The board of CCLA Investment Management Limited (CCLA IM) has established an Audit and Risk Committee that typically meets quarterly to oversee, amongst other things, risk management issues. In addition, an Executive Committee has day to day oversight of CCLA IM and its operations. The Executive Committee has in turn established:
• an Investment Committee (held at least quarterly) to oversee the investment process and activity.
• a Product Governance Committee (held at least quarterly) to oversee changes in funds characteristics and launches of new funds.
• a Risk Committee (held at least quarterly) as a risk governance committee chaired by the Chief Risk Officer, to which three sub-committees report into:
• an Investment Risk Committee (held at least quarterly) focused to overseeing matters pertaining to Investment Risk.
• a Fair Value Pricing Committee (held at least quarterly) focused to overseeing matters pertaining to valuation and fair pricing of all assets managed by CCLA.
• a Client Money Committee (held at least quarterly) focused to overseeing matters pertaining to direct holding of client’s money.
Although the ultimate accountability for risk leadership and management rests with the board and the Audit and Risk Committee, the Chief Risk Officer, in leading CCLA’s risk management function is suitably empowered and has responsibility to ensure an appropriate risk framework is in operation. The Chief Risk Officer also has an unfettered reporting line into the Audit and Risk Committee to further maintain his independence.
CCLA’s risk management function is divided between investment risk and enterprise risk with both areas suitably resourced with experienced risk professionals. Below is a summary of each area’s key responsibilities and coverage.
Enterprise Risk
The Enterprise Risk team is responsible for the design and upkeep of the firm’s risk management framework. This includes the strategies, methodologies, tools, processes and procedures necessary to identify, measure, mitigate, manage, monitor and report on a continuous basis the enterprise risks, at an individual and at an aggregated level, to which the company is or could be exposed to, and their interdependencies. The Enterprise Risk team looks after the following tasks:
Enterprise risk management policy and risk event management procedures
• Maintaining and developing the enterprise risk management framework (ERMF). This includes monitoring and refreshing the risk appetite statement against the firm’s top-town risks and maintaining and refreshing the firm’s risk profile review each quarter (including refining top-down and bottom-up risk taxonomies and control assessments).
• Managing core risk management processes. Conducting risk event and near-miss investigation (including root cause analysis, proposing control environment enhancements, maintaining the risk event log, managing and tracking issues and actions, facilitation of the risk and control self-assessment (RSCA) process and the development of key risk indicators. Enterprise Risk also facilitates the annual AAF 01/20 review, an independent assessment undertaken by a third-party of CCLA's key operational controls and processes.
• Risk reporting. Responsible for preparing risk reports for the Risk Committee, Executive Committee, Audit Committee and fund board documenting emerging risks to the firm/funds, highlighting risk event and loss trends and providing updates on specific enhancements made to the ERMF.
• Risk culture. Support the executive directors of the firm in setting the right tone from the top, ensure that the ERMF is well understood by all business teams (the 1st line of defence) and they take ownership of risks pertinent to their division. The Enterprise Risk team recognises the importance of embedding a risk and control mindset within the business, which in turn will enhance and drive the adoption of a strong risk awareness culture.
• Thematic and deep-dive reviews. Conducting focused, detailed reviews of specific team processes/products to ensure all risks are appropriately identified and rationalised, whilst ensuring control environments are suitably robust. These can be triggered by a risk event crystallising or via the annual RSCA review or as part of a significant project being implemented.
• Regulatory capital. The Enterprise Risk team has significant involvement in ensuring that CCLA remains appropriately capitalised, working closely with the Finance team to produce its internal capital adequacy risk assessment (ICARA). Enterprise Risk is responsible for the development of severe but plausible risk scenarios that are used to ensure the firm holds adequate own funds and that CCLA remains financially viable throughout its economic cycle.
Supplier management policy and procedures
• Maintaining and developing the supplier management framework. This includes giving guidance on the supplier management framework to the wider business, providing independent review and challenge of supplier risk assessments/due diligence activities and assisting with pre-screening checks and site visits.
• Supplier Management reporting. Enterprise risk incorporates data produced from the supplier management framework into the quarterly risk profile review and risk reports provided to the Risk Committee, Executive Committee, Audit Committee and fund boards.
Business continuity planning
• The Enterprise Risk function actively supports CCLA's Deputy Chief Operating Officer in delivering the business continuity plan, contributing to its maintenance and the testing of business continuity scenarios. Additional responsibilities include ensuring that operational resilience considerations such as, the safeguarding and monitoring of CCLA's Important Business Services is maintained at all times. The senior risk manager attends the quarterly Business Continuity Forum and is a member of CCLA's Incident Management team.
Investment risk
The Investment Risk team is responsible for ensuring funds and mandates are taking acceptable levels of risk and to ensure that any exposure from investment activities complies with the requirements set out in the relevant FCA Sourcebooks (e.g. “FUND” and “COLL”, as applicable), the respective fund literature and/or investment management agreements, as well as internal guidelines set by CCLA.
The Investment Risk team looks after the following:
• The Investment Risk Management Policy: regular review and update of the documentation that sets out the risks that may impact a fund or mandate, and to describe the processes to manage, monitor, and mitigate those risks.
• The investment risk control framework: reviewing, monitoring, and reporting on the state of the control environment, its adequacy and effectiveness.
• Ongoing monitoring and escalation: ongoing monitoring of investment risk metrics and compliance against set limits, as well as assessing the quality and effectiveness of the monitoring process. This includes escalation to the appropriate channels if any issue or concern is identified.
• Investment risk profile and mandate consistency: review and assessment of the consistency between the current risk profiles of the funds and mandates against the investment mandate expected by investors, including any limits which may apply.
• Internal risk limits and guidelines: reviewing and assessing the adequacy and effectiveness of internal investment risk limits and guidelines, as well as providing indication and the technical basis to support any change to internal limits that may be deemed necessary.
• Data quality, model validation and output validation: ensuring that the data used by the Investment Risk management function is fit for purpose in terms of quality, quantity, and breadth. Providing oversight and validation on external sources of data and on any output from external investment risk models employed. Providing when required, validation on Investment Risk information outputs destined for external consumption.
• Investment risk reporting: providing the Investment Risk Committee and other governance committees with appropriate and sufficiently comprehensive information and analysis on key risks as well as reporting on compliance of the funds and mandates’ limits (including regulatory, fund literature or mandate limits, internal limits and guidelines) (i.e. not limited to exceptions) to allow for decision-making bodies to attain to reliable information to appropriately challenge and call for action as deemed necessary.
• Regulatory reporting: providing the necessary data in relation to investment risk to the relevant departments within CCLA to enable the submission of regulatory reporting such as AIFMD Annex IV and Money Market Fund Regulation reporting to the FCA.