Are Trustees managing pension risk effectively

Almost 90% of respondents told us that they believe pension risk management has become more challenging in the last 12 months. This is primarily due to increased complexity of DB risks and the increasing number of DC risks. This perception may be in response to Trustees becoming more aware of the risks facing their pension scheme, due to having to respond to initiatives such as 21^St Century governance, data protection and Integrated Risk Management (IRM). It also highlights that more work needs to be done to reassure Trustees that their pension scheme's risks are being managed appropriately.

Are Trustees really managing their risks or do they just think they are?

There seems to be a disconnect between Trustee perception vs reality when it comes to controlling pension risks.

With the exception of cyber risk and fraud risk, the responses clearly demonstrate that Trustees are very confident that their risk controls are helping to manage their risks appropriately. In fact, confidence levels have increased dramatically in the last 12 months.

Contrast this with our general experience when reviewing risk controls where, in too many cases, the controls associated with specific risks are just not appropriate, such as:

• they do not reduce ‘impact’ or ‘likelihood’ scores
• they provide more commentary rather than focused actions
• they tend to be too subjective • they have not been reviewed in detail in years
• no documentation exists confirming that the controls are actually being actively applied.

Combine this with the fact that only one third of pension schemes have appointed an independent audit firm as Internal Auditors to help them review their risks/controls and we then have a problem. Trustees need to reassure themselves that any controls identified continue to be appropriate, effective and applied.

Trustees of DB schemes continue to focus primarily on managing financial risks, with concerns relating to employer covenant being a clear winner. Whereas, Trustees of DC schemes see the greatest risks being those potentially resulting in members not being treated fairly or making the wrong decisions

Trustee concerns over DB administration risks (particularly for large schemes) have increased considerably in the last 12 months. In terms of DC risks, there was a difference in views. Trustees of hybrid schemes were concerned with poor communication/default fund design whereas Trustees of DC only schemes were concerned with meeting regulatory requirements and cyber-risk. 

Are Trustees doing enough when it comes to Integrated Risk Management?

The results highlight that most pension arrangements are taking IRM seriously, with 60% of pension schemes spending more than three hours each year considering IRM and related topics. However, of concern is the 14% of pension arrangements who have spent less than one hour on this subject, this includes the 22% of large pension arrangements.

This is reinforced with 30% of pension schemes not using the Trustees’ appetite for risk to help them manage their risks effectively.

Something we encourage all Trustees to consider is to keep things simple and focus on what matters. Too much of valuable Trustees’ time continues to be spent focusing on risk scoring/prioritisation and not enough time is spent on discussing quality risk solutions. At the risk of over-simplifying, we would suggest Trustees should ask themselves three very simple questions at the beginning of each Trustee meeting.

• What are the scheme’s top three risks and what are we doing about them?
• Are we within our risk appetite/tolerance parameters?
• Are our risk controls working well?

Trustees should then rely on their pension manager or advisers to manage the risk programme (consistent with the risk management policy) outside of the Trustee meeting, and allow the Trustees to take an oversight or strategic role towards risk management going forward.