"Governance and risk in a time of uncertainty and change" - Deputy
Governor Ed Sibley
17 February 2021 Speech
Speech to Institute of Directors
Good morning.
I would like to thank the Institute of Directors for inviting me to speak with you today1.
We are living through a time of great uncertainty - uncertainty over the short term path of the COVID-19 pandemic and
its longer term effects; uncertainty regarding the pace and extent of technology and related behavioural changes;
uncertainty about the timing of the effects of climate change; and much more besides.
This uncertainty has implications for how we think about risk and probabilities, and importantly how we govern, lead
and manage our organisations. I will explore these issues in my remarks today. I will outline how the approach to the
fundamentals of governance and risk management need to continue to improve.
I will start by summarising some of the Central Bank's key regulatory and supervisory priorities for 2021.
Financial Regulation Priorities in 2021
The mission of the Central Bank is to serve the public good by safeguarding monetary and nancial stability and by
working to ensure that the nancial system operates in the best interests of consumers and the wider economy. The
Governor of the Central Bank recently outlined the Bank's 2021 priorities2. Today, I will expand on some of the sub-set
of specic nancial regulation priorities for 2021, which are focused on the near and longer term challenges we see in
the system.
Our priorities are informed by our overarching aim for the nancial system to be resilient and trustworthy, for it to
sustainably serve the needs of the economy and its customers and for rms and individuals within the system to adhere
to a culture of fairness and high standards. In 2021, our nancial regulation strategic priorities include:
1. maintaining our supervisory focus on nancial and operational resilience of rms and markets to ensure they
continue to support households and business through the economic disruption caused by COVID-19; and can
support the recovery from it;
2. seeking to improve governance and risk management capabilities in rms and markets to improve culture and
decision-making and ensure that risks are identied and effectively mitigated, including the risks from disruptive
change such as climate change;
3. seeking to ensure that detrimental consumer outcomes are identied, prevented or mitigated, including those
arising from the pandemic, such as business interruption insurance, where extensive supervisory engagement
continues to ensure rms pay valid claims; and differential pricing, where we have set out a number of immediate
requirements to insurers as we work towards publication of our full ndings, together with a potential consultation
3
on proposals to further protect consumers, planned for July 2021 ; and
4. resolving both pandemic related and longer term distressed debt in the system, ensuring the fair treatment of
borrowers in nancial distress and preserving nancial stability.
In delivering the above, we remain focused on seeking to ensure that regulated rms: (i) have sustainable business
models; (ii) sufcient nancial resources including through times of plausible and severe stresses; (iii) are well governed,
with appropriate cultures and effective risk management; and (iv) can recover if they get into difculty and are
resolvable without recourse to the taxpayer if they cannot.
Given the audience today, I want to focus in on governance and risk management. Before covering these areas in detail, I
think it is worthwhile to reect on the pandemic.
COVID-19
We are still experiencing a profound shock from the COVID-19 pandemic. It is, rst and foremost, a cause of human
tragedy. It has challenged our resilience in many ways and has had a devastating effect on many families and individuals.
The health emergency has also had a profoundly negative effect on many businesses and household incomes, due to the
4
associated economic disruption .
While the timing and nature of the current shock were largely unforeseen, the Central Bank has long recognised the
inevitability of economic shocks and downturns. We have focused over the last decade on rebuilding and increasing the
nancial and operational resilience of the Irish nancial system. Consumer and investor protection frameworks have
also been signicantly enhanced with this in mind.
Much of the Central Bank's focus over the last year has been on mitigating the effects of the pandemic. The Central
Bank's intertwined responsibilities - consumer protection; monetary policy; prudential regulation; payments, and so on
- have strong interconnections with each other. This positions us well to understand and mitigate the effects of the
pandemic.
The economic challenges posed by COVID-19 have been met by exceptional policy support. This has included a range of
scal, monetary, macro-prudential and micro-prudential policy actions (as well as actions taken by nancial services
rms) to support households, businesses and vulnerable borrowers.
Vaccine technology has advanced in recent years to such an extent that highly effective vaccines have been developed in
a short time period and offer hope that the virus can be defeated. Moreover, technology has enabled many parts of the
economy (including nancial services) to continue operating with many workers (typically those with higher and more
secure incomes) continuing to work remotely. The corollary of this is that the pandemic has disproportionally affected
5
those that are least able to afford it .
As we continue to work through the challenges and uncertainty we all face, there is a need for us all to think afresh of
how we govern and manage risk and how we work to meet not only the current challenges but also to recognise and face
into emerging ones too. It is worth asking ourselves, is it possible that the COVID-19 pandemic is not just a seismic and
tragic event, but a stark warning too? It is worth us reecting on how we think about future events that have a near
certainty of occurrence over time, but with some doubt about precise timing and impact. In other words, how well do we
6
prepare for predictable surprises ?
Humans tend to be optimistic in nature. It is in some ways a necessary human condition. Business leaders need to have
optimism about the future to drive their businesses forward. However, we should also recognise that there is power in
negative thinking - testing our assumptions, considering what could go wrong and considering what we will do if things
do go wrong. Many mistakes, big and small, would be prevented or the impact of them lessened if leaders better
considered what could go wrong and what assumptions they were relying on. "We should all spend more time thinking
about the prospect of failure and what we might do about it. It is a useful mental habit but it is neither easy nor
7
enjoyable ."
Global pandemics have been on risk registers for a long time - in my own experience, at least a couple of decades. There
have also been recent health emergencies in various parts of the World that signalled clear alarm bells for those who
8
were listening . High prole organisations and experts have been clear that a global pandemic was a certainty, but the
timing, nature, type and gravity of one was open to doubt. Notwithstanding its inevitability over time, we were all ill-
prepared for its occurrence in 2020.
There are lessons here for us to consider for other critically important issues, such as climate change and technological
disruption.
Climate change effects and costs are with us today. There is broad scientic consensus that these effects and costs are
going to grow exponentially and that the future costs of deferred and inadequate action today also continue to grow.
And yet, at global, national, political, economic, business and individual levels our responses and planned actions are
woefully inadequate.
The pandemic has accelerated and deepened our reliance on technology. Technological change is disrupting the
landscape of nancial services. The competitive landscape is changing, with new entrants, new business models, a race
by incumbents to invest in developing the necessary capabilities, and in many cases the potential for a fundamental
9
disruption in the value chain of traditional nancial services rms and sectors . All business models are vulnerable to
this pace of technology change and there are few, if any, that will be able to survive without change for more than a few
years. The cost of inaction, insufcient action or misdirected action today, will probably be terminal for businesses large
and small over a short time horizon. And yet, as I will come to, we still see that signicant improvements are required at
board and executive levels in the understanding of technology and technology related risk.
These are complex issues, which will not be solved by simple solutions. But, I am certain that improvements in
governance and risk management are pre-requisites to successfully rising to meet these challenges, so I will now turn to
our work and expectations in these areas.
Governance and risk management
As I have already outlined, there is a strong case for fundamentally reconsidering how we think about risks. There is
also a need to signicantly improve how rms are being governed today. Some of the recurring issues pre-pandemic that
have undermined effective internal governance and risk management in rms include:
weaknesses in connecting strategy with risks and nancial resources;
10
deciencies in board oversight of director and senior management appointments ;
a lack of effective challenge of the executive by the non-executive directors;
weaknesses in the governance of rm's risk appetite, including a lack of appropriate reporting to the board;
inadequate resourcing of the risk management and compliance functions and poor quality governance of compliance
11
activities and assurance work ; and
weaknesses in understanding and approach to IT related risk management.
So, what is the Central Bank doing and what do we expect?
Accountability and decision making
Individual accountability has been a focus for the Central Bank since the global nancial crisis. It has been a decade since
the Fitness and Probity (F&P) Regime was introduced to ensure that individuals who hold certain positions in regulated
12
rms are committed to high standards of competence, integrity and honesty. More recently, we have proposed the
introduction of an enhanced Individual Accountability Framework (IAF) for individuals, particularly senior individuals,
working in regulated nancial services rms in Ireland.
The four key components of this proposed framework are:
1. Conduct Standards which will set out the behaviour the Central Bank expects of regulated nancial services
providers (RFSPs) and the individuals working within them;
2. A Senior Executive Accountability Regime (SEAR) which will ensure clearer accountability by placing obligations
on rms and senior individuals within them to set out clearly where responsibility and decision-making lies for their
business;
3. Enhancements to the current F&P Regime to strengthen the onus on rms to proactively assess individuals in
controlled functions on an ongoing basis, and to surmount some current limitations of the F&P Regime; and
4. A unied enforcement process, which would apply to all contraventions by rms or individuals of nancial services
legislation.
In evolving the individual accountability framework, we are of course keen to ensure that we do not unbalance the
framework of collective decision-making and individual accountability by an increased focus on the individual aspects. In
fact, we expect that enhancing individual accountability should result in better collective decisions due to a heightened
awareness on the part of individuals of their own increased accountability for the discharge of their function, including
with respect to their participation in collective decision-making. We expect that the new framework will reect this in
the obligations of individuals.
We are working closely with the Department of Finance to develop this framework, so that the necessary legislative
proposals can be brought forward as soon as possible, after which we will be in a position to consult publically on the
proposals and will look forward to engaging further with you then.
Diversity & Inclusion
While some rms are starting to make progress, much more needs to be done to increase the diversity of experience,
thought, background and attributes at senior levels, to reduce the likelihood of groupthink, reduce overcondence,
improve decision-making, increase the level of internal challenge, improve risk management, and reduce excessive
resistance to external challenge.
This is becoming even more important as we strive to deal more effectively with the complex challenges we face today
and respond to the evident unequal effects of the pandemic. It is in times of change and uncertainty when qualities such
as resilience and innovative thinking are essential, and the value of diversity of background, thought and experience are
all the more important.
13 14
The Central Bank will continue to require improvements in this area ; undertake detailed and thematic reviews ; and
publish research and information on the issues and progress (or lack thereof) in improving diversity and inclusion in
15
regulated rms .
Technology and innovation
Advances in technology are bringing rapid and deep changes to the nancial services sector. These are impacting
business models, decision-making, systems and processes, and products. They are having a material effect on the
operation of nancial markets, nancial supervision and the economy.
Financial services rms are looking to innovation, such as increased automation; digitisation of processes; the use of
algorithms; and machine learning to deliver cost reductions and efciencies, and competitive advantage resulting from
16
improved customer offerings. Big Data Analytics can allow for advanced risk assessment and pricing .
New payment methods and platforms bring challenges for the traditional role and dominance of banks in this area, while
digital payment channels have lowered the barrier to entry for alternative providers.
Innovation has the capacity to bring many benets for consumers, the economy and society in general. It is essential to
the effective functioning of a competitive economy.
Customers require rms' systems and data to be available, reliable and secure. This is also important for nancial
stability reasons. Digital transformation can, without proper oversight, increase vulnerabilities in rms' IT operations,
with increased risks around IT failures, outages and cyber-attacks. Firms must strive to minimise the frequency and
impact of issues and have an ability to recover quickly from them. Resilient systems are a fundamental pre-requisite for
successful innovation.
The importance of operational resilience has been further reinforced by the experience of the immediate shock from
COVID-19 and the ongoing shift in consumer behaviour and reliance on remote working. Given the importance of
operational continuity for the stability of the system and for consumers, businesses and the wider economy, we will
continue to challenge how rms are ensuring that risk and control frameworks are operating effectively under the
current working environment and are prepared for unforeseen operational disruptions.
It is important to emphasise that ultimate responsibility for a rm's IT risk, strategy and governance rests with the
Board, including the adequacy of digital and IT strategies to deliver and support business strategies and plans. Boards
must rstly ensure they themselves have the skills and knowledge to meaningfully understand the risks their
organisation faces and the responsibilities they bear. In order for the IT function to be able to operate within set risk
tolerances, Boards are expected to allocate and periodically review appropriate IT budgets to safeguard the operational
resilience of the IT framework. In this regard, the Central Bank expects Boards to approve, oversee and review the
implementation of Business Continuity Policies and Disaster Recovery Plans. Furthermore, Boards are expected to
obtain independent assurance on IT governance by approving and periodically reviewing the IT audit plans and by being
17
informed in a timely manner of IT related incidents and their impact on their rm's operations .
18
Proposed upstream legislation, such as the EU digital operational resilience act (in short DORA) or the revised EU
19
directive on security of network and information systems (NIS2) , will also seek to further strengthen the governance
and oversight frameworks of IT risk.
Climate change
Finally, I want to turn to climate change and sustainability. Until recently, these would not necessarily have been seen as
areas of legitimate interest of central banks and regulators. It is now clear that the macro-prudential policy, economic
advice, nancial stability, and consumer and investor protection implications of climate change put it rmly in the
bailiwick of Central Banks and regulators.
20
As the President of the ECB, Christine Lagarde, has recently said , "Inaction has negative consequences, and the
implications of not tackling climate change are already visible. Globally, the past six years are the warmest six on record,
and 2020 was the warmest in Europe. The number of disasters caused by natural hazards is also rising, resulting in $210
billion of damages in 2020. An analysis of over 300 peer-reviewed studies of disasters found that almost 70% of the
events analysed were made more likely, or more severe, by human-caused climate change." In this context, the ECB is
assessing how climate risks and environmental sustainability considerations are relevant in the pursuit of its mandate as
part of its ongoing Strategy Review, to which the Central Bank is an active participant.
So, the question becomes not whether we should focus efforts on climate change, but how and what should we focus on.
I believe we have a role in both mitigating the risks from the effects of climate change and taking actions that reduce
these effects.
Boards and executives need to meaningfully act now to understand and address the challenges associated with climate
change. In order to mitigate the risk and adequately position themselves to respond to these challenges, opportunities
and regulatory expectations, rms will need to understand the impact of climate related risks on their business
environment, their business models and investments. This requires lessons to be learnt from the pandemic, changing
how we think about risks and probabilities over the longer term.
The Central Bank is a signicant participant in nancial markets itself, through its investment portfolio for
21
example. Investment choices are increasingly informed by climate and sustainability related considerations .
As members of the Network for Greening the Financial System and the wider European regulatory system you can
expect the Central Bank to become increasingly active and intrusive in its approach to the supervision of climate change
risks. Action is required by us all now. You can expect us to be seeking evidence that:
Boards are meaningfully considering climate change risk;
climate change risks are being incorporated and embedded in organisational risk management frameworks and
mitigation;
climate risks are being considered as part of stress testing; and
24
the EU taxonomy of sustainable activities is being proactively applied.
I will conclude here.
Unprecedented is an overused word. It is perhaps fair to say we are living through times that are unprecedented in
living memory. But it is important that we do not believe that there is nothing that we can learn from history - from
precedents - whether recent or long past.
Moreover, we can also learn from our experience in the pandemic, about how our core assumptions can prove to be
unreliable, and about how we think about future events that may seem improbable in a given year but have a near
certainty of occurrence over time. Applying these lessons well will be important in how we emerge from the pandemic
and how we meet the uncertain challenges ahead, whether these challenges arise from climate change, technology or
some other source.
Finally, the pandemic also reminds us of the importance of the basics, the fundamentals of good hygiene, of compliance,
of minding those around us, of basic risk management. Improvements in the fundamentals of better governance; better
risk management; improving your understanding and testing your assumptions; and actively considering what could go
wrong and preparing for it are critical to the nancial system being resilient and trustworthy; and sustainably serving
the needs of the economy and its customers.
I thank you for your attention and look forward to our discussion.
[1] With thanks to Lisa O'Mahony, Joern Dobberstein, Pamela Farrell and Tony Cahalan for their assistance in preparing
these remarks
[2] Seehttps://www.centralbank.ie/news/article/speech-the-year-ahead-governor-makhlouf-25-jan-21
[3] See: https://www.centralbank.ie/news/article/press-release-interim-report-of-differential-pricing-review-14-
december-2020. Given that differential pricing can be associated with both benets and costs for consumers,
completion of this detailed analysis is essential in order to ensure a full market perspective, evidence-based conclusions,
and appropriately calibrated regulatory interventions.
[4] See the latest Central Bank Quarterly Bulletin (https://www.centralbank.ie/docs/default-
source/publications/quarterly-bulletins/qb-archive/2021/quarterly-bulletin-q1-2021.pdf?sfvrsn=5) and Financial
Stability Review (https://www.centralbank.ie/docs/default-source/publications/nancial-stability-review/nancial-
stability/nancial-stability-review-2020-ii.pdf?sfvrsn=9 ) for more information on the economic effects of and possible
future paths from the pandemic
[5] See, for example, https://www.imf.org/external/pubs/ft/fandd/2020/09/COVID19-and-global-inequality-joseph-
stiglitz.htm
[6] See https://hbr.org/2003/04/predictable-surprises-the-disasters-you-should-have-seen-coming
[7] Tim Harford, the power of negative thinking
[8] Bill Gates: The next outbreak? We're not ready
[9] See https://www.bis.org/review/r191129d.pdf
[10] See Central Bank F&P Dear CEO letter https://www.centralbank.ie/news/article/press-release-weaknesses-in-
rms-compliance-with-tness-probity-regime-17-november-2020
[11] For example, see Central Bank thematic review of Best Execution in a sample of MiFID rms
https://www.centralbank.ie/docs/default-source/regulation/consumer-protection/compliance-monitoring/themed-
inspections/stockbroking-investment-rms/industry-letter---mid-ii-best-execution-thematic-inspection---10-
november-2020.pdf)
[12] In line with the Central Bank's submission to the Law Reform Commission in 2017, and our recommendations to
the Minister for Finance in 2018
[13] See https://www.centralbank.ie/news/article/importance-diversity-central-banks-supervised-entities-deputy-
governor-donnery-04-May-2018 for example of our views and expectations
[14] For example, see Thematic Assessment of Diversity and Inclusion in Insurance Firms and Behaviour and Culture
of the Irish Retail Banks
[15] For example, see https://www.centralbank.ie/docs/default-source/regulation/how-we-regulate/diversity-and-
inclusion/2019-demographics-of-the-nancial-sector-report.pdf?sfvrsn=10
[16] See https://www.centralbank.ie/news/article/press-release-nancial-regulation-technological-innovation-gerry-
cross-27-november-2019
[17] Our expectations are outlined in more detail in the Central Bank's Guidelines on Information Technology and
Cybersecurity Risks and on outsourcing through the publication of a 2018 outsourcing discussion paper. The Central
Bank will shortly publish a public consultation on proposed cross-industry outsourcing guidance which will re-iterate
our expectation of high standards with regard to the governance and oversight of outsourcing arrangements.
[18] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52020PC0595
[19] https://ec.europa.eu/digital-single-market/en/news/revised-directive-security-network-and-information-systems-
nis2
[20] See Discussion Paper on management and supervision of ESG risks for credit institutions and investment rms
[21] In relation to the equities component of these investment assets, compliance with the UN-supported Principles for
Responsible Investment (PRI) was a condition in allocating the mandate for this portfolio. In relation to the bond
component of these investment assets, the Bank holds eleven green bonds and is aiming to increase its exposure to
green bonds in its investment assets in 2021. In addition, Eurosystem central banks have agreed a common stance for
climate change-related sustainable and responsible investment principles for euro-denominated non-monetary policy
portfolios that they each manage under their own responsibility. The common stance prepares the ground for the
measurement of greenhouse gas (GHG) emissions and other sustainable and responsible investment-related metrics of
these portfolios. The Eurosystem aims to start making annual climate-related disclosures for these types of portfolios
within the next two years, using the recommendations of the Task Force on Climate-related Financial Disclosures
(TCFD) as the initial framework. The Bank is fully aligned with this timeline and approach.
[22] https://www.ngfs.net/en
[23] See, for example, ECB publishes nal guide on climate-related and environmental risks for banks and Discussion
Paper on management and supervision of ESG risks for credit institutions and investment rms
[24] See https://ec.europa.eu/info/business-economy-euro/banking-and-nance/sustainable-nance/eu-taxonomy-
sustainable-activities_en - the taxonomy regulation establishes six environmental objectives: focused on
Climate change mitigation
Climate change adaptation
The sustainable use and protection of water and marine resources
The sustainable use and protection of water and marine resources
The transition to a circular economy
Pollution prevention and control
The protection and restoration of biodiversity and ecosystems
©2021 Central Bank of Ireland