Insights. NAIC s ORSA. A Broader Approach to Regulation. NAIC S ORSA Part of a Global Shift to Regulatory Modernization

Transcription

1 Insights June 2011 NAIC s ORSA A Broader Approach to Regulation Broad regulatory changes are on the horizon for U.S. insurers. The National Association of Insurance Commissioners (NAIC s) Solvency Modernization Initiative (SMI) has increased the regulatory focus on insurer risk and capital management. One proposed component of the SMI the Own Risk and Solvency Assessment (ORSA) will require U.S. insurers to make a self-assessment of the capital available to support their business risks. ORSA will require insurer management teams to be much more deliberate and explicit in how they identify, measure and manage enterprise risks. The good news is that insurers have been investing in enterprise risk management (ERM) for several years. Insurers should expect that their ERM activities will provide a strong foundation for the development of ORSA procedures. That said, ORSA development will require management teams to invest additional time and money enhancing their enterprise risk, capital management and governance processes. NAIC S ORSA Part of a Global Shift to Regulatory Modernization The NAIC recently released a draft proposal for the creation of a U.S. ORSA process. The proposal requires insurers to complete an ORSA annually for each statutory entity, as well as at the insurance group level, and submit the results to state regulators. The results should demonstrate that each entity s capital both regulatory and economic is suffi cient to cover the risks inherent in the entity s business plan. Regulators will use this information to better understand the prospective risks to each insurer s plan and judge the adequacy of capital for the risks identifi ed. The ORSA proposal represents a broader and more prospective approach to U.S. insurance regulation. Historically, insurers managed to the highest and most demanding regulatory bar, which was typically set by rating agencies such as A.M. Best and Standard & Poor s (S&P), often viewed as de facto regulators. The NAIC s capital requirements were typically less than those of the rating agencies, using risk-based capital (RBC) formulas to assess insurer solvency. RBC has served the NAIC well for almost 20 years, but it is being eclipsed by more dynamic, forward-looking and comprehensive regulatory approaches. Solvency II, the regulatory regime that is being implemented in Europe, is the most prominent example of such an approach. It uses a three-pillared approach: quantitative capital (Pillar 1), governance and risk management (Pillar 2), and disclosure and transparency requirements (Pillar 3). As currently planned, all European Union-domiciled insurers will be subject to Solvency II requirements by January 2013 and will face an ORSA requirement under Pillar 2. Other jurisdictions, including Bermuda, Switzerland and Japan, are implementing similar changes to ensure regulatory equivalence with Solvency II. Further, the International Association of Insurance Supervisors (IAIS), consisting of insurance regulators from 190 jurisdictions around the world, has identifi ed a set of principle-based regulatory practices, which include enterprise risk and capital management and ORSA, as global best practices. The NAIC is moving in a similar direction. Its evolving SMI seeks to enhance the regulatory review of capital requirements, governance and risk management, group supervision, statutory accounting and fi nancial reporting, and reinsurance. As part of the SMI, the ORSA proposal outlines the NAIC s proposed approach to reviewing each insurer s governance and risk management framework. The good news is that insurers have been investing in enterprise risk management (ERM) for several years. Insurers should expect that their ERM activities will provide a strong foundation for the development of ORSA procedures.

2 Towers Watson believes that the SMI, including the adoption of ORSA, will accelerate over the coming years for several reasons. First, the NAIC recognizes that its existing tools are limited to assessing retrospective risks to insurer solvency. Work on SMI will address this limitation by examining global regulatory practices and identifying more powerful and prospective regulatory tools to strengthen the NAIC s toolbox. ORSA is one of these tools: It examines the risks associated with future business plans, rather than evaluating only risk associated with past performance (as RBC does). Clearly, ORSA will supplement the existing RBC review and provide regulators with a more dynamic view of each company s risk profi le. Regulators will be able to key in on each insurer s top risks and more effi ciently allocate resources to the most critical areas for regulatory review. Presumably, the SMI and the ORSA requirements will complement other forward-looking regulatory tools being implemented by the NAIC, including the newly implemented risk-focused exam and Form F enterprise risk reporting requirement of the Insurance Company System Regulatory Act. In addition to strengthening tools at home, the NAIC must ensure that the U.S. regulatory framework is deemed equivalent under Solvency II in Europe. Equivalence is important to the competitiveness of U.S. insurers doing business in the Europe Economic Area (EEA), particularly to ensure that capital add-ons or collateralization are not imposed as a result of being domiciled and regulated by a non-eea equivalent regulator. Switzerland and Bermuda are the fi rst two countries to be tested for full equivalency with Solvency II. Japan will be tested specifi cally for reinsurance equivalence. The U.S. was noticeably absent from this list. The NAIC s SMI and ORSA will aid in any future Solvency II equivalency reviews. Understanding ORSA The proposed ORSA requires an insurer to internally assess the suffi ciency of its capital to back the risks inherent in its business plan. It is a self graded exam, with the following key questions: What is our strategy? What level of risk are we willing to assume in pursuit of this strategy? What are the key risks that could hinder our ability to achieve our strategy? How much capital do we need to cover those key risks? What risks individually or collectively would subject us to losses that exceed our tolerance levels? What risk scenarios would cause us to fail or stop operating as a going concern? The proposed ORSA requires the insurer to demonstrate qualitatively and quantitatively its process for identifying, measuring, monitoring and managing all reasonably foreseeable and relevant material risks to the business strategy. A robust ORSA addresses current and prospective risks in fi ve key categories: underwriting, credit, market, operational and liquidity (Figure 1). It also identifi es and measures the risks associated with being a member of a larger insurance or non-insurance group. While at its core ORSA is a process, ensuring adequate documentation and reporting of ORSA is integral to its successful use by management and, from the NAIC s perspective, for regulatory supervision. The NAIC suggests that each insurer develop a formal risk policy as part of its ORSA. The policy would document the risk management approach and contain three distinct sections. Figure 1. How the ORSA fits within risk management Stress and scenario testing Link to business strategy Risk appetite Risk culture Monitoring and reporting Identify and assess risks Risk measurement 2 towerswatson.com

3 Section 1: Description of Risk Management Policy Under the proposal, Section 1 of ORSA details the amount of risk an insurer is willing to take to achieve its mission in the marketplace. It requires insurers to explicitly sketch out a three- to fi ve-year business plan and identify risks that could inhibit that plan. As part of this process, the NAIC proposal suggests that the insurer detail the following elements in Section 1: A list of all relevant and material risk categories Details on how risk categories are managed and monitored on a day-to-day basis Risk tolerance statements, including the link between risk tolerance and required economic and regulatory capital An investment policy that addresses credit, market, liquidity and counterparty risk An underwriting policy with a demonstrated link to product design and pricing Claim underwriting and processing policies showing how coverage terms are defi ned Anti-fraud policies in place to detect fraudulent claims Asset/liability management (ALM) activities with a demonstrated link to product development, pricing and investment management Any retention or conservation policies such as multiple-coverage discounts, extra interest credits or other policyholder options Description of any reinsurance counterparty credit risk measures Policies to identify, measure, manage and control risks associated with group membership Although many companies already have components of ORSA in place, we believe one of the major challenges will be joining these processes in a coherent manner. For example, companies typically establish risk identifi cation, measurement and reporting processes, but often these are not aligned. They will need to be part of ORSA development and refl ect use by multiple, geographically diverse stakeholders. It is therefore essential that the process is well understood and that communication between linked elements is clear, effi cient and timely. Finally, risk management policies and procedures will need to be clearly defi ned, documented, tested and updated on a regular basis. Section 2: Quantitative Measurement of Risk Exposure in Normal and Stressed Environments Section 2 of the proposed ORSA is designed to explain how the insurer quantifies the risks identified in Section 1 under normal and stressed scenarios. It suggests that the insurer document its measurement methodology for each key risk category, including credit, market, liquidity, cash-flow mismatch, underwriting, claims, expenses and operational risks associated with group membership. Additionally, the insurer should list each of the key assumptions that underlie these risk calculations. The NAIC states that quantitative risk measurement should incorporate a range of outcomes and use risk measurement techniques that are appropriate to the nature, scale and complexity of the risks. These statements are purposely open-ended and deliberately nonprescriptive. They allow the insurer to tailor its approach both scenarios considered and measurement methodologies used based on the unique risks in its business plan. So the ORSA approach will vary depending on the nature, complexity and scale of the risks inherent in the business. The NAIC has not provided explicit guidance on proportionality, the use of risk measuring tools that fit a firm s risk profile, or its expectations for different types or sizes of companies. Risk culture can be defined as the norms and traditions of behavior of individuals and of groups within an organization that determine the way in which they identify, understand, discuss and act on the risks the organization confronts and takes. towerswatson.com 3

4 That said, the NAIC s proposal does provide a generic matrix that shows how an insurer might list risk measurements for each key risk category. The matrix displays each risk category, shows the notional amount of exposure for each, and the expected payment amount required over a oneyear time horizon for both normal and stressed scenarios. In addition, the NAIC suggests that the insurer calculate a reverse stress test for each risk that will identify the level of stress that would cause the insurer to fail using its current level of economic capital. Towers Watson notes that a large portion of the U.S. insurance industry will benefit from investing time and money in quantitative risk modeling tools to meet the NAIC s suggested requirements. There is some debate over whether companies need to develop sophisticated measurement tools to satisfy the ORSA requirement. A proportional approach recommended in IAIS core principles suggests that the insurer employ methods that are appropriate for the fi rm s risk profi le. These methods may range from simple stress and scenario tests to economic capital modeling that vary in sophistication. In reality, the measurement methodology and projection capability is likely to be developed iteratively. The focus should be on building a measurement methodology consistent with the fi rm s culture and that is well understood by the insurer s management team. Towers Watson notes that a large portion of the U.S. insurance industry will benefi t from investing time and money in quantitative risk modeling tools to meet the NAIC s suggested requirements. A 2010 survey conducted by Towers Watson fi nds that only 49% of U.S. insurers have built and implemented economic capital models. While economic capital is not necessary for all risk calculations, we suggest that it is the most appropriate tool for measuring the risks inherent in an insurer s business plan and determining an appropriate level of capital to support such risks. Section 3: Prospective Solvency Assessment Section 3 of the proposed ORSA represents the integration of the fi rm s qualitative risk policies (Section 1) and quantitative measurement methodologies (Section 2). It should demonstrate how the policies and measurements, in combination, result in economic and regulatory capital that fully supports the risks inherent in a three-to-fi ve year business plan. Insurers with capital shortages measured by risk identifi ed must demonstrate how they will modify their three-to-fi ve year business plan to ensure adequate fi nancial capital. The link between business strategy and required capital is a key element of ORSA. For many companies, this link should build on existing capital management and budgeting processes. Typically, new business sales are examined under base, optimistic and pessimistic scenarios. As part of the business planning process, companies need to understand how these scenarios affect risk and associated capital requirements. For example, scenarios may help management decide if there is suffi cient capital to support organic growth under optimistic sales plans. Organizations contemplating major strategic acquisitions or divestments will need to look at the impact on their risk profi le and decide if the board s agreed appetite and tolerances are honored. Similarly, product pricing, design, risk transfer and ALM processes will need to be reviewed regularly to ensure consistency with risk appetite and capital constraints. Ultimately, the state regulator should be able to review all three sections of the insurer s risk policy and understand the link between risk policies, measurements, capital allocation and day-today operational decisions. This concept, known more commonly as the use test, has proved to be a challenge to demonstrate. In fact, a survey conducted by Towers Watson in 2010 found that only a small minority of European insurers feel that their internal risk models would meet the use test requirements under Solvency II. Numbers in the U.S. would likely be comparable or even lower given that the European industry has been working on these issues for a longer period. To foster use, an effective risk management policy must be technically sound and an effective communication tool. We feel there should be focus on developing a slim-line report for an organization s executive management team effectively a high- 4 towerswatson.com

5 level explanation of how risk is managed within the business. This report could follow a cascade structure and link to other significant documentation requirements that exist around public and supervisory reporting, internal models and internal requirements. The depth and breadth of ORSA documentation is likely to exceed most companies current output. Organizations of all sizes (especially groups) will be challenged because they have not typically been required to document risk identifi cation, measurement and management policies in such unifi ed and clear terms. ORSA Only a Starting Point The NAIC s ORSA proposal is the starting point for its approach to reviewing insurer governance and risk management practices. The proposal will be shaped over the next several years. It will incorporate industry feedback, new IAIS pronouncements, guidance from other regulatory jurisdictions (the European Insurance and Occupational Pensions Authority, the Bermuda Monetary Authority and the Offi ce of the Superintendent of Financial Institutions in Canada) and industry expertise offered by actuaries, accountants and risk managers. Towers Watson maintains that the NAIC s ORSA proposal needs to address several key elements before being fi nalized. These include: Confidentiality. How will the NAIC ensure that an insurer s highly proprietary strategy and risk management information remain safe and secure? Consistency. How will the NAIC guarantee that ORSA reviews are consistent across states (particularly for groups that maintain statutory entities in multiple states i.e., most of the industry)? Group versus statutory entity. How will the NAIC reconcile statutory and group-level ORSAs that are conducted in different states? Size threshold. Will ORSA apply uniformly across the industry? Or will there be tiered requirements based on company size and a phased rollout schedule? Group Solvency Issues (EX) Working Group (GSIWG) Timeline for ORSA Discussions June July August October November Extent to which current U.S. reporting requirements can meet any of the ORSA expectations ORSA proposal paragraphs 1 10 Introduction Solvency regime requirements Background Implementation authority Purpose ORSA proposal paragraphs U.S. ORSA requirements Section 1 Description of the Risk Management Policy ORSA proposal paragraphs Section 2 Quantitative Measurements of Risk Exposure in Normal and Stressed Environments ORSA proposal paragraphs Section 3 Prospective Solvency Assessment Other topics for discussion and follow-up on previous sections GSIWG National Meeting Review newly revised draft of ORSA proposal Revised Group Capital Assessment proposal GSIWG Public Hearing on ORSA Final edits before adoption SMI Task Force Receive and discuss proposal towerswatson.com 5

6 Role of board versus management. Will the NAIC change its ORSA wording to clarify that the board remains responsible for oversight, while management is responsible for ORSA execution? Regulatory input. What degree of input will state regulators have in company scenario testing and model calibration? Regulatory capital. Will ORSA be linked to a standard regulatory capital formula such as RBC? Will RBC change to refl ect more dynamic measurement approaches? Will the NAIC allow for the use of internal capital models in determining regulatory capital positions? A Road Map for Success Many companies will face considerable internal challenges for dedicated management time and buy-in to the new metrics and changes in processes that underlie ORSA. Success will depend on an early start and senior executives engagement in how ORSA can add value to business development. The sooner that the new approach filters into daily internal risk governance and risk reporting, the better the chance for a high level of engagement, a prerequisite for better embedding of risk management. We also recommend that insurers clearly defi ne roles and responsibilities for executing the ORSA action plan. Within the organization, ORSA will be a joint effort with some expected responsibilities from various stakeholders (Figure 2). Figure 2. Expected responsibilities from stakeholders Stakeholder Board/executive Risk management function Actuarial function/finance Strategy/treasury function External organizations/ internal audit Selected responsibilities Setting the overall business strategy and direction Setting risk appetite for the organization Engendering a positive risk culture, including incentive systems Appropriate governance, committee structure and escalation procedures such that risks are monitored and managed Agreeing to a business plan for the organization Engaging in stress tests, reverse stress tests and emerging risks Signing off various deliverables, including ORSA policy, ORSA report and other associated policies Producing the ORSA report slim-line document suitable for executives and board Translating risk appetite into more granular tolerance and risk limits Working with stakeholders to develop appropriate risk reporting templates Setting risk policies consistent with risk appetite Ensuring consistency among risk identification, measurement and reporting Managing scenario testing and reverse stress testing with input from other stakeholders Measuring and monitoring risk culture within the organization Documenting the process Working with stakeholders to develop appropriate risk reporting templates Developing tools to ensure appropriate risk measurement and monitoring including, where necessary, lite models such as replicating portfolios and curve fi tting Carrying out fi nancial projections to better understand the risk drivers during the business planning horizon Carrying out stress and scenario analysis Investigating risk/reward optimization Setting business and contingency plans Providing input on strategic direction Providing input on capital structure, including: Dividend plans Issuing/retiring of existing capital instruments Fungibility and transferability constraints Providing challenge, benchmarking and independent review Ensuring that there is an appropriate control framework in place for the process to be sufficiently robust Providing quality assurance 6 towerswatson.com

7 Companies should consider the following steps to successful ORSA compliance: Perform an ORSA gap analysis. Develop an ORSA policy. Develop the ORSA template as a slim-line document covering risk management for senior management. Refresh risk appetite within the organization. Translate risk appetite into more granular tolerances and limits for business use. Measure and benchmark the risk culture and degree of embedding within the organization. Ensure consistency among risk identifi cation, measurement and reporting exercises. Develop a pro forma risk dashboard for continuous solvency monitoring and management information. Develop internal stress and scenario tests (and reverse stress tests) at both the solo and group levels. Review mandates and delegation of authority for various risk committees within the organization. Link risk information into existing ALM, strategic decisions, pricing, product design and risk transfer strategy. Europe Preparing for ORSA As part of the pending Solvency II regulatory framework in Europe, European companies will also be required to perform an ORSA. While there are many similarities between the proposed ORSA for U.S. insurers developed by the NAIC and Solvency II s ORSA for European insurers, they are not identical. A copy of Towers Watson s Insights article on the ORSA requirements under Solvency II can be obtained from: towerswatson.com/united-kingdom/newsletters/solvency-ii/4254 A copy of the proposed NAIC ORSA may be obtained here: naic.org/documents/committees_ex_isftf_exposures_orsa.pdf Towers Watson will compare the two ORSAs in a subsequent article. Conduct board education and wider training regarding ORSA. Link existing documentation to support ORSA. Longer term, we expect ORSA will be a foundational element of the NAIC s Solvency Modernization Initiative. The signifi cant overlap between ORSA and ERM creates an opportunity for companies to embrace ORSA to gain business benefi ts from substantial investment in the new NAIC requirements. Companies need to be developing their ORSA approach now to ensure they realize these benefi ts. towerswatson.com 7

8 About the Authors Joseph Lebens is a director at Towers Watson who specializes in enterprise risk management issues and leads the company s economic capital initiative in North America for property & casualty insurers. For more information, please contact: joe.lebens@towerswatson.com Mark Scanlon is a senior consultant with Towers Watson who specializes in enterprise risk management issues and leads the company s economic capital initiative in North America for life insurers. For more information, please contact: mark.scanlon@towerswatson.com Anthony Shapella is a consultant with Towers Watson and specializes in strategic and competitive analysis, reinsurance market research, fi nancial statement analysis, and credit rating agency and enterprise risk management consulting. For more information, please contact: anthony.shapella@towerswatson.com About Towers Watson Towers Watson is a leading global professional services company that helps organizations improve performance through effective people, risk and financial management. With 14,000 associates around the world, we offer solutions in the areas of employee benefits, talent management, rewards, and risk and capital management. Copyright 2011 Towers Watson. All rights reserved. TW-NA towerswatson.com