On 26^th March 2008, the Financial Services Authority (FSA) published a summary of the review conducted by its internal audit division into the supervision of Northern Rock.  This constituted the executive summary of a full report.  Hector Sants, FSA Chief Executive, had requested a 'lessons learned' review of the supervision of Northern Rock to be conducted by a team headed by its Director of Internal Audit. The FSA's Board confirmed its support for the FSA's philosophy of outcomes-focused and principles-based regulation with financial firms being primarily responsible for ensuring their own financial soundness. The Board also accepted the regulatory failings identified although noted that even if Northern Rock had been supervised to a higher standard, its funding difficulties and subsequent public acquisition would not necessarily have been avoided.  (There is also some anecdotal evidence, not mentioned in the Review, that officials at the FSA were also questioning as part of their routine supervisory meetings with other large former building societies as to why they were not adopting Northern Rock's funding model since it appeared to have been so successful!)

The internal audit review, which appears to be couched in terms of 'FSA management speak', (almost as incomprehensible to the layman as Eurospeak'), confirms four main failings in connection with Northern Rock. There had been a lack of sufficient supervisory engagement with the firm with the supervisory team not following up rigorously enough with management on the business model vulnerability arising through changing market conditions. There had been a lack of adequate oversight and review by FSA line management on the quality, intensity and rigour of the firm's supervision. There had been inadequate specific resource directly supervising the firm and a lack of intensity by the FSA ensuring that all available risk information was properly utilised to inform its supervisory actions.  In this article George Walker considers the summary Review in more detail.

A number of high-level recommendations are made in this Review. These include FSA senior management having increased engagement with high impact firms, increased rigour in day-to-day supervision, increased focus on prudential supervision (including liquidity and stress testing), improving the use of information and intelligence in supervision, improving the quality and resourcing of financial and sectoral analysis, strengthening supervisory resources and increasing the level of firm supervision oversight.  (Subsequently, there have also been a number of resignations (some at a high level) of FSA officials, although the Chairman of the FSA remains in office until his normal retirement later this year.)

FSA Supervision

The review considers the supervision of Northern Rock between 1^st January 2005 and 9^th August 2007 only and the tightening of wholesale funding markets including securitisation markets. This was referred to as 'the crystallisation of a low probability, high impact risk' which led to the Northern Rock seeking emergency liquidity assistance from the Bank of England and consequently a run on its retail deposits. The review considers the information available within the FSA and externally with the FSA's approach to the supervision of five other firms being considered to determine whether Northern Rock was an outlier and whether the FSA's supervisory strategy for Northern Rock was in line with its risk profile. Sixty-five staff and former staff within the FSA were interviewed and one hundred and twenty nine files were reviewed.

The principal conclusion of the review is that no assurance could be provided that the prevailing framework for assessing risk was appropriately applied in relation to Northern Rock and that the supervisory strategy applied was in line with the firm's risk profile. This was specifically referred to in the Internal Audit Directorate's terms of reference and was based on the combined effect of, amongst other things, the maximum supervisory period used being thirty-six months, the failure to update the Interim Risk Manager System (IRM), the absence of a Risk Mitigation Programme (RMP), the high turnover of senior FSA management, insufficient engagement with the firm and the long intervals between supervisory meetings. The Review also concludes that the supervision of Northern Rock was at the extreme end of the spectrum of the supervisory practices considered. Northern Rock was also an exception in terms of the number of supervisory meetings held. Only one other firm was supervised by the three heads of departments concerned at the FSA and four firms fell into the thirty-six months supervision period category. Northern Rock was the only firm without an RMP.

Northern Rock was supervised by a department within the Major Retail Groups Division of the FSA which was primarily responsible for insurance groups until June 2006. This followed an earlier reorganisation in April 2004 to create separate business units for the supervision of retail and wholesale firms. Northern Rock was supervised by a team which was only otherwise responsible for one insurance group between June 2006 and February 2007 after which Northern Rock was supervised with deposit-taking peers. Three heads of department were then variously responsible for Northern Rock although there was continuity at the manager and lead associate levels.

The ARROW Panel graded Northern Rock as low-probability and lengthened its supervisory period from twenty-four months (as proposed by the supervisory team) to thirty-six months with no RMP being required. Northern Rock was initially assessed under ARROW I and then transferred to the new IRM system under ARROW II in December 2006. The Review considered that the subsequent supervision would be important in light of the concessions allowed although Northern Rock's supervisory team did not appear to be aware of the full implications of its own close and continuous supervisory meetings requirement. Only one set of such meetings was conducted during the two years between 1^st January 2005 and 9^th August 2007, for example, with only the most minimal agenda and records being kept. A number of other additional risks arose during this period especially with regard to Northern Rock's Basel II assessment and new business risks. Ten 'Basel visits' had been conducted with new risk indicators arising in terms of management stretch, specialist reliance and risk management weaknesses. The business risks that arose with the substantial growth in the bank's lending book did not result in a RMP plan being required nor were any changes in the ARROW risk scores shown in the IRM. The Review concluded that the FSA's supervisory team had not adequately identified and pursued all relevant risks either as a whole and in relation to Northern Rock's business model and control framework. There was inadequate engagement and oversight by supervisory line management and insufficient heads of department involvement at the FSA partly due to breaks in management continuity.

The Review concluded that the ARROW Panel should have been provided with a more comprehensive analysis of the risks inherent in Northern Rock's business model with the firm's planned growth should have led to an RMP being agreed. It was nevertheless accepted that the Panel was entitled to hold that Northern Rock was a low probability risk on the material provided to it. Certain key risks were identified during the Panel process including the viability of the firm's strategy and need to maintain access to funding and especially securitisation. These risks were nevertheless not taken forward by the supervisory team having regard to Northern Rock's increased business risk profile and control framework. The lack of formal risk assessment and amendment to the IRM meant that there was no trigger to reassess the level of supervisory resource nor to increase FSA management scrutiny. There was inadequate line management supervision nor were there any effective mechanisms to trigger a periodic review.

The terms of reference refers specifically to considering the adequacy of the FSA's risk framework, coverage of stress testing, liquidity and governance and management competence, intelligence and information flows and supervisory resources. The Review concluded that the ARROW risk framework was appropriate to support effective risk-based supervision. While a number of improvements have been adopted under ARROW II, further Recommended Actions are made although no separate ARROW III is suggested. Firms should be required to explain the vulnerabilities of their business and strategic plans as part of regular stress testing although the Review accepts that practice in this area was developing during the period of review especially in connection with the Basel Pillar 2 Internal Capital Adequacy Assessment Process. The FSA's approach to liquidity during the review period had assumed that in extreme circumstances liquidity would be provided by the Bank of England and made available to systemically important institutions in extreme cases. The FSA's liquidity risk identification was not sufficiently effective having regard to the level of risk that arose.  However, a number of weaknesses were subsequently identified with the thematic work conducted on liquidity and securitisation. Assessment of governance and management were generally considered sound although inadequate action was taken where uncertainties arose concerning management.

Improvements were recommended in connection with intelligence and information flows, in particular, to enhance the use of available intelligence and to secure two-way exchanges. There had been inconsistent and poor use of publicly available data, inconsistent implementation of the ARROW sub-sector issue mechanism and the absence of any arrangements to develop priorities from the FSA's Financial Risk Outlook with no clear responsibility for peer firm analysis and identification of outlying firms. Prioritisation decisions and resourcing capacity issues, including reduced staff numbers, had led to core areas of risk assessment being ignored especially as market conditions worsened. The quality of risk assessment had been damaged as part of the FSA's policy of 'fewer, better staff', but with ineffective senior oversight. These difficulties were aggravated by inadequate record-keeping especially in connection with key meeting records (which although the review document does not state it, must be evidence of pure laziness on the part of the staff concerned), document filing and IRM updating.

Recommendations and FSA reaction

The FSA has adopted a dedicated supervisory enhancement programme in response to the internal audit review although this includes improvements that were already planned by it. A new group of supervisory specialists will review the supervision of all high impact firms to ensure that procedures are properly complied with. The number of supervisory staff engaged with high impact firms will be increased with minimum staff levels being appointed and maintained for each firm. The current specialist prudential risk department will be upgraded to divisional status and expanded with the resources of the relevant sector teams concerned also being extended. Supervisory training and competency are also to be upgraded. FSA senior management involvement will be increased in direct supervision and contact with high impact firms. There will also be increased focus on liquidity especially in the supervision of high impact retail firms. The competence of senior management within firms will also be highlighted in future.  (Indeed, the House of Commons' Treasury Select Committee has also posed the question in its initial report on Northern Rock as to whether the chief executives of banks ought to hold some banking or professional qualification, in future,)

In addition to these seven high level recommendations, ten specific recommended actions were also specified by the Review. There should be an ongoing supervisory assessment of all appropriate core ARROW risk areas (including capital and liquidity) for high impact firms including specifically deposit-takers and investment firms with no de-prioritisation. The heads of departments responsible for supervising high impact firms should formally review the supervision of each firm every six months with any significant changes being taken into consideration since the last formal ARROW risk assessment and last head of departments' review. ARROW Panels must consider all relevant core risk areas for high impact firms including capital and liquidity, again with regard to deposit-takers and investment firms with extended financial analysis reflecting market conditions and the firm's business model. Supervisors should carry out an annual review of the business and strategic plans for each high impact firm including stress testing, assumed management actions and the firm's opinion as to possible instability scenarios. Priority risks should be identified in the Financial Risk Outlook through a specific strategy which is then incorporated into firm supervision. There has to be a clear assignment of responsibility for peer analysis of firms and for identifying outliers having regard to their business and business models within each sector or sub-sector. The FSA's Interim Risk Manager system should be updated to reflect changing developments in accordance with an appropriate set of revision principles.  With regard to liquidity, the FSA should develop clear timetables for the implementation of changes to the qualitative and quantitative Handbook material with qualitative requirements being implemented as soon as possible. Senior management must monitor the balance of supervisory resource planned against key supervisory activities/priorities for each firm using a 'bottom-up approach' and a 'zero-based budget'. Current training arrangements should be significantly enhanced to ensure that staff receive appropriate training and that all roles match relevant skills and experience. Many of the recommendations develop existing ARROW II and stress testing proposals with formal methods being adopted to allow senior managers to confirm relevant progress. A further implementation plan and timetable should be produced by the Chief Executive to give effect to these recommendations. The recommendations are generally considered to support the FSA's move to a more principles-based regulatory approach.

The FSA's Response Statement

In its response statement, the FSA executive under Hector Sants has agreed to implement the improvements proposed in both the Internal Audit review and in the tripartite consultation paper issued with HM Treasury and the Bank of England earlier this year on depositor protection and financial stability. Northern Rock's difficulties arose from the failure of its board and executive to create a sustainable funding model that could withstand the exceptional market circumstances that occurred in the summer of 2007. The FSA has nevertheless developed a supervisory enhancement programme strengthening its overall supervisory process incorporating other changes that were already being effected.  This will be incorporated into its three-year plan 2007-2010 with the primary objective of creating an effective management, operational and cultural framework to deliver more effective principles-based regulation.

Under this programme, the FSA's basic regulatory philosophy will remain based on the allocation of primary responsibility for the management of a financial institution with its board and executive management. The supervisory framework would then attempt to ensure that the board and executive discharge their responsibilities effectively. The FSA will continue to use and improve its ARROW II framework and operate a 'principles and outcome based philosophy'. Allocation of resources will be assigned on a risk-based and proportionate basis in light of its funding although all high impact firms will be subject to a minimum level of adequate supervision. The FSA cannot ensure that no institution fails but will try to balance risk mitigation with consumer protection and market stability while promoting innovation and competition. A number of more specific core enhancements will then be adopted with regard to culture and people1, organisation2, process3 and technology4.

The FSA's internal audit review identified certain specific failings with regard to Northern Rock which partly related to policy (principally in connection with risk identification and mitigation), but which were essentially concerned with operational matters. All relevant risks had to be identified including liquidity and funding risk as well as business model risk with these exposures being reassessed as market conditions change. This supervision conducted must be of quality, intensity or depth and credibility with the staff concerned having appropriate numbers and being properly trained. Effective oversight processes must also be in place including reporting channels to senior management within the FSA.

The FSA's response document was solid enough in the author's view, although it tends to focus on technical and operational matters. One of the key issues not discussed in adequate detail either in the Review or the FSA's response is the action that should be taken in dealing with firms where heightened risks are identified. Supervisory staff and supervised firms must both be fully aware of the importance and consequences of such supervisory risk adjustments. It is meaningless to talk in terms of risk revision if no consequential direct regulatory action or sanction is to be taken. The other the two key issues from a more general financial perspective that remain are to develop closer operational relations between the FSA and the Bank of England in terms of financial stability and between the UK authorities and overseas agencies in the event that a crisis arises with a major cross-border firm. Only minimum or outline provisions appear to have been agreed in this regard to date. These remain core omissions and represent one of the weaknesses of relying on an internal review in circumstances which would have justified a more independent, external review by an outside party or consultants.

Professor George Walker

Centre for Commercial Studies, London