17.04.2023
Participation in the Governance Workshop "Diverse and effective
boards in a changing and competitive landscape"
ECB and the Florence School of Banking and Finance
Florence
Margarita Delgado
Deputy Governor
Thank you for inviting me to speak here today. I am very pleased and honoured to participate
in this event.
The oversight role of the board of directors is one of the core elements of good corporate
governance and a key area of supervisory focus. The Single Supervisory Mechanism (SSM)
deals with heterogeneous structures and different management approaches, which has
made it necessary to design an open supervisory framework.
Sound oversight is ultimately achieved by striking the right balance between challenge,
involvement and independence.
First, by challenge I am referring to board members' ability to participate in discussions. In
this regard, non-executive members should be able to improve the quality of the debate and
have the opportunity, the capacity and the ability to question the decisions made by the
executive members. In order to do so, they need to have reliable, timely information. Without
it there can be no meaningful discussion or effective decision-making processes. But
challenge is not at odds with the support that the board of directors needs to provide to
senior management.
Diverse knowledge is a relevant issue in this context. This is not just a matter of gender,
although there are still banks that do not have diversity policies or internal targets for gender
diversity at board level. In fact, at end-2021 a third of the banks under our direct supervision
did not meet their internal targets for gender representation at board level.
But, as I said, it is not just a matter of gender. The board of directors needs to have the
appropriate knowledge diversity to be able to deal with the challenges facing the financial
industry. I am thinking, for example, of digitalisation strategies and climate risks. This does
not mean that members need to be experts on these topics, but they do need to have
sufficient knowledge to understand these challenges in order to make sound decisions.
At the end of 2021, only around a fifth of the largest euro area banks had sufficient IT
expertise at board level. Increasing this ratio will be key if banks are to successfully navigate
the digital era.1
Second, the involvement of board members is crucial. Members should exercise their duties
responsibly and uphold professional standards. They should devote sufficient time to
reading and understanding all the documentation in order to be well-prepared for their
meetings. They should also have the opportunity to seek clarification in advance, if
necessary, to ensure that they have sufficient knowledge to support or challenge decisions.
Finally, as I mentioned earlier, independence is of course essential. Institutions should have
a sufficient number of independent directors to contribute to decision-making in an
objective manner and to ensure a neutral attitude within the board. They should be
appointed in recognition of their personal and professional repute, and perform their duties
without being perceived as biased due to any relationship with the institution, its significant
shareholders or its management team.
Moreover, institutions should guarantee independence in order to avoid groupthink. The
board of directors as a whole should have sufficient knowledge, skills and expertise to
properly understand the institution's activities, ensuring the board's effective ability to take
decisions independently and autonomously in the best interests of the institution.
Risk culture
Another aspect I would like to emphasise is the importance of promoting a strong risk
culture across the institution.
The elements I mentioned earlier (challenge, involvement and independence) are the
cornerstones of a good internal organisation structure.
An appropriate risk culture emanates from the board of directors, but it has to be properly
embedded across the organisation, especially among senior management. I would call this
"tone from the top and echo from the middle".
Decisions such as excessive risk taking, putting the bank's short term interests ahead of its
longer-term interests, can damage an organisation's reputation and culture. The board of
directors is responsible for setting the strategy and defining the sustainable business model
that is right for the institution, without getting bogged down in the details. That is the job of
senior management.
Banking is a sector that is very vulnerable to uncertainty and reputational issues. Therefore,
in addition to the other elements I mentioned earlier, such as risk controls and data quality,
a clear and sound risk culture is also needed.
This was an important element in the recent financial turmoil, particularly the episode
triggered by the collapse of Silicon Valley Bank, although many of the underlying factors in
that case have yet to be properly analysed. Nevertheless, some aspects can be highlighted:
shortcomings in banks' risk management, ineffective governance and an inappropriate
business model, including in terms of interest rate risk, asset/liability management profile,
liquidity risk and NBFI2 exposures.3 Others have also pointed to the gaps in regulatory and
supervisory frameworks and the long period of low interest rates and ample liquidity. While
these latter factors are all true, this episode has shown that even today some banks still fail
to comply with basic risk management and governance practices.
But what are the fundamentals of risk management and oversight by banks? Beyond the
Basel Committee's 2015 corporate governance principles for banks,4 there is no single
approach to good corporate governance. The clear objective is to achieve sound risk
management and decision-making. Banks' board of directors, senior management and risk
management function should be able to ask the right questions in a timely manner and take
credible decisions to strengthen operational and critical resilience. This seems to be the real
challenge, even today.
Banks should be able to respond promptly to material developments such as rapid growth,
an excessive concentration on funding sources, ineffective asset-liability management,
misconduct incidents, changes in the economic environment (such as policy normalisation
or economic growth), or their ability to consider stress-test scenarios.
Based on our experience in the SSM, banks have improved their governance structure and
design in recent years. However, challenges remain in implementing these changes and
making them effective.
The thematic review conducted in 2015 was the first horizontal exercise that led to tangible
improvements in the design of banks' management bodies. However, efforts still need to be
made to improve boards' oversight role and challenging capacity.
Progress has been made in some areas such as board composition (collective knowledge
and diversity), self-reflection on board effectiveness and the quality of board documentation
and minutes. However, some challenges remain, particularly with regard to boards'
oversight and challenging capacity, insufficient internal suitability policies for the recruitment
and assessment of board members, the inclusion of an appropriate risk perspective in
discussions and decision-making, boards' collective skillset and the degree of formal
independence within the board.
Governance is an area where supervisors pay a lot of attention, because we are aware of
the importance of a robust governance structure and functioning. An example of this is that
7,371 findings have been raised in this area since the SSM was created, of which 1,303
remain open. This is because there is always room for improvement and governance should
not be seen as a static element. On the contrary, as new challenges arise (climate risks,
ESG, digitalisation, etc.), governance needs to be updated to properly address them.
How can we keep encouraging our institutions to improve their governance framework? I
believe that we need to continue our supervisory activities, placing greater emphasis on a
structured escalation of our supervisory interventions (escalation ladder), and insist that a
strong board of directors is key to the smooth functioning of banks. We should therefore
continue to strengthen governance regulations to make them clearer, in particular as
regards fit and proper processes and diversity, to build strong boards for sound
decisionmaking.
Non-executive directors
In this decision-making process, non-executive directors (NEDs) play a crucial role. They
should oversee management and focus on the key issues that are of concern to all
stakeholders. These of course include the usual financial activities, but also emerging risks
that could severely impact banks that are not properly prepared for them. In today's
complex business environment, new technologies and digital transformation are a key focus
for all institutions, specifically for NEDs. We are in a situation of continuous and very fast
change on the digital front, so it is crucial for organisations to be prepared and
simultaneously adapt to new applications.
I would like to highlight two key elements in this regard:
First of all, the importance of defining the digitalisation strategy for the institution.
Digitalisation is a broad concept that covers different aspects, and it needs to be clearly
defined and specified for each institution.
And second, the importance of establishing a robust operational resilience framework. The
current pace of digital transformation at financial institutions is unprecedented. But
increased digitalisation also entails greater ICT and cyber risks. Not only are malicious
attacks against financial institutions and their customers on the rise, but the enormous
complexity of these institutions' ICT systems makes operational errors more likely. In
addition, institutions' increasing reliance on specialised third parties, very often involving a
multi-tiered supply chain, makes operational risk management even more challenging.
Of course, we cannot talk about digital transformation and IT environments without
mentioning data quality. Reliable data is the starting point for properly quantifying,
identifying and monitoring any risk, to ensure that potential weaknesses can be identified in
a timely manner and that any necessary measures can be coordinated.
Climate and environmental risks are another area that supervisors have identified as a
source of risk in the medium term, which should be closely monitored in order to properly
understand and recognise these risks. Overall, both ESG and regulatory compliance are
becoming more relevant due to their high reputational impact, and banks need to pay close
attention to them.
Internal control functions
Another issue I would like to highlight is the key role of internal control functions in the
smooth functioning of institutions, complementing the role of the first line of defence.
The board of directors must have full and direct access to the heads of the internal control
functions (risk management function, compliance function and internal audit). In other
words, the interaction between the board of directors and the heads of the internal control
functions should not have to go through an intermediary level of executive management.
Reporting to the board should be supported by agile internal systems capable of producing
reliable information to facilitate meaningful discussion and effective decision-making
processes.
Overall, the internal audit and risk management functions are more mature in their
functioning than the compliance function, whose role has changed/increased in recent
years. There is therefore more room for improvement in the compliance function.
The main focus areas identified by the SSM related to internal control functions are:
(i) the board's challenging capacity and ownership in addressing deficiencies.
(ii) in most SSM institutions, the heads of the internal control function have
direct access and report any concerns directly to the board of directors, in
line with the EBA guidelines on internal governance. However, the
frequency and level of detail of the information provided is also a focus
area.
(iii) the right balance between sufficient involvement and independence.
(iv) the stature of the control functions, with the internal audit function
performing better and the compliance function worse or even inadequately.
(v) the central steering and oversight of the control functions of group
subsidiaries.
(vi) there has been a slight increase in the staffing of control functions
(especially compliance), but there are still shortages of qualified staff in
some specialised areas (e.g. cyber, digitalisation, internal models).
(vii) the scope covered by compliance is often not comprehensive, clear or well
documented.
The role of the board of directors, in particular through its oversight committees (Audit, Risk,
Appointments and Remunerations) is key to ensure that the internal control functions have
the appropriate stature within the institution and are sufficiently resourced. Moreover, the
board of directors and its committees should empower the internal control functions to
complement the role of the first line of defence.
The board of directors needs to challenge the control functions and properly oversee the
follow-up of the findings and weaknesses flagged by these functions. It must also
demonstrate a willingness to take ownership and be actively involved ("tone from the top").
Risk data aggregation
The last point I would like to make is the importance of accurate, relevant and timely data.
The SSM pays close attention to supervised institutions' general data quality, risk data
aggregation and risk reporting (RDAR) capabilities, which are deemed essential for proper
risk governance and sound risk-based decision-making. Indeed, they have been a key
aspect of the ECB's supervisory roadmap since the SSM was created.
Sound and robust risk data aggregation capabilities and risk reporting practices have
become even more important since the global financial crisis, which demonstrated that an
institution's ability to manage risk-related data has a significant impact on its overall risk
profile and the sustainability of its business model, especially under stress conditions.
The presence of board members with IT expertise has increased significantly in banks,
allowing them to be more aware of this shortcoming and to make better-informed decisions
to implement an effective RDAR framework across the institution.
Additionally, some institutions have invested in strengthening their processes, by including
dynamic dashboards in risk reports, which allow for a deeper dive into several types of risk.
In conclusion, although it has been in the supervisory spotlight for several years, awareness
of the benefits of good risk data management has shown limited progress in institutions.
Thus, the accuracy and timeliness of internal reporting still needs to be improved, as not
doing so will limit management bodies' ability to make the right strategic decisions.
Conclusion
The board's oversight role is one of the core elements of good governance. Adequate skills,
challenge and independence are three factors that ensure good governance of our
institutions, and it is therefore helpful if both their business model and their risk management
are geared towards making them robust and profitable.