1. INTRODUCTION AND PURPOSE

Transcription

1 Solvency Assessment and Management: Pillar I - Sub Committee Capital Requirements Task Group Discussion Document 61 (v 1) SCR standard formula: Operational Risk EXECUTIVE SUMMARY 1. INTRODUCTION AND PURPOSE Solvency Assessment and Management (SAM) regulatory requirements are being developed in South Africa in line with solvency regulations in other countries (e.g. Solvency 2 in the EU). To this end developments in other jurisdictions have been considered in order to formulate appropriate guidelines for the South African insurance industry. We have considered principles & prescriptions provided by the International Association of Insurance Supervisors (IAIS), as well as, the regulatory bodies in the European Union (Solvency 2), Australia (APRA) and Canada (OSFI). This document sets out the recommended approach, for the 1 st SAM QIS exercise (QIS1), for the Operational Risk SCR calculation and supporting rationale for the recommendation. 2. INTERNATIONAL STANDARDS: IAIS ICPs Since its inception in 1994, the International Association of Insurance Supervisors (IAIS) has developed a number of principles and standards in guidance papers to help promote the global development of well-regulated insurance markets. A further objective of the IAIS is to contribute to broader stability of the financial system. The IAIS is currently revising the ICPs with corresponding standards and guidance material to be ready in We have considered all the relevant available current and draft ICPs for this discussion document. The ICPs considered are: Number and Name Status ICP16: Enterprise Risk Management for solvency purposes Draft: February 2011 ICP17: Capital Adequacy Adopted: October 2010 In essence the ICP recommends that operational risks should be considered for solvency purposes. IAIS however recognises the challenges to quantify operational risks, and suggest that in certain cases operational risks could rather be addressed through risk management and the ORSA.

2 3. EU DIRECTIVE ON SOLVENCY II: PRINCIPLES (LEVEL 1) The EU level 1 directive (dated November 2009) defines operational risk as the risk of loss arising from inadequate or failed internal processes, personnel or systems, or from external events (article 13 (Definitions), section 33). It also specifies that operational risk shall include legal risks, and exclude risks arising from strategic decisions, as well as reputation risks (article 101). It is clearly specified that the risk management system (article 44, point 2) and the Solvency Capital Requirement calculation (article 101) shall include operational risk. In calculation of the Solvency Capital Requirement (article 103), the operational risk capital requirement is an explicit component of the calculation (together with the Basic Solvency Capital Requirement and the loss-absorbing capacity of technical provisions & deferred taxes) Principles for the calculation of the operational risk capital requirement (standard formula) are provided in article 107: 1. The capital requirement for operational risk shall reflect operational risks to the extent they are not already reflected in the risk modules referred to in Article 104. That requirement shall be calibrated in accordance with Article 101(3). 2. With respect to life insurance contracts where the investment risk is borne by the policy holders, the calculation of the capital requirement for operational risk shall take account of the amount of annual expenses incurred in respect of those insurance obligations. 3. With respect to insurance and reinsurance operations other than those referred to in paragraph 2, the calculation of the capital requirement for operational risk shall take account of the volume of those operations, in terms of earned premiums and technical provisions which are held in respect of those insurance and reinsurance obligations. In this case, the capital requirement for operational risks shall not exceed 30 % of the Basic Solvency Capital Requirement relating to those insurance and reinsurance operations. For SAM level 1 it was recommended that the Solvency 2 level 1 principles be adopted, but that some of the more specific calculation elements be moved to the level 2 text e.g. the 30% limit and which capital drivers are to be taken into account in the Operational Risk SCR formula. 4. MAPPING ANY PRINCIPLE (LEVEL 1) DIFFERENCES BETWEEN IAIS ICP & EU DIRECTIVE The IAS ICPs do not outline detailed requirements for calculation of operational risk capital requirements. Consequently there are no contradictions / differences between the EU directive and the IAS ICPs. Page 2 of 11

3 5. STANDARDS AND GUIDANCE (LEVELS 2 & 3) 5.1 IAIS standards and guidance papers ICP 17: Capital Adequacy ICP 17 as issued by the IAIS applies to insurance entities and insurance groups. This document seeks to establish capital adequacy requirements for solvency purposes so that insurers can absorb significant unforeseen losses and to provide for degrees of supervisory intervention. The ICP states that the solvency regime should address all relevant and material categories of risk - including as a minimum: Underwriting risk, Credit risk, Market risk, Operational risk and Liquidity risk. The IAIS however recognises that some risks are less readily quantifiable than the other main categories of risks. These risks include: Strategic risk, Reputational risk, Liquidity risk and Operational risk, Operational risk, according to IAIS, is diverse in its composition. The measurement of operational risk, in particular, may suffer from a lack of sufficiently uniform and robust data and well developed valuation methods. Jurisdictions may choose to base regulatory capital requirements for these less readily quantifiable risks on: Simple proxies for risk exposure, and/or Stress and scenario testing. For these types of risks (including operational risks), holding additional capital may not be the most appropriate risk mitigant and it may be more appropriate for the supervisor to require the insurer to control these risks via exposure limits and/or qualitative requirements such as additional systems and controls. However, the IAIS envisages that the ability to quantify some risks (such as operational risk) will improve over time as more data become available or improved valuation methods and modelling approaches are developed. Further, although it may be difficult to quantify risks, it is important that an insurer nevertheless addresses all material risks in its ORSA (Own Risk and Solvency Assessment). Page 3 of 11

4 Insurance Groups: Group specific risks posed by each group entity to insurance members of the group and to the group as a whole are a key factor in an overall assessment of group-wide capital adequacy. Such risks are typically difficult to measure and mitigate and include notably operational/organisational risks. As groups can differ significantly it may not be possible to address these risks adequately using a standardised approach for capital requirements. It may therefore be necessary to address group specific risks through the use of more tailored approaches to capital requirements including the use of (partial or full) internal models. Alternatively supervisors may vary the standardised regulatory capital requirement to ensure that group-specific risks are adequately provided for in the insurance legal entity and/or group capital adequacy assessment. Group specific risks should be addressed from both an insurance legal entity perspective and group-wide perspective ensuring that adequate allowance is made. Consideration should be given to the potential for duplication or gaps between insurance legal entity and group-wide approaches ICP 16: Enterprise Risk Management for solvency purposes According to IAIS, where a risk is not readily quantifiable, for instance some operational risks, an insurer should make a qualitative assessment that is appropriate to that risk and sufficiently detailed to be useful for risk management. 5.2 CEIOPS CP53 (Operational Risk SCR consultation paper) The guidance provided in the CEOIPS CP53 is as follows: Definition Operational risk is the risk of loss arising from inadequate or failed internal processes, or from personnel and systems, or from external events (Article 13(33) of the Level 1 text). Operational risk shall include legal risks, and exclude risks arising from strategic decisions, as well as reputation risks (Article 101(4)(f) of the Level 1 text). The operational risk module is designed to address operational risks to the extent that these have not been explicitly covered in other risk modules. For the purpose of this advice, reference to technical provisions is to be understood as technical provisions excluding the risk margin, to avoid circularity issues Calibration Based on the assumptions contained in the explanatory text, CEIOPS calibrated the submodule according to 99.5% VaR and a one year time horizon. The overall conclusion was that operational risk in the QIS4 standard formula was under-calibrated. CEIOPS thus proposes the following operational risk factors: New Factors QIS4 Factors TP life 0.6% 0.3% TP non-life 3.6% 2.0% Prem life 5.5% 3.0% Prem non-life 3.8% 2.0% UL factors 25% 25% BSCR cap - life 30% 30% BSCR cap - non-life 30% 30% Page 4 of 11

5 5.2.3 Inputs The inputs for this module are: TP life TP SLT Health TP life-ul TP nl TP Non SLT Health Earn life Earn SLT Health Earn life-ul Earn nl = Total life insurance technical provisions (gross of reinsurance), with a floor equal to zero. This would also include unit-linked business and life like obligations on non-life contracts such as annuities. = Technical provisions corresponding to health insurance (gross of reinsurance) that correspond to Health SLT with a floor equal to zero. = Total life insurance technical provisions for unit-linked business (gross of reinsurance), with a floor equal to zero. = Total non-life insurance technical provisions (gross of reinsurance), with a floor equal to zero (excluding life like obligations of non-life contracts such as annuities). = Technical provisions corresponding to health insurance that correspond to Health non SLT (gross of reinsurance), with a floor equal to zero. = Total earned life premium (gross of reinsurance), including unit-linked business. = Total earned premiums corresponding to health insurance that correspond to Health SLT (gross of reinsurance) = Total earned life premium for unit-linked business (gross of reinsurance) = Total earned non-life premium (gross of reinsurance) Earn Non SLT Health = Total earned premiums corresponding to health that correspond to Health non SLT (gross of reinsurance). All the aforementioned inputs should be available for the last economic period and the previous one, in order to calculate their last annual variations. Exp ul BSCR = Amount of annual expenses (gross of reinsurance) incurred in respect of unit-linked business. Administrative expenses should be used (excluding acquisition expenses); the calculation should be based on the latest past years expenses and not on future projected expenses. = Basic SCR Page 5 of 11

6 5.2.4 Calculations The capital charge for operational risk is determined as follows: where SCR op = Capital charge for operational risk where SCR ul Op lnul is determined as follows: where and: where = min{0.30 BSCR;Op lnul } Exp ul = Basic operational risk charge for all business other than unit-linked business (gross of reinsurance) Op lnul = max (Op premiums ; Op provisions ) Op premiums = * ( Earn life + Earn SLT Health Earn life-ul ) * ( Earn non-life + Earn Non SLT Health ) + Max( 0, * ( ΔEarn life ΔEarn life-ul )) + Max( 0, * ΔEarn non-life ) Op provisions = * ( TP life + TP SLT Health TP life-ul ) * ( TP non-life + TP Non SLT Health ) + Max(0, * (ΔTP life ΔTP life-ul )) + Max(0, * ΔTP non-life )) Δ= change in earned premiums / technical provisions from year t-1 to t, for earned premiums / technical provisions increases which have exceeded an increase of 10%. Furthermore no offset shall be allowed between life and non-life Δ. 5.3 Other relevant jurisdictions The Australian Prudential Regulatory Authority (APRA) Non-Life Insurance (Individual Insurers and Groups) According the APRA s Prudential Standard GPS 110 the MCR (Minimum Capital Requirement) is intended to be commensurate with the full range of risks to which an insurer is exposed including risks relating to Insurance claims, Investments, Counterparty default, Asset-liability mismatches, Catastrophic events, and Page 6 of 11

7 Operational errors and problems. For Non-Life Insurers in Australia using the Prescribed Method, the MCR is determined as the sum of the capital charges for: Insurance risk; Investment risk; and Concentration risk. Although operational risk is mentioned to be captured in the MCR, operational risk as a separate element is not included in the APRA Prescribed Method Life Insurance (Individual Insurers and Groups) The APRA Management Capital Standard requires that the life company to maintain at all times a minimum amount of capital outside the statutory funds - the Management Capital Requirement. The Management Capital Requirement is determined by considering the various risks which could impact the security of the company s operations and, by consequence, policy owner entitlements and requiring the provision of a prudent level of reserve against such risks. The approach to determining the Management Capital Requirement recognises the separate and distinct nature of a life company s statutory funds in respect of its life insurance business and the extent to which the risks associated with undertaking life insurance business are provided for in the Solvency and Capital Adequacy. Capital reserves for operational risks are not specially mentioned nor formulated by APRA The Canadian Office of the Superintendent of Financial Institutions (OSFI) Capital Requirement OSFI defines operational risk as the risk that losses could materialize as a result of deficiencies in information systems or internal controls. At present, life insurers have a 20% flat capital charge on business embedded in their 120% MCCSR to account for this risk. The MCCSR (Minimum Continuing Capital and Surplus Requirement) is the current system prescribed by the OSFI for determining required capital. In future, OSFI plans to implement a minimum capital charge of 25% of MCCSR gross capital requirements for life insurers to account for operational risk. This approach is intended to be temporary until an explicit capital charge for operational risk is developed Approach to Setting Capital Requirements In November 2008 a Joint Committee consisting of OSFI, the Autorité des marchés financiers (AMF), and Assuris released a paper stating that the current MCCSR does not adequately account for risk concentration and risk diversification. Page 7 of 11

8 The Joint Committee recognised that the current framework does not provide explicitly for operational risk. It stated that these areas will need to be considered in the updated standard approach but provided no details of how this will be done Definition The committee defined operational risk as the risk that the company s business processes will fail, or that the company will fail to comply with laws and regulations. It recognised that the financial impact of loss of reputation should also be included in operational risk Approach to Operational Risk The paper states that a solvency buffer for operational risk will be calculated by applying a factor to a measure of exposure such as gross revenue. In addition, the solvency buffer will also contain a margin for future expenses that exceed those assumed in the calculation of best-estimate insurance obligations. It recognised that there are currently no explicit capital requirements for operational risk but argued that this is implicitly accounted for by requiring companies to hold more than 100% of the capital required by the MCCSR calculation. The paper stated that in the future, operational risk should be explicitly provided for e.g. by applying a factor to gross revenue Operational risk categories The paper proposes that operational risk can be further divided into the sub-categories of process risk, legal and regulatory risk, and fraud and mismanagement risk. These are further defined as follows: Process risk is the risk of loss due to the accumulation of small process errors. This occurs most often in processing high-volume, low-dollar-value transactions. The risk is best measured by using volume of transactions, but using gross revenue can give reasonable results. Legal and regulatory risk is the risk of loss due to non-compliance with laws or regulations. This risk increases with the size of a company. Gross revenue is a reasonable measure of company size. Fraud and mismanagement risk is the risk of loss due to significant fraudulent or negligent action by people in the organization. A classic example would be the unauthorized derivative trading that caused the failure of Barings bank. This type of risk has many of the same characteristics as catastrophic risk and it is difficult to find a suitable measure. The amount of such risks does tend to increase with company size, and gross revenue is a reasonable measure of size. The paper suggests that different factors may be required for different lines of business and states that more study and thought is required in this area. It notes that IFRS best estimates may not include actual expenses, but may instead include standard expenses derived from a reference entity. Page 8 of 11

9 It suggests that where the present value of actual future expenses is expected to be higher than the present value used in the valuation, the excess should be provided for in the solvency buffer. 5.4 Mapping of differences between above approaches (Level 2 and 3) APRA differs from Solvency 2 and OSFI in that the MCR is defined to be sufficient to cover operational risks no specific operational risk capital requirement is calculated OSFI & Solvency 2 both adopt a simplistic formula, but the capital drivers are different: OSFI uses MCR (temporarily), Solvency 2 uses earned premiums and technical provisions (for each of life, non-life and health business) for non-linked business and expenses for unitlinked business 6. ASSESSMENT OF AVAILABLE APPROACHES GIVEN THE SOUTH AFRICAN CONTEXT 6.1 Discussion of inherent advantages and disadvantages of each approach Solvency 2 The operational risk standard formula has been derived from extensive benchmarking exercises performed in Europe, and is based on internal model results from a variety of insurance participants. This provides a good starting point from which to leverage and develop South African requirements. It needs to be acknowledged however, that the factors applied in the formula may not be appropriate for the South African insurance industry, if the operational risk profile of South African entities differs significantly to that of European entities. The formula proposed in the level 2 text is simplistic and easy to apply. Whilst its simplicity is an advantage, it needs to be recognised that any simplified formula will likely provide disparate results between individual companies. For unit-linked business the current Solvency 2 formula specifies the use of annual expenses, however it is unclear exactly what expenses are to be included. Previous guidance from the FSB indicated that asset management fees should be included. It might be argued that this could be a significant miss-representation of the operational risks faced by certain companies e.g. insurers that pass on all investment-related obligations and asset management fees directly to asset managers. Uncertainty exists regarding allowance for the risk of new start-up companies not meeting growth targets, especially relating to the impact of this on the appropriateness of the assumed expense basis. Clarification is needed regarding where this risk is to be allowed for and whether this will be covered by the Operational Risk SCR APRA APRA requires the inclusion of operational errors and problems the calculating regulatory capital requirements, however evidence of specific guidance on the manner in which this should be calculated could not be found. We therefore conclude that APRA agrees to the principle of including operational risk in regulatory capital requirements however a detail approach is not prevalent to discuss as an alternative. Page 9 of 11

10 6.1.3 OSFI The plan of the Canadian regulator (OSFI) to implement a minimum capital charge based on a percentage of MCCSR gross capital again has the key advantage of simplicity. This approach is similar to the Basic Indicator Approach that bank s are permitted to use under Basel II. An approach that calculates a solvency buffer for operational risk by applying a factor to a measure of exposure such as gross revenue is inherently easy to calculate. Allowing a similar approach locally (even as a temporary measure) would thus greatly reduce the costs of compliance for local insurance companies. It needs to be recognised however that results calculated under an approach of this nature will have almost no correlation to the actual risk exposure within the respective entities. This can result in greatly disparate results which will depend solely on the composition of the balance sheet and income statement of the relevant entities. Whilst the simplicity of the approach is attractive, an approach of this nature is likely to be widely criticised due to its lack of risk sensitivity. 6.2 Impact of the approaches on EU 3rd country equivalence Adopting the Solvency 2 requirements discussed in this document would provide the closest possible EU 3 rd country equivalence. Adopting an approach similar to the OSFI or APRA proposals would place South Africa at odds with the Solvency II recommendations that are likely to be adopted by European Union countries. EU 3 rd country equivalence would thus be a major issue should this approach be elected. 6.3 Comparison of the approaches with the prevailing legislative framework The current prevailing legislation (CAR requirements under PGN104) merely specifies that allowance should be made for operational risk, but does not provide detailed guidance on the calculation thereof. 6.4 Conclusions on preferred approach The latest Solvency 2 QIS exercise (QIS5) applied the same formula and factors as those proposed under CP53. In light of the considerations discussed above, the Solvency II QIS 5 formula appears to provide the most pragmatic and appropriate basis to calculate operational risk capital under the standardised approach for the SAM QIS1 exercise. The only modification required is a clarification of the definition of annual expenses for unitlinked business, specifically with regard to asset management fees. Going forward a South African calibration exercise will need to be performed to assess the most appropriate capital drivers and factors to apply for the SA insurance industry. It should be noted however that a calibration exercise may prove to difficult as very few market participants (if any) in the South African insurance industry have, to date, developed advanced methods to calculating operational risk capital. Internal operational risk loss data is also not widely captured across the industry and external operational risk loss data sources are still practically non-existent for South African insurance entities. 7. RECOMMENDATION Page 10 of 11

11 It is recommended that the CP53 formula & factors (as also adopted by Solvency 2 QIS5) be applied in the SA QIS1 exercise to calculate the Operational Risk Capital Requirement, with the definition of annual expenses for unit-linked business more clearly defined in line with annual expenses defined for the Technical Provisions cash flow calculations (specifically to include asset management fees). This represents a minimum requirement that should be performed by all participants. Furthermore, undertakings participating in the SA QIS1 exercise with unit-linked business should indicate the percentage of the unit-linked annual expenses included in the operational risk calculation a new output (AMul) has been added to the SA QIS1 technical specifications for this purpose. This will assist in gaining an understanding of the materiality of the inclusion of asset management fees and potentially assist in future calibration exercises. Conclusions and recommendations will be finalised once the Capital Requirements Task Group has assessed the results of the various South African quantitative impact studies as well as other sources of information to assist in performing the operational risk standard formula calibration. Page 11 of 11