Enterprise Risk Management

Insurers lead the way

Implementation of ERM appears to have aided insurers in avoiding the worst of the financial crisis

By Michael J. Moody, MBA, ARM

Enterprise risk management (ERM) has been in the risk management lexicon for more than 10 years. It has gotten a lot of attention for the way that it looks at an organization's risks from a holistic viewpoint.

Early on, it was the banking industry that pioneered the concept and led with most of the research. From the outside, it appeared that the banks had discovered a better method of managing their risks. However, while the ERM concept has validity, the most recent worldwide financial crisis has proven that many banks were only giving lip service to it, rather than integrating ERM into their strategic plans.

It has been a different story for another major component of the financial service sector: the insurance industry. For the most part, the insurance industry has taken the ERM concept to heart; and while the industry's performance during the recent financial crisis was mixed, most insurers were satisfied with their results.

According to Towers Watson's most recent Global Insurance and Risk Management Survey; about 58% of the 465 insurance company executives participating in the study indicated they were satisfied with their firm's ERM performance during the financial crisis. Additionally, only 11% stated they were dissatisfied with their company's performance.

Among the core risk control techniques that the participants noted were management of individual risk exposures, risk monitoring and reporting, and risk limits and controls. Further development of these risk control frameworks was also noted, with over 42% indicating that they would be developing risk appetite statements within the next 12 months.

In fact, many of the participants noted the importance of the risk appetite statement and pointed to the fact that "companies that have a documented risk appetite statement in place are more likely to be satisfied with the performance of their ERM programs." Most of the participants had done significant amounts of work on implementing risk appetite and tolerance statements since the last study in 2008. The principal focus of these statements is to articulate the degree of risks the insurer is willing to take and it is being expressed via balance sheet solvency calculations. More participants are also beginning to include earnings-related measures.

Acceptance of ERM within the insurance industry has been widespread. At this point in time, the movement of insurers/reinsurers to ERM is being driven by several powerful factors.

Rating agency involvement

Early on, the rating agencies began to see the value of ERM and most major agencies supported the movement. In the early stage, Standard & Poor's (S&P) was by far the most active in promoting the ERM concept. To this day, S&P has offered the strongest position by developing an ERM framework that it uses as part of its overall rating matrix. The S&P rating matrix is made up of eight components, ERM being one of those.

As S&P began to incorporate ERM into its models, the industry saw rating either increasing or decreasing based on the grading of the insurer's ERM program. Obviously, this kind of impact had an immediate effect on the industry and many carriers began serious efforts to improve their ERM programs.

Similar analyses of ERM programs were also being incorporated into A.M. Best and Moody's ratings.

As was noted in their publication titled Enterprise Risk Management: More Important, But Still No Panacea, S&P realized that by incorporating ERM analysis they "could provide more structure and consistency in their assessment of a company's risks." Further, S&P believes: "It enables analysts to drill deeper into quantitative financials, links risk management to overall corporate strategy, and allows greater prospectiveness in S&P's analyses."

The publication goes on to note that, since introducing its ERM criteria in 2005, S&P has "witnessed a remarkable level of evolution" within the industry. And while S&P saw a favorable ERM evaluation as a competitive advantage, today it is even more important. "In summary, enterprise risk management—both as a philosophy and a discipline—is becoming a necessity, not an option."

Actuarial involvement

Many of the strategic aspects within the insurance industry are directed by actuaries. As a professional group, the Society of Actuaries (SOA) was one of the organizations that was able to make the jump from an insurance-based risk environment to accepting a more holistic approach to risk management. Actuaries, through the SOA, have invested significant time and capital into developing and implementing ERM-related services. The most tangible sign of this commitment was the development of the Chartered Enterprise Risk Analyst (CERA) designation—the first internationally recognized ERM credential.

Much of the advancement of ERM within the insurance sector has been due in large part to the tireless efforts of the SOA. Their ability to develop unique modeling approaches that utilize risks beyond the traditional "insurable" exposures to more of a 360-degree view of an insurer's/reinsurer's risk profile has greatly assisted in assessing and managing a holistic view of risk management.

Not only has the actuarial profession been instrumental in advancing the reach of ERM, individually they have served as a vital resource for ongoing ERM educational efforts. Their annual ERM symposium, which is in its eighth year, is one of the largest educational endeavors dedicated exclusively to enterprise risk management, with many specific insurance company-related sessions.

As ERM begins to take on more importance in non-financial service sectors, the SOA and its members will become even more important in its growth.

Regulatory involvement

The regulatory involvement within the insurance industry has been, for the most part, adequate. In the United States, much of the regulation has been handled by the individual state insurance departments. While state regulations have generally been viewed as good, over time, some experts have come to believe that the rating agencies have been the "power behind the throne." They believe the rating agencies have become de facto regulators.

Rating agencies are quick to point out that this is not possible because they do not have a supervisory role, but rather an independent assessment role to determine the financial strength of a carrier.

Rating agencies and critics of the current regulatory environment all believe that strengthening of the current regulations for insurers would help restore a balance of power between the agencies and the regulators.

In Europe, the upcoming implementation of Solvency II has taken center stage. Despite the fact that it does not take effect until 2012, Solvency II will have a profound effect on the ERM efforts of European insurers/reinsurers. Many believe that Solvency II will provide an important catalyst for the further development of ERM.

One of the reasons for this optimistic outlook is that it will build an ERM framework by instilling a greater risk awareness into the culture of the organization. However, compliance with the new requirements will require a decision on the part of insurance/reinsurance companies. There are two clear directions that carriers can choose: a "back-office-led" technical compliance approach, or they can use Solvency II implementation, which, as PwC, in its study "Does ERM Matter?" suggests would be "an opportunity to bring ERM into the forefront of their strategy, operations and governance."

PwC believes that the best run insurers will put the management of risk and capital at the heart of their decision-making, thereby strengthening and embedding ERM within their organizations. This will increase the quality of ERM but will also bode well for meeting the increasing scrutiny from the rating agencies and investors as well.

What's next?

For a variety of reasons, the insurance industry has found itself at the cutting edge of the ERM movement. The insurance companies themselves, as well as many affiliated organizations, have developed a strong case that ERM can offer significant advantages for those organizations that implement ERM and have embedded it into their operational arsenals. As the Towers Watson study pointed out, "68% of the participants felt that their risk management efforts had enhanced business performance overall during the past 24 months." In addition, 92% of the survey executives "indicated that their ERM program has resulted in key business changes."

With the exception of AIG, "the insurer that was too big to fail," the insurance industry has proved to be an excellent case study in ERM implementation. As a result, many believe that the industry as a whole has benefited from this movement; and individually, several forward-looking insurers/reinsurers have already benefited from embedding ERM into their strategic plans. As S&P notes, "We still strongly hold to the opinion that ERM will be key for future corporate financial health" within the insurance sector. As was noted above, insurers/reinsurers have,for a variety of reasons, been accepting of a more holistic approach to risk management and, as a result, are in fact confirming the business case for ERM in the process.

The real challenge for ERM is how to take the lessons learned within the insurance sector and successfully implement them in other business segments. This expansion is of course necessary if ERM is going to fulfill its strategic role in corporate management.

The author

Michael J. Moody, MBA, ARM, retired as the managing director of Strategic Risk Financing, Inc. (SuRF), a firm that had been established to advance the practice of enterprise risk management. As a regular columnist, he continues to actively promote the concept of enterprise risk management by providing current, objective information about the concept, the structures being used, and the players involved.