WHITE PAPER. Solvency II Compliance and beyond: Title The essential steps for insurance firms

Transcription

1 WHITE PAPER Solvency II Compliance and beyond: Title The essential steps for insurance firms

2 ii Contents Introduction... 1 Step 1 Data Management... 1 Step 2 Risk Calculations... 3 Solvency Capital Requirement (SCR)...3 Minimum Capital Requirement (MCR)...4 Step 3 ORSA... 4 Step 4 Reporting... 4 Solvency and Financial Condition Report (SFCR)...4 Regular Supervisory Report (RSR)...5 Quantitative Reporting Templates (QRT)...6 Solvency II Compliance and Beyond... 7 How SAS Can Help... 8 SAS Firmwide Risk for Solvency II...8 SAS Capital Planning and Management...8 SAS Model Risk Management...8 Conclusion... 8

3 1 Introduction The largest transformation of European insurance legislation to date, Solvency II, took effect on Jan. 1, Designed to introduce a harmonized, EU-wide insurance regulatory regime to protect policyholders and minimize market disruption, the legislation sets stronger requirements for capital adequacy, risk management and disclosure. The challenges of meeting Solvency II requirements have been incredibly complex, regardless of whether insurers are using their own internal capital model or the Solvency II standard formula. Embedding new solvency capital models, data management processes and reporting systems into day-to-day business, across multiple business lines and subsidiaries, is a complicated and sophisticated task. Ensuring Solvency II compliance has been a long and difficult journey for many insurance companies. However, simply adhering to Solvency II shouldn t be viewed as the finishing line. In fact, it s just the first step of a journey toward a comprehensive risk management destination. This white paper maps out the essential steps that insurance companies need to complete to ensure Solvency II compliance and beyond with the ability to support enterprise risk management. Step 1 Data Management Data management or more precisely, managing the quality and consistency of data is fundamental to Solvency II compliance. The directive requires data to be accurate, traceable, timely and consistent across actuarial, risk and financial functions. For many insurance companies, the mix of different legacy systems has led to disjointed data, posing a serious challenge to data reconciliation. Data quality is paramount for any system that operates for the sole purpose of producing valuable business information. No insurance company can be sure that its economic and/or regulatory capital calculations are accurate and reliable if the supporting data is not cleansed and validated according to defined business rules. Hence insurers need to build flexible IT platforms and data management frameworks that both enable them to be compliant now and provide a solid foundation for future innovation. To support a repeatable data management process for Solvency II and enterprise risk management, we recommend that insurers follow these six distinct stages, run iteratively and often. Embedding new solvency capital models, data management processes and reporting systems into day-to-day business, across multiple business lines and subsidiaries, is a complicated and sophisticated task.

4 2 Plan Stage 1 Define the Solvency II business terms and identify the required data sources. Stage 2 Conduct data profiling to discover what your current data contains. Act Stage 3 Design business rules for checking your data to ensure it is valid and complete. Stage 4 Execute these business rules and data quality services by embedding them into your operational systems and monitor what is happening as they are executed. Monitor Stage 5 Measure and monitor the actual state of your data against what is expected and how it trends over time. Trigger tasks to improve your data as needed. Stage 6 Make the required updates and improvements to your data, systems and processes to make things better. Plan Business Owner and Data Integration Expert Data Quality Analyst Define the Solvency II business terms and sources. Discover what the data contains by profiling to understand actual data quality issues. Control Define Act Business Owner and Data Quality Analyst Data Integration Expert Monitor Design business rules to check data and design and use data quality services to improve data. Embed the data quality services and business rule monitoring into your operational systems and data integration processes. Evaluate Monitor Act Plan Discover Data Steward and Business Owner Measure and monitor actual vs. expected, track trends, allocate tasks and publish data quality measurements. Execute Design Data Integration Expert and Data Quality Analyst Remediate and update systems and processes. Figure 1: Solvency II data management process. An essential component of Solvency II and other risk management legislations is traceability of the data. However, a fully auditable end-to-end process is a challenge. Your insurance company needs to assemble a solid IT infrastructure that enables users to quickly see and understand how data was acquired, transformed, integrated and used within the risk calculations and reports. This is critical, especially when working with auditors and regulatory bodies who want to see the process, not just the final result. A good data management strategy is a prerequisite for meeting Solvency II regulations. However, an excellent strategy not only ensures Solvency II compliance, it can help increase risk awareness and improve confidence in the financial stability of any insurance organization.

5 3 Solvency II Qualitative Requirements and Regulation 1 Quantitative Requirements 2 3 Market Discipline and Transparency Market Value of Assets Free Assets Capital Requirement (SCR/MCR) Technical Provisions Market Risk Default Risk Operational Risk Underwriting Risk Decision Making and Strategy Reporting and Monitoring Approach Risk Identification and Assessment Risk Mitigation and Control Standard Model Approach Internal Models Group Solvency ORSA Process Capital Planning Risk Management Processes Risk Governance, Compliance Groupwide Reporting External & Internal Reporting Requirements SFCR, RSR, QRT Figure 2: Solvency II three-pillar structure. Step 2 Risk Calculations Measuring and managing all types of material risks is not just about regulatory compliance; it also informs business strategy, planning and operational decision making. In the past, insurers have used numerous, separate actuarial models to calculate capital requirements and project cash flow for individual products or subsidiaries. This siloed approach has meant that balance sheets and therefore regulatory capital have not always truly reflected all of the risk undertaken by the business such as market, credit, underwriting, liquidity and operational risk. Solvency II uses a three-pillar structure that covers both quantitative elements and qualitative aspects that influence the risk standing of an insurer. Pillar 1 outlines the quantitative requirements; Pillar 2, the supervisory activities; and Pillar 3 the reporting and public disclosure requirements. The quantitative requirements (Pillar 1) of the Solvency II legislation define two key risk measures: solvency capital requirement and minimum capital requirement. Solvency Capital Requirement (SCR) This risk-based capital requirement guarantees the minimum capital required to maintain appropriate policyholder protection and is a key solvency control level. The SCR reflects a level of capital that enables an insurer to absorb significant unforeseen losses. When an insurer does not meet the SCR, it will be required to increase the amount of capital necessary to cover the SCR based on a definitive and realizable plan, approved by the insurer s supervisor.

6 4 Minimum Capital Requirement (MCR) The MCR indicates a level of capital below which ultimate supervisory action is initiated if an attempted recovery has been deemed unsuccessful. This action may result either in closing the insurer to new business and runoff of the existing book of business, or transferring the portfolio to another insurance company. The MCR is calculated quarterly, and the confidence levels are set between 25 percent and 45 percent of the SCR. Insurers must develop a central risk calculation engine that will analyze risks and calculate capital requirements in line with both Solvency II and company strategy, taking into account all quantifiable risks that an insurer may encounter, including underwriting risk, market risk, credit risk, liquidity risk and operational risk. Step 3 ORSA Own Risk and Solvency Assessment (ORSA) is aimed at enhancing insurer awareness and understanding significant risks and interdependencies, as well as the impact of these risks on each company s available capital and its own view of capital needs. One of the key requirements of ORSA is that companies conduct an annual forwardlooking assessment. The result is a report that includes all material risks to which the insurer is exposed or may be exposed to in the future (e.g., emerging risks ), and that it must manage to arrive at its appropriate risk profile and risk appetite. The goal is not only to demonstrate that the company s current capital needs are appropriate, but also that its future capital needs will be met over a specified assessment time frame (usually three to five years). The report also allows regulators to get an enhanced view of an insurer s ability to withstand financial stress. Many industry leaders consider Solvency II and ORSA to be transformational for the insurance industry, as these regulations represent an opportunity for insurance companies to demonstrate that they fully understand their own risk exposures, covering both their assets and liabilities. Step 4 Reporting For many insurers, reporting is the final hurdle to Solvency II compliance and could be considered the most important because insurers are under pressure to increase the quantity and quality of board-level reporting. Greater transparency, through public disclosure and reporting requirements, is one of the central foundations of Solvency II. Insurers are expected to produce more reports than ever such as capital calculation and risk management results quarterly and annually, for internal, regulatory and market scrutiny. The reporting requirements are detailed in Pillar 3 of the Solvency II Directive. Essentially, they comprise three main components described below. Solvency and Financial Condition Report (SFCR) This publicly available report is produced annually containing qualitative and quantitative information. The purpose of the SFCR is to ensure a minimum standard of disclosure, leading to greater transparency not only for policyholders, but also for investors, intermediaries and other interested third parties. This report must be approved by the

7 5 Figure 3: ORSA reporting dashboard. insurer s management board and should be made available electronically. The information and format required for the SFCR is standardized to make it easier for supervisors, policyholders and other third parties to compare one insurer with another, improving market transparency. Regular Supervisory Report (RSR) This is a private report that is communicated only to the insurer s appropriate supervisor. The RSR expands on the SFCR s disclosures using a similar, prescribed structure, but this time presenting the information differently as part of the ongoing supervisory dialogue with the insurer. The Solvency II Directive stipulates that the RSR must be produced every three years, but at supervisory discretion, may be produced as often as annually. The RSR requires information relating to the following areas, which are not required in the SFCR: The business and risk strategies, including the insurer s continuity plan. Legal and regulatory issues affecting the insurer. Variance against plan rather than prior reporting period. Future anticipated solvency needs, underwriting performance projections and changes in risk exposure. Significant additional disclosure explaining the results of the internal models.

8 6 Figure 4: Regulatory reports (QRT) and validation. Quantitative Reporting Templates (QRT) Based on the EIOPA taxonomy, insurers have to adhere to 182 quantitative reporting templates (QRTs) for various submissions (annual, quarterly, solo, group), resulting in more than 500 reports. These reports cover the many different aspects of Solvency II from minimum capital requirement, solvency capital requirement, technical provisions, to assets and own funds. In addition, the regulations stipulate that reports are created, approved by senior management and available electronically over shorter time periods. Initially the reports must be made available within 10 weeks after the end of the reporting period, reducing to six weeks within a few years. As a general rule EIOPA plans one taxonomy release per year and aims to minimize the number of taxonomy publications. However, while it is expected that in regular years (most of the years) only one taxonomy release will occur, the Data Point Model and the XBRL taxonomy are planned to be updated up to twice a year. Managing separate reporting systems for regulatory, financial and management purposes will not be practical or cost-efficient, especially If some of the results need to be reconciled (i.e., with IFRS). Insurers must save time and money by integrating their existing reporting system with their Solvency II implementations to produce consistent, timely and relevant information for all stakeholders. And while running the daily business optimally, upcoming financial standards, future regulations and regulatory updates will also need to be considered in order not to disrupt any execution of the business strategies.

9 7 Solvency II Compliance and Beyond Solvency II compliance is not the end of the process; in fact, it s simply starting. Insurance companies will begin to look beyond Solvency II, invest in enterprise-class technology and integrate risk management within their core business processes. These insurers can expect significant business benefits. For example, this technology approach enables insurance executives to gain knowledge and feed it into their decision-making processes for more efficient business strategies and operations. You can expect to: Increase return on capital. Optimizing business strategies on the basis of the riskcapital-return tradeoff leads to selection of most suitable strategies. As an insurer, you can also better allocate capital to profitable business, which leads to betterquality growth. And lastly, you can reallocate capital and risk capacity to take advantage of emerging opportunities. Reduce volatility. Ongoing monitoring of risks and active management of those risks will help reduce volatility. For example, proactive management of risk exposures helps your company carefully select risks that are within the appetite of management. You can also better anticipate risks using forward-looking analyses and take steps to mitigate unwanted risks. Ultimately, understanding how economic risk factors affect the balance sheet results in better risk management actions. Achieve better management of risks and allocation of risk-based capital charges for lower premiums and higher sales. Optimization of your investment strategy results in better investment performance and higher returns to policyholders. At the same time, hedging investment and insurance risks leads to better performance. In addition to Solvency II, another directive will change the face of the insurance industry IFRS 4 Phase II, issued by the International Accounting Standards Board (IASB). Solvency II has been implemented several years ahead of these reporting standards. However, for insurers, it makes business sense to take a coordinated approach for the implementation of both directives, due to the significant overlaps in the requirements for Solvency II and IFRS 4 Phase II. While there is no requirement for consistency between regulatory and financial reporting, there are significant overlaps in both the measurement and disclosure requirements contained in IFRS 4 Phase II and Solvency II frameworks.

10 8 How SAS Can Help The SAS approach to Solvency II is a flexible framework leading companies through the minefield of data, existing models, economic capital standard models, operationalized risk and reporting. Our framework delivers consistency and auditability, which greatly eases the path to compliance. SAS Firmwide Risk for Solvency II SAS Firmwide Risk for Solvency II performs complex calculations to anticipate risks, then initiate control measures to maintain solvency ratios that satisfy regulatory requirements. A single solution lets you calculate standard model MCR and SCR requirements, as well as create regulatory and management reports for Solvency II compliance. And the solution s flexible framework grows along with you to meet evolving risk analysis needs. At its foundation, the solution has an extensible risk analytics framework to support other regulatory regimes. It also supports an internal model approach for risk analysis, providing insurance companies with additional business benefit. SAS Capital Planning and Management SAS Capital Planning and Management creates an integrated environment to assess and project capital for insurance companies. It summarizes data and offers custom reports to different capital planning users to align business planning processes and capital projections with income statements and balance sheets. It supports both the qualitative and quantitative aspects of the ORSA. SAS Model Risk Management SAS Model Risk Management includes centralized model inventory and model assessment capabilities. It enables enterprise-level oversight throughout the model life cycle, and it provides model status reporting across all risk categories for internal and external stakeholders. The solution supports enterprise-level model governance, including validation processes of insurers internal capital models according to the Solvency II Directive (and similar regulations) as well as the increased use of models in the insurance industry to support decisions or measure performance. Conclusion For the last 30 years, insurance companies have been bombarded with new and increasingly diverse regulations, all designed to validate that insurers are financially stable. The regulation of the insurance industry has recently been regarded as an unnecessary hindrance to the dynamism of economies and the natural tendency of firms to innovate and expand. Solvency II and other insurance regulations demand a more comprehensive approach to risk management. Insurance companies need to anticipate the regulatory and risk changes ahead and deal with them efficiently and proactively. Insurers who have the systems and processes that help them adapt swiftly to change will realize significant competitive advantages, including lower compliance costs, less intrusive regulatory supervision, and greater peace of mind for their board members.

11 To contact your local SAS office, please visit: sas.com/offices SAS and all other SAS Institute Inc. product or service names are registered trademarks or trademarks of SAS Institute Inc. in the USA and other countries. indicates USA registration. Other brand and product names are trademarks of their respective companies. Copyright 2016, SAS Institute Inc. All rights reserved _G