Session 8A: Risk Appetite in Practice. Moderator: Presenters: Anthony Dardis, FSA, CERA, FIA, MAAA. Damon Levine

Transcription

1 Session 8A: Risk Appetite in Practice Moderator: Anthony Dardis, FSA, CERA, FIA, MAAA Presenters: Anthony Dardis, FSA, CERA, FIA, MAAA Damon Levine SOA Antitrust Disclaimer SOA Presentation Disclaimer

2 RISK APPETITE: THEORY AND PRACTICE DAMON LEVINE, CFA, CRCMP ERM SYMPOSIUM 2017, NEW ORLEANS

3 You want a valve that doesn't leak and you try everything possible to develop one. But the real world provides you with a leaky valve. You have to determine how much leakiness you can tolerate. -Arthur Rudolph

4 AGENDA Overview: Definitions, Goals, and Attributes Appetite Statements Parameterization and Cascading to LOBs With examples from world famous insurer Company XYZ! Measurement and Monitoring Review and Evolution

5 I. Overview: Definitions, Goals, and Attributes In theory there is no difference between theory and practice. In practice there is. -Yogi Berra

6 RISK APPETITE DEFINED The amount and type of risk that an organization is willing to take in order to meet their strategic objectives The Institute of Risk Management The total exposed amount that an organization wishes to undertake on the basis of risk-return trade-offs for one or more desired and expected outcomes The Risk and Insurance Management Society (RIMS) The level of aggregate risk that an organization can undertake and successfully manage over an extended period of time the broad-based amount of risk an organization or other entity is willing to accept in pursuit of its mission or vision Society of Actuaries

7 MEANWHILE IN THE NAIC ORSA GUIDANCE MANUAL Risk Appetite, Tolerances and Limits A formal risk appetite statement, and associated risk tolerances and limits are foundational elements of risk management for an insurer; understanding of the risk appetite statement ensures alignment with risk strategy by the board of directors.

8 NAIC ORSA (CONT D) Risk Appetite Documents the overall principles that a company follows with respect to risktaking, given its business strategy, financial soundness objectives and capital resources. Often stated in qualitative terms, a risk appetite defines how an organization weighs strategic decisions and communicates its strategy to key stakeholders with respect to risk-taking. It is designed to enhance management s ability to make informed and effective business decisions while keeping risk exposures within acceptable boundaries

9 NAIC ORSA (CONT D) Risk Limit Typically quantitative boundaries that control the amount of risk that a company takes Risk Tolerance The company s quantitative and qualitative boundaries around risk-taking, consistent with its risk appetite

10 THEREFORE WE SHOULD Ignore terminology and just do the work?!?

11 RISK APPETITE FRAMEWORK (A LA DELOITTE 1 ) The policies, processes, skills and systems needed in order that risk appetite is the way the firm and its people across all business and control functions talk, think and do risk [in order to ] Set the strategic plan and objectives as well as the risk strategy and risk capacity Articulate and cascade [to LOBs] risk appetite statements and limits Monitor and report risk profile versus appetite Control and correct the risk profile should it deviate from appetite, and reassess the risk appetite and, as the case may be, its strategy in the light of changes in the business, competitive or control environments

12 CORE PRINCIPLES DESCRIBED BY THE NORTH AMERICAN CRO COUNCIL 2 Establishing a comprehensive RAF should be approached in an iterative fashion The RAF should reflect the diverse interests of parties relevant in achieving company objectives Compliance with the frameworks limits/tolerances should be realistic and attainable The RAF should identify and quantify risk preferences for material risks Risk appetite statements and limits should be reviewed and possibly revised after significant events, and at least annually, by the Board

13 COMPANY XYZ S PRACTICAL CONSIDERATIONS Aim for a RAF which meets the CRO Council s core principles When defining the company s appetite, begin with the past Do not create immediate and widespread non-compliance Connect to the Plan process to ensure value and create buy-in Do not assume that all enterprise level tolerances must be cascaded It is not practical to always seek quantitative limits or linkages

14 THE COMPANY S RAF AXIOMS 3 A RAF includes enterprise level statements describing the preferred types and amounts of risk the company is willing to assume in pursuit of its business objectives The above statements include limits, targets, tolerances, or constraints relating to key profit and solvency measures and relating to each high-level risk category in the risk taxonomy (e.g. risks categorized as financial, market, legal/regulatory, insurance, strategic, and operational) When appropriate, there are line of business (LOB) level limits to support the enterprise level statements

15 THE COMPANY S RAF AXIOMS (CONT D) There exists a monitoring and reporting structure to measure actual exposures against the system of limits and tolerances at both the business unit and enterprise levels, detects/reports breaches, and triggers appropriate remediation When feasible, quantitative methods are employed because they are objectively defined, leave little room for misinterpretation, and aid in making the RAF operational. An enterprise risk model capturing LOB correlations and interrelationships is in place which can model prescribed scenarios or be run stochastically

16 II. Appetite Statements Don`t be afraid to take a big step when one is indicated. You can`t cross a chasm in two small steps. -David Lloyd George

17 METRIC-BASED RISK APPETITE STATEMENTS The Company regards risk appetite statements as enterprise-level targets or constraints and defines these statements which link to key metrics Earnings: We are x% confident that the Plan earnings for the Company will not be missed by more than 15%; i.e., the estimated probability of achieving at least 85% of Plan earnings is x% ROE: We are 85% confident that the Company s achieved return on equity (ROE) y% Capital: The aggregate capital at the legal entities and the holding company is sufficient to cover all obligations and expenses, over a one year horizon, in any modeled scenario having greater than a 1 in 200 annual probability Franchise Value: The annual probability of a reduction in franchise value (e.g. present value of free cash flows) of 10% or more is at most z%

18 TAXONOMY-BASED RISK APPETITE STATEMENTS In pursuit of its business goals the Company s risk preferences, in decreasing order, are insurance, strategic, market, legal/regulatory, & operational For insurance risk scenarios with probability of at least 10% ( p.10 ), the worst modeled impact to earnings is at most I 1 % of Plan For strategic risk scenarios with p.10, the worst impact to earnings is at most I 2 % of Plan For market risk scenarios (p.10), the worst impact to earnings is at most I 3 % of Plan For legal/regulatory risk scenarios (p.10), the worst impact to earnings is at most I 4 % of Plan For operational risk scenario (p.10), the worst impact to earnings is at most I 5 % of Plan

19 PARAMETERIZING THE RISK APPETITE STATEMENTS Some parameters are determined using a quantitative, mostly objective, approach while others may be more subjective Consider the existing risk profile and Management/Board behavior and preferences as expressed explicitly or implied by past behavior Leverage risk identification process (inventories, RCSA) with a focus on scenario modeling and associated probability/impact estimates When possible, tie parameters in the risk appetite statements to financial Plan other established business processes

20 III: Parameterization and Cascading to LOBs A foreign policy aimed at the achievement of total security is the one thing I can think of that is entirely capable of bringing this country to a point where it will have no security at all. -George F. Kennan

21 THE COMPANY S USE OF THE PLAN PROCESS IN SETTING EARNINGS RISK APPETITE Recall the earnings appetite statement: We are x% confident that Plan earnings for the Company will not be missed by more than 15% Management and the Board are hoping to define x as 90% We require that LOB forecasts have a degree of confidence. For each LOB, denoted LOB 1, LOB 2, the respective (dollar) earnings forecasts P 1, P 2, are such that LOB x is 95% confident that it will not miss its Plan forecast by more than M% of P x We back into the value for M through an iterative process

22 THE COMPANY S USE OF THE PLAN PROCESS IN SETTING EARNINGS RISK APPETITE (CONT D) The Company tests a value of M = 15% but model simulation, capturing correlation, shows this tolerance at the LOBs only leads to the enterprise level statement We are 86% confident that the Plan earnings for the Company will not be missed by more than 15% To bump up the 86% confidence to the desired 90% confidence we must tighten the earnings tolerance in each LOB. We gradually try smaller values of M such as 14%, 13%, etc. until we find what value gives the desired confidence statement at the enterprise level

23 THE COMPANY S USE OF THE PLAN PROCESS IN SETTING EARNINGS RISK APPETITE (CONT D) The Company eventually finds that 12% will produce the desired enterprise statement. However, it is necessary for one LOB to reduce its Plan forecast so that it can commit to its earnings confidence statement This revision in the Plan forecast illustrates the iterative nature of the Plan/limit setting process. The fact that the limit setting is embedded in the Plan process creates a strong link between strategic planning and ERM while increasing buy-in The Company has therefore determined the value for M as 12% and we have: If: Each LOB is 95% confident that it will not miss its own Plan earnings by more than 12% Then: We are 90% confident that Plan earnings for the Company will not be missed by more than 15%

24 OTHER PARAMETERIZATION The risk model, complete with equity modeling, can then be used to translate the LOB limits for earnings into LOB limits for ROE. The model is then used to determine what statement is implied at the enterprise level and allows for the determination of y in the ROE risk appetite statement (enterprise-level) The finalized Plan, current risk inventory, and the model allow the parameter z, in franchise value risk appetite statement, to be determined Strategy discussion and the Plan process lead to revisions to the risk inventory, which suggest the following parameters are attainable for the taxonomy-based risk appetite statements: I 1 = 6%, I 2 = 4%, I 3 = 2.5%, I 4 = 2%, & I 5 = 1.5% The above supports the (enterprise-level) earnings risk appetite statement

25 OBSERVATIONS The risk appetite statements relating to capital and franchise value were not cascaded but ERM tools and processes at LOBs can support these statements The Company employed both top-down and bottom-up methods Cascading does not necessitate a precise mathematical linkage in all cases Tying the risk appetite framework to the Plan process leads to an ERM- Strategy linkage and helps operationalize the concepts

26 EXAMPLES OF RISK LIMITS AT LINE LEVEL LOB limits help ensure the (enterprise level) goals described by the risk appetite statements Liquidity limits require liquid assets at the LOB to be sufficient to cover L% of the next 6 months of expected cash outflows FX limits describe what percent of invested assets must be in the local currency Operational risk limits describe a tolerance for actual or estimated frequency and impact of BC/DR, breach etc. events

27 EXAMPLES OF RISK LIMITS AT LINE LEVEL (CONT D) Business continuity limits via enterprise-wide scoring system overseen by the ERM function Portfolio risk limits provide duration corridors, based on ALM studies for the product lines, and also relate to asset allocations, issuer exposures, and average credit rating Counterparty credit exposures: limits at apply at both LOB and the enterprise levels Loss ratio, expense ratio, sales, & capital level vs Plan are measured quarterly & include a mixed actual/forecast refresh

28 EXAMPLES OF RISK LIMITS AT LINE LEVEL (CONT D) The risk scenarios modeled as part of the recurring ERM processes are critical for the RAF (and ERM in general) At each LOB risk scenarios are examined to determine those with probability at least 10% with the highest impacts Judgement and quantitative modeling help to then set LOB limits to help support the risk appetite statements related to key metrics and to the taxonomy classes

29 IV: Measurement and Monitoring Human beings, who are almost unique in having the ability to learn from the experience of others, are also remarkable for their apparent disinclination to do so. -Douglas Adams

30 RISK PROFILE VERSUS LIMITS Recall the Company s axiom regarding limits: There exists a monitoring and reporting structure to measure actual exposures against the system of limits and tolerances at both the business unit and enterprise levels, detects/reports breaches, and triggers appropriate remediation The ERM function oversees this important aspect of the RAF in conjunction with other risk identification and risk quantification processes A regular cadence is important but ad hoc measurement may be necessary when significant events occur which change or may change the Company s risk profile

31 MEASURING RISK EXPOSURE / LIMIT COMPLIANCE On at least a quarterly basis, the enterprise risk inventory is updated and the following risks and metrics are tracked, measured or assessed: 1. LOB level earnings to date and any shortfalls versus the LOB Plan forecasts 2. Achieved ROEs to date and any shortfalls versus the LOB Plan forecasts 3. The enterprise values for (1) and (2)

32 MEASURING RISK EXPOSURE / LIMIT COMPLIANCE (CONT D) 4. Projections reflecting (1) - (3) for the Plan time horizon and updated risks to that reforecast (reflected in the risk inventory) 5. The enterprise risk inventory and risk model are used to check a) the aggregate capital and risk buffer needs, and b) the annual probability of a reduction in company value of 10% or more 6. Separately and for each risk type, the risk scenarios with probability of at least 10% are identified and their impacts to LOB and enterprise earnings are estimated 7. Customized for each LOB, a) key risk indicators (KRIs) and key performance indicators (KPIs) relating to the key metrics, and b) KRIs relating to specific subclasses of the taxonomy categories.

33 EXPOSURE RATINGS The ERM function works with Company management and SMEs define a system of traffic light indicators mapping the prior slide s observed values (1-7) to Green: the risk level is acceptable and regular monitoring continues (no special action required) Amber: the risk may be at a level that is not acceptable and may require remediation; escalation (formal/documented reporting of the situation) is required to the ERM Committee (ERMC), who will make a formal recommendation for corrective action, to restore to Green rating, or possibly defer a decision regarding action during a period of continued monitoring Red: the risk has exceeded the allowable tolerance or limit, and escalation to the ERMC, Management, and/or the Board is required. Root cause analysis, describing the origin of the breach, is submitted by the relevant business and a path toward remediation, including time-frame, is set forth by the ERMC

34 V: Review, Evolution, and Parting Thoughts By definition, risk-takers often fail. So do morons. In practice it's difficult to sort them out. -Scott Adams

35 REVIEW OF THE RAF An organization is rarely static and the RAF must evolve with material changes in a company s risk appetite, risk strategy or risk profile Management and the Board should revisit the framework at least annually but when ever there is a significant change as mentioned above Examples of potential RAF review triggers (not exhaustive!) New product line proposal Potential acquisition or divestiture Reforecast indicates large deviation from Plan (in either direction!) Significant growth or expansion into new geographies Change in strategy or regulatory environment

36 REPEAT OFFENDERS If a particular limit is often breached or a specific LOB (or person!) leads to many breaches then action is needed Revisit and potentially revise strategy Consider revising the limit, adding additional controls, or mitigations Consider changing the traffic light indicators to provide earlier and more sensitive warnings Determine if the breaching element should be reigned in or removed

37 PARTING THOUGHTS ERM in general, and limit/tolerance reporting in particular, is about risk and this implies future events must be the primary focus. Event databases are important but ERM must detect and communicate exposure to future events Leading vs. Lagging: a RAF should make extensive use of risk identification and quantification processes so it can function, in part, as an early warning system rather than merely pointing to recent downside events Caveat: RAFs are given so much attention people may mistakenly view them as synonymous with ERM! A RAF, while only one component of a complete ERM framework, offers a chance for a clear link with strategy and can enable a company to live and breathe its risk-reward vision.

38 REFERENCES Establishing and Embedding Risk Appetite: Practitioners View from the CRO Forum and the North American CRO Council 3. Risk Appetite: An Axiomatic Approach in the Joint Risk Management Section, March (

39

40

41

42

43

44