Enterprise Risk Management Its implications, benefits and process by Janice Englesbe, CFA, and Abbe Bensimon, FCAS, MAAA, Gen Re Capital Consultants A Berkshire Hathaway Company
The 2005 hurricane season took everyone by surprise, and many insurance companies had significant losses beyond their worst expectations. While claims from Hurricanes Katrina, Rita and Wilma may not be settled for years, the rating agencies reactions have been swift. A.M. Best says: the impact of huge losses as well as the increased volatility of the investment markets and corporate governance failures, have raised the importance of risk management and placed a premium on gathering and evaluating the most critical information related to risk management at the enterprise level. 1 As a result, the rating agencies are not only increasing capital requirements, they are also being more stringent by explicitly incorporating Enterprise Risk Management (ERM) into their rating processes. While much has been written on the topic of ERM, our intent in this article is to briefly describe the ERM process, its benefits and implications. We will then examine how the rating agencies have taken up ERM as an important aspect of the rating process. What is ERM? ERM begins as a capital preservation process that helps insurers identify, quantify and manage risks from all sources that exist throughout the corporation, including investments, underwriting, operational and reputational. It considers the accumulation and diversification of risk. ERM uses the organization s past experience to help evaluate future business plans to manage the unexpected. However, ERM is more than a forward-looking capital preservation tool. A fully-developed ERM discipline frames business decisions as risk/return trade-offs and creates the link between financial risk management and strategic business planning. By fully harnessing the power of ERM, companies can gain competitive advantage. ERM Tools There is no one right way to do ERM. Each organization develops ERM disciplines to reflect their own needs, business platform and market position. Some companies choose to begin the ERM process on a qualitative basis by using tools such as risk mapping while others use quantitative economic financial models, like dynamic financial analysis (DFA). Risk Mapping In a risk mapping exercise, management teams identify, classify and prioritize the risks that affect the entire organization. Risk maps help refine the understanding of the exposures being managed and measure the effectiveness of the mitigation strategies employed. 2 One of the most important features of risk mapping is its low-cost, high-impact introduction to enterprise risk management that builds on the company s existing structure. It enables a management team to develop a comprehensive list of risks faced by the company and builds support within that team for involvement in the enterprise s risk management process. 3 Risk mapping is an effective tool in corporate governance, and often can be the foundation for quantitative risk and economic capital modeling. 1 Gen Re Capital Consultants
Economic Capital Models Capital models assess whether the amount of a company s economic capital is sufficient to support the retained risks in a severe loss situation. Models for this include the well-known, risk-based capital models and solvency reviews already in place with various regulatory bodies and rating agencies. DFA is a specific type of economic capital model that simulates a company s financial results under possible scenarios of changing conditions that a company can face. [GRCC has written about DFA tools in the Spring 2005 edition of Regarding Risk, Dynamic Financial Modeling Measuring Risk for Better Decisions. ] Not only does DFA present expected profitability given a choice or decision, it also measures the economic impact of these choices on a company s performance. Its ability to quantitatively assess downside risk provides valuable information to management in judging whether a decision s expected profitability is worth its risk. When integrated with a company s qualitative risk mapping, DFA model enterprise risk metrics are particularly effective. GRCC s Economic Capital Model Current Book and Business Plan Economic Factors Individual Assets Individual Loss Events Asset Proxy (Duration/ Convexity/Credit) Fit Frequency and Severity Distributions Correlation Simulation Enterprise Risk/Return Economic Capital Catastrophe Event Tables Aggregated Losses ERM and the Importance of Corporate Culture No matter which ERM tools a company chooses to use, or where they are in the process, the successful implementation of ERM is wholly dependent upon the organization s (1) willingness to learn ERM concepts; (2) belief that a tailored ERM could be beneficial; (3) allocation of resources to develop an effective ERM discipline for the organization; and (4) understanding that success of an implementation is contingent upon communicating and selling the ERM strategy to all stakeholders. In short, it needs to become part of a company s culture. Analytics need to be aligned with business knowledge, and integrated with decision-making. When this alignment occurs, the culture will promote disciplined decision making that is understood and consistently applied throughout the organization. Specifics on Rating Agencies Approaches to ERM Each of the rating agencies is taking its own approach to recognizing ERM and economic capital in the rating process. A.M. Best has chosen to integrate ERM throughout its analysis of a company. They will look at ERM holistically, asking questions such as, Does the insurer have a strong risk management program vis à vis its capital strength, operating performance and business profile? Instead of requiring a high level of sophistication at the outset, A.M. Best s approach to evaluating ERM will be fluid and is expected to evolve as more information is gathered about companies ERM capabilities. At this time, S&P s evaluation process appears to be more structured than A.M. Best s and looks for companies to meet specific criteria. Companies are evaluated on five major components of ERM: risk management culture, risk controls, extreme event management, risk and capital models, and strategic risk management. S&P places more emphasis on economic capital models than A.M. Best and looks for companies to specifically articulate risk tolerance. Fitch Ratings has just released exposure drafts on how its rating will reflect to ERM. 2
ERM Specifics A.M.Best As an initial part of its evaluation, A.M. Best has changed some questions in the 2006 Supplemental Rating Questionnaire (SRQ). New, detailed questions on terrorism and catastrophe exposure, the accuracy of financial and capital modeling, and exposure assessment, among other things, provide A.M. Best with a better understanding of both the company s risk management and tolerance for risk. The ability of a company to monitor, manage and discuss risks to its capitalization remains a key rating consideration and is also a fundamental part of a company s ERM. The information in the SRQ is a beginning for A.M. Best s evaluation of those capabilities. Some companies have proactively shared their enterprise-wide risk initiatives with A.M. Best rather than letting A.M. Best draw conclusions based on the data contained in the SRQ or specific questions posed by A.M. Best s analysts. A discussion about a company s qualitative risk mapping as described above, and the management process for evaluating those risks, is one way to share ERM disciplines with A.M. Best. For some companies, this qualitative work may be sufficient to address questions on ERM. Other companies choose to present their own capital modeling to A.M. Best as a tool for illustrating the company s proactive management of risk to capital. While there is no current requirement for a company to use a capital model, A.M. Best gives credit to companies who employ these models to the extent that the modeling is linked to a risk management strategy. BCAR continues to be A.M. Best s internal economic capital model. It is their starting point for the assessment of a company s capitalization, and provides A.M. Best a baseline for analysis and a relative ranking in terms of the company s capital. BCAR and a company s own capital modeling play different roles in A.M. Best s evaluation of companies as they have different goals and intended uses. The goal of BCAR is capital preservation, while the goal of economic capital models, such as DFA, is value creation. A.M. Best will evaluate those companies who do not present their own capital modeling only through the lens of BCAR and its capital preservation focus. ERM Specifics Standard & Poor s Taking a slightly different tack, S&P has chosen to view ERM as a separate, major category in its rating process by joining existing categories of Competitive Position, Management and Corporate Strategy, Operating Performance, Capitalization, Liquidity, Investments and Financial Flexibility. Similar to A.M. Best, S&P views ERM as an evolving analysis component over the next two years. They will seek input from the rated companies themselves for improvements to the analysis. S&P s ERM analysis will result in a determination of whether a company has Excellent, Strong, Adequate or Weak risk management. An Excellent insurer will consistently identify, measure and manage risk exposures within pre-determined tolerance guidelines. A Strong insurer is somewhat more likely to experience unexpected losses that are outside of its tolerance level. An Adequate insurer is defined as hav(ing) the capabilities to identify, measure, and manage most major risk exposure and losses, but the process has not been comprehensively extended to all significant risks facing the enterprise. Again, ERM is one, albeit important, component to the rating analysis. The importance of ERM in the overall rating will vary according to the insurer s situation regarding the ability to absorb risks and the complexity of those risks. S&P will test the ERM evaluations against their ratings over time and will review how the risk management process worked. Did companies learn from their mistakes? How? What modifications to the risk management processes result from unexpected losses? S&P also expects that ERM could be a leading indicator of slippage due to cycle deterioration (risk management standards slip as the market softens). Conclusion Clearly, ERM has come out from behind the curtain. All insurers, to some degree, will have to begin assessing their risk management capabilities and processes. ERM is a good business practice and companies can turn the new ERM standards set by rating agencies into a competitive advantage. If companies look beyond checking the box for meeting rating agency criteria, the real value of ERM can be realized and result in more profitable business practices down the road. Endnotes 1 A.M. Best Special Report: A.M. Best Comments on Enterprise Risk Management and Capital Models, Matthew C. Mosher, February 2006. 2 Milliman, Best Practices for The Risk Mapping Process. 3 Id. at 2. Enterprise Risk Management 3
Who is GRCC? Gen Re Capital Consultants is a strategic consulting practice specializing in the property/casualty insurance industry. Our focus is on helping companies build a disciplined culture to support risk and capital management. We believe value creation for a company results from more informed decision making. Considered experts in the field of enterprise risk management, the GRCC team is comprised of specialists in: > Actuarial science > Corporate finance and accounting > Financial systems and technology > Reinsurance and insurance underwriting, structuring, pricing and reserving > Corporate governance > Rating agency interaction GRCC assists companies with the design and implementation of effective risk/capital initiatives. We work alongside our clients in a collaborative manner, as we understand management teams know their companies best. > Clients leverage our experience and avoid common pitfalls. > We aid management teams in communicating ERM disciplines with the Board of Directors. > We help companies establish a risk culture that is grounded in and benchmarked with observable metrics. We have completed over 110 projects for a broad range of stock and mutual insurers since we were formed in 1998. GRCC was selected by the Casualty Actuarial Society to set standards for DFA analysis and its application in setting business strategy. For quantitative analysis, we use our own proprietary, state-of-the-art DFA model developed by our team and customized to reflect our clients specific needs. Years of direct application with our client companies allows us to continually enhance the model. When integrated with your business knowledge and strong risk disciplines, this model helps your company harness the real value of enterprise risk management a competitive advantage. 4
For More Information If you have any questions about our proprietary, state-of-the-art tools, or to discuss your company s ERM needs, please contact Joan Lamm-Tennant at 203 328 6818 or jlammten@genre.com, Janice Englesbe at 203 328 5408 or jenglesb@genre.com, or Abbe Bensimon at 203 328 5529 or abensimo@genre.com. The people behind the promise 2006 General Re Corporation, Stamford, CT This information was compiled by Gen Re and is intended to provide background information to our clients, as well as to our professional staff. The information is time sensitive and may need to be revised and updated periodically. It is not intended to be professional advice. Gen Re assumes no liability for reliance on this material or any portion thereof for any purpose. ERM200610-1