Risk Management. Risk Opportunity. The 2006 Tillinghast ERM Survey

Transcription

1 Risk Management. Risk Opportunity. The 2006 Tillinghast ERM Survey An ERM Update on the Global Insurance Industry

2

3 The 2006 Tillinghast ERM Survey I 1 TABLE OF CONTENTS Foreword 2 Key Findings 3 About the Survey 4 Major Focus: Risk Measurement, Quantification 5 Who Is Responsible for Risk Management? 7 How Do Insurers Measure Risk? 9 Economic Capital Competence 11 Reporting on Risk 18 Decision Making 21 What Insurers Are and Are Not Satisfied With 22 The Impact of Solvency II on European Insurers 24 Conclusion 27 Appendix A: Survey Participants 28 Appendix B: Complete Survey Findings 30

4 2 I The 2006 Tillinghast ERM Survey FOREWORD It is clear that insurers now see ERM as a value-adding activity in its own right. An economist with a wry sense of humor once said that a certain developing country had a promising future and always would. His point, of course, was that the country had all of the ingredients necessary for success but somehow just couldn t put them together. There was a time when the same thing might have been said about enterprise risk management (ERM). Many of us can think back 10 years or so and recall our fascination with the very idea of ERM. On paper, it seemed to be the perfect approach for risk and capital management. Major financial institutions raced to grab the lead in ERM development, and words like convergence filled the air. Then reality hit. ERM s promise was never in serious doubt. But developing an effective enterprisewide approach proved to be far more challenging than expected. It required new investments in modeling and analytical capabilities, a different way of looking at risk and capital, and even cultural changes that would embed risk management in all facets of a corporation. Our 2006 survey of senior insurance industry executives shows beyond any question that the investments in ERM are paying off at companies around the world and that ERM is now an integral part of doing business. In fact, as our data show, an insurer that does not have a defined process for identifying, measuring and managing risk is among a very small minority. The evidence shows up in many ways including the growing sophistication of risk metrics and an even richer understanding of how insurance capital works with equity and debt. ERM s acceptance is also reflected in the way regulators and rating agencies expect insurers to apply its techniques for managing their business on a daily basis. For ERM, the future is now. In this report, we have supplemented statistical results with analysis and comments by industry practitioners as well as a number of my colleagues. I believe you will find their comments add richer insights to the findings. I especially want to thank the more than 200 executives who completed our online survey or who consented to individual interviews. Your opinions are invaluable and have added significantly to the industry s understanding of ERM and its applications. Sincerely, Prakash Shimpi ERM Practice Leader

5 The 2006 Tillinghast ERM Survey I 3 KEY FINDINGS Two years ago, insurance industry executives told us that enterprise risk management (ERM) had come of age; they recognized ERM as a legitimate strategic function and discipline. In our 2006 survey, it is clear that insurers now see ERM as a value-adding activity in its own right and part of the fundamental business processes of an efficient and well-managed insurance company. This progression in the status of ERM has been driven by several converging forces, including: increasingly rigorous and risk-based regulatory requirements more explicit and demanding rating agency criteria relentless shareholder demand for superior financial performance progress in the art and science of ERM. Our fourth survey of insurers risk and capital management practices affirms that ERM is now an integral part of doing business around the world. An insurer that does not have a defined process for identifying, measuring and managing risk is among a very small minority. There were several other significant global trends that emerged from the survey: Insurers are using increasingly sophisticated risk metrics though no single metric is favored. Almost two-thirds of survey respondents determine the impact of risk on their capital, value and earnings from at least three metrics, including statutory capital, GAAP/IAS earnings and economic or embedded value. Two-thirds of the insurance industry worldwide relies on economic capital (EC) as a risk quantification tool. This is up from just over half of respondents in our 2004 survey. Many who are not currently calculating EC are considering it. Insurers most frequently use EC for capital allocation and other strategic decision making and to measure riskadjusted performance. European insurers are bracing themselves for change. Nearly 90% of European insurers expect to upgrade their risk management capabilities as a result of Solvency II. Use of internal models for risk management and capital assessment is widely anticipated. However, there are mixed views as to Solvency II s impact on capital requirements. Insurers are not satisfied with their current risk and capital management efforts. More than three-quarters of respondents are not satisfied with their ability to quantify operational risks, and 71% are not satisfied with their ability to integrate risk considerations in performance measures. Eighty-nine percent of those who calculate EC are planning to make further improvements to the way they do it.* More than threequarters (77%) of respondents are concentrating their risk management efforts on improving risk measurement and quantification processes. Continuous improvement of risk and capital management capabilities is clearly an important issue for insurers and will continue to be as their risk and capital challenges evolve. Across the globe, the insurance industry still has some way to go but has made significant progress in embedding rigorous ERM processes in the way they conduct their business. *In this response, as with others throughout the survey, respondents were able to provide multiple answers to a single question. The data therefore may total more than 100%.

6 4 I The 2006 Tillinghast ERM Survey ABOUT THE SURVEY Nationwide sets its financial North Star around the creation of economic value. Michael Mahaffey, Nationwide Mutual Insurance Co. Chief risk officers, chief financial officers, chief actuaries and other senior executives representing more than 200 insurers and reinsurers participated in an extensive online survey during June and July To gain a richer understanding of the quantitative results, we supplemented the survey with insights obtained from a number of respondents and other industry executives as well as Tillinghast market leaders. Participants included many of the largest insurers with representation from more than half of the world s top 20 insurance companies. Nearly two-thirds of respondents had annual revenues in excess of $1 billion and nearly 20% in excess of $10 billion. Survey respondents included direct writers of life or property/casualty (P/C) insurance, multiline companies and reinsurers. The largest group of respondents was from public stock companies, although private companies, mutuals or mutual holding companies and fraternals were also represented. The bulk of participants (80%) was almost evenly split between North America and Europe, with another 16% representing the Asia/Pacific region and 4% from Latin America. Respondents generally hailed from the country in which their respective companies were headquartered. 0% Among respondents, two-thirds of their scope of operations were limited to one country, with 29% consisting of North American companies and 20% European (Exhibit 1). Twenty-seven percent of participants describe their companies as multinational, conducting business across multiple regions. EXHIBIT 1 The majority of respondents indicated their scope of operations is limited to one country (in percent) Limited to one country North America Limited to one country Europe Limited to one country Asia/Pacific 11 Limited to one country Latin America 2 Multicountry Europe 6 Multicountry North America 3 Multicountry Asia/Pacific 2 Multinational covering multiple regions 10% 20% 30% Base: Total respondents n = 204

7 The 2006 Tillinghast ERM Survey I 5 MAJOR FOCUS: RISK MEASUREMENT, QUANTIFICATION Insurers are squarely focused on improving their risk measurement and quantification processes to enhance their overall ERM efforts (Exhibit 2). Other highly ranked goals included better management of their risk profile and improved risk reporting. Almost 60% cited the importance of factoring risk management considerations into decision making. Michael Mahaffey, associate vice president of enterprise risk management at Nationwide Mutual Insurance Co., says, Nationwide sets its financial North Star around the creation of economic value. As part of our ERM efforts, we have calibrated our risk decision framework to align decision-making criteria with this governing objective. While this might be expected among larger insurers, this integration of ERM into decision making is being achieved by smaller companies, too. Randy Rotschafer, assistant vice president at Woodmen of the World Life Insurance Society, notes, We are using ERM to help management understand better how incremental returns are associated with degrees of risk. It is also beginning to be used to prioritize competing projects. Comparatively few respondents placed much significance on improved external communications or on the linkage between risk management and incentive compensation, although we anticipate this will change in the future. EXHIBIT 2 Risk management efforts continue to focus on improving risk measurement and quantification processes (in percent) 0% 20% 40% 60% 80% 100% Improving the risk measurement and quantification processes 77 Acting to manage the risk profile of your organization 64 Improving internal risk reporting processes 63 Ensuring that risk management considerations are explicitly factored into decision making 59 Improving the risk identification and prioritization processes 54 Establishing a risk framework and/or risk policy 53 Improving the education and internal communication of risk management principles and approach 46 Establishing a risk management organization and governance structure 42 Improving external communications 14 Incorporating risk management considerations into incentive compensation 8 Other 1 Base: Total respondents n = 204 There are interesting regional variations across these issues. Although more than three-quarters of respondents overall are concentrating risk management efforts on improving risk measurement and quantification processes, the focus was highest in the United Kingdom (97%) and Japan (95%).

8 6 I The 2006 Tillinghast ERM Survey For a chief risk officer, a reporting relationship to the CEO is a common critical success factor. Linda Chase-Jenkins, Towers Perrin In 2004, insurers were more focused on identifying their risks, with less emphasis on acting to manage these risks than they are today. This progression from risk identification to risk measurement and analysis to actively managing these risks is what might be expected as ERM practices mature. We re clearly seeing broader and more disciplined use of ERM, concludes Tricia Guinn, managing director of Towers Perrin s Tillinghast and Reinsurance businesses. Catastrophic events, the push for capital efficiency and competitive pressures are driving companies to a less seat of the pants approach to measuring and managing their risks. A significant majority of North American (91%), European (79%) and Latin American (78%) respondents attribute their risk management efforts to good business practice (Exhibit 3). Given the recent push by rating agencies to assess insurers risk management capabilities on an enterprise-wide basis, rating agency considerations are also seen as an important driver of risk management efforts. This is particularly true in North America (72%), where rating agency interest in risk management has grown significantly over the past two years. EXHIBIT 3 Good business practice is the principal driver of current risk management efforts for insurers globally (in percent) 0% 20% 40% 60% 80% 100% Good business practice 78 Rating agency considerations 55 Shareholder considerations 54 Changes in insurance solvency regulation 43 Competitive advantage 43 Sarbanes-Oxley or other regulatory considerations 28 Other 6 Base: Total respondents n = 204 Shareholder concerns are also strong motivators for public companies (72%). In Europe and Asia/Pacific, key drivers include changes or anticipated changes in insurance solvency regulations, such as Solvency II in the European Union. The U.K. already has strong risk-based regulatory requirements, introduced by the Financial Services Authority (FSA) in advance of Solvency II. Japan s Financial Supervisory Agency also requires the calculation of risk capital.

9 The 2006 Tillinghast ERM Survey I 7 WHO IS RESPONSIBLE FOR RISK MANAGEMENT? Larger insurers are far more likely to rely on chief risk officers (CROs) or risk management directors (RMDs) to be principally responsible for their risk management efforts. More than two-thirds of firms with assets of $50 billion or more reported having a CRO. About 40% of companies with assets of $1 billion to $49 billion reported having this position in their organization. For insurers with less than $1 billion in assets, only about one in 10 had a chief risk officer or equivalent in place. Overall, 43% of respondents had a CRO with primary responsibility for risk management, matching the results from our 2004 survey (Exhibit 4). These positions are more prevalent in insurance companies in Japan and Europe (with over half of respondents from these geographical regions having CROs or risk management directors), while only a third of insurers in North America have such executives. Eighteen percent of the respondents indicated that the chief financial officer or finance director has the main responsibility for risk management. Globally, public entities (52%) and multiline companies (51%) made greater use of a CRO or RMD. Forty-five percent of those responsible for risk management report directly to the CEO, with a further 24% reporting to the CFO (Exhibit 5). For a chief risk officer, a reporting relationship to the CEO is a common critical success factor, notes Linda Chase-Jenkins, a Towers Perrin principal. The CEO relationship more easily enables a CRO to rise above risk silos and to take a genuine enterprise approach to risk. EXHIBIT 4 The chief risk officer or risk management director is still the primary person responsible for risk management efforts (in percent) 0% 10% 20% 30% 40% 50% Chief risk officer or risk management director Chief financial officer or finance director 18 Risk management committee 16 Chief actuary 8 Head of internal audit 1 Other EXHIBIT 5 The person responsible for risk management most often reports to the CEO (in percent) 0% 10% 20% 30% 40% 50% CEO CFO or finance director Board of directors COO 4 Risk committee 4 Other Base: Total respondents n = 204 Base: Total respondents n = 204

10 8 I The 2006 Tillinghast ERM Survey The cross-functional risk committee is now an almost universal entity. THE GROWTH OF THE RISK COMMITTEE The cross-functional risk committee is now an almost universal entity. Eightyseven percent of insurers across the globe indicated that they had a risk committee or were considering creating one (Exhibit 6). This is up from 80% in Only 13% of the respondents were not considering the use of a crossfunctional risk committee. Asia/Pacific companies show the greatest level of commitment to the committee structure with responsibilities that can include aligning risk appetites and strategy; linking growth, risk and strategy; establishing consistent risk measures and limits; and advising on EC and capital allocation. EXHIBIT 6 The presence of a cross-functional risk management committee has increased Base: Total respondents n = % No, and not considering 19% No, but considering 68% Yes Public companies (78%) were much more likely to have a cross-functional risk committee than private companies (60%) or mutuals (56%).

11 The 2006 Tillinghast ERM Survey I 9 HOW DO INSURERS MEASURE RISK? Insurers approach the impact of risk on their capital, value and earnings from multiple perspectives, with 63% using at least three different assessment measures. In considering risk to the balance sheet (e.g., risk of insolvency, bond default), companies said they focus primarily on statutory capital and economic/embedded value. However, when considering risk to earnings (which might trigger significant loss of shareholder value), the focus is more on GAAP/IAS measures. Overall, 56% of insurers globally rely on statutory or regulatory capital and surplus (Exhibit 7), which was also the metric most frequently cited by participants in North America (70%) and the U.K. (67%). Economic value was cited by 42% and embedded value by 26%. Life insurers and multiline companies in North America (75% in each case) were more likely than their European counterparts (58% and 31%, respectively) to focus on statutory or regulatory capital and surplus. EXHIBIT 7 When measuring the impact of risk, statutory or regulatory capital and surplus is the financial measure most frequently cited (in percent) 0% 10% 20% 30% 40% 50% 60% Statutory or regulatory capital and surplus Economic value GAAP or IAS earnings Statutory or regulatory profits Embedded value Economic profit Ability to pay claims when due 15 Embedded value earnings 12 GAAP or IAS equity 11 Other 4 Base: Total respondents n =

12 10 I The 2006 Tillinghast ERM Survey Economic capital (EC) is rapidly becoming a universal risk management tool. When focusing on asset/liability management, duration is a universal yardstick. Life insurers (85%), multiline insurers (82%) and P/C insurers (80%) are all almost equally likely to use this metric. Asset concentration is also important, with 60% of respondents saying they capture it in managing asset/liability risk (Exhibit 8). Life insurers (66%) made greater use of asset concentration data than P/C insurers (59%) or multiline corporations (51%) globally. Value-at-risk and cash flow matching were also mentioned. EXHIBIT 8 Asset/liability duration is the most frequently used metric for managing asset/liability risk (in percent) 0% 20% 40% 60% 80% 100% Asset/liability durations Asset concentration Asset/liability convexities 36 Asset return over spread of liability 36 Asset duration vs. proxy benchmark 28 Asset/liabililty Greeks Other 16 Base: Total respondents n = 204

13 The 2006 Tillinghast ERM Survey I 11 ECONOMIC CAPITAL COMPETENCE Economic capital (EC) is rapidly becoming a universal risk management tool. What s more, our survey reveals that insurers are increasingly sophisticated in their approach to EC. Many have moved quickly to broaden their risk coverage, now including many risks that historically have been difficult to model. Having said that, most insurers are not yet satisfied with their current EC modeling processes, are looking to improve the way they calculate EC and see it as something that will need continuous improvement. This issue is particularly vexing as operations and business mix become more complex. In Japan, for example, the country s P/C insurers have significant life insurance subsidiaries and sell health-related products. Applying their EC models consistently to these very different businesses is a challenge. Almost two-thirds of all survey participants said that their organizations calculated EC this year (Exhibit 9). This increase from 53% in 2004 reflects comparatively new regulatory requirements in the U.K. and the implementation of many EC programs that were under consideration at the time of the last survey. The increase in use of EC in 2006 also encompasses some of the 28% of companies that were considering calculating EC in This year, a further 19% of the participants said that they are considering calculating EC. This suggests that by the time of the next survey, EC may well be close to a universally applied risk management tool. EXHIBIT 9 Globally, more insurers are calculating EC There were sharp global variations in the use of EC. Ninety percent of insurers in the U.K. said they calculate EC. This is not surprising, given the FSA s requirement for companies to perform an Individual Capital Assessment (effectively an EC calculation). Other strong responses came from Bermuda (89%) and the Asia/Pacific region (72%). EC currently is used less in the U.S. where there is less regulatory demand for the economic measures that are becoming commonplace in Europe and elsewhere. Stephen Lowe, a Towers Perrin managing director and leader of the firm s P/C insurance practice, notes that U.S. insurers tend to use regulatory or statutory capital benchmarks. However, he noted, EC measures have some inherent advantages that, over time, will drive broader use in the U.S. Other concerns arise as companies attempt to make use of their models in managing their business. You need to be convinced the model is fit for purpose before making changes to business practices, noted Peter Needleman, a Towers Perrin managing director and leader of the firm s life insurance practice. It can take a long time to get comfortable with the results. Base: Total respondents n = % No 19% Considering 65% Yes

14 12 I The 2006 Tillinghast ERM Survey As EC models become more advanced, companies are able to model more types of risks. On a global basis, life insurers are least likely to calculate EC (55%) vs. reinsurers (80%), multiline companies (72%) and P/C insurers (69%). Part of the disparity may be explained by the difficulty in applying stochastic modeling to some long-term life risks. It also happens that a large portion of life business is conducted by multiline insurers, who are more likely to calculate EC. For reasons mentioned earlier namely, a very different regulatory and legal environment fewer than half of North American life insurers (47%) calculate EC, while 61% of their European counterparts do so. CAPITAL ALLOCATION EC is largely seen as a strategic tool for insurers, with key drivers being the allocation of capital (56%) and the measurement of risk-adjusted performance (42%). The use of EC in strategic or tactical decision making (40%) also ranks high on the list of drivers (Exhibit 10). Eighty-eight percent of respondents from Bermuda cited capital allocation as an EC driver. Seventy-one percent of continental Europeans identified risk-adjusted performance, although 65% also cited capital allocation. Japanese insurers were the most likely to use EC as a strategic or tactical tool (64%). EXHIBIT 10 Capital allocation is a principal driver for calculating EC (in percent) 0% 10% 20% 30% 40% 50% 60% Allocation of capital Measure of risk-adjusted performance Making strategic or tactical decisions Product pricing and design/business mix Good business practice 24 Regulatory requirements 20 Rating agency considerations 20 Parent company requirement 20 Preparation for regulatory development 10 Shareholder reporting 8 Other 4 Base: Those that calculate EC n = 133 Worldwide, only 20% of insurers claimed that rating agency considerations were a top consideration for calculating EC although, as noted earlier, it is a significant driver for their overall risk management efforts. This percentage was higher in North America, with 36% of respondents mentioning rating agencies as key drivers for implementing EC, no doubt reflecting increasing rating agency focus on risk management and capital models

15 The 2006 Tillinghast ERM Survey I 13 STOCHASTIC APPROACH Most insurers are increasing the sophistication of their EC calculations, with 57% using stochastic approaches. Of these, two-thirds model each risk separately before statistically aggregating them, while a further one-third take their EC modeling one step further and are able to model multiple risks together (Exhibit 11). Insurers are gaining increasing insight into the critical aspects of risk modeling and developing strong enterprise-level modeling capabilities. As EC models become more advanced, companies are able to model more types of risks. For example, credit risks such as asset default and counterparty risks are modeled more frequently than indicated in our prior surveys. Steve Taylor-Gooby, Towers Perrin managing director of the firm s Tillinghast business, notes, By using more refined modeling systems and incorporating more types of risk in their models, companies are better able to demonstrate their ability to model, understand and manage their risks (including, critically, diversification effects) and hence to substantiate claims for lower capital requirements. EXHIBIT 11 Stochastic approaches and stress and scenario testing were the most frequent methodologies used in calculating EC (in percent) 0% 10% 20% 30% 40% 50% Stochastic approach each risk modeled separately, then stastistically aggregated 38 Stochastic approach mutiple risks modeled together 19 Stress and scenario testing Factor-based Other Base: Those that calculate EC n = Many companies find considerable merit in starting with a stress and scenario testing approach, which is significantly quicker to implement. Sue Kean, director of risk and capital integration at Aviva plc, noted, While we use a stochastic approach as the base engine for many purposes, our stress- and scenariobased group ICA assessment provides a clear view of risk drivers and is stronger in its ability to communicate risk issues to a wide audience. The companies most likely to use a stochastic approach, while modeling each risk separately, were those from the Asia/Pacific region (44%) and continental Europe (45%).

16 14 I The 2006 Tillinghast ERM Survey Many companies are turning to scenario analysis to identify and quantify operational risks. Fifty-six percent of the largest companies (those with more than $10 billion of annual revenues) use a stochastic approach that models each risk separately and then statistically aggregates the risks, compared to just 18% of companies with less than $1 billion of annual revenue. These smaller companies tended to use the simpler approach of stress and scenario testing (49%), while none of the larger companies reported using this method. Survey responses, adjusted to account for risks that are not applicable to a given respondent, indicated that almost all companies (97%) model interest rate risk, and most include equity (81%), asset default (80%) and counterparty risks (63%) (Exhibit 12). On the same basis as for market/credit risks, respondents reported including mortality (92%), lapse/surrender (84%), longevity (73%), expenses (73%) and morbidity (70%) in their EC modeling of life insurance risks (Exhibit 13). Fiftyeight percent reported including policyholder behavior risk in their modeling. Where these P/C risks were applicable, respondents most frequently reported modeling catastrophe (78%), reserving (78%) and pricing risks (74%). Other risks modeled include: expenses (53%); correlation of liability lines or concentration (49%); underwriting, new product or growth (36%); insurance cycle behavior (29%); liability links to economic conditions (25%); and policyholder behavior (9%) (Exhibit 14). EXHIBIT 12 Interest rate, equity and credit (asset default) risk were the market/credit risks most often included in EC calculations (in percent) 0% 20% 40% 60% 80% 100% Interest rate Equity Credit (asset default) Credit (counterparty) Property/real estate Currency Liquidity Other EXHIBIT 13 Mortality, lapse/surrender, longevity, expense and morbidity were the life insurance risks commonly included in EC calculations (in percent) 0% 20% 40% 60% 80% 100% Mortality Lapse/surrender Longevity Expenses Morbidity Policyholder behavior Other 7 9 Base: Those that calculate EC (percentages exclude Not Applicable) n = Base: Those that calculate EC (percentages exclude Not Applicable) n = 91

17 The 2006 Tillinghast ERM Survey I 15 These numbers confirm that companies are more competent at modeling risks for which there are well-established statistical data sources. Having said that, as ERM and EC modeling become an integral part of doing business, insurers have become more comfortable with their basic EC modeling processes and are beginning to develop ways of modeling more complex nonfinancial risks. For example, the majority of insurance companies now include operational risks in their EC calculations (Exhibit 15). These responses are significantly higher than in 2004 when fewer than half of respondents included event and business risks. However, as discussed later in this report, most respondents are not yet satisfied with their abilities to model these types of risks. Insurers have come to realize the potential impact that a single event such as a systems failure, security breach or a major failure in a business process (particularly for compliance) can have as much impact on their operations as exposure to financial risks. But operational risk management is often seen as a complicated and difficult ERM activity. In the absence of adequate data, traditional ways of quantifying risk, and indeed many advanced approaches, are not reliable. Many companies are now turning to scenario analysis to achieve meaningful and usable results. Over the next few years, operational risk modeling and operational risk management practices can be expected to steadily improve. EXHIBIT 14 The most common P/C insurance risks included in EC calculations were catastrophe, reserving and pricing (in percent) 0% 20% 40% 60% 80% 100% Catastrophe Reserving Pricing Expenses Correlation of liability lines or concentration Underwriting, new product or growth 36 Insurance cycle behavior EXHIBIT 15 Most insurers now include event and business operational risks in their EC calculations (in percent) 0% 20% 40% 60% 80% 100% Event Business Other Liability links to economic conditions 25 Policyholder behavior 9 Other 4 Base: Those that calculate EC (percentages exclude Not Applicable) n = Base: Those that calculate EC (percentages exclude Not Applicable) n = 105

18 16 I The 2006 Tillinghast ERM Survey Assessing economic capital over a one-year period is becoming the most widely accepted methodology. MEASUREMENT PERIOD The survey revealed that assessing economic capital over a one-year period is becoming the most widely accepted methodology. Fifty-six percent of respondents indicated that they measure EC over a 12-month duration, a sharp increase over 2004 when only 32% of respondents did so. Assessing risk over a two- to five-year period has decreased from 22% to 12% and the runoff-ofportfolio approach has declined from 29% to 14% since Looking at risk over a 12-month period is less complicated from a modeling perspective, and its increasing acceptance indicates that insurers are finding it useful. EXHIBIT 16 Almost half of the respondents use a correlation matrix for aggregating risk (in percent) 0% 20% 40% 60% 80% 100% Correlation matrix applied to risk capital results for each risk or business unit 46 Simple correlation of individual risk distributions to give combined direction 12 Copulas used to combine individual risk distributions 5 Structural model Other 7 None 8 22 Base: Those that calculate EC (percentages exclude Not Applicable) n = 129 CORRELATION MATRICES The most popular method for aggregating risk is a correlation matrix applied to risk capital results for each risk or business unit, with 46% of respondents saying this is the method they use (Exhibit 16).

19 The 2006 Tillinghast ERM Survey I 17 Globally, multiline companies (57%) and life insurers (52%) make more use of correlation matrices than P/C insurers (16%). In general, P/C insurers use structural models more than correlation matrices. Forty-eight percent of P/C insurers globally use structural models, while only 14% of multiline insurers and 13% of life insurers do. In this context, it is interesting to note that European companies (60%) use correlation matrices more frequently than North American companies (32%). CONTINUOUS IMPROVEMENT Eighty-nine percent of those participants that currently calculate EC plan to make further improvements. Participants in Asia/Pacific (96%) and Canada (100%), as well as North American life insurers (93%) and multiline companies in Europe (95%) in particular feel that they still need to improve the way they do EC modeling. Those companies that are planning to improve their ERM capabilities most want to improve their aggregation capabilities (70%) and application of EC modeling to their business (64%) (Exhibit 17). EXHIBIT 17 Almost all of the respondents that calculate EC are planning to make further improvements (in percent) 0% 20% 40% 60% 80% 100% Improving the aggregation capabilities Improving applications 64 Enhancing core methodology 56 Extending the risks covered 54 Improving internal reporting capabilities 53 Improving controls surrounding data and process 53 Increasing software modeling capabilities 52 Improving the understanding and buy-in of senior management 50 Increasing modeling capabilities and efficiency 38 Introducing or improving communication 31 Increasing hardware capacity 23 Other 2 Base: Those planning further improvements/enhancements to EC calculations/framework n =

20 18 I The 2006 Tillinghast ERM Survey REPORTING ON RISK Your risk reporting really can provide a value to the organization by showing who has a clear ownership of risk. Mary Gardner, Zurich North America The survey revealed that for the vast majority of insurers around the world, risk reporting is a regular activity. Nearly two-thirds of respondents formally report on risk to the board of directors at least quarterly. Risk reporting is not a trivial task; collating risk reports takes significant resources. Moreover, the increase in the frequency of reporting over the last two years indicates that companies continue to emphasize its importance, whether a larger or a smaller company. Reporting on risk is a universal concern. Woodmen s Randy Rotschafer notes, Our board expects practical risk measures, and we ve used ERM measures to inform them. It helps that ERM is not solely an actuarial or CRO thing for us. As a result, non-actuaries have been able to use our ERM results and measures to discuss their own concerns. Companies are reporting to senior management shareholders and regulators more frequently, and a majority of insurers around the world are reporting on risk issues to rating agencies at least annually. Ninety-two percent of respondents report on risk to their board of directors at least annually, up from 84% in 2004 (Exhibit 18). This is heading toward 100%, with the remaining 8% clear stragglers in the reporting arena. Multinational companies (70%) and public entities (71%) are more likely to report to the board at least quarterly. Bermudian (89%) and Canadian (82%) companies are more likely than U.S. or Asia/Pacific companies (53% each) to report to their boards quarterly. REPORTING TO SENIOR MANAGEMENT Four in 10 insurers (39%) report risk to senior management monthly, and another 35% report once a quarter (Exhibit 19). Clearly, reporting on risk management activity is an integral part of doing business for insurers. EXHIBIT 18 Most respondents report on risk to their board of directors at least annually (in percent) 0% 10% 20% 30% 40% 50% 60% Once a month Once a quarter Twice a year Once every year Other 1 Do not formally report 8 15 Base: Total respondents n = 204 EXHIBIT 19 Reporting to senior management is provided more frequently, with almost 40% of respondents reporting risk monthly (in percent) 0% 10% 20% 30% 40% 50% 60% Once a month Once a quarter Twice a year 8 Once every year 6 Other 5 Do not formally report Base: Total respondents n = 204

21 The 2006 Tillinghast ERM Survey I 19 Mary Gardner, vice president, risk management, Zurich North America, recently noted, Your risk reporting really can provide a value to the organization by showing who has a clear ownership of risk. It s not just your risk management department. In general, European life insurers (65%) and P/C insurers (60%) are twice as likely to report risk to senior management on a monthly basis than their North American counterparts (31% respectively). REPORTING TO SHAREHOLDERS Reporting to shareholders is an equally important part of doing business. More than a quarter of respondents report to shareholders annually and 18% report quarterly (Exhibit 20). A high proportion of respondents said they do not formally report to shareholders; however, many of these respondents are mutual insurers, to whom this question does not apply. REPORTING TO REGULATORS AND RATING AGENCIES Almost two-thirds (62%) of participants cited they formally report on risk to regulators, with 32% saying they report annually and 18% quarterly (Exhibit 21). Quarterly reporting is more common among European and Asia/Pacific respondents (22%), compared to just 13% of North American insurers. Reporting to rating agencies is as common an activity as reporting to regulators, with 63% of respondents worldwide saying they report at least annually to the rating agencies. Again, there were EXHIBIT 20 Most respondents report on risk to shareholders at least annually (in percent) 0% 10% 20% 30% 40% 50% 60% Once a month 4 Once a quarter Twice a year 8 Once every year Other 4 Do not formally report Base: Total respondents n = EXHIBIT 21 Almost two-thirds of respondents formally report their risk management practices to rating agencies (in percent) Once a month 0 Once a quarter 6 Twice a year 6 Once every year Other 3 Do not formally report 27 0% 10% 20% 30% 40% 50% 60% Base: Total respondents n =

22 20 I The 2006 Tillinghast ERM Survey The use of risk and capital models is primarily focused on asset and investment strategies. significant regional variations. Criteria applied by U.S.-based rating agencies increasingly include ERM features. Evaluation components listed by Standard & Poor s, for example, include an assessment of risk management culture in addition to risk controls, risk and capital models and strategic risk management.* As a consequence, more than 75% of U.S. insurers report to rating agencies, including virtually all public companies. Naturally, the proportion of companies that does not report to rating agencies is much higher among private companies (57%) than it is among public companies (21%) and mutuals (36%). INTERNAL AND EXTERNAL COMMUNICATION OF RISK While most insurers provide regular risk reports to their executive committee or board of directors, many also use risk information to communicate internally on an ad hoc basis. Fewer insurers are using the more sophisticated internal communication tools such as risk dashboards, although multiline insurers (41%), life insurers (32%) and reinsurers (28%) were more likely to use a risk dashboard than P/C insurers (10%) (Exhibit 22). Insurers indicated that they also provide risk information to investors and regulators in their annual reports (45%) (Exhibit 23). PartnerRe s board receives a quarterly update on key assumed risks using a risk dashboard that allows the board to monitor risk exposures against the company risk appetite as approved by the board, according to Costas Miranthis, chief actuarial officer. EXHIBIT 22 Internal communication of key risk exposures and risk management activities is a major focus (in percent) 0% 20% 40% 60% 80% 100% Regular reports to executive committee/board of directors On an ad hoc, as-needed basis Regular reports to CRO Risk dashboards at the risk category, business or corporate level 29 Regulatory reporting formats 25 Other 4 Base: Total respondents n = EXHIBIT 23 Communication of key risk exposures and risk management activities to external groups is also a major activity (in percent) 0% 20% 40% 60% 80% 100% Provide separate information to rating agencies Separate section devoted to risk management in annual report 45 Provide supplementary information to regulators 32 Use regulatory reporting formats 31 Provide separate information to financial analysts 18 Do not externally communicate with stakeholders 14 Hold focus groups with key customers/suppliers/community 3 Other 4 Base: Total respondents n = * Insurance Criteria: Refining the Focus of Insurer Enterprise Risk Management Criteria, Standard & Poor s, June 2, 2006

23 The 2006 Tillinghast ERM Survey I 21 DECISION MAKING Our survey suggests that ERM is becoming an integral part of strategic planning as well as business planning, reinsurance purchasing, and product design and pricing. However, the use of risk and capital models is primarily focused on asset and investment strategies. Tom Wilson, president and COO, The Allstate Corporation, says, It has helped us optimally structure our investment portfolio. We do sound asset/liability modeling now, but I believe there are opportunities for us to identify ways of intelligently taking on more risk. * Seventy-one percent of respondents currently use risk and capital management models for asset/investment strategy decision making, with an additional 21% planning to do this in the next 24 months (Exhibit 24). In 2004, 67% of respondents indicated that they used risk and capital management models in investment planning, with a further 19% planning to use them by now. Within two years, if current trends continue, insurers that have not integrated ERM modeling into their core business processes will be very much in the minority. Having said that, managers currently are not being compensated based on their risk management performance. Only 20% of companies indicate that performance targets for compensation include risk-based or EC, the same as in 2004 (Exhibit 25). There are signs, however, that executive compensation will be more closely linked to risk management measures in the future, with more than a third (35%) saying that it is being considered in their firm. Scott Cochran, RGA Reinsurance Company executive, recently said that management bonuses in his firm have been tied to their EC results since EXHIBIT 24 A strong majority are using or plan to use risk and capital management models to make asset/investment strategy decisions (in percent) 0% 20% 40% 60% 80% 100% Asset/investment strategy Annual business planning Reinsurance purchasing Strategic planning process Product design and pricing M&A and divestiture Currently using Plan to use in next 24 months Do not use and have no future plans to use Base: Total respondents n = 204 EXHIBIT 25 Despite the extent of risk management activity, almost two-thirds of the respondents are not currently linking management compensation to the results (in percent) 0% 10% 20% 30% 40% 50% Performance targets include return on risk-based or EC 20 Performance targets include increase of risk-adjusted value measure 10 Breach of risk guidelines attracts a penalty 9 Other 5 Not incorporated yet but are considering Not applicable (i.e., no incentive compensation) Base: Total respondents n = * Allstate: An ERM Case Study, The Allstate Corporation and Towers Perrin, 2006

24 22 I The 2006 Tillinghast ERM Survey WHAT INSURERS ARE AND ARE NOT SATISFIED WITH It is...important to give operating units a capital incentive to manage op risks. John C.R. Hele, ING Group On the whole, insurers are not satisfied with their current capabilities in many risk management areas they see as important. They are most confident in their asset liability management capabilities, and their ability to apply risk transfer techniques and to manage and mitigate important risks (Exhibit 26). On the flip side, they are significantly dissatisfied with their ability to quantify operational risks. This is no surprise to John C.R. Hele, deputy CFO of ING Group, who notes that the problem is shared by banks as well as insurance companies. You have to come up with a quantitative approach and work with it, he said. It is also important to give operating units a capital incentive to manage op risk. EXHIBIT 26 Respondents view the following risk management capabilities as important for insurers, but are dissatisfied with their current capabilities to execute on the majority of them (in percent) 0% 20% 40% 60% 80% 100% Your asset liability management process n = 199 Your ability to apply risk transfer techniques n = Your ability to manage and mitigate important risks n = Your ability to identify and prioritize risks n = Your ability to monitor key risk exposures n = That you have clear accountability assigned for key risk processes n = Your ability to allow for risk in your decision making n = The quality and frequency of your internal risk reporting n = Considered important and satisfied with current capabilities Considered important but not satisfied with current capabilities Not considered important Base: Total respondents (percentages exclude Not Applicable)

25 The 2006 Tillinghast ERM Survey I 23 Respondents were also dissatisfied with the links between performance and risks (Exhibit 27), which require rigorous assessment and measures that have yet to be fully addressed in the evolving ERM metrics. North American insurers in particular are most satisfied with their asset/ liability management capabilities (68%) and risk transfer techniques (69%). All respondents consider the ability to identify and prioritize risk as well as monitor key risk exposures important, although only half were satisfied with their capabilities in these areas. EXHIBIT 27 Companies are least satisfied with their ability to quantify operational risks or reflect risk in performance measures (in percent) 0% 20% 40% 60% 80% 100% The quality of your external risk reporting n = That you have a coherent framework to guide the above activities n = Your ability to accurately measure EC n = Your ability to model the impact of the risks n = Your ability to aggregate risks across risk categories or business n = Your ability to set risk-based target returns n = The extent to which your performance measures reflect risk considerations n = Your ability to quantify operational risks n = Considered important and satisfied with current capabilities Considered important but not satisfied with current capabilities Not considered important 1 Base: Total respondents (percentages exclude Not Applicable)

26 24 I The 2006 Tillinghast ERM Survey THE IMPACT OF SOLVENCY II ON EUROPEAN INSURERS U.K. insurers clearly feel better placed...in advance of Solvency II. Ian Farr, Towers Perrin Solvency II is now taking clearer shape. There is an emerging consensus among European insurers that the new requirements will have significant implications for their capital structure, the business they write and how they undertake risk management. The impact on overall capital requirements remains, however, difficult to predict as no definitive parameters have been set for the standard approach to calculating the solvency capital requirement. The more sophisticated companies are already several years into the process of building internal models to manage risk and calculate capital requirements, according to Ian Farr, Towers Perrin principal. Others had been hoping to use a standard approach, but there is an increasing concern that this might require excessive capital. Regardless of any regional differences, European insurers agree that they will need to make significant improvements to their risk management capabilities under the new Solvency II regime. The most frequently cited action is the enhancement of risk quantification skills, closely followed by the need to improve actuarial and accounting tools. Perhaps more challenging will be improving risk governance, clearly defining risk appetite and embedding risk management across their businesses, all of which attracted frequent mention (Exhibit 28). Results nevertheless differ markedly between the U.K. and continental Europe, with U.K. respondents generally anticipating that the new European regulations will have fewer implications. For example, 76% of continental European respondents indicated a need to enhance their risk quantification capabilities, compared to only 41% of U.K. respondents. Similarly, only 19% of U.K. insurers think they will need to enhance their risk governance and organization, compared to 61% among continental European respondents. Finally, only 15% of U.K. respondents see a need to improve their risk identification capabilities, compared to 52% in continental Europe. Farr added, U.K. insurers clearly feel better placed as a result of the regulatory changes introduced by the FSA in advance of Solvency II. Their focus has moved away from the core risk governance and risk identification capabilities, with attention now directed more towards embedding risk management in the business and developing actuarial/accounting tools to suit the new environment. EXHIBIT 28 Enhancing risk quantification capabilities is the most frequently cited action European companies feel a need to take as a result of Solvency II (in percent) 0% 20% 40% 60% 80% 100% Enhance risk quantification capabilities Enhance actuarial/accounting tools Embed risk management within the whole organization 52 Clearly define risk appetite Upgrade risk management governance and organization structure 47 Enhance risk identification capabilities 40 None of the above 13 Base: European insurers n =