Jean-Pierre Charmaille and Rachel Elwell look at the importance of keeping your pension scheme risk register alive
Risk registers occupy a central place in pension scheme management, more so than in other businesses, perhaps as they have long been the risk management tool of choice for trustees and their advisors. They are the blueprint by which schemes are run: identifying the risks faced, describing the controls to prevent, mitigate or give early warning of risks and setting out the control owners. The risks are commonly assessed in terms of their impact and likelihood, with a separate assessment of the effectiveness of controls to give the residual risk after mitigation.
The process by which trustees develop their risk register is in itself very valuable. It improves trustees' understanding of their scheme, its strengths and weaknesses, and encourages challenge of advisors. However, once the risk register has been fully developed, it often ceases to be a live document that trustees pay attention to. Why is this so often the case?
The cycle of risk management
The creation of a risk register is only one part of the cycle of risk management and often the rest of the risk management strategy can be easily overlooked. The risk management strategy brings a risk register to life, where trustees will assess risk appetite and risk budget, and prioritise risk mitigation actions, and which then becomes a tool to manage progress against the strategy.
Identification of risks
There are a number of different ways to populate the risk register:
Pro forma lists covering core risks for a "standard" scheme.
Theoretical risk management frameworks suggest a number of different risk types which can be used to generate ideas (such as financial, operational, reputational, etc).
Brainstorming (or "Blue Sky" thinking) sessions can identify risks specific to a scheme's own objectives or around a specific topic. The sponsoring employer may be able to contribute.
Lawyers and consultants prepare regular newsletters highlighting developments.
Scenario testing and reverse stress testing.
On this latter point, risk registers are often only a collection of things that can go wrong and interactions between risks are ignored. But interactions between risks matter a lot. This is because pension schemes, like any organisations, are complex systems. For example, a reverse-stress-test exercise carried out by the Pension Protection Fund showed that risks that were initially thought to have a small impact on the organisation had a much larger impact when interactions with other risks were taken into account.
The principle of reverse stress testing is to find scenarios that may render the business model of an organisation no longer viable. Unlike stress testing, reverse stress testing starts from the bad outcomes and seeks series of events that may lead to these outcomes. It is a risk management tool that can uncover weaknesses in the organisation control framework and focuses on the risks that may lead to a failure of the organisation.
Regular re-assessment
The cyclical nature of the risk framework is important: the environment in which schemes operate is constantly changing (eg. economic circumstances, regulations and legislation, demographics) and markets are constantly innovating to find new products to improve the efficiency of risk management (eg. longevity hedging instruments, speculation over CPI-linked gilts). These need to feedback into the process to ensure that the prioritisation remains appropriate. Potential questions include:
Are the risks identified still relevant to the scheme?
Are the controls as effective as we thought?
Are there new ways to mitigate the risks or to improve the risk-return profile?
Are there new emerging risks owing to changes in the scheme, pension industry or the wider economic environment?
Are the trustees spending their time considering the prioritised risks (if not, this might be an indication that the prioritisation is not quite right)?
Pension schemes can benefit from Enterprise Risk Management in the same way as all businesses. Conscious identification of key priorities and risks, and a framework for improvement, will increase trustee and advisor engagement and should provide better member outcomes.
If the risk register has been embedded in the running of the scheme, it becomes the living and breathing document that enables prioritisation of activities and efficient spend of budget. This requires commitment from all involved, but the reward when it works should mean no more dusty old registers.
Jean-Pierre Charmaille is the chief risk officer at the Pension Protection Fund. Rachel Elwell is director of staff pensions at Royal London Group. Both sit on the Profession's ERM Research and Thought Leadership Committee.