American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) ISSN (Print) 2313-4410, ISSN (Online) 2313-4402 © Global Society of Scientific Research and Researchers http://asrjetsjournal.org/ Automation of Risk Management in the Social Security Sector in Tanzania Job Asheri Chaula* Job Asheri Chaula, P.o.Box 35176, Dar es Salaam, Tanzania Email: jobchaula@gmail.com Abstract The paper proposes an automated model of the Risk-based Supervision (RBS) framework for social security sector in Tanzania. The regulator of the Social security sector strives to ensure that social security schemes are sustainable and will not collapse because inherent and residual risks in the sector. The biggest risk in the risk that the social security scheme will become insolvent. The paper opens with a discussion on the wider concept of RBS with particular reference to more traditional supervisory approaches. Based on this understanding of RBS, a case is then made for the use of automatic alerts and risk indicators to facilitate early intervention by supervisors. It is anticipated that with automated RBS risk management becomes more proactive and futuristic. Within the proposed model, a descriptive rule table is used which is easily extensible to cover both risks already identified and those that will be identified in future. The rule table includes the risk description, risk parameters, baseline and thresholds. The model is a neutral one with regards to the regulated entity and is therefore applicable to schemes, fund managers, custodians or administrators. The model further proposes a series of alerts that are derived from electronic offsite monitoring. To drive the model, the necessary data for the regulator and for the regulated entities is proposed together with a modality for collection of such data. The entire model design is also presented both as a graphical depiction and as pseudo code and matched to the current regulators’s infrastructure. The paper concludes with an additional set of recommendations to facilitate the journey to implementing RBS and adopting a forward-looking approach to regulation of social security sector. Keywords: Risk; Automation; Social Security; Indicator; Data Model; Impact; Probability; Supervision. ------------------------------------------------------------------------ * Corresponding author. 287 http://asrjetsjournal.org/ American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 287-306 1. Introduction Regulators across the globe are constantly faced with the challenge of spotting problems before they occur. It is widely recognized by financial services practitioners worldwide that regulatory failure was responsible for the 2007 – 2008 global financial crisis to some extent [10]. In a post-crisis world, some have argued that more heavy-handed regulation is required to prevent similar problems in the future. The unintended consequence of this approach however, is that regulation that is too tough may stifle innovation and financial growth. An alternative view is that there is a need for ‘smarter’ supervision of regulated entities. One approach that adopts this view is referred to as Risk-based supervision (RBS), a forward looking methodology that identifies the most critical risks. This increasingly popular approach in the regulatory realm is a significant departure from earlier ‘point in time’, transaction based assessments such as CAMELS (Capital adequacy, Asset quality, Management, Earnings, Liquidity and System & Control) [9]. Figure 1 below compares and contrasts these differing approaches to supervision. Figure 1: Comparison of RBS versus traditional supervisory approaches Figure 1 above validates the proposed approach to RBS, given the strong case made for the latter. In the case of the social security regulators, the regulatory universe in Tanzania includes the following regulated entities: • Mandatory defined benefit schemes • Supplementary defined contribution schemes • Mandatory health insurance scheme RBS - Forward looking: Continous collection of financial and non-financial data to allow offsite analysis to identify high-risk areas - Recources effectively utilised through the allocation of resources to high prority areas depending on risk rating - Targeted supervision enables the definition of key risk parameters such as minimum solvency requirements Point in Time Assessments e.g CAMELS - Backward looking: Based predominantly on the previous year's financial performance. Therefore, does not allow for early corrective action - Lack of risk priority areas increases the likelihood of the wastage of resources on low risk entities - Vaguely defined paramaters such as Management or System & Controls may not capture high risk indicators specific to the regulatory environment 288 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 • Fund managers • Custodians • Administrators In addition to the regulated entities, the Bank of Tanzania is a co-regulator of the social security regulator with regards to financial matters of the schemes. The Capital Markets and Securities Authority, is also considered as a key player, although not mentioned in the Tanzania Social Security Regulation Act, with respect to fund managers. However, for purposes of automation – the model proposed is neutral in the sense that it is applicable to any of the regulated entities and additionally recognizes possible data input from other regulators. In the next section the discussion on automated RBS models, and how this concept feeds into the wider RBS framework. 1.1. Description of the automated Risk Based Supervision model Risk is the exposure to loss or damage [10]. There is a degree of risk attached to every activity organizations carry out. The RBS approach involves identifying high risk areas and hence enabling supervisors to intervene early as and when required. Risk based supervision (RBS) requires supervisors to review the manner in which insurers are identifying and controlling risks. It requires supervisors to assess system and individual firm risk and to respond with the supervisor’s own processes and interventions in line with the assessment [6]. The main characteristics of an RBS approach is that emphasis is more on understanding and anticipating the possible risks the supervised entity will be facing when executing its business plan thus going beyond its current financial situation [6]. To achieve this, the social security sector needs to clearly define the risk parameters and model. This will subsequently enable the regulator to allocate supervisory resources to high risk areas. Of particular relevance to regulator’s ambition to become a forward-looking regulator, is the need to be able to automatically generate alerts and risk indicators when there is a breach, or potential breach based on the pre-defined parameters. However the Risk Based approach is particularly sensitive with regards to required data inputs to drive the model. In order to generate alerts, there has to be collection of data on an ongoing basis. Thus electronic offsite surveillance is essential. Next, we take a closer look at some of the benefits of having an automated alerts and risk indicators system in place. 1.2. The benefits of an automated system As discussed in the introduction, the RBS approach provides clear benefits from a regulators perspective. However, in tandem with the RBS framework, the regulator needs to develop an integrated data store that is 289 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 leveraged to generate risk alerts and early warning indicators. We discuss the proposed design of this system in more detail later in this paper. The wider benefits of implementing such a system are illustrated below: Figure 2: An Illustration of the benefits of automated alerts and risk indicators As illustrated above, the automated system provides a robust, flexible framework that can be tailored to the particular needs of the social security sector. The proposed system also allows the tracking of supervisory action and provides Management Intelligence (MI) based on trends analysis. The use of information technology to automate risk management disrupts the traditional way risk management is done in all sectors [3]. 1.3. Defining risks and alerts The main area of concern for the Authority with regards to the schemes is the solvency of pension funds is of particular interest to members and a risk based solvency rule needs to be set up. To effectively achieve this, we propose a system that generates both alerts and risk indicators that would lead to a risk based solvency rule. For the purpose of this document an Alert is an indication of unacceptable risk for which an immediate and urgent intervention is required. The concept of an alert will be explored further in section 3.0 that proposes regulatory responses. 290 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 The Risk Indicators indicated in this document are predictive measures designed at focusing the Authority’s attention to certain areas of operation of the regulated entity and guiding Authority towards an appropriate regulatory response. 1.4. Alerts An alert, based on this proposal, is generated when an entity has breached any aspect of the Solvency requirements. For example, if a fund goes below the minimum solvency requirements specified by the regulator, then a breach will have occurred and an alert will be generated. The proposed process once an alert has been generated is for the system to trigger a notification process via E-mail or SMS, depending on the regulator requirement. This notification is sent to the specific supervisor or group of supervisors responsible for fund that has breached. As a result, the responsible supervision team can then respond through a series of interventions as defined by regulatory response and any other relevant internal documents within the Authority. 1.5. Risk Indicators To further the forward-looking agenda, it is imperative that the regulator implements a system that generates risk indicators if a firm is likely to breach the guidelines in the future. It is proposed that the risk indicators are modeled against the current and future focus areas that guide the supervisory regime at the social security regulator. For example, a Scheme may have had adequate funding in 2012 and is viewed as compliant from regulatory perspective. However, the Scheme records a significant drop in the funding held for the following year 2013. In this hypothetical scenario, the proposed social security regulator system would generate a risk indicator highlighting the increased chance of risk presented by the fund in question. As a result, the Authority would be able to intervene early and therefore prevent an issue before it occurs. It is reasonable to suggest that risk indicators are more suited to higher risk regulated entities whereby a breach could potentially have serious consequences for the industry. The concept of alerts and risk indicators is further illustrated in chapter 3 with respect to the risk parameters defined in the proposed RBS framework. 1.6. Risk Based Supervision in the Social Security Sector This chapter provides an assessment of the design and experience of risk-based supervision in several countries that have been involved in these methods. The countries observed provide a range of experience that shows the diversity of systems and approaches to RBS, as well as the common goal of sound risk management and effective supervisory outcomes. 291 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 In Tanzania, the RBS framework has been adopted by the Bank of Tanzania for supervision of banks and financial institutions. The main objective is to provide an effective and efficient process to assess the safety and soundness of institutions which is achieved through: i. Evaluating institutions’ risk levels and trends associated with current and planned activities; ii. Assessing the management processes to identify, measure, monitor and control risks; iii. Assessing the institutions’ financial conditions; iv. Assessing compliance with applicable laws and regulations; v. Communicating findings, directives, and recommendations in a clear and timely manner, and obtain commitments by board of directors and management to correct significant deficiencies; and vi. Making follow up on implementation of corrective actions to ensure that all the deficiencies are rectified at appropriate time and in the right manner. Under the RBS approach, focus is on areas of greatest risks and concerns in individual institutions to ensure effective and efficient supervision. This approach enables the Bank of Tanzania (BOT) to prioritize the use of its resources by allocating them according to risk profiles of institutions [11]. In South Africa, The pension industry is supervised by the Financial Services Board (FSB), a partially integrated supervisor with oversight responsibilities for all financial services outside banking. The FSB uses the same model for all financial institutions, assigning a risk score to each pension fund which then determines the supervisory approach [7]. The process in can be summarized as follows: i. Identify and classify the internal and external risks to institutions together with the development of the trends and key drivers of those industries; ii. Assess the important risks to each institution or category of institutions collating both qualitative and quantitative information into an overall assessment of the risk; iii. Determine the probability and weighting of the important risks, combining this with the impact to derive an overall risk rating for each institution; iv. Prioritize the institutions; v. Determine a supervisory response for each selected institution; vi. Confirm the appropriateness of the supervisory response by doing an internal review of the assessment before the response is communicated to the institution; vii. Communicate the assessment and supervisory response to the institution on a confidential basis. viii. Carry out additional assessments, assess any escalation in the risks, and monitor the outcomes of the risk mitigation undertaken by the institution. In Kenya, a specialized agency, the Retirement Benefits Authority (RBA) is responsible for the supervision of funds. The goal is to measure the solvency of DB schemes and the investment risk of DC schemes, applying a risk score to each scheme which then determines the supervisory response [7]. 292 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 According to [6] and [7], The RBA has defined a number of risks as the main areas of considerations to include; i. Balance Sheet and Market Risk: Risk of losses due to movements in interest rates and other market prices ii. Operational Risk: The risk of losses resulting from inadequate internal processes, people and systems – whether these are internal to the regulated entity or in a service provider iii. Legal and Regulatory Risk: The likelihood of adverse consequences arising from the failure to comply with all relevant laws and regulations iv. Strategic Risk: Risks to the continued viability of an entity as a result of change in the operating environment, including internally driven change such as merger or introduction of new product line. 1.7. Limitations of this study This study is limited to the risks which are inherent in the social security sector. This automation model cannot be directly applied in the aviation sector or educational sector because the inherent risks in those sectors vary for the social security sector. However, this automation model can be applied directly is sectors such as banking because of similarities of inherent risks in the banking and social security sector. The model will need minimal modification for application in the banking sector but will need major modification to work in automating other sectors. Initially, in the implementation stage, the model will automate 14 risks but additional risks can be added as needed by the authority or scheme. 2. Methodology 2.1. Describing the coverage of the study The automation model is customized for the social security sector. This implies the model will enable the regulator to collect and analyze data from the funds and other schemes under its jurisdiction. The collected data will be used to determine risks and its magnitude. 2.2. Materials • The risk based supervisory framework • Funds and schemes risk registers 2.3. Methods 2.3.1. Identification of the highest risks For all regulated entities, the biggest risk in the risk that the social security scheme will become insolvent. This is a composite risk that is illustrated in a Risk Based Solvency Rule. To adhere with international standards, an adaption of the Solvency II directive [12] may be adopted. The Risk Based Solvency Rule will be defined for each category of regulated entities which are DB, DC, Health Insurance, Custodians, Administrators and Fund- managers, based on one or more of the risk indicators outlined in section 2.2. For purposes of the automated model, the risk indicators will be captured as parameters for the solvency rule which when assessed on the 293 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 model will generate an alert if necessary. This automation model design is focusing on fourteen risks namely longevity, funding, liquidity, strategic, legal and regulatory, operational, actuarial, market , Governance, reputation, credit, IT, outsourcing and people risks. The definitions for each risks are provided in each table 2.4. Risk Alerts and Indicators The risk indicators that are shown in the table below are proposed for monitoring by the Authority. The risk indicators show a description, parameters, baseline and threshold. In addition the description is expanded to indicate the applicability in terms of the type of regulated entity A maximum of 3 indicators per risk is used so as to avoid unnecessary complexity in coding. Furthermore the RI are described using pseudo code. Where guidelines or other documents issued by the Authority already exist – the reference document is indicated. The list of risk indicators is not meant to be exhaustive; it is presented in such a manner as to be extensible to incorporate any risks identified in the future by the Authority – and to be able for them to be incorporated seamlessly into the automated model. The data sources indicated in the last column will have to be structured to enable feeding into the automated model. The rules are represented by a unique numbers which will be used by the system to uniquely identify a risk. Other parameters presented in Tables 1 to Table 14 are the baseline and threshold values as set by the regulator for regulated entries to comply. The output of the automated system will either be an indicator of a risk or an alert. The risk score as calculated by the system will either be 1, 2, 3 or 4. These number represent the quadrants as shown in Figure 3. 3. Results Results are presented in Table 1 to Table 14. The automated model of the RBS for various risks will be codified basing on rules defined by the regulator. Alerts and risk indicators shall be generated by the system after given calculations result into true result. The formulas are developed using rules and the threshold and baseline values. In Tables 1 to Table 14 some acronym are used to simply the presentation. Acronym DB means Defined Benefit (retirement scheme), DC means Defined contribution (retirement scheme), CMSA means Capital Market and Security Authority, PPRA means Public Procurement Authority and BoT means Bank of Tanzania and CAG means the Auditor General. 4. Discussion, Conclusion and Recommendation 4.1 Discussion 294 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 Table 1: Longevity Risk Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulated Entity Reference Data Source 1A The risk that beneficiaries will live longer than anticipated and that contributing members cannot support them [5] 12.5 years after retirement N/A Risk Indicators IF Average Age in the scheme increases by 20 % or more from previous year THEN generate RI1 IF (number of contributing members in current financial year) / (number of pensioners)<14 THEN generate RI2 If Average lifespan of beneficiaries entitled to a lifetime benefit >=72.5 years THEN generate RI3 2 Amber DB Statistical Bulletin Quarterly returns through ESP Table 2: Funding Risk Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulated Entity Reference Data Source 2A The risk that regulated entity does not have sufficient funds to honour its obligations[4] 40% 80% Risk Indicators or Alert IF % Fund Assets at minimum portfolio value /Total schemes Liabilities <=Threshold THEN generate RI IF % Fund Assets at minimum portfolio value /Total schemes Liabilities <=Baseline THEN generate Alert 3 Red DB - Quarterly returns through ESP 2B 2009) 100% 100% Alert IF Total schemes Liabilities ≠ 3 Red DC - 295 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulated Entity Reference Data Source 100 % Fund Assets at minimum portfolio value THEN generate Alert 2C 100% N/A Alert IF Total schemes Liabilities >= 100 % Fund Assets at minimum portfolio value THEN generate Alert 3 Red Health Insurance 2D BoT Requirements N/A Alert IF BoT takes over administration of the entity THEN generate Alert 3 Red Custodians BoT 2E CMSA Requirements N/A Alert IF CMSA issues a public warning with regards to the entity THEN generate Alert 3 Red Fund Managers CMSA 296 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 Table 3: Liquidity Risk Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulate d Entity Reference Data Source 3A The risk that a regulated entity will not be able to meet its payment obligations as they fall due without excessive costs or total inability to recover funds or only with significant delay [1] N/A N/A Risk Indicators IF a Court case initiated by creditors against the regulated entity THEN generate RI1 IF the regulated entity obtains an adverse judgement with legal liability >= 10% of its assets THEN generate Alert IF a stress test predicts liquidity issues THEN generate RI3 2 Amber DB , DC, Health Insurance, Custodian s, Fund Managers - Records of court cases;Market performance reports from Fund Managers Stress Testing reports from Directorate of Risk Management Table 4: Strategic Risk Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulated Entity Reference Data Source 4A The risk that a regulated entity will be unable to realise its documented strategic intent N/A N/A Risk Indicators IF % of unrealised strategic objectives in one year <5% THEN generate RI1 IF trend of unrealised objectives over the corporate strategic plan period increases by 5% every year THEN generate RI2 IF number of strategic rescinded decisions > 3 annually THEN generate RI3 2 Amber DB , DC, Health Insurance - Onsite inspection report 297 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 Table 5: Legal and Regulatory Risk Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulated Entity Reference Data Source 5A The risk of failure to comply with relevant laws, regulations , rules and guidelines N/A N/A Risk Indicators IF a Court case is initiated against regulated entity because of defaults THEN generate RI1 IF the entity attracts a Penalties imposed by regulators THEN generate RI2 IF there are legal requirements not fully complied with over a period of six months THEN generate RI3 2 Amber DB , DC, Health Insurance, Custodians, Fund Managers - Records of court cases ; Onsite inspection reports; Complaints received; Reports of the CAG, and PPRA Table 6: Operational Risk Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulated Entity Reference Data Source 6A The risks of losses resulting from inadequate internal processes, systems or people N/A N/A Risk Indicators IF a case of fraud is detected in the entity THEN generate RI1 IF the Number of complaints received by the Regulator increases by 5% in a 3 month period THEN generate RI2 IF compliance to the customer care charter and policy of the entity<100% THEN generate RI3 2 Amber DB , DC, Health Insurance, Custodians, Fund Managers - On site inspection reports; 298 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 Table 7: Actuarial Risk Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulated Entity Reference Data Source 7A The risk of utilisation of improper actuarial methods or misleading data in actuarial valuations (Brunner G. 2008) Actuarial Valuation conducted in 2010 N/A Risk Indicators IF Completeness of Data used for actuarial valuation<=90% THEN generate RI1 IF compliance to the conduct of actuarial services guidelines <= 100% THEN generate RI2 IF Integrity of Data used for actuarial valuation <=50% THEN Alert 2 Amber DB , DC, Health Insurance, Custodians, Fund Managers Conduct of Actuarial Services Guidelines; Data management guidelines Review of actuarial reports Table 8: Market Risk Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulated Entity Reference Data Source 8A The risk of losses due to adverse movements in interest rates and other market conditions [9] Average Interest rates reported by BoT for 2014 N/A Risk Indicators IF Interest rates increase by more than 5% for one year to the next THEN generate RI1 IF market prices of assets increases or decreases by more than 100% in a one year period THEN generate RI2 IF asset value deceases or increases by more than 15% due to Foreign exchange fluctuation THEN generate RI3 2 Amber DB , DC, Health Insurance - BoT, Offsite monitoring 299 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 Table 9: Governance Risk Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulated Entity Reference Data Source 3A The risk that Trustees and management don’t discharge their responsibility N/A N/A Risk Indicators If compliance to the guideline<100% then generate RI1 - - 2 Amber DB , DC, Health Insurance Conduct of affairs of Board of Trustees Guidelines Onsite inspections Table 10: Reputational Risk Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulated Entity Reference Data Source 3A The risk that a regulated entity that is operating a competitive setting acquires a negative perception from stakeholders N/A N/A Risk Indicators IF No of complaints in a specific category > 10 in a one month period then generate RI1 IF Court cases brought against the entity in a one year period >5 then generate RI2 IF No of adverse media reports about an entity > 10 in a three month period then generate RI1 2 Amber DB , DC, Health Insurance, Custodians, Fund Managers - Records of court cases , Media monitoring, complaints received 300 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 Table 11: Credit Risk Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulated Entity Reference Data Source 11A The risk that a regulated entity will suffer financial losses should any counterpart fail to fulfil their contractual obligations [2] N/A N/A Risk Indicators IF the ratio of non performing assets > 4% of the portfolio THEN generate RI1 IF the credit concentration ratio of a single debtor >= 15% THEN generate RI2 IF percentage of delayed contributions is >10% over a 3 month period THEN generate RI3 2 Amber DB , DC, Health Insurance, - Annual reports and financial statements Table 12: IT Risk Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulated Entity Reference Data Source 12A The risk arising from inadequate IT in terms of integrity, continuity, processing and interoperability [8] N/A N/A Risk Indicators IF Compliance to Data management guidelines <100% THEN generate RI1 IF Compliance to interoperability guidelines <100% THEN generate RI1 - 2 Amber DB , DC, Health Insurance, Custodians, Fund Managers Data management guidelines; interoperability guidelines On site inspections; Database Analysis. Electronic offsite monitoring 301 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 Table 13: Outsourcing Risk Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulated Entity Reference Data Source 13A The risk that arises from outsourcing of core functions N/A N/A Risk Indicators IF Service Level agreements in place for outsourced services is < 100% THEN generate RI1 IF statutory obligations have been outsourced THEN generate RI2 -IF service provider for outsourced services is deemed unqualified by a regulator such as PPRA THEN generate RI3 2 Amber DB , DC, Health Insurance, - On site inspections, Offsite monitoring Table 14: People Risk Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulated Entity Reference Data Source 14A The risk that a regulated entity will be unable to recruit and or retain appropriate people to current out its operations N/A N/A Risk Indicators IF there are no staff with rare skills e.g. actuaries, investment analysts , risk THEN generate RI1 IF Number of on going training programmes to update staff of core activities and regulatory requirements <1 THEN generate RI2 IF annual staff turnover > 5% THEN generate RI3 2 Amber DB , DC, Health Insurance, Custodians, Fund Managers - On site inspections; offsite monitoring 302 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 Table 15: Systemic Risk Rule Description Baseline Threshold Output RI1 RI2 RI3 Risk Score Status Regulated Entity Reference Data Source 14A The risk the entire social security sector shall be affected by an adverse event N/A N/A Risk Indicators IF There are Changes in legislation that impact the sector adversely –THEN Alert IF Inflation rate increases by more than anticipated by Government +2 % THEN generate alert IF the equities traded by the Dar es Salaam Stock Exchange experiences a severe dip THEN generate Alert 3 Red DB , DC, Health Insurance - BoT, Media Monitoring 303 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 This chapter focuses monitoring and proposed regulatory response to the identified risks with regard to the impact and probability or frequency of occurrence of the risk. The diagram below depicts the probability and impact of a risk and possible regulatory response. The automated RBF system will map results of risk analysis in four quadrants as shown in the Figure 3. Risk managers will visualize the output presented in the quadrants and come out with strategies for educating, monitoring, proactive supervision and intervention. The quadrant number four has high impact and high probability of risk. The potential regulatory responses for high risk events/transactions shall include interaction and/or meetings with fund administrators to discuss how to mitigate the risk. For risks in the category of the 3rd quadrant, that is high impact and low probability the potential regulatory response will be proactive supervision. In proactive supervision activities will include ongoing monitoring, included in periodic management reporting, particularly if impact can be very large ongoing media monitoring of plan and sponsor, possible interactions with plan and considerations for site examinations. Treatment of risks in quadrant 2 which represents low impact and high probability is that the regulator responses will entails monitoring. Monitoring activities will include flagging and enhancing reviews. Monitor and flagging will be implemented if identified risks persist or additional risk indicators are present. Also enhanced review may be appropriate communication with plan administrator may be warranted, e.g. to bring awareness of the issue and request explanation. Quadrant 1 is characterized of low impact and low probability. The regulatory response for such risks will be to educate the social security services provider. Educating social security services provider entails no specific communications to individual plans is required and providing general education/communications to plan administrators and advisors, with a view to enhancing understanding of pension administration. 4.2 Conclusion The proposed automation model for the RBS is developed using the social security sector as a case study. However, similar automation can be used to model RBS for other financial sector such as banking sector. This model fits for the banking sector because the type of risks facing the banking sector are similar to those in the social security sector. With the exception of longevity risks, all other risks analyzed in section 3 apply in the banking sector. This automation model is not 100% exhaustive of the risks in the social security sector or the banking sector but provides a concise framework oh how to develop an automation model. Users of the model wishing to include additional types of risks may do so following similar structure as the one presented in section 3. To minimise complications in the actual implementation of the model, only 3 Risk Indicators are used in this framework (RI1, RI2 and RI3). This will enable the programmer to code the Indicators without having to develop complex algorithms which may became prone to errors. 304 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 4.3 Recommendations It is reasonable to suggest that an automated alerts and risk indicators system is integral to the successful implementation of risk-based supervision model at the social security regulator. To conclude this discussion, this paper provides a set of recommendations that will facilitate the regulators’s journey to RBS. To note is that these may not be the within scope for this paper but are important components of the journey to meeting the regulators' objective. Acknowledgements I wish to acknowledge the Social Security Regulatory Authority (SSRA) for the providing useful information on the RBS and the baseline and threshold values which are fundamental in developing responsive automated model. Besides, I wish to express my heartfelt gratitude to Ardhi University particularly to the members of School of Geospatial Science and Technology for their support during the study. Also I wish to acknowledge the contribution from Domina Kiunsi for assisting in reviewing the paper. Figure 3: Risk impact and probability Visualisation References [1]. Clemens Bonner, Iman Iman van Lelyveld and Paul Hilbers. Liquidity Risk Management and Supervision: A Guide to Better Practice, Risk Books, 2015, pp. 210-233 [2]. Raymond Anderson. The Credit Scoring Toolkit: Theory and Practice for Retail Credit Risk Management and Decision Automation, Risk Books, 2015, pp. 30-45 [3]. R "Ray" Wang. Disrupting Digital Business: Create an Authentic Experience in the Peer-to-Peer Economy. Harvard Business Review Press, 2015, pp. 111-130 [4]. Surendra Sundararajan. Book of Financial Terms. Kindle Edition, Tata McGraw-Hill, 2009, pp. 155- 170 305 American Scientific Research Journal for Engineering, Technology, and Sciences (ASRJETS) (2016) Volume 17, No 1, pp 291-306 [5]. Brunner, G., Hinz, R., & Rocha , R. Risk-based supervision of pensions: emerging practices and challenges. Washington DC: The World Bank, 2008, pp. 130-144 [6]. Randle, T. Risk Based Supervision. Washington, DC: McGraw-Hill, 2009, pp. 68-99 [7]. Stewart, F. Experiences and Challenges with the Introduction of Risk-Based Supervision for Pensions Funds. International Organisation of Pension Supervisors, 2007, pp. 111-125 [8]. Job Asheri Chaula Louise Yngstrom and Stewart Kowalski. "Article: Security Metrics and Evaluation of Information Systems Security," ISSA2004, South Africa, 2004. [9]. Greg Brunner and Roberto Rocha. Risk-Based Supervision of Pension Funds: Emerging Practices and Challenges (Directions in Development). World Bank Publications, 2008, pp. 44-55 [10].Michael Crouhy, Dan Galai, Robert Mark. The Essentials of Risk Management. McGraw-Hill Education 2 edition, 2014, pp. 23-33 [11]. BOT. "Risk Based Supervision Framework". Internet: https://www.bot- tz.org/adverts/PressRelease/RBS_%20Revised_Framework_2010_final.pdf, August 2010 [Jan 4, 2016] [12]. EU. "Directive 2009/138/EC of the European Parliament and of the Council of 25 November 2009 on the taking-up and pursuit of the business of Insurance and Reinsurance (Solvency II)". Internet: http://eur-lex.europa.eu/legal- content/EN/TXT/?uri=CELEX:32009L0138, 25 November 2009 [Jan. 4, 2016]. 306 http://eur-lex.europa.eu/legal- 4.1 Discussion 4.2 Conclusion 4.3 Recommendations