Home / Analysis / Big super, systemic risk and the ‘illusion of control’

Systemic risk in the superannuation system likely doesn’t stem from funds themselves, but from their service provider relationships. Regulators need to be thinking harder about where and how it arises – something they’re not necessarily well set up to do.

For a few months in 2022, the Australian financial press was briefly gripped by a wild interest in whether superannuation funds had become  “too big to fail” – systemically important institutions that, if they collapsed, would take other financial players (and millions of members) down with them.

The fact that super funds mostly pass investment risk onto their members was ignored, and the conversation perhaps obscured genuine systemic risks in the system. Because while the legal structures around super funds make it difficult for them to fail in a way that takes other institutions with them, many of them have common service provider relationships or rely heavily on one for multiple services – and those service providers likely are systemically important.

“It might be that one fund maybe can’t interact with other funds or market providers in ways that it thought it would be able to, and that might disrupt other processes,” UNSW associate professor Scott Donald tells ISN. “The transmission of risk can occur even when things that would appear at first blush not to be particularly germane go wrong.”

Donald uses the example of the 1997 Aisin Fire, which shut down a Toyota subsidiary that produced 99 per cent of the company’s brake fluid proportioning valves. Toyota’s factories only kept four-hour stocks of the part, and it was believed that car production would be halted for weeks. While the issue was resolved much more quickly than that, it highlights that the loss of something (relatively) small can cause big problems.  

“When you’re dealing with risk it’s a bit unruly; it doesn’t necessarily do what you want it to do… regulators have to be intellectually nimble.”

Scott Donald

“They had a dependency on a single provider and when that provider was no longer able to do what it needed to do, it caused the entire economic enterprise that was Toyota to struggle to perform.”

In a 2013 paper that Donald authored with Bruce Arnold, Hazel Bateman, Ross Buckley and Kevin Liu, the example was custodians and fund administrators, with a superannuation system that was at first glance large and ‘diverse’ actually highly concentrated in a small number of providers (it’s perhaps even more concentrated now given the exit of some custodians from the market since then).

And Donald says that there other “information sensitivities or dependencies” out there of equal importance. UniSuper’s issue with Google Cloud this week – though it (thankfully) hasn’t transmitted to other funds – goes some way to illustrating the potential problem, with 615,000 members left unable to access key aspects of their superannuation due to a “combination of rare issues at Google”.

“APRA is concerned about cyber risk, and my concern is that while cyber risk is important, there’s an assumption that the break has to be malicious and that’s a dangerous assumption,” Donald says. “It could be innocent; it could be that Telstra or Optus goes out for a day or two. What happens if they have an outage at 4:30 on the 30^th of June, and all of a sudden we can’t value securities at the close of business?”

That 2013 paper was written when AMP was still the largest super fund and AustralianSuper managed a piddly $65 billion. The fact that most funds are now much, much bigger compounds some of the problems.

“I’ve been concerned for a while about the move towards having a few absolutely enormous funds,” Donald said. “While it reduces the challenge of identifying who the funds are… if any one of them does get into trouble than there’s a lot of people effected. A number of funds now have two million members or thereabouts. It’s just a question of what you regard as a risk that you’re uncomfortable with.”

The illusion of control

But a risk won’t necessarily manifest in price volatility before it actually occurs, and Donald thinks prudential regulators need to think “more broadly” about how systems can cease to function.

“If I’m going to build a system of supervision based on portfolio holdings, I need to be alert to the fact that the portfolio holding at any particular moment might not be reflective of anything other than what they want to tell me.”

Regulators around the world have started to look more closely at risk management processes, policies and culture. But those are in some ways “harder to get your hands around” than numbers, and that’s a challenge for regulators with a preference for analysis that’s consistent, repeatable and objective.

“But when you’re dealing with risk it’s a bit unruly; it doesn’t necessarily do what you want it to do… regulators have to be intellectually nimble.”

For example, prudential regulators are focussed on strengthening climate risk reporting, but Donald’s concern is that “somebody, somewhere” concludes that’s all they need to do – and climate is a good example of a risk that has a lot of “underestimated or unanticipated” effects.

“Setting up your processes in such a way that you can identify those and then have the ability to respond to them is actually quite hard,” Donald says. “I’m not suggesting that any prudential regulator could ever aspire to do that perfectly.

“But there is a cultural issue within regulators about how they do that stuff and whether they’ve allocated enough resources to free thinking about what could happen here and how this system could break – rather than this highly modelled, highly structured process they all seem to instinctively gravitate towards.”