Thursday, Dec 09, 2021
BCP Impact of Pandemic on Supervisory Practices
In this podcast, the speakers discuss business continuity planning and the impact of the COVID-19 Pandemic on supervisory practices.
Title:
Business Continuity Planning: Impact of the Pandemic on Supervisory Practices
Speakers:
Karen Baderow
Former Chief Executive Officer, Isle of Man Financial Services Authority
Host:
Richa Goyal
Program Director, Toronto Centre
Date:
December 3, 2021
Listen to the Podcast
Read the full Transcript
Automated: You're listening to a Toronto Center podcast. Welcome. The goal of TC podcasts is to spread the knowledge and accumulated experience of global leaders, experts, and world-renowned specialists in financial supervision and regulation. In each episode, we'll delve into some of today's most pressing issues as it relates to financial supervision and regulation, the financial crisis, climate change, financial inclusion, fintech, and much more. Enjoy this episode.
Richa: On behalf of Toronto Center, I, Richa Goyal, would like to welcome you all to the Toronto Center podcast on business continuity planning, impact of pandemic on supervisory practices. Our guest speaker today is Karen Badgerow who is the former Chief Executive Officer with the Isle of Man Financial Services Authority and has over 35 years of financial services regulatory experience. Previously, Karen held senior roles with the Canada Deposit Insurance Corporation and at the office of the Superintendent of Financial Institutions.
Karen specializes in risk-based supervision of banks, insurance companies and pension plans. She has extensive experience in governance, risk management and assessment of AML/CFT risks. We are pleased to have Karen join us to share her experiences of managing BCP at the authority during the pandemic. Karen, thank you very much for joining us today. I would like to start by asking you, how did the pandemic impact your leadership style, and what most surprised you during the early months of the pandemic?
Karen: Hi. Thanks, Richa, and thanks for having me today. Real pleasure to join you and share some of my thoughts. I think it impacted so many people in terms of leadership style, and as Richa mentioned, I've had 35 years plus experience, and that's why I've lived through a couple of crises already, but this was so very different because it wasn't just financial economic. It was about personal wellness, and I think that's the piece where, as a leader, was the more challenging. You're trying to manage multiple priorities external to the organization, but very much concerned about the wellness of your own team during the same time. So, I think that's was a real challenge for leaders to be able to stretch yourself across the range of needs.
I think the other thing in terms of the communication piece, I've always thought myself a good communicator but it's hard to communicate when you don't know. And I think that was the uncertainty for leaders. It was quite difficult because you were trying to provide some level of assurance to your staff about their wellness, how we would cope, what was going on outside, but not really knowing. And I think as a leader, the important lesson for myself was really to be able to give yourself some latitude to change the message, because information was changing very rapidly and you had to be able to say, "Hold on. That's not quite right. Let's try this again." And I think that's hard as a leader because you want to exude this confidence and this certainty in things when the world around us was uncertain.
So, those are the parts that I really found my leadership style changed and was challenged a bit. I think the thing that surprised me a lot, and I really got some interesting insight into my executive team, was around risk appetite. And some people are comfortable making decisions with less information than others, and you really started to see how your leadership team operated together because we were all dealing with not a lot of information. So, some people were very comfortable in making decisions and others were less comfortable with the strategy. And it gave me the insight into probably how they think about supervision, because those things are personal characteristics around risk appetite, and that often translates into your other work.
So, you get some really interesting insight into personal behavior and how it reflects in professional performance. I thought that was fascinating. And I know, when Malcolm Gladwell, in one of his first early books on Blink talks about instinct and the value of instinct, but instinct is really a collection of experiences and knowledge, so you really had to rely on your professional instinct to make decisions at the early days of the pandemic, because again, the world was so uncertain and information was very, very uncertain. So, boy, you learn a lot about yourself in crises, I would say.
Richa: So, Karen, in terms of assessment of effectiveness, how did you ultimately know you were doing the right thing, given that there was really no road map for this kind of crisis? And what do you feel were some of the biggest gaps in the supervisory plus processes and practices?
Karen: That's a really good question. How do you ever know you're doing the right thing? The one thing I reflected on in the early days was the things that we know as supervisors. What do we do well? And you have to go back to first principles in any crises. So, as supervisors, we're very good at risk assessment. That's one of our skills and it carries us through risk-based supervision, market conduct supervision, but we're good at risk assessment. I think the other thing we're really good at is stress testing for outcomes. So really going back to first principles to understand what we were coping with and dealing with. So, when I think about risk assessment, I think about the fact that, how do we know we're doing the right thing? Well, we're always good at planning, so we had to really think about reprioritizing and replanning, and so being agile.
So again, you're assessing from what we knew about our firms, assessing what the new risks were. I think that was really important. And I think the other, as well, in terms of prioritizing. So, we could plan, but we had to really focus on reprioritizing as well. And again, as supervisors, we're fairly agile. So, again, how do we know we're doing the right thing? We looked at the risks out in the system, from what we knew, with what information we had, albeit limited information, and reprioritize based on that. I think the other thing in knowing it terms of are you doing the right things, was our stress testing capability. And that was really important, I think, for supervisors, for two aspects. One was in terms of distress testing your own capability.
So again, the extent to which we may have suffered or could suffer some loss in staff in terms of illness, other responsibilities, as we've talked about earlier, in terms of family responsibilities, stress testing our own capabilities to be able to deliver on our plan, and also stress testing firms' capabilities, given the uncertainties. So again, using our classic supervisory tools of risk assessment and stress testing, making sure we're largely on track. I think the other thing that how do we know we're doing the right thing, was really just setting out a plan. And going back to first principles is going back to your, you know, here we are today, our BCP plan. And, typically, as we asked firms to do, we asked them to set out contingencies around different scenarios.
And we had a scenario that perhaps we hadn't modeled for, because we assumed in most of our BCP plans that we'd be up and running in like five, 10, 30 days, and this was not the case. But again, the BCP framework provides some useful tools and guidance for staff. So again, going back to that first principle of the BCP planning, what do we know? What do we don't know? And that was quite helpful. And in our case, one of the things I think that really helped us to make sure we were being effective, I call it divide and conquer, but we organized ourselves, so we had a team that was purely focused on an internal wellness. Communication, technology, staff wellness, really keeping our eye on the ball in terms of our internal operations. And we had a team purely focused on external, what was happening in our stakeholder firms.
That was really important because they were very two critically important areas, but they required the proper attention and leadership to make sure that we were taking care of the range of things that were on our plate. So I think that was a really important way in terms of making sure that we remained effective. So things, like I say, ruthless prioritization, good planning and replanning, not being afraid to drop things, really critical. And finally, I just would, maybe a plug for the Toronto Center, and I can't help but do this, because the Toronto Center issued a very helpful note during the early months of the pandemic in terms of 10 issues for supervisors during crises. And what we did is, we did a self-assessment against those 10 principles and presented back to our risk committee, because it was very important for us to understand where we might have some gaps in our processes.
And so that was a very useful risk management tool for ourselves to do. I think that was really critical. Gaps commonly, I think, across supervisory authorities, one of the big gaps, was our technology, and we all suffered that because we all, A) had different technology, or none, in terms of the ability to have virtual meetings, and so we had to pick our poison in the early days, whatever we could grab to use. Our ability to share information and data with firms, I think that very common across supervisors where we didn't necessarily have that portal technology or technology that allowed that sort of sharing of information and data.
And like many firms and many other supervisors, the whole issue of legacy data systems. So, some supervisors, and not unlike ourselves, had a mix of paper versus sort of data systems. And so trying to marry the two together and making sure that we could provide sufficient information and access to our staff when we were offsite. So that proved to be one of the biggest challenges, but it really forced us to reconsider our priorities going forward.
Richa: These are really useful insights, Karen. Taking the discussion more specific matters on supervision, what was the impact of the pandemic on corporate governance standards, and how did the supervisory approach change or adapt to monitor the scene?
Karen: Well, one of the things, and this is often a lesson for many crises, is that really having access to the senior decision-makers. And post-2008 some of the guidance coming out of the Financial Stability Board was around access to board, and we observed post-financial crises that supervisors had different approaches. Some never had access to the board, or if the access was provided, it was to really listen and record and not really to engage. And the FFB really tried to promote that engagement model, but we're not all in the same place, and I think that really came to fruition during this crisis, is because it was really important to engage with the most senior decision-makers in organizations. So trying to encourage that conversation between boards and supervisors, because strategies were changing, firms were facing very similar risks, operational risks, contingency planning, that corporate governance approach to supervision was really important in the early days.
And I think, how do we monitor? I mean, clearly, for some of our larger firms, our access and our contact was more frequent, for good reason. The more systemically important those firms that were involved, the more public policy goals around easing of access to credit. And so again, supervisors really had to change a bit of their style because it went from a more formalized monthly or quarterly meetings to more frequent contact. And again, it's not always a space that supervisors are comfortable in. And I think we have to appreciate that every supervisory authority is different and the extent to which you never want to make your first contact when things go really bad, but in some cases that happened and we had to overcome that. In terms of just generally speaking, I mean, we had to be able to adapt in terms of some forbearance around appointments to boards and appointments to senior positions because we had emergency replacements in some cases, so that we had to have some latitude around how we approached our approvals process.
So I think flexibility was the name of the game, but making sure that we had that regular contact, the most senior people, because decision were happening very quickly, and again, often not with the fullness of information. I think one of the things I would observe in terms of the corporate governance standards, that level of cooperation did wane a bit as the pandemic persisted, because everyone, early days, and absolutely for the right reasons, that cooperation was critical. We all had the same real interest in terms of the wellness of our staff and the continuity of our businesses. And so we overlaid more data requirements, more information requirements, more frequent contact. And as the pandemic persisted, firms started to question whether or not this was all very necessary, and let's just get back to the business of doing business. So, trying to manage those relationships in the changing environment was also very challenging for supervisors.
Richa: And what do you think were some of the most important changes to your own risk management practices and your decision-making process?
Karen: Yeah, no, and a lot. I think that value of having those internal business continuity planning teams that focused internally was really important because a lot changed, I would say, and we had been fortunate enough to do some work around our own enterprise risk tolerance framework about 18 months before. It was a very useful piece of work and we were able to test ourselves against our risk tolerance had anything changed in our views on risk that we would have to temporarily change, alleviate, through the crisis. So, again, that was a really important element. I think the level of engagement, two really important aspects in terms of our risk management framework in terms of our board.
One was the risk committee and we invoked less formal meetings with risk committees, so we took ourselves outside that normal schedule and had phone catch-ups. And that was really, really important because it was not burdened by a formal reporting process, but rather a conversation around what we were seeing for risks. So we didn't burden ourselves, nor burden the risk committee with the formal sort of lots of paper, lots of fanfare. And also the other important aspect as to... Really struck me was our human resources committee. And they were very, very keen to help out where necessary. But one of the important things was around succession planning and emergency replacements.
We all do that process where we do our succession planning, who would step in if we had an emergency, but it was real because as part of our looking at our internal business continuity planning, we considered stress testing our capacity in the organization and what happened if staff had to leave, senior staff were out of operation for a period of time. So that whole work on our succession planning that we had done historically came back onto the table and we really had to look at that and consider whether or not we really had the right people that we could move across the organization. So it really focused on having a strong risk management framework internally and being able to rely on that in times of crises.
Richa: Karen, switching to the impact of the pandemic on consumers, what are your thoughts on growing consumer exclusion and the rising risk of misconduct or misselling, and fraudulent activities observed during the pandemic? Has this influenced your thoughts on market conduct supervision post-pandemic?
Karen: Yeah, no. I mean, I think, unintended consequences, many things that we think about as supervisors, and clearly at the early months of the pandemic when we were in lockdown, we moved from a system where people had face-to-face access to their insurance brokers, their bankers, their financial advisors, and had to really rely on technology. And that really had some positive outcomes, but in some cases, some unintended consequences for certain consumer classes. So we found people, it was really interesting, just sort of a... But we found there was limited access to our bank branches, but people would go to the bank branches just for human contact. It was quite interesting. So they would bring in the coins they had collected for considerable periods of time and bring them in just to have that human contact. It didn't seem to be a necessary thing, but it was necessary because people were quite isolated.
But what we found was that there were certain classes of consumers, more vulnerable consumers, that may have limited opportunities or limited access because of technology to the financial platforms. And that's always a concern. So it accelerated much of the changes that were happening in the industry in terms of banking and insurers moving to more digital platforms, which is a positive thing. But I think that change, and let's think about change management, the client or consumer cohorts didn't necessarily have that time to fully adapt to those changes. So we found that in some cases, just observing what happened, and in my experience, is that some consumers really felt a bit left out at times because these digital platforms were quite new to them. They had been classic branch, in some cases, or face-to-face consumers, and now they had to switch to more digital offerings.
From a market conduct perspective it raises new concerns, first and foremost, in terms of, I think, about data privacy and data security for individuals, and that goes with anyone who's really, really savvy to someone who's not as savvy. We all were providing very personal data onto very new platforms in some cases. So there's always a concern for data security and data protection. I think the other piece is around the classic concerns around market conduct issues, around misselling and misinformation. So, when two elements to that in terms are, consumers getting enough information, one, but is that information clear and does it allow them to discern opportunities in terms of product offerings? So, there's two ways of doing this. One, you can provide a whole bunch of information, but it's not very useful and consumers have a very difficult time making a decision and choice, and being able to discern product features.
Or we provide very little information and they just default. So I think that's always a concern when you're going to more digital platforms. A new way of offering products, services, and a new way for consumers, what kind of information do they need? And they're not necessarily having that conversation. So the things that are important are around making sure we're very clear, as supervisors, on what our expectations are around information and the quality of information provided to consumers in this new digital world. I think the one thing, as well, really highlighted for us is making sure that we provide that level of consumer education.
So what do we need to do as supervisors to really up the level of general knowledge and understanding? And indeed, from our perspective as supervisors, technology did provide us that opportunity to reach out to consumers more, because we were able to provide more in the way a podcasts, webinar series, online web information. So, again, making sure that we leveraged the opportunity to raise the standard of practice and care for consumers during the pandemic.
Richa: And in terms of risk-based supervision, did you reconsider your approach for smaller firms, given that all firms were facing similar risks during the outset of the pandemic? And what changed in your supervisory approach in terms of reporting, thematic reviews, or perhaps a small dedicated team to supervise?
Karen: At the start of the pandemic, I mean, everyone faced the same risk, in many ways, in terms of operational risk. It was different degrees of operational risk, but clearly we had the same issues and their contingency planning. So our starting point was very similar, but again, as supervisors, you have to be able to discern the most important things to deal with and the ones you can put aside. So, in smaller firms, you started to be able to see the distinction between the large and small firms. So, for the large firms, as I mentioned earlier, our contact was more frequent because of the systemic nature of their operations and the fact that they had more involvement in some of our public policy goals around our forbearance programs and easing of credit.
But for the smaller firms, they faced different challenges because often they were more the cashflow issues, sort of smaller offerings, more reliant on face-to-face with clients, smaller teams. So again, the impact of losing one person, the magnitude was much greater for a smaller firm. So again, we had to think about the risks that were particular to smaller firms. And we did some particular work around smaller firms that we really focused on in terms of their cashflow analysis work. So we did some real stress testing bespoke just for the smaller firms. We also considered the what ifs around failures because a lot of our focus had been post-crisis for many jurisdictions around big bank failure and resolution planning.
And we started to think about what would be a safe failure regime? A safe closure regime for smaller firms? And again, it was a very useful chapter that we wrote that will be added to the BCP plan because we really focused on what would it look like, administratively, if we were to lose a smaller firm, and how would that be managed? So really, really useful work. From a supervisory perspective, I think the things that we started to focus in on was the extent to which we could use other tools. So, absolutely things around... We moved away a bit from this onsite, single firm focus, because we just didn't have the capacity and the organization, and nor did the firms, as well. And that was the other piece as well. Their ability to cope during pandemics and managing onsite to more thematic approaches.
And also the use of questionnaires to ferret out the more important firms to spend time on. So we used those questionnaires to filter and consider the higher risk, I forgot to use that term, amongst the smaller firms. So again, we had to adjust our supervisory approach to be able to soft of... A bit more of a filtering and prioritization to allow the teams and to help the teams focus on the smallest. And we did some work early on as well, and this was a hard piece of work for supervisors, as it always is, on what was the most critical thing we had to do. And we did it throughout the organization in terms of looking at our policy, our approvals process, our supervisory process, our resolution work across, because again, we're trying to stress test our capability as an organization to cope.
And so we had to be able to discern what was the most critical pieces of work to be done in the first month, three months. That's very hard for supervisors in normal times because all of our work is important, but it did help us then to focus our work around, "Okay, now that we've done that, where do we allocate what we consider to be 'available resources' and really risk-based, based on our assessment of overall risk?" So lots of adjustments, and I think a lot of things that we took away where we're much better, I think, as supervisors globally at planning and reprioritize, because we just were constantly, constantly considering our priorities throughout the pandemic.
Richa: So, Karen, what were the big takeaways for you? And what changes do you think you would have retained or the supervisor should retain from this learning?
Karen: I mean, lots of takeaways and, here we are, I know, going into the end of year two, and still a lot to learn, I think. And it was interesting, in an article this morning I was looking at, talked about the mushiness of work environments in terms of, we're now in a world where we're dealing with some people in the office, some people on Zoom, and how do you cope with that? And that's a story for another day, because I think that's going to be our future world. But I think some of the things, I would say, lessons for how we arrange ourselves and our risk management frameworks, I think one of the things that it really illustrated was the importance of ease of access to the top of the house, and breaking down of hierarchies.
And I think that is true for both internal risk management and external. So the extent to which we had more access to board members and that would be the senior team, our risk people, very important, because it just allowed for less formality and real-time discussions about risks that were changing. And similarly for firms, making sure we had that ease of access. So really important. We all talk about delegation, delegation, delegation, how important it is, but when you're in crises and this has been historical, you really have to dig deep and delegate and give people accountability and responsibility at the same time because you can't do it all as leaders, and you really have to be able to, as I say, divide and conquer.
The other thing I would say around that as well is that, I think, our back office, people are often just sort of ignored, and they were the most critical people at the start of the crisis and through it in terms of making sure that we could continue to operate. So your operations people, your technology people, have them at the table. They're critical to decision-making. And I think about all the times that we were locked down, going back to the office, lockdown, we relied on, that's our staff, our heads of our operations teams, to really do that risk assessment. What would it look like to come back in the office? What would it look like to have social distancing? What would it look like to have half load, a third load?
So don't forget your back office staff. Internal policies are interesting because we have lots of policy procedures, but it really helped us to focus on two things. Data security. So, again, making sure that people really understood their responsibilities because there's some things you couldn't let go of. And so, making sure our data security policies were very clear and do more training where you need it. As well, we had specific data security requirements for our board members because we were removing from different countries. And so it's different having access when you're in the same sort of VPN world versus when you're not. So it made us think about other needs outside of our own needs as supervisors. So, again, thinking about your internal policies.
And as I mentioned before, Richa, don't be afraid to change your communication strategy or your communication points, speaking points, because things were changing and I think people just appreciated knowing something. This is what I know now, and things may change. We're often used to being very scripted and very careful in what we say as supervisors because we're dealing with firms, but you really had to come out there with your heart on your sleeve and be quite honest about what you knew and what you didn't know and what you weren't really sure about. The other thing I would say, a lesson for myself is, take care of your leadership team. They shouldered a whole bunch, and I think we often forget that everyone's leadership style is quite different and you've got to see, as I mentioned earlier, risk appetite being one element of leadership, but also the ability of people to have hard conversations.
And I'll tell you, we had Case No. 6 in our office and having to make that phone call to the people who sat with Case No. 6 was really hard, because we didn't know a lot then. That was like early days and not everyone could make those phone calls, and having that hard conversation with a staff member saying, "We think you might be exposed." And so, you learned a bit about the things that people were more comfortable doing. So making sure, as you look back on this, to follow up with some training, helping people get comfortable having those tougher conversations. Everyone's empathetic, but people show their empathy in different ways, and so I think it's really important. Don't lose the opportunities to train for some of those soft skills and support and coach people through those.
And I always say, don't let good learnings go to waste, and I think about our BCP work. We were fortunate to have slated an external audit review of our BCP. What luck is that? Very handy, and we thought we had it pretty nailed down, but there were a couple things they shared with us that were useful learning. So, have a third party look at your BCP plan, and we're not post-pandemic yet, but at the right time, because this is a chance to add that additional chapter, to just strengthen your framework. And, I would say, what were we to keep? I think things that we're to keep is the use of technology. I mean, it's been a real bonus I think for us to rely more on technology, and here we are today having a podcast. We engaged in much more sort of one-to-many opportunities with our stakeholders in terms of, we had webinars, we rolled out a new AML framework during the course of the pandemic.
So we had the opportunity to have a two-to-many opportunity to roll out the framework. We had over 400 participants, which was massive, and people could join in and it was really interactive. So, we used our technology to really reach more individuals, and that was fantastic. Also, though, as I said, some of the gaps that we observed and not unusually, not unusual for supervisors, is around technology and data. So take the chance to consider reinvesting in your technology as well. Don't miss that opportunity. And I think if you're going to make a case for budget, now's the time because that's the name of the game here, money. And because it's a really critical part of being able to operate in terms of having the right data, having the right technology, to be able to engage with your stakeholders, having the right data and technology to be able to hone in on the key risks and especially for small firm supervision where technology is really helpful.
So take the chance to pause and look at your data strategy, and if you don't have a data strategy, get one and reinvest in that. So I say that would be really a big learning. But I always say, there's nothing like physical presence, and I think people have really missed that. Think about it in terms of, for supervisors and the whole team environment, we're used to leaning over the desk and having a conversation, and that is missed. And I think for our young and upcoming supervisors is that the chance to be mentored personally. We did a lot of onboarding of new staff during the pandemic and that was great, but there's nothing like sitting beside someone, looking at that file, looking at that plan, and that's important.
And that's important for just your social development in early days of your career and as well for firms. There's nothing like looking across the table and having that conversation and reading the body cues, reading where people are uncomfortable, reading where people are looking at someone else to fill the gap and the answer, that physical presence. You don't want to lose that, for sure. So those are some of my thoughts, Richa, on BCP and what will remain.
Richa: Karen, it was very interesting to hear about your pragmatic and proactive management of BCP during the pandemic. It was a great pleasure talking to you today and thank you very much for sharing your valuable experiences with the Toronto Center Community and giving supervisors food for thought for the road ahead. Thank you, again.
Karen: Thank you, Richa. My pleasure.