ARROW risk assessment framework

Themes: FSA

See the list of related resources at the bottom of this page.

The FSA has developed the ARROW risk assessment framework with the following objectives:

Help FSA meet its statutory objectives by focusing on key risks
Influence resource allocation to make efficient and effective use of limited resources
Use appropriate regulatory tools to deal with risks or issues
Undertake proportionally more work on a thematic (or cross-sectional) basis

ARROW stands for Advanced Risk Response Operating frameWork: a bit contrived, but we get the picture.

Firms are assigned to one of four supervision categories, based on the risk they pose to the FSA's objectives, as perceived by the FSA. The ARROW framework describes how the FSA assesses the risk. Although the requirements are the same for all firms, the level of the FSA's involvement depends on the supervision category. Firms in category A can expect a close and continuous relationship; those in category D can expect little or no individual contact.

An extremely important aspect of the whole regulatory approach of the FSA is that only the risks to the FSA's objectives are considered. These objectives are concerned with market confidence, public awareness, consumer protection and the reduction of financial crime. Risks to shareholder value, for example, do not explicitly concern the FSA.

The FSA assesses the risk that a firm poses to its objectives by considering the impact and probability separately. The unit of assessment may be the individual firm, or a business unit consisting of several firms (in large groups) or within a firm.

The impact assessment depends on the size of the firm, and is expressed as high, medium high, medium low, or low. The size of the firm is measured by premium income, assets/liabilities, funds under management, annual turnover, or other similar measures, depending on the firm's sector.

The probability assessment is performed on a firm by firm basis, by considering each element in a matrix of risks. The thoroughness of the probability assessment depends on the impact rating of the firm. Low impact firms won't be assessed individually; high impact firms will be assessed in great detail, with visits from the FSA; those in the middle will get desk-based assessments.

After performing the probability assessment, the FSA develops a risk mitigation programme (RMP) for the firm. The RMP will use a selection of regulatory tools intended to reduce the risks that have been flagged as requiring action. Usually, this means that the firm has to take some action: produce and implement a plan for introducing a risk management process, for example.

Resources

The firm risk assessment framework: This is the fourth document in the Building the new Regulator series of reports issued by the Financial Services Authority. It describes the FSA's ARROW framework for risk assessment and is essential reading for anyone in a regulated firm who will be involved in the risk assessment process. It was published in February 2003 and is available at http://www.fsa.gov.uk/pubs/policy/bnr_firm-framework.pdf.
Financial Services Authority: The FSA is the regulatory authority for the financial services industry in the UK. Its website at http://www.fsa.gov.uk contains all the public documents produced by the FSA, including consultation papers and the texts of speeches as well as the currently applicable Handbook of rules and guidance.
Building the new regulator: Progress report 2: The Financial Services Authority have issued a series of reports outlining their new risk-based regulatory framework. This report, issued in February 2002, describes their risk-based operating framework and what it means for the firms that they regulate. In particular, it includes (as Appendix B) a probability assessment matrix that provides the risk classification system that they use. Note that the FSA is interested only in risks to their statutory objectives, and that these may not be the same as, for example, risks to shareholder value. The report is available at http://www.fsa.gov.uk/pubs/policy/bnr_progress2.pdf.
Building the new regulator: Progress report 1: This is the first report in the series issued by the Financial Services Authority. It was published in December 2000, and describes the risks to the FSA's statutory objectives and the method of assessing the impact of particular risks. It then goes on to consider how the probability of risks can be assessed. In Appendix 1 it provides five case studies of the impact/probability assessment framework, indicating the regulatory relationships that would be likely for various combinations of impact and probability. The report is available at http://www.fsa.gov.uk/pubs/policy/bnr_progress1.pdf.
The future regulation of insurance: A progress report: Despite its title, this report can be seen as the third in the Building the new Regulator series issued by the Financial Services Authority. It was issued in October 2002. It sets out the regulatory agenda (for insurance firms) for the next few years, and is a result of the so-called Tiner project. It emphasises that firms should realise that the new style of regulation means that they should modernise their governance and risk management frameworks, and their systems and controls. Half a dozen areas of particular concern are highlighted. The report is available at http://www.fsa.gov.uk/pubs/policy/bnr_progress3.pdf.
A new regulator for the new millennium: This is the precursor to the Building the new Regulator series of reports issued by the Financial Services Authority. It describes the FSA's statutory objectives and its approach to regulation, including the operating framework and regulatory tools. The report, which was published in January 2000, is available at http://www.fsa.gov.uk/pubs/policy/p29.pdf.
PS04/16: Integrated Prudential sourcebook for insurers: This Policy Statement reports on the main issues arising from Consultation Paper 190 (Enhanced capital requirements and individual capital assessments for non-life insurers), Consultation Paper 195 (Enhanced capital requirements and individual capital assessments for life insurers) and the audit and reviewing actuary proposals in Consultation Paper 202 (Insurance regulatory reporting – changes to the publicly available annual return for insurers) and publishes the associated rules and guidance. It is available at http://www.fsa.gov.uk/Pages/Library/Policy/Policy/2004/04_16.shtml.
CP190: Enhanced capital requirements and individual capital assessments for non-life insurers: Consultation paper 190 from the FSA discusses how capitial requirements will be determined for non-life insurers. It was issued in July 2003, and the consultation period ended on 30 November 2003. The overall effect of the proposals will be to introduce a new risk-based minimum requirement, the ECR (Enhanced Capital Requirement), and the concept of ICG (Individual Capital Guidance) which will take into account both the ECR and the systems and controls that firms have in place. CP190 is available at http://www.fsa.gov.uk/Pages/Library/Policy/CP/2003/190.shtml
CP195: Enhanced capital requirements and individual capital assessments for life insurers: Consultation paper 195 from the FSA discusses how capitial requirements will be determined for non-life insurers. It was issued in August 2003, and the consultation period ended on 30 November 2003. The overall effect of the proposals will be to introduce a new risk-based minimum requirement, the ECR (Enhanced Capital Requirement), and the concept of ICG (Individual Capital Guidance) which will take into account both the ECR and the systems and controls that firms have in place. CP195 is available at http://www.fsa.gov.uk/Pages/Library/Policy/CP/2003/195.shtml

	:: About :: Blog :: Notes :: All topics :: All links :: Publications :: Downloads :: Contact Related topics: Financial Services Authority The FSA and operational risk Future regulation of insurance briefing The FSA and risk based capital Risk maps Risk management process Operational Risk Enterprise risk management Risk classification Read my blog. Is your software use Competent, Complacent or Compromised? Take my 30 second quiz now, and find out! Read past issues of my newsletter. Tools download a simple code profiler for Excel VBA. Automated spreadsheet testing, documentation and more. Download now, or find out more at http://www.xlsior.com. Search WWW Search louisepryor.com
ARROW risk assessment framework Themes: FSA See the list of related resources at the bottom of this page. The FSA has developed the ARROW risk assessment framework with the following objectives: Help FSA meet its statutory objectives by focusing on key risks Influence resource allocation to make efficient and effective use of limited resources Use appropriate regulatory tools to deal with risks or issues Undertake proportionally more work on a thematic (or cross-sectional) basis ARROW stands for Advanced Risk Response Operating frameWork: a bit contrived, but we get the picture. Firms are assigned to one of four supervision categories, based on the risk they pose to the FSA's objectives, as perceived by the FSA. The ARROW framework describes how the FSA assesses the risk. Although the requirements are the same for all firms, the level of the FSA's involvement depends on the supervision category. Firms in category A can expect a close and continuous relationship; those in category D can expect little or no individual contact. An extremely important aspect of the whole regulatory approach of the FSA is that only the risks to the FSA's objectives are considered. These objectives are concerned with market confidence, public awareness, consumer protection and the reduction of financial crime. Risks to shareholder value, for example, do not explicitly concern the FSA. The FSA assesses the risk that a firm poses to its objectives by considering the impact and probability separately. The unit of assessment may be the individual firm, or a business unit consisting of several firms (in large groups) or within a firm. The impact assessment depends on the size of the firm, and is expressed as high, medium high, medium low, or low. The size of the firm is measured by premium income, assets/liabilities, funds under management, annual turnover, or other similar measures, depending on the firm's sector. The probability assessment is performed on a firm by firm basis, by considering each element in a matrix of risks. The thoroughness of the probability assessment depends on the impact rating of the firm. Low impact firms won't be assessed individually; high impact firms will be assessed in great detail, with visits from the FSA; those in the middle will get desk-based assessments. After performing the probability assessment, the FSA develops a risk mitigation programme (RMP) for the firm. The RMP will use a selection of regulatory tools intended to reduce the risks that have been flagged as requiring action. Usually, this means that the firm has to take some action: produce and implement a plan for introducing a risk management process, for example. Resources The firm risk assessment framework This is the fourth document in the Building the new Regulator series of reports issued by the Financial Services Authority. It describes the FSA's ARROW framework for risk assessment and is essential reading for anyone in a regulated firm who will be involved in the risk assessment process. It was published in February 2003 and is available at http://www.fsa.gov.uk/pubs/policy/bnr_firm-framework.pdf. Financial Services Authority The FSA is the regulatory authority for the financial services industry in the UK. Its website at http://www.fsa.gov.uk contains all the public documents produced by the FSA, including consultation papers and the texts of speeches as well as the currently applicable Handbook of rules and guidance. Building the new regulator: Progress report 2 The Financial Services Authority have issued a series of reports outlining their new risk-based regulatory framework. This report, issued in February 2002, describes their risk-based operating framework and what it means for the firms that they regulate. In particular, it includes (as Appendix B) a probability assessment matrix that provides the risk classification system that they use. Note that the FSA is interested only in risks to their statutory objectives, and that these may not be the same as, for example, risks to shareholder value. The report is available at http://www.fsa.gov.uk/pubs/policy/bnr_progress2.pdf. Building the new regulator: Progress report 1 This is the first report in the series issued by the Financial Services Authority. It was published in December 2000, and describes the risks to the FSA's statutory objectives and the method of assessing the impact of particular risks. It then goes on to consider how the probability of risks can be assessed. In Appendix 1 it provides five case studies of the impact/probability assessment framework, indicating the regulatory relationships that would be likely for various combinations of impact and probability. The report is available at http://www.fsa.gov.uk/pubs/policy/bnr_progress1.pdf. The future regulation of insurance: A progress report Despite its title, this report can be seen as the third in the Building the new Regulator series issued by the Financial Services Authority. It was issued in October 2002. It sets out the regulatory agenda (for insurance firms) for the next few years, and is a result of the so-called Tiner project. It emphasises that firms should realise that the new style of regulation means that they should modernise their governance and risk management frameworks, and their systems and controls. Half a dozen areas of particular concern are highlighted. The report is available at http://www.fsa.gov.uk/pubs/policy/bnr_progress3.pdf. A new regulator for the new millennium This is the precursor to the Building the new Regulator series of reports issued by the Financial Services Authority. It describes the FSA's statutory objectives and its approach to regulation, including the operating framework and regulatory tools. The report, which was published in January 2000, is available at http://www.fsa.gov.uk/pubs/policy/p29.pdf. PS04/16: Integrated Prudential sourcebook for insurers This Policy Statement reports on the main issues arising from Consultation Paper 190 (Enhanced capital requirements and individual capital assessments for non-life insurers), Consultation Paper 195 (Enhanced capital requirements and individual capital assessments for life insurers) and the audit and reviewing actuary proposals in Consultation Paper 202 (Insurance regulatory reporting – changes to the publicly available annual return for insurers) and publishes the associated rules and guidance. It is available at http://www.fsa.gov.uk/Pages/Library/Policy/Policy/2004/04_16.shtml. CP190: Enhanced capital requirements and individual capital assessments for non-life insurers Consultation paper 190 from the FSA discusses how capitial requirements will be determined for non-life insurers. It was issued in July 2003, and the consultation period ended on 30 November 2003. The overall effect of the proposals will be to introduce a new risk-based minimum requirement, the ECR (Enhanced Capital Requirement), and the concept of ICG (Individual Capital Guidance) which will take into account both the ECR and the systems and controls that firms have in place. CP190 is available at http://www.fsa.gov.uk/Pages/Library/Policy/CP/2003/190.shtml CP195: Enhanced capital requirements and individual capital assessments for life insurers Consultation paper 195 from the FSA discusses how capitial requirements will be determined for non-life insurers. It was issued in August 2003, and the consultation period ended on 30 November 2003. The overall effect of the proposals will be to introduce a new risk-based minimum requirement, the ECR (Enhanced Capital Requirement), and the concept of ICG (Individual Capital Guidance) which will take into account both the ECR and the systems and controls that firms have in place. CP195 is available at http://www.fsa.gov.uk/Pages/Library/Policy/CP/2003/195.shtml
Copyright © 2003-2008 Louise Pryor. All rights reserved. Site developed by Louise Pryor. Louise Pryor is no longer practising as a consultant — the site is maintained as an archive, and is not updated.