a guide to strong risk culture and risk management in the ... · corporate culture, including risk...

12
www.pwchk.com A Guide to Strong Risk Culture and Risk Management in the MPF Industry

Upload: others

Post on 20-Aug-2020

1 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: A Guide to Strong Risk Culture and Risk Management in the ... · corporate culture, including risk culture, risk management frameworks and internal controls. From the introduction

www.pwchk.com

A Guide to Strong Risk Culture and Risk Management in the MPF Industry

Page 2: A Guide to Strong Risk Culture and Risk Management in the ... · corporate culture, including risk culture, risk management frameworks and internal controls. From the introduction

1 PwC

The importance of strong risk culture and risk management cannot be underestimated. Scandals are committed across all levels of an organisation and while the pension fraud scandal committed by Maxwell fades in the popular memory, new ones such as South Korea’s public National Pension Service, Brazil’s pension fund scandal and Sweden’s Allra have made notorious history.

The winds of change are sweeping across Hong Kong in the areas of corporate culture, including risk culture, risk management frameworks and internal controls. From the introduction of the Manager-in-Charge (“MIC”) regime by the Securities and Futures Commission, to the increased focus on bank culture espoused by the Hong Kong Monetary Authority,

regulators in the financial services sector are taking increased interest in the level of governance and culture exhibited by financial firms.

The Mandatory Provident Fund Schemes Authority (“MPFA”) is also taking action, having hosted a forum for Mandatory Provident Fund (“MPF”) trustees in October 2017 with a specific focus on governance and the responsibilities of the board of directors of MPF trustees.

Whilst Hong Kong’s MPF industry is still relatively young, compared to its international peers, and on a journey of discovery as it matures, the total aggregate net asset value of MPF schemes as of 31 December 2017 now stands at HK$ 843.5 billion1, up over 30% from 31 December

2016 (HK$ 646.3 billion). Historically a large focus of attention within the industry has been on compliance with regulations, procedurally driven and on the performance of MPF products. There is clear evidence that key stakeholders within the industry are now taking a more holistic view, stepping back and looking at the inputs which go into an MPF model as opposed to just analysing the outputs. Through having a good risk culture and risk management framework, MPF trustees are more likely to meet their business goals and objectives and by doing so provide a better outcome for their members.

1. Based on information published within the MPFA’s ‘Mandatory Provident Fund Schemes Statistical Digest’ December 2017 edition

2. Based on information published within the MPFA’s ‘Statistical Analysis of Accrued Benefits Held by Scheme Members of Mandatory Provident Fund Schemes’ September 2017 edition

3. Based on information published within the ‘2017 Report on Annual Earnings and Hours Survey’ by the Census and Statistical Department of the Hong Kong Special Administrative Region

Introduction

60%30%

10%

The MPF now has 4.2 million members2

Aggregate net asset value of MPF schemes now stands at HK$ 843.5billion1

The average MPF member has therefore approximately HK$ 200,000 in their MPF account(s)

Global trends point to increasing numbers of people who will rely on their MPF schemes to finance their retirement. Governance is crucial to public trust in the MPF system!

The median monthly wage in Hong Kong is HK$ 16,8003

Only 25% of Hong Kong's working population earn more than HK$ 26,300 per month3

The MPF is designed for Hong Kong’s working population. They need effective governance to safeguard their retirements

Page 3: A Guide to Strong Risk Culture and Risk Management in the ... · corporate culture, including risk culture, risk management frameworks and internal controls. From the introduction

2A Guide to Strong Risk Culture and Risk Management in the MPF Industry

Recent industry observations

Within PwC’s publication “Review of Hong Kong’s MPF system: Recommendations for key reforms”, published in September 2017, ‘strengthening governance’ was highlighted as one of the areas that needed attention in the MPF industry.

This is also not a topic which is lost on the MPFA. From 2014-2016, one of the MPFA’s campaigns was focused on the board of directors of MPF trustees in order to promote better governance and risk culture. Two main areas of improvement recognised by the MPFA following this campaign were:

• Risk management frameworks of MPF trustees not being tailored to the MPF business; and

• Ineffective monitoring of outsourced service providers by MPF trustees.

The MPFA has frequently reiterated that trustees must act in the best interests of scheme members and the culture of MPF trustees must change to what delivers the best value for those members. It is relatively implicit that the MPFA is expecting MPF trustees to revisit and revamp their culture and that the current status quo is not expected to remain.

MPF trustees can expect a further visit from the MPFA as part of its supervisory plan for the period from 2017-2019, with one of the areas of focus expected to be:

“Ensuring MPF trustees have a sound risk culture, strong governance, accountability by senior management, and an increased emphasis on putting members’ interests first.”

MPF trustees can expect that the MPFA will also be using these visits to understand how MPF trustees are responding to the observations and findings raised from their previous campaign.

Understanding the importance of risk culture and risk management frameworks

Establishing a strong risk culture combined with an effective risk management framework are critical factors that should be embedded in all MPF trustees. This is not something that can be achieved solely through the establishment of step by step policies and procedures and evidenced through periodic checklists.

This guide has been designed to assist MPF trustee directors and executive management in assessing where they are on their risk culture and risk management journey. The guide firstly examines the roles and responsibilities of MPF trustees as well as highlighting some established and emerging cultural and operational issues within the MPF industry. It then provides some thoughts on future actions and industry best practices which can be undertaken by MPF trustees to enhance and strengthen their risk culture and risk management frameworks in order to help mitigate these issues and challenges. The guide also touches on the role that MPF sponsors play in the MPF industry and the support that they can provide to MPF trustees.

Page 4: A Guide to Strong Risk Culture and Risk Management in the ... · corporate culture, including risk culture, risk management frameworks and internal controls. From the introduction

3 PwC

Roles and responsibilities of MPF trustees in Hong Kong

Hong Kong MPF trustees, and trustees in general, find their statutory and regulatory duties stated across a variety of sources. For MPF trustees, this includes:

• The Trustee Ordinance (Chapter 29);

• The Mandatory Provident Fund Schemes Ordinance (Chapter 485);

• The Mandatory Provident Fund Schemes (General) Regulation (Chapter 485A); and

• Various MPFA Codes and Guidelines

The MPFA’s guidelines on trustee responsibilities note that there are two levels of duties, those at the director level and those at the company officer level. While observing that the duties of MPF trustees are predominantly administrative and procedural; ensuring correct accounting and record keeping, reporting to the MPFA and MPF scheme members, and ensuring transfer and payment of MPF benefits for instance, this guide encourages MPF trustees to revisit and focus on the following core areas:

• Scheme management - MPF trustees are required to manage their MPF schemes in accordance with the governing rules of the scheme as well as relevant laws and regulations. MPF trustees should ensure that they have at their disposal sufficient qualified, experienced and knowledgeable resources to enable them to effectively discharge their responsibilities as trustee.

• Risk management culture and framework - To aid in the effective management of their MPF schemes, MPF trustees should

design and implement an effective risk management framework and system of internal controls. The MPF industry in Hong Kong is on a journey of development and therefore MPF trustees’ established risk management frameworks and internal control systems should be subject to periodic evaluation to ensure continued effectiveness.

• Effective oversight of service providers - MPF trustees are responsible for selecting, appointing, re-appointing and terminating the appointment of other service providers to MPF schemes. The ‘Effective risk management framework and the three lines of defence model’ section of this guide delves into measures MPF trustees should implement.

Key stakeholders within the MPF industry

There are numerous different stakeholders within the MPF industry, which MPF trustees need to consider, including:

(i) Shareholders;

(ii) Members;

(iii) Sponsors;

(iv) Employers;

(v) Policy makers;

(vi) Regulators; and

(vii) Auditors.

MPF trustees when making strategic and operation decisions may identify potential conflicts between the optimum courses of action for these different stakeholders. For example, is what provides maximum returns to my shareholders also in the best interests of my members? When actual or

perceived conflicts arise, MPF trustees should be putting themselves into the shoes of their members.

Role of service providers within the MPF industry

MPF trustees are able to delegate elements of their duties to other service providers, and it is common practice in the MPF industry for MPF trustees to do so. Typical delegated duties include:

• Scheme member administration;

• Constituent fund administration;

• Custody of scheme assets; and

• Investment management of scheme assets.

The risk culture and risk management framework of an MPF trustee should incorporate how the trustee implements and demonstrates effective oversight of these other service providers, which is covered in more detail later on in this guide.

Page 5: A Guide to Strong Risk Culture and Risk Management in the ... · corporate culture, including risk culture, risk management frameworks and internal controls. From the introduction

Managing conflicts of interest

As mentioned above, there are numerous potential conflicts of interest, both real and perceived, that MPF trustees need to consider, manage and overcome. These include, but are not limited to:

• Duties to shareholders versus duties to members;

• Duties to different members;

• Duties to members versus duties to regulators; and

• Duties to group service providers versus duties to members.

Overcoming real conflicts of interest and the perception that such conflicts exist is a key challenge regarding the governance of MPF trustees. Various social, regulatory, and financial penalties and sanctions exist to punish trustees that disregard their responsibilities including, financial fines and penalties, loss of office, and criminal liability.

This can be challenging to manage in practice but there are a number of safeguards that can be put in place including establishment of a conflicts of interest policy, requiring disclosure of all actual or potential conflicts of interests, recording all conflicts in a conflicts register and providing periodic training to directors on identifying, reporting and managing conflicts. This is also an area where the importance of Independent Non-Executive Directors (“INEDs”) comes to light. Through having directors who don’t have potential situational conflicts to grapple with they can put members’ interests at the centre of decision making.

Roles and responsibilities of MPF sponsors in Hong Kong

While MPF trustees are ultimately responsible for the operations of MPF schemes under their trusteeship, MPF sponsors are the product owners. MPF sponsors play a key role in the initial design and establishment of an MPF scheme, including the design and investment strategies of constituent funds and setting fee levels. On an ongoing basis MPF sponsors are heavily involved in the continuing distribution and marketing of their MPF products.

MPF trustees find themselves increasingly in the spotlight and often MPF sponsors fall under the radar. Given MPF products typically bear the name of the sponsor, this creates a significant reputational risk for the MPF sponsor if things were to go wrong. As a result MPF sponsors have a vested interest to be comfortable that the trustees of their MPF products are doing the right thing for members.

As MPF sponsors aren’t currently regulated by the MPFA in Hong Kong they don’t have the same day to day focus, as MPF trustees, on compliance with laws and regulations. This should enable MPF sponsors to be more freely focused on the interests of members. This is where MPF sponsors can support MPF trustees in the decision making process by providing another point of view.

In Hong Kong, whilst there are instances where MPF trustees are independent of the MPF sponsor, a majority of MPF trustees are part of the same financial group as the MPF sponsor, with the MPF sponsor typically being a parent entity within the financial group. The MPF sponsor can therefore play a pivotal role in ensuring that the MPF trustee has the necessary support, resources and backing that it needs from the financial group in order to effectively discharge its fiduciary obligations.

4A Guide to Strong Risk Culture and Risk Management in the MPF Industry

Page 6: A Guide to Strong Risk Culture and Risk Management in the ... · corporate culture, including risk culture, risk management frameworks and internal controls. From the introduction

5 PwC

Establishing an effective risk culture

Adopting and embedding an effective risk culture for MPF trustees means

demonstrating that, at all levels within the organisation, there is a shift in the

focus of strategic and day to day decisions.

MPF trustees should avoid making decisions purely based on the scope of MPF scheme governing rules and relevant laws and regulations. This involves taking a step back to consider whether the course of action is in the best interests of MPF members.

Importance of risk culture

Why should MPF trustees be concerned with their risk culture? The potential consequences for MPF trustees getting this wrong could be severe and long-lasting. These could include:

• Regulatory fines and the resulting increased scrutiny by the regulator, members and service providers;

• Adverse impact on the MPF trustee's external brand and reputation;

• Increased internal scrutiny, in particular where the MPF trustee is a subsidiary of a financial institution;

• Loss of talent as experienced employees migrate to other MPF trustees with strong risk cultures; and

• Potential missed business opportunities if the MPF trustee doesn’t strike the right balance between risk avoidance and taking controlled calculated risk.

Model for building an effective risk culture

So how do MPF trustees build an effective risk culture? This guide identifies six key areas of discipline needed to create and sustain a healthy risk culture.

Leadership and tone at the top - The attitudes, behaviours, beliefs and actions about risk, of the directors and executive management of MPF trustees, shape the risk environment and culture. How does leadership communicate regarding risk? How is unacceptable behaviour dealt with? MPF trustees’ directors and executive management should ensure they align their actions with the messages they are conveying concerning risk.

Governance and organisation - The risk function should be seen as an integral part of the business, a working partner, as opposed to an obstacle or hurdle that business lines need to overcome. MPF trustees need to foster a culture of collaboration between the risk function and other business functions. As part of this, MPF trustees should consider the following:

Can we do this? Should we do this?

Is it legal? Is it the right thing to do?

Internal thinking (i.e. financial)

External thinking (i.e. members and social responsibility)

Page 7: A Guide to Strong Risk Culture and Risk Management in the ... · corporate culture, including risk culture, risk management frameworks and internal controls. From the introduction

6A Guide to Strong Risk Culture and Risk Management in the MPF Industry

• How risk is integrated into the decision making process - MPF trustees should ensure that risk personnel are adequately involved in strategy business decisions.

• What place does the risk function have in an organisation - MPF trustees should ensure that the Chief Risk Officer (“CRO”), or other equivalent representative of the risk function, has a direct reporting line with the CEO and/or board.

Communications - Successful risk cultures are often forged on the back of communication channels that support and promote open and honest communication between directors, executive management and other employees. MPF trustees wishing to create a strong organisation culture should develop a strategy and plan for communicating and embedding leadership messages to employees.

Talent management - Risk personnel should be expected to work with and support their colleagues from within business operations. MPF trustees will therefore need to consider the skills and experience existing within their risk functions and whether it has the right balance between risk management skills and operational experience. Risk functions composed solely of employees with limited or no front line experience will find it harder to challenge business decisions and perform their duties effectively. Risk goals should also be embedded into the recruitment and ongoing employee training process. Employee incentives and consequences can be aligned with desired risk behaviours and expectations.

Consistent operating norms - Service providers, including MPF trustees are increasingly making use of offshore service centres in their efforts to reduce overall operating costs and to provide more value for money to customers. MPF trustees, where their operations are split across several locations, will need to understand differences in local office cultures so that policies and procedures can be aligned with the MPF trustee’s values.

Technology and infrastructure - Technology should be in play which enables MPF trustee directors, executive management and other employees to make informed decisions by providing them with appropriate information on a timely basis. Technology can also be utilised by MPF trustees to provide a platform for maintaining a risk register and for employees to escalate risk. Whilst eMPF may be a few years away, MPF trustees will need to evaluate their readiness in advance. It is expected that there might be a renewed focus on the integrity of member unit balance records, and an emphasis on MPF trustees to provide assurance over those records, before the launch of eMPF.

Common challenges in building an effective risk culture

Outlined above is a six step model for MPF trustees to consider when cultivating an effective risk culture. Within the MPF industry there are additional common operational challenges which MPF trustees will have to overcome when implementing the highlighted model:

• Resources: MPF trustees are under increasing pressure to provide value for money and reduce their costs charged to MPF schemes. Taking this into consideration, are MPF trustees deploying sufficient resources within a risk function to allow them to achieve their risk goals?

• Expertise and professional support: MPF trustees are commonly established as a subsidiary of a financial institution, and as a result, there is typically heavy reliance on intra-group resources for functions such as risk management. These financial institutions can have extensive risk functions, with a wide breadth of knowledge and experience available, and therefore this guide isn’t advocating that MPF trustees should cease to make use of these resources. However, MPF trustees should ensure that these group risk functions commit, and provide the

trustee operations, with sufficient and appropriate time, focus and attention. As highlighted previously in this guide this is an area where MPF sponsors could provide support.

• Outsourcing risk function: Within the industry it has been observed that MPF trustees might outsource, to third party service providers, some key functions, including risk management. MPF trustees need to conduct due diligence to establish whether the outsourced service provider operates under the same set of core values and beliefs as the MPF trustee considering the adverse impact that a non-vetted vendor might have on the reputation of the firm.

Page 8: A Guide to Strong Risk Culture and Risk Management in the ... · corporate culture, including risk culture, risk management frameworks and internal controls. From the introduction

7 PwC

Effective risk management framework and the three lines of defence modelThe three lines of defence approach is increasingly being adopted as the model supporting good risk management across all industries. This guide

supports the three lines of defence model and considers that all MPF trustees should implement, at a minimum, this model to support

establishing an effective risk management framework and embedding their risk culture, goals and objectives into day to day operations.

1st line of defence 2nd line of defence 3rd line of defence

Culture, people, processes, systems and controls

Setting the right risk culture and aligning strategy to risk imperatives are essential to an organisation’s success. When developing a response to risk, an organisation’s first line of defence is the culture it develops, the processes it puts in place, and the systems and controls it employs to manage risk whilst still exploiting business opportunities.

As highlighted in the previous section, MPF trustee directors and executive management demonstrating the right ethical behaviour in everything they do, including putting MPF members interests first, will make it more likely that these behaviours and traits will cascade down to other staff members. With that in mind the board needs to ensure that the trustee’s mission, purpose and values are at the heart of their actions undertaken.

MPF trustees have various contractual and regulatory obligations to key stakeholders within the MPF industry. The first line of defence should be able to demonstrate how implemented systems and internal controls support the MPF trustee being able to satisfy all these obligations on a continuing basis.

Management oversight, board and risk management committees, risk management and compliance functions

Dedicated compliance and risk functions are important components of the second line as are committees and functions that oversee the effective operation of an organisation’s internal control framework, including the control activities performed in the first line.

The committees set direction, define policy and oversee the management of risk in line with risk appetite. The tone set by the board will have an impact on the effectiveness of the first and second lines.

The second line shouldn’t purely be viewed as a secondary check (i.e. additional review) of the activities undertaken by the first line. Whilst the second line needs to maintain a degree of independence from the first line, it should be working alongside the first line providing guidance, expertise, and support in helping the first line design, implement, and periodically re-assess their systems and internal controls. In effective three lines of defence models, the second line often contains valuable subject matter expertise in fields such as risk, compliance, controls etc. which the first line can draw upon as required.

Internal audit

Internal audit provides independent, objective assurance and is designed to add value and improve an organisation’s operations. Internal audit helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluating and improving the effectiveness of risk management frameworks and systems of internal controls. This assurance is the result of a risk-based programme of internal audits covering aspects of the organisation’s operations and oversight functions.

Support from external assurance

Successful three lines of defence models are often supplemented through periodic external assurance reviews. These encompass third party assurance engagements, and other

equivalent reviews, completed by an external independent auditor and/or other independent professional services firm, as well as reviews completed by regulators.

This approach allows MPF trustees to draw on the experience of their

external independent auditors, creating the potential for these reviews performed to play a role of driving change within an MPF trustee, bringing different points of views and perspectives to an MPF trustee, which can be invaluable in times of change.

Page 9: A Guide to Strong Risk Culture and Risk Management in the ... · corporate culture, including risk culture, risk management frameworks and internal controls. From the introduction

8A Guide to Strong Risk Culture and Risk Management in the MPF Industry

Common challenges to overcome to establish an effective three lines of defence model

This guide acknowledges that in many organisations the three lines of defence model is not sufficiently supported by the processes and technology that it ideally requires for optimum operation. This commonly results in complexity and confusion, especially for those involved in exchanging information with others, including multiple service providers, across the three lines.

Successful three lines of defence models are built upon clearly defining the roles and responsibilities within the three lines and the three lines collaborating and working towards common goals and objectives. If there is confusion over the responsibilities of various parties within the three lines of defence model it results in less than effective collaboration and increases the likelihood that control needs are either “falling through the cracks” or overlapping in coverage. For example, management, the first line, may be confused as to where the second and third lines begin and end, which can lead to uncertainty about whom they should share information with. Confusion in addition may lead to the first line looking at the second and third lines as roadblocks, rather than as trusted advisors, in managing risks and strategic initiatives.

Service provider oversight

The importance of oversight of service providers has recently been catapulted into the public domain through Facebook’s recent scandal involving Cambridge Analytica. This guide has already highlighted that MPF trustees delegate a number of their duties to other service providers and that MPF trustees therefore need to have a system of processes and internal controls to maintain and demonstrate effective oversight of these service providers. But how can this be achieved? This guide supports MPF trustees following a four step process.

Upfront risk assessment - As a starting point MPF trustees need to

identify, assess and understand the inherent risks associated with their business activities and operations. Following this, MPF trustees can start to analyse the costs versus the benefits of outsourcing individual duties. As part of evaluating outsourcing risk, MPF trustees need to consider their ability to provide appropriate oversight of any service provider.

Due diligence and selection of service providers - MPF trustees have an obligation to protect the interests of, and act in the best interests of, their members and this should underpin the evaluation of potential service providers. MPF trustees should ensure they have a robust due diligence process in order to support an informed decision as to which service provider presents the best value for money for MPF members. What represents value for money for MPF members is not just associated with lower costs but also the overall quality of the services they will receive. So in addition to pricing, a robust due diligence program should include a review examining business background, reputation, strategy and corporate values, financial performance and internal control frameworks. MPF trustees should also retain documentation of their due diligence performed to support the final decision made on choice of service provider.

Contract provisions and appointment of service providers Terms of service arrangements to be entered into by MPF trustees with other service providers should be in the form of written contracts. These written contracts would typically include terms such as respective roles and responsibilities, costs and compensation, right to audit, establishment and monitoring of performance standards and metrics, reporting and escalation protocols, business resumption and contingency planning, safeguarding MPF members data and sub-contracting. MPF trustees should ensure that a comprehensive review of contract terms has been completed before formal approval and execution.

Continuing oversight and monitoring of service providers -Performance metrics established, and incorporated into contractual agreements, should be monitored on a periodic basis by MPF trustees. For this process to be effective, the individual(s) assigned with completing this periodic evaluation should have the requisite experience and knowledge to perform this role. Service provider oversight should be a risk focused process and the results of the process should be reported to an appropriate committee, or if not, delegated to a committee of the board of directors, within the MPF trustee.

Where any concerns or deficiencies have been identified as part of the oversight process, remediation actions and plans should be documented and followed up through to resolution. This could include steps such as control enhancements being committed to by the service provider, additional top-up procedures/controls required at the MPF trustee level to bridge identified gaps and/or more frequent and stringent monitoring of the service provider.

Vendor oversight should not be considered a one-off, point in time evaluation, but a continuous obligation of MPF trustees. MPF trustee directors and executive management need to be comfortable that their oversight processes and controls are sufficient and appropriate to enable them to conclude that appointed vendors provide quality, value for money, services for MPF members on a continuing basis.

Page 10: A Guide to Strong Risk Culture and Risk Management in the ... · corporate culture, including risk culture, risk management frameworks and internal controls. From the introduction

9 PwC

Moving forward

Moving forward

Over the coming years MPF trustees are expected to continue to receive challenges, from regulators, members and other stakeholders, in three key areas which have been touched upon in this guide.

Promoting a member-centric culture at all levels of the trustee

The members of MPF schemes should be at the centre of any and all cultural practices exhibited by MPF trustees, and supporting organisations, including MPF sponsors. This is paramount not only given the inherent nature of what being a trustee entails, as outlined throughout this guide, but also due to the fact that the working population of Hong Kong is relying on the MPF to assist them in saving for their retirement. Just as the MPF as a whole should be ‘digital by default’, the culture of an MPF trustee should be member-centric at all levels.

Implementing a strong risk culture and effective internal control frameworks across the organisation

Risk management and risk culture is becoming ever-important across the financial services industry and the MPF industry is no exception to this. Ensuring that MPF trustees have effective risk management frameworks, a strong risk culture, and adequate and regularly reviewed internal controls is

the responsibility of an MPF trustee and it is crucial that they take their responsibilities in this seriously.

Risk management frameworks can’t be effective without firstly establishing a strong risk culture within an organisation. The six key areas of discipline and three lines of defence model highlighted in this guide can help support MPF trustees in embedding a strong risk culture and an effective risk management framework. With the future implementation of the eMPF there will be an increased focus on risk management frameworks and risk culture, especially in the realm of cybersecurity, but also across more traditional areas like unit balance accuracy and data standards.

Strengthening trustees' governance frameworks in the oversight of service providers

In the ordinary course of business operations it is normal for MPF trustees to look to outsource various functions to other service providers. This guide has highlighted a four step process for MPF trustees to ensure that they can operate and demonstrate effective supervision of vendors.

Conclusion

The MPFA, along with other financial regulators in Hong Kong, is taking a firm stand on matters related to risk

culture as well as risk management and internal control frameworks. Already many MPF trustees have had thematic reviews undertaken and inspections by the MPFA have occurred. Fines have been handed out, and the MPFA is being more vocal in its disclosure of breaches by MPF trustees.

The MPFA has also disclosed its action plan to promote continued improvement within MPF trustees. It consists of:

• Supervisory dialogue with individual trustees on governance issues based on submitted business and governance plans; and

• Promulgating standards and principles on good governance for MPF trustees.

This guide has highlighted suggested frameworks for risk culture and risk management for MPF trustees. A key success factor for establishment, implementation and operation of these frameworks depends on the accountability and governance standards exercised by leadership and tone from the top, as internal controls are only as robust as one’s weakest link. In order for the MPF industry to be fit for purpose, MPF trustees must be driven to always do the right thing as trustees of the assets of the working population of Hong Kong.

Page 11: A Guide to Strong Risk Culture and Risk Management in the ... · corporate culture, including risk culture, risk management frameworks and internal controls. From the introduction

10A Guide to Strong Risk Culture and Risk Management in the MPF Industry

Our experienced team are able to assist in a range of areas as industry players seek to either establish and/or strengthen their risk cultures and risk management frameworks.

For more information please contact:

Contacts

Marie-Anne Kong

Partner, Asset and Wealth Management Practice Leader +852 2289 2707 [email protected]

Albert Lo

Partner, Financial Services Consultancy +852 2289 1925 [email protected]

Helen Li

Partner, Financial Services Risk and Regulation +852 2289 2741 [email protected]

Nick Hamer

Partner, Risk Assurance +852 2289 8545 [email protected]

Carlyon Knight-Evans

Partner, Financial Services Risk and Regulation + 852 2289 2711 [email protected]

Gary Ng

Partner, Risk Assurance +852 2289 2967 [email protected]

Michael Atkinson

Senior Manager, Financial Services Risk and Regulation +852 2289 1119 [email protected]

Page 12: A Guide to Strong Risk Culture and Risk Management in the ... · corporate culture, including risk culture, risk management frameworks and internal controls. From the introduction

www.pwchk.comThis content is for general information purposes only, and should not be used as a substitute for consultation with professional advisors.

© 2018 PricewaterhouseCoopers Limited. All rights reserved. PwC refers to the Hong Kong member firm, and may sometimes refer to the PwC network. Each member firm is a separate legal entity. Please see www.pwc.com/structure for further details.HK-20180420-2