32 / RISK MANAGEMENT

Transcription

1 32 / RISK MANAGEMENT FEATURE SOLID FOUNDATIONS The Australian Prudential Regulation Authority (APRA) released the final package of new cross-industry risk management and governance standards on 31 January In this article, Brett Riley and Jacob Mamutil review and consider these changes in the context of APRA s broader focus on risk management and risk governance. The authors consider what insurers should do to meet APRA s requirements, while maximising the commercial benefits from their risk management investment. Early planning for these changes and building solid foundations in risk management will enable insurers to make a smooth transition when the new standards take effect on 1 January APRA

2 33 / RISK MANAGEMENT Brett Riley, Principal, Finity Consulting. Jacob Mamutil, Senior Consultant, Finity Consulting. Background The recent release of the final version of Prudential Standard CPS 220 Risk Management and an amended Prudential Standard CPS 510 Governance, follows the draft versions of these standards issued in May Few changes of substance were made in the final versions. The key elements of the new standards are that every APRA-regulated institution must have: separate Board Risk and Audit Committees a designated Chief Risk Officer (CRO) who is independent of front line business responsibilities and reports directly to the Chief Executive Officer (CEO) and Board Risk Committee (BRC). Under CPS 220, insurers may apply for alternative arrangements to the CRO requirement, if they can establish that this aspect of CPS 220 is inappropriate for their particular circumstances. Industry has raised some objections to elements of the package, particularly the key changes listed above. A view held by many is that the new standards are overly prescriptive. APRA responded to these concerns in a paper accompanying the final standards. APRA also released Draft Prudential Practice Guide CPG 220 Risk Management for consultation. Submissions are due by 28 March Beyond the changes listed above, the broader risk management requirements have been transferred from GPS 220 to CPS 220. These include the role of the Board, the Risk Management Framework (RMF), the Risk Management Strategy (RMS), risk appetite, group risk management, business planning, policies and procedures and compliance. Insurers must now turn their attention to implementing any necessary changes. Any modifications should consider the implications for all elements of the insurer s RMF, as these often interact. APRA s broader risk management focus The new standards are part of a broader risk management focus in APRA s regulation and supervision in recent years. Other examples include: Life and General Insurance Capital (LAGIC) changes, increasing the risk sensitivity of insurers capital requirements. The Internal Capital Adequacy Assessment Process (ICAAP), through the linkage between capital and risk management and encouraging improved stress testing and scenario analysis. Increased attention on risk appetite, particularly with ICAAP. APRA have advised that more guidance is expected on this topic in future. Working with the Actuaries Institute in 2012 to strengthen risk management reviews in Financial Condition Reports. Improving remuneration policy requirements in In 2013, articulating expectations for improvements in risk management around catastrophe exposures and related reinsurance cover. A greater focus on risk governance and risk culture in Many of these changes have been implemented, with further enhancements to come through continuous improvement in second or subsequent iterations. Some areas have a relatively specific focus (e.g. catastrophe risk). Based on APRA s speeches and presentations in 2013, we expect a strong emphasis on risk governance and risk culture in 2014 and beyond. Both of these topics are central to CPS 220 and CPS 510. Risk governance is a common thread running through the items listed above, in particular the oversight provided by the Board. Draft CPG 220 is a further indication of APRA s expectation of the risk management issues that need to be considered in practice. Risk governance the next frontier The Board s role in risk governance is critical. In a speech to the Actuaries Institute in May 2013, APRA Deputy Chairman Ian Laughlin observed that risk governance could improve in many regulated institutions. APRA will likely pursue the following as part of a greater focus on risk governance: Key communications including an information pamphlet for directors, to help them understand their role and APRA s expectations of them. Greater interaction between APRA supervisors and Boards, in both formal and informal settings. The latter may involve catch-ups with Board and committee chairs, rather than all directors. Risk culture is closely linked to risk governance. In his May 2013 speech, Ian Laughlin noted that Boards must find ways to assess the health of an insurer s risk culture and encourage improvements where needed. He acknowledged that this is an emerging and challenging area. Strong Board engagement with management lays a solid foundation for risk governance. Regular oversight of business plans and operations with appropriate questioning and scrutiny of management are vital. The passive role assumed by some Boards in the past is no longer appropriate. For example, regular and active meetings involving both the management and Board of Zurich Australia were used in their implementation and operation of ICAAP in Zurich Australia CRO James Myerscough commented: the Board challenged management in several areas, which led us to consider those areas in greater detail. The resulting ICAAP was stronger than it would have otherwise been. I expect this process will carry on in future, as part of the continuous improvement of our ICAAP.... following a risk appetite review, some insurers are exploring quota share reinsurance for long-tail classes to reduce insurance risk.

3 34 / RISK MANAGEMENT APRA s requirements for designated CROs and separate Board Audit and Risk Committees are two changes in the broader context of APRA s focus on risk governance. There is an important change in the annual Risk Management Declaration that Boards currently make to APRA (Attachment B of GPS 220). This again highlights the more prescriptive approach taken by the regulator. Paragraphs (c) and (e) of Attachment B of GPS 220 require the Board to declare that: (c) The regulated institution has in place an RMS, developed in accordance with the requirements of this Prudential Standard, setting out its approach to risk management. (e) The regulated institution has, over the last financial year, substantially complied with its RMS* and Reinsurance Management Strategy (ReMS), and that these strategies are operating effectively in practice, having regard to the risks they are designed to control. The new Risk Management Declaration in Attachment A of CPS 220 places a greater onus of responsibility on the Board. Paragraph (d) of Attachment A requires the Board to declare that: (d) The institution has a RMS that complies with this Prudential Standard, and the institution has complied with each measure and control described in the RMS*. The required Board oversight of risk management under CPS 220 is now greater. Beyond the new prudential standards, we expect APRA to continue communicating its expectations in risk management through speeches, publications and the supervision of individual insurers. Some insurers have used their latest catastrophe and reinsurance market stress tests, combined with their risk appetite, to adjust the reinsurance they purchase. Commercial benefits matter too Insurers should, and have, pursued sound risk management for reasons other than complying with regulation, including: Developing greater resilience to internal or external shocks, so less time is spent by management fire-fighting problems. This requires holding all staff accountable for risks in their area of responsibility and checking via peer reviews. Management can then spend more time thinking about core business issues. Encouraging improved communication and information flows to make superior business decisions and improve business outcomes. Reducing volatility, through better identification, understanding, assessment and treatment of the risks impacting the business. As a result, insurers may need less capital and improve the stability of their earnings. Improving the insurer s risk-return profile, thus improving performance and competitive advantage. Some practical examples will illustrate these principles. Most Australian insurers have improved their risk appetite statements in recent years, prompted by APRA s greater focus on risk appetite. In our experience, many have found this a useful extension of strategy setting, testing the boundaries of what is acceptable for a range of financial and non-financial risks. Some have taken the opportunity to step back and reassess whether they should be writing more or less business in particular classes, regions or distribution channels, or if they should change their underwriting, reinsurance or investment strategy. For example, following a risk appetite review, some insurers are exploring quota share reinsurance for long-tail classes to reduce insurance risk. Further guidance from APRA will assist insurers to develop their risk appetites. This is currently included in the draft version of CPG 220. Also, those insurers who have embraced stress testing and scenario analysis will have a better understanding of their business and its key sensitivities. This can be difficult when contemplating extreme scenarios, but weather events and financial market turmoil in recent years demonstrate that unlikely outcomes cannot (and should not) be discounted when an insurer prepares its plans. Some insurers have used their latest catastrophe and reinsurance market stress tests, combined with their risk appetite, to adjust the reinsurance they purchase. What should insurers do? Insurers will rightly concentrate on what they must do to satisfy CPS 220 and CPS 510. Those who plan and prepare early will be best positioned to comply with the new regulations, with minimal disruption to their business. The experience of European insurers implementing Solvency II in recent years shows that when resources are scarce, early movers hold an advantage. We recommend that insurers start preparing a review of their risk management framework and develop their approach to changes required under CPS 220. The new standards take effect on 1 January 2015, so time is limited. In addition, insurers should consider any enhancements to their risk governance and risk culture and other specific needs for the insurer (e.g. insurer specific ICAAP enhancements suggested by APRA). Figure 1 explores how key areas might be addressed. The Board needs to approve the work plan with senior management. Insurers may choose to discuss the plan with their APRA supervisor to confirm the right areas are being addressed and that plans seem appropriate particularly if alternative arrangements to the CRO requirement are sought. At the very least, insurers should be ready in case their supervisor asks what they are doing! Throughout this process, insurers will benefit if they follow the principle of proportionality. They should not lose sight of what the material risks are for general insurers (underwriting and other insurance risks, insurance concentration risks, asset-liability risks and strategic risks for most) and should not be distracted by lesser issues.

4 35 / RISK MANAGEMENT FIG 1. Checklist what to do now Insurers work plans for risk management in 2014 should include the following (as needed): CRO INSURER CURRENTLY HAS A DUAL HAT CRO WITH FRONT LINE RESPONSIBILITIES Option 1 Seek alternative arrangements with APRA Option 2 Plan to separate dual hat CRO s responsibilities a. The incumbent remains CRO but resigns other conflicting roles b. The incumbent retains other responsibilities and relinquishes the CRO role c. Appoint a group or regional risk manager as CRO Clearly articulate why there are material constraints in appointing a CRO with no conflicts, possibly referring to the Three Lines of Defence model. Insurers should refer to paragraph 61 and Appendix A of draft CPG 220. Some insurers may prefer this course. Those seeking alternative CRO arrangements should include this as a contingency plan. Other responsibilities are assumed by existing staff, promoted staff, external hires or consultants. Insurer must appoint a CRO through internal promotion or external hire. Input from others may be needed (e.g. recruiters, or some external support for training or mentoring a promoted CRO). Australian insurance groups may have the Level 1 insurer CRO report to the Level 2 or Level 3 Group CRO, if the Group CRO reports to the Group CEO and the Level 1 insurer s Board can demonstrate that the Group CRO meets its requirements (paragraph 62, draft CPG 220). Australian branch insurers may use their regional or group CRO to fulfil the role, assuming the CRO has active and sufficient oversight of the insurer and interaction with local management. This CRO should have regular and clear access to the Senior Officer Outside Australia (paragraph 63, draft CPG 220). BOARD COMMITTEES INSURER CURRENTLY HAS A JOINT BOARD RISK AND AUDIT COMMITTEE Seek alternative arrangements with APRA Separate Audit and Risk Committees REPORTING LINES AND RISK GOVERNANCE Insurers may need to amend organisational structures An exemption from the requirement for separate committees for a locally incorporated insurer may be argued, although it is unlikely to be granted. If required this should be a relatively straightforward change to charters and schedules. The same directors may sit on both committees, provided the governance structures are separated. Roles, reporting lines and risk reports required by the CRO, CEO, the Board and the BRC may need to change. The most important changes will likely relate to the CRO. Continued on page 36 Following the publication of APRA s final risk management and governance standards, insurers should now give thought to how they might implement the required changes and start their preparations.

5 36 / RISK MANAGEMENT Continued from page 35 RISK MANAGEMENT FUNCTION Authority of the designated Risk Management Function OTHER ELEMENTS OF THE RISK MANAGEMENT FRAMEWORK (RMF) Review RMF against business plan Review Management Information System (MIS) Review risk culture Update reporting requirements Under paragraph 16 of GPS 220, an insurer required a risk management function that has the authority to conduct its activities in an effective and independent manner. Paragraph 38 of CPS 220 is more prescriptive. It explicitly provides that an insurer s designated risk management function: (f) has access to all aspects of the institution that have the potential to generate material risk, including information technology systems and systems development resources; and (g) is required to notify the Board of any significant breach of, or material deviation from, the risk management framework. As a result, insurer Risk Management Frameworks may need updating. Paragraph 23 of CPS 220 requires an insurer s RMF to be consistent with its business plan. In addition to addressing the risks arising from its strategic objectives and business plans, an insurer must also explicitly manage these risks through the RMF and identify how these plans affect its risk profile. This may require a review of the RMS, ReMS, the ICAAP and other risk policies. Paragraph 25 (g) of CPS 220 requires an insurer s RMF to have an MIS that is adequate, both under normal circumstances and in periods of stress, for measuring, assessing and reporting on all material risks across the institution. Insurers should review and examine these systems and business continuity management policy and plans. APRA acknowledges that the MIS should reflect the size, business mix and complexity of each institution. Insurers should think about ways this is measured, monitored and embedded in the organisation. Some may also review the nature of the challenge provided to management by the Board. CPS 220 is less prescriptive than GPS 220 in certain aspects. For example, branches are no longer required to include a summary of the home regulator s supervisory provisions in their RMS. Summary Following the publication of APRA s final risk management and governance standards, insurers should now give thought to how they might implement the required changes and start their preparations. Further refinement may be justified later in 2014 once the final version of CPG 220 is released. The current draft should be sufficient to guide insurers for now. Beyond the standards, we expect APRA to continue its broader focus on risk management in 2014, including the areas of risk governance and risk culture. APRA wants each of its regulated institutions to have a RMF that is appropriate to the needs of its business while protecting the interests of stakeholders, particularly policyholders. Insurers should adopt a changed mindset of risk leadership, as opposed to mere compliance with these initiatives. A house that embodies the spirit of risk leadership will not only have solid foundations, it will have a sustainable future. Notes * Emphasis added. A house that embodies the spirit of risk leadership will not only have solid foundations, it will have a sustainable future.