Scholarly article on topic 'Should the insurance industry be banking on risk escalation for solvency II?'

Should the insurance industry be banking on risk escalation for solvency II? Academic research paper on "Economics and business"

CC BY
0
0
Share paper
OECD Field of science
Keywords
{"Operational risk" / "Risk escalation" / "Risk regulation" / "Basel II" / "Solvency II"}

Abstract of research paper on Economics and business, author of scientific article — Cormac Bryce, Rob Webb, Carly Cheevers, P. Ring, G. Clark

Abstract Basel II introduced a three pillar approach which concentrated upon new capital ratios (Pillar I), new supervisory procedures (Pillar II) and demanded better overall disclosure to ensure effective market discipline and transparency. Importantly, it introduced operational risk as a standalone area of the bank which for the first time was required to be measured, managed and capital allocated to calculated operational risks. Concurrently, Solvency II regulation in the insurance industry was also re-imagining regulations within the insurance industry and also developing operational risk measures. Given that Basel II was first published in 2004 and Solvency II was set to go live in January 2014. This paper analyses the strategic challenges of Basel II in the UK banking sector and then uses the results to inform a survey of a major UK insurance provider. We report that the effectiveness of Basel II was based around: the reliance upon people for effective decision making; the importance of good training for empowerment of staff; the importance of Board level engagement; and an individual's own world view and perceptions influenced the adoption of an organizational risk culture. We then take the findings to inform a survey utilizing structural equation modelling to analyze risk reporting and escalation in a large UK insurance company. The results indicate that attitude and uncertainty significantly affect individual's intention to escalate operational risk and that if not recognized by insurance companies and regulators will hinder the effectiveness of Solvency II implementation.

Academic research paper on topic "Should the insurance industry be banking on risk escalation for solvency II?"

PII: DOI:

Reference:

Accepted Manuscript

Cormac Bryce, Rob Webb, Carly Cheevers, P. Ring, G. Clark

Should the insurance industry be banking on risk escalation for solvency II?

S1057-5219(16)30075-8 doi: 10.1016/j.irfa.2016.04.014 FINANA 989

To appear in: International Review of Financial Analysis

Received date: 13 October 2015 Revised date: 11 April 2016

Accepted date: 28 April 2016

Please cite this article as: Bryce, C., Webb, R., Cheevers, C., Ring, P. & Clark, G., Should the insurance industry be banking on risk escalation for solvency II?, International Review of Financial Analysis (2016), doi: 10.1016/j.irfa.2016.04.014

This is a PDF file of an unedited manuscript that has been accepted for publication. As a service to our customers we are providing this early version of the manuscript. The manuscript will undergo copyediting, typesetting, and review of the resulting proof before it is published in its final form. Please note that during the production process errors may be discovered which could affect the content, and all legal disclaimers that apply to the journal pertain.

Should the Insurance Industry be Banking on Risk Escalation for Solvency

Cormac Bryce3*, Rob Webba, Carly CheeversD, and Ring, PD a n d CI a r k, G □,

Abstract

Basel II introduced a three pillar approach which concentrated upon new capital ratios (Pillar I), new supervisory procedures (Pillar II) and demanded better overall disclosure to ensure effective market discipline and transparency. Importantly, it introduced operational risk as a standalone area of the bank which for the first time was required to be measured, managed and capital allocated to calculated operational risks. Concurrently, Solvency II regulation in the insurance industry was also re-imagining regulations within the insurance industry and also developing operational risk measures. Given that Basel II was first published in 2004 and Solvency II was set to go live in January 2014. This paper analyses the strategic challenges of Basel II in the UK banking sector and then uses the results to inform a survey of a major UK insurance provider. We report that the effectiveness of Basel II was based around: the reliance upon people for effective decision making; the importance of good training for empowerment of staff; the importance of Board level engagement; and an individual's own world view and perceptions influenced the adoption of an organizational risk culture. We then take the findings to inform a survey utilizing structural equation modelling to analyze risk reporting and escalation in a large UK insurance company. The results indicate that attitude and uncertainty significantly affect individual's intention to escalate operational risk and that if not recognized by insurance companies and regulators will hinder the effectiveness of Solvency II implementation.

Keywords: Operational Risk, Risk Escalation, Risk Regulation, Basel II, Solvency II.

JEL: G2, L1, L2, L5, N2

Acknowledgements: The project received 'Seedcorn' funding from the Institute of Chartered Accountants Scotland (ICAS). The research team would also like to thank Mike Webb and Bradán Donnelly-Bryce for their timely and helpful interventions on earlier versions of this paper, albeit the latters introduction and formers exit undoubtedly led to delays in the final preparation of this paper. The final version of this paper also received comments and suggestions from delegates of the ESRC 'Lessons in the Management of People Risk' Seminar Series (ES/L000776/1), notable contributors include Tom Reader, Jane Lenehan, Meghan Leaver, Paul O'Connor, and Jamie Wardman.

a Economics and Finance Department, Centre for Risk and Insurance Studies, University of Nottingham, United Kingdom.

□ □ Department of Law, Economics, Accounting and Risk, Glasgow Caledonian University, United Kingdom.

□ School of Psychology, University College Dublin, Ireland.

□ Independent Risk Consultant, London, United Kingdom.

Correspondent Author. Tel: +44 115 846 6690

Email Addresses: cormac.bryce@nottingham.ac.uk (C. Bryce), robert.webb@nottingham.ac.uk (R. Webb), carly.cheevers@ucdconnect.ie (C. Cheevers) patrick.ring@.gcu.ac.uk (P.Ring).

Introduction

During the 1970s and 1980s the banking industry, in the UK and globally, experienced a sea change with regards to banking theory, practice and regulation. These changes can be traced back as far as the liberalization of the banking and financial markets throughout the 1970s and the encroachment on each other's traditional business lines during the early 1980s. In the context of these changes, governments and regulators were keen to ensure the 'prudent behaviour' of banks - as defined in regulation. Here, the importance of capital was the focus of one the first widely accepted international codes in banking - the Basel I Accord 1988 -recognizing the importance of levels of capital held by banking institutions in creating confidence in the sector and staving off bank collapses. Likewise, European regulators had also recognized the importance of capital in the insurance industry with some form of capital requirements being in place since the 1970s under Solvency 1 requirements.

Yet, from its implementation, Basel I was already considered inadequate to control for the changes occurring in bank operations in both its calculations of 'capital adequacy' and its ability overall to capture the right metrics to reduce risk within the industry. It was argued

that it focused too much upon credit risk, only acknowledging that "other risks.....need to be

taken into account" (BCBS 1998 p.1). In light of this, the Accord was amended to include market risk in 1996 and throughout the 1990s, the Basel Committee worked on introducing a replacement in the form of Basel II.

Basel II was a major gear change for the sector, focusing on key areas in bank operations and improving capital allocations for credit and market risk (for example see Jobst 2007 Rowe et al 2004 Santos 2002 Power 2005). Significantly, for the first time, it also introduced metrics that considered 'operational' risk as distinct from financial risk (usually encompassing liquidity, credit, interest rate and market risk) and required banks to provide capital for operational risk. Operational risk is defined as 'the risk of loss arising from inadequate or failed internal processes, or from personnel and systems, or from external events' (CEIOPS 2009 p5). The impact of the Basel II guidelines and the rush to be Basel II compliant cannot be overemphasized and has brought about the rise of operational risk management as a standalone risk within financial institutions. Importantly, banks had to consider how to efficiently implement operational risk management in order to comply with Basel II and signal to domestic and international markets and regulators that they were an effective, efficiently operated institution.

As a result, the banking industry undertook much soul searching during the 2000's in order to discover the most appropriate ways to implement and comply with the Basel II requirements. This forms the basis of the first stage of the paper which investigates and identifies the key challenges in the implementation of Basel II and how these were addressed. We then extend our analysis based on our findings from Basel II implementation in the banking industry to examine the implementation of Solvency II in the insurance industry, which is often referred to as the Basel II for insurance companies. Solvency II was to be introduced in January 2014 but has been delayed due to implementation issues, therefore the timing of such an cross-industry investigation could not be better.

The paper is structured as follows. In the next section the paper discusses the rise of operational risk as an important element of managing risk in the banking and insurance sectors, and draws attention to the management of that risk through the structure of the three lines of defence. This is followed by a description of the methodology employed in our primary research and a discussion of the results. The paper concludes with limitations and areas for future research.

Banking, Insurance and Regulatory Compliance

Banks and insurance companies dominate the UK financial services industry. At the beginning of this decade, the major British banking groups held £678bn of households assets in the form of personal deposits and savings and the UK insurance market was the largest in Europe, contributing £10.4bn in taxes, with 74% of all households in the UK using home contents insurance (BBA 2012 ABI 2011). Importantly, the two sectors are both dominated by the management of risk in their daily operations (Al-Darwish et al 2011 Geneva Association 2010). Insurance company risk is linked to their ability to assess the 'correct' premiums and manage the volatility of their investments on the financial markets. (Geneva Association 2010 Hoffman and Lehman 2009). In contrast, banks are more exposed, as deposit takers, to liquidity risks and as lenders to credit risk (loans can account for over 60% of a UK retail banks balance sheet, see individual UK Bank annual reports) as well as undertaking extensive asset transformation (Gatzert and Wesker 2012 Lehman and Hoffman 2010). Nevertheless, both sectors are involved in assuming risk, risk transfer and risk management. Clearly, both sectors will also encounter similar types of daily operations in their businesses, and will share similar problems. As a result, the experience of operational

risk management and compliance issues encountered in the banking sector can be extrapolated to aid operational risk management and compliance in the insurance industry.

Here, the three Pillars of Basel II (and more recently Basel III) are important. They concentrate upon capital ratios (Pillar I), supervisory procedures (Pillar II) and demand better disclosure to ensure effective market discipline upon, and transparency of, risk management practices (Pillar III). Yet the requirement to treat operational risk as a unique and distinctive risk discipline has posed difficulties of definition, implementation and strategic planning and created a major operational challenge for banks around the globe (see Cruz 2004 Holmes 2003 Bryce et al 2011). It has been a particular issue when accounting for operational risk in capital allocations in relation to what are considered volatile and difficult to predict upstream risk events (see for example Cruz 2002 Baud et al 2002 Holmes 2003 Power 2005). More specifically, the challenges of modelling operational risk in an environment with little historic data and applying a metric for risk capital means banks have often been torn between a focus on Pillar 1, which is quantitatively focused, and Pillar 2, which is more qualitatively focused (Cruz 2002 Hoffman 2002 Bryce et al 2011).

Similar issues arise in the international insurance industry, where operational risk compliance poses one of the largest current issues for insurance companies. Insurance regulators are cognizant of the learning experiences of the banking sector, and that operational risk management remains under development. However, Warrier (2007) and Flamee and Windel (2009) believe there are indications that insurance companies, with the historical experience of the Basel II compliance process in banks, may well find compliance with Solvency II less problematic. Importantly, more research in both sectors may enable this process.

Certainly, there are indications that the design of Solvency II has benefitted from banks' experience of Basel II; for example, in the adoption, as with Basel II, of a hybrid internal approach to the measurement of operational risk. Nevertheless, like banks, this approach has been limited by the expected lack of credible data and a lack of robust management infrastructure within Pillar 2 of the operational risk control/assessment frameworks of insurance companies (CEIOPS 2009 Bryce et al 2011). There is also commonality in how regulators of both industries approach the measurement of risk exposures within the business environment. For example, they both prescribe a risk-based approach using a choice of internal or standardized minimum capital/solvency requirements. This flexibility to self-regulate (Young, 2012; Young, 2013) by choosing your own internal measures recognizes the

debates taking place across both industries regarding which models and statistical approaches are best suited to manage operational risk. It remains an important issue, as research by, amongst others, Cruz (2002) Frachot et al (2001) (2003) and Davis (2006) provides clear empirical evidence suggesting a wide variance in the capital required depending on the selection of the approach taken.

Further, Bryce et al (2011) have argued that a number of key challenges remain for regulatory operational risk modelling; including the collection, availability, frequency and quality of data as well as the suitability of historic losses as predictors of the future (CEIOPS, 2009). At the same time, qualitative assessments have a key role to play, and Solvency II (learning from Basel II) establishes a set of minimum requirements designed to ensure the validity of these internal risk assessments as inputs to the capital calculations (see Cruz et al 2004 Davis 2006 Frachot et al 2002 Hoffman 2002 BCBS 2005 CEIOPS 2009). Thus the CEIOPS 2009 Directive, article 44 states:

Insurance and reinsurance undertakings shall have in place an effective risk management system comprising strategies, processes and reporting procedures necessary to identify, measure, monitor, manage and report on a continuous basis the risks, at an individual and at an aggregated level, to which they are or could be exposed, and their interdependencies

Solvency II regulation also includes requirements for institutions to address the issue of scenario analysis, which in turn raises questions around judgement, and particularly the use of expert judgement, in the validation of risk assessment and model outputs (see Tversky and Khaneman 1971 O'Brien 2011 Rosqvist 2003 Hall 2006). Importantly, regulators intend to apply a "use test", similar to Basel II, to the Solvency II framework to assess how well it is understood, applied and owned throughout insurance companies. Here, it is clear that organizations must learn from operational risk events, and both their own and others experiences (Toft 1990).

Overall, past research indicates strong agreement on the actual operational risk framework that should be implemented to manage operational risk (see Alexander 2003 Cruz 2004 Davis 2006 Hoffman 2002), although Cruz (2004) and Blunden and Thirlwell (2010) both highlight the importance of the environment into which the framework is launched and how fully implementation is achieved. In this regard, Waring and Glendon (2001) and Chang (2001) note that the key to successful implementation is the strength of the operational risk culture -something which is fundamental to the research undertaken in this paper. Here, we will be

guided by the definition provided by the Institute of Risk Management, which defines risk culture as:

the values, beliefs, knowledge and understanding about risk shared by a group of people with a common purpose, in particular the employees of an organization or of teams or groups within an organization" (IRM 2012 p12)

Lavida and Garcia (2006) suggest that risk culture will be a major strategic challenge that confronts all institutions, which is of particular importance in this context as Davis (2006) and Waring and Glendon (2001) both suggest that the culture of risk management within an organization may affect the collection and processing of loss data.

All of this, in turn, highlights the importance of qualitative management as the foundation for quantitative assessment, and both will use the base data of the outputs from control frameworks, corporate knowledge and history as reference points (Tversky and Khaneman 1971). With this in mind, it remains surprising how little of the literature discussing the implementation of the qualitative Pillar 2 requirements of Basel II/III or Solvency II refer to the accepted management sciences related to strategy, leadership and change management (for example Porter 1995 1996 or Mintzberg and Quinn 1996 or in the context of operational risk Bryce et al 2011). The majority of good practice in the literature emphasizes process, methodology and adding value when executing the implementation of key regulatory projects (Davis 2006 Cruz 2004 Alexander 2003 Wilson 2006).

In terms of the management of risk, the three lines of defence hierarchical structure for the management of operational risk (IOR 2010) details common guidelines for the governance of operational risk management within financial institutions (Bryce et al 2013). As previously stated, although the business models of insurance companies and banks may differ, the fundamentals of operational risk governance and internal control frameworks remain comparable. This can be seen, for example, in the implementation of a more robust three lines structure by Mitsui Sumitomo Insurance Company required as a consequence of a Financial Services Authority (FSA) investigation into ineffective corporate governance within the institution (FSA 2012).

The first line of defence involves day to day risk management at the operational level, in accordance with agreed risk policies, appetite and controls. Yet, it is the execution of these policies, processes, procedures and controls as set out by the second line of defence which the first line of defence has difficulty implementing into their 'business as usual' activities

(Bryce et al 2011 2013). Previous literature has highlighted education and training, blame culture, and lack of understanding, as key elements which affect the ability of staff in the first line of defence to engage in operational risk management (Power 2007 Wahlstrom 2006 Bryce et al 2011 2013).

It is for this reason that this paper will investigate the effectiveness of this first line of defence within a UK insurance company's call centre environment as they move towards Solvency II. In order to achieve this, and recognizing that, in implementing Solvency II, insurance companies may learn from the difficulties experienced by UK banks in developing effective strategies to ensure full compliance and sustainability, we will first develop a more in-depth understanding of the issues surrounding Basel II implementation within a Major British Banking Group.

Methodology

The current research targets the dearth of research in the area of operational risk implementation within financial institutions. We begin with a qualitative approach focusing upon a major British banking group and key external stakeholders as it moved towards advanced Basel II compliance - undertaking twenty thematic interviews and four additional 'in-depth' semi-structured interviews with UK bank executives. The key findings of this phase of the research are reported in this section and inform the development of the second stage methodology - a survey undertaken at a large UK insurance company to help inform Solvency II implementation to which we received 111 (n=111) completed responses. The survey was designed to utilize structural equation modelling which is presented in the proceeding section (see Pearl 2000). Our approach looks like this:

Figure 1 Stage 1 & 2 Research Design

20 THEMATIC INTERVIEWS

4 IN-DEPTH SEMI-STRUCTURED INTERVIEWS

STAGE1- QUALITATIVE BASEL II COMPLIANCE

111 SURVEYS

IN UK INSURANCE CALL CENTRES

STAGE 2- STRUCTURAL EQUATION MODELLING FOR SOLVENCY II

Our survey follows the innovative approach of Elbanna et al (2013) undertaking the survey within a large provider of insurance1, offering customer services as well as insurance sales products via three call centres and reported total revenue of over £40 million for the period 2012/2013. In order to maximise the response rate the survey was distributed via the company's intranet and the insurance company gave employees 20 minutes to complete the survey. This contributed to a healthy response rate of 44% which compares well to other survey response rates (Hsu & Chiu, 2004; Poulter et al., 2008). Table one shows our descriptive statistics.

Table 1 Descriptive Survey Statistics

Demographic Characteristic_Frequency %

Gender

Male 52 47

Female 59 53

Role within the Institution

Call Centre Operative 76 68

Call Centre Manger/Team leader 35 32

Length of time at the Institution

0<6 months 12 11

6 months > 1 year 16 14

1 Year > 3 years 41 37

3 years > 5 years 17 15

5 years + 24 22

Length of time in current role

0<6 months 15 14

6 months > 1 year 18 16 1 Year > 3 years 53 48 3 years > 5 years 11 10

_5 years +_13_12

Stage One: Qualitative Study

Following the method generally considered to be the most appropriate to gather data on processes and decision-making within companies (Gummeson 2000) and congruent with the sample size utilised in previous research in the area (for example see Wahlstrom 2006 Bryce et al 2011) our qualitative research was conducted in two phases: twenty thematic interviews within a major UK commercial bank followed by four in-depth interviews with major stakeholders of the UK Basel II implementation process.

1 We cannot name the financial institution due to a confidentiality agreement

In line with Lincoln and Guba (1985) Denzin and Lincoln (1994) and O'Loughlin et al (2004) a semi-structured approach was used to maximise the depth of analysis with each individual. The four in-depth interviews were then conducted which probed deeper into areas of interest that the thematic interviews brought to our attention in line with the work of Barritt (1986) Sykes (1990) or O'Loughlin et al (2004). Such purposive sampling allows flexibility and manipulation of themes of particular interest to our research questions (Glaser and Strauss 1967). The selection of these participants included a senior FSA regulator during the development of Basel II for the UK, a 'grey panther' for the FSA, the global head of another Major British Banking Groups Operational Risk Consultancy arm, and finally the Chief Risk Officer of another Major British Banking Group. The objectives of the interviews were to:

1. identify the key challenges in the Basel II AMA Pillar 1 and 2, and how these were being addressed;

2. critically analyse the requirements of implementing an operational risk framework for Basel II Pillar II;

3. generate specific items for the development of scales for stage 2 survey.

The key outcomes from this initial qualitative stage of the research emerged within the following themes:

• reliance upon people for effective decision making;

• the importance of good training for empowerment of staff;

• the importance of Board level engagement;

• an individual's own world view and perceptions influenced the adoption of an organizational risk culture.

The respondents highlighted the importance of a top-down approach to the management of the Basel II compliance, engaging 'decision making echelons' to more effectively embed processes, procedures and techniques (see also Mikes and Kaplan 2013). Retrospectively, it is these 'decision making echelons' that have been targeted by UK regulators as to the root cause of the most recent banking crisis, in the form of poor governance (See Power, 2011 or Young, 2012 p467). Although the debate between the importance of Pillar 1 and Pillar 2 featured prominently within the qualitative data, it was evident that in the regulators development of the 'use test' they were focusing upon effective management of the firm. It seems they have a belief that somehow the implication of a 'use test' will actually make it clear that it is 'how you run your business' that remains paramount.

Following the regulators public exhortations and their desire to see the models forming part of the decision-making process, we found that management were required to place the models in the context of the organisation and both understand their importance and obtain employee buy in (see Leech 2002 BCBS 2006). However, it was emphasised that it is the employees and the 'people' within the organization which were considered most important in this context, for example, our initial research identified the role that human nature plays in creating errors and reporting them in the first line of defence. This concurs with previous research by Bryce et al (2011 2013) or Wahlstrom (2006) who report that a 'no blame' proactive risk culture will involve top level buy in, and more importantly bottom level understanding. Our research in this phase of our investigation found that 'how well and how far down the organization has the framework been implemented?" was a key concern for regulators, which again is consistent with Bryce et al (2011) and Wahsltrom (2006). However, in contrast to the academic literature of Chernobai et al (2011) or Guegan and Hassani (2012) which focuses on the importance of measuring operational risk in Pillar 1, it was clear from our Stage 1 results that Pillar 2 and the effect that implementation has on 'employees' was a more urgent priority in order to safeguard and mitigate operational risk. That is not to say that the measurement of operational risk is not relevant, as there was general agreement from all the participants that the "modelling of risk must form part of any risk management technique".

Importantly, in banks, it is widely acknowledged that operational risk manifests itself primarily within the operations level (the first line of defence). However if the second line of defence are not made aware of a risk occurring via an effective escalation process filtered through employees within business operations - measurement quickly becomes inconsequential (Wahsltrom 2006 Bryce et al 2011 2013). This conceptual understanding of the operational risk escalation protocol within banks also holds true for insurance companies. It is this very 'risk event' reporting which has been highlighted by the IRM (2012) as a key indicator to a successful risk culture which has become considered to be the most effective tool of risk management (IIF 2008). It is therefore natural to assume how and what employees consider the difficulties and aids in escalating operational risk events will be an appropriate fundamental starting point for assessing "how well and how far down the organization has the framework been implemented" from a Solvency II perspective as outlined by CEIOPS (2009, Article 44). These findings inform the development of Stage 2 of our methodology.

Stage 2: Development of the Conceptual Protocol model

Our Stage 2 model is based on the contention that uncertainty and attitude will impact on the intention of an operative in the first line of defence to escalate operational risks to the second line of defence of an insurance company. We use the definition of risk escalation as outlined by Bryce et al (2013, p298): "the internal process by which real or potential operational risks are reported in a manner that complies with agreed institutional policy". The use of intention as a measure of potential behaviour is based upon an approach informed by the Theory of Reasoned Action, Theory of Planned Behaviour and the more recent Technology Acceptance Model (Lin 2010 Hsu and Chiu 2004 Ajzen 1988 1991 Bryce et al 2013).

We define uncertainty as a condition where the availability of information deviates from the ideal situational state by which to make a decision (see Shiu et al 2011 Daft and Lengel 1986 Lipshitz and Strauss 1997 Milliken 1987). Such interpretation of uncertainty can be considered either uni-dimensionally (Kooufteros et al 2005 Lanzetta 1963) or multidimensional^ (Urbany et al 1989 Shiu et al 2011) and builds upon the methodological work of Bryce et al (2010, 2013). Further, this investigation of the effects of employee uncertainty provides cross-industry applicability, as the requirement of Pillar 2 of Solvency II will inevitably lead to the requirement of staff in the first line of defence to address new processes and procedures.

As highlighted by the Stage 1 qualitative research, during Basel 2 roll-out, if implementation at the lower levels of the organization is not performed correctly it can lead to a situation where the availability of information deviates from the ideal. As such, Stage 2 takes this into consideration and investigates uncertainty in the intention to escalate operational risks using a uni-dimensional scale grounded in the disaggregated constructs as highlighted originally by Urbany et al (1989).

For the purposes of hypothesis development Figure 2 depicts our conceptual model. Standard statistical methods were used to test the conceptual model and Confirmatory factor analyses (CFAs) were conducted to ensure the survey items used were measuring the underlying latent constructs of attitude, uncertainty and behavioural intention. In addition, structural equation modelling (SEM) was implemented to test the relationships between the constructs and the fit of the hypothesised conceptual model as a whole, due to its ability to consider a number of regression equations simultaneously. Previous studies that have added to the finance literature using this method include the areas of mobile banking adoption (Luarn and Lin, 2005; Gu et

al, 2009), Insurance purchasing behaviour (Hellier et al, 2003), Firm Capital structure (Baranoff et al, 2007), and Financial services trust (Malaquias and Hwang, 2016). The use of SEM in this current study is further supported by its ability to determine the dynamically interactive relationship between the variables as outlined below in Figure 2. CFA and SEM were undertaken via AMOS 20, with descriptive analysis provided by PASW 18.

Figure 2 Conceptual Model of Intentions in Operational Risk Escalation

INTENTION TO

ESCALATE OPERATIONAL RISKS

H3. (+)

ATTITUDE TOWARDS OPERATIONAL

RISK ESCALATION

H4. (-)

H1. (-)

UNCERTAINTY

TOWARDS OPERATIONAL

RISK ESCALATION

We utilise a number of hypotheses:

H1: Uncertainty negatively affects intention to escalate operational risks.

The formalized procedures of staff training and professional development have been outlined in Stage 1 as a critical factor in the empowerment and effectiveness of staff to manage operational risks. Previous research considered this within banking, with the most recent studies alluding to education and training incentivizing staff to escalate events due to increased participant's certainty and awareness of the area (see Bryce et al 2011 Power 2005 Blunden and Thirlwell 2010 Mikes and Kaplan 2013 IRM 2012). Further, the IRM (2012) highlight the importance of risk management skills development and technical training as pertinent to an effective risk culture. This informs our second hypothesis:

H2. Staff training has a negative effect upon employee uncertainty.

The role of attitude and more specifically attitudes towards behaviour has also been widely acknowledged as an important precursor to actual behaviour in the literature. Within the banking industry employee attitudes in driving what is now considered 'risk culture' has received significant attention both in policy and industry best practice (by amongst others

Ashby et al 2012 and the IRM 2012). The IRM (2012) study further states that from the perspective of financial services risk attitude: 'is the chosen position adopted by an individual or group towards risk, influenced by risk perception and pre-disposition' (p7). To place this in the context of the current study, if a key indicator of good risk culture involves risk escalation, then positive attitudes towards that behaviour would increase intention to escalate operational risks. This therefore informs our third hypothesis:

H3. Attitude has a positive effect on intention to escalate operational risks.

We test whether a significant negative relationship between uncertainty and attitude exists, which goes much further than the IRM (2012) suggestion that 'perception' and 'predisposition' explain development of attitudinal constructs of risk behaviour. We contend that:

H4. Attitude and uncertainty are significantly negatively related to each other.

With these hypotheses in mind Table 2 below lists the final survey questions used to measure each latent construct, in the interests of brevity a full copy of the survey is available on request. All the questions were pseudo-randomly mixed together in line with Poulter et al (2008) to reduce respondent bias.

Table 2: Survey Items Used and Measurement Robustness Checks

Constructs Standardized Construct Average

CFA Reliability Variance

Loadings_Extracted

0.966 0.904

0.986 0.935

0.884 0.718

0.753 0.929 0.851

Intention (7 point strongly disagree to

strongly agree)

1. I intend to report operational risk losses/events in the next twelve weeks should they arise

2. I plan to report operational risk losses/events in the next twelve weeks should they arise

3. I want to report operational risk losses/events in the next twelve weeks should they arise

Attitude (7

point scale)

Overall, I think that reporting operational risk losses/events

is...?

4. Very Ineffective/Very Effective

5. Very Harmful/Very Beneficial

6. Very Foolish/Very Wise

Uncertainty (7 point strongly disagree to 0.871 0.693

strongly agree)

7. I am sure of my knowledge and understanding of what operational risk losses/events are 0.841

8. I am aware of the correct reporting channels for the reporting of operational risks losses/events 0.812

(7 point scale)

9. When you come across various risk losses/events how sure are you of what to choose to report as an operational risk loss/event?

Very Unsure/Very sure_0.844_

Structural Equation Modelling

Measurement Model

The measurement model was evaluated for reliability, convergent validity and discriminant validity of the three constructs included in our model. Confirmatory factor analyses offered strong support that the survey items measured the hypothesised latent constructs of uncertainty towards risk reporting, attitude towards risk reporting, and behavioural intention to report risks. As can be seen by Table 2 above, all constructs are above 0.7 in relation to construct reliability thus indicating a good fit. Convergent validity was assessed in line with the two criteria set out by Fornall and Lacker (1981) with all factor loadings exceeding 0.7 and average variance extracted (AVE) for each construct exceeding the variance due to measurement error for that construct (that is it should exceed 0.5). Discriminant validity was also examined and accepted using the Fornall and Lacker (1981) test of AVE exceeding the squared correction between that and any other construct. In conclusion the measure for each latent construct satisfies construct validity in this current research context.

Table 3 Structural Equation Model and Path Influence Results

□ C.R. Supported

+ H1 Attitude ^ Intention .475 4 716 *** Yes

- H2 Uncertainty ^ Intention -.350 -3.568*** Yes

- H3 Uncertainty ^ Attitude -.474 -3.165*** Yes

***P<0.05, C.R. = Critical Ratio, □ = Standardized Loading, R2 Intention = 0.506

Model Fit Results

Table 3 indicates that all hypothesised pathways as outlined in Figure 2 were significant (p<0.05) with attitude displaying the largest effect on operational risk escalation intention. The model was tested for goodness of fit with X2 29.837 (p=0.19), RMSEA = 0.047, CFI=

0.992, and NFI = 0.963.With goodness of fit tests exceeding all their common acceptable levels the model is considered an excellent fit to the data (see Hooper et al 2008 Barrett, 2007 Steiger 2007 Hu and Bentler 1999). The explanatory power of the research model is also identified with R2 of 0.506, thus suggesting that both attitude towards risk escalation behaviour and uncertainty account for over 50% of the variance in intention to escalate operational risks within the call centre environment.

Discussion

As previously theorized by Urbany et al (1989) and Shiu et al (2011) uncertainty affects intention to enact a behaviour. Our results suggest that where the availability of information deviates from the ideal situational state by which to make a decision the intention to escalate operational risk events deteriorates thus we accept H1. We therefore find, in line with the IRM (2012) that given the importance of risk escalation as an indicator of strong risk culture those institutions that can minimize this 'uncertainty' may well increase the number of events escalated within their organization. This inevitably has important consequences both for risk management, but also for overall performance as early detection and escalation is critical to the minimization of loss of earnings as also reported by Bryce et al (2011, 2013).

This process of what Cooke (2003) refers to as 'incident learning' by risk managers within the organization can only ever be improved by ensuring events do not go unchecked or unnoticed in the first line of defence, which in this current study was the financial institution environment. Interestingly, within this first line of defence no significant differences exist between employee hierarchy in relation to attitudes or intention, however, a significant difference emerges in relation to the construct of uncertainty. Unsurprisingly call centre associates reported significantly higher scores on the uncertainty scale (M=3.79, SD=1.39) than call centre managers/team leaders, given that managers will be more accustomed to dealing with multiple events from associates (thus reducing uncertainty!) as they are one level above them in the reporting hierarchy (M=3.09, SD=1.17; i(99)=2.44, p=0.02). It is reassuring to observe a lack of divergence in attitude and intention between managers and their subordinates albeit not uncommon in the behavioural literature (Krupka and Weber, 2009; Burks and Krupka, 2012). Such a divergence could have indicated a lack of consistency in not only the treatment of risk events should they occur, but also in how managers and their subordinates consider the importance of reporting of risk within their work environment. It is this consistency in the values and beliefs around risk, between and

across hierarchical structures, that is key to the fostering of an effective risk culture (IRM, 2012).

It has been widely recognized that employee training and professional development are critical to escalation and we report a negative and significant relationship (Spearman's rho, -0.68 p<.01) between level of agreement with the question 'the education and training that have been provided enables me to better report operational risk losses/events' and the latent construct 'uncertainty', thus we accept H2. The importance of on-going training to reduce uncertainty is evident in our current study, independent samples T-tests identified that there were no significant differences between job length and attitude and intention, but significantly higher levels of uncertainty were found in staff who had been working in their job for less time. The analyses indicates that those employees who have been working in their job for three years or less scored higher on the uncertainty scale (M=3.86, SD=1.37) than those working there for over three years (M=3.10, SD=1.22; t(99)=2.82, p=0.006).

In itself this result around 'tenure' and its importance to training may seem irrelevant, however the behavioural work of Blau (1960); van Maanen (1975); De Cooman et al (2009); and Moynihan and Pandey (2007) suggests that altruistic and pro-social behaviours (in this case risk escalation intention) should decline with tenure within organisations. Given the nature of the continual training specific to risk within the workplace under investigation it is evident that this pro-social decline with tenure is unsubstantiated. In fact, as an employees tenure increases so does the amount of training they receive, thus reducing their uncertainty around risk escalation as it becomes a normative response derived from training supporting previous research (Bryce et al, 2013; Power 2005; Mikes and Kaplan; 2013 IRM 2012). It is not surprising that in other sectors, such as aviation, inappropriate or lack of training can be considered a precondition to unsafe acts when retrospectively forensically examining air accidents (see Olsen and Shorrock 2010). We report that the same conditions apply in the insurance industry, particularly training outside the remit of their main duties, which in the call centre environment involves primarily sales, to improve the risk culture within those organizations. If financial regulators are increasingly interested in the 'breadth and depth of understanding of risk management' within organizations (as outlined in the Stage 1 interviews of this current study) then it will be important that training reflects this, especially if it reduces risk 'uncertainty' within a workforce as is the case in this current study.

As regards 'risk culture' receiving increased attention from institutions, the analysis of underlying attitudes that cultivate and foster positive behaviours and risk culture was important. As expected in H3, positive attitudes towards the escalation of operational risk events significantly affect intention to escalate operational risks. However the contention that 'risk perception' and 'pre-disposition' are the fundamental antecedent factors that affect attitude as outlined by the IRM (2012) fails to take into account the interrelationship of uncertainty as witnessed by the acceptance of H4 (r= -4.74, p<0.05). This is of particular importance given the reality of working environments, as the 'awareness-based' detection (see Kontogiannia and Malakis 2008) that is required for risk escalation clearly has at least one other significant and negative factor (uncertainty).

This could reduce attitude which is unique from 'risk perception' and 'pre-disposition' as outlined by the IRM (2012). The relationship as outlined in Figure 2, albeit interesting, led the study in an unintended direction. From the survey it was revealed that a subset of questions as outlined below in Table 4, now baptized 'risk integrity' (Cronbach alpha = 0.754) was found to be a strong predictor of positive attitude (Beta= 0.459, p<.001) and Uncertainty (Beta= -0.497, p<.001) in their duties towards risk escalation. This is the first time, to the authors' knowledge, that a construct internal to the employee has been developed and tested which can predict traits that may be beneficial in the creation of a risk culture and management of risk by financial institutions.

Table 4.0 Risk Integrity Construct and Analysis

Questions Contained within the Risk Integrity Construct_

I would like more information in order to understand my institution's operational risk policy

(1 ' Strongly Disagree' to 7 'Strongly Agree') Having a good risk management track record is important to me (1 ' Strongly Disagree' to 7 'Strongly Agree') I would be prepared to invest a lot of effort in operational risk reporting _(1 ' Strongly Disagree' to 7 'Strongly Agree')

_R_B Std. Error_Beta

DV = Attitude .201**

Risk Integrity .439 .103 .459***

Controlling for work environment

Job Role .299 .294 .135

Volume of Calls -.145 .301 -.048

Length of Time Spent in Role .097 .282 .046

Education -.271 .254 -.116

DV = Uncertainty .594***

Risk Integrity -.630 .098 -.497***

Controlling for work environment

Job Role -.101 .279 -.035

Volume of Calls -.560 286* -.139

Length of Time Spent in Role -.551 .268* -.196

Education -.919 241*** -.297

***p<.001 **p<.01 *p<=.05

The intrinsic motivation to learn about risk, willingness to exert effort to report risk, and the pride that an employee has in there risk management track record would appear to be traits that are conducive to the development of improved 'overall risk management capability'. As Wildavsky (1988) suggests:

improvement in overall capability, i.e. a generalised capacity to investigate, to learn, and to act, without knowing in advance what one will be called to act upon, is a vital protection against unexpected hazards" (p.70).

With this in mind, future research investigating this 'risk integrity' concept could prove useful not only in employee recruitment but also in evaluating the effectiveness of organizational risk learning and development programs pre/post their completion. We believe this construct aligns closely to what Arnaud and Schminke (2012) refer to as 'collective moral emotion' and could pave the way for the development of an even deeper insight into the behavioural norms and peer effects (Gino et al, 2009; Mazar and Ariely, 2006; Ahern et al 2014) that surround risk management within organisations.

Conclusions

The paper followed a mixed-methods design in an interesting and scarcely researched area of financial services risk management. The ability to obtain primary qualitative and quantitative data allowed us to uncover important and interesting dimensions of the risk management process in financial institutions. In addition, it allowed us to provide enriched explanations of the behavioural intention to escalate risks. Interest in this area arises for several reasons. First, previous research in this contextual setting has found that attitude and other constructs of the theory of planned behaviour do not account for the effects of uncertainty on the risk escalation procedure. Second, knowing more about individual decision processes and what makes effective 'risk aware' employees has practical consequences for effective risk management design and best practice. Third, a plethora of new documentation surrounding best practice risk management and culture within financial institutions has been brought to bear on the academic community with little or no evidence to support it. In addition to this, if we consider the initial escalation of a risk event detailed in this paper as the first step towards

the measurement and management of this event, then it is rationale to suggest that risk escalation would therefore be a precursor to 'event study' type methodologies that use operational risk events as the subject of their investigation. Finally, increased regulatory attention in the effectiveness of risk management frameworks at the lowest levels of financial institutions should clearly inform Solvency II compliance. The past should inform the future and insurance companies can learn from the banking sector.

Our results highlight the importance of uncertainty and attitude in the decision making process. Further, the existence and identification of a new employee concept 'risk integrity' allows for interesting avenues of further exploration. It is envisaged that future studies will encompass in situ experimentation and analysis of actual behaviour by way of ratification, but also encourage industry application of the concept. If it is the case within financial organizations as outlined by the qualitative interviews in stage 1 that reliance upon people for good decision-making exists, then it is only a matter of time before legislative policy and regulations reflect this. The move by regulators towards a 'use test' that measures the effectiveness of how well risk frameworks are embedded within organizations may well be that signal, which could be reinforced by the inclusion of behavioural metrics of effective risk management as outlined in this current study.

With Solvency II implementation on-going, the readiness of staff to accept new processes, and the ability to disseminate information to 'decision makers' in a fashion that enables rather than disables risk management behaviour should not be understated. This study highlights the importance of both from a qualitative and quantitative training and educational development perspective. Evidence within the current study suggests that both attitude and information certainty fostered by training and education around risk management process/procedures may well be the fundamental building blocks of a coherent and effective risk culture, and therefore risk management strategy.

References

ABI (2011) UK Insurance Key Facts, Association of British Insurers, September 2011, London: ABI.

Ahern, K; Duchin, R; and Shumway, T (2014) Peer Effects in Risk Aversion and Trust, Review of Financial Studies, vol. 27(11): 3213-3240.

Al-Darwish, A.,Hafeman, M., Impavido, G., Kemp, M., O'Malley, P. (2011) Possible Unintended Consequences of Basel III and Solvency II, International Monetary Fund Working Paper, August 2011.

Alexander, C. (2003), Operational Risk: Regulation, Analysis and Management, London: Prentice Hall.

Arnaud, A and Schminke, M. (2012) The Ethical Climate and Context of Organizations: A Comprehensive Model, Organization Science Vol 23 (6), pp 1767-1780

Ajzen, I. (1988) Attitudes, Personality and Behaviour, Chicago: Illinois Press.

Ajzen, I. (1991) The Theory of Planned Behaviour. Organizational Behaviour and Human Decision Processes, 50, 179-211.

Ashby, S.; Power, M,; Palermo, T. (2012) Risk Culture in Financial Organisations, Centre for Analysis of Risk Regulation, London School of Economics and Political Science, LSE: London.

Baranoff, E. G., Papadopoulos, S. and Sager, T. W. (2007) Capital and risk revisted:A Structural Equation Modelling Approach, Journal of Risk and Insurance, Vol 74, pp 653681.

Barrett, P. (2007), Structural Equation Modelling: Adjudging Model Fit, Personality and Individual Differences, Vol 42 (5),pp 815-24.

Barritt, L. (1986), "Human science and the human image", Phenomenology and Pedagogy, Vol. 4 pp.14-22.

Basel Committee on Banking Supervision, (1998), Operational Risk Management, Bank of International Settlements, June.

Basel Committee on Banking Supervision, (2005), International Convergence of Capital Measures and Capital Standards, Bank of International Settlements

Basel Committee on Banking Supervision, (2006), Observed range of practice in key elements of Advanced Measurement Approaches (AMA), Bank of International Settlements

BBA (2012) BBA Abstract of Banking Statistics, British Bankers Association, Vol 29, London BBA.

Blau, P. (1960) Orientation toward Clients in a Public Welfare Agency, Administrative Science Quaterly, Vol 5 (3): 341-361.

Blunden, T., and Thirwell, J. (2010) Mastering Operational Risk, London: Prentice Hall.

Burks, S and Krupka, E (2012). Behavioral Economic Field Experiments Can Identify Normative Alignments and Misalignments within a Corporate Hierarchy: Evidence from the Financial Services Industry. Management Science, Vol 58:203-217

Bryce, C., Webb, R., Adams, J. (2011) Internal Loss Data Collection Implementation: Evidence from a Major UK Financial Institutions, Journal of Risk Research, August, pp 1-16.

Bryce, C., Webb, R., Watson, D. (2010) The Effect of Building Society Demutualisation on Levels of Relative Efficiency at Large UK Commercial Banks. Journal of Financial Regulation and Compliance. Vol 18 (4), pp.333 - 355

Bryce, C,. Webb, R., Cheevers, C. (2013) Operational Risk Escalation: An Empirical Analysis of UK Call Centres, International Review of Financial Analysis, Vol 30, pp 298307.

CEIOPS (2009) Advice for Level 2 Implementing Measures on Solvency II: System of Governance, Committee of European Insurance and Occupational Pensions Supervisors, Article 44 (9), CEIOPS.

Chang, V. (2001), Siebel Systems: Culture as a Pillar of Success, Case Number: HR-14, Graduate School of Business, Stanford University

Chernobai A., Jorion, P., Yu F. (2011) The determinants of operational risk in U.S. financial institutions. Journal of Financial and Quantitative Analysis, Vol. 46 (6), pp. 1683-1725

Cooke, D.L. (2003) Learning from incidents, in proceedings of the 21st International Conference of the System Dynamics Society, New York.

Cruz, M. (2002), Modelling, measuring and hedging operational risk, West Sussex, Wiley Finance.

Cruz, M. (2004), Operational Risk Modelling and Analysis, Theory and Practice, London: Risk Waters

Daft, R. L., & Lengel, R. H. (1986). Organizational information requirements, media richness and structural design. Management Science, 32, 554-571.

Davis, E. (2006) The Advanced Measurement Approach to Operational Risk, London, Risk Books

De Cooman, R; De Gieter,S; Pepermans, R; Hermans, S; Du Bois, C; Caers, R; Jegers, M. (2009), Person-Organization Fit: Testing Socialization and Attraction-Selection-Attrition Hypotheses, Journal of Vocational Behavior, 74(1): 102-107.

Denzin, N.K., and Lincoln, Y.S. (1994) Handbook of Qualitative Research, Sage: CA

Elbanna, S; Child, J; Dayan, M. (2013) A Model of Antecedents and Consequences of Intuition in Strategic Decision-making: Evidence form Egypt, Long Range Planning, Vol 46, pp 149-176.

Flamee, M., and Windels, P. (2009) Restructuring Finanical Sector Supervision: Creating a Level Playing Field, Geneva Papers on Risk and Insurance - Issues and Practice, Vol 34 (1), pp 9-23.

Fornell, C., Larcker, D.F. (1981) Evaluating structural equation models with unobservable variables and measurement error. Journal of Marketing Research, Vol 18 (1), pp 39-50.

Frachot, A, and Roncalli, T, (2001), Loss Distribution Approach for Operational Risk, Credit Lyonnais, Groupe de Recherche Operationnelle, Working paper

Frachot, A and Roncalli, T.,(2002) Mixing internal and external data for managing operational risk, Credit lyonnais, group de Receherche Operationnelle, Working paper

Frachot, A, Moudoulaud, O and Roncalli, T., (2003), Loss distribution approach in practice, Credit lyonnais, group de Receherche Operationnelle, Working paper

FSA (2012) Financial Services Authority Final Notice - Mitsui Sumitomo Insurance Company (Europe) Ltd, Financial Services Authority, FSA: London

Gatzert, N., and Wesker, H. (2012) A Comparative Assessment of Basel II/III and Solvency II, The Geneva Papers on Risk and Insurance - Issues and Practice, Vol 37, pp 539-570.

Geneva Association (2010) Systemic Risk in Insurance, Special report to the Geneva Association Systemic Risk Working Group, Geneva: Geneva Association.

Gino, F., S. Ayal, and D. Ariely. (2009) Contagion and Differentiation in Unethical Behavior: The Effect of One Bad Apple on the Barrel. Psychological Science, Vol 20, no. 3, pp 393398

Glaser, B.G., and Strauss, A.L. (1967) The Discovery of Grounded Theory: Strategies for Qualitative Research. Chicago: Aldine

Gu, J.-C. , Lee, S.-C. and Suh, Y.-H. (2009), "Determinants of behavioural intention to mobile banking", Expert Systems with Applications , Vol. 36 (9), pp. 11605-11616.

Guegan D., and Hassani B. (2012), Operational risk : A Basel II++ step before Basel III, Journal of risk management in financial institutions , Vol 6 (13), pp 37 - 53.

Gummesson, E. (2000) Qualitative Methods in Management Research, 2nd Ed, Sage: CA.

Hall, C. (2006), Quantifying operational risk using expert opinions, Oprisk and compliance, 7(6)

Hellier,P; Geursen,G,; Carr, R,; RickardJ. (2003) Customer repurchase intention: A general structural equation model, European Journal of Marketing, Vol. 37 (11/12), pp.1762 - 180.

Hoffman, D. (2002) Managing Operational Risk - 20 Firmwide Best Practice Strategies, New York, Wiley Finance

Hoffman, D.M. and Lehman, A.P. (2009)Dedicated Insurers are not a systemic risk - an assessment after the first year of the global credit crisis, Insurance Economics, Vol 59

Hooper, D., Coughlan, J., Mullen, M. (2008) Structural Equation Modelling: Guidelines for Determining Model Fit, Electronic Journal of Business Research Methods, vol 6 (1), pp 5360.

Hsu, M. H., & Chiu, C.M. (2004). Internet self-efficacy and electronic service acceptance. Decision Support Systems, Vol 38 (3), 369-381

Hu, L.T. and Bentler, P.M. (1999), Cutoff Criteria for Fit Indexes in Covariance Structure Analysis: Conventional Criteria Versus New Alternatives, Structural Equation Modeling, Vol 6 (1), pp 1-55.

IIF (2008) Financial services industry response to the market turmoil of 2007-2008. Washington DC: Institute of International Finance.

IOR (2010) Operational Risk Governance Sound Practice Guidance, Institute of Operational Risk, September 2010

IRM (2012) Risk culture: Guidance from the Institute of Risk Management. London: Institute of Risk Management.

Jobst, A. A. (2007). It's all in the data - consistent operational risk measurement and regulation. Journal of Financial Regulation and Compliance, Vol 15 (4), pp 423-449.

Kontogiannis, T., and Malakais, S. (2008) A proactive approach to human error detection and identification in aviation and air traffic control, Vol 47, PP 693-706.

Koufteros, X.,Vonderembse, M., & Jayaram, J. (2005). Internal and external integration for product development: The contingency effects of uncertainty, equivocality, and platform strategy. Decision Sciences, 36, 97-133.

Krupka and R. Weber (2009). The Focusing and Informational Effects of Norms on Pro Social Behavior. The Journal of Economic Psychology, 30(3):307-320.

Lanzetta, J. T. (1963). Information acquisition in decision making. In O. J. Harvey (Ed.),Motivation and social interaction-cognitive determinants (pp. 239-265). New York: Ronald Press.

Lavida, A.F. and Garcia, F. J. M. (2006), Operational Risk Management in Financial Institutions; Some Empirical Evidence from Spain in The Advanced Measurement Approach to Operational Risk, E Davis (ed), London, Risk Books

Leech, T, J. (2002), Regulatory Revolution Risks Civil War, Algo Research Quarterly, 5 (2)

Lehman, A.P. and Hoffman, D.M. (2010) Lessons Learned from the Financial Crisis for Risk Management: Contrasting developments in banking and Insurance, Geneva Papers on Risk and Insurance - Issues and Practice, Vol 35, pp 63-78.

Lin, H.F. (2010) Applicability of the Extended Theory of Planned Behaviour in Predicting Job Seeker Intentions to Use Job-Search Websites. International Journal of Selection and Assessment, Vol. 18 (1), pp 64-74.

Lincoln, Y.S., and Guba, .E.G. (1985) Naturalistic Inquiry, Sage: CA.

Lipshitz, R., & Strauss, O. (1997). Coping with uncertainty: A naturalistic decision making analysis. Organizational Behavior and Human Decision Processes, 69, 149-164

Luarn, P., & Lin, H. H. (2005). Toward an understanding of the behavioral intention to use mobile banking. Computers in Human Behavior, Vol 21(6), pp 873-891.

Malaquias, R. and Hwang, Y. (2016) "An Empirical Study on Trust in Mobile Banking: A Developing Country Perspective," Computers in Human Behavior, Vol 54, pp. 453- 461.

Mazar, N. and Ariely, D. (2006) Dishonesty in Everyday Life and Its Policy Implications. Journal of Public Policy & Marketing: Spring 2006, Vol. 25 (1), pp. 117-126.

Mikes, A,. and Kaplan, R. (2013) Managing Risks: Towards a Contingency Theory of Enterprise Risk Management, Harvard Business School Working Paper, Vol 13-063.

Milliken, F. J. (1987). Three types of perceived uncertainty about the environment: State, effect, and response uncertainty. Academy of Management Review, 12, 133-143.

Mintzberg, H and Quinn, J., (1996), The Strategy Process; Concepts, Contexts, Cases, New York, Prentice Hall Inc.

Moynihan, D. P. and Pandey, S. K. (2007), The Role of Organizations in Fostering Public Service Motivation. Public Administration Review, 67: 40-53.

Olsen, N. and Shorrock, S. (2010) Evaluation of the HFACS-ADF safety classification system: Inter-coder consensus and intra-coder consistency, Accident Analysis and Prevention, Vol 42, pp 327-444.

O'Brien, C. (2011) Insurance Regulation and the Global Financial Crisis: A Problem of Low Probability Events, The Geneva Papers, Vol 35, pp 35-52

O'Loughlin, D.; Szmigin, I.; Turnbull, P. (2004) From relationships to experiences in retail financial services, The International Journal of Bank Marketing, Vol 22 (7), pp 522-539.

Pearl, J (2000) Causality: Models, Reasoning, and Inference. Cambridge University Press.

Poulter, D. R., Chapman, P., Bibby, P. A., Clarke, D. D., Crundall, D. (2008). An application of the theory of planned behaviour to truck driving behaviour and compliance with regulations. Accident Analysis & Prevention, Vol 40 (6), pp 2058-2064.

Power, M. (2005) The Invention of Operational Risk. Review of International Political Economy, Vol. 12 (4) pp 577- 599.

Power, M. (2007) Organised Uncertainty: Designing a World of Risk Management, London: Oxford University Press.

Power, M. (2011) Smart and Dumb Questions to Ask About Risk Management. Risk Watch: Thought Leadership in Risk and Governance (May 2011): 2-5.

Porter, M.E., (1995),Competitive Advantage, London, The Free Press

Porter, M.E.,(1996), What is Strategy?, Harvard Business Review, Boston, Harvard Business Scholl Publishing.

Rosqvist, T. (2003) On the use of expert judgement in the qualification of risk assessment, Helsinki, VTT Publications

Rowe, D., Jovic, D., Reeves, R. (2004) Bank Capital Management in the Light of Basel II. Journal of Performance Management, Vol 17 (1), pp15-26.

Santos, J.A.C. (2002) Bank Capital Regulation in Contemporary Banking Theory: A Review of the Literature. Financial Markets, Institutions and Instruments, Vol 10 (2), pp41-85.

Shiu, E., Walsh, G., Shaw, D., Hassan, L., (2011) Consumer Uncertainty Revisited, Psychology & Marketing, Vol. 28(6), pp 584-607.

Steiger, J.H. (2007), Understanding the limitations of global fit assessment in structural equation modeling, Personality and Individual Differences, Vol 42 (5), 893-98.

Sykes, W. (1990) Validity and reliability in qualitative market research: a review of the literature, Journal of the Market Research Society, Vol 32 (2), pp289-328.

Tversky, A. and Khaneman, D. (1971), Belief in the law of small numbers. Psychological Bulletin, 76, 105-110

Urbany, J. E., Dickson, P. R., & Wilkie,W. L. (1989). Buyer uncertainty and information search. Journal of Consumer Research, 16, 208-215.

Van Maanen, J (1975) Police Socialization: A Longitudinal Examination of Job Attitudes in an Urban Police Department, Administrative Science Quarterly, 20(2): 207-228

Wahlstrom, G. (2006) Worrying about accepting new measurements: the case of Swedish bankers and operational risk, Critical Perspectives on Accounting, Vol 17 (4), pp 493-522.

Warrier, S.R. (2007) Lessons Learned, Bests Review, February 2009.

Waring, A. and Glendon, I.A. (2001), Managing Risk - critical issues for survival and success into the 21st Century, London, Thomson Learning.

Wildavsky, A.B. (1988) Searching for Safety. Transaction Books: New Jersey.

Wilson, D., (2006), Adding value to operational risk, Oprisk and compliance, Vol 8 (1).

Young, K. (2012) Transnational Regulatory Capture? An Empirical Examination of the Transnational Lobbying of the Basel Committee on Banking Supervision. Review of International Political Economy vol 19, pp 663-688

Young, K. (2013) Financial industry groups adaption to the post-crisis regulatory environment: changing approaches to the policy cycle, Regulation and Governance, Vol 7, pp 460-480.

Should the Insurance Industry be Banking on Risk Escalation for Solvency

Cormac Bryce3*, Rob Webba, Carly CheeversD, and Ring, PD a n d CI a r k, G □,

Highlights

• We employ a two stage mixed methods approach that includes Structural Equation Modeling

• An individual's own world view and perceptions along with Board Level Engagement influenced the adoption of an organizational risk culture

• Attitude and uncertainty significantly affect individual's intention to escalate operational risk

• Employee tenure significantly affects risk escalation uncertainty

a Economics and Finance Department, Centre for Risk and Insurance Studies, University of Nottingham, United Kingdom.

□ □ Department of Law, Economics, Accounting and Risk, Glasgow Caledonian University, United Kingdom.

□ School of Psychology, University College Dublin, Ireland.

□ Independent Risk Consultant, London, United Kingdom.

Correspondent Author. Tel: +44 115 846 6690

Email Addresses: cormac.bryce@nottingham.ac.uk (C. Bryce), robert.webb@nottingham.ac.uk (R. Webb), carly.cheevers@ucdconnect.ie (C. Cheevers) patrick.ring@.gcu.ac.uk (P.Ring).