Independent federal government agency outlines priorities for insurance sector

Marketplace volatility, climate risks, transition risk in particular, demographics, the speed of digital transformation and the resulting increase in cyberattacks, even company cultures are all on the list of things the Office of the Superintendent of Financial Institutions (OSFI) is focused on now and in the near future. The topics all formed the basis of a “fireside” presentation with Neville Henderson, OSFI’s assistant superintendent with the regulator’s insurance supervision sector, at the virtual KPMG 30th annual insurance conference, Reimagining Insurance. 

In conversation with Chris Cornell, partner and audit and insurance national sector leader with KPMG Canada, the discussion also addressed international financial reporting standards (IFRS 17) implementation expectations and the current challenges that regulators and companies alike have in attracting and recruiting talent.

Recruitment and retention challenges 

“One point we’re struggling with, even in my sector, is the number of early retirements,” Henderson says. “It’s really difficult to understand the reasons why people are leaving early, but a number of them have said it’s because they’re exhausted. The work environment has been very tiring, and they don’t see that improving after the pandemic. They think that the changes in the work environment will actually move in the opposite direction – we’ll be working more hours, rather than less.” He adds that the impact has been a considerable loss of supervisory expertise. “That’s difficult to replace. It’s not available in the employment market.” 

Like companies, he says the regulator is pressed to train and fill those roles, but candidates with even basic industry knowledge are difficult to find. While an option might be to hire inexperienced, motivated people and fully train them on the work and the culture of the organization, “we recognize that once you’ve picked good people and trained them, they become targets for other employers. Retention becomes an issue,” he says, adding that how companies address and implement back to work plans will have a real bearing on how many staff they retain.

For companies, on the technical side in particular, those requiring IFRS 17 implementation expertise and those needing climate change test scenarios run, are also finding it hard to find staff. “They’re in demand, and they’re paid well,” he says. “Getting them to move is difficult.” 

IFRS 17 

Regarding IFRS 17, despite staffing challenges, Henderson says most companies are on plan and believe they can still meet their targets. 

“I know that keeping on top of all the work has been challenging and it’s certainly not without cost,” he says. “We’re aware the many resources needed for implementation are in high demand in the market, making them difficult and expensive to obtain. There are real challenges getting the work accomplished on time, and of course, there are a lot of other projects that are (occurring) simultaneously.” 

That said, he adds that the regulator remains committed to working with stakeholders “to support a robust IFRS 17 implementation. We think it’s critical,” he says.

“Part of the work remaining for us includes finalizing the capital guidelines and doing a transition readiness test to make sure that the returns and systems are producing the right results. We will be sharing more details on this in the spring.” 

Keeping up with digital transformation 

The sheer speed of digital transformation, meanwhile, he says, “is a regulatory nightmare.” While COVID-19 sped up the shift of operations towards digital platforms and third-party providers, he says this raises the scope and potential impact cyber risks could have on businesses. Coupled with rapid advances in artificial intelligence (AI), machine learning, data storage and analysis, he says all of this is creating an ever-changing landscape for institutions and regulators alike.

Rapid-pace developments in digital transformation have also brought with them an increase in the number of cyberattacks companies face. “The attacks themselves are becoming more sophisticated and criminals that perpetuate them are becoming increasingly knowledgeable. Some are linked to governments, so they have substantial resources backing them. I don’t think any institution has developed an immunity to cyber risk,” he says. “It will take regulators and the industry combining their skills to protect against attacks. There will never be a panacea.” 

He adds that the regulator is planning a consultation on new draft guidelines for technology and cyber risk management. Plans also include the production of a revised guideline on outsourcing and third-party risk. This, he says, will be released early in 2022. “Our sense is that cyber risk is a perpetual problem. The industry as well as regulators will have to continually track the breaches and shift their responses if the criminals change their mode of attack.” 

He says cyber insurance underwriting risk has also become a strategic priority for the regulator. “The increasing reliance on technology makes policy holders more vulnerable to risk. Today’s interconnectivity creates a dependency maze across businesses and their partners,” he says.

“There’s a need to keep policy wording up to date given the fast pace of evolution of the technology. While some insurers are doing this already, we are encouraging insurers to consider the rapidly changing, increasing, and wide range of exposures as they review and modify their risk management objectives and practices.” 

Climate change and transition risk  

As for the actions the regulator hopes insurers are taking to deal with the risks that climate change pose to their businesses, Henderson points out that most things climate related are also dynamic and changing very quickly. 

“The transition to a lower carbon environment and lower greenhouse gas emissions is going to be borne by institutions with long term liabilities which are backed by long term assets, much of which is invested in fossil fuels or industries dependent on fossil fuels,” he says.

“Transition risk is actually the most difficult to quantify and is heavily dependent on how rapidly the transfer takes place. A slower pace of change may help companies manage the transition but increases the likelihood of more dramatic financial consequences. A quick pace could complicate operations and disrupt investment strategies but may be less costly in the long run.” 

In the future, he adds that more companies are likely to be drawing on the industry’s expertise and support as climate-related risks are identified. Failure to identify and disclose carbon risks can lead to investor concerns.

“OSFI has been monitoring this situation,” he says. “We expect companies to identify their exposures to climate risk. We have been asking some of them to stress test their vulnerability and establish plans to manage exposure going forward.” 

Marketplace volatility 

The regulator also plans to look at change management behaviour in upcoming review work and continue work which began at the end of 2019, to add cultural components to its supervisory reviews. Finally, he says the regulator expects there will be considerable marketplace volatility following the pandemic.

“We’ve been reviewing financial condition reports and stress testing results to ascertain the potential impact given the levels of available capital,” he says. “Our sense is the at the industry is resilient and it will manage through the period of volatility following the pandemic. Nonetheless, I suspect the consequences of the pandemic will have long lasting impacts that will shape business decisions for years to come.”