SYSC 21.1 Risk control: guidance on governance arrangements

1. (1)

   1This chapter provides additional guidance on risk-centric governance arrangements for effective risk management. It expands upon the general organisational requirements in SYSC 2, SYSC 3, SYSC 4 and SYSC 7, and so applies to the same extent as SYSC 3.1.1 R (for insurers, managing agents and the Society) and SYSC 4.1.1 R (for every other firm).

2. (2)

   Firms should, taking account of their size, nature and complexity, consider whether in order to fulfil the general organisational requirements in SYSC 2, SYSC 3, SYSC 4 and SYSC 7 their risk control arrangements should include:

   1. (a)

      appointing a Chief Risk Officer; and

   2. (b)

      establishing a governing body risk committee.

   The functions of a Chief Risk Officer and governing body risk committee are explained further in this section.

3. (3)

   The appropriate regulator considers that banks and insurers that are included in the FTSE 100 Index are examples of the types of firm that should structure their risk control arrangements in this way. However, this guidance will also be relevant to some similar sized firms (whether or not listed) and some smaller firms, by virtue of their risk profile or complexity.

1. (1)

   A Chief Risk Officer should:

   1. (a)

      be accountable to the firm's governing body for oversight of firm-wide risk management;

   2. (b)

      be fully independent of a firm's individual business units;

   3. (c)

      have sufficient authority, stature and resources for the effective execution of his responsibilities;

   4. (d)

      have unfettered access to any parts of the firm's business capable of having an impact on the firm's risk profile;

   5. (e)

      ensure that the data used by the firm to assess its risks are fit for purpose in terms of quality, quantity and breadth;

   6. (f)

      provide oversight and challenge of the firm's systems and controls in respect of risk management;

   7. (g)

      provide oversight and validation of the firm's external reporting of risk;

   8. (h)

      ensure the adequacy of risk information, risk analysis and risk training provided to members of the firm's governing body;

   9. (i)

      report to the firm's governing body on the firm's risk exposures relative to its risk appetite and tolerance, and the extent to which the risks inherent in any proposed business strategy and plans are consistent with the governing body's risk appetite and tolerance. The Chief Risk Officer should also alert the firm's governing body to and provide challenge on, any business strategy or plans that exceed the firm's risk appetite and tolerance;

   10. (j)

       provide risk-focused advice and information into the setting and individual application of the firm's remuneration policy (where the Remuneration Code applies, see in particular SYSC 19A.3.15 E).2

2. (2)

   Firms will need to seek the appropriate regulator's approval for a Chief Risk Officer to perform the systems and controls function (see SUP 10 (Approved persons)).3

3. (3)

   The appropriate regulator expects that where a firm is part of a group it will structure its arrangements so that a Chief Risk Officer at an appropriate level within the group will exercise functions in (1) taking into account group-wide risks.

1. (1)

   The Chief Risk Officer should be accountable to a firm's governing body.

2. (2)

   The appropriate regulator recognises that in addition to the Chief Risk Officers primary accountability to the governing body, an executive reporting line will be necessary for operational purposes. Accordingly, to the extent necessary for effective operational management, the Chief Risk Officer should report into a very senior executive level in the firm. In practice, the appropriate regulator expects this will be to the chief executive, the chief finance officer or to another executive director.

1. (1)

   Firms should ensure that a Chief Risk Officers remuneration is subject to approval by the firm's governing body, or an appropriate sub-committee.

2. (2)

   Firms should also ensure that the Chief Risk Officer may not be removed from that role without the approval of the firm's governing body.

1. (1)

   The appropriate regulator considers that, while the firm's governing body is ultimately responsible for risk governance throughout the business, firms should consider establishing a governing body risk committee to provide focused support and advice on risk governance.

2. (2)

   Where a firm has established a governing body risk committee, its responsibilities will typically include:

   1. (a)

      providing advice to the firm's governing body on risk strategy, including the oversight of current risk exposures of the firm, with particular, but not exclusive, emphasis on prudential risks;

   2. (b)

      development of proposals for consideration by the governing body in respect of overall risk appetite and tolerance, as well as the metrics to be used to monitor the firm's risk management performance;

   3. (c)

      oversight and challenge of the design and execution of stress and scenario testing;

   4. (d)

      oversight and challenge of the day-to-day risk management and oversight arrangements of the executive;

   5. (e)

      oversight and challenge of due diligence on risk issues relating to material transactions and strategic proposals that are subject to approval by the governing body;

   6. (f)

      provide advice to the firm's remuneration committee on risk weightings to be applied to performance objectives incorporated in the incentive structure for the executive;

   7. (g)

      providing advice, oversight and challenge necessary to embed and maintain a supportive risk culture throughout the firm.

3. (3)

   Where a governing body risk committee is established, its chairman should be a non-executive director, and while its membership should predominantly be non-executive it may be appropriate to include senior executives such as the chief finance officer.

In carrying out their risk governance responsibilities, a firm's governing body and governing body risk committee should have regard to any relevant advice from its audit committee or internal audit function concerning the effectiveness of its current control framework. In addition, they should remain alert to the possible need for expert advice and support on any risk issue, taking action to ensure that they receive such advice and support as may be necessary to meet their responsibilities effectively.