Pension scheme risk function that reports to the CFO
Harbour Pension Trust is a £3.2bn defined-benefit scheme with 45,000 members. Risk management is performed by a team of three within the finance directorate; the head of risk reports to the CFO. The trustee board has no risk appetite statement and reviews the risk register once a year. The audit committee, composed mainly of trustees with finance backgrounds, meets twice a year and receives internal audit reports. Internal audit is outsourced and its engagement partner reports functionally to the CFO. Last quarter a data breach affecting 1,200 member records was not escalated to the trustees for three weeks; management treated it as an IT incident. The Pensions Regulator has written to the trustees asking for evidence that risk is managed effectively. The chair asks for a review of governance and assurance.
1. Evaluate Harbour's risk governance and assurance arrangements against the three lines model.
Read the worked answer
Against the three lines model:
- First line: management owns risk. Here IT treated a breach as an IT incident, indicating weak first-line ownership and unclear escalation.
- Second line: risk and compliance should be independent of management. The head of risk reports to the CFO, who also owns finance operations and budget, creating a conflict. Three staff for a £3.2bn scheme and an annual register review are not proportionate.
- Third line: internal audit should report to the audit committee and be independent. The outsourced engagement partner reports functionally to the CFO, compromising independence and limiting the committee's ability to challenge.
- The audit committee meets twice a year and is composed mainly of finance trustees; it may lack cyber and pensions-specific expertise.
- No board risk appetite statement means the trustees have no benchmark for tolerance or escalation.
The three-week delay in escalating a breach affecting 1,200 members is a symptom of unclear roles, not just an IT failure.
2. Recommend changes to strengthen independence, escalation and board oversight.
Read the worked answer
Recommend:
- Establish a board risk committee, or formally extend the audit committee's remit, with a majority of independent trustees and at least one member with risk or cyber expertise.
- Appoint a head of risk with a reporting line to the board risk committee and an administrative line to the CEO, not the CFO; segregate risk from finance.
- Change internal audit's functional reporting to the audit committee chair; approve the audit plan and fees at committee level.
- Adopt a risk appetite statement with tolerances for member data, funding, investment, operational resilience and regulatory compliance; review annually.
- Define a risk escalation protocol with mandatory timescales (e.g., material data breach to trustees within 24-48 hours), thresholds and named owners.
- Require quarterly risk reporting with KRIs, incidents, control effectiveness and an assurance map.
- Commission an independent review of cyber controls and a lessons-learned exercise on the breach.
- Document the three lines and assurance mapping so trustees can see coverage and gaps.
3. Explain how a risk appetite statement would improve trustee decision-making at Harbour.
Read the worked answer
A risk appetite statement would give trustees pre-agreed boundaries for decisions: for example, tolerance for funding deficit volatility, maximum unhedged inflation exposure, data protection tolerance (zero tolerance for reportable breaches) and investment liquidity. It would allow management to escalate by exception rather than trustees debating every incident. It would make trade-offs explicit, such as the cost of controls versus risk reduction. It would provide evidence to the regulator that risk is governed and that the board sets direction. It also supports challenge: if a breach is outside tolerance, the board can require a remediation plan and hold executives accountable. Without it, decisions are ad hoc and escalation is discretionary.