Deputy Superintendent, Ben Gully speech to C. D Howe Institute: What makes an effective prudential supervisor

Good afternoon and thank you for inviting me to speak today about prudential supervision. It may not be everyone's favorite lunchtime topic but supervising the safety and soundness of regulated institutions is critical to promoting public confidence in the financial system, whether in the context of recent events or the broader (and too often forgotten) lessons of the global financial crisis (GFC). And while there may be different views on what constitutes an effective prudential supervisor, the challenge in defining success stems from the inherent nature of our business, which is judgement-driven and where “failures” are rare, making statistical back-testing impractical.

While it might seem straightforward at first glance, prudential supervision is a complex and nuanced discipline that relies more on strategy and skill than science.

To explain this, let me draw a comparison from the world of sports – picture prudential supervision as a high-stakes soccer match, where every decision counts.

In this analogy, think of the Office of the Superintendent of Financial Institutions (OSFI) as the referee. Much like them, we closely monitor the game, blow the whistle when necessary, and have our own version of yellow and red cards when regulated institutions cross the line.

Now, imagine the spectators in the stadium as depositors, creditors, and policyholders who should enjoy the game, while feeling confident about what's happening.

Finally, consider the federally regulated financial institutions (FRFIs) and private pension plans (FRPPs) as the players we oversee.

But much like a referee’s, OSFI’s job as a prudential supervisor isn’t just about the rules; it’s about the finesse.

Experience has shown us that while data, analysis, and regulations have their place, qualities such as a willingness to take calculated risks, acting swiftly, and remaining open to feedback are equally, if not more, important.

That’s why as part of our supervision renewal, OSFI is leaning into these intangible qualities. We’re getting ourselves match-fit for a fast moving, complex and, at times, unpredictable risk environment.

In case it isn’t already evident from the soccer analogy, let me further illustrate the difficult task of implementing supervisory actions based on sound judgement with a quote from Mark Twain; and while he was probably not talking about prudential supervision, or about refereeing a World Cup match, he said:

“Good judgement is the result of experience - and experience the result of bad judgement.”

Just like a soccer referee's role is to ensure the game's integrity, OSFI's mission is to protect the interests of depositors, policyholders, and private pension plan members from financial loss. We’ve got the legal authority to blow the whistle, and an accountability model that is built on operational independence.

On the soccer field, the referee must ensure compliance with the rules and allow teams to compete effectively, without disrupting the flow of the game. The same could be said about prudential supervision.

OSFI’s prudential goal is financial safety and soundness. Financial institutions and private pension plans have to follow the rules. And our role is to observe, ready to whistle and intervene when the game is at risk.

But while we promote good risk management and corporate governance practices, we're also mindful of the need for financial institutions to stay competitive and take reasonable risks.

Ultimately, responsibility for risk decisions rests with senior management, boards of directors and private pension plan administrators for the quality of their ‘game’.

That means financial institutions can fail and they may need to leave the field, so to speak.

OSFI’s supervisory work is to mitigate the risks that may lead to this as much as possible, preventing a failure that could undermine public confidence in the Canadian financial system.

As a result of the need to balance competing interests, our work will always involve a judgement call.

While the failures of regulated institutions don’t happen often, they are often high impact. So, while we rely heavily on data, it's not always enough to predict lurking issues.

It’s also difficult to demonstrate that a problem has been averted because of actions we’ve taken – in the same way that it’s difficult to predict the outcome of a soccer match solely by stats.

Sometimes, you just need a keen eye.

OSFI’s take on supervision uses methods and risk skills that reflect good practices across the regulatory community. Indeed, OSFI’s supervisory approach is aligned with international standards, such as the Basel Committee’s ‘Core Principles for Effective Banking Supervision’ and the ‘Insurance Core Principles’ established by the International Association of Insurance Supervisors, among others.

However, while these methods help lay the foundation for effective supervision, they are only as good as the supervisor’s judgement about the risk and what to do about it.

Throughout my career, I’ve been privileged to observe and learn from different supervisors regarding how they apply judgement. To me, an effective supervisor strives for prudent outcomes through moral suasion, and when required, more directive means to address the risks. The key ingredient for success is an individual’s willingness to act even when the stakes may be high.

Earlier, I likened OSFI’s role to one of a soccer referee. If you've ever watched soccer or any sport with referees, you may have noticed that respected officials possess intangible qualities. Those qualities can also apply to effective supervisors, and so I’d like to highlight four qualities that stand out to me.

First, there’s simply no way that referees can watch the entire field at once, so they must anticipate the game. So just like referees, supervisors need to focus on what matters most, with curiosity, while keeping an eye on the most crucial plays.

Effective supervisors need to be comfortable accepting risk. They make risk-based decisions all the time. Risk-appetite guides this process. Sometimes, they need to sprint, pivot, and adapt – just like a referee in a fast-paced match.

Second, effective supervisors must make decisions under pressure. While they usually have more time at their disposal than referees, they still need the ‘will to act’ and a sense of urgency. Effectiveness as a supervisor depends on translating opinions into meaningful, timely actions that address core risk issues and resolve them as quickly as possible.

Third, supervisors need grit. They must have a thick skin in the face of criticism or challenge from the institutions they oversee, just as referees must stand up to players, team owners or spectators.

Effective supervisors must maintain a healthy level of skepticism in everything they do. But they must also ensure that this thick skin does not become a barrier to learning from experience.

Fourth, unwavering integrity is paramount. Effective supervisors base their decisions on sound evidence and organizational support from regulatory senior management, while remaining alert to the potential biases that exists in all judgement-based businesses.

They must also cultivate trust and confidence by engaging openly with their stakeholders; they provide clarity about regulatory expectations and supervisory processes and encourage diverse perspectives to uncover hidden risks.

Now let’s turn to OSFI.

As the game evolves, so do the challenges. Today’s rapidly changing risk environment places greater demands on supervisors. You only have to look at OSFI's latest Annual and Semi-Annual Risk Outlook to see this. Financial institutions and private pension plans face increasingly complex and interconnected risks.

At OSFI, we consider broader macro-economic trends to supervise the regulated institutions we oversee. Where appropriate to do so, we also adopt a proportional approach for smaller financial institutions or private pension plans and recognize the necessity of international cooperation for a level playing field.

In recent years, our focus has expanded from so-called “traditional risks” – such as credit, market, and liquidity risk – to also include non-financial risks, like risks arising from operations, climate change, tech and cyber, third parties, and institutional culture.

We think these newer risks have the potential to materialize as serious prudential concerns if they are not managed well.

Similarly, geopolitical risks are also growing more prominent and can expose or exploit vulnerabilities here in Canada.

It has become clear that mitigating threats to financial institutions’ integrity and security, including by foreign interference, is critical to maintaining the safety and soundness of the financial system.

That’s why this past June, the Government of Canada modified OSFI’s mandate to provide us with the necessary tools to ensure federally regulated financial institutions protect themselves against threats to their integrity & security. In line with our expanded mandate, OSFI is now developing new ways to assess the adequacy of steps taken by financial institutions in this regard.

We know we need to change the way we work to stay ahead of the curve. That’s why we’ve embarked on a comprehensive program of supervisory renewal.

Our goal is to become more responsive, and our new Supervision Institute is leading efforts to build our supervisory capacity to enable supervisors to make timely decisions with imperfect information.

In addition to reinforcing the continued importance of technical skills related to risks in the financial industry, we are harnessing the power of data and analytics to gain new insights and speed up the decision-making process with the data we already have.

With the creation of OSFI's new Supervision Institute, we are establishing a supervisory apprenticeship model, including cross-border partnerships with other regulators, to build the next generation of supervisors and contribute to the professionalization of supervisory talent. Recent experience suggests that we need to work even harder to build the right skills given the risk environment, and we can't leave talent management as informal as it may have been in the past.

Quality control and assurance mechanisms will also help us consistently maintain our edge, ensure supervisors are equipped with the support they need from across OSFI, and sustain our focus on critical issues.

Central to our supervisory renewal efforts is the completion of a comprehensive review of our supervisory framework. This is the most significant change to our supervisory playbook in 25 years, and it will take effect in April 2024. You may ask, "Why now?" Recent events and the rapidly changing risk environment underscore the need to relentlessly invest in our supervisory capabilities and make it clear that there's no time to waste. In fact, the changes we've made are already paying dividends.

The new supervisory framework will apply to both financial institutions and private pension plans and recognizes the specific nature of the different industries we regulate.

Our new framework is more explicitly results-orientated. It is designed to help us respond quickly and achieve sound supervisory outcomes when problems arise. Our supervisory assessments are based on identified risks, or in other words, things we want to see changed at the financial institution.

While the changes represent a comprehensive update to our approach, supervisory judgement remains central to our process, and we continue to be a principles-based, forward-looking regulator.

In developing the new framework, we worked with other international peer regulators as well as Canadian federal government organizations that work together to support the strength and stability of Canada’s financial system.

We don’t expect the new Supervisory Framework to lead to big surprises in the transition. However, regulated institutions may see more rating changes than before as the new framework provides for greater differentiation than the old one. Our goal is to focus on an institution's most critical risks and respond promptly. We will also share more ratings privately with regulated institutions to be more transparent in our assessments and, where they exist, signal supervisory concerns. These ratings will remain private regulatory information and will therefore not be publicly disclosed.

So, with the launch of our new framework, regulated institutions will receive an overall risk rating reflecting viability risk according to an expanded eight-point scale (from a previous four-point scale). This additional differentiation in ratings supports our ability to take early corrective action.

We’re also introducing tier ratings to gauge size, complexity, and potential for contagion in the event of failure. This helps to guide our intensity of supervision and is consistent with our “risk-based” approach.

We will also include four additional assessment categories for our larger institutions that will help focus our efforts on prudential outcomes and thereby help to identify specific supervisory concerns.

The four new category ratings are as follows:

• First, business risk, which is a forward-looking assessment of the sustainability of the business model, taking into account risk appetite, strategy and performance, as well as the impact of macro risks;
• Second, financial resilience, which addresses the ability to withstand financial stress, considering risk, capital and liquidity;
• Third, operational resilience, which refers to the ability to continue operations, including critical operations through disruption; and
• Fourth, risk governance, which refers to the ability to identify, assess and manage risks appropriately.

You may be wondering where Climate risk fits in. Climate risk is covered by all four categories and is something we consider as a s​o-called “transverse risk” that runs throughout our assessment. Climate-related risks have the potential to impact an institution’s business model as well as its financial and operational resilience. We are looking for institutions to have appropriate governance and risk management practices to manage these risks.

Whenever we identify significant climate related risks, these will be explained in our ratings for the affected categories. In this way, climate risk considerations can drive an institution’s overall risk rating.

Overall, we expect that the changes to our supervisory framework will result in a richer dialogue between the Board, senior management and OSFI supervisors.

As we look ahead to implementation in 2024 and beyond, OSFI remains committed to review the new framework immediately after implementation while also conducting comprehensive reviews of the entire framework at least every five years to ensure its relevance.

At OSFI, we know that effective supervision depends on strong relationships with those we regulate.

That’s why we’re revamping our approach to supervision to make sure we’re all on the same page.

To that end, we'll continue to facilitate open, frank, and direct communication with our stakeholders. When our new framework takes effect in April 2024, we'll also provide more information to regulated institutions to help them understand our key concerns and how best to address them in a timely manner.

There's no doubt that today's rapidly changing environment puts more pressure on being an effective supervisor.

But the role of OSFI remains the same, even in these fast‑paced and sometimes unpredictable times.

Like a referee in a soccer match, getting the basics right and being consistent is the foundation for good performance. That's how we promote effective risk management, preserve sound governance, and take swift action when problems arise.

Effective supervision relies on individuals who, like the best soccer referees, have the unique and valuable capability to make sure everyone plays by the rules while allowing the game to unfold smoothly.

This unique skill is demonstrated through the various judgement-calls that a supervisor makes throughout ‘the game’. As such, we can’t forget that effective supervision is still the result of good judgement, and experience counts.

In the aftermath of the GFC, the regulatory community invested in many more rules, data, and reporting benchmarks to answer questions about the ability of supervisors to promote sound prudential outcomes on an ongoing basis. You could think of these as "instant replay" innovations used to double-check a referee's calls.

But rules and data, even with more technology, can't yet replace the importance of a supervisor's call on prudential risks and what to do about them. As a result, the effectiveness of prudential supervision remains one of the most important factors in maintaining public confidence in the financial system, and therefore warrants equal attention to all other important policy development efforts.

That’s why OSFI’s focus on supervision renewal is so critical to its transformation strategy and why we are so focused on continuous improvement and learning from past experiences.

Thank you.