ARROW

1. ARROW An Overview Dr John Hedges

2. Overview • Framework • Recording • Some History • The ARROW process • ARROW 2 importance of governance • Objectives-no surprises • Preparation • The Visit • An ongoing process

3. Importance of Frameworks • A place to put facts/impressions and assists with analysis of and an understanding of the facts • Assists with a common language • Provides continuity when reviewing an issue • Can be developed as knowledge of the issues improves

4. The Importance of Frameworks cont. • Can be used as predictor and effectiveness and may be subject to back testing • Danger: too rigid a view and facts may be ignored if they apparently do not fit framework

5. More overall points: Recording • Why record? • Reflects thinking process at the time • Reflects what appears reasonable at the time • Reference point for the future • Clarifies assumptions made • Explains reasons for action made at the time • For example; why did we think these risks were more important than those when we carried out the risk assessment?

6. Some Risk Profiling History • Growing need for regulators to account for their actions • They need to explain why they look at certain issues and not others • Resource constraints: cannot look at everything • Important to have an audit trail reflecting decision making process

7. Some Risk Profiling History cont. • SFA’s experience and how risk profiling grew • My group of 500 odd firms; which one to visit next and what was the ranking of their importance in relation to their potential to damage the securities sector? • The Bank of England’s RATE system developed post Barings

8. Common denominators in Risk Assessment systems • Capital • Liquidity • Systems and controls • Management Focus very much on mitigation of business risk and little analysis of types of business risk taken on by the industry and therefore a need to understand and select appropriate mitigation. But an important start and industry is receptive to the risk based approach

9. Implications of risk based assessments • Moves away from the tick box mentality • Moves away from “carpet bombing” • But it is risk based and the assessment of risk can be incorrect; that something that was abandoned in the interest of an issue that was deemed to be important at the time could “get up and bite”. • Hence the importance of developing a robust framework that records the decision making process.

10. What do you wish to get out of the ARROW Assessment • Survival with as little inconvenience as possible? • Reassurance that the business is running as expected? • Check that management focus is in the right place? • The control infrastructure is effective in supporting the business in a safe way? • Our view of our Firm’s risk profile is the same as FSA’s?

11. Arrow 2 • A2 takes an holistic view of the firm • Not issue focussed • Places an issue in the context of the business and its control infrastructure • Asks two fundamental questions • How likely is it that the issue will materialise? • What would be the significance if it did?

12. “an issue” • Mismarking has occurred • Types of sub issues to consider • Size of mismark • Transparency: OTC • Discovered by? • Trader experience? • Does this issue compromise whole trading operation of the firm?

13. ARROW 2 Grid • A2 grid tries to mirror the organisation of a firm • Risk is analysed by • Front Office (Customer, Products, Markets) • Back Office (Business process) • Prudential • Complemented by controls specific to these issues • Plus overall controls plus capital and liquidity • Generating net risk

14. ARROW 2 Methodology • The concept of net risk • Focus on inherent business risk to get some idea of the gross risk and then an assessment of the controls to offset that risk • The overall controls of • Governance • Compliance • Risk management • Internal Audit • Clarity on the role of capital

15. Governance • A big driver of the risk score and a subject I shall be speaking to in anther one of these sessions • What makes for effective governance? • A methodology I want to talk about in December • Correct mix of structure, process, management information and culture to produce effective controls, legal entity integrity the minimisation of client risk etc • Important to have a framework that provides meaningful feedback to the industry.

16. Compliance • Profile within business • Appropriate resourcing • Span of operation • Advisory • Surveillance • Spectrum of legal (advisory) compliance (surveillance) and internal audit

17. Internal Audit • Profile within the organisation • Career progression or dead end? • Resourcing- adequate skills base • Risk based approach • Liaison with external auditors and extent to which they rely on Internal Audit

18. Role of Capital and Liquidity • Capital cannot replace effective systems and controls • Can only be a cushion until issues are resolved • Is a reserve to meet expected and unexpected movements in risks faced by the business, including market, credit and operational. • Liquidity • Liquidity management is now and always was of prime importance and this is reflected in ongoing assessments.

19. Put Yourself in the shoes of the FSA and ask the following • What are their core statutory responsibilities • How would you relate your firm to these • How would you go about a risk assessment of your firm if you were the FSA • What conclusions would you arrive at • How would you mitigate identified risks

20. Importance of preparation • FSA personnel busy and will welcome information that is • Pertinent and clear • You know your firm best and in a good position to supply relevant information • Clarify from FSA exactly what is required when and in what format. Be specific and as focussed as possible; try and be proactive rather than reactive • FSA will also gather information from other divisions within FSA so it is worth while reviewing the total exposure of the firm to FSA.

21. The Visit • The discovery concept • The importance of meetings (CEO, heads of business and control heads) • Agenda is clear between Firm and FSA • Appropriate people to attend meetings • Avoid back to back meetings • Importance of summing up the main points after each meeting.

22. The Close Out Meeting • Understand and agree issues raised; clarify in a constructive way. The controls are weak; which controls and why are they weak • Issues raised should give contouring to the risk profile; are they a surprise or not. Avoid talking about risk profiles without concrete examples. • Above all it is important that there is a convergence of views if the firm is to get anything out of ARROW

23. The Risk Mitigation Programme • Each risk mitigation will be analysed and recorded as follows • Issue; intended outcome; action to accomplish this • The concept of tools and the tool box • Use of Firm’s resources to conduct the work • Be clear on scope and what constitutes an effective outcome • Clear on resource commitment from FSA and Firm • Clear on time frame

24. Output • Draft letter- chance to correct factual errors but overall message remains the same if not affected by factual error • If the close out meeting is successful the draft letter should contain no surprises • Letter format • Addressed to? • Main message clearly understood? • Scores and their role • RMP clear and related to the main message?

25. Ongoing Process • Thank god it is all over? • ARROW should be a live process and not cast in stone but subject to alteration as firm’s profile changes. • What changes profile • Change in business activity • Rapid expansion causing control and management stretch • It pays to keep FSA informed so that in the next ARROW the firm’s risk profile does not have to be built up from the ground again

26. Staying in touch • It pays to stay in touch and keep the FSA abreast of strategic developments and how these will be supported by an effective control infrastructure • Try and avoid springing surprises on the FSA; discuss potential problems and think through effective mitigation well before the issue crystallises