Risk and business assurance

– changing expectations

Greg Campbell 3 March 2015

Top 5 global risks (Zurich Insurance)

You can’t escape it…

• Financial capacity risk

• Liquidity risk

• Diversification risk

• Lack of diversification risk

• Development risk

• Growth risk

• Stagnation risk

• Regulation risk

• Demand risk

• Supply risk

• Sale and leaseback risk

• Reputational risk

• Business continuity risk

• Health and safety risk

…wherever you are

• Cosmopolitan, Housing 21

• Southern Cross, Castlebeck

• Mid-Staffs NHS Trust

• RBS, HBOS, PPI, LIBOR

• Lakanal House

• Connaught, ROK, Kinetics

• KPMG, JP Morgan

• Tesco, The Co-op Group

• US National Security Agency

• BBC, News of the World

• Glasgow Rangers, Portsmouth FC, Harlequins

“The good old days”

• A simpler environment

• Housing providers (relatively) straightforward

• Big = 15-20,000 homes

• Inspection

• Prescriptive regulation

Traditional approaches to risk

• Risks? To be avoided! Leave risk to the auditors

• Remember the Housing Corporation risk list…

• For instance - 1/3 of your business in supported housing…

• Probability x Impact

• Focus on internal controls

• Focus on operational assurance –

“Are we doing things right?”

But now…

• Diversification - range of business streams

• Commercial competition; for-profit providers

• Non-RP parents

• Care and support, social enterprise

• Market renting, market sale

• New partners

• Joint ventures

• Different kinds of housing animals

And what’s more…

• RP regulation more hands-off

• Albeit now more complex

• No inspection

• Increasing focus on governance

• Greater onus on Boards to

demonstrate they understand the

issues and challenges, and are in

control

So how should we deal with risk?

• Look out for it?

• Avoid it?

• Manage it?

• Mitigate it?

• Embrace it?

• Love it?

Or accept that risk is ever-present and

applies regardless of size; so ensure we have effective business assurance systems

The big question for Boards and Execs

How do you know

you’re any good?

Comprehensive approach to risk

• Shift towards strategic assurance:

“Are we doing the right things?

Have we identified the right risks?”

• Board oversight

• Inputs from:

Executive and middle management - performance

management, line management, supervision

Effective whistle-blowing culture

External audit, internal audit

Resident scrutiny, mystery shopping, complaints

Specialist support/critical friend

Challenges

• Keeping it strategic

• Keeping it rigorous

• Keeping it manageable

• Keeping it proportionate

• Balancing delegation with

accountability – Board to

Exec to middle managers

• Incorporating into individual

targets, appraisals

What might that look like?

Business Assurance Programme

• Comprehensive risk matrix

• Interlocking ‘patchwork’ of assurance

• Input from all levels of the organisation

• Responsibility:

Head of Business Assurance

Reporting to Group Chief Executive

Reporting to Audit & Assurance Committee

• Joint framework with GreenSquare Group for internal

audit services and specialist reviews

Risk Matrix overview (extract)

And what about Stress Testing?

“The stress scenario is not a forecast. It is not a

set of events that is expected, or likely, to

materialise.

“Rather, it is a coherent, ‘tail-risk’ scenario that

is designed specifically to assess the resilience

of UK banks.”

Bank of England, April 2014

It’s all the rage!

Bank of England stress testing

• CPI 6.5%

• 10 year Gilts 6%

• Real GDP -3.5%

• Unemployment 12%

• House prices -35%

• Disruption in bank funding

markets

Stress testing – what it involves

• Base business plan

• How is it planned to change and develop?

• What might the ‘Perfect Storm’ involve?

• What would that Perfect Storm do to the business plan?

• What actions would you need to take to keep those

changes under control?

• What changes do you need to make to assumptions

and plans so that you could manage that Storm?

Stress test – then what?

• Reconsider/adjust your risk appetite

• Understand the scale of mitigating options/actions

• Understand the timing of mitigating options/actions

• Adjust your cushions and early warning systems

• Consider your decision-making processes/triggers/

powers

• ‘Prod’ the mitigations

Coping strategy

Sharing best practice

• HouseMark Business Assurance Club - launched 2013

• Supporting HM members in ensuring robust business

assurance, effective risk management, strong governance

• Meeting 3-4 times a year

• c.45 member-organisations

• Membership at CEO/Director/Head of Service level

• Supported by CT and Trowers & Hamlins

Greg Campbell

Campbell Tickell

greg.campbell@campbelltickell.com

020 8830 6777 or 0793 048 0244

@CampbellTickel1

Samantha McGrady

HouseMark

samantha.mcgrady@housemark.co.uk

024 7646 0500

@HouseMarkLtd