Thoughts on Risk Management Gone Wrong

Transcription

1 Thoughts on Risk Management Gone Wrong Canadian Life and Health Insurance Association 2013 Joint Compliance and Consumer Complaints Officers Annual Conference Vancouver, May 8 10, 2013 Stuart Carruthers Stikeman Elliott LLP, Toronto

2 Overview 1. What are the types or phases of material risk? 2. How do legal and compliance work together in managing material risk? 3. What are the implications for reputational risk when risk management goes wrong? 4. What can we learn from the mistakes of others? 5. Where do regulators fit in? 6. What material risk issues are on the horizon? 7. Opportunity for discussion SLIDE 1

3 1. Types or phases of material risk Good overview in OSFI s Supervisory Framework Appendix A Inherent Risk Categories, and in OSFI s Draft ORSA Guideline Appendix I Risks and Risk Considerations Also risk factors disclosures of public companies Credit risk (counterparty risk) Market/Investment/Liquidity risk (changes in market rates, prices or liquidity) Insurance risk (amounts and timing of payments/receipts (claims frequency/severity and administration costs)) Product design Product pricing Underwriting and claims adjudication/processing Reinsurance Reserving SLIDE 2

4 1. Types or phases of material risk (Cont d) Operational risk Selling practices Breakdowns in transaction processing Fraud Physical security Data/information security Business continuity Money laundering and terrorist financing Modeling Outsourcing Judicial interpretations Catastrophes Loss of key employees SLIDE 3

5 1. Types or phases of material risk (Cont d) Tax risks Regulatory compliance risk Strategic risk Ratings risk SLIDE 4

6 2. How do legal and compliance work together? Ideally, in coordination with each other? Legal: stewardship; Compliance: operational implementation?? Compliance: prevention; Legal: problem mitigation? What is your organization s structure? Compliance reports to legal? Do you have a Chief Risk Officer role/structure? dedicated Board Risk Committee? formal Risk Appetite Framework (OSFI Corporate Governance Guideline, Annex B)? How international is your business? What is your organization s culture? How risky are your products and distribution structure? Are you innovators or careful followers? SLIDE 5

7 3. Implications for reputation management when things go wrong Reputational Impact Negative publicity Board and management distraction Impact of social media Cost to rebuild goodwill Hard costs of fines, sanctions Restrictions on business/operations Innovation paralysis SLIDE 6

8 4. What can we learn from the mistakes of others? Lots of recent teachable moments (corruption and bribery; moneylaundering; sanctions violations; conspiracy (LIBOR fixing); tax evasion; unfair treatment of customers (US sub-prime mortgages; UK Payment Protection Insurance)) Promontory Sightlines In Focus Article March, 2013 Common Breakdowns in Risk Management COMMON RISK-MANAGEMENT MISTAKES Failing to regard risk management as a toptier discipline Inadequate staffing in risk-management functions Weak and inadequate risk data and information Ignoring warnings about potential problems Inattention to potential risk accretion at high-volume businesses perceived as low risk Inadequate due diligence on vendors and third parties Disregarding lessons that can be learned from peers experiences Not holding all employees responsible for ethical behavior SLIDE 7

9 5. Where do regulators fit in? Everywhere Prevention OSFI Supervisory Framework, Corporate Governance Guideline and June 2005 Reputation Risk Practices Note Punishment International Coordination Making your regulators part of your solution, not part of your problem Get to know your regulators now and well Is the class action bar the real regulator? SLIDE 8

10 6. What material risks are on the horizon? Distribution risks Distributor fiduciary obligations Product risks Over-complexity Products which are unconscionably profitable to insurers and distributors Unethical practices Anything that seems unfair, effectively is and will likely result in class action litigation Systems/IT risks Disruption of service Privacy breaches Regulatory complexity/overkill Stikeman Elliott s new Canadian regulatory regime map SLIDE 9

11 7. Opportunity for Discussion SLIDE 10

12 For further information Stuart Carruthers, Stikeman Elliott LLP, Toronto