Risk Management and the Global Banking Crisis: Lessons for Insurance Solvency Regulation

Abstract

This paper investigates the causes of the banking crisis and the resulting lessons that need to be learned for insurance regulation. The paper argues that the banking crisis was predominantly caused by weaknesses in the management and regulation of banks, weaknesses that lead to problems such as flawed compensation schemes, poor risk management communication and an over-reliance on mathematical risk models. On the basis of these findings, doubts are expressed about the direction of certain insurance regulatory reforms—such as the focus on capital requirements and quantitative risk assessment (the so-called “Pillar I” of most reforms). It is also recommended that a more balanced approach to insurance regulation should be implemented, which places much greater emphasis on enhancing risk management guidance and supervisory tools (Pillar II) and improving disclosure rules (Pillar III).

Introduction

The regulation of insurance companies is at a global crossroads. Many countries are in the process of reforming their regimes, including the whole of the European Union with the Solvency II project and the United States with the National Association of Insurance Commissioners’ (NAIC) “Solvency Modernization Initiative”¹ and even more significantly for the U.S. the July 2010 Financial Reform Act and the creation of a new federal insurance agency.² In addition the G-20, supported by “The Joint Forum” of international financial services supervisors, has called for the closer harmonisation of solvency regimes across the financial services sector,³ while the International Association of Insurance Supervisors (IAIS) is working towards a common framework for the supervision of internationally active insurance groups and has issued various “principles”, “standards” and “guidance” on the design/use of solvency regulations.⁴

While some of these reforms were well established before the global banking crisis (e.g. the Solvency II project), the crisis has had a significant effect on their content and direction. Understandably insurance regulators are keen to learn from the banking crisis, analysing its causes and consequences to help improve the effectiveness of their own solvency regimes.

This paper adds to the current literature on the banking crisis and the associated direction of insurer solvency regulation in the following ways. First, it draws on an analysis of the root causes of the recent banking crisis to examine the micro (human/cultural) level factors that can influence the risk management decisions of financial institutions. Second it shows how poorly implemented regulatory reforms can adversely affect the risk management activities of financial institutions.

To support the above analysis, the paper uses evidence from interviews with 20 senior risk management professionals from a range of U.K. licensed financial institutions, including 11 from institutions operating within the insurance industry. These interviews were conducted in the immediate aftermath of the initial phase of the crisis (July/August 2009) and so provide an early, first-hand, account of its causes.

The paper makes recommendations on how the prudential regulation and supervision of insurers could be improved. In so doing, it supports and develops the work of Doff, Eling et al. and Eling and Schmeiser,⁵ arguing that a more holistic approach is required that balances technical capital rules with a greater emphasis on risk management standards/practices and market disclosure. It is also recommended that supervisors should place more emphasis on the assessment of qualitative factors such as management expertise, attitudes and judgement or the nature of an insurer's risk culture.

The next section begins with an explanation of the methods used to collect and analyse the testimonies that were obtained from the selected risk management professionals. The section after that then uses these testimonies to explore the root causes of the banking crisis and their implications for insurer solvency regulation, while the subsequent section provides recommendations in the light of this analysis. The last section ends with a conclusion and some suggestions for future research.

Methodology

Approach: Semi-structured interviews

To explore the reasons behind the banking crisis a series of semi-structured interviews were conducted. The interviews focused on the opinions of the respondent in relation to: the cause(s) of the current financial crisis; the role of risk management and its implementation; how organisational factors (i.e.—culture and governance) may have contributed to events; and participants’ comments on the future in relation to sector regulation and the understanding and management of risk. Appendix A lists all the questions that were asked.

Semi-structured interviews were chosen because they provide the interviewer with an opportunity to explore a range of complex and potentially sensitive issues. They allow conversation to flow more freely than structured interviews, affording the interviewee an opportunity to express their personal opinions, concerns and feelings, while still ensuring that there is a sufficient degree of structure to allow comparisons between interviewees. Grounded theory approaches, such as the analysis of semi-structured interviews, are particularly well suited to this type of organisational analysis because of their ability to capture the complexity of real-world contexts and to link theory with practice.⁶

Scope of analysis: The interviewees

In total 20 interviews were conducted across a range of retail banks, building societies, investment firms and insurers—11 of the interviewees worked for an insurance company or bank/insurer conglomerate. Appendix B contains the pseudonyms for each interviewee and a brief description of the type of financial institution(s) they worked for. All interviewees were selected on the basis that they had considerable experience in the financial services sector—having worked for a range of institutions over their careers (their ages ranged from 35 to 65), including in a number of cases the U.K. Financial Services Authority. In addition many of them had experience of not just the current financial crisis, but also previous crises and recessions. Hence they were well placed to comment on the banking crisis, its causes and the lessons that need to be learned for the future.

Method of analysis: Examining the data

Given the sensitive nature of the material, all respondents were guaranteed confidentiality. In all cases but one the interviewees agreed to be recorded. For the remaining case, detailed notes were taken at the time of the interview and further reflections added soon after. Recording and transcribing of all but one of the interviews allowed for more detailed data analysis using accurate quotations from the respondents that helped to convey their meaning and intentions more fully.⁷

Analysis was conducted through a process of pattern matching⁸ by comparing empirical patterns between each of the participants interviewed. In addition, themes were identified by establishing “similarities, dissimilarities and recurrent words and themes” and by noting patterns by “volume or significance”.⁹ The process was carried out first on a within-case basis and then on a between-case basis. Subsequently, data concerned with similar themes was drawn together from different cases and placed in data categories to further support analysis. Then, results were presented in the form of a summary report¹⁰ to a convenience sample of U.K. financial services experts including Chief Risk Officers (CROs), consultants and representatives from government departments and financial regulators, who were invited to comment and confirm the validity of the findings (which they did). Such an approach helped to combat the possibility of researcher bias.

The banking crisis: Understanding its root causes and their implications for insurer solvency regulation

Understanding the banking crisis: Theoretical foundations of the current analysis

Investigations into the causes of the banking crisis and the lessons that need to be learned are plentiful. Regulatory agencies have been particularly prolific in this space.¹¹ In the main the story goes that the banking crisis, like most financial crises before it, was caused by a series of macroeconomic temptations (low interest rates, booming housing markets, high levels of market liquidity, etc.) that drove banks (and a few insurers) to take excessive amounts of risk. Risks that they were unable to control effectively because of weaknesses in their corporate governance frameworks (e.g. excessive reliance on staff bonus payments, which promoted moral hazard) and risk management arrangements (e.g. holding insufficient levels of capital and liquidity).

While such factors undoubtedly played their part and are likely to do so again in future crises (whether the next major crisis is banking- or insurance-related), there is a key flaw in this analysis—it fails to explain why some financial institutions exposed themselves to excessive levels of risk, while many others did not. In short it would seem that there are some more fundamental causal factors that need to be identified and understood if regulators are to learn all the lessons required, so that they can prevent, or at least significantly mitigate the effects of, the next crisis.

One key source of insight into the question of why some financial institutions may be less prone to crises than others, is the growing literature on organisational crises and their management.¹² Within this field, a considerable amount of case study work has been done to investigate the causes of many different crises (financial or otherwise), including insurance company failures¹³ and the current banking crisis.¹⁴ Hence it seemed an appropriate starting place to help focus the theoretical lens of the current analysis.

Understanding crises is a complicated affair, especially as their causes are often multifaceted and interrelated. Typically the conditions for crisis build up over time, with multiple factors (or “preconditions” as they are sometimes referred to) combining and interacting to create the potential for a crisis that finally manifests itself once a suitable trigger event came along (in the case of the banking crisis, rising U.S. interest rates and subprime mortgage defaults).

However, despite such complexity, patterns have emerged from this research. Patterns that suggest that the underlying causes of most crises have a lot in common, with one or more of the following factors lying at the heart of any crisis:

• An organisation's structure and associated management systems. Complex organisations with heavily interdependent production processes tend to be more prone to both minor and major loss events (including crises), as do those with ineffective internal communication systems.

• Management risk perceptions. A problem that is sometimes compounded by “groupthink”, where individual mis-perceptions are reinforced by those of their peers and dissident views are stifled.

• An organisation's risk culture. In particular, some organisations seem to be more risk aware and committed to effective risk management than others.

• Organisational change, which can divert attention from normal day-to-day risk management activities and/or damage staff morale, causing a rise in errors, fraud, etc.

• Internal politics and power dynamics. Individuals (e.g. directors) or departments within an organisation may wield a disproportionate amount of power and have a detrimental effect on risk management decision-making. For example, sales staff may resist risk management initiatives on the grounds that they are costly, bureaucratic and time-consuming, or attempt to circumvent them to maximise their short-term, sales-related bonuses.

• External social, political, regulatory and micro-economic pressures. For example, organisations may decide to cut corners in their risk management activities when budgets are tight or they may over/under emphasise certain activities depending on the prevailing political/regulatory priorities (e.g. use of quantitative risk models).

In short the roots of most crises are usually a combination of cultural and human “foibles”, weaknesses in organisational design and structure, and economic/strategic pressures. All of which combine to increase an organisation's susceptibility to external temptations, while at the same time helping to weaken the systems and processes that should be in place to help control the risks that may be associated with these temptations.

Identifying the underlying causes of the banking crisis

The initial review of the interview transcripts revealed a significant degree of consistency between the responses of each interviewee (both across banks and insurers). It also indicated that interviewees’ opinions on the causes of the banking crisis were aligned to the insights provided by the field of crisis management. Closer analysis of the themes contained within these transcripts revealed that the underlying causes of the banking crisis could be grouped into six categories (Figure 1).

Figure 1

The six Cs.

Each of these Cs is summarised below, structured according to the importance given to them by the interviewees. We start with the more minor of these Cs (Compensation, Complexity and Competition) and then move onto the major ones.

Compensation

Blaming the crisis on “greedy” bankers has been a popular thread in many of the publically available commentaries on the crisis. However, the interviewees revealed that the issue of pay and bonuses is more complicated than that.

In total, 18 of the interviewees mentioned the issue of compensation. However, 17 of these pointed out that it was not the size of pay/bonus arrangements that mattered, but rather the design of these arrangements. The key weaknesses that they identified were as follows:

• Incentive arrangements that encouraged short-term, sales-driven behaviour.

• Arrangements that did not claw back salary/bonuses when losses were incurred, meaning that managers and some directors did not have a financial stake in the decisions that they were making.

• Arrangements that did not reinforce or even contradicted the governance frameworks of some financial institutions (e.g. arrangements that did not incentivise managers to: assess, monitor or control risk).

Complexity

Financial services is a complex business. There are a wide range of difficult and sometimes volatile risk factors to consider. Moreover, the interrelatedness of many activities, risks and institutions creates the perfect environment for unforeseen correlations and extreme events.

Under such conditions, it is hardly surprising that major financial crises emerge from time to time, since crises are much more likely in complex and/or tightly coupled (interdependent) systems.¹⁵ However, while accepting that the financial services sector is highly complex, none of the interviewees saw the banking crisis as an inevitable result of this. Instead, they highlighted the failure on the part of some, but by no means all, institutions to manage the complexities of their risk exposures in an effective manner. The following quote illustrates this:

The big boys, Barclays, HSBC etc., were leading the charge but the smaller banks were following the herd … . The big boys knew what they were doing but when you get to the second or third tier that is where too many players were chasing too few and the dross got picked up without them knowing what they were doing. (Risk Consultant 3)

In short complexity was not the real problem—rather it came down to the attitudes and abilities of management.

Competition

While this was not a major theme in every interview, seven of the interviewees explained that some very real and rational economic pressures drove institutions to make the risk management decisions that they did. One of these interviewees put this as follows:

Some people say a bonus culture – I don’t think it is a bonus culture, I think it's a real desire for shareholders and stakeholders and the analyst community to get returns and their consistent profits. You get very little credit for having a steady ship and being consistent: it's much more about differentiating from the rest of the market and getting the best margin. (PD 1)

However, a few of these seven interviewees pointed out that not every financial institution followed the trend for increased risk-taking in the pursuit of higher rewards. In particular they suggested that institutions were better able to manage these economic pressures where they exhibited the following qualities:

• Effective risk appetite frameworks and associated risk reporting structures. Some institutions were not only able to spot the crisis coming, but took decisive action to reduce their exposure to it.

• An organisational culture that embodied the traditional financial services' virtues of prudence and conservatism.

So again, as with the issues of Compensation and Complexity, there is continuing evidence that the crisis was due to the quality of management—which brings us to the three more important Cs.

Culture

The role that cultural weaknesses can play in causing crises is a major theme within the field of crisis management, where it has been known for some time that “crisis prone” organisations have cultures that are very different from “crisis avoiding” ones.¹⁶ Therefore it came as no surprise that, when asked about the underlying causes of the crisis, 19 of the interviewees referred to a range of common human/cultural “weaknesses”, including greed, short termism and herding (the tendency to copy the strategies of other institutions). Indeed for some such weaknesses were fundamental:

I’m a great believer that when you do look at underlying causes you use root cause analysis and try to go back to basics. I’m going to say this because of my bent towards people, but when I look at risk there are two underlying causes— one is god and one is people. (FD 1)

For me it's human behaviour. Everything else comes off the back of that—it all comes back to the person. (Risk Consultant 3)

Some of the interviewees also revealed that these human/cultural weaknesses were reinforced by powerful factors at the national/industry-wide, inter-firm and intra-firm levels. Moreover, they indicated that certain financial institutions had cultural characteristics that allowed them to control these inherent weaknesses, indicating that culture can have a positive crisis-avoiding effect. This observation was especially common among the respondents from insurance firms/conglomerates, most of which talked about their own organisation's culture as being one that emphasised risk awareness and the importance of taking a long-term view, with steady returns and their ongoing survival being more important than rapid growth and profits. However, this finding should be viewed as tentative until further research is conducted to explore potential differences between the risk cultures of pure banks and those of insurers/conglomerates.

Of particular note, at the intra firm level, were the behaviours of not only boards/senior managers, but also those of certain risk management functions (in both banks and insurers). Therefore, while boards/senior managers may not always have paid sufficient attention to risk management considerations or been reluctant to challenge high levels of risk-taking while the profits were rolling in, many risk functions were their own worst enemies when trying to get their voices heard. It was commented that risk functions often adopted “ivory tower” and/or an officious “compliance-orientated” culture, instead of business-focused ones devoted to supporting both strategic and operational decision-making. In so doing, risk management functions are likely to be marginalised and ignored, meaning that valuable messages about key risk exposures may not be given adequate attention. As Chief Risk Officer (CRO) 1 explained:

Often we get things achieved in our own firm because we say “we must do this, the regulator says we have to and that's why we're doing it”. We should be doing good risk management for the right reasons because we see the benefit to the business and our clients and our reputation. We’re going to make money out of it—fantastic—not because the regulator tells us to.

Communication

In total 16 of the interviewees highlighted the issue of risk reporting, commenting on:

• whether the right data was communicated to the right people (e.g. whether key decision-makers such as boards/senior managers were receiving the information that they needed to make effective strategic decisions and avert the impending crisis);

• whether those receiving this data were able to understand it.

In terms of the reasons behind these communication weaknesses, it was suspected that boards did not always receive sufficient support from management. This may have been because management lacked the necessary expertise (e.g. the ability to report risk management information in a clear and meaningful way) or because they were withholding information (for internal political reasons for example). One of the interviewees summed this up as follows:

… maybe we are not always best at putting that message across. As risk managers we’re all very good at saying how good we are but are we good at saying “actually there is some fault within us”? (CRO 1)

Capital regime

While all the interviewees accepted that financial institutions have to shoulder much of the responsibility for the current crisis, they also had a lot to say about regulatory failures. In total, 15 of the interviewees were critical of financial services regulation and the U.K.'s Basel II-based capital regime for banks in particular.

The specific comments provided by the interviewees covered both the design and implementation of the U.K.'s capital requirement regulations for banks.

In terms of design, the U.K.'s Basel II-based prudential regime for banks was criticised by nine of the interviewees, most of whom mentioned its bias towards quantitative risk assessment. This may have encouraged banks to become overly reliant on flawed mathematical models at the expense of management judgement. The following quote illustrates this point:

I’m a bit of a Luddite when it comes to risk frameworks. Because the way the regulations work now, it tends to lead you into defined categories and you imagine a room with green, red and amber lights and you spend all your time watching them and reacting to how they go off…. The point of risk management is to think about where the emerging risks are and what the regulators do is focus on what can be measured and they’re not the same thing. (CRO 4)

In terms of implementation, interviewees suggested that supervisors did not have the necessary skills and industry/management experience to supervise financial institutions effectively. As one of the interviewees put it:

Of course the regulators were appalling either at understanding what they were regulating or actually regulating, probably the latter because of the former. (DR 1)

An especially common topic across both banks and insurers related to the metric-driven nature of supervisory assessments where supervisors rarely delve into the motivations, experience and personalities of the management of financial institutions. The following quotes illustrate this:

Our supervisor at the FSA has probably just had his 14^th birthday! I know that is a bit of an unkind statement but they come in with their checklists and tick everything off and we got a very good report but they don’t really understand what is going on underneath the surface because they are not streetwise enough and don’t understand some of the people aspects. (FD 1)

… rules-based supervision invariably goes as a box ticking exercise. I think that is a massive failure … . You’ve got 3 pages of boxes and they [supervisors] are filling the boxes in like Sudoku to make sure the result at the bottom is an MH [medium high]. That's not the way to do it. You’ve got to get there through the process. (Non-exec 1)

Implications for insurer solvency regulation

The most important implication of the above findings is that insurance regulators and supervisors must not forget the human element. First and foremost, financial institutions are made up of people and it is their attitudes, behaviours, incentives, knowledge and competencies that are a fundamental part of why they succeed or fail. Hence current regulatory reforms need to consider carefully this issue and ensure that they promote the right sort of behaviour (a sustainable, management-driven approach to balancing risk and return) rather than the wrong sort (metric-driven risk management combined with excessive risk-taking).

From this two key issues arise:

1. The multifaceted nature of financial crises requires a multifaceted solution.

Some years ago a group of European insurance supervisors concluded that the multifaceted nature of insurance company failure meant that a more balanced approach to regulation was required:

… if we are going to prevent insurance company insolvencies, management and supervisory tools need to be developed which can tackle the full cause-effect chain. As a result, managers and supervisors need to adopt a more holistic approach to the management and supervision of insurance companies.¹⁷

To a certain extent, initiatives like the Solvency II project and the U.S. insurance reforms achieve such an approach. The basis for these reforms being the three pillars of: (I) quantitative capital requirements; (II) supervisory review (of risk management and internal control systems); and, (III) disclosure. However, the fact remains that most attention has been devoted to the first of these pillars rather than the other two.¹⁸

This rather skewed focus is problematic because capital can be of limited effectiveness in the presence of human weakness, a fact that was highlighted by Howard Davies, the first Chairman of the U.K. Financial Services Authority:¹⁹

But we have learnt, from better experience, that no amount of capital is enough if the management in charge of it is incompetent, and the control systems are fatally flawed.

In short, for capital requirements to be effective, the management of an insurance company must be appropriately skilled and incentivised and have the information and controls that they need to manage their company effectively. If such elements are not in place then even high levels of capital may prove inadequate. As highlighted by the recent banking crisis it does not take long for a poorly managed financial institution to run out of capital, however much it has:²⁰

As we saw last year it doesn’t take many days for a company's capital to be worth next to nothing and we have to bear that in mind. Capital is a tool in the toolbox but it's not everything and knowing your company is much more important than knowing how much capital your company has. (DR 1)

However, it is likely that such weakness will be more effectively constrained by appropriate governance, risk management and internal control standards coupled with comprehensive disclosure requirements that help to highlight excessive risk taking and weak management. Hence a more balanced approach to regulation and supervision is required that does not give misplaced priority to the role of capital. Capital is the same as any other regulatory “tool” in that it has strengths and weaknesses. Also, like any other tool, it is at its most effective when combined with and given equal weighting to the other main tools that are at the disposal of regulators/supervisors (risk management and disclosure requirements).

2. Poorly designed and or implemented regulations can help to cause financial crises

As indicated above many of the interviewees blamed, in part, regulation and supervision for the banking crisis. These observations illustrate that regulation and supervision can have serious and unexpected consequences. Moreover, such consequences can create the preconditions for major system-wide events. This endorses the view of Cummins et al. that poorly designed regulatory systems can create incentives for excessive risk-taking.²¹ Design weaknesses that by their very nature are systemic, because of the large number of institutions that they can effect. Hence insurance supervisors who are prepared to accept that perfect solvency regimes do not exist²² are taking a huge risk. Instead they should look much more carefully at the adverse consequences that may be associated with their proposals.

Recommendations

On the basis of the current analysis of the causes of the banking crisis, how should the design and implementation of insurer solvency regimes proceed? Below are some recommendations for insurance regulators and supervisors, from around the globe, to consider.

Recommendation 1: Insurance supervisors should work to raise the quality of management within insurance firms and the appropriateness of their risk cultures.

All of the interviewees accepted that their risk management, governance and internal control practices needed to improve and many were already taking steps to enhance them—this included those from insurance companies. As such, insurance supervisors should be commended for producing some useful guidance in this area.²³ However, more is required. On the basis of the findings in the section “Identifying the underlying causes of the banking crisis”, some key areas that require further guidance are as follows:

• The development of appropriate risk cultures.

• The role of the risk management function—which can be overly compliance orientated and mechanistic.

• How to design appropriate compensation arrangements that enhance governance and risk management objectives (but not limit the amount of compensation).

• Training and development; including at board level and within the risk management function, where some boards and senior management have a lack of appreciation of risk issues, while many risk managers do not understand the practicalities of running a business or how to communicate effectively.²⁴

This does not mean that more prescriptive rules are needed though. Rather, regulators/supervisors need to work with the industry to identify and promote examples of good management practice. One of the interviewees explained this as follows:

What you want is not to tell people what they can and can’t do, which is where the regulator is going, but to have some flexibility and some guidelines that people work to … . Actually shouldn’t they be taking some of the companies that have been run well and saying “that's a good business model, what were they doing that hasn’t lead them down the path of failure?” … . They know what's caused the problem so surely they should be speaking to the companies who haven’t got into a mess to find out what they did and how they controlled the desire to go for profit. (CRO 5)

Recommendation 2: Insurance regulators/supervisors should promote risk awareness and preparedness over mechanistic approaches to modelling risk.

In a recent paper on the risk management lessons from the banking crisis, Philippe Jorion stated:

… risk management should be driven by people, not machines.²⁵

As illustrated in the section “Identifying the underlying causes of the banking crisis”, this view was endorsed by some of the interviewees, who criticised the model/metric-driven focus on the Basel II-based U.K. regulatory regime for banks. In addition many of them (14) talked about the benefits of more judgemental tools, such as scenario analysis and the role that they can play in preparing financial institutions for low probability, high impact loss events. As one of these interviewees said:

We have to break out of the traditional modelling approaches that are effectively based on recent experience and become a lot more creative and subjective, which per se weakens the model. I think we almost have to convince ourselves subconsciously that we’re not trying to predict, not trying to forecast; we’re trying to come up with a series of situations that might vary from the radically positive to the radically negative and consider how we work in those scenarios …

The point of doing scenario analysis and stress testing is to enable you to prepare, enable you to think through different circumstances, unfavourable circumstances, and decide how you would manage in those circumstances. It's qualitative, not quantitative, it's contingency planning on a larger scale almost. (Risk Consultant 1)

Leading regulatory initiatives such as Solvency II already include reference to alternative risk assessment techniques like scenario analysis, stress testing and expert judgement and accept that they have their uses. However, concerns remain regarding the focus of this attention and regulators/supervisors over willingness to rely on probabilistic models.²⁶ Regulators and supervisors must be open to and promote the use of alternative risk assessment techniques. Risk is a complex phenomenon that cannot be reliably reduced to simple function of probability and impact,²⁷ hence alternative assessment techniques must be given, at the very least, equal status to probabilistic approaches.

Recommendation 3: Improve the skills and experience of supervisors, ensuring that they focus more on the people aspects.

As highlighted above, many of the interviewees criticised the ability of supervisors to properly monitor and control financial institutions across the U.K. banking and insurance sectors. In particular, if insurance regulators are to reduce the risk of future crises, they must recruit supervisors, who can make judgements about the quality of an insurer's management and their associated risk management decisions. This will probably mean recruiting, at additional cost, staff with appropriate industry experience and/or professional qualifications is areas such as insurance and risk management. As two of the insurance-based interviewees said:

It comes back to having the right individuals at the regulator who come into an organisation and sniff around and use that insight when they come and have a chat with us and “talk prudential” down the road. (CRO 6)

The FSA needs a better understanding of what companies are doing and be able to ask the right questions. (FD 2)

Insurance supervisors, therefore, need to develop qualitative risk assessment tools that allow them to “ask the right questions”. However, they do not need to start from scratch as tools already exist to support such assessments in other sectors of the economy (oil and gas, manufacturing health and safety, security forces, etc.). For example, Cox and Cheyne²⁸ provide a “Safety Climate Assessment Toolkit” for the offshore oil and gas industry that could be adapted to other sectors, including insurance. Plus there are a variety of qualitative risk assessment techniques that could be applied by insurance supervisors, including “Hazard and Operability Studies”, “Action Error Analysis”, “Task Analysis”, etc.²⁹

Recommendation 4: Enhance transparency via improved disclosure rules.

One final way to better control the behaviour and resultant risk management decisions of insurers is to promote enhanced disclosure rules. Greater transparency should increase the discipline that is imposed on insurers, thus ensuring that they are properly managed and do not take excessive risks. Of course, not all stakeholders may wish to impose such discipline (e.g. well diversified shareholders); however, there are many that will (notably regulators, consumers, creditors and smaller private shareholders).

Most of the proposed insurance regulatory reforms already include regulations on both supervisory reporting and market disclosure. However, what is questionable is the amount of attention devoted to this important but often underestimated third regulatory pillar.³⁰ This is backed up by empirical evidence that disclosure rules, particularly in relation to public (market) disclosure, are the most effective means for disciplining risk-taking within financial institutions and should be given a more central role.³¹ The benefits of public risk disclosure have also been acknowledged by the CRO Forum within its paper on the subject,³² while very recently in this journal Eling and Schmeiser have argued that increased disclosure of an insurer's risk profile is required.³³

Although only four of the interviewees addressed the issue of disclosure, it is interesting to note that three of these were at director level (FD 1 and Non-execs 1 and 2) and hence more likely to consider the issue of stakeholder reporting. In so doing, these interviewees called for the disclosure of risk management information that is less quantitative and accounting biased and more relevant to a wider range of stakeholders (e.g. small shareholders/consumers). As one of the interviewees said:

Bland statements about numbers that don’t mean a great deal. (Non-exec 1)

They also argued that disclosure documents should contain more qualitative information about the future prospects of an institution and the effectiveness of its risk management and governance frameworks, rather than simply their design:

I don’t think increased disclosure is working—as an accountant the stuff that we publish hasn’t really moved us forward … . In the years we’ve been reacting to this, the accountants don’t move things forward—disclosed reports are not any more user-friendly. In fact they’re less user friendly, potentially scary if you read them in any detail and don’t allow the audience to better understand the risk an organisation is carrying. (Non-exec 2)

Reassuringly, regulations such as the Solvency II Directive do acknowledge the importance of qualitative disclosures; however, they have done little to provide guidance on this issue, arguing that they want to encourage “a degree of flexibility” regarding how their requirements are met.³⁴ While such an aim appears commendable, it will do little to clarify requirements in this area and could lead to important qualitative disclosures being overlooked. Moreover, though the CRO Forum have done rather better on this topic,³⁵ the lack of regulatory sanction associated with their work is likely to mean that their proposed standards will not be universally adopted.

Conclusions

The purpose of this paper was to investigate the underlying causes of the banking crisis and consider the lessons that need to be learned by insurance regulators and supervisors.

The paper argues that at its heart the recent banking crisis was caused by:

• human/cultural weaknesses at the industry-wide, inter-firm and intra-firm levels;

• communication weaknesses within some financial institutions, where boards and senior managers either did not get the information that they needed, or failed to understand it when they did;

• weaknesses in the prudential regime for banks, building societies and investment firms, coupled with flawed supervision.

From this a number of implications were identified for insurer solvency regulation and recommendations provided. In so doing, doubts were expressed about the current direction of certain insurance regulatory reforms—such as the strong focus on regulatory capital requirements and quantitative risk assessment. It is also recommended that insurance regulators/supervisors should pay more attention to the management of insurance firms, seeking to control this via enhanced risk management guidance and supervisory tools (Pillar II), coupled with improved disclosure rules (Pillar III).

Appendices

Appendix A

Table A1

Table A1 Interview agenda

Appendix B

Table B1

Table B1 Respondents