Complacency - a Behavioural and Organisational Risk

Robert Shrimsley, one of the FT's satirical columnists (when he isn't managing FT.com) wrote about a recent Mayfair dinner hosted, I suspect, by Edelmans to promote their Global Trust Barometer.  The Barometer is a valuable institution that has been going for 15 years.  We have written about it in the past and we expect to return to it.

The dinner was attended by former ministers, former and current CEOs and senior journalists (such as him).  They made a well-educated, well-heeled cohort of 'serious concerned people'.

One of the Barometer's findings was a drop in trust in leaders, institutions and elites.  The decline in trust in the CEO as a credible spokesperson continued for the third consecutive year, with trust levels now at 31 percent in developed markets. Globally, CEOs (43%) and government officials and regulators (38%) continue to be the least credible sources for information.  CEOs lagged far behind academic or industry experts (70%) or "people like me" (60%).

The reaction of those diners is interesting.  Shrimsley did not mention anxious discussion of the possibility that the Barometer might be onto something fundamental - for example that elites' collective behaviour leads outsiders to regard elites as untrustworthy - let alone soul-searching to understand why people like those present are seen as so untrustworthy.  On the contrary, Shrimsely summed up the event as

"an evening of high-level hand-wringing, the kind of self-reinforcing event that goes on all over London most weeks."

We recently carried out a poll on perceptions of behavioural and organisational risk.  The cohort consisted of almost 100 company secretaries and senior in-house lawyers, who had recently completed an intense training session we had run to introduce them to behavioural and organisational risk and its tragic reputational consequences.  These were people who often know more about 'where bodies are buried' than most.

We asked two pairs of questions, separating them as much as we could (which wasn't much) to reduce the effect of 'anchoring bias'. 

The first pair of questions concerned the extent to which behavioural and organisational risks were understood across business generally and in their own organisation. 

The results clearly imply that those present thought that their own organisation deals with behavioural and organisational risks better than others could.

Our second pair of questions produced a similar pattern.  

Whilst not suggesting a solid working knowledge, those present clearly thought that their own board understood these risks rather better than boards in general.

In his second 2015 Reith Lecture, Atul Gawande looked at analogous behaviour in a different context: surgery.  After introducing a checklist system for surgeons, modelled on those used by airline pilots for procedures routine and emergency, he surveyed surgeons on their attitudes.

Whilst most surgeons had become very happy to use the checklist system, about 20% really disliked it even after three months' use.  So he asked those who really disliked the system whether, if they were to have an operation, they would wish their surgeon to use such checklists.  94% wanted their surgeon to use the checklists!  The implication was clear: I don't need such a system but everyone else sure does!

Drivers fit a similar pattern: Apparently almost all of us think we are above average drivers! 

This is a very common behaviour.  Shrimsley mentioned confirmation bias.  He might also have mentioned the availability heuristic, optimism bias and above all superiority bias and the overconfidence effect.  All are widespread behavioural phenomena and all lead to a corresponding behavioural risk that we can summarise as complacency risk.

Add herding behaviour and the effects of social norms, and 'groupthink', a dangerous organisational risk, is the inevitable result. 

At a dinner party, the consequences are likely to be dull and self-reinforcing conversation because participants' knowledge and experiences all come from the same box.  Trapped inside, they may be unable to see they are in a box, let alone see the box from the outside; still less can they examine the beliefs and assumptions in and around the box.

Translated to leadership teams of companies, governments and other organisations,the effect of these relatively homogeneous groups (that probably see themselves as diverse) is as predictable as it is devastating.  Whilst these behavioural and organisational risks are predictable, and blindingly obvious to an outsider given access to insiders' knowledge, they commonly lie unrecognised and untreated for long periods before they blow up.  We plan a blog with our latest research on this, but you already know why this is so.

The challenge for leaders is to understand not just how others see them but how others would see them if they had an insider's knowledge. 

Or as Robert Burns eloquently put it:

O wad some Pow'r the giftie gie us
To see oursels as others see us!
It wad frae mony a blunder free us,
An' foolish notion!

Anthony Fitzsimmons

Reputability LLP

London

Anthony Fitzsimmons is Chairman of Reputability LLP and, with the late Derek Atkins, author of “Rethinking Reputational Risk: How to Manage the Risks that can Ruin YourBusiness, Your Reputation and You”

Solvency II Handbook makes Start on Reputational Risk for Insurers

As a textbook author for the Chartered Insurance Institute I am only too aware of the challenges of writing about Solvency II, the regulatory monster that hangs over the insurance industry. It has been 14 years in gestation, has continually changed, and became over- politicised and over- complicated. As a consequence publications on the subject are usually out of date, some are pitched at the wrong level and many are unintelligible to anyone who is not a qualified actuary. It therefore is refreshing to find that the new edition of The Solvency II Handbook largely avoids such problems and provides a practical reference book that merits a place on the shelves of every EU insurer. Best of all, it is well edited and very readable.

The previous edition that came out in 2009 coincided with the passing of the Solvency II Directive by the European Parliament. It was an aid to insurers as they began their preparations for the ‘imminent’ implementation of the legislation in the Member States. As we all know the EU totally under-estimated the task before it and so deadlines came and went and Solvency II does not actually come into force until 1 January 2016.

In contrast to its predecessor, the new edition focuses far more on the practical issues of implementation in insurance operations. Chapters represent the shared experiences of specialists from a range of disciplines including underwriting, actuarial, risk management, regulation, accounting and audit. They deal with all three Pillars of Solvency II and provide views from non-life, life, pensions, mutual and reinsurance sectors.

The timing of the Handbook is appropriate. It was put together in 2014 at the time of the approval of Omnibus II, the revised Solvency II legislation aimed at dealing with the shortcomings of the original. These included the impact of the Lisbon Treaty, the creation of the super-regulator EIOPA, and the numerous issues identified in the quantitative impact studies, particularly the potentially crippling effect on long term guarantees. Of course, nothing is perfect in the publishing world. The Handbook has just missed the Commission Delegated Regulation (EU) 2015/35. This has provided another 175 pages of detailed technical rules that will form the basis of a single prudential rulebook across the EU. Fortunately, the Handbook contributors generally anticipated the provisions but this new regulation and other rules in the pipeline should keep Risk Books busy for some time to come.

From my own perspective, I found that many chapters shone fresh light on the impact of Solvency II and it was useful to get a broad view of what is actually happening in insurers. I particularly valued the chapter on the comparison of insurance liabilities under IFRS 4 Phase II and Solvency II.

Finally, as a partner of Reputability LLP, I obviously welcome the chapter on reputational risk. One of the constant weaknesses of insurance regulation, even of Solvency II, particularly in the way it appears to be treated by insurers, is the lack of attention to behavioural, organisational and reputational risks. The problem is by no means new. Over decade ago William McDonnell in his report on insurance failures wrote, ‘Management problems appear to be the root cause of every failure or near failure, so more focus on underlying internal causes is needed’. It is encouraging that The Solvency II Handbook is drawing attention to the issue. But is anyone listening? 

Professor Derek Atkins
Reputability LLP
London
www.reputability.co.uk


The Solvency II Handbook: practical approaches to implementation
Ed Rene Doff,
Risk Books 2014
ISBN 978 1 78272 188 8

None so deaf

We are delighted to welcome a guest glog from Mark Powell and Jonathan Gifford, authors of "My Steam-Engine is Broken".  We enjoyed working with them as they researched their book; and now they have written a blog post based on one of our shared insights.

We are, it would seem, communicating more than ever, but not necessarily to greater effect. The world of business, in particular, seems to be stuck with merely faster versions of industrial era, top-down modes of directive communication that are preventing creative involvement and genuine engagement. The lack of real dialogue is increasing the likelihood of failure – and, on occasion, even disaster.

How organisations fail to encourage real dialogue

If communication is good then more communication should be better. It depends, it would seem, on the quality of the communication. 
The communication that the person walking in front of you has stopped suddenly to read on their mobile device might be a tweet (currently over 500 million per day); a text message (estimated 21 billion per day); the now more popular instant message (estimated 50 billion per day – see previous link) or even an old-fashioned email (estimated 196 billion per day).

The email is an interesting case in point. Despite the fact that the new generation views email as an overly-complicated way of delivering a simple message, the business world has got pretty much stuck with email. Of those 196 billion daily emails sent worldwide, 109 billion are estimated to be from business.

Business looks askance at text and instant messaging (with the notable exception of the marketing department) but it has always liked email. This is probably because email offers a way of sending what is effectively a memo to a lot of people without the fuss of having to have many paper copies of the latest edict made, put into internal mail envelopes and distributed by the organisation’s mailroom to ‘all desks’ – if any readers can remember such ridiculously antiquated methods.

The point about memos is that they are not even intended to be a dialogue. They are an instruction; a directive. ‘That may be so,’ business bosses might argue, ‘but of course we also have regular meetings where people can air their views.’

But most business meetings are not a form of real dialogue either: the rigid hierarchies of most businesses and the subtle but keenly-felt gradations in the status of those present make real dialogue almost impossible to achieve.

Stuck in the industrial era

In our new book, My Steam Engine is Broken: Taking the organization from the industrial era to the Age of Ideas, we argue that modern business has got stuck in a late nineteenth- or early twentieth-century industrial mode of operation; the age of ‘scientific management’ and the ‘one best way’ of doing things, and of a sharp and quite deliberate distinction between management and ‘workers’.

In the book, we identify ten core behaviours that organisations persist with, despite the fact that these behaviours are actively preventing the very outcomes that those organisations know that they need in the modern world: creative thinking, innovation, agility and adaptability, for example. Self-motivation and heartfelt commitment from the members of the organisation. That kind of thing.

These ten paradoxical behaviours have to do with old-fashioned and inappropriate issues of control, measurement and ‘efficiency’; with outmoded, hierarchic management structures; with an absence of real leadership and a lack of genuine diversity – and with a failure to communicate in any meaningful sense of the word.

Communication: the canary in the mine

While researching material for My Steam Engine is Broken, we turned to business consultants, coaches, senior executives and business thinkers for their own experiences and ideas. One of these was Reputability’s chairman, Anthony Fitzsimmons.

“We regard the effectiveness of communication as the canary in the mine as to what’s going on in the organisation,’ Anthony told us, ‘because the ability to communicate freely is influenced by all kinds of incentives – by the culture of the place, by the way the leadership behaves – and if communication is actually flowing freely, it also tells you that it’s quite likely that a lot of other things are set relatively well which permit the information to flow, and it tells you that other important things are almost certainly happening, because if they weren’t happening, the information flow would be likely to be messed up. So that’s why we think of it as the canary in the mine.”

Failures in communication are not merely unfortunate, they can be disastrous, as Fitzsimmons and others explore in Roads to Ruin, the Cass Business School report for Airmic.  Senior leadership can fail, all too easily, to communicate its real concerns about safety standards (for example) to the organisation as a whole. Breakdowns in communication between the people on the ground and management – typically because of problems of hierarchy and status, and of the existence of silos in all large organisations – can prevent the communication of known problems to the people who are in a positon to address them.

Group intelligence

The thing about good communication is that it is relational: it is a multi-dimensional process.

Recent research has shown that the ‘collective intelligence’ of any group has less to do with the individual intelligence of the group’s members than it does with the way in which ideas are shared around the group.

As Anita Woolley, assistant professor of organizational behaviour and theory at Carnegie Mellon University, told Harvard Business Review in an interview about her research: ‘What do you hear about great groups? Not that the members are all really smart but that they listen to each other. They share criticism constructively. They have open minds. They’re not autocratic. And in our study we saw pretty clearly that groups that had smart people dominating the conversation were not very intelligent groups … Our ongoing research suggests that teams need a moderate level of cognitive diversity for effectiveness. Extremely homogeneous or extremely diverse groups aren’t as intelligent.’

Yet what Woolley describes as good successful group behaviour, leading to higher collective intelligence, is quite recognisably the antithesis of most organisational behaviour. Managers and workers do not ‘listen to each other’; they don’t ‘share criticism constructively’; managers are indeed ‘autocratic’; they work hard at ‘dominating the conversation’; groups and organisations as a whole are highly ‘homogeneous’.

We all know that this is true from our daily experience. In My Steam Engine is Broken, we invite business leaders to examine the outmoded behaviours that are still embedded in their industrial era organisations, and to begin to unpick and unravel these, little by little, piece by piece. Encouraging real, constructive, non-judgemental, open-ended dialogue in every form of communication would be a good place to start.

* * *

Mark Powell is a partner at the global consulting firm A.T. Kearney and an Associate Fellow at the University of Oxford’s Saïd Business School, where he has spent 10 years directing leadership development programmes. Jonathan Gifford is a business author and a partner of the digital advertising agency, Bluequest. He was the launch publisher of BBC History Magazine.

My Steam Engine is Broken: Taking the organization from the industrial era to the Age of Ideas is available now at bookshops and online.

Is your own organisation stuck in the industrial era? This short questionnaire will give you an instant (and slightly light-hearted) analysis: How Steam Are You?

Join the debate @MySteamEngine.

Investors Asking Questions = Better #CorpGov ?

 
We are delighted to welcome a guest blog post from Dina Medland . We hope you enjoy this investor-oriented perspective.  

We shall be adding more investor perspectives.

 




As one might expect, any institutional investor is capable of asking questions that will concentrate the mind of a publicly listed company. Would that more would do so - in a non-specific manner if preferred, but publicly. It's all about having an ongoing, relevant and timely debate around corporate governance, and better run businesses.


The innovative UK consultancy Board Intelligence  (@boardintel) held one of its regular think-tank events in London this week. This one involved a select group. Attendees in senior positions from public and private sectors agreed that there seems to be a 'bubble', a 'disconnect ' between our boardrooms and the reality out there - the way business is viewed by the society within it sits. The only way to break that 'bubble' is to have genuine, and transparent wherever possible, debate - and come up with potential new ways of doing things.

The question is what to do next. There are many potentially troubling issues around the UK's boardrooms.

This week institutional investor  Legal & General Investment  Management (LGIM) came out strongly on two of them - cybersecurity and board evaluation and review. The link will take you to some thoughts on the first issue.

Board evaluation is one of those issues that evokes comment from regulators from time to time, but is very slow to change, beyond lip service. It has taken years for anyone even to pay serious attention to the fact that executive search firms responsible for placing non-executive directors in the boardroom have also been earning fat fees 'evaluating' the same individuals. Enough said.

This blog has expressed views on evaluation from the start - the search engine does work, take a look. At the start of 2014, it got excited about the possibility of  a new code around the evaluation of boards. I got even more excited about being approached directly by Anthony Fry, a Chairman, with his thoughts.

Mr Fry has not been in the best of health, or I would have gone back to him. Would that more people in leadership positions at the top in boardrooms would reach out so naturally with their ideas, as he did.

But, despite my best efforts - with his help- to create a little kerfuffle around this issue, nothing seems to have progressed since the start of the year. Is it because there are too many vested interests at stake ?

Enter LGIM. First, the diplomacy: "Behind every successful company is an effective board. It's a message we've been spreading for many years which is why we welcomed the Financial Reporting Council's decision to officially require FTSE 350 boards to be externally reviewed every three years. However, four years after these reviews were brought in, there are still big variances in the process - namely, wide variation in the ways that reviewers work and how companies share the results with shareholders" says Sacha Sadan, its Corporate Governance Director.

Sacha Sadan, Director Corporate Governance LGIM

LGIM goes on to say that it "expects all board reviews to be rigorous and a value-adding exercise", not a 'tick-box' one. "A set code of practice should provide the necessary frameork to ensure minimum standards are upheld and that potential conflicts of interest are managed appropriately" says a press statement.

As far as I am concerned, it gets better. "LGIM has suggestions on what should be included in such a code. At the very least, minimum standards should help to ensure that the purpose of these reviews are more balanced between investors and companies, rather than tilted towards management."

What was that about 'stewardship'? And - as I take a quick peek at Twitter tonight what do I see ?
@manifestproxy: No quotas, no regulations, just S/H action: LGIM may vote down director elections on diversity from 2015 http://uk.news.yahoo.com/legal-general-im-may-vote-down-director-elections-143744321--sector.html#NnEpML8

Ah yes, diversity too - Perhaps this is one way to get quicker change when it comes to corporate governance.

Dina Medland
http://www.dinamedland.com
Original article posted October 2014 

Managers are Chief Bribe-Givers

The OECD has published a new report analysing 427 concluded bribery cases over the last 15 years.  The results are striking.

• In 12% of cases, the CEO was aware of and endorsed the bribe;
• In 41% of cases, other members of management were aware of and endorsed the bribe;
• External intermediaries such as sales agents and distributors were involved in 41% of cases;
• 57% of bribes were paid in relation to public procurement and
• 41% of cases related to bribes paid in well-developed countries.

It is a surprise that bribery is a phenomenon of well-developed countries, but it is a shock that most bribery efforts are approved by mangers or the CEO.

The root causes of bribery have to do with behavioural and organisational risks such as leadership on ethos and values, actual leadership ethos and behaviour and incentives at all levels.  Organisational complexity may leave the board in a rose-tinted bubble, unaware of the extent to which operational units - which may share a language and a country or be in far-flung places - are very different from themselves. Failures in all these areas have their origins in the board, and we suspect that it will not be long before boards themselves are pursued by prosecutors.

All large firms concentrate on bribery as a risk issue.  But how many focus systematically on the root causes?

In our experience, even after the Financial Reporting Council  has made behavioural and organisational risks a board issue, too many Chairmen and Company Secretaries are reluctant to investigate the extent to which their risk management systems have a hole where behavioural and organisational risk should be.

Until they fill that gap, boards will continue to find themselves regularly surprised by the latest crisis to hit their firms.

We won't be surprised: one of the striking findings of 'Deconstructing failure' was that boards' 'inability to engage with important risks to the business' was a root cause of 85% of the crises studied. 


Anthony Fitzsimmons
Reputability LLP
London

Anthony Fitzsimmons is Chairman of Reputability LLP and, with the late Derek Atkins, author of “Rethinking Reputational Risk: How to Manage the Risks that can Ruin YourBusiness, Your Reputation and You”

How Culture can affect Honesty

We are delighted to welcome a guest blog post from  Professor Ernst Fehr, Professor Michel Maréchal and Dr Alain Cohn, working at the Department of Economics at the University of Zurich.  Their research, just published in Nature, suggests that culture can influence honesty.

Bank employees are not more dishonest than employees in other industries. However, the business culture in the banking industry implicitly favours dishonest behaviour. that is the conclusion of a behavioural study at the University of Zurich.

It follows that a change in cultural norms would thus be important not only in order to improve the battered image of the industry but also to improve actual banker behaviour.

In the past years, there have often been cases of fraud in the banking industry, which have led to a considerable loss of image for banks. Are bank employees by nature less honest people? Or does the business culture in the banking sector favour dishonest behaviour? These questions formed the basis for our new at the Department of Economics at the University of Zurich.

Our results show that people who are bank employees are not in themselves more dishonest than their colleagues in other industries. The findings indicate, however, that the business culture in the banking sector subtly encourages dishonest behaviour.  The results suggest that the implementation of a healthy business culture is of great importance in order to restore trust in the banking industry.

Our experiment

We recruited approximately 200 bank employees, 128 from a large international bank and 80 from other banks. Each person was then randomly assigned to one of two experimental conditions.

In the experimental group, the participants were reminded of their occupational role and the associated behavioural norms with appropriate questions. In contrast, the subjects in the control group were reminded of their non-occupational role in their leisure time and the associated norms.

Subsequently, all participants completed a task that would allow them to increase their income by up to two hundred US dollars if they behaved dishonestly. The result was that bank employees in the experimental group, where they had recently been reminded of their occupational role in the banking sector, behaved significantly more dishonestly.

A very similar study was then conducted with employees from various other industries. In this case too, the employees had recently been reminded of either their occupational roles or those associated with leisure time were activated.

Unlike the bankers, however, the employees in these other industries were not more dishonest when reminded of their occupational role.

Our results suggest that the social norms in the banking sector tend to be more lenient towards dishonest behaviour and thus contribute to the reputational loss in the industry,

We therefore believe that a change in norms is needed in the banking industry.  Social norms that are implicitly more lenient towards dishonesty are problematic, because people’s trust in bank employees’ behaviour is of great importance for the long-term stability of the financial services industry.

We suggest that concrete measures could be used to counteract the problem.  The banks could encourage honest behaviour by changing the industry’s implicit social norms.  Several experts and supervisory authorities suggest, for example, that bank employees should take a professional oath, similar to the Hippocratic Oath for physicians. If an oath like this were supported with a corresponding training program in ethics and appropriate financial incentives, this could lead bank employees to focus more strongly on the long-term, social effects of their behaviour instead of concentrating on their own, short-term gains.

Alain Cohn, Ernst Fehr, and Michel Maréchal 
Department of Economics at the University of Zurich
http://www.econ.uzh.ch/index.html 

Reputability LLP
London
www.reputability.co.uk

ORSAs: Evaluating Risks to Insurers

After years of uncertainty, Solvency II, the risk based insurance capital regime for insurers, will come into force on 1 January 2016. Even more comprehensive than banking's Basel III, it requires an enormous amount of work over the next twelve months or so to ensure that companies can meet its capital, risk management and reporting requirements. Most think that it is a step forward from the existing ‘one-size fits all’ regime of Solvency I, but there are still concerns that it is excessively onerous and bureaucratic.

Introducing the ORSA

What's new in Solvency II is the Own Risk and Solvency Assessment (ORSA), a development paralleled by the USA’s National Association of Insurance Commissioners (NAIC) who also require ORSAs. This is all part of a coordinated global approach to ORSAs, driven through the International Association of Insurance Supervisors (IAIS). It means that national and regional standards are converging. An important driver of the introduction of ORSAs was the collapse of AIG in 2008, an event that took regulators completely by surprise.

Insurers have always accepted that a robust regulatory capital requirement is essential for customer protection, whilst feeling that sensitive implementation is essential to ensure it doesn't get in the way of efficient management of the firm. The ORSA addresses this dilemma through an annual report to the regulator which includes the Board's own view of the capital needed to run the business in future irrespective of the regulatory requirements. The aim is to demonstrate to the regulator that the Board understands the business, the risks and challenges it faces, and that it has adequate capital to achieve its strategic plans. Thus the ORSA requires a description of the risks based on the business model, assets and liabilities with a strategic, forward-looking perspective, written from the standpoint of the Board. It cannot be outsourced.

There is no pre-defined process, but EIOPA, the European regulator of insurance regulators, has indicated that the report should comprise:-

• Summary of current business strategy and risk appetite
• Current risk profile against risk appetite
• Required capital regulatory (SCR) and economic capital
• Available funds to meet the capital requirement
• Expected future risk, capital and solvency profile – with a capital plan and contingency planning as required
• Potential risk, capital and solvency profile under various stressed conditions
• An independent review of the ORSA

The place of reputational, behavioural and organisational risks in the ORSA

Historically, quantifiable regulatory requirements (such as for capital) have tended to eclipse unquantifiable factors.

However, research into corporate failures of the last few decades, such as the FSA’s McDonnell Report (2003), the Airmic/Cass Business School Report 'Roads to Ruin' (2011) and Reputability's report 'Deconstructing Failure' (2013), has revealed the potentially fatal weakness of this approach. Individual and collective human behaviour plays a key role in corporate failure. These unquantifiable weaknesses, now widely called ‘behavioural’ and ‘organisational’ risks are regularly found to be the root causes of crises and of a subsequent reputational collapse.

Regulators are recognising these new insights with alacrity. Reputational, behavioural and organisational risks are explicitly dealt with in the latest Financial Reporting Council Guidelines to boards on risk, and the importance of hard-to-quantify risks is increasingly recognised by global regulators including the Basel Committee on Banking Supervision and the IAIS.

In the insurance sector, IAIS, EIOPA and the NAIC have highlighted examples of risks they expect to see covered in the ORSA. Insurance, market, liquidity and counterparty risks are obvious to all, but the lists also include ‘operational risks’, with both the NAIC and EIOPA making clear that while risks such as reputational, strategic and operational risks can be hard to quantify, they must nonetheless be evaluated.

The range of ‘operational risks’ has also been clarified. It is now reasonably clear that, as regards the European ORSA, ‘operational risks’ include:

• non-quantifiable risks in general,
• reputation risks
• risks from organisational complexity, and
• risks from human behaviour, whether individual or collective.

As to the USA, the NAIC guidance on the ORSA explicitly mentions complexity risk, and operational and reputational risks as examples of hard-to-quantify risks. Behavioural risks are not mentioned by name. However since they are ‘operational risks’ and the most frequent root causes of both crises and reputational collapses, behavioural and organisational risks will be investigated by insurers that understand reputational risks. Those that lack this understanding can expect to be singled out by supervisors for remedial work. In turn, supervisors who lack this insight can expect enlightenment from the IAIS.

Implications for Insurers

Since the extent to which behavioural or organisational risks both cause crises and tip them into reputational catastrophes has only recently been recognised, ignorance has kept these risks out of risk registers. Nowadays there remain two main reasons why it is difficult to get these risks onto risk registers and into ORSAs.

First, it has often been personally dangerous, even for risk professionals, to bring these risks to the attention of their leaders. This is because the ultimate source of many of these risks is often the company’s leadership - both Board and Executive.  Fortunately, recent regulatory requirements to leaders to deal with these risks are beginning to address this problem.

However, the second reason, a serious practical problem of cognitive bias, remains. This makes behavioural and organisational risks notoriously difficult for insiders to find, recognise and understand. These risks are most easily seen by outsiders with sectoral experience who are trusted with insiders’ knowledge and given the authority to identify risks of these kinds and explaining them to insiders. Given sufficient independence, such trusted outsiders can also be relied on explain any painful truths to leaders without putting the risk team in danger of reprisals. We have developed tools systematically to find these risks and help insiders, at all levels, to understand their implications.

Conclusion

The ORSA is an important development that has the potential to become a valuable tool for management as well as supervisors when, in 2016, it becomes a regulatory requirement throughout the EU. As part of the exercise, insurers will need to make an objective assessment of their behavioural and organisational risks.

Will insurers have the tools to accomplish this task? Or will the behavioural and organisational risk gap remain as a result of self-delusion? Market history shows this is a residual risk that could have devastating consequences for firms, for the reputation of regulators and for the stability of the market as a whole.

Regulators should also put this risk on their own risk register. The painful lessons of the AIG debacle should not be forgotten.

Professor Derek Atkins
Anthony Fitzsimmons
Reputability LLP
London


Anthony Fitzsimmons is Chairman of Reputability LLP and, with the late Derek Atkins, author of “Rethinking Reputational Risk: How to Manage the Risks that can Ruin YourBusiness, Your Reputation and You”