APRA’s new Supervision Risk and Intensity (SRI) model

As a risk-based supervisor responsible for the oversight of a very diverse range of entities across a number of industries, APRA needs to have a structured framework to identify, assess and effectively target its limited resources to areas and entities of greatest need. Central to this process is its risk rating model, which is used to assess the level and nature of risk within each APRA-regulated entity. APRA’s long-standing model is known as PAIRS – the Probability and Impact Rating System – and is used by supervisors to arrive at a PAIRS ‘probability of failure’ score. That PAIRS score is then combined with an ‘impact of failure’ rating to determine – under APRA’s Supervisory Oversight and Response System (SOARS) – the required level of supervisory intensity. The higher the risk of failure, or the more damaging the impact, the more supervisory intensity is applied.

The PAIRS and SOARS framework has served APRA well for a decade and a half, providing a structured and disciplined approach to allocating supervisory resources and attention. Over recent years, however, the type and nature of prudential risks has evolved. Evidence emerged of poor actions and behaviours at an increasing number of financial institutions, undermining community trust and confidence. Emerging risks such as operational resilience and cybersecurity have also increased in prominence. In superannuation, APRA has intensified its focus on ensuring trustees were assessing and, where needed, are taking steps to improve member outcomes.

As part of a broader response to the changing and increasingly challenging operating environment, APRA also began work to review and update its supervision methodology. It commenced this by undertaking a study of prudential regulators in peer jurisdictions, looking at different supervision models and identifying good practice. This culminated in APRA commencing a review of APRA’s entire supervision model (the frameworks, processes, systems, tools and people) which kicked off in early 2019. Known as the APRA Supervision Fitness Program, one of the key deliverables was to redesign PAIRS and SOARS.

A new way to supervise

After a period of development, initial pilot and review, APRA has now designed a more contemporary model set to replace PAIRS and SOARS. The new model will be known as the Supervision Risk and Intensity Model (SRI).

Grounded on the three core attributes of APRA’s supervision philosophy – risk-based, forward-looking and outcomes-focused – the SRI provides a common platform by which all regulated entities can be assessed, while also incorporating different risk class elements tailored to banking, insurance and superannuation depending on the particular business of the entity concerned.

Under the new approach, the APRA-regulated entity population will be divided into ‘tiers’ based on size, complexity, substitutability, inter-connectedness and resolvability, with Tier 1 entities being the largest, most complex entities where failure would risk contagion and other material market impacts. Tier 1 and 2 entities will be subject to the broadest and deepest risk assessments. At the other end of the scale, Tier 4 entities will be subject to a simpler form of assessment. The approach ensures proportionality in line with APRA’s revised Supervision Philosophy¹.

Compared to the PAIRS model, new risk categories are being introduced to more explicitly address matters such as cyber risk; resolvability; governance, culture, remuneration and accountability; and (in superannuation) member outcomes. In addition, a new feature of the model will be the introduction of a common consideration of external environment factors impacting each industry, in the form of an overlay to the SRI scoring system that can be dialled up or down depending on current and prospective operating conditions.

The outcome of the SRI risk scoring will place each entity into a five-stage system of supervisory intensity. Stage 1 equates to what could be described as ‘routine’ supervision and ramps-up as needed in line with APRA’s revised ‘constructively tough’ enforcement approach.

What comes next?

The SRI is in final pilot testing until the end of January 2020, and review of the model by external parties is also currently being sought. It is planned for roll-out during 2020/21.

What will be the impact on current entity PAIRS and SOARS settings?

The SRI risk score and intensity stage will replace existing PAIRS and SOARS entity settings. The impact on individual entities will differ – some entities will see no change, while others may see their risk score and level of supervisory intensity go up or down. This could be due to the impact of the new risk factors (such as risk culture or cyber) or APRA’s strengthened enforcement approach to address prudential risk and hold entities to account. It is also expected that the new model will be more responsive to changing risks, and therefore entities may find their ratings shift more frequently than in the past. Regardless of the nature of change, the SRI will provide greater clarity on the risk assessment drivers, and what an entity would need to do to reduce its risk rating.

Further communication to entities on the SRI rollout will take place in early 2020.

What else is changing?

In addition to the replacement of PAIRS and SOARS, APRA is evolving other parts of its supervision framework. Developing new and innovative ways to conduct supervisory activities and embracing a more open external engagement approach are examples of such areas. Underpinning it all is the establishment of a Supervision Training Academy to deliver an enhanced supervisory curriculum across APRA, helping to strengthen supervisory capabilities.

In short

APRA is evolving its supervision model and the replacement of PAIRS and SOARS is fundamental to this evolution. The new SRI model will be more contemporary, flexible and fit for purpose in today’s environment. It is a significant development for APRA as it strengthens its toolkit and underpins its ability to deliver on its financial resilience mandate. 

¹ To be released in early 2020