HBOS Insurance and Investment Division “A New Force In Risk Management” Paul Moore - November 2002.

HBOS Insurance and Investment Division

“A New Force In Risk Management”

Paul Moore - November 2002

Our objective

Our objective is to work with our business colleagues to Our objective is to work with our business colleagues to increase shareholder value.increase shareholder value.

[Note:- We recognise that understanding the needs of our other [Note:- We recognise that understanding the needs of our other stakeholders – our customers, colleagues, regulators, communities stakeholders – our customers, colleagues, regulators, communities [and families] - is central to achieving this objective][and families] - is central to achieving this objective]

Good ideas need wings, an undercarriage ……….and results which stick!

Our strategy for risk management

The right people with the right mixture of skills

Being passionately business focused

Striving for simplicity with clear accountability over process and

complexity

Leading a culture of openness and excellence in which fear,

blame and pride have no part

Helping management to drive down the costs of managing or

failing to manage risks while driving up the profits from taking

them

The right people with the right skills

This part of the strategy is focused not only on risk management This part of the strategy is focused not only on risk management

professionals but on business management itself. Probably the single most professionals but on business management itself. Probably the single most

important key to risk management is having the right people in the right jobs.important key to risk management is having the right people in the right jobs.

In relation to risk management professionals, the skills we will focus on are:-In relation to risk management professionals, the skills we will focus on are:-

– Deep business understanding and empathyDeep business understanding and empathy

– Client relationship / communication and influencing skillsClient relationship / communication and influencing skills

– Technical skills – analytical and forensic skills and the skill to be able to develop Technical skills – analytical and forensic skills and the skill to be able to develop

technical knowledge fasttechnical knowledge fast

– Judgement – the ability to weigh up facts, analyses, technical knowledge, business Judgement – the ability to weigh up facts, analyses, technical knowledge, business

understanding and creativity with the needs, requirements and perspectives of understanding and creativity with the needs, requirements and perspectives of

multiple stakeholdersmultiple stakeholders

– CreativityCreativity

– Independence, integrity and personal courageIndependence, integrity and personal courage

Being passionately business focused

This means we are there to understand and support our business colleagues not to act This means we are there to understand and support our business colleagues not to act

as an “internal police force”. We do not believe in “The answer’s “no”, now what’s the as an “internal police force”. We do not believe in “The answer’s “no”, now what’s the

question.question.

We will work with our colleagues in a client focused way so that together we meet the We will work with our colleagues in a client focused way so that together we meet the

needs of our common stakeholders.needs of our common stakeholders.

Being business focused DOES NOT MEAN only giving messages that are not Being business focused DOES NOT MEAN only giving messages that are not

challenging but we will work incessantly to make our difficult messages digestible and challenging but we will work incessantly to make our difficult messages digestible and

understandableunderstandable

Being business focused does not mean letting business colleagues simply ignore other Being business focused does not mean letting business colleagues simply ignore other

stakeholders in their decisions, and so……..stakeholders in their decisions, and so……..

““It takes two to tango”. We expect our business colleagues to work with us in an It takes two to tango”. We expect our business colleagues to work with us in an

environment of mutual respect and top business leaders to be the sponsors of this and environment of mutual respect and top business leaders to be the sponsors of this and

“walk the talk”“walk the talk”

Simplicity with clear accountability

Good risk management is much more about the exercise of well-informed, well-educated

and well-timed judgement within a framework of clear accountability than detailed policy

or process

Process is a highly valuable means to an end BUT NOT an end in itself. Process is

particularly valuable as guidance and structure in new environments and when

regulation requires it.

“More is often less” e.g. too much reporting can lead to “missing the wood for the trees”

The risks associated with too much prescription is that people follow the rules blindly

and never reflect on the ambiguities and dilemmas involved in managing risk.

In the new knowledge economy, centralised decision making slows you down and makes

you uncompetitive. Too much process can stifle creativity, courage and pace.

A culture of openness and excellence

One of the keys to good risk management is having the right culture.One of the keys to good risk management is having the right culture.

The culture – what’s “in”The culture – what’s “in”– Openness– Excellence – total dedication to getting things right first time and continuous

improvement – this drives down the costs of managing / failing to manage risks– Standards of conduct and good business ethics

The culture – what’s “out”The culture – what’s “out”– Fear and blame go together and discourage openness– Pride– What we can get away with not what is right.

Pride may be the most risky of these because it encourages the “not invented Pride may be the most risky of these because it encourages the “not invented here” syndrome. “Pride comes before a fall”– Hubris = Nemesishere” syndrome. “Pride comes before a fall”– Hubris = Nemesis

NB the strain between “accountability” and “no blame” – people cannot be NB the strain between “accountability” and “no blame” – people cannot be accountable until they have the competence and confidence to carry out the accountable until they have the competence and confidence to carry out the accountability.accountability.

Is “situational leadership” part of the solution where accountability is dependent Is “situational leadership” part of the solution where accountability is dependent not only on job title and its MAP but on the “readiness” of the jobholder.not only on job title and its MAP but on the “readiness” of the jobholder.

Good risk management increases profit

““If you want someone to do A, pay them to do A”If you want someone to do A, pay them to do A”

If you want business managers to manage risk, pay them to do If you want business managers to manage risk, pay them to do soso

We will focus on achieving transparency of the costs relating to:-We will focus on achieving transparency of the costs relating to:-– Managing risks…down to activity levels.Managing risks…down to activity levels.– Failing to manage risksFailing to manage risks– Identifying profits associated with taking risksIdentifying profits associated with taking risks

This has been called “the institutionalisation of quality cost This has been called “the institutionalisation of quality cost measurement”. It must not be too complexmeasurement”. It must not be too complex

We need to agree what our risk appetite is and what this means.We need to agree what our risk appetite is and what this means.

We need to agree ways of increasing the upside associated with We need to agree ways of increasing the upside associated with our plans by taking more risks e.g AIG’s approachour plans by taking more risks e.g AIG’s approach

Key early challenges – a recipe which could curdle!

Key challenges in achieving our vision and strategy are as follows:-

– Newly merged organisation– New division– New management teams with varied experiences and backgrounds– Ambitious growth targets in a very difficult market place– Complex and difficult projects to deliver– A plethora of new regulatory / governmental / EEA policy initiatives

and new regulation– New devolved approach to corporate governance and risk

management within HBOS– New functional teams– Divisional risk management leadership introducing a major change

programme into the way we manage risk - the “start-up” year– Plus pre-existing issues and risks within the Division need to be

managed

People matters matter most Our own way of working together will be informed by:-

A dedication to technical excellence, client service, independence, integrity, courage etc.

Values and ethics – “Moving beyond compliance”

We will support each other and create a developmental culture – “The more I help others succeed, the more I succeed myself– “In the modern knowledge economy learning is a key strategic imperative not

irritating and expensive training”

“Feedback is the breakfast of champions”

A professional collegiate atmosphere – a team bound by common objectives

A cohesive approach to leadership and management based on the “situational leadership” model

Fun is part and parcel of the recipe

Balance in our lives……is part of risk management – “Too many emails can damage your health!”

Our vision for risk management

To become trusted advisers to our colleagues within IID

and HBOS Group by providing a simple, understandable and

business focused approach to risk management within the division

To become a “New Force In Risk Management” by becoming

an independently acknowledged benchmark for best practice.

To become the first choice employer for the best risk

management professionals by reinventing the approach to

organisational development.

A little more about risk management frameworks

A good risk management framework SIMPLY covers the following bases and has simple processes to implement such a framework………….

A simple risk management framework

Identify and analyse Identify and analyse risks accordinglyrisks accordingly

Train Train & explain & explain

UnderstanUnderstand business d business activitiesactivities Identify business Identify business

and external and external requirements requirements

Define Define accountabilitiesaccountabilities

Take Take actionaction

ReviewReview

Produce MIProduce MI

Check / Check / assureassure

Changes in business or external

requirements

Changes in appetite for risk

Changes required after “review”

Design Design business business processeprocesse

ss

Some other key messages

We are not going to treat the business like this………We are not going to treat the business like this………

We say this……..We say this……..

Risk management and compliance is not “rocket science”

If we implement this strategy and do these things together If we implement this strategy and do these things together as a team, we will avoid the stereotype……..as a team, we will avoid the stereotype……..

Risk management - a play in three acts?

The businessThe business Risk Risk managementmanagement

Real risksReal risks

And then, we can achieve the real goal…………….And then, we can achieve the real goal…………….

Risk management department - the ultimate vision

Risk managementdepartment