Prudential Regulation Authority Rulebook

5.1

As explained in paragraph 2.5 the supervisory approaches outlined in Chapter 3 (for lending) and Chapter 4 (for financial risk management) are not intended to be ‘one size fits all’, and the portfolio limits suggested in the appendices are indicative only of PRA expectations for each of the defined approaches. It is ultimately for each society to determine its own individual approach, based on its specific risk appetite, corporate plan, risk management capabilities and management expertise. Boards are expected to set appropriate individual limits for each relevant activity, having regard to those indicated for each supervisory defined approach. The PRA does not expect boards simply to ‘copy out’ the indicative limit structure into their own policy statements.

5.2

The PRA recognises that some societies have developed distinctive business models that do not fit the standard archetypes, and also that existing business models can evolve over time. The expectations set out in this supervisory statement are designed to encourage the development of risk management skills and practices that are commensurate with the risk appetite of the society, as agreed by its board, and the PRA therefore expects boards to select the most appropriate of the defined approaches for its business. Although the chosen approach is expected to form the backdrop to the society’s business model and control structure it is for boards to tailor their internal limits and organisational structure to the types of business undertaken.

5.3

The PRA expects to be kept informed of any material changes in relevant policies, and envisages two alternative types of change that could arise:

1. (a) ‘extensions’ to limits or control systems that take place within a supervisory approach; and
2. (b) changes of approach – where a society wishes to move from its existing approach to a more sophisticated one (or, more rarely, to drop back to a less sophisticated one).

5.4

The defined supervisory approaches are specified within a continuum and the boundaries between approaches are deliberately not distinct. As such, the approach categories need to be seen, not as discrete compartments, but rather as stages in the continuous evolution of risk management and systems, with a change of approach marking a milestone in that progress. It is expected that any society wishing to move to a more sophisticated approach will develop their risk management and systems to the level appropriate to support the scale and nature of their business ambitions.

5.5

The PRA envisages that it would be possible to stay within a defined approach and still have some internal limits that are larger than the PRA’s indicative expectations, provided that the management capability and control structure is adequate for those areas of additional risk: such limits would be seen as ‘extensions’. If, however, the board of a society wishes to adopt policies and pursue business opportunities that take the society’s risk profile well beyond what is envisaged for its existing approach (eg where numerous indicative limits would be exceeded), the PRA is likely to conclude that it would be appropriate for the society to adopt the next, more sophisticated approach (ie change approach) rather than seek ‘extensions’. Where there is potential for doubt about whether an ‘extension’ or a change of approach is needed, societies are expected to discuss their plans with their supervisors.

5.6

Where societies identify a need to make changes to their lending, funding, treasury investments or interest rate risk or structural risk profile, it is likely that the move to achieve this will be gradual. The PRA would expect to discuss with each society its plans, which would include an appropriate period of time over which any realignment would be implemented.

5.7

In considering approach ‘extensions’, societies are expected to assess whether they have the requisite expertise, management information systems, accounting systems and risk controls to undertake the additional business to be undertaken. As set out in Chapters 3 and 4, there are specific additional considerations associated with different types of lending and treasury activity, and it is important for boards to satisfy themselves that their societies have the capabilities and resources to undertake these activities safely.

5.8

A society planning to extend its approach is expected therefore to propose changes to relevant policy statements and have these approved by the relevant committees and the board itself. Societies may be asked to provide their PRA supervisor a copy of the board paper, which will be expected to:

1. (a) set out the clear business rationale for the change;
2. (b) clarify and quantify the additional risks and benefits from undertaking the new activities, both in ‘steady state’ and under stress;
3. (c) explain how the proposed internal risk limits for the new activity have been calibrated, and how performance against these limits will be reported to relevant committees and the board; and
4. (d) provide a detailed timeline and operational plan of how the society is intending to implement the change.

5.9

Following notification of the proposed change, the PRA will acknowledge the application in writing. The PRA cannot stipulate a standard timescale for its full response, since that will depend on the specific circumstances of the case. The PRA will review the documents and may have questions or observations on the proposal, including potentially requesting additional information before it can provide commentary and feedback to the society. If the PRA identifies significant issues that need to be addressed, the society will be expected to resolve these before implementing the approach extension. The PRA will maintain consistency in its judgement by discussing and agreeing internally its feedback with a panel of supervisory managers and technical specialists.

5.10

Whatever their existing positioning within the three approaches to managing the lending book, or the four approaches to treasury risk and financial risk management, the PRA expects societies to continue to develop their expertise, and to change their approach if and when necessary. Any society that wishes to move approaches should contact its PRA supervisor at an early stage to discuss its plans and the work it envisages to be needed as part of the change.

5.11

The PRA will expect a society changing approach to demonstrate that it has in place the requisite expertise, management information systems, accounting systems and risk controls before any significant change in its lending policy or treasury activities is implemented.

5.12

A society planning to change approach is expected therefore to prepare a revised set of policy statements compatible with the approach it now wishes to adopt, and have these approved by the relevant committees and the board itself. Societies can expect to be asked to provide to the PRA a copy of the board paper, which would:

1. (a) set out the clear business rationale for the change;
2. (b) explain how the society will be capable of managing any increased risks to which it will be exposed, including a detailed analysis of control systems, IT and operational capabilities, regulatory reporting requirements and MI production that will be needed to operate safely under the new approach;
3. (c) include a forward-looking assessment of the extent that a changed risk appetite might impact on the safety and soundness of the society and its regulatory requirements (eg how will it affect all capital, liquidity, operational and conduct risk drivers). This would cover both the upside gains anticipated from making the change, and the downside risks, with the latter calibrated through appropriate scenario analysis and stress testing;
4. (d) include clear new policy limits that express the board’s risk appetite; and
5. (e) provide a detailed timeline and plan of how the society is intending to implement the change.

5.13

Societies changing approach will be expected to ask their internal auditors to review and comment on the proposed changes to provide assurance that all relevant risks have been properly identified and mitigated, and that the implementation plans are achievable. The report from internal audit would be considered alongside the board paper, and societies can expect the PRA to ask for a copy of it.

5.14

The PRA, following notification of the proposed change will acknowledge the application in writing and send written feedback as soon as possible. The PRA cannot stipulate a standard timescale for this response, since it will depend on the specific circumstances of the case and its review of any documents requested. The feedback to the society will be based on a review by technical specialists and following discussion at a panel of supervisory managers which will aim to ensure consistency of expectations as compared with other societies (and equivalent expectations for banks). If the PRA identifies significant issues that need to be addressed, the society will be expected to resolve these before it implements the revised approach.

5.15

From time to time, the PRA may judge that an approach currently followed by a society is no longer suitable, either in light of changes to its business model or on supervisory reassessment of its risk management capabilities. This view will be communicated to the board of the impacted society, and the PRA would expect the society in question to adjust its business activity accordingly. If the society wishes to remain on its original approach, it will need to enhance its business processes and risk management to a level compatible with that approach. Until that has been achieved, the PRA would not expect the society to operate at the higher approach. Either way, the society would be expected to review its risk management policies and internal limits in light of PRA feedback.