ERM in the Rating Process: A Practical Perspective

ERM in the Rating Process: A Practical Perspective Jeffrey Mango, Group Vice President, A.M. Best Michelle Baurkot, Assistant Vice President, A.M. Best Tom Zitelli, Managing Senior Financial Analyst, A.M. Best

Enterprise Risk Management Establishing a risk-aware culture, using sophisticated tools to consistently identify and manage, as well as measure risk and risk correlations is an increasingly important component of an insurer s risk management framework. The foundation of any risk management framework is the compilation of traditional risk management practices and controls that historically have helped companies monitor and manage their exposure to the five key categories of risk: credit, market, underwriting, operational and strategic.

Enterprise Risk Management A.M. Best believes that risk management capabilities should be viewed in light of a rating unit s scope of operations and the complexity of its business. For organizations with a more limited operating scope focusing on traditionally stable lines of business, the ERM process may be less complex. Within the rating process however, each rating unit regardless of its size or complexity is expected to explain how it identifies, measures, monitors and manages risk. Each rating unit is also expected to produce an overall risk appetite and risk tolerance statement that has been established or approved by its Board of Directors or senior management.

Enterprise Risk Management An insurer that can demonstrate it has incorporated strong risk management practices into its core operating processes while effectively executing its business plan will be more likely to maintain favorable ratings in an increasingly dynamic operating environment. Strong risk management programs integrate risk metrics into corporate, business line and functional area objectives, and meld risk-return measures into financial planning and budgeting, strategic planning, performance measurement and incentive compensation.

Own Risk and Solvency Assessment Following the 2012 Model Act, insurance companies meeting certain guidelines are now required to prepare and present an ORSA Summary Report to their regulators which began in 2015. ORSA Summary Reports are to be filed by individual insurance companies with over $500 million in direct written and unaffiliated assumed premiums or by insurance groups with over $1 billion in gross written premiums. ORSA represents the first significant action by regulators to engage in a formal dialog with insurers regarding their risk and capital management processes.

Own Risk and Solvency Assessment Have you completed an ORSA? NO YES Health 33.3% 66.7% Life / Annuity 51.4% 48.6% Property / Casualty 56.9% 43.1%

Own Risk and Solvency Assessment If you were not obligated to complete an ORSA, will you voluntarily complete one as part of your corporate governance? NO YES Health 20. 80.8% Life / Annuity 63.6% 36.4% Property / Casualty 48.2% 51.8%

Own Risk and Solvency Assessment What is your company s opinion of ORSA? Negative burden outweighs the benefit Neutral Positive benefit to company Health 33.3% 22.2% 44.4% Life / Annuity 20. 37.1% 42.9% Property / Casualty 27.4% 41.1% 31.5%

Own Risk and Solvency Assessment Most companies required to submit an ORSA have long standing ERM processes in place. While A.M. Best does not expect the ORSA process will identify significant new risks or capital management issues for most companies, it may provide additional insight into risk assessment and management. A.M. Best requests that companies provide a copy of their ORSA report to their analytical team.

Where ERM Falls in the Rating Process Country Risk Balance Sheet Strength Baseline (e.g., bbb+) Operating Performance (+2/-3) Business Profile (+/-2) Enterprise Risk Management (+1/-4) Comprehensive Adjustment (+/-1) Rating Enhancement Published Issuer Credit Rating Based on New BCRM-Effective 2017

ERM Assessment ERM Assessment Adjustment (Notches) Key Characteristics of ERM Very Strong +1 Adequate 0 Weak -1/2 Very Weak -3/4 Based on New BCRM-Effective 2017 Risk management capabilities are excellent and more than adequate for the risk profile of the company. Risk management capabilities are good and adequate for the risk profile of the company. Risk management capabilities are insufficient given the risk profile of the company. Risk management capabilities contain severe deficiencies relative to the risk profile of the company. The key characteristics described for each assessment category are ideal scenarios and are not intended to be prescriptive.

Risk Impact Worksheet The Risk Impact Worksheet is the primary tool that rating analysts use in the ERM assessment process. The worksheet contains ten broad categories of risk and allows the rating analyst to assess the risk profile of each category relative to the insurer s management capabilities. For each risk category, the risk management capabilities of the insurer are measured to see if they meet or exceed the risk profile.

Risk Impact Worksheet When an assessment has been reached for each of the ten risk categories, the rating analyst will arrive at a summary assessment, which combines the risk profile and risk management capabilities of all ten sub-assessments into a single overall assessment. The RIW is reviewed and discussed as part of the rating committee process.

Sample Risk Impact Worksheet Product & Underwriting 1 2 3 4 5 6 7 8 9 Reserving 1 2 3 4 5 6 7 8 9 Concentration 1 2 3 4 5 6 7 8 9 Reinsurance 1 2 3 4 5 6 7 8 9 Financial Flexibility 1 2 3 4 5 6 7 8 9

Sample Risk Impact Worksheet Investments 1 2 3 4 5 6 7 8 9 Legislative/Regulatory/Judicial/Economic 1 2 3 4 5 6 7 8 9 Management 1 2 3 4 5 6 7 8 9 Operational 1 2 3 4 5 6 7 8 9 Risk Appetite/Stress Testing 1 2 3 4 5 6 7 8 9 Summary 1 2 3 4 5 6 7 8 9

Recent RIW Findings Reviewed the RIWs of over 1100 rating units that were evaluated between April 4 th and December 15 th Population included approximately 800 P/C insurers, 250 L/A insurers and 70 Health insurers Represented regions included the U.S. (7), the EU (7%), Bermuda (5%), MENA (3%) and other.

Risk Category #1: Product/Underwriting The analyst should understand the rating unit s specific products and the factors that make them more or less risky, taking into account any diversification benefits. The frequency and severity of losses in a particular product line influence the analyst s assessment of a rating unit s underwriting risk. Management Capabilities The management team s achievements in implementing product changes and embedding risk mitigation strategies within the rating unit s product offerings, pricing, benefits and limits are evaluated. Management is also assessed on how effectively they manage correlation in the mix of product offerings.

10 9 8 7 6 5 5.2% 3.7% P/C RIW Category: Product / Underwriting 72.8% 64.1% 22. 32.2%

10 9 8 7 6 5 9.8% 3.9% Life and Annuity RIW Category: Product / Underwriting 79.2% 80.7% 11. 15.4%

10 9 8 7 6 5 8.8% 0. Health RIW Category: Product / Underwriting 69.1% 82.4% 22.1% 17.6%

Risk Category #2: Reserving For reserving risk, the review may include the rating unit s historical reserve adequacy, current reserve position, sensitivity to market changes, accident vs. calendar year results, reserving philosophy, and reserving process. All business segments (P/C, L/A and Health) have specific reserving requirements. Management Capabilities The rating analyst may consider management s philosophy (midpoint, margins, etc.), line of business trends in adequacy, results of cash flow testing, use of captives, track record and experience of actuarial staff. The analyst may also evaluate the rating unit s ability to finance rate increases and reduce reliance on releases.

10 9 8 7 6 5 11.1% 6.3% 75.2% P/C RIW Category: Reserving 67.4% 13.8% 26.3%

10 9 8 7 6 5 11. 5.1% 81.5% Life and Annuity RIW Category: Reserving 85.1% 7.5% 9.8%

10 9 8 7 6 5 26.5% 17.6% 73.5% Health RIW Category: Reserving 76.5% 0. 5.9%

Risk Category #3: Concentration Contributing to the rating unit s risk profile are any concentrations in areas such as investments, product offerings, geography, sources of earnings, distribution channels, regulatory environment, or other business operations. Typically, higher concentrations create higher risk profiles. Risk Management Capabilities The rating analyst may consider how the rating unit actively identifies, addresses, mitigates, and controls its exposure to risks caused by concentrations. The analyst may also make a judgment regarding how successful management is likely to be in reducing the potential impact of these risks.

10 9 8 7 6 5 3.2% 1.5% P/C RIW Category: Concentration 52.9% 56.4% 43.9% 42.1%

10 9 8 7 6 5 4.7% 2.4% Life and Annuity RIW Category: Concentration 65.4% 79.1% 29.9% 18.6%

10 9 8 7 6 5 7.4% 0. Health RIW Category: Concentration 44.1% 66.2% 48.5% 33.8%

Risk Category #4: Reinsurance Reinsurance can be an effective tool for managing insurance risks. However, the use of reinsurance creates a host of new risks for the ceding rating unit. Counterparty credit risk, dispute risk, inappropriate/poorly designed reinsurance programs, dependence on reinsurance for ratings/solvency/growth, concentration risk, increased costs of reinsurance and associated record keeping, unstable reinsurance pricing/market, oversight and type of collateral, and reliance on third party brokers are just some of the risks associated with reinsurance. Risk Management Capabilities The specific types, reliance, counterparty credit quality and levels of reinsurance used by the rating unit are reviewed to see if its insurance risks are being properly mitigated. The policies and procedures the rating unit has put in place to control the credit, dispute and dependence risks created by using reinsurance are also considered.

10 9 8 7 6 5 17.6% 6.2% P/C RIW Category: Reinsurance 65.3% 64.9% 17.1% 28.9%

10 9 8 7 6 5 27.3% 11.1% Life and Annuity RIW Category: Reinsurance 62.8% 75.5% 9.9% 13.4%

10 9 8 7 6 5 67.6% 51.5% Health RIW Category: Reinsurance 29.4% 41.2% 2.9% 7.4%

Risk Category #5: Financial Flexibility Assessing financial flexibility risks requires understanding the rating unit s own financial wherewithal and ability to raise funds, if needed, in a timely and cost effective manner. If the rating unit is reliant upon an affiliate, holding company, private owner, or other funding mechanism the assessment would also factor in that group s ability to raise capital in a timely and cost efficient manner. Although the existing capital structure plays into the assessment, saying a rating unit has no debt does not adequately address this risk category. The financial flexibility of the rating unit should incorporate the need to absorb losses and finance growth, in addition to potentially supporting parent or affiliated entities.

Risk Category #5: Financial Flexibility Risk Management Capabilities Rating analysts may assess the rating unit s ability to manage capital such that if it had a sudden large loss of surplus, it would be able to quickly and efficiently access funds. Other areas of review would include the rating unit s overall philosophy towards capital management, relative leverage/coverage position versus peer groups, and short vs. longer term liquidity needs.

10 9 8 7 6 5 15.9% 6.2% P/C RIW Category: Financial Flexibility 73.6% 73.4% 10.5% 20.4%

10 9 8 7 6 5 15. 8.7% Life and Annuity RIW Category: Financial Flexibility 78.7% 74.7% 6.3% 16.6%

10 9 8 7 6 5 11.8% 7.4% Health RIW Category: Financial Flexibility 85.3% 82.4% 2.9% 10.3%

Risk Category #6: Investments The rating analyst should review the investment mix and duration; this should reflect the rating unit s liability profile and should not change materially year-over-year. The ability to take on more investment risk should be balanced by the unit s capabilities and the amount of underwriting risk it undertakes. The analyst can also review the investment risk profile relative to peers and the industry. The riskiness of invested assets would be impacted by default and interest rate risk on bonds, market risk on stocks, and liquidity risk on all asset types. Investments are viewed in light of the rating unit s ALM philosophy reflecting both potential and expected liability and liquidity needs. Comparing asset allocation to a composite s asset allocation may indicate the relative riskiness of the rating unit s investment portfolio. A rating unit that cannot match asset duration to liability duration may create a higher risk investment portfolio.

Risk Category #6: Investments Risk Management Capabilities Management s ability to create, execute, monitor, and manage an investment policy and portfolio is assessed to determine if it reflects and responds to the liquidity needs and duration of the products and liabilities of the rating unit. The use of an outside asset manager alone is not considered a relevant capability. The outside manager should be well-known and provide meaningful management information systems to the rating unit who, in turn, can explain its investment strategy to the rating analyst. The insurance management team should also explain what oversight and limitations are placed on external asset managers. Even with the use of an outside manager, the management team should be able to explain the risk in the investment portfolio in light of the rating unit s stated risk appetite measures and demonstrate its performance under stress scenarios.

10 9 8 7 6 5 18.3% 7.2% P/C RIW Category: Investments 68.5% 74. 13.3% 18.8%

10 9 8 7 6 5 14.2% 5.1% Life and Annuity RIW Category: Investments 75.5% 75.5% 10.3% 19.4%

10 9 8 7 6 5 25. 8.8% Health RIW Category: Investments 70.6% 80.9% 4.4% 10.3%

Risk Category #7: Legislative/Regulatory/Judicial/Economic This risk profile assessment requires an impact review of macro-economic policies and/or other outside influences on the rating unit s risk profile and performance. Influences from market and country risks and other domestic or global macro-economic policies should be reflected here. Any regulatory, legislative or judicial exposures that impact pricing and strategy should also be captured here. Risk Management Capabilities The analyst should discuss management s ability to identify, quantify, monitor, and measure potential losses associated with, or caused by, the identified outside influences. Only the influences identified by the risk profile review are addressed in the capabilities section.

10 9 8 7 6 5 P/C RIW Category: Legislative / Regulatory / Judicial / Economic 6.3% 3.5% 69.4% 71.9% 24.3% 24.6%

10 9 8 7 6 5 7.9% Life and Annuity RIW Category: Legislative / Regulatory / Judicial / Economic 4.4% 71.1% 80.6% 20.9% 15.1%

10 9 8 7 6 5 Health RIW Category: Legislative / Regulatory / Judicial / Economic 4.4% 0. 60.3% 85.3% 35.3% 14.7%

Risk Category #8: Management An overall assessment of the rating unit s management team and strategy will be made. This includes qualitative aspects of the management team such as concentration in decision making, high turnover, credibility and Board engagement. Risk Management Capabilities When evaluating a rating unit s management team, the analyst looks for evidence of management input in decision making (i.e. use of committees), good corporate governance (i.e. clear accountability, authority, communication), and management s ability to execute its strategies (investment, UW, growth, etc.). The analyst also scrutinizes management s ability to stay within the stated risk appetite and tolerances, generally meet financial projections, and establish a succession plan.

10 9 8 7 6 5 8.8% 3.2% P/C RIW Category: Management 84.3% 75.1% 7. 21.6%

10 9 8 7 6 5 11.4% 4.7% Life and Annuity RIW Category: Management 83.9% 79.9% 4.7% 15.4%

10 9 8 7 6 5 8.8% 1.5% Health RIW Category: Management 85.3% 88.2% 5.9% 10.3%

Risk Category #9: Operational Operational risk is defined as any risk of loss arising from damage to a rating unit s reputation or franchise value caused by external events, inadequate or failed internal processes, or people. Additional examples of operational risk would include poor data quality, fraud, business disruption, and cyber risk. Risk Management Capabilities The analyst considers the rating unit s access to reliable, accurate, comprehensive and timely data. Whether breaches in tolerances are reported immediately, duties are properly segregated, and third party cyber security assessments are conducted are also evaluative factors. Additionally, the analyst will review the rating unit s IT infrastructure and disaster recovery plan.

10 9 8 7 6 5 4.5% 2.5% P/C RIW Category: Operational 85.5% 76. 9.9% 21.5%

10 9 8 7 6 5 11.1% 7.5% Life and Annuity RIW Category: Operational 82.5% 84.1% 6.3% 8.3%

10 9 8 7 6 5 8.8% 2.9% Health RIW Category: Operational 79.4% 86.8% 11.8% 10.3%

Risk Category #10: Risk Appetite/Stress Testing A rating unit s risk appetite statement is the documented amount and type of risk an organization is willing to seek or accept in pursuit of its long-term objectives. A rating unit s risk tolerance represents the boundaries of its risk taking; the organization is not prepared to venture outside of its risk tolerance levels in the pursuit of its long term objectives.

Risk Category #10: Risk Appetite/Stress Testing Risk Management Capabilities It is important for management to be able to communicate the rating unit s risk appetite in clear, measurable terms, normally through a risk appetite/tolerance statement. The sophistication and clarity of risk measures outlined are evaluated relative to the level of risk taken. The use of stress testing and scenario analysis adds additional insight in understanding risk exposures. Stress testing focuses on infrequent but costly events. It enables the insurer to identify potential sources of risk, evaluate the magnitude of risk, develop tolerance levels for risk, and generate strategies to mitigate risk.

10 9 8 7 6 5 7.8% 5.3% P/C RIW Category: Risk Appetite / Stress Testing 78.8% 75. 13.4% 19.7%

10 9 8 7 6 5 14.7% 13.4% Life and Annuity RIW Category: Risk Appetite / Stress Testing 77.4% 72.7% 7.9% 13.8%

10 9 8 7 6 5 16.2% 16.2% Health RIW Category: Risk Appetite / Stress Testing 77.9% 76.5% 5.9% 7.4%

Risk Impact Worksheet Summary The rating analyst summarizes the overall assessment of the rating unit s risk profile and risk management capability. This summary should incorporate all of the ten categories previously discussed, but should not be considered a weighted average of the categories. For every rating unit, each of the ten categories will take on varying degrees of importance. Using analytical judgment, the analyst will determine which of the ten categories are most important in reaching a final assessment of the rating unit s risk management process.

Risk Impact Worksheet Summary The rating analyst will make a final assessment on what is believed to be the rating unit s risk profile. Within this assessment the analyst will identify which risks the rating unit is most susceptible to and why. Risk Management Capabilities The rating analyst will make a final assessment determining if the rating unit has demonstrated an ability to manage its most material and identified emerging risks, highlighted in the risk profile of each category. The rating analyst can identify and explain where management has strengths and shortfalls. If these shortfalls are not considered material, a rating unit can still score as adequate on an overall basis.

10 9 8 7 6 5 1.6% 1.4% 87.7% P/C RIW Category: Summary 76.7% 10.7% 21.9%

10 9 8 7 6 5 3.6% 3.6% 90.9% Life and Annuity RIW Category: Summary 83.4% 5.5% 13.

10 9 8 7 6 5 7.4% 4.4% 82.4% Health RIW Category: Summary 89.7% 10.3% 5.9%

Product / Underwriting Reserving Concentration Reinsurance Financial Flexibility Investments Legislative / Regulatory / Judicial / Economic Management Operational Risk Appetite / Stress Testing Summary 25% 15% 5% 15% 19% 22% 5% 16% P/C Companies 9% 15% 13% 14% 18% 13% Percent of companies with risk > capability

Product / Underwriting Reserving Concentration Reinsurance Financial Flexibility Investments Legislative / Regulatory / Judicial / Economic Management Operational Risk Appetite / Stress Testing Summary 35% 25% 15% 5% 19% 36% 9% Life and Annuity Companies 26% 14% 14% 14% 16% 17% 18% Percent of companies with risk > capability

Product / Underwriting Reserving Concentration Reinsurance Financial Flexibility Investments Legislative / Regulatory / Judicial / Economic Management Operational Risk Appetite / Stress Testing Summary 6 5 Health Companies 54% 34% 13% 6% 18% 25% 25% 24% Percent of companies with risk > capability

AM Best Company, Inc. (AMB) and/or its licensors and affiliates. All rights reserved. ALL INFORMATION CONTAINED HEREIN IS PROTECTED BY COPYRIGHT LAW AND NONE OF SUCH INFORMATION MAY BE COPIED OR OTHERWISE REPRODUCED, REPACKAGED, FURTHER TRANSMITTED, TRANSFERRED, DISSEMINATED, REDISTRIBUTED OR RESOLD, OR STORED FOR SUBSEQUENT USE FOR ANY SUCH PURPOSE, IN WHOLE OR IN PART, IN ANY FORM OR MANNER OR BY ANY MEANS WHATSOEVER, BY ANY PERSON WITHOUT AMB s PRIOR WRITTEN CONSENT. All information contained herein is obtained by AMB from sources believed by it to be accurate and reliable. AMB does not audit or otherwise independently verify the accuracy or reliability of information received or otherwise used and therefore all information contained herein is provided AS IS without warranty of any kind. Under no circumstances shall AMB have any liability to any person or entity for (a) any loss or damage in whole or in part caused by, resulting from, or relating to, any error (negligent or otherwise) or other circumstance or contingency within or outside the control of AMB or any of its directors, officers, employees or agents in connection with the procurement, collection, compilation, analysis, interpretation, communication, publication or delivery of any such information, or (b) any direct, indirect, special, consequential, compensatory or incidental damages whatsoever (including without limitation, lost profits), even if AMB is advised in advance of the possibility of such damages, resulting from the use of or inability to use, any such information. The credit ratings, financial reporting analysis, projections, and other observations, if any, constituting part of the information contained herein are, and must be construed solely as, statements of opinion and not statements of fact or recommendations to purchase, sell or hold any securities, insurance policies, contracts or any other financial obligations, nor does it address the suitability of any particular financial obligation for a specific purpose or purchaser. Credit risk is the risk that an entity may not meet its contractual, financial obligations as they come due. Credit ratings do not address any other risk, including but not limited to, liquidity risk, market value risk or price volatility of rated securities. AMB is not an investment advisor and does not offer consulting or advisory services, nor does the company or its rating analysts offer any form of structuring or financial advice. NO WARRANTY, EXPRESS OR IMPLIED, AS TO THE ACCURACY, TIMELINESS, COMPLETENESS, MERCHANTABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OF ANY SUCH RATING OR OTHER OPINION OR INFORMATION IS GIVEN OR MADE BY AMB IN ANY FORM OR MANNER WHATSOEVER. Each credit rating or other opinion must be weighed solely as one factor in any investment or purchasing decision made by or on behalf of any user of the information contained herein, and each such user must accordingly make its own study and evaluation of each security or other financial obligation and of each issuer and guarantor of, and each provider of credit support for, each security or other financial obligation that it may consider purchasing, holding or selling.