Risk Management Insurance Company Best Practices

1
Risk Management - Insurance CompanyBest Practices

• David Ingram, FSA, FRM, PRM
• Milliman Risk Management

2
Bank Risk Management Best Practices

• Group of 30 Report 1993
• FRB Field Audit Manual (1994)
• Bank of England Report 1995
• Basel Interest Rate Risk Management (1997)
• Counterparty Risk Management Policy Group 1999
• OSFI Standards of Sound Business Practices

3
1. Board Senior Management are Responsible for
Risk Management

• Best practice
• CRO has regular private meeting with Board Risk
  Management Committee
• Standard practice
• Management has annual RM report to board
• Basic practice
• No Board involvement in RMexcept for extreme
  problems

4
2. Senior management understands all firm
activities and understands the basis of the Risk
Management system

• Best practice CEO can explain risks and RM
  system of the company
• Standard practice CFO can explain risks and RM
  system of company
• Basic practice Individual risk specialists are
  the only ones who can explain risks and RM
  systems of the company

5
3. Authority and responsibility are clearly
defined, risk measurement and management are
independent from risk taking functions

• Best practice Independent RM function
  responsible for risk measurement and enforcement
  of risk limits
• Standard practice Dotted line relationships of
  risk management officers
• Basic practice RM is totally integrated in
  operating areas

6
4. All material risks are identified and
measured, exposures are aggregated and management
attends to largest exposures

• Best practice Single, clear enterprise wide
  Risk Report with name exposure list that includes
  credit, reinsurance, market indices
• Standard practice Single compilation of Risk
  Reports from business units
• Basic practice scattered risk reports from
  business units

7
5. There are risk limits for all material risks
and a system for enforcing the limits is part of
an internal control system that is relevant to
the risks of the firm

• Best practice Can readily identify risk limits
  for credit, market and insurance risks and
  consistent rationale for limits and have an
  active control system for each
• Standard practice Has separate clear limits for
  most significant risks and a regular process for
  monitoring compliance.
• Basic practice Has limits for most significant
  risks and some processes for monitoring
  compliance.

8
6. The firm has staff with sufficient expertise
to perform the risk management functions and
adequate systems support

• Best practice Has experts and back-ups for risk
  measurement and risk management functions
• Standard practice Has an expert for risk
  measurement/management
• Basic practice Relies on outside expertise for
  risk measurement /or management

9
7. Risk surplus is allocated to business units
and products and is used for capital budgeting
purposes

• Best practice Calculates Economic Capital using
  company models. Capital usage of activities is a
  major factor in decision making.
• Standard practice Uses Rating Agency / RBC
  formulas with modifications. Capital is
  allocated, but capital usage is rarely considered
  in decisions.
• Basic practice Uses RBC formulas without
  modification. Looks at capital position in time
  for analysts visit. Capital not allocated.

10
8. Stress testing is a part of the risk
management process

• Best practice Stress test credit, market and
  insurance risks
• Standard practice Stress test interest rate
  risks
• Basic practice NY 7 are only stress tests

11
9. New products and ventures trigger
consideration of potential new risks and new risk
management procedures

• Best practice Risk analysis is a primary
  component of new product review review is
  completed prior to go - no go decision on
  product
• Standard practice Risk analysis is a component
  of product development but rarely impacts on go
  no go decision
• Basic practice Ad hoc risk analysis of new
  products

12
10. Financial reporting allows management to view
the risk adjusted returns of business units,
products and activities

• Best practice Use IMR style reserves to
  accumulate release risk premiums that the
  reserving system does not recognize
• Standard practice RAROC style ROE is key
  financial target using risk capital as part of
  equity.
• Basic practice no risk adjustment

13
11. Product pricing and rate setting reflects the
risk adjusted return

• Best practice Risk Adjusted return targets for
  unusually high or low risk activities in addition
  to cost of risk surplus
• Standard practice Cost of risk surplus is
  primary risk adjustment
• Basic practice All pricing is for expected
  costs only with no (or ad hoc) adjustment for
  risk surplus or unusual risk levels

14
12. The firm has a process for quickly resolving
identified risk management weaknesses

• Best practice Makes improvements to RM systems
  procedures before they are required or common.
  Always seeking ways to improve processes and
  understand weaknesses.
• Standard practice Makes improvements as they
  become common practices.
• Basic practice Makes improvements to RM
  practices as they are required.

15
Risk ManagementEvolving Practices

• CRO Position Organizing for RM
• Use of CTE rather than VaR as a primary risk
  measure (aka CVaR, Tail VaR)
• Use of Company Model Economic Capital
• RAROC with continuously updated Economic Capital
• General Stochastic Approach to Risk Assessment
  for Insurance Products
• Variable Products Concentration
• Regime Switching model for capturing equity
  market tail risk
• Financial Market view of Variable Products
  benefits risks
• Hedging programs for Variable Products benefits
  risks

16
Risk Mapping

• AM Best
• November 1, 2004

17
(No Transcript)
18
ERM is Daunting

• To large companies
• wondering how to get started
• To small companies
• do not think that they have the resources to do
  ERM
• Risk Mapping is a process that can be used in
  both situations

19
Risk Mapping

• Process used in many industries and government
  entities throughout the world
• Also known as Heat Map
• Used by larger companies as a first step in a
  major Risk Management effort
• Used by smaller companies as their primary Risk
  Management program

20
Risk Mapping Best Practices

• Board Senior Management are Responsible for
  Risk Management
• Senior management understands all firm
  activitiesand understands the basis of the Risk
  Management system
• Authority and responsibility are clearly
  definedand risk measurement and management are
  independent from risk taking functions
• All material risks are identified and
  measuredExposures are aggregated and management
  attends to largest exposures
• There are risk limits for all material risks and
  a system for enforcing the limits that is part of
  an internal control system that is relevant to
  the risks of the firm
• The firm has staff with sufficient expertise to
  perform the risk management functions and
  adequate systems support

21
Risk Mapping Best Practices

• Board Senior Management are Responsible for
  Risk Management
• Senior management understands all firm
  activitiesand understands the basis of the Risk
  Management system
• Authority and responsibility are clearly
  definedand risk measurement and management are
  independent from risk taking functions
• All material risks are identified and
  measuredExposures are aggregated and management
  attends to largest exposures
• There are risk limits for all material risks and
  a system for enforcing the limits that is part of
  an internal control system that is relevant to
  the risks of the firm
• The firm has staff with sufficient expertise to
  perform the risk management functions and
  adequate systems support

22
Risk Mapping Best Practices

• Board Senior Management are Responsible for
  Risk Management
• Senior management understands all firm
  activitiesand understands the basis of the Risk
  Management system
• Authority and responsibility are clearly
  definedand risk measurement and management are
  independent from risk taking functions
• All material risks are identified and
  measuredExposures are aggregated and management
  attends to largest exposures
• There are risk limits for all material risks and
  a system for enforcing the limits that is part of
  an internal control system that is relevant to
  the risks of the firm
• The firm has staff with sufficient expertise to
  perform the risk management functions and
  adequate systems support

23
Risk Mapping Best Practices

• Board Senior Management are Responsible for
  Risk Management
• Senior management understands all firm
  activitiesand understands the basis of the Risk
  Management system
• Authority and responsibility are clearly
  definedand risk measurement and management are
  independent from risk taking functions
• All material risks are identified and
  measuredExposures are aggregated and management
  attends to largest exposures
• There are risk limits for all material risks and
  a system for enforcing the limits that is part of
  an internal control system that is relevant to
  the risks of the firm
• The firm has staff with sufficient expertise to
  perform the risk management functions and
  adequate systems support

24
Risk Mapping Best Practices

• Board Senior Management are Responsible for
  Risk Management
• Senior management understands all firm
  activitiesand understands the basis of the Risk
  Management system
• Authority and responsibility are clearly
  definedand risk measurement and management are
  independent from risk taking functions
• All material risks are identified and
  measuredExposures are aggregated and management
  attends to largest exposures
• There are risk limits for all material risks and
  a system for enforcing the limits that is part of
  an internal control system that is relevant to
  the risks of the firm
• The firm has staff with sufficient expertise to
  perform the risk management functions and
  adequate systems support

25
Risk Mapping Best Practices

• Risk surplus is allocated to business units and
  products and is used for capital budgeting
  purposes
• Stress testing is a part of the risk management
  process
• New products and ventures trigger consideration
  of potential new risks and new risk management
  procedures
• Financial reporting allows management to view the
  risk adjusted returns of business units, products
  and activities.
• Product pricing and rate setting reflects the
  risk adjusted return.
• The firm has a process for quickly resolving
  identified risk management weaknesses

26
Risk Mapping Best Practices

• Risk surplus is allocated to business units and
  products and is used for capital budgeting
  purposes
• Stress testing is a part of the risk management
  process
• New products and ventures trigger consideration
  of potential new risks and new risk management
  procedures
• Financial reporting allows management to view the
  risk adjusted returns of business units, products
  and activities.
• Product pricing and rate setting reflects the
  risk adjusted return.
• The firm has a process for quickly resolving
  identified risk management weaknesses

27
Risk Mapping Best Practices

• Risk surplus is allocated to business units and
  products and is used for capital budgeting
  purposes
• Stress testing is a part of the risk management
  process
• New products and ventures trigger consideration
  of potential new risks and new risk management
  procedures
• Financial reporting allows management to view the
  risk adjusted returns of business units, products
  and activities.
• Product pricing and rate setting reflects the
  risk adjusted return.
• The firm has a process for quickly resolving
  identified risk management weaknesses

28
Risk Mapping Best Practices

• Board Senior Management are Responsible for
  Risk Management
• Senior management understands all firm
  activitiesand understands the basis of the Risk
  Management system
• Authority and responsibility are clearly defined
• All material risks are identified and exposures
  are aggregated and management attends to largest
  exposures
• New products and ventures trigger consideration
  of potential new risks and new risk management
  procedures
• The firm has a process for quickly resolving
  identified risk management weaknesses

29
Risk Mapping Project

• Install Risk Mapping Process
• Quarterly Review of Risk
• Annual Risk Report
• Risk Management Advisor

30
A. Installing Risk Mapping

• Risk Identification
• Risk Assessment
• Prioritization
• Risk Responsibility
• Risk Monitoring
• Risk Plan

31
1. Risk Identification

• Start with AAA and COSO risk lists
• Divide into broad categories
• Operational
• Marketing
• Product
• Investment
• Select actual risks in each area

32
(No Transcript)
33
(No Transcript)
34
2. Risk Assessment

• Frequency Severity
• Existing Risk Transfer
• Existing Risk Management
• Controls Limits
• May refine risk list as part of this step

35
3. Prioritization
36
4. Risk Responsibility

• For Each Important Risk identify
• Senior Manager Responsible
• Manager in charge of transfer program or
  management program
• Person responsible for monitoring

37
Risk Responsibility Chart
38
5. Risk Monitoring Management

• Monitoring
• Volume Report
• Loss Report
• Exception Report
• Managing
• Transfer
• Limit
• Offset
• Retain

39
Monitoring Managing
40
6. Risk Plan

• Planned Changes to
• Responsibilities
• Monitoring
• Transfer
• Management
• Controls Limits
• Concentrate on improvements relating to High
  Priority Risks

41
Risk Plan
42
(No Transcript)
43
B. Quarterly Review of Risk

• Identify External Risk changes
• Identify Internal Risk changes
• Assess Plan Progress
• Review Monitoring Reports
• Modify Plan if needed

44
Annual Risk Report

• Written Report to Management
• Optional
• Oral Report to Board
• Oral Report to Rating Agency
• Summary Material for Annual Report

45
Annual Risk Report

• General Description of Risks to Industry,
  Products Markets
• Description of Company Risks
• Summary of Risk Assessment Priorities
• Statement of Risk Responsibilities
• Statement of Risk Transfer Risk Management
  Programs in place
• Summary of Prior year Risk Plan Actions Taken
• Summary of Risk Monitoring Reports
• Recommendation for next years Risk Plan

46

• David Ingram, FSA, FRM, PRM
• Risk Management Consulting

One Pennsylvania Plaza, 38th Floor New York, NY
10119 212 279 7166 david.ingram_at_millliman.com