Getting To Grips With Pillar 3 - Capital Adequacy/BASEL

Welcome to 'Getting to grips with Pillar 3'. Drawing on our wide-ranging work with clients and discussions with supervisors and other relevant bodies, the paper looks at how to tackle the key strategic and implementation issues emanating from the Solvency II reporting and disclosure requirements.

The implementation section, 'Bringing reporting up to scratch', examines the practical considerations for complying with the demands of Pillar 3. Pillar 3 will require your business to report more information (in a structured, electronic format) more quickly and with much greater scrutiny than ever before. But there will also be opportunities to use the required investment to improve the quality, reliability and timeliness of management information. Many businesses will be looking to realise these benefits ahead of the compliance deadline.

To help illustrate the scale and nature of the task, the section opens with a programme director's view from the coalface of implementation. We then look at the different elements that will need to be put in place, including getting down to the right level of detail; bringing asset managers on board and what is appropriate for different types and sizes of company; along with how to develop the systems infrastructure needed to keep it all running.

There is no single right answer for any of these issues. What works best is going to depend on a range of coalescing factors including what kind of business you write, where and the structure of your company. What this paper does seek to do is to outline the issues you will need to consider and the next steps towards implementation.

With so much attention devoted to the Pillar 1 capital evaluation and Pillar 2 risk management requirements, Pillar 3 can sometimes become the forgotten pillar within many organisations. Yet the quantitative and qualitative disclosures could have a significant impact on how your business is judged by policyholders, analysts, investors and supervisors. The tight turnaround times and level of data and analysis that will need to be reported and disclosed also present a significant operational hurdle over and above what is required for the other two pillars.

The implementation date for Solvency II looks set to be postponed to allow more time for assessment and agreement on a number of key issues. But the reporting and disclosure are unlikely to see material changes and it will be important not to lose momentum on the preparations for Pillar 3, especially as some local supervisors are set to require a demonstration of reporting capabilities and significant interim disclosures ahead of the EU-wide launch (as an example, the ACP in France are potentially introducing QRT reporting in XBRL format for 2014.) Furthermore, EIOPA are currently looking to see what aspects of Solvency II (particularly Pillars 2 and 3) they can introduce in the interim phase within the supervisory process.

The extra time also offers a valuable opportunity to use resources in the most cost-effective way. This includes developing sustainable reporting capabilities and building them into business as usual. This would help avoid the quick fix spreadsheet options that many were envisaging to get over the line in time for the earlier deadline. Some national supervisors may allow you to use advanced Solvency II templates in place of current regulatory standards, and this could include reporting and disclosure.

A further consideration is that the postponement would open up the potential to bring the timetables for Pillar 3 and the planned new IFRS insurance contracts standard (IFRS Phase II) closer into line if your company chooses the possible option for early adoption of IFRS Phase II. This would help to avoid digging up the road more than once. (See our publication 'Laying the foundations for the future of insurance reporting'.) The added benefit would be to bring a relatively early end to a period of substantial financial reporting change and allow you to fully focus on business priorities.

As you think about how to prepare in the most effective way, the strategic section of this publication, 'How are you going to be judged?', looks at what areas of the business are going to come under the spotlight, how the numbers might influence decisions and how they are going to be viewed by the financial markets. The consistent market value approach could provide greater comparability of risk and capital disclosures across the EU. But it could also introduce greater balance sheet volatility and there will still be inconsistencies with business written outside the EU. The market focus on the numbers is going to be heightened by the fact that the solvency evaluations will have a crucial impact on how much money you can pay in dividends.

You will also need to decide how much independent review will be required to ensure market confidence in the disclosures.

Overview

Given the lack of focus on Pillar 3 in comparison to Pillars 1 and 2 within many insurance companies, it is easy to misjudge or under-estimate some of the key strategic and implementation challenges. Some of the main misconceptions and their implications are set out here.

Possible misconception one "Pillar 3 reporting and disclosure does not matter as we primarily focus on a different basis of disclosure."

In fact, your business will need to take full account of Pillar 3 reporting and disclosure in line with the requirement to build the risk and solvency evaluations into decision making. The binding capital constraints imposed by Solvency II will also have a decisive impact on how much money is available for dividends and investment, which are a key focus for analysts and investors.

See 'Moving to a new regime: Judging the business through the lens of Pillar 3' More broadly, Pillar 3 could provide a useful catalyst for a review and rethink of reporting and disclosure aimed at communicating the strength and potential of the business in a more understandable, accessible and, ultimately, value-enhancing way.

See 'Vision for the future' Possible misconception two "Pillar 3 disclosure will provide a more useful and comparable marketconsistent approach to insurance disclosure."

Pillar 3 introduces a prescribed and hence consistent EU-wide basis for evaluating and communicating a market value balance sheet. But while some firms may thus want to use Pillar 3 as a key basis for judging and communicating performance, translating regulatory measures into performance reporting can be difficult in practice. For one, Pillar 3 could introduce short-term fluctuations in the evaluation of assets and liabilities, which may not reflect how they are viewed, managed and matched within the business. The regulatory capital calculations for many non-EU operations would also be based on the existing local rules, not on the prescribed Solvency II format.

See 'Moving to a new regime: Judging the business through the lens of Pillar 3' Possible misconception three "Reconciling Pillar 3 disclosures with financial reporting should be relatively straightforward."

There are conceptual similarities between IFRS and Solvency II and it will be important to make the most of these synergies when designing and developing models. But there are also a number of key differences in areas ranging from contract boundaries to the basis for discounting. So it will be important to identify any divergence and be able to explain the reasons for it. If you don't, you could face awkward questions from analysts and investors.

Possible misconception four

"A single group SFCR would be easier and cheaper than preparing separate reports for what may be many different legal entities."

A single group report would allow both the group and the reader to view the business as a single entity. But it may not necessarily be more straightforward and understandable than separate solo entity reports once factors such as language, stakeholder expectations and differences between business lines are taken into consideration.

See 'Setting the scope' Possible misconception five

"The simplifications used in Pillar 1 capital evaluation will also make Pillar 3 more straightforward."

In fact, simplifications in Pillar 1 could actually add to the Pillar 3 demands by requiring the inclusion of a full explanation to justify the use of these simplifications.

See 'Applying proportionality to your reporting demands'

Possible misconception six

"Fund administrators will easily be able to take care of all the third party information demands."

In fact, your business will be responsible for making sure the required information on assets is delivered on time and that it is subjected to appropriate governance and verification. Particular challenges include the 'look-through' approach, under which your fund administrator would have to provide details on each of the assets within a fund or fund-of-funds.

See 'Developing an effective partnership with your asset managers'

Possible misconception seven

"The detail and timelines will be tough, but existing solvency evaluation and financial reporting systems can be adapted to cope."

In fact, the level of detail required and the turnaround times are unprecedented. People, processes and technology are all going to have to be reviewed and rethought as part of the 'industrial' approach needed to build Pillar 3 reporting into business as usual. Without it, the process is going to be unsustainably labour intensive.

See 'Getting down to the right level of detail' and 'Delivering on time, every time'

Moreover, Pillar 3 will require actuarial evaluations that are at present only used internally to be brought up to the standards of verification and review needed for external reporting. See 'Gauging the need for external evaluation'

Possible misconception eight

"The postponement of the implementation date for Solvency II is a chance to put Pillar 3 preparations to one side."

In fact, some local supervisors are set to require a demonstration of reporting capabilities and significant interim disclosures ahead of the EU-wide launch.

EIOPA chairman Gabriel Bernardino said in his speech of 21 November 2012 that an interim phase could introduce elements of Pillars 2 and 3 before the implementation date. Sustaining the momentum of implementation would also help to build Pillar 3 into business as usual and avoid the potentially costly and error-prone quick fixes that many might have felt necessary to comply with the previous deadline.

Section one How are you going to be judged?

Moving to a new regime: Judging the business through the lens of Pillar 3

Solvency II will change how companies within the insurance sector think about their businesses. This might include how performance, risk and capital are evaluated and communicated. But using regulatory driven data for performance analysis brings with it many challenges. Quite a few companies, particularly in the life sector, may also not view Solvency II data as the ideal basis for allocating capital or judging the performance of the business.

These companies may look to augment Solvency II data with additional metrics, both internally and externally, but this introduces a new set of issues. And whether management thinks Solvency II is a good approach or not, the Directive could introduce greater volatility into capital metrics and new complications into determining the amount of cash available to pay dividends, which are key areas of analyst and investor focus. So with no 'one size fits all' view, how your business addresses these challenges will vary considerably.

Greater consistency

The introduction of greater harmonisation and better alignment of capital requirements and risk is a welcome step for the European insurance sector. Solvency II may help iron out some of the inconsistencies in current solvency reporting, and the outputs should be more useful as a tool to help evaluate the business than is the case with existing requirements.

Moving to a new regime: Judging the business through the lens of Pillar 3

Pillar 3 is also going to put new and potentially more detailed information about your risk profile and the way it is managed into the public domain. Even countries such as the UK, where regulatory returns are already made public, will see new disclosures that the markets will be keen to scrutinise. In an industry that currently lacks a consistent approach to calculating an 'economic' view of the business, some insurers believe that Solvency II could help to fill the void and allow them to link performance, capital and risk metrics.

They may see Pillar 3 reporting as an opportunity to bring market disclosure closer into line with the measures they use to run their businesses and possibly provide a new basis for how they judge performance. This is more likely to be the case for non-life companies, as the ways risk and capital are evaluated under Solvency II are conceptually not far away from how most internal models work.

Many will thus want to focus analyst and investor attention on the Pillar 3 numbers and use them as one of the bases for steering the business.

Using Pillar 3 as one of the bases for performance management may be difficult to achieve in practice, however. A particular challenge will be how to use a framework designed for regulatory reporting to provide information that is useful to management (let alone investors).

The focus to date has been on ensuring that insurers can explain the movements in solvency capital in a Solvency II world in the form of 'variation analysis' and 'P&L attribution analysis'. However, this may not generate the type of information that is actually needed to run the business or communicate with investors - essentially, a clear view of operating and non operating elements, and an ability to determine what is really driving movements in capital available at a group level.

In particular, 'variation analysis' may not prove particularly useful as a management tool. It will be prepared on a solo basis only. It will not be mandatory until the second year following Solvency II implementation, and the degree of detail around life results (with separation only between 'life' and 'health') may not provide the granular level insight that will be needed to understand what is happening in the business.

And while the industry has looked for more user-friendly information from P&L attribution analysis, the main aim of this information is to act as a cross check against whether internal models are focusing on the key risks, not on providing insight into profit drivers to management or investors. With a lack of clarity as to how this information should be presented combined, with considerable flexibility as to the approach adopted, there is a great deal of uncertainty as to whether this will be a step forward.

Those insurers that are looking to use Solvency II to help bridge the information void both internally and with investors will need to be able to build from solo level to group-level analysis and to help provide clarity on the different sources of earnings that drive results on a Solvency II basis, as well as how group capital structures work in practice.

A further consideration is to reflect the views of investors. Fund managers are keen to 'join the dots' with measures that are comparable to other industries. Given the 'economic' starting point for Solvency II reporting, this will create new challenges. In particular, simply providing analysts with a new raft of data on a basis that is unique to insurers is unlikely to be a successful strategy.

What this means for your business is that it will need to be able to reconcile Pillar 3 disclosures with other aspects of financial reporting and to be able to explain the main differences, whether they relate to contract boundaries, the basis for discounting or the myriad of other variables. From a practical perspective it will be important to prepare the Solvency and Financial Condition Report (SFCR) in parallel with annual reports to allow your business to identify any divergence and be able to explain the reasons to analysts. Failure to do this risks sending out mixed messages and incompatible numbers.

When Solvency II may not be the right answer

For large and complex insurance groups with significant operations outside the EU, particularly life insurance operations, Solvency II may not be fully consistent with what management view as the main drivers of value and risk.

First, under the proposed equivalence rules, regulatory capital calculations for many non-EU operations could be based on the existing local rules, not on the prescribed Solvency II format. This may be particularly significant if your business has large US operations, given the conceptual differences between the US statutory and EU Solvency II frameworks (discussions between EU and US supervisors on equivalence are ongoing). While not relevant to solo level reporting, the consolidated data that emerges from the Solvency II reports would include two different bases of evaluation, rendering it far less useful either internally or externally as a way to judge performance or to allocate capital. In such cases, it is hard to see how Solvency II information for insurers operating outside the EU could be viewed as a substitute for embedded value data, for example.

Secondly, Solvency II is built on a market consistent approach that does not have universal appeal. Many insurers view a market-consistent approach as the most appropriate benchmark of economic value in their businesses. However, there are some who believe that it can portray an overly generous view of some businesses (for example, mortality and other risks within protection business, as well as unit-linked business), while taking a highly punitive view of the risks within certain guaranteed savings business. A market-consistent approach also introduces much greater volatility into both capital available and capital requirements, which even with 'dampeners' in place may exacerbate pro-cyclical pressures.

Tackling these challenges will require careful thought. On the one hand, management teams will need to demonstrate that Solvency II-style information is at the heart of decision making. On the other, management may not want to adopt bases for internal or external reporting that do not reflect its own view of risk and value. You could look to adopt a consistent group-wide 'Solvency II' view, but this may not be easy to do, and would be resisted by those who believe that a market-consistent approach is inappropriate. An option is to focus group-wide capital allocation decisions and external markets on the outputs from internal economic capital models, and to use Solvency II data at a local solo level, as well as a means of testing compliance with binding regulatory constraints.

The advantage of this approach is that it can be applied on a consistent basis across the business and may better reflect management's own perspectives and objectives, as well as what is viewed as most important in creating value in the business. However, this approach also brings numerous challenges. A key one is ensuring that it does not jeopardise internal model approval. In addition, experience shows that embedding an approach for group-wide decision making that is not fully aligned with local regulatory approaches, or with how local competitors set capital requirements or price products, is far from straightforward. It is also debatable how useful this approach is to analysts and investors, since local regulatory demands are the ones that may determine dividends and other questions around capital deployment.

In respect of the needs of analysts and investors it is not possible simply to dismiss Solvency II information. Your business would still need to find ways to tie these binding regulatory constraints to group level economic capital evaluations, along with those used in IFRS and rating agency capital models. We set out in Figure 1 some of the considerations that companies will need to address.

Break on capital flexibility

Whether or not Solvency II or alternative versions such as internal economic capital models are viewed as the best proxy for economic value in the business, it will be local solvency rules and rating requirements that are likely to be the decisive factor in calculating how much cash is available to be reinvested in the business, or is legally available to pay dividends or fund possible share buybacks.

Market movements come into play here, as there will be more volatility in available capital than under the relatively static existing regimes. Today's point estimates are therefore likely to be redundant and will need to give way to dynamic analysis under a comprehensive range of scenarios.

A further consideration is the impact that Solvency II will have on capital flexibility, particularly for life companies. At present, Solvency I rules and the legal requirements for what counts as distributable earnings tend to operate in a broadly consistent way (and in some jurisdictions are in fact the same). But Solvency II could create a high degree of divergence between what may be 'free capital' from a regulatory view, and what may in fact be legally distributable. This is because Solvency II takes an 'economic' view, as opposed to the traditional cost based view, which tends to drive legal considerations around dividend distributions. A further complication is that the difference between an economic and 'distributable' perspective may vary greatly by product. This will have consequences for different legal entities within a business as to whether the real binding constraint will be regulatory capital (guaranteed savings products) or what is legally distributable (protection).

What this means is that even if Solvency II may be viewed as broadly neutral to an insurer at a group level, there may be consequences in the ability to move capital internally from what is the current practice. A key question for CFOs is whether today's cash cow becomes tomorrow's dividend block?

Identifying the implications of these considerations for your own operations will be hard enough, but clearly analysts and investors will be looking for 'winners and losers'. In other words, they will want to know what Solvency II data means in terms of sufficiency of capital and ability to withstand shocks, the quality of capital, and the impact that this will have on the financial flexibility of the business. To be prepared, it will be important to have thought through your positioning relative to key competitors and the consequences this may have for the business - and to do so early enough to be able to take any necessary actions well in advance of Solvency II coming into effect. Here, delays to implementation may actually work to the industry's advantage, but there is no room for complacency.

Strategic response

While the latest delay to Solvency II may be viewed as an opportunity to focus on remaining technical challenges, it's important to bear in mind that shareholders reward good performance and potential rather than good models. Assessing the investor relations implications of these reporting changes and how to address them is therefore vital. Getting this right is going to take time and a considerable amount of high level input. The postponement will allow more time to address these challenges in a well-planned strategic way.

Next steps

The first key step is to determine whether the Solvency II numbers are going to be an important performance driver in allocating capital across the group or will be viewed more from a compliance perspective. If Solvency II numbers will be the core basis for decision making and performance management, then your Pillar 3 disclosures are clearly going to be a vital part of how management and investors will assess your strategy and track progress against objectives. But you will need to think through how to make information intended to be used for regulatory reporting genuinely insightful for you in performance reporting, and how to tie this together with other perspectives of your business (bearing in mind that there is resolutely no 'one view' that can tell you everything you need to know). While not a direct factor in Pillar 3, it will be important to look at how to make P&L attribution analysis useful within your financial reporting function.

Companies with less appetite for using Solvency II as a basis for valuation, capital allocation and performance management at a group level will need to determine how to build and embed a more coherent approach without this leading to regulators questioning whether the Solvency II evaluations have enough influence on decision making. Alternatively, these insurers may decide to manage the group to local bases.

Whichever approach is adopted, there will be a raft of additional challenges. For example, if you are looking to design an alternative to Solvency II, there is the challenge of how to embed a metric in your business that may not actually be a binding constraint - as well as to have clear links to what will actually drive your 'real-world' capital flexibility. Clarity on the final direction of Solvency II will be helpful but not essential before you can fully engage with this issue. There are steps that are relevant now. For example, it is important to think through the possible consequences of Solvency II for your business, and to start to plan ahead for future reporting - for example, where will embedded value data fit in?

You will need to ask how financially stable the business will look under the SFCR. How will the new regime affect distributable earnings? How does this compare to your competitors? How does it square with the measures used by analysts and investors to rate performance?

It is also important to look at how the changes to reporting support your 'equity story'. This includes explaining to analysts and investors the extent to which Solvency II is likely to change the key performance indicators used to run the business and how strategic objectives accord with your regulatory requirements.

Vision for the future

The previous section, 'Moving to a new regime: Judging the business through the lens of Pillar 3' explores some of the immediate investor relations challenges created by the move to Solvency II. We think it is also useful to examine how the Directive might influence longer term changes in insurance reporting and how we believe these will take shape.

In particular, given investors' continued frustrations about how insurers communicate on value, performance and risk, the combination of Pillar 3 reporting and the planned new IFRS for insurance contracts (IFRS Phase II) presents the opportunity for a broader rethink of insurance reporting and disclosure. The results of this rethink would aim to communicate the strength and potential of the business in a more understandable, accessible and, ultimately, value enhancing way. Further opportunities to cut through the complexity of reporting are going to come from the market push for more straightforward and comprehensible products.

Closing the information gap

The gap between what analysts and investors want from reporting and what they actually receive from many insurers has long been a cause for concern. The markets want a clear indication both of how insurers make money now and how they intend to in the future (underwriting, fees or investment returns) as well as how these funds would translate into 'real' distributable cash. To be credible and informative, these metrics need to be consistently prepared (across years and between companies) and actually be used within the enterprise itself.

In most analysts' view, what they currently get, particularly with respect to the life industry, is far less useful. There are essentially two main issues to overcome, comprehensibility and comparability. Our research has consistently highlighted market concerns over what analysts and investors believe are disjointed and opaque insurance financial statements, creating a jumble of numbers that are difficult to comprehend and compare against other sectors and which often fail to tell them what is actually happening within the company. Comparability is compromised by material inconsistencies in approach in relation to almost all aspects of reporting. The numbers are produced on a different basis from insurer to insurer and might not even correspond with the measures that are being used to run the business.

At a time when competition for capital has rarely been more intense, the difficulties in understanding the strategic direction and value potential within insurance businesses mean that they may lose investment to industries that offer seemingly more transparent and easily discernible opportunities.

Equally, policyholders want products that are easy to understand and compare. We've already seen the rapid rise of price comparison sites for many forms of insurance. The drive towards greater product simplicity, transparency and comparability is also gaining ground on the life side through the emergence of online access life policies and easy to manage pension products such as target date funds.

As a lot of the complexity is stripped out of product design, it should be possible to cut out some of the corresponding complexity in reporting to create financial statements that all stakeholders can understand. For example, simpler products are likely to require less sophisticated investments, which will make risk evaluation more straightforward and the resulting reports and disclosures more concise and comprehensible.

A new framework

As the previous section highlighted, the way insurers approach Solvency II is going to vary. Some will be looking at it as a binding capital constraint, while others will want to place greater emphasis on the evaluations within management information and external reporting. Equivalence could act as a further constraint on comparability, as quite a lot of the non-EU operations of European groups could be measured on a different basis. Given these factors, the view that Solvency II could represent a fresh start for the industry from a reporting perspective may be rather naive.

However, when put in the context of the far-reaching changes to financial reporting likely to come in as part of IFRS Phase II, the insurance industry is going to have to rethink how it judges all aspects of performance over the next decade. It would clearly be a wasted opportunity if this was not used to address some of the problems highlighted earlier.

From this perspective, as well as focusing on the technical challenges of these new standards, companies need to think about how they use Solvency II and IFRS Phase II data to answer the key questions that are relevant to management of the business and to what investors need to know.

In our investor survey earlier this year, fund managers told us that insurance reporting consistently failed to answer some of the following points:

How do life insurers make money? Here, existing reporting often provides only the most tangential clues as to what drives profits, whether on an IFRS or embedded value basis.
How do we know that the reinvestment in the business is of good quality? Investors are increasingly sceptical as to whether new business profits are really achieved, and whether published internal rate of returns (IRRs) or payback periods really match reality.
How do insurance earnings turn into distributable cash? While there have been attempts by several insurers to try and answer this question, the outputs are often not robust or linked to the 'real world'.
Does the company have sufficient capital? This may seem like a straightforward question, but the myriad of different capital lenses and frequent company confusion mean that a clear answer can often be lacking.

We're not suggesting that these are the only issues, and clearly there are numerous other considerations that are of equal importance to management and investors. However, it is not a stretch to understand how Solvency II and IFRS could be used to try and address these questions, and to deliver a far more coherent approach to internal and external analysis than the patchwork of disjointed metrics that tend to represent the reporting dashboard of many insurers in today's environment.

For example, using scenario analysis built around Pillar 3 data would go a long way towards giving analysts the prospective information on cash generation they are looking for and help them to track the most important risk and value drivers that influence this. As a result, financial statements would provide a more balanced evaluation of risk and reward and the strategies that underpin this. The information would ideally be available in an accessible and concise format.

Industry investment in new technology will support these developments by speeding up the supply of key information. To manage their businesses, management will have online access to value creation and risk information through dashboards. Once the link between Solvency II and statutory accounting is bedded down, we may also see the emergence of a core suite of metrics to manage and communicate the performance of the business on a consistent basis.

Of course, there remain unanswered questions as to how far the US and other non-EU markets will go along with approaches often built from a market consistent approach; in this respect, multinational insurers are likely to have to continue to grapple with multiple reporting approaches for many years to come. A further consideration is the complexity of the Solvency II and IFRS Phase II reporting, which could just as easily make current confusion even worse if not handled properly. However, there is a clear prize here for the insurers that get this right - and focus beyond technical considerations to make the outputs of the significant investment in reporting useful and insightful.

Presenting a clearer, more concise and more compelling approach to reporting would remove much of the 'mystery' from insurance disclosure and help companies to compete for investment on a more favourable basis with other sectors, while being more transparent to shareholders, policyholders and other external stakeholders.

Gauging the need for external evaluation

Pillar 3 disclosure could have a significant influence on investors' decisions. How much independent review will be required to ensure market confidence in the disclosures?

We would expect that key elements of the quantitative reporting such as the technical provisions and own funds are likely to require mandatory external review under Solvency II. Preliminary consultations are underway.

As market pressure to disclose aspects of Solvency II increases, your business may eventually want to consider whether external review may need to go further than the mandatory areas. Possible areas include parts of the own risk and solvency assessment (ORSA), such as the assessment of the future solvency position. External review would enhance the credibility of the reporting within the markets. This will in turn require a more forward-looking approach than is typical within today's audit-type evaluations. However, it is important to note that external review is intended to be a complement to internal governance rather than a replacement for it.

Reviewers are expected to place considerable reliance on your company's own framework of oversight and controls. So what role may external reviews play in Solvency II reporting and how would this work?

Broad scope of review

Investors and other stakeholders may come to expect both a retrospective and prospective focus for external review under Solvency II. On a retrospective basis, reviewers will be called upon to provide stakeholders with reasonable assurance that key elements of Pillar 3 disclosure are materially correct. On a prospective basis, it is our view that some analysts and investors might want to see a review of the assumptions made to assess the future continuity of the business. These perspectives would draw on reviews of the risk assessment and control framework to judge whether the business is properly controlled.

Therefore, we envisage that the external review will focus not only on a selection of the publicly available elements of Pillar 3, but also on a limited number of additional disclosures as a result of market pressure (Figure 2 sets out the possible scope of external review).

Figure 2: PwC's view on the potential scope of external review

A selection of the publicly disclosed Quantitive reporting templates (e.g. Solvency II balance sheet)
Tiering and eligibility of the own funds
Solvency capital requirement (SCR) and minimum capital requirement (MCR) calculation and thus the solvency position
Management's assessment of the prospective risk and solvency position based on the ORSA and a statement on the quality of the internal control framework to the extent that the information can be objectively measured and made subject to a clear framework for review

Changing role for auditors

Some countries already require auditing of certain elements of regulatory returns. But Solvency II may take such evaluations into uncharted waters. In particular, if stakeholders would require a statement on management's prospective risk assessment, this would lead to a more forward-looking focus for auditors than at present.

The review body would be required to provide a letter detailing any matters arising from the evaluation, such as internal control issues. This would be shared with the supervisor, but not publicly available.

Reviewers might be allowed to place a certain amount of reliance on your internal control framework and the independent validation of the cash flow and (in the case of internal models) the risk models in judging the accuracy of the numbers and rigour of the surrounding governance and oversight. Their main role will be to test controls and 'review' the procedures in place rather than primary verification, though how much testing of their own they are likely to carry out remains to be seen.

Emerging requirements

In addition to the mandatory areas for review, there may eventually be peer and market pressure to disclose some additional elements of Solvency II evaluation and management. This could include scenario analysis within the ORSA. The credibility of this information would benefit from external review and verification.

Strengthening assurance

The details of the (mandatory) external review requirements are still to be finalised. What is certain is that such reviews would play a significant role in assuring stakeholders over the accuracy of disclosure and the quality of the controls that underpins it. We expect that the market may also be looking for an additional voluntary review of managements' forward-looking statements not covered by the mandatory review. This will be a new departure for companies used to a traditional audit of financial reports, and therefore the information and evidence they will seek to assure themselves will be extensive.

Next steps

EIOPA has embarked on a programme of consultations which will look at what should be covered by an external review, how it will work (including how much reviewers can rely on internal controls) and the cost/benefit of the proposed approach. Subject to this cost/benefit analysis, further areas that could fall into the scope of the review include the SCR and MCR. Further questions are likely to centre on clarification of how much reliance can be placed on internal controls.

Section two Bringing reporting up to scratch

Starting with the end in mind: An insurer's perspective on implementing Pillar 3

The challenges of getting ready for Pillar 3 disclosure should not be underestimated. However, the systems and operational upgrades that will be required open up opportunities to create a more efficient, organisationally integrated and ultimately useful framework for company-wide reporting. We asked the programme director from a leading international insurer to share his company's expectations, practical experiences and perspectives on the hurdles ahead.

'We knew from the outset that meeting the Pillar 3 requirements would be challenging, requiring us to disclose more information, more frequently than ever before and with much less time available to do so. But the challenge is not compliance in itself - we would always find a way to get over the line, even if that meant bringing in more people from other areas of the business. The real issue is how to meet the demands of Pillar 3 in a sustainable way that minimises the implementation costs and ongoing compliance burden in the future.

Having carried out some initial work in 2008 and 2009, mainly focusing on the Pillar 1 quantitative requirements, the programme began in earnest in 2010.

The first step was to bring together key stakeholders from across the organisation (actuarial, finance, risk, internal audit etc.) to evaluate what would be required for all three pillars, carry out a high level gap analysis and set up work streams to address the gaps. This was accomplished during a project initiation workshop where the programme structure, vision and training requirements were determined.

It is very important to develop a good organisation-wide understanding of what is required for Pillar 3 at an early stage to help to mobilise the business. As people become aware of the implications, they can begin to lobby their supervisors for a workable approach. Many local companies had been primarily focusing on Pillar 1 at the beginning and therefore there was less awareness of how long the Pillar 3 implementation will take and how much it is likely to cost.

We were among the first few organisations to be lobbying our supervisor for better recognition of the challenges and this has resulted in greater awareness across the industry.

Setting your ambitions

Drawing on our high-level evaluation, a core team developed the programme vision for the new solvency regime and for Pillar 3 specifically, before we sought views from key stakeholders at all levels of the business.

This vision is going to vary from organisation to organisation depending on their ambition and what other issues they want to address as part of the programme. But an agreed vision is the key to getting everyone mobilised and working towards common goals.

Our overall vision not only focuses on the practical compliance demands (for example, how to clear the compliance hurdle at the lowest possible costs), but also how to use the necessary changes as an opportunity to develop a more risk aware culture and optimise risk-adjusted value. Our Pillar 3 vision reflects these overall objectives by looking at how we can use the new management information and reporting requirements as a foundation to add value for customers, investors and other key stakeholders. It also recognises that the right processes, controls, technology, data and governance have to be in place.

Pillar 3 is a journey and some elements of what we want to achieve will not be in place before the implementation deadline. But as long as you have a clear and agreed vision, the direction and momentum can be maintained to ensure you will get there eventually. Similarly, you are bound to need some workarounds to get over the line during the transition. But you can't afford to institutionalise these fixes, as this will only prolong the costs and disruption.

From a practical perspective, we have come to realise that integration with financial reporting is vital, especially as many of the same people are going to be closely involved in both. The worst thing to do would be to create a whole new set of reports on top of what is already produced.

In turn, efficient implementation demands close integration between risk, finance, actuarial and assurance (internal audit) teams. These teams tend to work quite independently, so getting them to work together posed a possible challenge. However, the earlier you can get these teams to engage and collaborate, the better.

Steps along the journey

All this preliminary work paved the way for the development of a target operating model. We carried out a more detailed gap analysis that looked at the potential data gaps and hold-ups and what organisational changes and systems investment would be needed to tackle these (The 'Delivering on time, every time' section on pages 32-35 explores some of the key considerations). A very important part of this was to look at the reporting calendar and then determine who needs to do what and when and how all the reporting activities are going to come together. Among the potential bottlenecks we identified were systems and process inefficiencies, technology not deployed as efficiently as it could be and actuarial, risk and finance teams working in silos. Other key bottleneck areas included reliance on asset managers and other third party data providers for more frequent and detailed data feeds (the 'Developing an effective partnership with your asset managers' section on pages 20-31 looks at the additional requirements and how to overcome them).

We're upgrading our systems to make sure that we can meet the new reporting deadlines. While we currently have several months to submit our returns, in future these will need to be ready in a matter of weeks. Our investment includes a combination of off-the-shelf Pillar 3 reporting systems and the development of a new data warehouse. It's important to stress that you can't just buy a solution, as the really hard part is making sure the right data is fed into the system at the right time, which requires a substantial amount of data sourcing and data flow work across the organisation.

Looking at where we are now, I think we are probably slightly ahead of the curve, but there is still some way to go. The key challenge ahead is embedding the changes, though I believe that if you develop capabilities that the business will use and see the benefit of, embedding will just be the by-product of this rather than an exercise in itself. Starting 'with the end in mind', i.e. what you are going to report on, brings significant clarity on what the business needs to do after the programme.

Key lessons

When asked what we've learned, I think the first key point is that all the people who are going to have the most important roles in making this work - including the IT, risk, finance, actuarial and internal audit teams - need to be pulling together from the outset. In turn, you need senior buy-in or progress will be significantly delayed. Given the amount of dependencies and oversight involved in Pillar 3 reporting, allowing time for a dry run and any subsequent fixing is also essential. The final message is the importance of being pragmatic and realistic and developing an iterative solution approach. An overly complicated programme and approach can all too easily come unstuck, destroying value rather than creating it.

We would like to thank the contributor for his time and thoughtful insight.

To view this article in full please click here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Malta: Getting To Grips With Pillar 3