.
The validation report should include an overview of the validation approach, extent of testing and procedures performed. It should also include a conclusion detailing underlying evidence inspected to support the validation report.

Audit:

The Internal Audit function then takes the next step in the process. This is essentially to provide oversight over the validation report that the Risk Management function has produced, ensuring that the governance and conclusions reached are valid. They also perform a final check to ensure that all instances of non-compliance have been linked to appropriate remedial actions. Key considerations that should be included for the scoping and execution of this work by Internal Audit are:

Article 9(3) of RTS 6 states that Internal Audit are required to audit the validation report. However, there is no further guidance on how this audit should be performed. In practice we have noted that this typically entails an audit of the Risk Management function’s process to validate the Self-Assessment conclusion for each article, including a review of the validation strategy and the appropriateness of the extent of procedures performed.
A review of the governance around the process i.e was the scope, timing and approach approved by the appropriate individuals / governing bodies and have the Self-Assessment results and validation report been signed off by the appropriate individuals (e.g. senior managers)?
A review of the validation conclusions reached should be conducted by re-performing the validation procedures for a sample of higher risk areas. To avoid duplication of effort, this could include reliance on audits which were completed during the period.
Ensuring that all non-compliance areas, identified as part of the Self-Assessment and validation process, have been linked to approved remedial action and this has been communicated to the Compliance function.

Conclusion

The MiFID II RTS 6 Annual Self-Assessment process can be seen as a robust approach in helping to ensure that financial institutions which fall under its scope are continuously assessing their controls around algorithmic trading. The power of automation in the financial services sector cannot be understated, with flash crash scenarios over the past decade demonstrating the disruption that rogue code or ineffective controls can cause.

Up-front planning is critical, to ensure roles and responsibilities, definitions, timelines and approach are agreed in the first instance. Internal Audit should be engaged early and agree on scope, approach, format and content of the validation report. It should be noted that It is our view that the road to full implementation will take some time, as resourcing and the interpretation of regulations across businesses in scope are challenged which will remain for the foreseeable future.

Deloitte have strong and extensive experience in various aspects of the Self-Assessment process and are able to guide financial institutions through a process that may seem onerous and complex at the outset. If you would like to discuss the MiFID II Annual Self-Assessment or any other areas of algorithmic trading risk and control, please do get in touch.

______________________________________________________________________________________________

¹RTS 6 MiFID II Article 9(1)
²Article 4 (1) MiFID II: “Any person whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis”
³Article 17(1) MiFID II
⁴Investment decision algorithms that do not initiate orders or the timing, price or quantity of an order do not fall within the scope of MiFID II. However, the FCA has stated best practice would subject these algorithms to the same standard of controls as within MiFID II

Mark Cankett – Partner, Banking & Capital Market Team

Email | LinkedIn

Stephen Farrell – Partner, Banking & Capital Market Team

Email | LinkedIn

Barry Liddy – Senior Manager, Banking & Capital Markets Team

Barry is a Senior Manager in our Banking & Capital Markets Assurance Group in London and has over 15 years’ experience spread across industry and financial services. Barry has lead several large projects specifically focused on enhancing trading control frameworks and assessing their design and operating effectiveness to ensure full regulatory compliance. Barry is currently a lead in our Algorithm Assurance team and has been in direct dialogue with regulators and market participants on this topic.

Email | LinkedIn

Matthew Hedding – Manager, Banking & Capital Markets Team

Matthew is a Manager in our Banking & Capital Markets group in London and is a member of our Algorithm Assurance team. For the past 3 years, Matthew has provided support to the controls and supervision team of a Tier 1 global banking institution with respect to their Global Markets remediation activity and enhancement of their Algorithmic Trading Control Framework.

Email | LinkedIn

Please find attached a link to our Algorithmic Assurance webpage, which we will be regularly updating with blog posts and articles on hot topics and new developments in the industry. Here