and senior insurance managers regimes. under these regimes all senior managers, including certain non - executive directors, will be held to a clear standard of behaviour. but the primary role of all neds is independent oversight and challenge of the executive and the pra recognises that the actual responsibilities of neds within the scope of the regimes differ from those of executive senior managers and they should be clarified and limited accordingly. key messages from the statement are : bis central bankers ’ speeches • it is a responsibility of boards to establish strategy, set the risk appetite and monitor risk across the business and hold management to account ; • the risk appetite must be clearly owned by the board, integral to the strategy and actively used to monitor and control risks and inform key business decisions ; • boards should articulate and maintain a culture of risk awareness and ethical behaviour ; • boards should include individuals with a mix of skills and experience that are up - todate and cover the major business areas in order to make informed decisions and provide effective oversight of the risks ; • but this does not mean expertise in every aspect of a broad and complex financial business – the point is to have the diversity of experience and capacity to provide effective challenge across the full range of business ; • boards should act in a co - operative and collegiate manner whereby the nonexecutives support and encourage executive management and vice versa ; • but this should not inhibit the non - executive directors from challenging executive management and holding them effectively to account ; • non - executive directors should ensure they have the time and resources and access to the business they need to fulfil their duties ; • executive management have a responsibility to ensure the board can exercise its role and should exercise their judgement in bringing key issues to the board ’ s attention at an early stage ; and • the principle of good governance, including independence of the chairman, should also apply to material subsidiaries. boards of regulated subsidiaries need to be able to take decisions where required to meet their own legal and governance responsibilities or in the interests of the safety and soundness of the subsidiary. but, that does not mean they should operate outside the general governance and objectives of the group to which they belong. independence in this context is carefully defined and limited. as you will all be aware, we have undertaken significant engagement with the boards of banks and building societies on governance. through our supervisory work, we are seeing improvement but in our view there is more to do. board effectiveness will therefore remain a key priority. to conclude, governance matters

generally reduced their commercial property loans, and non - prime has declined too. the main area of growth has been buy - to - let lending, which is true not just for societies but for lenders in general. now, i don ’ t want to demonise buy - to - let lending. we are watching carefully, and for the societies we see no evidence today that btl loans are of poorer quality than prime owner - occupier, and we see a fair amount of stability over time in maximum ltv and minimum rental cover. but, we are watching carefully, and of course applying stress testing across all loans. looked at more broadly, we are not seeing an upward surge in high ltv lending of the sort that was so damaging in the past, but there is an upward direction to the – admittedly small – share of lending at high ltv and high loan - to - income ( ie the two together ). we are, again, watching this carefully, and it is why in 2010 we implemented the building societies sourcebook to encourage appropriate risk management of lending and funding. the latter will be supported in future when we implement the net stable funding ratio which is the international standard to discourage reliance on short - term funding. we are also increasingly focussed on operational risks and the prudential implications of conduct risk, as i know are societies. i want to pick out one area of operational risk which is important, namely it systems risk. one aspect of this is the cost and complexity of updating legacy it systems in the face of growing demands on those systems from innovation in products. cyber risk is also very high on our list of priorities. i recognise that not all societies have an internet presence, though i do know, of course, that you all use the internet. we will be seeking to ensure that cyber risk is properly tackled by societies as appropriate. in saying this, i am not seeking to pick out societies from other firms that we supervise, but we do think that these risks are in important respects common to all firms. societies have generally been less affected than the large banks by conduct mis - selling costs, though not fully immune. we are watching again very carefully, and i can assure you that as prudential regulator we want to see sensible outcomes that balance the objectives of all parties and ensure that we maintain a stable financial system that can support the activity of today ’ s customers. nobody wants to see a world where ex - post enforcement weakens the