17.04.2023 Participation in the Governance Workshop “Diverse and effective boards in a changing and competitive landscape” ECB and the Florence School of Banking and Finance Florence Margarita Delgado Deputy Governor Thank you for inviting me to speak here today. I am very pleased and honoured to participate in this event. The oversight role of the board of directors is one of the core elements of good corporate governance and a key area of supervisory focus. The Single Supervisory Mechanism (SSM) deals with heterogeneous structures and different management approaches, which has made it necessary to design an open supervisory framework. Sound oversight is ultimately achieved by striking the right balance between challenge, involvement and independence. First, by challenge I am referring to board members’ ability to participate in discussions. In this regard, non-executive members should be able to improve the quality of the debate and have the opportunity, the capacity and the ability to question the decisions made by the executive members. In order to do so, they need to have reliable, timely information. Without it there can be no meaningful discussion or effective decision-making processes. But challenge is not at odds with the support that the board of directors needs to provide to senior management. Diverse knowledge is a relevant issue in this context. This is not just a matter of gender, although there are still banks that do not have diversity policies or internal targets for gender diversity at board level. In fact, at end-2021 a third of the banks under our direct supervision did not meet their internal targets for gender representation at board level. But, as I said, it is not just a matter of gender. The board of directors needs to have the appropriate knowledge diversity to be able to deal with the challenges facing the financial industry. I am thinking, for example, of digitalisation strategies and climate risks. This does not mean that members need to be experts on these topics, but they do need to have sufficient knowledge to understand these challenges in order to make sound decisions. At the end of 2021, only around a fifth of the largest euro area banks had sufficient IT expertise at board level. Increasing this ratio will be key if banks are to successfully navigate the digital era.1 Second, the involvement of board members is crucial. Members should exercise their duties responsibly and uphold professional standards. They should devote sufficient time to reading and understanding all the documentation in order to be well-prepared for their meetings. They should also have the opportunity to seek clarification in advance, if necessary, to ensure that they have sufficient knowledge to support or challenge decisions. Finally, as I mentioned earlier, independence is of course essential. Institutions should have a sufficient number of independent directors to contribute to decision-making in an objective manner and to ensure a neutral attitude within the board. They should be appointed in recognition of their personal and professional repute, and perform their duties without being perceived as biased due to any relationship with the institution, its significant shareholders or its management team. Moreover, institutions should guarantee independence in order to avoid groupthink. The board of directors as a whole should have sufficient knowledge, skills and expertise to Keynote speech by Frank Elderson https://www.bankingsupervision.europa.eu/press/speeches/date/2022/html/ssm.sp220611~fa99fcbb52.en.html. properly understand the institution's activities, ensuring the board's effective ability to take decisions independently and autonomously in the best interests of the institution. Risk culture Another aspect I would like to emphasise is the importance of promoting a strong risk culture across the institution. The elements I mentioned earlier (challenge, involvement and independence) are the cornerstones of a good internal organisation structure. An appropriate risk culture emanates from the board of directors, but it has to be properly embedded across the organisation, especially among senior management. I would call this “tone from the top and echo from the middle”. Decisions such as excessive risk taking, putting the bank’s short term interests ahead of its longer-term interests, can damage an organisation’s reputation and culture. The board of directors is responsible for setting the strategy and defining the sustainable business model that is right for the institution, without getting bogged down in the details. That is the job of senior management. Banking is a sector that is very vulnerable to uncertainty and reputational issues. Therefore, in addition to the other elements I mentioned earlier, such as risk controls and data quality, a clear and sound risk culture is also needed. This was an important element in the recent financial turmoil, particularly the episode triggered by the collapse of Silicon Valley Bank, although many of the underlying factors in that case have yet to be properly analysed. Nevertheless, some aspects can be highlighted: shortcomings in banks’ risk management, ineffective governance and an inappropriate business model, including in terms of interest rate risk, asset/liability management profile, liquidity risk and NBFI2 exposures.3 Others have also pointed to the gaps in regulatory and supervisory frameworks and the long period of low interest rates and ample liquidity. While these latter factors are all true, this episode has shown that even today some banks still fail to comply with basic risk management and governance practices. But what are the fundamentals of risk management and oversight by banks? Beyond the Basel Committee’s 2015 corporate governance principles for banks,4 there is no single approach to good corporate governance. The clear objective is to achieve sound risk management and decision-making. Banks’ board of directors, senior management and risk management function should be able to ask the right questions in a timely manner and take credible decisions to strengthen operational and critical resilience. This seems to be the real challenge, even today. Banks should be able to respond promptly to material developments such as rapid growth, an excessive concentration on funding sources, ineffective asset-liability management, misconduct incidents, changes in the economic environment (such as policy normalisation or economic growth), or their ability to consider stress-test scenarios. Non-banking financial institutions. Hernandez de Cos, April 2023 https://www.bde.es/bde/es/secciones/prensa/intervpub/Discursos_del_Go/gobernador--bis-innovation-hubeurosystem-centre---regtech-and-suptech-in-the-context-of-cryptocurrencies-and-decentralised-finance-.html. https://www.bis.org/bcbs/publ/d328.htm. Based on our experience in the SSM, banks have improved their governance structure and design in recent years. However, challenges remain in implementing these changes and making them effective. The thematic review conducted in 2015 was the first horizontal exercise that led to tangible improvements in the design of banks’ management bodies. However, efforts still need to be made to improve boards’ oversight role and challenging capacity. Progress has been made in some areas such as board composition (collective knowledge and diversity), self-reflection on board effectiveness and the quality of board documentation and minutes. However, some challenges remain, particularly with regard to boards’ oversight and challenging capacity, insufficient internal suitability policies for the recruitment and assessment of board members, the inclusion of an appropriate risk perspective in discussions and decision-making, boards’ collective skillset and the degree of formal independence within the board. Governance is an area where supervisors pay a lot of attention, because we are aware of the importance of a robust governance structure and functioning. An example of this is that 7,371 findings have been raised in this area since the SSM was created, of which 1,303 remain open. This is because there is always room for improvement and governance should not be seen as a static element. On the contrary, as new challenges arise (climate risks, ESG, digitalisation, etc.), governance needs to be updated to properly address them. How can we keep encouraging our institutions to improve their governance framework? I believe that we need to continue our supervisory activities, placing greater emphasis on a structured escalation of our supervisory interventions (escalation ladder), and insist that a strong board of directors is key to the smooth functioning of banks. We should therefore continue to strengthen governance regulations to make them clearer, in particular as regards fit and proper processes and diversity, to build strong boards for sound decisionmaking. Non-executive directors In this decision-making process, non-executive directors (NEDs) play a crucial role. They should oversee management and focus on the key issues that are of concern to all stakeholders. These of course include the usual financial activities, but also emerging risks that could severely impact banks that are not properly prepared for them. In today’s complex business environment, new technologies and digital transformation are a key focus for all institutions, specifically for NEDs. We are in a situation of continuous and very fast change on the digital front, so it is crucial for organisations to be prepared and simultaneously adapt to new applications. I would like to highlight two key elements in this regard: First of all, the importance of defining the digitalisation strategy for the institution. Digitalisation is a broad concept that covers different aspects, and it needs to be clearly defined and specified for each institution. And second, the importance of establishing a robust operational resilience framework. The current pace of digital transformation at financial institutions is unprecedented. But increased digitalisation also entails greater ICT and cyber risks. Not only are malicious attacks against financial institutions and their customers on the rise, but the enormous complexity of these institutions’ ICT systems makes operational errors more likely. In addition, institutions’ increasing reliance on specialised third parties, very often involving a multi-tiered supply chain, makes operational risk management even more challenging. Of course, we cannot talk about digital transformation and IT environments without mentioning data quality. Reliable data is the starting point for properly quantifying, identifying and monitoring any risk, to ensure that potential weaknesses can be identified in a timely manner and that any necessary measures can be coordinated. Climate and environmental risks are another area that supervisors have identified as a source of risk in the medium term, which should be closely monitored in order to properly understand and recognise these risks. Overall, both ESG and regulatory compliance are becoming more relevant due to their high reputational impact, and banks need to pay close attention to them. Internal control functions Another issue I would like to highlight is the key role of internal control functions in the smooth functioning of institutions, complementing the role of the first line of defence. The board of directors must have full and direct access to the heads of the internal control functions (risk management function, compliance function and internal audit). In other words, the interaction between the board of directors and the heads of the internal control functions should not have to go through an intermediary level of executive management. Reporting to the board should be supported by agile internal systems capable of producing reliable information to facilitate meaningful discussion and effective decision-making processes. Overall, the internal audit and risk management functions are more mature in their functioning than the compliance function, whose role has changed/increased in recent years. There is therefore more room for improvement in the compliance function. The main focus areas identified by the SSM related to internal control functions are: (i) the board’s challenging capacity and ownership in addressing deficiencies. (ii) in most SSM institutions, the heads of the internal control function have direct access and report any concerns directly to the board of directors, in line with the EBA guidelines on internal governance. However, the frequency and level of detail of the information provided is also a focus area. (iii) the right balance between sufficient involvement and independence. (iv) the stature of the control functions, with the internal audit function performing better and the compliance function worse or even inadequately. (v) the central steering and oversight of the control functions of group subsidiaries. (vi) there has been a slight increase in the staffing of control functions (especially compliance), but there are still shortages of qualified staff in some specialised areas (e.g. cyber, digitalisation, internal models). (vii) the scope covered by compliance is often not comprehensive, clear or well documented. The role of the board of directors, in particular through its oversight committees (Audit, Risk, Appointments and Remunerations) is key to ensure that the internal control functions have the appropriate stature within the institution and are sufficiently resourced. Moreover, the board of directors and its committees should empower the internal control functions to complement the role of the first line of defence. The board of directors needs to challenge the control functions and properly oversee the follow-up of the findings and weaknesses flagged by these functions. It must also demonstrate a willingness to take ownership and be actively involved (“tone from the top”). Risk data aggregation The last point I would like to make is the importance of accurate, relevant and timely data. The SSM pays close attention to supervised institutions’ general data quality, risk data aggregation and risk reporting (RDAR) capabilities, which are deemed essential for proper risk governance and sound risk-based decision-making. Indeed, they have been a key aspect of the ECB’s supervisory roadmap since the SSM was created. Sound and robust risk data aggregation capabilities and risk reporting practices have become even more important since the global financial crisis, which demonstrated that an institution’s ability to manage risk-related data has a significant impact on its overall risk profile and the sustainability of its business model, especially under stress conditions. The presence of board members with IT expertise has increased significantly in banks, allowing them to be more aware of this shortcoming and to make better-informed decisions to implement an effective RDAR framework across the institution. Additionally, some institutions have invested in strengthening their processes, by including dynamic dashboards in risk reports, which allow for a deeper dive into several types of risk. In conclusion, although it has been in the supervisory spotlight for several years, awareness of the benefits of good risk data management has shown limited progress in institutions. Thus, the accuracy and timeliness of internal reporting still needs to be improved, as not doing so will limit management bodies’ ability to make the right strategic decisions. Conclusion The board’s oversight role is one of the core elements of good governance. Adequate skills, challenge and independence are three factors that ensure good governance of our institutions, and it is therefore helpful if both their business model and their risk management are geared towards making them robust and profitable.