Risk management, governance and regulation of pension schemes
Governance and regulation determine how schemes are run and how risks are controlled. The exam tests trustee duties, TPR's powers and codes, integrated risk management, covenant assessment, notifiable events and breach reporting.
Core rules
- Trustees must act in members' interests, with knowledge and understanding, and take advice.
- Integrated risk management links covenant, funding and investment; a risk register records impact and likelihood.
- TPR can issue improvement notices, third-party notices, Contribution Notices and Financial Support Directions; the Pensions Act 2021 added criminal offences for wilful avoidance of employer debt and false statements.
- Material breaches must be reported to TPR; actuaries and auditors have a statutory duty to report certain matters under s70 Pensions Act 2004.
- Notifiable events (e.g. sale of the sponsoring employer, insolvency) must be reported.
Worked example
A risk register scores a cyber-attack as impact 5, likelihood 3, giving 15 against a tolerance of 8. The trustees assess that member data could be lost and payments disrupted. Controls: penetration testing, dual authorisation for bank changes, an incident response plan and cyber insurance. Residual score falls to impact 4 × likelihood 2 = 8, which is within tolerance. The register records the owner, review date and evidence.
Traps
Assuming TPR guarantees benefits (the PPF does that, subject to limits); reporting only "certain" breaches; confusing a Contribution Notice with a s75 debt; ignoring the employer covenant when assessing funding risk; treating governance as paperwork rather than a control system.