Creating Value Through Enterprise Risk Management—A

RiskValueInsights ™

Taking Enterprise Risk Management

From Theory to Practice Results in™ RiskValueInsightsthe Industry Industry CreatingA TILLINGHAST–TOWERS Value Through PERRIN Enterprise MONOGRAPH Risk Management — A Practical Approach for the Insurance Industry

A TILLINGHAST–TOWERS PERRIN MONOGRAPH

www.tillinghast.com Page 1

Table of Contents

Part One: Laying the Groundwork for Strategic Enterprise Risk Management in the Insurance Industry: From Need, to Framework, to Process………………………………………2 I. Overview and Objective...... 3 II. The Case for an Insurance Industry-Specific Approach to Enterprise Risk Management ...... 5 III. RiskValueInsights™: Beginning With the Right ERM Conceptual Framework...... 10 IV. Moving From Concept and Framework to Action: Overview of the RiskValueInsights™ Process for ERM ...... 14

Part Two: Making the Right Choices: A Detailed Guide to Strategy Development…………19 V. Strategy Development, Step 1 — Assess Risks...... 20 Sidebar: Modeling Financial Risks...... 26 Sidebar: Modeling Operational Risks ...... 28 VI. Strategy Development, Step 2 — Articulate Strategies ...... 32 VII. Strategy Development, Step 3 — Evaluate Strategies Based on Policyholders’ Interests...... 36 VIII. Strategy Development, Step 4 — Evaluate Strategies Based on Owners’ Interests...... 43 IX. Strategy Development, Step 5 — Refine Strategies...... 48 X. Recapping the Strategy Development Stage of the RiskValueInsights™ Process...... 50 Sidebar: Illustrative Results...... 51 XI. Proceeding Incrementally...... 57

Appendices: (Index Page)...... 62 A. A Brief Recent History of the Risk of Not Managing Risks Holistically...... 63 B. Worldwide External Pressures...... 65 C. The Value of Consistency...... 69 D. Risk Measurement — for Policyholders and for Enterprise Owners ...... 73 E. Glossary of Risk Modeling Methods...... 75 F. An Overview of Change Management...... 80 G. Use of Appropriate Risk Measures in Determining Capital...... 81

Index to Figures...... 85 References and Recommended Reading ...... 88 Acknowledgments ...... 90 The Principal Authors...... 91 Page 2

Part One Laying the Groundwork for Strategic Enterprise Risk Management in the Insurance Industry: From Need, to Framework, to Process

We set the stage in the first four chapters by: Ⅲ Presenting an overview of the monograph and our objective in writing it (Chapter I) Ⅲ Laying out the business case for enterprise risk management in the insurance industry (Chapter II) Ⅲ Introducing RiskValueInsights™, our approach to enterprise risk management specifically designed for the insurance industry: — the conceptual framework (Chapter III) — the process (Chapter IV).

In Part Two (beginning with Chapter V), we focus on the strategy development stage of the RiskValueInsights™ process. We then provide suggestions on how to move forward in manageable increments. Chapter I Page 3

I.Overview and Objective between risk and value for their enterprise, based on the risk and value preferences of those n the face of well-publicized industry calami- managers, which are unique to each company. Ities1, increasing pressure from regulators, RiskValueInsights™ can help senior managers rating agencies and investors2 — and, perhaps achieve that goal because it: most importantly, for fundamental business Ⅲ incorporates all material risks — financial and reasons3 — insurance company executives are operational embracing the concept of enterprise risk man- Ⅲ evaluates all relevant strategies — financial agement (ERM) in increasing numbers. ERM and operational is generally defined as assessing and addressing risks, from all sources, that represent either Ⅲ considers all pertinent constraints (including material threats to business objectives or oppor- political/social, regulatory and competitive) tunities to exploit for competitive advantage. Ⅲ exploits the natural hedges and portfolio effects among the risks, and the financial and Yet, while they embrace the general concept, operational efficiencies among the strategies. insurance executives also report both dissatisfaction and frustration with actually implement- The result of applying this process is the opti- ing ERM. They don’t believe they have a mal set of strategies from the perspective of coherent conceptual framework to guide their both the policyholder and the owner — strate- thinking about ERM. They are dissatisfied with gies that balance the need for capital and the the tools they believe are currently available need for return, growth and consistency.4 to them to manage risk at the enterprise level. They are particularly dissatisfied with the tools ERM is multifaceted and may appear to manage operational, as opposed to financial, daunting to some. Indeed, we consider our risks. And they are not entirely clear about how RiskValueInsightsTM approach as the “ideal” to to incorporate enterprise-wide risk management strive for, gradually. We therefore conclude our into their larger strategic decision-making and monograph with ideas on pragmatic ways to overarching goal for their enterprises: to create implement ERM in a manageable, stepwise value. fashion, using the “building blocks” of RiskValueInsightsTM. To address the needs of insurance senior managers for an ERM process that is specific to Because the dynamics between risk and value the insurance industry and that explicitly links are quite different — and arguably more com- ERM to strategic planning, we have devel- plex — for insurers than for any other financial oped a new approach to ERM. We call it services sector, traditional financial industry RiskValueInsights™. It is intended to improve models are inadequate to produce optimal insurers’ ability to create value. It does so by results consistently. Our approach is grounded employing a formal process that allows senior in the realities of the insurance industry, and managers to find the optimal relationship blends industry-specific models and methods

1 See Appendix A, “A Brief Recent History of the Risk of Not Managing Risks Holistically.” 2 See Appendix B, “Worldwide External Pressures.“ 3 See Chapter II, “The Case for an Insurance Industry-Specific Approach to Enterprise Risk Management.” 4 One of the central goals of ERM is consistent financial performance. While some in the industry accept the fundamental value of consistency, others argue that investors do not favorably value companies that expend time and resources attempting to minimize volatility in their results. This volatility, the argument goes, can more efficiently be diversified away within the investor’s own portfolio. Our empirical research indicates that, holding constant other key drivers of share value (such as earnings growth and return on capital), investors do indeed assign considerable value to consistency, and earnings consistency in particular. See Appendix C, “The Value of Consistency,” for a full discussion of this point. Page 4 Chapter I

with tailored techniques from other industries Ⅲ How do we select our growth strategies, to address the industry’s key risk management given our risk environment? (Chapter VIII) problems. Ⅲ How can we maximize our return on capital, given our risk appetite? (Chapter VIII) We have attempted to include all sectors of the insurance industry (life, health, property/casu- Ⅲ How do we best invest our assets, given the alty and investment management) and have structure of our liabilities? (Chapter VIII) highlighted issues of specific relevance to indi- Ⅲ How much, and on what terms, should we vidual sectors where appropriate. reinsure/hedge? (Chapter VIII) We prepared this monograph in direct response Ⅲ What must be done to implement a sound, to insurance executives’ declared desire for comprehensive risk management framework a unifying ERM framework specific to their and process throughout the organization? industry. We address the concerns they ex- (Chapters IV, IX, X) pressed regarding their lack of tools, processes Ⅲ How can we continually evaluate our risk and time. In the following chapters we describe management program? (Chapters IV, IX, X) an approach to ERM that is: Ⅲ How should we report our risk management Ⅲ conceptually straightforward results? (Chapter IV) Ⅲ based on sound science as well as practical Ⅲ How should we communicate our risk man- realities agement programs to outside audiences? Ⅲ implemented in manageable steps. (Chapter IV) Ⅲ How does all this relate to value creation? Specifically, the monograph will help insurance (Chapter III) executives respond in a coherent way to strategic, financial and operational questions such as: Ⅲ How do we get to full ERM in manageable steps? (Chapter XI) Ⅲ How can we identify the key or emerging risks that deserve senior management RiskValueInsightsTM recognizes that the answers attention? (Chapter V) to these questions are fundamentally related. In Ⅲ How do we measure and manage our opera- the pages that follow, we outline how to exploit tional risks with the same level of sophistica- these fundamental relationships to unlock tion as we do for financial risks? (Chapter V) value. Ⅲ How do we relate risk management activities We intend to continually update and enhance to the business’s bottom line? (Chapter VI) this monograph. We are sincerely interested in, Ⅲ How much capital do we need? And how do and invite you to share with us, your comments we convince the rating agencies? (Chapter and suggestions. VII) Ⅲ How should we evaluate business segment performance, given the differing levels of risk each segment contributes to the enterprise? (Chapter VII) Chapter II Page 5

II.The Case for an Insurance Industry- ance companies, to help them meet their own ERM challenges. Whether the need is sophisti- Specific Approach to Enterprise cated risk assessment, risk modeling, risk miti- Risk Management gation or risk financing, the financial services industry is assumed to be ahead of the game. A financial institution that can demonstrate that it A.The Promise of ERM for the Insurance has, in fact, mastered ERM internally will make Industry itself more credible in the marketplace and, as a There are very sound business reasons that result, more likely to attract and retain increas- insurance companies and other financial services ingly sophisticated customers. organizations have begun to embrace ERM. Moreover, the insurance industry is now experi- These organizations believe ERM can help encing strategic and operational problems that increase the value of their companies.5 This belief lend themselves to ERM solutions. Insurers is founded upon ERM’s potential to: today face decreasing margins, increasing competition from unconventional sources, more Ⅲ avoid “land mines” and other surprises demanding stakeholders and — for many lines Ⅲ improve the stability and quality of earnings6 — too much capital pursuing too little business. Ⅲ enhance growth and return by more knowl- The industry is also in the midst of fundamental edgeably exploiting risk opportunities and changes in technology, distribution systems and managing/allocating capital customer expectations that create new risks and challenge high performance. Convergence of Ⅲ identify specific opportunities such as natural the banking and insurance sectors brings synergies and risk arbitrage additional uncertainties and greater levels of Ⅲ reassure their many stakeholders that the scrutiny. business is well managed — stakeholders that include investors, analysts, rating agencies, In this more complex environment, insurers regulators and the press. need to wring maximum value from the business by making sound decisions about: The confidence of another group of stake- Ⅲ products/markets holders — depositors and policyholders — Ⅲ represents a very important asset to banks and distribution insurance companies. Protecting the interests Ⅲ investments/assets of these parties, properly recognizing the risks Ⅲ operations they present and balancing their interests against those of the owners of the enterprise are Ⅲ human resources distinct motivating factors for financial services Ⅲ capital companies to adopt the rigor of ERM. Ⅲ hedging/reinsurance. Also, financial services companies have a distinct competitive reason to get ERM right. Organizations in all industries are looking to the financial services industry, particularly insur-

5 Based on our client experiences, discussions with industry executives, and specific results of our insurance industry ERM surveys and interviews cited later in this chapter. 6 An empirical study exploring the explicit linkage between stability of earnings and enterprise value is summarized in Appendix C, “The Value of Consistency.” Page 6 Chapter II

Although these decisions — and their attendant FIGURE 1 risks — are usually treated by managers as sepa- Will ERM help address the top 10 issues? rate and distinct, they are, in fact, an interrelat- % of respondents selecting “yes” ed mix of financial and operational judgments. 0% 20 40 60 80 100% A classic example of this for industrial companies generally is: foreign exchange fluctuation Earnings growth (a financial risk) is mitigated by buying source 80% goods and services closer to the point of sale Revenue growth 47% of one’s own products and services (an operational strategy), reducing the need for currency Return on capital 97% hedging (a financial strategy). While this partic- Expense control ular example may be of only limited use to 57% many insurance companies, consider the Competition following insurance-specific interplay of 62% strategies/risks: Capital management/allocation Ⅲ Moving from high front-end commissions to 100% higher renewal commissions brings agents’ Earnings consistency 100% interests and policyholders’ interests into Pricing adequacy closer alignment and mitigates the risk of 72% market conduct problems. Asset/liability management Ⅲ Involving asset managers in product develop- 81% ment decisions reduces asset-liability mis- M&A activity match risk. 80% Ⅲ Figure 1: Respondents believe that ERM will help them address Selling products over the Internet may their top business issues, shown above in order of importance require simplified product features, options (Source: Enterprise Risk Management in the Insurance Industry: and pricing. This should improve administra- 2000 Benchmarking Survey Report, cited among the references on pages 88 and 89). tive efficiency, increase product transparency and reduce the risk of product misrepresenta- tion. However, there may be loss of brand Clearly, insurance industry senior managers hope awareness as customers price shop. Also, that ERM will live up to its promise. We saw claim costs may increase if there is less oppor- that in a worldwide survey of industry Chief tunity to gather and verify applicant data for Financial Officers, Chief Actuaries and Chief risk rating. Risk Officers conducted in 2000 by Tillinghast – Towers Perrin. (Enterprise Risk Management The promise of ERM for insurers is that it can in the Insurance Industry: 2000 Benchmarking help them integrate the evaluation of these Survey Report, our full report on the results of financial and operational decisions by demon- the survey and related interviews, is listed strating their impact on both financial and among the references on pages 88 and 89.) operational risks. Moreover, the promise of ERM is that this integrated evaluation can actually change, and improve, business decisions. Chapter II Page 7

FIGURE 2 B.The Doubts That Industry Leaders What are the barriers to an industry-specific ERM? Have About the Current State of ERM % of respondents selecting in Insurance 0% 10 20 30 40 50% While insurance senior managers see the potential value of using ERM strategically to help Tools them build value, they also report significant 50% frustration and dissatisfaction with the current Organizational turf 47% state of ERM in the industry today. In particu- Processes lar, insurance executives cite several barriers in 41% their path to an industry-specific ERM. In our Time benchmarking survey, the barriers most often 39% cited were, in descending order across all Culture respondents: tools, organizational turf, 29% processes and time (see Figure 2). Cost 24% The concern about tools was especially clear for Technology those tools intended to assess, measure, miti- 18% Intellectual capital gate and finance operational risks. Across all 14% categories of operational risk (including, for Skills/talent example, reputation/rating, distribution chan- 14% nel and people/intellectual capital), only 55% of respondents, on average, said they were Figure 2: Respondents identified barriers to integrating risk management (Source: Enterprise Risk Management in satisfied with these tools; for financial risks the Insurance Industry: 2000 Benchmarking Survey Report, (including interest rate, credit and currency) cited among the references on pages 88 and 89). the average was 70% (see Figure 3).

Among the key findings of the survey was that With respect to risk management processes, these industry executives believe ERM will help survey respondents were most dissatisfied with them address their key business issues. Eighty their current ability to: percent of respondents feel that ERM will help Ⅲ include operational risk in the determination with earnings growth, which they identified as of economic capital their number one business issue. Ninety-seven Ⅲ percent believe that ERM will help improve stochastically model the important opera- return on capital, their number three business tional and financial risks issue. Almost half (47%) believe that ERM will Ⅲ prioritize risks from disparate sources using a even help with top-line revenue growth, their common metric number two issue. The majority of respondents, Ⅲ and in some cases 100% of them, feels that optimize financial and operational risk man- ERM will help with each of the remaining busi- agement strategies in light of the organiza- ness issues on their top 10 list (see Figure 1). tion’s risk/return requirements Ⅲ accurately model the impact of risks and strategies on financial results. Page 8 Chapter II

FIGURE 3 How satisfied are you with your current tools to manage risk?

0% 20 40 60 80 100% 0% 20 40 60 80 100%

Interest rate Reputation/rating 87% 69% 75% 60% 69% 57% Credit Products 84% 66% 78% 58% 73% 62% Reinvestment Political/regulatory 82% 66% 63% 61% 67% 56% Asset market value Expenses 80% 64% 71% 49% 64% 43% Liability Technology 77% 63% 71% 50% 71% 48% Liquidity Catastrophe 76% 62% 77% 55% 66% 54% Currency Distribution channel 69% 61% 74% 53% 74% 49% Capital markets People/intellectual capital 69% 34% 58% 33% 53% 28%

Assessment/measurement Mitigation Retention/transfer

Figure 3: Respondents believe that ERM will help them address their top business issues (Source: Enterprise Risk Management in the Insurance Industry: 2000 Benchmarking Survey Report, cited among the references on pages 88 and 89). Chapter II Page 9

Finally, they were not convinced that they The ERM framework for insurers must recog- had a coherent framework to guide their risk nize the unique nature of insurance operations management activities — and they felt they — this is particularly important in this era of needed one. industry convergence. Bank assurance groups, for example, must be careful not to simplistical- C.Temptation: Borrow From Banking ly apply to insurance businesses the tools and techniques that were developed to manage Given the dissatisfaction with the current state banking businesses. of ERM in the insurance sector — particularly for managing operational risks — it’s not sur- prising that some managers believe they can D. RiskValueInsightsTM: The Strategic speed the implementation of ERM in this Enterprise Risk Management Approach industry by simply borrowing and “tweaking” for the Insurance Industry concepts and tools from the banking sector. It is abundantly clear, then, that the insurance The temptation may be particularly strong industry wants and needs its own approach to because it looks like the banking sector has ERM. We believe RiskValueInsightsTM meets made significant progress organizationally with that need. Our approach, detailed in the chap- the creation of the senior-level Chief Risk ters that follow, directly addresses the desire Officer function. But, while this approach has of insurance executives for a unifying frame- fostered consistency of measurement and work, as well as their concerns regarding tools, oversight of financial risks, the treatment of processes and time. operational risks in banking remains largely qualitative and ad hoc.7 (See the discussion of Modeling Operational Risks in Chapter V.)

That’s one of the reasons we believe it would be a mistake to try to simply adopt the methodologies and measures prevalent in banking to the insurance industry. More fundamentally, the operations of these sectors, and their attendant risks, differ in important ways, and for the insurance industry these risks are, arguably, more complex. These fundamental differences are explored in Section III.C.

7 Though the New Basel Capital Accord attempts to impose some conformity. Page 10 Chapter III

III.RiskValueInsights™:Beginning With the It comprises: the development, implementation and monitoring of financial and Right ERM Conceptual Framework operational strategies for assessing, mitigating, financing and exploiting financial RiskValueInsights™ takes as its foundation a and operational risk for the purpose of conceptual definition and framework for ERM increasing enterprise value. that is specific to the insurance industry. Our definition is grounded in the fact that insurers’ In this definition, financial risks refer to asset core business is creating value by assuming risk. and liability risks (e.g., investment, currency, inflation, underwriting); operational risks A. Definition of ERM for Insurers comprise business and event risks (e.g., tech- We define ERM for insurers as the nology failure, natural catastrophes and new optimization of the dynamic relationship competition). Financial strategies refer, for between risk and value throughout the example, to capital structure, asset allocation, insurance enterprise. product mix, reinsurance and financial hedg-

FIGURE 4 Internal and external environments create financial and operational risks External Internal Risk Environment Environment

Economic conditions Expansion/diversification FINANCIAL

Social/legal trends Culture Asset Political/regulatory climate Liability Distribution Natural catastrophes Risk appetite Reputation/rating agency People Customer behavior Business Competition Processes Event Investor expectations Technology OPERATIONAL

FIGURE 5 The complete array of financial and operational strategies should be investigated Risk Financial Operational Strategies Strategies

FINANCIAL Capital structure M&A Technology Asset Investment strategy Liability Internal controls Pricing Incentive programs Hiring/training Product mix Business Customer service Event Dynamic hedging Market strategy OPERATIONAL Reinsurance Distribution Chapter III Page 11

FIGURE 6 The objective is to increase enterprise value by establishing the proper foundation of capital, enhancing growth opportunities, increasing return on capital and improving the consistency of results

INCREASE VALUE by

Enhancing Increasing Improving growth return consistency

Providing appropriate level, structure and allocation of capital

ing; operational strategies include internal Ⅲ Apply this knowledge in a holistic risk man- controls, hiring/training/incentive plans, agement framework, exploiting financial and distribution systems, culture change and operational efficiencies among the strategies, process engineering. and portfolio effects and natural hedges among the risks. This definition informs both the RiskValueInsightsTM framework — a way to Ⅲ Increase value by: think about ERM for insurers — and the — providing an appropriate level, structure process — how to accomplish it. and attribution of capital — which opti- mizes capital use and establishes the prop- B. RiskValueInsightsTM: Creating a er business performance measurement Framework to Increase Enterprise Value framework Managers of an insurance enterprise need to — enhancing growth opportunities — by be concerned with myriad separate but related identifying the growth strategies that best activities, ranging from product and distribu- exploit the organization’s risk condition tion, to investments, to financing, to organiza- and appetite tional issues. The overall objective of these — increasing return on capital — by rigor- activities is to increase the value of the enterprise. ously analyzing and selecting strategies The best way for insurance managers to achieve that optimize the risk/return profile for this objective is to: the overall enterprise — improving the consistency of results — Ⅲ Understand the full external and internal by identifying the primary sources of per- environments within which they operate. formance volatility, and pursuing strate- These environments create the financial and gies, including risk pooling and natural operational risks unique to each enterprise hedges, that address them (see Figure 6). (see Figure 4). Figuratively speaking, insurance managers Ⅲ Investigate the complete set of financial and attempt to build a sturdy edifice in a very haz- operational strategies available, any of which ardous climate. The risk environment is the may be applicable to both financial and oper- climate they must operate within. The value ational risks (see Figure 5). edifice is built on a foundation of capital and is Page 12 Chapter III

FIGURE 7 The RiskValueInsights™ framework for insurance companies integrates financial and operational risk assessment in developing financial and operational strategies to increase value

INCREASE VALUE

Enhance Increase Improve growth return consistency

ESTABLISH CAPITAL

Holistically manage financial and operational risks Understand both Investigate both internal and external Exploit natural financial and operational environments hedges strategies and portfolio effects

supported by the three pillars of growth, return gration of risk management activities, such as and consistency. The relationship between risk risk assessment, financial risk modeling, opera- and value is complex and dynamic. tional risk modeling, capital management, RiskValueInsightsTM is the approach by which asset/liability management and reinsurance/ managers optimize this relationship (see Figure 7). hedging strategy. ERM for Insurers versus Other Financial C. What’s Different About This? Institutions. ERM for insurers and for other

ERM versus Traditional Risk Management. FIGURE 8 ERM, as we have defined it within ERM integrates all risks and all strategies RiskValueInsightsTM, embraces financial and operational risks and financial and operational Financial Operational Strategies Strategies strategies. The goal is to manage both types

of strategies and risks within a coherent frame- Current State of work that recognizes and exploits their rich Risk Management Financial interplay. This goes beyond traditional industry DFA Risks ALM approaches — such as dynamic financial analysis RCM (DFA), asset/liability management (ALM), risk DCAT and capital management (RCM), dynamic capi- DST tal adequacy testing (DCAT) and dynamic Future State of Risk Management solvency testing (DST) — that tend to focus Operational exclusively on financial strategies to manage Risks financial risks (see Figure 8). Moreover, RiskValueInsightsTM provides the logical inte- Chapter III Page 13

financial services companies have some similari- Ⅲ Insurers and banks have different views of ties — but also some fundamental differences. operational risks: The major differences between insurance and — Insurance companies have not been sub- banking from a risk management perspective are: jected to as much regulatory pressure as banks in connection with the avoidance Ⅲ Insurance liabilities are not known with cer- or mitigation of operational risks because, tainty. They are evolving estimates of pay- unlike banks, they cannot cause directly ments to claimants and can thus display a malfunction of the national or interna- significant volatility. In addition, these liabili- tional payment and settlement systems. ties are subject to claims being contested Banks, as a result, are primarily concerned (often involving litigation) and the impact of with event risks, such as technology public policy (governmental or court failures. activism) that significantly increase their vari- — Insurance companies are concerned about ability. Bank liabilities, primarily deposits, business risks, especially reputation risks, generally are known with certainty. such as those resulting from their relative Ⅲ Insurance liabilities cannot be traded easily lack of control over people selling their or efficiently in open markets. They are products (e.g., independent insurance comparatively illiquid and cannot be easily agents). “marked to market.” In banking, it is assets Ⅲ Insurance risk, resulting from underwriting that cannot easily be marked to market, while activities, is primarily associated with insur- liabilities, especially money market instru- ance liabilities. Credit risk, one of the main ments, are traded in highly efficient markets risks that banks have, is related to their assets. and are therefore easily marked to market. So, insurance companies expend much ener- Ⅲ Insurance liabilities can have long remaining gy managing liability risk, and banks expend term to maturity and duration. much energy managing asset risk. Ⅲ Insurance company balance sheets, especially Ⅲ Insurance products have high acquisition in the property/casualty industry, can include costs resulting in long break-even periods, significant amounts of assets and liabilities but savings products are generally profitable that are related to contracts that have from day one. expired. For banking products, in general, Ⅲ In insurance, there has been little uncoupling assets and liabilities are extinguished when so far between the generation of assets and contracts expire. liabilities — they both originate from the Ⅲ Insurance companies are much less exposed same contracts. This makes it more difficult to liquidity risk than are banks, because their for insurance companies to understand and liabilities are not payable on demand. This manage the performance impact of linkages difference explains why a run on a bank can between assets and liabilities (the sharp dis- cause failure in a matter of hours, while it tinction between deposit taking and lending takes months or longer for policy lapses to activities and their uncoupling makes this task force an insurance company to reorganize easier in most banks). or cause it to fail. RiskValueInsightsTM explicitly recognizes the unique nature of insurance operations. Page 14 Chapter IV

FIGURE 9 IV.Moving From Concept and Framework The RiskValueInsights™ framework is made to Action:Overview of the a reality through strategy development, implementation and monitoring RiskValueInsights™ Process for ERM

Im A conceptual framework, however sound, is st p e St le B s ra m meaningful only if it can help improve the e t p i e e o g l g n management of the enterprise. In this chapter, e i e t e t v a s we outline a systematic process that helps man- r e t

S agement make well-informed decisions in key D strategic areas and thus “operationalizes” the TM RiskValueInsights framework. The process M involves the development, implementation and o e n c it n monitoring of strategies, executed in a continu- a or a nd Perform t al loop (see Figure 9). E n nvironme We provide an overview of each of these three stages in this chapter. In the five chapters that and effective. In this monograph, strategy follow (V through IX), we will focus on the development refers to the process of making details underlying the strategy development annual decisions with respect to issues such stage. In each of those chapters we outline each as distribution channel, capital deployment, of the five steps in the strategy development investments and technology. It does not refer process that represent the “ideal” to be striven to long-term business planning decisions relat- for. Although it would be the rare company ed, for example, to business model (e.g., manu- that could immediately jump to this ideal facturing versus distribution) and branding. process for developing strategy, clearly defining The goal of strategy development in this con- and communicating the ultimate goal is helpful text is to optimize management’s response to in constructing a transition path toward the the following types of questions: ideal. However, even for some very progressive Ⅲ companies, the path has been blocked with the What should our product mix be? baggage of legacy information technology, Ⅲ What channels should we distribute the “silo based” organizational structure and lack products through, and to which markets? of tools. In Chapter XI, therefore, we propose Ⅲ What set of agency ratings should the com- how companies could move incrementally pany target? And how do we most efficiently toward this ideal process in manageable steps. achieve our target rating(s)? Ⅲ A.The Process Begins With Strategy How much capital should we hold and how Development should we attribute it to each product/business line to properly gauge performance? Strategy development is the critical first stage — investing in a rigorous effort at this point Ⅲ How much and on what terms should we will pay dividends by making the subsequent reinsure/hedge? stages, and the entire process, more disciplined Ⅲ How should we invest our assets? Ⅲ How much should we invest in technology, and which technologies? Chapter IV Page 15

Ⅲ How should resources be assigned to sales in terms of the organization’s bottom-line versus service, and how should they be financials. deployed across products and regions? 3. Evaluate strategies using the stochastic finan- Ⅲ How much should we spend on recruiting, cial model in this step and the next by con- training and retention? sidering both policyholders’ concerns and owners’ interests, respectively. Specifically, in These questions should be answered with the this step policyholders’ concerns about sol- objective of maximizing economic value over vency are reflected in the determination of the long term while minimizing the risks of capital requirements. large deviations from expected performance. While each management team for each enter- 4. Consider owners’ interests by analyzing a prise may have different preferences for maxi- combination of financial metrics focused on mizing value versus averting risk and while the the drivers of value: growth, return and con- circumstances under which each must develop sistency. Strategies will differ in their impact its strategy will also differ, the process for on each of these drivers. This step will answering these questions is the same regard- require optimizing the trade-offs among the less of the risk-value preferences. The strategy value drivers based on management’s objec- development stage consists of five steps (see tives and constraints. Figure 10). 5. In practice, the process is typically not as 1. Assess the current internal and external risk straightforward as depicted. Decomposition environments. This includes assessment of of the results of steps 3 and 4 will likely sug- both financial and operational risks, using gest ways to fine-tune the strategies through both qualitative and quantitative methods. minor modifications. However, these refined strategies must go through the evaluation 2. Articulate alternative financial and opera- process with respect to policyholder’s con- tional strategies for maximizing value within cerns and owners’ interests by repeating the current risk environment. In addition, these two steps. We have formalized this create a stochastic financial model of the decomposition analysis and described it as business to express the interaction of the a final, optimization step of the strategy financial and operational risks and strategies development process.

FIGURE 10 The RiskValueInsights™ strategy development stage has five steps

Evaluate Evaluate Assess Articulate Strategies: Strategies: Risks Strategies Policyholders’ Owners’ Perspective Perspective

t I Refine Strategies es m B S p s tr le p ie a m o g te l e e e t g i n v a e r t e t s

D S

o n it c a o n n r a d Perform E nt nvironme Page 16 Chapter IV

Before discussing each of these steps in the five At the other extreme, an operational strategy chapters that follow, it is useful to consider what such as adopting the Internet as a primary must happen once management has agreed on a distribution channel, or deciding to compete set of financial and operational strategies. The exclusively on the basis of customer service, remaining two sections of this chapter present requires substantial change of behavior among an overview of the strategy implementation and a significant number of employees. At a mini- ongoing monitoring stages. mum, extensive training/retraining of affected staff and redesign of employee incentive plans B.The Second Major Stage Is Strategy are required. Implementation For all but the most straightforward strategies, The optimal set of strategies for a particular implementation should follow a well-planned organization will be drawn from a mix of possi- change management process (see Figure 11). ble strategies, from the straightforward and Of course, the level of necessary detail within quickly implemented to the complex and multi- this process will vary depending upon the strat- year. These latter strategies often involve sub- egy. (See Appendix F, “An Overview of stantial people-oriented activities that may Change Management,” for more on this topic.) require broad-scale behavior modification.

A financial strategy such as changing the orga- C.The Third Major Stage Is Monitoring nization’s outward reinsurance program is an Strategy Performance and Risk example of straightforward activity, and is rela- Environment tively easy to implement. In fact, all that’s Once the financial and operational strategies required is to obtain the necessary senior man- have been implemented, their performance agement approval of the program design, pric- must be monitored to make sure they are ing and counterparties, and to secure coverage. achieving their goals. Similarly, the risk environment must be continually monitored to make Much of the groundwork for these activities certain that key assumptions have not changed. will have been laid in the strategy development These assumptions include financial and opera- stage. A reinsurance program change does not tional variables such as interest rates, productiv- require broad-based buy-in of the organization ity, sales, claims, persistency, employee turnover as a whole. and investment return. Significant deviation

FIGURE 11 To implement certain strategies, a change management process should be followed

Change Enablers

Leadership Communication Involvement Measurement

t I es m B p s St le p ie ra m o g t l e e e t g e n v a i r e t e t s

D S

o n e it c a o n n r a d Perform E nt nvironme Chapter IV Page 17

FIGURE 12 Operational and financial measures are used to monitor strategy performance. The examples below illustrate some measures that capture information on both the sources of risk and their financial impact

Marketing Investments Ⅲ New business sold Ⅲ Cash flow Ⅲ Retention of old business Ⅲ Yield on new investments Ⅲ Mix of business: new and renewal Ⅲ Yield on portfolio by class and duration Ⅲ Market share by customer type Ⅲ Convexity of assets Ⅲ Average premium or assets per customer Ⅲ Duration of assets Ⅲ Percent of high-yield customers Ⅲ Investment mix: new and portfolio Ⅲ Customer satisfaction Ⅲ Credit default Ⅲ Average number of products per customer Ⅲ Total return

Underwriting Human Resources Ⅲ Price achieved versus target price Ⅲ Agency composition (number, age, service) Ⅲ Exposure data (number of cars, payroll, etc.) Ⅲ Total employment by department Ⅲ Exposure mix Ⅲ Number and percentage leaving Ⅲ Quotes accepted/declined the company Ⅲ Variance analysis Ⅲ Vacancy rates Ⅲ Premium persistency Ⅲ Average salary increase versus plan Ⅲ Loss ratio Ⅲ Employee commitment and engagement Ⅲ Loss adjustment expense Claims Financial Ⅲ Frequency and severity of claims Ⅲ Revenue Ⅲ Claims department productivity Ⅲ Underwriting profit External Data Ⅲ Investment profit Ⅲ Audit compliance Ⅲ Pretax operating income Ⅲ Inflation rates Ⅲ Net income Ⅲ Interest rates Ⅲ Return on equity and total capital Ⅲ GNP Ⅲ Economic value added Ⅲ Competitor pricing Sales/Distribution Ⅲ Acquisition costs per sale Ⅲ Sales by distribution channel Ⅲ Growth/retention of agents

from assumptions could undermine the ratio- Ⅲ include both leading indicators and outcomes nale for the chosen set of strategies and jeopar- Ⅲ include actual levels, expected or “planned” dize financial performance. levels, and benchmarks for each measure The specific operational and financial measures Ⅲ include measures pertaining to all stakehold- that are captured in the monitoring process will ers — customers, shareholders, distributors, vary, depending on the selected strategy and its employees and vendors objectives. (Examples of measures are shown in Ⅲ organize measures to clarify “line of sight” Figure 12.) However, some common guiding or value chain principles are: Ⅲ limit number of measures to enable management focus Page 18 Chapter IV

FIGURE 13 A “risk dashboard” provides a monitoring and early avoidance system for unacceptable deviations in financial and operational performance

t I es m B S p s tr le p ie a m o g te l e e e t g i n v a e r t e t s

D S

o n e it c a o n n r a d Perform E nt nvironme

Operating Margin 9% 16 8% 8% 8% 2001 14 7% 7% 7% 6.80% 6.50% 6.60% 12 6% 6% 10 5% Target 8 4% 6 3% 3.20% 3.10% 2.50% 4 2% 1.90% 2000 1% 2 0% 0 1998 1999 2000 2001 YTD 0% 1998 1999 2000 2001 YTD 2% 4% 6% 8% # catastrophes # bad faith lawsuits yields-new invmts portfolio yields GNP deflator

Ⅲ match frequency of reporting (e.g., daily, The first two require either repeating the strate- monthly, quarterly) to the volatility and gy development process or fine-tuning a limited importance of the measure. number of “substrategies” by reflecting the new information. Typically, the weakest link in The selected measures can be presented in a the process is executing strategy. Mitigating visual “risk dashboard” that clearly identifies poor execution can also involve redevelopment unacceptable deviations from expectations of the strategy in cases where the strategy (see Figure 13). development did not reflect deep-seated cultural constraints that may be difficult to overcome. Significant deviations from performance require Indeed, strategy development should properly a quick reassessment of, and possible revisions reflect implementation constraints. And often it to, the strategy. The dashboard can be used to involves a greater focus on change management determine the root cause(s) of the deviation. efforts. These can be classified into three categories: Ⅲ error in assumptions Ⅲ change in the risk environment Ⅲ poor execution of strategy. Page 19

Part Two Making the Right Choices: A Detailed Guide to Strategy Development

Because strategy development is both the most critical and the most complex stage in the RiskValueInsights™ process, we devote the next five chapters to a full discussion of each step in strategy development: Ⅲ Assess Risks (Chapter V) Ⅲ Articulate Strategies (Chapter VI) Ⅲ Evaluate Strategies Based on Policyholders’ Interests (Chapter VII) Ⅲ Evaluate Strategies Based on Owners’ Interests (Chapter VIII) Ⅲ Refine Strategies (Chapter IX).

The five-step process is recapped in Chapter X.

In Chapter XI, we provide suggestions on how to proceed incrementally in introducing strategic enterprise risk management into an organization, using the concepts and tools of the RiskValueInsights™ process. Page 20 Chapter V

V.Strategy Development,Step 1 – Assess Risks

Evaluate Strategies: Assess Articulate Policyholders’ Evaluate Strategies: Risks Strategies Perspective Owners’ Perspective

Refine Strategies

Identify financial Identify and overlay Establish Establish risk and value and operational financial and operational economic capital metrics for growth, risk factors strategies requirement return and consistency

Link to key performance Attribute capital Classify and prioritize indicator(s) via to business Set objectives risk factors financial model segment and constraints

Risk factor KPI Optimize strategies distributions distributions and sensitivity-test

Isolate impact of Decompose risk each strategy into root causes

The strategy development process begins with sources, both financial and operational, that can risk assessment, the first step. Risk assessment prevent an organization from meeting its objec- can easily bog down the process because there tives or represent a distinct potential opportu- are literally hundreds of risks that an organiza- nity for competitive advantage. Examples of tion faces depending on how they are defined financial risks include credit, interest rate, cur- and classified. It’s vital that the risk assessment rency, underwriting, investment and reinvest- focus only on risks that can have a material ment risks. Operational risks include risks impact on financial performance and strategy that fall into broad categories such as people, development. Thus, before embarking on an technology, distribution, and political and enterprise-wide risk assessment process, it is regulatory risks. important to understand management’s objectives, broadly stated, and the financial and oper- Materiality is generally determined qualitatively ational performance metrics that are used to at this stage, based on company experts’ views evaluate the performance of the business. of the potential impact of each risk on key performance indicators (KPIs). KPIs might include financial measures such as market share and A. Risk Assessment Begins With Risk profitability, and externally focused measures Identification such as public perception and customer Given this context, managers begin the risk satisfaction. assessment step by identifying risks from all Chapter V Page 21

Risks that pass the materiality threshold should resents a unique risk and each column is used be described as fully as possible including, to organize information gathered for each risk where appropriate: (e.g., likelihood, predictability, severity of impact, quality of controls). The table may Ⅲ an identification of causal factors and be used later to help prioritize risks. consequences Ⅲ timing (e.g., short term versus long term, An alternative method is to develop risk maps seasonal) that graphically illustrate both the causes and consequences of each risk. For example, Figure Ⅲ correlation with other risks, including 14 illustrates a risk map of a computer virus whether it could trigger or be triggered infection. by other risks Ⅲ current risk mitigation strategy and its The advantage of the graphical method of doc- effectiveness to date umentation over the tabular method is that it’s a more natural way to present the risk dynamics Ⅲ either historical data on, or expert assessment when it comes time to develop risk mitigation of, its impact on relevant KPIs. strategies. It’s clear from the map that risk miti- This process involves gathering historical data, gation strategies must block either the effect reviewing documents and conducting inter- of causal factors or mitigate the consequences. views to gather information on business pro- The disadvantage of this method is that it cesses, organization, technology, people and requires more work. A combination of the culture. Thus, it provides valuable insight into two methods of documentation may be most how the business operates as well as its capacity appropriate (i.e., a table supported by risk maps and readiness for change. for certain complicated risks that require a better understanding of the underlying dynamics). There are several ways to document the output That is especially the case if the risk table is of the risk identification process. A simple used to prioritize risks in the next phase of method is to create tables where each row rep- risk assessment.

FIGURE 14 A risk map of cause-effect relationships can be used to document the output of the risk identification process

Causes Consequences

Frequency Lost of backup Virus protection software updates Risk information IT Staffing Employees following Time to policies? IS failure Time to Virus recover systems recover info Lost E-mail infection productivity Resources to communicate shutdown? and enforce e-policies Lost time Firewall Desktops and Web site servers down Financial penalties hacker Failed client ~ Services commitments Number offered Services offered of hits online Public Lost business online Brand recognition reputation

Operational decisions Intermediate causal variables Output distributions Page 22 Chapter V

B.The Next Phase of Risk Assessment reasons, strategic risks require a more thorough Is Risk Classification and Prioritization analysis than conducted thus far in the process The risk identification process will likely gener- — they need to be modeled and incorporated ate more information than management can directly into strategy development. Modeling digest unless it is properly organized. There the portfolio of financial and operational risks is may be 100+ risks identified across the organi- described later in this section on the first step in zation. They will vary significantly in their strategy development. scope and impact on the ability of the organization to meet its objectives. A practical approach Manageable risks, on the other hand, are those to organizing the information is to classify the that the organization can address with existing risks in a way that suggests how management capabilities without substantial expenditures. should address them. These risks might include weak contingency planning in critical functions or employee dis- Classification satisfaction with opportunities for advance- ment. The proper response to manageable risks One useful classification method separates is to use existing organizational capabilities to risks into strategic risks versus manageable risks. mitigate them. They do not need to be mod- Strategic risks are those that can be addressed eled, nor do they directly influence strategy only through substantial expenditures and/or development. a change in strategic direction. Many financial risks fall into this category because of the sub- Prioritization stantial impact they pose. Strategic operational risks can arise, for example, when an organiza- Manageable risks should be prioritized and tion enters unfamiliar business territory due to allocated to each managerial level in considera- a major acquisition, a new competitor emerges tion of their priority and scope (i.e., the highest or customers’ buying preferences change. As a priority risks are reviewed by the board and group, they pose difficult decisions and com- senior management, the middle level by busi- plex trade-offs because of their interaction and ness unit management and the lowest level by relative impact on strategic objectives. For these line management). Where the line is drawn

FIGURE 15 A risk table can provide a relatively simple way to prioritize risks Quality of Composite Risk Factors Likelihood Severity Controls Score (1-5) Negative government, legal and HH L 5 media actions Uncompetitive administrative costs, HLM3 including costs of personnel practices Leadership inability to overcome cultural MM L 3 resistance to necessary changes Competition from new entities with more MH L 4 efficient business models Possibly incorrect IT strategy, architecture LHM3 and direction Poor positioning to compete by ourselves MMM 3 in the new e-business world Poor strategic focus, direction and HHM 4 execution through our people Poor market knowledge and research L L M 2 Chapter V Page 23

between each level depends on the number of documented in the prior risk identification step risks, the number of management levels and the and assigns a score to each risk, on a scale of capacity of management at each level to address 0-5, for example (see Figure 15), using the table risks. Some risks may be low priority but may created as the output of the risk identification require review at a high organizational level process. In order to establish a consistent scoring because of their wide scope. Regardless of how system, the team should be briefed on manage- the risks are allocated, it’s important to prevent ment objectives, financial and operational risks from slipping through the cracks. Just performance metrics, and the risk attributes because a risk is not considered strategic does that should be considered, e.g., likelihood, not mean that it should not be managed some- severity, timing, controllability and correlation. where in the organization, else it may grow unattended to become a major risk. Another prioritization method is illustrated in Figure 16, where each risk factor (“A” through In prioritizing manageable and strategic risks, “M”) is placed on a grid based on both the once again, there is no need to bog down the “depth of concern” throughout the organiza- process by developing sophisticated and precise tion (as measured by the frequency of its scoring and ranking methods. After all, the mention by knowledgeable internal interviewees) objective is simply to organize risks into broad and the perceived degree of impact on identified categories of importance for management business metrics. (Two such metrics are illus- review. What is important, however, is general trated in the figure: a financial metric and a agreement on the prioritization. The simplest customer satisfaction metric.) In this example, way to accomplish this is to establish a cross- the risk factors in the upper right-hand sector functional team that reviews the information of the grid are given the highest priority.

FIGURE 16 Risks can also be prioritized using a two-dimensional grid

L 3.00 F 2.75 M I G D C 2.50 B K 2.25 A J 2.00 H E 1.75 Key: Degree of Impact 1.50 = degree of impact 1.25 of this risk on financial metric 1.00 123456789101112= degree of impact of this risk on Frequency of Mention customer metric Page 24 Chapter V

FIGURE 17 A “heat map” classification/prioritization scheme identifies areas in need of immediate senior management attention

Conditions

ABEGIJKL Gov’t, Inadequate New, More e-Business Individual Coverage Medical Freedom of Organizational Legal, Media Capital Efficient Customer Expansion Expenses Choice/ Capabilities Action Competition Demands Open Access C Administrative efficiency, nimbleness D Leadership to overcome cultural resistance to change F IT strategy, architecture, direction G Competition by ourselves in e-business H Strategic focus, direction, execution through our people I Systematic customer needs satisfaction J Business segmentation K Medical expense control L Membership and billing systems/processes M Market knowledge and research

Our final example of a classification/prioritiza- C. Risk Modeling Follows Risk tion scheme is a “heat map,” shown in Figure Classification and Prioritization 17. In this example, risk factors are first classi- Once risks have been identified, classified and fied according to whether they represent exter- prioritized, the strategic risks need to be mod- nal conditions or internal capabilities. Within eled. As discussed, strategic risks are those that each of these categories, risk factors are color- require considerable investment and/or a sig- coded based on their priority (established via nificant change in strategic direction. Risk a process similar to that shown in Figure 16). modeling means developing a probability distri- Certain of these capabilities are needed to bution on outcomes that represents the uncer- respond to certain of these conditions. Cases tainty associated with a specific risk factor. A that represent an interaction of a high-priority risk model of interest rates, for example, will (i.e., weak) capability and a high-priority condi- generate a probability distribution of each point tion are areas worthy of immediate senior man- on the yield curve. Modeling the risk associated agement attention. with the productivity of a distribution channel would generate, for instance, a probability distribution of sales volume associated with that channel. Chapter V Page 25

There is a wide variety of risk modeling meth- They include, for example, empirical distribu- ods that can be applied to a specific risk. They tions, parametric methods to fit theoretical can be thought of as lying on a continuum that probability density functions, regression, sto- is based on the extent to which they rely on chastic differential equations and extreme value historical data versus expert input (see Figure theory. These methods have been used exten- 18 and glossary in Appendix E). Along the sively by financial institutions to model financial continuum of sources of information, the risks (see box for discussion of modeling finan- methods listed on the left are ones that rely cial risks). primarily on the availability of historical data.

FIGURE 18 There is a continuum of methods for modeling risks. Each method has advantages/ disadvantages over others, so it’s important to select the best method based on facts and circumstances

DATA ANALYSIS MODELING EXPERT INPUT

Empirically System Direct assessment from historical Stochastic Influence dynamics diagrams of relative likelihood data differential simulation or fractiles equations (SDEs)

Fit parameters for theoretical Neural Bayesian Preference among distribution networks belief bets or lotteries networks

Extreme Regression over Delphi method value variables that Fuzzy logic theory affect risk Page 26 Chapter V

Modeling Financial Risks

inancial risks are, for the approach. For example, if the has the benefit of ease of Fmost part, risks that are risks were interest rates, equity implementation and speed exogenous to the organization returns and liability volatility, of calculation. and beyond its direct control. financial institutions would These include: macroeconomic strive to build statistical distri- Einstein once said, “Solutions risks such as interest rates, butions representing each of should be simple, but not too exchange rates and asset the three risks — and then simple.” We believe that the performance, and insurable combine them by convoluting analytical representation risks such as mortality and (mathematically combining) the described above oversimplifies property/casualty claims. A distributions. This requires the the reality. This doesn’t mean combination of financial and specification of the form and we don’t use distributions, but it operational strategies is used parameters of each of the three does mean that we don’t think to protect against the adverse distributions, and the nature of they can be combined as con- financial effects of these risks. the linkages between them. If veniently as some might sug- the probability distribution for gest. That’s because reducing Since there usually are exten- each risk is part of a family of the interrelationship between sive historical data associated distributions with special math- two risks to a single number with financial risks, the methods ematical characteristics (e.g., (i.e., their correlation) is much listed on the left side of Figure symmetric distribution with too restrictive to capture the 18 are most often used to model constant covariance structure), nature of most risks in the real financial risks. Many financial the aggregate distribution can world. For example, consider institutions, particularly banks, be obtained analytically by the behavior of equity markets build models of each financial doing the math (rather than around the world. At most times risk separately, and then com- simulation). Analytical repre- the behavior of the stock mar- bine the risks using a statistical sentation of risks in this way kets in New York, London and

FIGURE 19 Global CAP:Link employs a cascade structure for modeling macroeconomic risks. The arrows indicate the direction of the causal relationship among the variables

Short- and Long-Term Interest Rates and Full Treasury Yield Curve High-Quality Corporate Curve Real GDP

High-Yield Corporate Curve Price Inflation Wage Inflation Index-Linked Corporate Curve Equity Earnings Equity Earnings User-Defined Yield Growth Rate Inflation

Cash and Treasury Bond Equity Income and Total Return Income and Total Return

Other Asset Classes Chapter V Page 27

Tokyo is only partially correlat- a cascade structure (see Figure markets, currencies, etc., over ed. While they react to one 19). Each variable in the cas- multiple time horizons. Through another, they also react to local cade is dependent on the vari- the use of structured equations, conditions. However, the level ables “above” it. The SDE for appropriate levels of mean of correlation changes when each variable is stated as a reversion, spread reversion, one of the markets declines function of the other variables etc., can be induced. This is precipitously. In those scenar- to which it is related. The spe- vastly superior to assuming ios the markets move down in cific form of the equation and these variables behave in virtual lockstep. This type of parameter values are calibrat- some kind of a “random walk” behavior (varying levels of cor- ed to properly represent the over time. relation) can be captured more relationship based on historical directly and easily by using a data representing many differ- Generating scenarios using a structural model to simulate ent economic environments. In structural model eliminates scenarios rather than a statisti- Global CAP:Link, the correlation constraints on risk modeling cal model. between variables is an emer- such as limitations on the form gent property, not a constant of probability distributions and A structural model represents input parameter. constant correlation associated the interaction among risk vari- with statistical models. Thus it ables explicitly using stochastic In addition, the structural provides a much more reliable differential equations (SDEs) approach is better in a multi- representation of the nature and other techniques rather period context. A stochastic of financial risks and their than one number. For example, scenario generator like Global interaction. As we will see, our Global CAP:Link scenario CAP:Link can generate inter- structural approaches also generator represents the internally consistent paths for provide similar advantages in action among financial risks as interest rates, inflation, equity modeling operational risks. Ⅲ

Now let us turn to the aspect of risk modeling by decision and risk analysts to model opera- most troubling to insurance industry managers: tional risks in support of management decision- modeling operational risks. The general reliance making in manufacturing, particularly in the oil on historical data to model financial risk has and gas industry, and in the medical sector. The somewhat biased financial institutions to con- methods listed in the middle of the continuum sidering the same methods for modeling opera- rely on data, to the extent that it is available, tional risk. However, operational risks are not and expert judgment to supplement the miss- like financial risks. For one reason, they vary ing data. In these methods, expert judgment is significantly based on a company’s unique used to develop the model logic indicating the operational processes, technology, resources, interactions among key variables and to quanti- culture and organization. Since most of these fy cause-effect relationships based on experience factors are dynamic, typically there are limited, and ancillary or sparse data. Methods such as representative historical data on which to base system dynamics simulation, Bayesian belief the modeling. networks and fuzzy logic in particular are ideal- ly suited for quantifying operational risks. These The methods listed on the right in Figure 18 methods offer the greatest potential for model- rely primarily on expert input, including for ing operational risks for financial institutions example, Delphi method, preference among (see box for discussion of modeling operational bets or lotteries, and influence diagrams. These risks) until the industry matures in its gathering have been used successfully for several decades and maintenance of data for operational risks. Page 28 Chapter V

Modeling Operational Risks

nlike financial risks, solely on industry-wide data quency and severity of losses Uoperational risks arise could be seriously misleading. stemming from business due to factors that are, for the decisions seems unlikely. most part, internal to the organ- 2. Operational risks are managed ization. Efforts to date for mod- through changes in processes, These differences have impli- eling operational risks (primarily technology, people, organiza- cations on how operational in the banking sector) have tion and culture — not risks should be modeled. focused on extending the use of through hedging in the capital Operational risk modeling meth- statistical (or "parametric") markets. Managers need a ods must be flexible and robust methods commonly used for risk modeling approach that enough to fill in data gaps, pre- modeling financial risks. Such can provide them information sumably by tapping the knowl- attempts have been limited by on how the operational risk edge of experienced operations the lack of historical data on would change if they were to managers who are “closest” to operational risks. Some financial implement alternative opera- specific risks. As with financial institutions, industry associa- tional decisions. For example, risks, we believe that structural tions and others have reacted by how much is technology (i.e., causal) models of opera- to this deficiency by beginning risk reduced by implementing tional risk are more robust than to compile databases of opera- redundancy in the technology statistical models. Structural tional risks. However, opera- infrastructure? Again, it’s methods differ from statistical tional risks differ from financial highly unlikely that the histori- methods in that they simulate risks in several important ways cal data will be segmented by the dynamics of a specific sys- that limit the use of statistical alternative operational deci- tem by developing cause-effect methods based on historical sions such that a distribution relationships between all the data. fitting approach will answer variables of that system. these questions. Figure 18 illustrates a continu- 1. Operational risks vary signifi- um of methods for modeling cantly based on a how a 3. Operational risks can be risk. Of these, the methods in company manages its internal loosely classified into event the middle of the continuum, operations. Thus the data risks and business risks. such as system dynamics simu- needed to apply standard sta- Event risks refer to isolated lation, fuzzy logic and Bayesian tistical approaches must be occurrences that generate belief networks (BBNs), are company specific. In fact, the losses (e.g., technology failure, examples of causal methods data should also be represen- fraud, mis-selling). Business that best suit the unique tative of the current opera- risks are those created by requirements of operational risk tions environment. To the business decisions (e.g., modeling. extent that operations are changes in distribution strate- dynamic due to changes in gy, launching a new product). System dynamics simulation is the business model, technol- Although it may be possible a robust business simulation ogy and processes, it will be to gather historical data on modeling method developed by difficult to gather sufficient losses due to event risks, Dr. Jay Forrester at the representative data. Relying finding data to assess the fre- Massachusetts Institute of Chapter V Page 29

Technology. The major steps in relationship using a combina- operations and rerunning the applying system dynamics sim- tion of historical data and simulations. With little effort, ulation are as follows: expert input. Again, expert an operational risk simulation input is used to fill data gaps model can be converted to a 1. Rely on expert input from and adjust for data that may “business flight simulator” seasoned managers to devel- not be representative. To the that allows managers to eval- op a graphical system map of extent that expert input is uate the impact of alternative the cause-effect relationships uncertain, the cause-effect decisions on operational risk among the key variables to relationship is represented (see Figure 21). represent the dynamics of a stochastically, i.e., the effect specific risk. Figure 14 is an is represented as a probability Bayesian belief networks are example of a system map for distribution around a point similar to system dynamics sim- the risk of the failure of infor- estimate (see Figure 20). ulation. The network consists of: mation systems. A system Ⅲ nodes representing decision map for the risk associated 3. Run simulations to develop a variables, outputs and inter- with the decision to use the range of outcomes for key mediate causal variables Internet as a distribution operational and financial vari- channel to launch a new ables. The output across the Ⅲ arcs which are directional product, for example, would simulation runs is summa- arrows connecting nodes capture the impact of variables rized as a probability distribu- indicating the logical causal such as brand name, market- tion for financial variables. relationship ing and advertising expendi- The probability distributions Ⅲ node probabilities indicating tures, complexity of product represent the operational risk the probabilities for each features, use of a financial given the current operating possible value at a node con- services portal, process environment. ditioned on the values of the cycle times, availability of on- nodes on which it logically 4. Perform “what-if” analysis by line support, etc. depends. modifying decision variables 2. Quantify each cause-effect representing changes in As with system dynamics simulation, expert input is used to FIGURE 20 develop the logical relationship Price elasticity can be modeled stochastically among nodes and to assess the How Company Price and Market Price Affect Sales node probabilities (using Bayes’ +50 Rule) to the extent that data is Deterministic Relationship not complete. Once the network Stochastic Relationship is specified, the network is solved analytically to develop a probability distribution for each 0 output node. BBNs thus are an “analytical cousin” to system dynamics simulation. % Change in No. of Policies in No. % Change -50 .750 1.0 1.250 Ratio of Company Price to Market Price Page 30 Chapter V

Advantages of tured, interactive and partici- dynamics of their own func- Causal Models pative modeling and decision- tional areas and of the organi- In addition to avoiding the draw- making process. zation. The operational risk backs of parametric methods, simulation models can be causal modeling methods offer Ⅲ A causal approach helps easily converted to “business several significant advantages: focus data-gathering efforts. flight simulators” that let A model can be built quickly users try out strategies or Ⅲ As businesses become more with expert testimony and change assumptions and complex, knowledge of their readily available data. By per- observe their effects. These underlying dynamics becomes forming sensitivity analysis on gaming exercises, conducted fragmented and localized. the assumptions underlying individually or in group ses- Although many managers have the model, one can identify sions, inevitably produce a good understanding of their the assumptions or relation- unexpected or counter-intu- own functional areas, few have ships that contribute most to itive results. By observing a solid grasp of the dynamics the results. This helps an individual cause-and-effect of the entire organization. organization deploy resources relationships, managers can Obtaining a complete picture to gather specific data needed more easily discover where of the sources of operational to tighten key assumptions. prior assumptions were risks and how they may Such an approach is more flawed. This learning can be affect the business through cost effective than are unfo- applied to better decision- intermediate cause-effect cused, hasty efforts to build making, which in itself is a relationships requires the massive databases. key objective of enterprise combined knowledge of risk management. Ⅲ managers across functional Ⅲ Most importantly, operational areas. The causal approaches risk models based on these facilitate interaction among principles will give managers managers through a struc- a better understanding of the

FIGURE 21 “Flight simulators” let managers evaluate alternative strategies Flight Simulator Price 900 1100 1000

No. of Independent Agents (1,000s) No. of Captive Agents (1,000s) Probability 515515 10 8 0100Profit ($Millions) Internet Marketing Expense Commission Rate 2% 3% 4% 5%

0% 8% 0% 10%

New Investment in Technology ($Millions) Probability 0 50 0 02Market Share % Chapter V Page 31

Throughout the risk assessment process, those Having completed the Risk Assessment step, performing the analysis must pay careful atten- the logical next step is to determine how to tion to the correlation among risks. In the mitigate them. At this stage, manageable risks identification process, we noted that for each have been addressed by the appropriate mana- risk, the relationship to other risks should be gerial levels using existing organizational capa- identified. This process can be used to ferret bilities. Strategic risks have been quantified out natural hedges. Natural hedges are two using a combination of risk modeling methods risks that have a negative correlation. For exam- that reflected the relative availability of data and ple, the risk of increasing cost of production expert input. So, at this point, we have a rea- could partially offset the risk of a new competitor sonably complete statement of the risk environ- entering the market by raising the competitor’s ment under which the business is operating. barrier to entry. In some cases, one risk has The next step is to develop strategies that will both positive and negative effects; for example, navigate the business through the risk environ- impact of interest rate risk can increase/ ment to meet management objectives. decrease both liabilities and assets. Insurers and pension funds take advantage of this dynamic by modeling assets and liabilities together. In other cases, risks may be positively correlated. To the extent that risks are not 100% correlated, it is important to capture the diversification benefits to paint an accurate picture of total risk. One of the primary benefits of an enterprise-wide risk assessment is to reduce the cost of risk management by properly reflecting natural hedges and risk diversification. (See box on modeling financial risks for description of methods for modeling correlation.) Page 32 Chapter VI

VI.Strategy Development,Step 2 – Articulate Strategies

Assess Articulate Evaluate Strategies: Evaluate Strategies: Risks Strategies Policyholders’ Owners’ Perspective Perspective

Refine Strategies

Link to key performance Attribute capital Classify and prioritize Set objectives indicator(s) via to business risk factors and constraints financial model segment

Risk factor KPI Optimize strategies distributions distributions and sensitivity-test

Isolate impact of Decompose risk each strategy into root causes

A.The Strategy Articulation Step Begins Universal life X% With Strategy Definition Annuity X% Strategies are decisions regarding core business activities. For an insurer, such decisions include Term life X% product mix, distribution channel, reinsurance, Ⅲ Allocate assets to the following classes in the asset allocation, business processes, technology proportions specified: and incentive compensation. Strategies also Cash instruments X% include decisions about activities meant explicitly to transfer or hedge risks, such as foreign Fixed income exchange trading to hedge currency risk. Short-term X%

For example, a high-level combination of finan- Mid-term X% cial and operational strategies could be: Long-term X% Ⅲ Change the product mix as follows: Equity Personal auto X% Domestic X% Home X% International X% Personal liability X% Real estate X% Chapter VI Page 33

Ⅲ Invest $X million in the Internet distribution to convey the merits of an enterprise-wide channel for personal property/casualty product approach to maximizing value/minimizing risk lines over more parochial, silo-based approaches. Ⅲ Increase compliance resources by X% B. After Defining Strategies, Develop a Ⅲ Change the form of commissions and incen- Financial Model to Express Their Impact tive compensation from X to Y on Key Performance Indicators Ⅲ Increase incentive compensation pool by X%. Having modeled strategic risks and articulated potential financial and operational strategies, the The above combination represents one set of logical next step is to measure the impact strategies. The objective of the articulating strate- of the strategies on the organization’s key gies step in the strategy development process is performance indicators, given the risk environ- to propose alternative financial and operational ment. A stochastic financial model is construct- strategies and to develop a financial model used ed for this purpose. This model is designed to in later steps to evaluate these strategies. generate pro forma financial statements. It is constructed by breaking down each item on the Strategies are developed to maximize value in financial statements into its operational and consideration of the risk environment. Value financial components. Each risk and strategy drivers such as earnings growth, return on capi- affects one or more of these components, which tal and consistency of financial performance are are then rolled up into the financial statement. often in conflict with one another. Some decisions may grow earnings at the expense of Risks affect elements of the financial statements return on capital while others may increase or their constituent variables by making their return in the long term but create short-term value uncertain. These variables are replaced by instability. Thus, financial and operational the probability distributions for the correspond- strategies must be carefully coordinated to ing risks that were developed in the risk assess- optimize the trade-offs and maximize overall ment step. For example, the number of policies value based on management objectives. sold in a given period is a constituent variable in calculating revenue. Risk of competition Coordination of financial and operational deci- makes the number of policies sold uncertain. sions requires input from a broad array of man- Risk of competition can be modeled in the risk agers, each of whom may currently “own” one assessment step as a probability distribution on or more of the decisions. Complicating matters the number of policies sold. This distribution is the fact that operating managers may change is used to represent the uncertainty associated strategies midterm if their results are not “on with the number of policies sold in the financial plan.” The idea of coordinating all strategic model. In this manner, all strategic risks mod- financial and operational decisions is likely to be eled in the risk assessment step, and their corre- new to most financial institutions. At best, only lation, are reflected in the financial model — financial decisions, such as product mix, rein- making this a stochastic financial model. The surance and asset allocation are coordinated model is used to run simulations that generate now. The interaction of the strategic risks high- alternative scenarios of financial performance. lighted in the risk assessment step should pro- Therefore, the output of this stochastic finan- vide some justification for coordinating with cial model is a probability distribution on key other operational strategies related to distribu- financial metrics such as net income. tion channel, technology and people, for example. However, the ability to coordinate strategy Capturing the impact of all financial and will depend primarily on leadership’s ability operational strategies as well as financial and Page 34 Chapter VI

operational risks in one holistic financial model 2. Similarly, the model expresses the impact creates an extraordinarily powerful tool in of all financial and operational strategies the RiskValueInsights™ process of strategy in terms of common metrics like capital development: required, net income or any other metric that management uses to run the business. 1. The model links disparate risk measures into a common metric. So far, each risk has been 3. The model can be used to measure the rela- modeled using its own unit of measurement. tive impact of each risk or each strategy. By For example, interest rates at various dura- successively turning “on” and “off” a risk tions for interest rate risk, annual returns for variable in the model, it’s possible to decom- asset risk, perhaps market share percentage pose overall risk on net income, for example, for competitor risk, and local currency into its constituents. Similarly, each denomination for underwriting risk. These strategy can be turned “on” and “off” to disparate measures must be combined into determine its relative impact on maximizing a common measure in order to measure the value and minimizing risk. Decomposing aggregate impact of all risks. By using one risk and value into its constituents provides model, the aggregate impact of all financial helpful information in developing optimal and operational risks is expressed as a proba- strategies that balance risk and value (see bility distribution on a financial metric like Figure 22). net income.

FIGURE 22 Risks and strategies are linked to key performance indicators through a stochastic pro forma financial model of the enterprise

Enterprise value

Current Future net Future capital income required capital

Investment Underwriting Taxes Subsidiary G/L income income

Premiums Benefits and Reinsurance Interest and Capital G/L Investment Asset expenses dividends expenses default

Financial and Operational Strategies

Asset Liability Business Event Risk Risk Risk Risk Chapter VI Page 35

Fortunately, financial institutions already use C. Match the Model to the Appropriate sophisticated stochastic financial models to Time Horizon develop pro forma financials. However, they Time is an important consideration in this generally only reflect some financial risks and analysis. Strategy development is generally some financial strategies. They need to be based on projecting financial performance three enhanced to reflect operational risks and opera- to five years into the future. Thus, the assess- tional strategies. Reflecting operational risks ment and modeling of strategic risks must con- involves converting deterministic variables to sider changes to the risk environment over the stochastic variables by representing the variable same period. The financial model must also as a probability distribution (as described generate probability distributions for financial above). Technically, the current models reflect metrics as a function of time — typically annu- operational strategies implicitly in the model ally. However, given the long-term commit- assumptions. These strategies need to be made ments inherent in the products sold by insurers, explicit in order to model the interaction of the performance of the financial products must changes to operational strategies with financial be modeled over a much longer period. strategies and risks. Enhancement of current models could face serious performance obsta- D. Summing Up Steps One and Two of cles such as an increase in the number of simu- Strategy Development lations needed to develop stable distributions of outcomes. However, there has been a steady Capturing the impact of all financial and and impressive trend in computing power, operational strategies, as well as financial which is expected to continue and may offset and operational risks, in one holistic financial performance issues. Greater difficulties may model creates an extraordinarily powerful tool arise because of the resources needed to revise in the RiskValueInsights™ process of strategy and validate large sections of complex financial development. programs. Therefore, a plan of incremental The first two steps in the strategy development enhancements to current models is advised to process, assessing risk and articulating strate- minimize model risk and to maintain credibility gies, constitute the bulk of the analytical effort. of the model. The remaining steps will continually use the risk models and the stochastic financial model to evaluate strategies. Page 36 Chapter VII

VII.Strategy Development,Step 3 – Evaluate Strategies Based on Policyholders’ Interests

Assess Articulate Evaluate Strategies: Evaluate Strategies: Risks Strategies Policyholders’ Owners’ Perspective Perspective

Refine Strategies

Link to key performance Attribute capital Classify and prioritize indicator(s) via to business Set objectives risk factors financial model segment and constraints

Risk factor KPI Optimize strategies distributions distributions and sensitivity-test

Isolate impact of Decompose risk each strategy into root causes

Strategies are evaluated in consideration of point that the price paid by policyholders is interests of both customers (i.e., policyholders, pushed unreasonably or uncompetitively high. through their proxies, the regulators and Therefore, the objective is to establish the rating agencies) and owners of the enterprise. minimum level of capital that will achieve Ultimately, policyholders are concerned with the desired level of policyholder protection. the solvency of the business, whereas owners are concerned with returns on their investment. Figuratively speaking, capital is the foundation This section is focused on the interests of poli- upon which the value edifice is built. cyholders while the next section shifts emphasis to owners. A. Begin by Defining the Types of Capital Requirement Used in the Evaluation Policyholders’ interests are reflected in the Evaluating strategies by how they satisfy policy- amount of capital the company holds against holders’ concerns essentially means determining adverse performance. The greater the level of the level of capital required by these strategies. capital, the lower the risk of insolvency, all else And that means, first of all, deciding which equal. However, too high a level of capital may type of capital requirement to use in the increase owners’ demand for earnings to the evaluation. Chapter VII Page 37

In practice, there are several important types of 2. Regulatory and rating agency capital may capital requirements, including regulatory, rat- actually not allow for some of the risks a ing agency, competitive and economic capital. company faces, such as interest rate guarantees, guaranteed surrender values and a Ⅲ Regulatory capital requirements are mini- whole range of operational risks. mums established explicitly by the regulatory agencies that hold jurisdiction where the 3. Since regulatory capital varies by political company has major operations. jurisdiction, if a large institution working Ⅲ Rating agency capital requirements are those across many jurisdictions were to make deci- that, in large part, determine the company sions based on regulatory capital require- ratings assigned by such organizations as ments, it may have different strategies for A.M. Best, Moody’s and Standard & Poor’s. each region. This would amount to running a number of smaller independent institu- Ⅲ Competitive capital requirements are implicit tions and result in a forfeiture of gains from constraints imposed by the competitive envi- economies of scale. ronment within which each company operates. They reflect both the upward pressure on 4. There are opportunities to hedge the differ- capital represented by very secure, highly ence between regulatory and economic rated competitors, and the downward pres- capital. This is accomplished through “rule sure represented by high-return, efficiently arbitrage,” i.e., by shifting risks into differ- capitalized competitors. ent jurisdictions with different capital Ⅲ Economic capital requirements are those requirements through the use of reinsurance, derived from explicitly stated financial objec- captives, etc. tives or constraints, such as “the amount of capital needed to reduce the technical ‘prob- 5. Economic capital can more directly be com- ability of ruin’ to an acceptable level.”8 pared across lines of business, e.g., banking products versus insurance products. These various capital requirements are not completely independent; competitors’ capital Each insurance company differs in terms of levels are, of course, influenced by regulatory which definition of capital it uses to suit its and rating agency considerations. And impor- management needs. For the purposes of illus- tantly, all capital requirements can be converted tration, we will use economic capital to evalu- to an economic capital equivalent by imputing ate a set of strategies, recognizing that the their probability-of-ruin implications, for exam- other types of capital requirements can also be ple. The utility and relevance of this conversion expressed in economic capital-equivalent terms. is discussed in the following two sections. B. Next Determine the Enterprise-Wide Companies that favor using economic capital Economic Capital Requirement to Satisfy cite several reasons, including: Policyholders

1. Economic capital reflects the underlying There are two primary methods for determin- economics of the business as opposed to ing economic capital. One is based on the political and rating agency conservatism. probability of ruin while the other is based on the economic cost of ruin. We will discuss

8Technically, economic capital is the difference between required assets and a realistic (e.g., fair value) measure of liabilities. It is noted that the determination of liabilities can be nontrivial, particularly when options and guarantees are involved, but discussion of liability estimation techniques is outside the scope of this document. Page 38 Chapter VII

FIGURE 23 The Probability of Ruin can be calculated from the probability density function by measuring the area under the curve corresponding to the section where liabilities exceed assets on a present value basis

Probability Density

Probability of ruin

0% (-) 0 (+) Present Value of Surplus

both here and compare them to Value-at-Risk area in Figure 23 and lowering the probability (VAR). Probability of ruin is relatively easy to point on the y-axis in Figure 24. The target conceptualize. This is the probability that liabil- probability of ruin is set by management in ities will exceed assets on a present value basis consideration of several factors, primary among at a given valuation date, resulting in technical them the solvency concerns of policyholders — insolvency. It can be calculated from the proba- usually expressed in terms of the minimum rat- bility density function by measuring the area ing that management desires from the rating under the curve corresponding to the section agencies. (See further discussion below.) where liabilities exceed assets. This is shown in Figure 23 as the shaded area. Alternatively, it The probability-of-ruin approach is conceptual- can be calculated from the cumulative distribu- ly similar to the VAR approach used in banking tion function by determining the probability for determining capital for market risk. The point (on the y-axis) where liabilities equal VAR of a bank’s portfolio exposed to market assets (on the x-axis), as shown in Figure 24. risk is “the maximum loss over a target horizon These probability plots are generated by run- within a confidence interval” (Jorion, 1997). ning computer simulations of liabilities and The target horizon generally corresponds to assets using the stochastic financial model in the time needed to liquidate the entire portfo- the prior step. lio in an orderly fashion (typically measured in days for most bank portfolios). The confidence Economic capital based on the probability of interval is expressed as a quantile of a cumula- ruin is determined by calculating the amount tive distribution function, e.g., 99%. It is set by of additional assets needed to reduce the prob- implicitly reflecting the cost of a loss exceeding ability of ruin to the target specified by man- the VAR amount, the bank’s risk aversion and agement. Addition of capital shifts the curves in both figures to the right by the amount of additional assets, thereby reducing the shaded Chapter VII Page 39

FIGURE 24 The Economic Cost of Ruin (ECOR) can be calculated from the cumulative distribution function by measuring the area under the curve to the left of the capital cushion

100%

Cumulative Probability

Probability of ruin without capital ECOR

Probability of ruin with capital 0% (-)Capital (+) Present Value of Surplus

some practical considerations associated with accepted in insurance and banking respectively. back testing. For example, if the VAR for a 99% However, both risk measures fail to consider confidence interval over 10 days is $1 million, the severity of ruin events, i.e., the expected loss it means that there is less than 1% probability of to policyholders. total losses on the portfolio exceeding $1 million over the next 10 days. Therefore, the capital Economic cost of ruin is an enhancement to cushion to cover losses at the 99% confidence the ruin probability concept, though one that is level is equal to VAR, i.e., $1 million. This also more prevalent in the property/casualty arena. means that $1 million in capital is needed for a In the event of ruin, the policyholders expect 1% probability of losses exceeding capital. to get some, but not all, of the benefits to Although there are technical computational dif- which they are contractually entitled. The differences between how insurers use probability ference between what policyholders are prom- of ruin and banks use VAR to determine capital, ised and the expected value of their post-ruin conceptually the two are linked. VAR is the benefits represents an expected shortfall to poli- monetary amount on the x-axis corresponding cyholders — this is called the economic cost of to the probability of ruin on the y-axis of the ruin. (It is sometimes called “expected policy- cumulative distribution function plot illustrated holder deficit,” but there may be insurance or in Figure 24. prudential obligations in place to protect policyholders from this loss; we therefore prefer the Both the probability-of-ruin and VAR methods term “economic cost of ruin.”) Economic cost have the advantage of being risk measures that of ruin (or ECOR) thus considers not only are easy to understand and communicate. This the probability of ruin, but also the expected no doubt is the reason that they are widely loss to policyholders in the event of ruin. It is represented by the “shaded area under the Page 40 Chapter VII

curve” in Figure 24. (An analogy may be useful The overall economic capital for the enterprise here: think of a bond rating that considers both is determined for each combination or set of the probability of default and the salvage value financial and operational strategies that were of the bond in the event of default.) In prac- proposed in the prior step. Recent surveys con- tice, ECOR is often expressed as a percentage ducted by Tillinghast of insurance companies of policyholder reserves. indicate their strong desire to reflect major operational risks and strategies in determining ECOR has important advantages over probabil- the capital requirement. Since both financial ity of ruin and VAR. Two companies with the and operational risks are incorporated in the same ruin probability would typically have dif- financial model used to calculate cumulative ferent, perhaps very different, ECORs. The earnings, operational risks would be auto- company with the higher ECOR would have matically reflected in establishing the capital fewer funds remaining after liquidation to dis- requirement. tribute to policyholders. Arguably, this policyholder payment capability captures the essence C. After Determining the Total Capital of the need for capital. For some companies, Requirement, Attribute Capital to the conceptual advantages of ECOR are out- Business Segments weighed by practicalities, such as the fact that probability of ruin is computationally simpler. Having determined the appropriate capital Advances in computational efficiency are over- requirement at the enterprise level to satisfy coming these practical constraints. policyholders’ interests, it is necessary to fairly attribute capital to each segment in a way that How are ruin probability or ECOR standards reflects its contribution to the enterprise-wide established for an insurance company? In capital requirement. This attribution allows the some cases, senior management or Boards of proper evaluation of the performance of each Directors are able to express their preferences business segment. in terms easily convertible to these metrics. In other cases, ruin probability or ECOR stan- There are several methods for attributing capital dards are imputed from the rating (e.g., S&P to each business unit. These methods differ rating) desired by the company. Whatever the primarily by the choice of risk measure used to source of the standards, expressing these objec- estimate the capital requirement of each seg- tives/constraints in ruin probability or ECOR ment in relation to risk. terms is important for two reasons. First, it One such method is to attribute capital across facilitates the appropriate attribution of capital, business segments in proportion to the present as discussed in the following section. Second, value of expected customer payments. Under it provides essential information, in the right this method, each product is assumed to con- language, to the strategy optimization exercise tribute to the risk of insolvency in proportion outlined in the following chapter. to the economic value of commitments to customers — and thus all products are assumed to involve the same degree of risk. Since this is not the case in most situations, less risky products provide a capital subsidy to the more risky products. The resulting unfairness may result in business decisions that destroy economic value. Chapter VII Page 41

To attribute capital fairly across segments, capi- level of risk tolerance, and produces sensible tal requirements must be determined in rela- results when used to attribute capital to business tion to the riskiness of each segment. Since, at segments. the most intuitive level, policyholders, regulators and insurance executives can see that the In any case, the attribution process requires level of risk is directly related to the probability completion of two steps. of ruin of the company, it is often suggested that probability-of-ruin constraints be used to 1. Calculation of stand-alone capital drive the capital attribution process. However, requirements: both probability of ruin and VAR have a seri- The objective of this step is to determine the ous drawback if they are used to attribute capi- minimum amount of capital that is needed tal to business segments or to determine the by each individual segment to meet the capital of merged or combined operations. For corporate level risk constraint, expressed as a example, when two or more risky portfolios are probability of default or ECOR ratio, for combined, the capital based on these measures example. Note that adding up the stand- for the combined portfolio may turn out to be alone capital requirements calculated above more than the sum of the capital for each port- will result in a capital requirement that is folio determined separately. (See Appendix G greater than the aggregate capital require- and references on coherent risk measures for ment of the enterprise. The difference numerical examples.) Combining risky portfo- between the two amounts represents the lios should, however, decrease total risk, and capital saving achieved by diversification. therefore capital, due to risk diversification. This benefit needs to be allocated to busi- Under certain conditions then, these risk meas- ness segments. ures may suggest incorrectly that combining 2. Allocation of the diversification benefit to portfolios increases the level of risk. segments: The allocation of the diversification benefit This drawback of probability of ruin and VAR to segments needs to reflect the contribution arises when loss distributions of business seg- of each segment to aggregate enterprise risk. ments are asymmetric and not correlated uni- It involves calculation of the marginal capital formly across the range of outcomes. This is requirement of each segment, i.e., the prevalent in insurance where, unlike banking, amount of capital needed by the enterprise most risks exhibit “fat tailed” probability distri- to add the segment to the enterprise. The butions that cannot be fully represented simply difference between this marginal capital by their mean-variance characteristics. requirement and the stand-alone capital requirement calculated in the preceding step A refinement to this method is to use the represents the maximum amount of diversifi- “ECOR ratio” (i.e., the ratio of ECOR to the cation credit associated with any segment. present value of expected customer payments) The actual amount of credit given to any to drive the attribution process. segment will be less than this maximum. It will be derived by use of any one of several ECOR does not suffer from the drawback possible algorithms that are designed to described above for probability of ruin and VAR. make the resulting allocation fair across Determining capital using ECOR correctly segments. produces this result: Combining risky portfolios reduces the capital requirement for the same Page 42 Chapter VII

It is important to note that capital attribution tion benefits, this results in an economically fair results can be highly sensitive to the risk measure capital attribution. Indeed, given the practical and risk constraints that are selected. In partic- difficulties in assigning regulatory, rating ular, as described in the prior section and in agency or competitive capital at the business Appendix G, there are situations in which using unit level, this may represent the most realistic a probability-of-ruin constraint can lead to and meaningful way to attribute such capital. severely erroneous conclusions about capital requirements and to inappropriate attribution It is important to attribute capital to business of capital across business segments (especially in segments to determine which segments, and property/casualty insurance companies). These which financial and operational strategies within difficulties can be avoided by using the ECOR a segment, are creating or destroying value. ratio as a measure of risk and selecting an This is explored in the next chapter. ECOR ratio target as a risk constraint. Having evaluated each combination of financial One noteworthy feature of capital attribution is and operational strategies in terms of its capital that, even if the enterprise-wide capital require- requirements — which is what matters most to ment is established on the basis of regulatory, policyholders — the next step is to evaluate rating agency or competitive capital considera- them on the basis of returns to owners. tions, it can be fairly attributed to business segment by first converting the enterprise-wide requirements into an implied risk constraint (e.g., ECOR ratio). The imputed financial constraint at the enterprise level can then be applied at the business unit level, and business unit capital requirements can be derived there- from. After applying any necessary diversifica- Chapter VIII Page 43

VIII. Strategy Development,Step 4 – Evaluate Strategies Based on Owners’ Interests

Assess Articulate Evaluate Strategies: Evaluate Strategies: Risks Strategies Policyholders’ Owners’ Perspective Perspective

Refine Strategies

Link to key performance Attribute capital Classify and prioritize indicator(s) via to business Set objectives risk factors financial model segment and constraints

Risk factor KPI Optimize strategies distributions distributions and sensitivity-test

Isolate impact of Decompose risk each strategy into root causes

The focus in this step is to evaluate strategies A. Begin This Step by Defining the Risk by considering the interests of enterprise own- and Value Measures ers. This group is primarily focused on growth In order to evaluate strategies against manage- of the business, return on their investment and ment preferences, each objective must be consistency of financial performance — the defined in terms of measures that are generated three pillars of the value edifice. Strategies will by the stochastic financial model developed ear- distinguish themselves based on their relative lier. Note that the financial model generates impact on each of these value drivers. Some projections of financial statements — specifical- strategies are meant to focus primarily on grow- ly, it generates probability distributions on ing the business, while others focus on return. each major element of the financial statement. Still others focus on reducing variability. A Growth is typically measured as the expected combination of financial and operational strate- value of the average percent change in revenue gies will likely affect all three objectives in posi- or earnings over the time horizon. The return tive and negative ways. Therefore, evaluating for a business segment can be measured as the strategies will require optimizing the trade-offs expected value of average net earnings over among the objectives based on the preferences the time horizon as a percent of attributed eco- of managers acting as agents for the owners. nomic capital. Earnings in this case should be determined on an economic value or cash flow basis, rather than statutory, to ensure that the numerator is consistent with the economic cap- Page 44 Chapter VIII

ital in the denominator. Consistency, however, These risk metrics are not the same as those can be measured in several ways. discussed in the previous chapter because the respective phenomena they describe (risk for Consistency typically refers to net earnings but policyholders and risk for owners) are funda- can also apply to return on capital, revenue mentally different. This difference is discussed growth, growth in embedded value or any in Appendix D. other financial metric that the owners consider important. In all cases, a measure of consistency B. Next, Select the Methods for for any financial variable can be represented by Evaluating Strategies any of the illustrative risk metrics in the following table. Once the measures are selected, there are several options for evaluating strategies. They range The target levels in the formulas for each risk from those that are computationally easy but metric are based on owner expectations. The involve extensive discussion among decision- target level for return on capital is ostensibly makers to those that rely more on computa- the return that the owner expects given the tional sophistication to capture management capital market investment opportunities that objectives. are available.

Risk Metric Definition

Standard Deviation where n is the number of simulation iterations and x is the average value over all iterations. This is a commonly used measure of risk by academics and capital markets. It is interpreted as the extent to which the financial variable could deviate either above or below the expected value. Note that equal weight is given to deviations of the same magnitude regardless of whether the deviation is favorable or unfavorable. (There are different schools of thought on whether standard deviation in this context should measure total volatility or only the non-diversifiable volatility.)

Shortfall Risk where T is the target value for the financial variable and n is the number of simulation iterations. This is an improvement over standard deviation because it reflects the fact that most people are risk averse, i.e., they are more concerned with unfavorable deviations rather than favorable deviations. It is interpreted as the probability that the financial variable falls below a specified target level.

Value at Risk (VAR) In VAR-type measures, the equation is reversed: the shortfall risk is specified first, and the corresponding value at risk (T) is solved for.

Downside Standard where T is the target value for the financial variable Deviation and n is the number of simulation iterations. This is a further improvement over the other metrics because it focuses not only on the probability of an unfavorable deviation in a financial variable (as with shortfall risk) but also the extent to which it is unfavorable. It is interpreted as the extent to which the financial variable could deviate below a specified target level.

Below-Target-Risk BTR is similar, but the argument is not squared, and there is no square root (BTR) taken of the sum. Chapter VIII Page 45

1. The simplest approach is to plot all combi- tainty of attaining that level. Typically, sever- nations of strategies on a two-dimensional al plots with various value and risk measures chart representing risk and value (Figure 25). are developed to provide several perspectives Either growth-based or return-based to the discussion. measures can be used to analyze risk and value. Risk is plotted on the x-axis using any 2. A more sophisticated approach uses mathe- one of the risk metrics in the above table. matical optimization technology to automat- Value is plotted on the y-axis. In Figure 25, ically eliminate dominated strategies. Given expected return on capital over five years is the number of alternatives proposed in Step used to measure value, and BTR with a target 2 (“Articulate Strategies,” Chapter VI) for rate of X% is used to measure risk. Each each independent financial and operational point on the plot represents a proposed set strategy, there may be hundreds or possibly of coordinated financial and operational thousands of possible combinations of strate- strategies. gies that must be evaluated. In this case, it’s practical to subject some strategies to mathe- Sets of strategies dominated by other sets are matical evaluation rather than manual evalua- eliminated from consideration. For example, tion as in the prior method. In particular, the strategy set A dominates strategy set B asset allocation strategy can be mathematically because A has both a higher Value and lower optimized to develop an efficient frontier of Risk, i.e., A is better than B under both dominant asset allocation strategies on a risk- measures. The remaining strategy sets are value plot (Figure 26 on following page). evaluated through discussion among the Each point on each curve represents a specific decision-makers. Decision-makers voice their combination of strategies. Moving from respective preference for trading off the point to point along the curve represents expected return on capital against the uncer- changes in only the asset allocation strategy,

FIGURE 25 The strategy sets in blue dominate the strategy sets in red because they offer higher value for a given level of risk, or lower risk for a given level of value

Plot of Alternative Strategies on Risk/Value Grid

A Value Measure: Return on B Capital

Risk Measure: Below-Target-Risk Page 46 Chapter VIII

whereas moving from curve to curve repre- value measure and each risk measure must be sents changes in the other strategies. The made explicit and stated in mathematical form. thick-lined curve represents all dominant However, the process of simplifying preferences combinations of strategies. Note that as into a mathematical equation is fraught with before, it is still necessary for decision-makers difficulties. First, not all decision-makers may to discuss their relative preference for risk have similar preferences. Second, people gener- versus value in selecting the optimum combi- ally have difficulty articulating their preferences nation of the remaining strategies. However, precisely. Finally, preferences may change as a all the dominated asset allocation strategies result of discussion with other decision-makers. have been eliminated from the discussion Therefore, whenever possible, it’s preferable to a priori. resist collapsing multiple financial measures into a compound measure for the purposes of evalu- As in the prior method, a value metric must be ating strategy. chosen for the analysis (e.g., return on capital) as well as a risk metric (e.g., below-target-risk). A partial solution to this problem is to display Also, if management objectives extend beyond the desired value and risk measures simultane- either just return on capital or just below-tar- ously, using visual devices. For example, an get-risk, several plots would have to be created extra risk or value metric (i.e., a third dimen- to represent other value and risk measures. It’s sion) can be captured in a classic two-dimen- possible to summarize information from several sional efficient frontier graph by varying the plots with different value and risk measures into size of the “bubble” used to represent each one plot with compound value and risk measures. strategy on the graph according to the size To do this, the relative preferences among each of the metric for that strategy. An alternative

FIGURE 26 The plot below illustrates the evaluation of alternate strategies that are already optimized with respect to asset allocation. Each line represents a different set of strategies; however, the thick bold line represents the best strategy given a level of risk

Plot of Alternative Sets of Strategies on Risk/Value Grid

Value Measure: Return on Capital

Risk Measure: Below-Target-Risk Chapter VIII Page 47

method for reflecting management objectives In all cases, the final evaluation and selection that extend over multiple measures is to repre- of the best combination of strategies is accom- sent some measures as constraints in the formu- plished through discussion — among decision- lation of the optimization problem. makers armed with insight into the risks and values of each strategy. Constraints can also be used to represent objectives other than maximizing value and mini- C. Finally, Conduct Sensitivity Analysis mizing risk. In general, constraints are factors that preclude an enterprise from pursuing the Regardless of the methods chosen to evaluate optimal risk management strategy. They can strategy, it is generally helpful to analyze the include risk management budget limitations, sensitivity of the conclusions to modeling unavailability of reinsurance, restrictions on use assumptions and parameters. For example, are of financial hedges, cash flow requirements and the conclusions very different for small changes undesired results under statutory and/or gen- in either the target return or the optimization erally accepted accounting principles. Any constraints? Although cumbersome, sensitivity of these can be structured as mathematical analysis is vital to ensure that the strategy evalu- inequalities and added to the above formula- ation approach is robust, thereby increasing tion of the optimization problem. Naturally, credibility and buy-in among the decision- adding constraints will always narrow the win- makers. dow of strategies that can be considered, and in the extreme, none of the strategy combinations may meet all constraints. In this case, it becomes necessary to selectively loosen the constraints and/or eliminate some constraints. However, judicious use of constraints can simplify the evaluation of strategies. Page 48 Chapter IX

IX.Strategy Development,Step 5 – Refine Strategies

Assess Articulate Evaluate Strategies: Evaluate Strategies: Risks Strategies Policyholders’ Owners’ Perspective Perspective

Refine Strategies

Link to key performance Attribute capital Classify and prioritize indicator(s) via to business Set objectives risk factors financial model segment and constraints

Risk factor KPI Optimize strategies distributions distributions and sensitivity-test

Isolate impact of Decompose risk each strategy into root causes

Although alternative financial and operational Step 1 (“Assess Risks”), sources of potential strategies were developed in Step 2 (“Articulate deviation were identified, prioritized and classi- Strategies,” Chapter VI), promising new strate- fied. Each source of risk that involved either gies often come to light in the process of dis- substantial expenditure or change in strategic cussion and analysis of strategies in Steps 3 and direction — strategic risk — was modeled as a 4. In this case, Step 2 may have to be revisited probability distribution on one of the variables to ensure that the financial model can model in the financial model. This structure allows the new strategy. Steps 3 and 4 must then be us to determine the relative impact each risk repeated to evaluate the new alternatives source has on consistency of results. against the best candidates from prior analysis. In this section, we present a formal method for The uncertainty associated with a variable in developing new strategies by decomposing the the model can be turned “on” and “off” to analysis into root causes. assess the impact of that variable. Turning “on” a variable means converting it from a determin- One of the fundamental objectives of manage- istic variable to a stochastic variable. As previ- ment is to increase the consistency of results. ously discussed, this is done by replacing the This reflects owners’ risk aversion to negative deterministic value with the probability distri- deviations from expected performance. In bution of the risk source that it is associated Chapter IX Page 49

with. Turning “off” a variable means replacing Repeating this exercise with each risk source the probability distribution with the expected provides information that can be used to com- value of the variable, i.e., the mean of the dis- pare each source of risk. Tornado graphs or bar tribution. In each case, the risk measure for charts, as in Figure 27, illustrate graphically the a financial metric is recorded, e.g., BTR for relative impact of each risk source on a specific return on capital. The difference in the values financial metric using a specific risk metric. This represents the contribution of that risk source information is extremely helpful in developing to the uncertainty of return on capital. There strategies that “zero in” on large sources of risk. will be no impact on value measures because in each case the value measure is based on the Similarly, evaluating results based on changes expected value of a stochastic variable. to an isolated strategy, e.g., reinsurance, can be used to determine the relative impact of each strategy within the complete set of financial and FIGURE 27 This tornado graph illustrates the relative operational strategies. In this case, it’s impor- impact of each source of risk on the deviation tant to look at both value and risk measures of earnings from the expected value because each strategy will likely impact both Earnings Volatility measures. Here also, the information is helpful (90% confidence interval) in developing alternative strategies. 0 1.0 2.0 3.0 4.0 Decomposing risk and isolating the impact of Interest rate each strategy can be an effective method for heuristically optimizing strategies. The process Claims amount provides additional insight into the underlying dynamics between risk and value. Claims timing

Sales

Distribution costs

Exchange rate

Technology failure Page 50 Chapter X

X.Recapping the Strategy Development Stage of the RiskValueInsights™ Process

FIGURE 28 The five-step strategy development stage is recapped below

Assess Articulate Evaluate Strategies: Evaluate Strategies: Risks Strategies Policyholders’ Owners’ Perspective Perspective

Refine Strategies

Link to key performance Attribute capital Set objectives Classify and prioritize indicator(s) via to business and constraints risk factors financial model segment

Risk factor KPI Optimize strategies distributions distributions and sensitivity-test

Isolate impact of Decompose risk each strategy into root causes

The five-step process recapped in Figure 28 Policyholders’ interests are reflected by estab- represents the logical flow of activities in devel- lishing capital based on economic capital oping strategy. The risk assessment process considerations (e.g., using Economic Cost of establishes the complete risk environment by Ruin — ECOR, the premium needed to insure considering both financial and operational risks. against ruin). Attribution methods consistent Manageable risks are assigned to appropriate with the method used to establish overall capital managerial levels while strategic risks are quan- (e.g., using the ECOR ratio) are used to attribute tified and included in the financial analysis. capital to business segments as a charge for Alternative financial and operational strategies protection against insolvency. Owners’ interests are overlaid on the risk environment and mod- are reflected by evaluating each combination of eled using an extension of existing financial strategies in terms of its impact on growth, models. Strategies are evaluated in consideration return on capital and consistency of results. of both policyholders’ and owners’ interests. The fundamental difference between policyholders’ and owners’ interests is captured by the risk metrics used (e.g., ECOR and Below- Target-Risk measures, respectively). The evaluation process can be computationally intensive Chapter X Page 51

but relies ultimately on the analysis and discus- cal, logistical and computational issues. But a sion among decision-makers who voice their rel- process such as the one we have described is ative preferences for multiple objectives. Finally, very useful as an ideal — and is essential as a decomposition of risk can provide opportunities guide to inform the development of progres- to develop potentially better strategies. sively more sophisticated practical processes along the way. In the next chapter we discuss In practice, of course, the strategy development how some companies have proceeded process is not so linear and logical due to politi- incrementally on this journey.

Illustrative Results

hat are the tangible Figure 29 shows how, using the These key decisions included: methods described in Chapter Wresults from all this Ⅲ Pricing V, a System Dynamics “flight analysis and strategy develop- Ⅲ Size of the independent and simulator” informed management? Examples from client captive agency forces ment’s decisions on distribution assignments range from more Ⅲ Commission rates channel strategy. By simulating optimal asset allocation to more Ⅲ Investments in technology the impact of certain key cost-effective reinsurance and Ⅲ Expenditures in building decisions on the probability hedging; from more risk-based e-commerce capability. internal audits to more “risk- distributions of market share informed” strategic decision- and profitability, management The impact of each of these making. Some specific results was able to evaluate a sizable decisions on the company’s are illustrated in the following number of alternative strategy risk/reward targets was there- figures. choices. fore directly measured, and a

FIGURE 29 A “flight simulator” allowed management to evaluate alternative distribution channel strategies

Flight Simulator Illustrative Price 900 1100 1000

No. of Independent Agents (1,000s) No. of Captive Agents (1,000s) Probability 515515 10 8 0100Profit ($Millions) Internet Marketing Expense Commission Rate 2% 3% 4% 5%

0% 8% 0% 10%

New Investment in Technology ($Millions) Probability 0 50 0 02Market Share % Page 52 Chapter X

small number of preferred segment was considered from (Note: points 1 and 2 define the options were presented to three points of view: upper and lower boundaries, senior management for their respectively, of the capital review. 1. On a stand-alone basis, that attributable to the segment.) is, as if the business segment Figures 30 through 33 show did not receive any “diversifi- 3. The “diversified portfolio” how, using the methods cation credit” amount, arrived at by sub- described in Chapter VII, capi- tracting from the stand-alone tal management was used to 2. On a marginal basis, whereby requirement a diversification create value. First, the compa- the capital attributed is the credit — the sum of such ny’s overall economic capital incremental amount required credits over all segments requirement was attributed to when the segment is added equals the capital saving business segment (Figure 30). to the company’s overall realized by the company The capital requirement of a portfolio of segments through diversification of its business portfolio. FIGURE 30 The company’s overall economic capital requirement was Then, underperforming busi- attributed to each business segment ness segments were identified Segment Capital Requirement based on their risk/return char- The Economic Cost of Ruin (ECOR) ratio is the risk constraint acteristics. That is, once capital we use to conduct the analysis had been attributed to segment, Illustrative the distribution of operating outcomes of each segment Maximum Capital Diversification Credit* could be transformed into distributions of return on capital. These distributions, in turn, Minimum Capital were assessed relative to the risk/return benchmark established by investors in the capital market. Figure 31 plots the result of this analysis for two segments. Segment A exceed- Stand Marginal Diversified ed the return standard for its Alone Portfolio risk level and was cresting *Derivation is “order independent.” value, while Segment B failed to meet the standard and was destroying values. Chapter X Page 53

FIGURE 31 By comparing the risk/return characteristics of different business segments against alternative investments of capital, underperformers were identified Modified Capital Market Line The modified capital market line represents the investor’s benchmark rate of return

Segment A Illustrative

Value Creation

Value Large cap stock Small cap stock Destruction Real estate Bond index Segment B

Expected Return Expected Long bond Cash

Below-Target-Risk

FIGURE 32 Different business segments consume different amounts of capital, and some do not return more than the cost of their capital

Illustrative

B C D Latent Value E Creation

A Excess Capital Current Actual Value Cumulative Value Value Cumulative Creation 0 Creation Cumulative Capital Total Capital Employed

FIGURE 33 Through redeployment and more efficient use of capital, returns — and value — were greatly enhanced

Illustrative D Value B C Enhancement

Original Value Cumulative Value Value Cumulative Creation Creation 0 Cumulative Capital Employed Total Capital Page 54 Chapter X

Next, once capital had been FIGURE 34 attributed to each segment Investment strategies reflecting asset and liability scenarios and the required rate of return are more efficient than those reflecting assets alone of each segment determined in Illustrative relation to risk, the company Asset/liability was able to measure and efficient frontier calibrate the value creation/ destruction associated with each segment. Figure 32 Asset-only efficient frontier shows the result of this “value

creation audit” for a company Return Expected with five major business segments arranged from left to right in declining order of value creation. In this compa- Level of Risk ny, segments A and B create Finally, a capital redeployment earmarked to be returned to value while C is at value break plan was developed (Figure 33). shareholders or to be used for even, and D and E destroy Segment D was “fixed” and is a “strategic acquisition.” (Many value. Also note the value projected to now create value. companies believe that they destruction associated with Segment E was sold off. Excess ought to return capital to excess capital. capital has been investors rather than be viewed

FIGURE 35 Each reinsurance program component was measured on its contribution to reducing insolvency risk; this was translated into reduction in required capital

Marginal Reduction in Required Capital Casualty Working XS Illustrative Property First Cat Special Property Fac E&O Program XS Work Comp Working XS Property High Cat Umbrella QS Std Property Risk XS Surety QS Casualty High XS Marine XS Aviation XS Professional Liability XS Special Property QS Casualty Clash

0 20 40 60 80 100 120 140 Dollars (in millions) Chapter X Page 55

as poor managers of capital claim liabilities within workers (Figure 35, page 54). (Note that productivity on behalf of their compensation, the ALEFSM single-period statistical analysis investors. A company that has analysis correctly showed that cannot capture the impact of credibility in the capital market investing heavily on stocks was reinsurance programs on capi- can raise money very quickly the better strategy. The long-term tal.) Relating capital reduction on attractive terms, while a nature of these liabilities and to the cost of each reinsurance company that does not manage the fact that they are very infla- program component allowed capital well is strategically tion-sensitive made stocks the meaningful comparisons of vulnerable.) ideal “hedge” for this carrier. components on the basis of value creation (Figure 36). The Figure 34 shows how, using the Figures 35 through 37 show reinsurance program was methods described in Chapter how, using the methods redesigned, by subjecting each VIII, an asset/liability efficient described in Chapters VI program component to the frontier (ALEFSM) analysis was through VIII, a reinsurance pro- criteria captured in Figure 37, used to improve upon a sub- gram was redesigned to page 56, that is, whether its optimal investment strategy. enhance enterprise value. First, cost (which reduces expected Based on an asset-only efficient each reinsurance program return) was justified by its risk- frontier, a workers compensa- component was evaluated reduction performance (which tion carrier would have been based on its contribution to reduces required return). led to invest mostly in bonds to reducing the risk of insolvency satisfy its risk/return constraints. — this was then translated into Finally, Figure 38, page 56, But given the nature of medical a reduction in required capital shows how, using the methods

FIGURE 36 By comparing capital reduction to program cost, it was determined that some program components added significant value; others were inefficient

Implied Marginal (Normative) Cost of Reinsurance Capital Casualty Working XS Property First Cat Illustrative Special Property Fac E&O Program XS Work Comp Working XS Property High Cat Umbrella QS Std Property Risk XS Surety QS Casualty High XS Marine XS Aviation XS Professional Liability XS Special Property QS Casualty Clash

0% 10% 20% 30% 40% 50% 60% 70% 80% Page 56 Chapter X

FIGURE 37 Reinsurance creates value when the cost of reinsurance is offset by a reduction in the required rate of return The value of reinsurance cannot be measured in a CAPM framework because ceded losses (diversifiable) do not reduce the required rate of return

Illustrative Required-Rate-of-Return Line

Return shortfall

Cost of reinsurance Return Excess return

With Without reinsurance reinsurance Risk

described in Chapters V through FIGURE 38 IX, an integrated approach to Integrating investment and reinsurance strategy evaluation investment and reinsurance produces considerable benefits

strategy evaluation was employed SM Illustrative ALEF under reinsurance to considerable beneficial effect. alternative #2 First, since alternative reinsurance ALEFSM under reinsurance programs change the nature of Investment alternative #1 strategy B the company’s liabilities, different Investment ALEFSM under strategy A asset/liability efficient frontiers current program were generated. (The alternative

reinsurance programs were Return Expected Current investment selected as described above.) strategy These efficient frontiers show the set of efficient investment strategies under each reinsur- Level of Risk ance scenario. By successively optimizing and refining the reinsurance and investment strategies, substantial improve- ments were achieved in terms of both risk reduction and return enhancement. Ⅲ Chapter XI Page 57

XI.Proceeding Incrementally A.The “Building Blocks” Many organizations are getting their feet wet While, in principle, it would be possible to by focusing on only some risk management introduce the kind of strategic enterprise risk activities. They include the following major management that we call RiskValueInsights™ categories: all at once, most organizations prefer an incremental approach in order to overcome the Risk practices audit — the comprehensive, potential hurdles to implementation uncovered objective review of the organization’s current in our survey of industry executives. The early activities against best practices to identify where activities are often designed to deliver “quick the needs are greatest. wins” that help garner senior and operational ERM framework development — the estab- management buy-in, and/or produce financial lishment of the objectives, business case and gains that help fund the next wave of activity. plan by which ERM will be implemented with- That kind of incrementalism can be effective, in the organization, including the incorporation as long as senior managers keep a firm eye of risk considerations into strategic decision- on the RiskValueInsights™ framework and making, capital budgeting, business planning, ultimate goal of creating a fully integrated, performance measurement, internal auditing strategic enterprise risk management system for and stakeholder relations. Also includes the their organization. determination of a “universal risk language,” Many companies have started quite modestly i.e., a common set of risk/value metrics, toler- by employing certain ERM-generated tech- ances and performance standards by which to niques in smaller-scale contexts. Examples evaluate strategic and tactical alternatives. include using a “heat map” approach similar Enterprise-wide risk assessment — the quali- to that shown in Figure 17 (Chapter V.B) on tative identification, prioritization and classifica- a less-than-enterprise-wide scope of risks, and tion of key risk factors, and the quantitative using a “flight simulator” approach similar to measurement and modeling of those risk factors that shown in Figure 21 (Chapter V.C, sidebar that are deemed high priority and strategic. to “Modeling Operational Risks”) to evaluate a Includes analysis of the organization’s strategic predetermined set of candidate strategies. plan, solicitation of expert testimony, risk factor Some organizations are “starting small” by mapping and ranking, and financial and opera- piloting ERM in one, or a small number, of tional risk factor modeling, using scenario gen- their business units or locations, for real-time eration and structural stochastic simulation as fine-tuning and eventual rollout to the entire necessary. enterprise. Other organizations are confining Sales practices and compliance — assessing the initial scope of their ERM to a subset of exposure to various forms of litigation through risk sources. This involves explicitly reflecting actuarial and business analysis of the company’s the interaction of these risks in strategy develop- products and practices. This includes evaluating ment. Eventually, all sources of risk would be the litigation exposure of potential acquisitions, layered in. reviewing business practices to reduce the potential for litigation and evaluating potential settlement offers.

Embedded value studies — the regular, peri- odic calculation of an embedded value, which is the present value of future expected after-tax Page 58 Chapter XI

distributable profits from existing business cal- Capital management — the determination culated at a discount rate that reflects the riski- of the organization’s optimal capital level and ness of the future profit flows. The change in structure, subject to regulatory and rating value of this amount over time gives a measure agency constraints, and the proper attribution of the change in economic value of the business of capital to business segments based on rela- to its owners. The main sources of the change, tive contribution to enterprise risk. This for example value added by new business includes quantitative risk analysis, determina- activities and deviations of actual from expected tion of capital adequacy from the policyholders’ experience, can be studied. perspective, assessment of value creation by business segment from the owners’ perspective, Strategy economics — the development redeployment of capital, and negotiation with and use of financial models to analyze the rating agencies as necessary. risk/value economics of alternative operational strategies related to, for example, distribution Asset/liability management — the coordina- channels, e-business, and customer retention tion between an organization’s asset and liability and attraction. functions and the optimization of investment allocation to asset class based on the nature and Financial risk modeling — the measurement structure of the organization’s liabilities. Key and modeling of financial risks and strategies activities include: expanding cash flow testing through actuarial and structural simulation models into full ALM models; risk management models such as dynamic financial analysis. of guarantees in equity-oriented products; Financial risks include asset risks (e.g., interest benchmarking against best practices; evaluation rates, equity returns) and liability risks (e.g., and optimization of strategies using efficient claims, expenses). One example of its use is the frontier analysis, and implementation of ALM optimization of investment strategy, given the controls, policies and procedures. nature of the organization’s liabilities, its risk/reward preferences, and its regulatory and Reinsurance/hedging strategy — the other constraints. development and execution of an optimal risk financing program, consistent with the organi- Operational risk modeling — the measure- zation’s risk/reward targets. Includes design of ment and modeling of nonfinancial risks and coverage form and structure, catastrophe-expo- strategies through the use of advanced decision sure management, dynamic hedging, integrated theoretic techniques and causal modeling product design and modeling, and execution approaches such as system dynamics. Operational through coverage placement with appropriate risks include business risks (e.g., sales tactics) reinsurance and capital markets. and event risks (e.g., natural catastrophes). An example of its use is the optimization of “Line of sight” people performance and distribution strategy given inputs such as reward systems — the effective linkage of indi- elasticity of demand, cost effectiveness of vidual performance targets and incentives with nontraditional channels such as the Internet, the strategic and financial objectives of the and competitor actions/reactions. organization as a whole. Chapter XI Page 59

B. Case Study Vignettes Ⅲ An integrated financial services company The activities described above, from risk prac- (banking, investment management, P/C and tice audits to people performance and reward life insurance) intended to add a new site- systems, represent the individual components of based delivery channel — a comprehensive RiskValueInsightsTM, i.e., the “building blocks.” risk management program was a key element Examples of how companies are utilizing these of the implementation plan. The program components include the following: integrated both financial risk (e.g., the economics of the new channel, and the ability to Ⅲ In the past, a large health plan conducted penetrate a new customer group efficiently) separate and uncoordinated risk assessments and operational risk (e.g., the business risk through its risk management, legal and inter- associated with bringing four lines of business nal audit functions. It recently undertook an to the sales desktops in remote locations, and enterprise-wide risk assessment covering all the regulatory risk of creating a new distribu- functional and operational divisions. The tion approach consistent with the regulatory objective was to prioritize all sources of risk requirements of each of the individual against a common set of financial and cus- businesses). tomer metrics to enable senior management Ⅲ to focus the organization’s limited resources A large multinational financial services group on the proper short list of critical concerns. undertook an assessment of the relative levels In addition to providing a meaningful and of economic capital required by each of its useful calibration of risks of varied types, this life and nonlife insurance subsidiaries. This exercise surfaced critical business risks that involved identifying the major sources of risk had not been identified through any previous in each line of business and modeling the audit or strategic planning exercise. Senior impact of these risk areas on the projected management is using the results of this cash flows. The results were used to determine assessment to set its strategic agenda. an appropriate level of capital at individual product level, subsidiary level, product group Ⅲ A life insurance group offering guarantees on level (across subsidiaries) and finally at group its variable annuity portfolio conducted an level. Global CAP:Link (a proprietary integrated analysis of both the downside risk economic scenario generation model of from the guarantees and the revenue risk Tillinghast –Towers Perrin) was used to pro- from capital market volatility to quantify the duce consistent economic scenarios to allow risk profile of the underlying portfolio and cross-currency aggregation. The resulting design an optimal risk management solution. attribution of capital is used as the foundation After a period of mock testing, the hedging for a performance measurement system relat- program has gone live. ing shareholder risk to return on capital and Ⅲ A multinational property/casualty company total shareholder return. Actual return on with significant workers compensation and capital is compared to the hurdle rate implied property catastrophe exposures combined by the shareholder risk, and differences are sophisticated global stochastic economic sce- analyzed into above- and below-the-line nario generation with state-of-the-art catas- effects. trophe modeling to simultaneously derive Ⅲ Several U.K. life assurance companies with optimal asset allocation and reinsurance “orphan” assets in their with-profits funds strategies. This ultimately resulted in a capital have used asset/liability modeling to deter- structure substantially more efficient than its mine the amount of these assets that can be peer companies. Page 60 Chapter XI

allocated and distributed between policyhold- tuned to bring the assets and liabilities into ers and shareholders without subjecting the balance. At this point, senior management fund to too high a level of risk. The impact analyzed various profit metrics for different on the fund was assessed for varying forms of investment strategies, looking at extreme sce- allocation and distribution of assets, on both narios for special review. Based on this analy- an open- and closed-fund basis, under a large sis, the product appeared to hold up well number of stochastic economic scenarios, even under the most extreme interest rate allowing for the interaction of economic scenarios without any market value adjust- conditions and management decisions on ment. The ALM analysis was effectively used bonuses. This has been used as the basis for to establish the product design and set the an allocation of these orphan assets between investment policy, and the product was filed policyholders and shareholders, thus allowing without any market value adjustment. part of the value to be unlocked. Ⅲ A property/casualty insurance company’s Ⅲ A medium-sized life insurer was looking to conservative asset mix resulted in perfor- improve the product design features of its mance returns that were not competitive. flagship universal life product — specifically, They evaluated alternative asset allocation incorporating a market value adjustment to strategies, along with an integrated financial protect against having to credit high interest reinsurance program, to enhance the returns in times of falling asset market values. The from investments and manage the risk of market value adjustment could have been a their business. However, the company did serious detriment to potential policyholders not want its rating from A.M. Best to be and might not have received regulatory affected as a result of implementing a more approval. Working together, senior manage- aggressive investment strategy. They devel- ment, the actuarial team and the investment oped a comprehensive model of the company fund manager determined that an ALM and evaluated multiple scenarios of economic model be developed using a set of stochasti- value in relation to risk. The model allowed cally generated interest rate scenarios. Various them to develop a strategy to alter their asset investment strategies were considered, cover- allocation. A financial integrated stop-loss ing a varying mix of mortgages, high-quality reinsurance program was designed with an corporate bonds and CMOs. The ALM investment hedge to mitigate the possibility model then made projections based on the that the investment portfolio may under- modeled relationship between the yield on perform a target return. The result: enhanced these asset classes and the yield curve for expected returns of the investment portfolio treasuries as produced by the stochastic inter- and lowered downside risk on operating est rate generator. Appropriate assumptions income. The executive team’s understanding were made for defaults and prepayment risk. of their return opportunities in relation to The yield relationships and other asset the risks of the business was deepened. This assumptions were reviewed by the fund man- insight was used to focus the work of line agement team, which also appraised the managers, and also used in discussions actuaries’ assumptions underlying the model with outside parties regarding overall risk that was used to create the stochastically management. generated interest rate scenarios. Duration and convexity of both assets and liabilities were then analyzed, and the product design and the planned investment strategy fine- Chapter XI Page 61

Ⅲ A medium-sized German life insurance com- risk/value economics of alternative opera- pany wanted to analyze the viability of their tional strategies by developing a financial current dividend strategy for traditional busi- model of the underlying business dynamics. ness. The German market has provided stable The process of model development and long-term dividend rates at a high level, even assumption setting forced the management while market interest rates have declined, by team to articulate the alternative strategies smoothing book yields via accrual and real- more clearly and with greater specificity than ization of “hidden” reserves (unrealized capi- they had thus far. The model was used itera- tal gains on assets) and unallocated bonus tively to evaluate further variations in strategy reserves. In the prevailing low interest rate suggested by a review of the projected finan- environment, the key competitive issue had cials at each prior iteration. Modeling the become how long companies could finance economics provided the management team their current dividend rates from existing with valuable information on the risks and buffers as compared to the market. In order opportunities underlying alternative strate- to analyze the company’s competitive posi- gies. As a result, the team was able to reach tion, ALM models were built for the compa- consensus on a distribution strategy that was ny and a representative market company, better understood and provided the best reflecting the company’s specific portfolio prospects of success. structure and strategies. On the basis of stochastic economic scenarios generation, the While such examples abound, we believe that estimated time until ruin (i.e., until buffers no single best approach to ERM implementa- have been exhausted) was determined for a tion is appropriate for all organizations. Some range of potential ALM strategies for the leading companies successfully employ a num- company and compared to the results for the ber of different phased approaches by starting market. By varying the investment strategy, with only some risks, only some strategies or the company improved its risk/return posi- only some business units. The nature and tioning. As a result of the benchmark study, sequence of these phases depend on the cul- the life insurer received an indication of its ture, strategic imperatives and management current competitive position and a quantifi- style of the organization. However, it is certain cation of alternative ALM strategies, which that for every organization a phased approach led the company to reassess its dividend- of some sort will be more successful than setting strategy for the entire traditional life attempting to do too much, too soon. portfolio. However you choose to proceed, and however Ⅲ A medium-sized life insurance company want- fast you decide to go, it is critically important ed to reconsider their distribution strategy in in the current environment to be on the light of plans to demutualize the following journey and to have a clear road map — a year. The bulk of their production came from complete conceptual framework and a coherent a network of career agencies, and the compa- process — to guide your way. We believe ny wanted to investigate not only other dis- RiskValueInsights™ provides that framework tribution channels but also the possibility of and process. becoming a wholesaler to other financial institutions. They decided to analyze the Page 62

Appendices

Ⅲ A Brief Recent History of the Risk of Not Managing Risks Holistically (Appendix A) Ⅲ Worldwide External Pressures (Appendix B) Ⅲ The Value of Consistency (Appendix C) Ⅲ Risk Measurement — for Policyholders and for Enterprise Owners (Appendix D) Ⅲ Glossary of Risk Modeling Methods (Appendix E) Ⅲ An Overview of Change Management (Appendix F) Ⅲ Use of Appropriate Risk Measures in Determining Capital (Appendix G) Appendix A Page 63

Appendix A Ⅲ A highly rated life insurer required state regulatory protection to prevent a “run on the bank” scenario that would have depleted the A Brief Recent History of the Risk of insurer’s surplus. The cause of the run was Not Managing Risks Holistically a ratings downgrade from one of the major Over the last several years, there have been rating agencies. The downgrade was due to many well-publicized events at financial institu- the insurer’s failure to adequately manage its tions that have led to significant financial/ exposure to credit risk. In part, these prob- reputational damage and, in some cases, lems were brought on by the insurer’s failure bankruptcies. to fully appreciate the financial risks associated with a major reinsurance treaty. Ultimately, Ⅲ Several large life insurance companies accused the insurer had no choice but to allow itself of misleading customers through their to be acquired by a much larger insurance agency sales forces face hundreds of millions organization. of dollars in fines, billions of dollars in policyholder restitution and significant damage to Ⅲ A syndicate that managed a pool of reinsured their image and reputation. Findings against workers compensation business on behalf of a these companies have included: number of large life insurance companies has cost these companies, their retrocessionaires — failure to obtain required licenses and the “fronting” companies more than — failure to submit sales literature for $1 billion in after-tax charges and settlements, regulatory review as the companies have claimed they were — failure to take disciplinary actions against misled into assuming more business than they sales representatives expected. This caused substantial disruptions in the workers compensation marketplace — failure of agents to properly explain the and was a major factor in the collapse of a policies or the impact of non-guaranteed large property/casualty company that fronted elements on these policies. for the syndicate. Ⅲ A centuries-old world-class bank collapsed Ⅲ The recent demise of a large Japanese prop- due to the actions of a single rogue trader erty/casualty writer was related to the overall who violated the bank’s trading policy, falsi- economic climate in Japan, but was height- fied records and engaged in large unautho- ened by an apparent poor regard for the rized trades. The bank’s control systems financial risk trade-off inherent in its balance failed to identify any of these activities. sheet. Japanese P/C insurers’ range of prod- Ⅲ Lack of appreciation of the exposure to a sin- ucts includes a distinctive “Savings” policy gle natural catastrophe across multiple busi- that is essentially a combination of property ness units resulted in severe aggregation of insurance coverage and a life insurance losses and substantial loss of capital for a endowment element. Most insurers include large multiline carrier. This led to the carri- a significant proportion of such business in er’s premature exit from a previously, and their portfolios, but this particular company subsequently, profitable business segment. had a disproportionately high share. Thus the cripplingly high level of interest rate guarantees, which are a recent feature of Savings business, were more acutely felt by this company and ultimately led to its demise. Page 64 Appendix A

Ⅲ Leading health insurers in the U.S. are expe- Ⅲ One of the oldest and, until recently, most riencing severe medical cost trends, system respected life insurance companies in the problems, class-action lawsuits, adverse legal U.K. was forced to close to new business and regulatory actions, significant reserve after losing a court case on its treatment of strengthening, missed earnings targets and guaranteed annuity rates. These allow policy- plummeting stock prices. This is in the holders the option to convert cash policy midst of the e-business revolution, new proceeds to a pension at a guaranteed rate. and nontraditional competition, increasing These guarantees appeared to be of little customer demands and ongoing business value when granted, but increasing longevity transformation. and falling interest rates have made them very valuable. The company, which is a Ⅲ In Canada, there have been recent, highly mutual, had a policy of full distribution publicized cases involving companies that of profits to policyholders and so had no have not had adequate control procedures in reserves to meet these guarantees without place. As a result, these companies have had reducing policy benefits. It tried to deal with their own employees take advantage of arbi- this failure in financial risk management by trage opportunities on segregated fund prod- reducing benefits for those policyholders who ucts at the expense of the policyholders, have exercised the option, thus rendering the been accused of secret billing practices and guarantee worthless. It failed to manage the are facing class-action lawsuits from their adverse public reaction to this course of own ex-employees. Although none of these action or to anticipate an unfavorable out- threatened the solvency of the companies come of the legal challenge to its actions. involved, the reputations of these companies have been tarnished by the bad press In most of these situations, problems stemmed received. There has also been a resultant from either a lack of understanding by man- increase in scrutiny by the regulators. agers of the dynamics of their business or lack Ⅲ The U.K. life insurance industry has been of sufficient influence over the activities of indi- required by regulators to carry out a review vidual or groups of employees or agents. It is of millions of pension policies sold in the late important to note that none have been the 1980s and early 1990s and to compensate result of a calculated risk taken by informed policyholders who are deemed to have suf- decision-makers. In addition to these well- fered losses as a consequence of mis-selling. noted events, financial institutions experience This review already has taken five years and frequent unpublicized losses due to financial is expected to last at least another two years. and operational risks that in the aggregate can Total costs to the industry are widely expect- significantly affect financial performance and ed to reach £13.5 billion. organizational stability. Ⅲ A medium-sized, highly rated mortgage company never anticipated ratings agency and pension plan clients’/investors’ reactions to a planned recapture of a previously reinsured interest rate risk. The end result: a forced merger. Appendix B Page 65

Appendix B requirement for accounting periods ending on or after December 23, 1999), makes directors responsible for establishing a sound Worldwide External Pressures system of internal control and reviewing its Failures in holistic risk management have led effectiveness, and reporting their findings to to efforts by regulators, rating agencies, stock shareholders. This review should cover all exchanges, institutional investors and corporate controls, including operational and compli- governance oversight bodies to insist that com- ance controls, and risk management. The pany senior management take greater responsi- Turnbull Committee issued guidelines in bility for managing risks on an enterprise-wide September 1999 regarding the reporting scale. These efforts span virtually all the devel- requirement for nonfinancial controls. oped countries, from the United Kingdom, to Ⅲ Australia and New Zealand have a common Western Europe, to Australasia, to Canada and set of risk management standards. Their the United States, and they encompass virtually 1995 standards call for a formalized system all industries. of risk management and for reporting to the organization’s management on the perfor- Publicly traded companies, in particular, know mance of the risk management system. While the keen and increasing desire of their investors not binding, these standards create a bench- for stable earnings. mark for sound management practices that Broad Corporate Governance Initiatives includes an ERM system. Ⅲ Ⅲ In Canada, the Dey report, commissioned In Germany, a mandatory bill — the Kon by the Toronto Stock Exchange and released TraG — became law in 1998. Aimed at giv- in December 1994, requires companies to ing shareholders more information and con- report on the adequacy of internal control. trol and increasing the duty of care of the Following that, the clarifying report produced directors, it includes a requirement that the by the Canadian Institute of Chartered management board establish supervisory Accountants, “Guidance on Control” (CoCo systems for risk management and internal report, November 1995) specifies that internal revision. In addition, it calls for reporting control should include the process of risk on these systems to the supervisory board. assessment and risk management. While these Further, auditors appointed by the supervis- reports have not forced Canadian-listed ory board must examine implementation companies to initiate an ERM process, they of risk management and internal revision. do create public pressure and a strong moral Ⅲ In the Netherlands, the Peters report in obligation to do so. In actuality, many com- 1997 made 40 recommendations on corpo- panies have responded by initiating ERM rate governance, including a recommenda- processes. tion that the management board submit an Ⅲ In the United Kingdom, the London Stock annual report to the supervisory board on a Exchange has adopted a set of principles — corporation’s objectives, strategy, related risks the Combined Code — that consolidates and control systems. At present, these recom- previous reports on corporate governance mendations are not mandatory. by the Cadbury, Greenbury and Hampel Ⅲ In the U.S., the SEC requires a statement on Committees. This code, effective for all opportunities and risks for mergers, divesti- accounting periods ending on or after tures and acquisitions. It also requires that December 23, 2000 (and with a lesser companies describe distinctive characteristics Page 66 Appendix B

that may have a material impact on future Insurance-Specific Initiatives financial performance within 10-K and 10-Q There are additional external pressures unique statements. Several factors broaden the to the insurance industry that are specifically requirement to report on the risks to the motivating insurers to take an enterprise-wide organization, leading to setting an enterprise- view of risk — and to integrate such risk man- wide approach to risk management in place: agement activities as risk assessment, capital management, asset/liability management, oper- — The report “Internal Control — An ational risk measurement, distribution channel Integrated Framework,” produced by optimization and reinsurance/hedging into a the Committee of the Sponsoring consistent, comprehensive framework. Organizations of the Treadway Commission (COSO), favors a broad Ⅲ In Canada, the Office of the Superintendent approach to internal control to provide of Financial Institutions (OSFI), in its reasonable assurance of the achievement Supervisory Framework: 1999 and Beyond, of an entity’s objectives. Issued in defines “inherent risk” to include credit risk, September 1992, it was amended May market risk, insurance risk, operational risk, 1994. While COSO does not require liquidity risk, legal and regulatory risk and corporations to report on their process of strategic risk. It states that, “Where inde- internal control, it does set out a frame- pendent reviews of operational management work for ERM within an organization. and controls have not been carried out or where independent risk management control — In September 1994, the American functions are lacking, OSFI will, under nor- Institute of Certified Public Accoun- mal circumstances, make appropriate recom- tants (AICPA) produced its analysis, mendations or direct that appropriate work “Improving Business Reporting — A be done.” Customer Focus” (also known as the Jenkins Report), in which it recommends Ⅲ The International Actuarial Association, in its that reporting on opportunities and risks Insurance Liabilities — Valuation & Capital be improved to include discussion of all Requirements: General Overview of a Possible risks/opportunities that: Approach, May 31, 2000, divides risk into — are current eight types (credit, transfer, market, business, — of serious concern operational, mortality, morbidity, and proper- — have an impact on earnings or cash flow ty and casualty) and states: — are specific or unique — “…the calculation of economic capital — have been identified and considered by should be based on the expected ruin management. probabilities or default rates, taking into account all the risks to which the company The report also recommends moving toward is subject.” consistent international reporting standards, which may include disclosures on risk as is — “The portion of the risks that has not required in other countries. been included in the fair value of liabilities (and assets) is taken into account in the Ⅲ Institutional investors such as Calpers have calculation of economic capital. This begun to push for stronger corporate gover- reflects uncertainties in the model and nance and to question companies about their process risk, setting assumptions, uncer- corporate governance procedures — includ- tainties with respect to the distribution ing their management of risk. functions of the risk factors and the volatility in the risks.” Appendix B Page 67

— “While similar in objective, the tools Ⅲ The National Association of Insurance required to measure and to analyze them, Commissioners (NAIC) Life Risk-Based not only are different, but also need to be Capital Working Group, in conjunction with supplemented with a decomposition of the American Academy of Actuaries Life risk into the various (sub) risk types to Risk-Based Capital Task Force, has finalized make it measurable, transparent and the development of an improved method for manageable.” measuring a company’s interest rate risk. The method, which is effective for the year-end Ⅲ In Australia, a feature of ongoing reforms to 2000 statements, “incorporates a cash flow the regulation of general insurers is a layer of testing requirement for annuity and single- four standards covering the subjects of capital premium life products and makes the RBC adequacy, liability valuation, reinsurance C-3a calculation more consistent with recent arrangements and operational risk. The industry advances in dynamic cash flow test- Australian Prudential Regulation Authority ing…The task force has recognized the need (APRA) is implementing an approach based to accurately incorporate these additional on development of, and compliance with, a risks into the RBC formula. They have stated range of risk management strategies. These that equity-indexed annuities (EIAs) and strategies will need to deal with the myriad variable products with secondary guarantees interlocking risks involved in managing a will be incorporated in a future C-3a update. general insurance company. Each company This would be consistent with the task force’s will need to have its strategy agreed upon by goal of upgrading C-3a from a measure of APRA and will then be responsible for man- interest rate risk to a more complete measure aging compliance. APRA has made it clear of asset/liability risk.” that an internal enterprise risk model with appropriate specifications will go a long way Ⅲ Moody’s Investors Service, in its One Step toward meeting compliance objectives. in the Right Direction: The New C-3a Risk- Based Capital Component, June 2000, states Ⅲ In the U.K., the Financial Services Authority that it will use the new method devised by (FSA — the recently created regulator of all the NAIC and the American Academy of U.K. financial services businesses) is intro- Actuaries for measuring a company’s C-3a ducing a system of risk-based supervision that (interest rate) risk, as it incorporates a cash will create a single set of prudential require- flow testing requirement for annuity and ments organized by risk rather than by type single-premium life products and is more of business. Regulated businesses will have consistent with industry advances in dynamic to demonstrate that they have identified all cash flow testing: “…the revised calculation is material risks and have adequate systems and a more accurate barometer of the amount of financial resources to manage and finance capital required to support an insurer’s interest- such risks, including market risk, credit risk, sensitive business, as it explicitly incorporates operational risk and insurance risk. There is asset-liability mismatches in determining the also likely to be a requirement for formal appropriate amount of required regulatory documentation of the whole process in a capital for a company. Consequently, the new format that is readily accessible to the FSA. calculation should help discourage companies from taking unwarranted asset-liability risk.” Page 68 Appendix B

Ⅲ A.M. Best, in its “Enterprise Risk Model: A Poor’s Insurance Capital Markets Group has Holistic Approach to Measuring Capital developed a new, risk-based capital adequacy Adequacy,” describes their VAR-based model to analyze the credit, financial market method for determining the adequacy of cap- and operational risks of companies that are ital for rating purposes. Their report states: offering products or are using sophisticated “The Enterprise Risk Model is a modular sys- risk management techniques that are not tem designed to capture all risks, including considered under the existing Rating Group’s noninsurance and non-U.S. related risks. capital models. The model will also determine VAR methodologies are somewhat contro- these companies’ capital adequacy. The pri- versial in insurance circles, but they are the mary application of the model will be to ana- standard for other financial services organiza- lyze specialized financial product companies tions. More importantly, A.M. Best believes ...The model may also be applied to portions that VAR-based methodologies provide a of insurance companies that control or more accurate assessment of risk and mitigate their risks to a greater extent than is required capital, since they use observable implied by the capital charges applied in the market metrics. Beyond its application in the standard life/health capital adequacy model, rating process, the model can also be a useful which bases charges for interest rate risk and tool for financial managers, since the VAR credit risk on industry averages and liability framework types rather than company-specific exposure.” provides a natural springboard to other Ⅲ The Basel Committee on Banking Super- applications, including risk-adjusted return vision has proposed a capital charge for oper- on capital (RAROC) and dynamic financial ational risk as part of the capital framework analysis (DFA). The Enterprise Risk Model in the New Basel Capital Accord. The charge quantifies the risk to the future surplus — net reflects the Committee’s “realization that worth — of an organization arising from a risks other than market and credit” can be change in underlying risk variables, such as substantial. Operational risk is defined as “the credit risk, insurance risk, interest rate risk, risk of direct or indirect loss resulting from market risk and foreign exchange risk. The inadequate or failed internal processes, peo- model also quantifies the benefits of diversifi- ple and systems or from external events.” cation as it takes a macro view of the correla- The new capital adequacy framework applies tions among risks within an organization... to insurance subsidiaries of banks and may Like other VAR-based models, it is calibrated well soon apply to insurance companies as to measure the risks over a defined holding insurance and banking activities converge. period — one year — for a given level of statistical confidence — 99%.” Ⅲ Standard & Poor’s, in its “Revised Risk- Based Capital Adequacy Model for Financial Products Companies,” states: “Standard & Appendix C Page 69

Appendix C ment of the underlying profitability of the company with more consistent results. The premiums that investors demand for systematic versus The Value of Consistency nonsystematic risk are not easily determined, One of the central goals of ERM is consistent but will be the subject of further research.) financial performance. While some industry observers accept the fundamental value of The analysis was performed on 111 publicly consistency, others argue that investors do not traded financial services companies. Similar favorably value companies that expend time results were found for every other industry and resources attempting to minimize volatility group we sampled as well. The bottom line: in their results. This volatility, the argument consistency does indeed matter. goes, can more efficiently be diversified away within the investor’s own portfolio — if, The primary objective of enterprise owners is indeed, that is the investor’s desire. to increase the value of the enterprise. The key driver of enterprise value is earnings perfor- Our empirical research indicates that, holding mance. Higher returns on capital, greater earn- constant other key drivers of share value (such ings growth — and less volatile earnings — all as earnings growth and return on capital), generate higher enterprise value (see Figure 39). investors do, in fact, assign considerable value to consistency, and earnings consistency in par- Minimizing earnings volatility has a significant ticular. (The sources of this value are more dif- impact on enterprise value. The effect of ficult to identify. It may be that that the more volatility can be seen more clearly by first consistent companies are less exposed to “sys- stratifying the industry according to return and tematic” volatility. Alternatively, investors may growth, thereby normalizing those effects simply place more confidence in their assess- (see Figure 40).

FIGURE 39 Investors assign substantial additional value to companies that achieve greater consistency of results than their peers

Market Value Added Market Value Added Market Value Added

2.0 1.86 2.0 2.0 1.67 1.52 1.5 1.5 1.5

1.04 1.0 1.0 1.0 .87 .69

0.5 0.5 0.5

0.0 0.0 0.0 Low High Low High High Low return return earnings earnings volatility volatility on capital on capital growth growth companies companies companies companies companies companies

Source: Tillinghast – Towers Perrin research into 1992-1999 performance of 111 publicly traded companies in the financial services industry, based on data from COMPUSTAT and Value Line. Details available on request. Page 70 Appendix C

FIGURE 40 The impact of consistency on value can be seen more clearly by first normalizing the effects of growth and return Market Value Added Market Value Added 8 8 7.38

6 6

High-Return 4 4 Companies

1.96 2 1.52 2 1.04

0 0 High Low High Low Earnings Volatility Earnings Volatility

Market Value Added Market Value Added 8 8

6 6

Low-Return 4 4 Companies

2 2 1.33 1.15 .49 .22 0 0 High Low High Low Earnings Volatility Earnings Volatility

Low Earnings Growth High Earnings Growth Companies Companies

Background Information on Tillinghast– process since (1) we find that more complicat- Towers Perrin Consistency Analysis ed methods introduce other sources of “noise” 1. Overview into the process and (2) consistency premiums Consistency analysis empirically estimates are fairly robust across many industry groups whether companies with more consistent earn- and emerge readily with relatively simple con- ings receive a premium market valuation rela- trol techniques. tive to peers. Since many other factors — in addition to earnings consistency — shape mar- A general description of the control process is ket valuations, we use a series of basic analytic provided below. For specific definitions and steps to control for the influence of other data sources used in the analysis, please see factors (e.g., earnings growth and return on the methodology section that follows. capital) and isolate a consistency premium or discount. We use a relatively simple control Appendix C Page 71

2. Basic methodology consistency (earnings predictability ≥ subset In performing consistency analysis, Tillinghast– median) and low-earnings consistency (earnings Towers Perrin’s first step is to identify a rele- predictability < subset median). A total of eight vant industry peer sample for a given company. subsets results from both steps. Using an industry peer group helps filter out the effect of common industry factors (e.g., Finally, an average market premium (standard- commodity price movements, regulatory risk) ized market value added) is calculated for each on market valuations. We typically use of the eight subsets, and the results are summa- published industry groupings provided by rized in bar chart form. ValueLine or Standard & Poor’s. Tillinghast –Towers Perrin Consistency Next, we create a data set including a market Analysis Methodology premium measure, earnings growth rate, return 1. Data sources on capital and earnings consistency for each peer. We employ historical growth rates and Ⅲ COMPUSTAT PC Plus database returns as surrogates for the future growth rates Ⅲ ValueLine Investment Survey (peer group and returns that drive valuations. We calculate companies and earnings consistency values). growth rates, using a least-squares (regression) approach to avoid biases caused by point-to- 2. Performance metric definitions point methodology, and average returns on capital over the measurement window. To A. “Return on capital” measure the market premium, we employ a Ⅲ Definition standardized market value-added metric since it — Eight-year (1992-1999) average properly distinguishes between the capital that Return on Capital Employed investors have placed in the business and the (ROCE). market value added to this capital. Ⅲ Formula Unlike market-to-book ratios, standardized — (Income before Extraordinary Items market value added also captures the dollar + Special items)/(Beginning growth in the value premium over time. Since Stockholders’ Equity + Beginning the measure is standardized (indexed), it can Total Debt) be meaningfully compared across companies. — Perform same calculation for eight Finally, ValueLine’s earnings predictability score years and take average. (0%-100%) is used as the measure of earnings Ⅲ Comment consistency. — Simplified return on invested capital definition (provides some adjust- We then calculate a median growth rate and ment for restructuring charges and return on capital for the peers and break the other one-offs but makes simplifying ≥ sample into “high growth” (growth median) assumption that special items receive and “low growth” (growth < median) and no tax deduction) ≥ high-return (return median) and low-return — Note: COMPUSTAT does not (return < median) subsets. report after-tax special items.

The process is repeated one more time by calculating the median earnings predictability score for each of the four subsets and then further breaking each subset into a high-earnings Page 72 Appendix C

B. “Earnings growth” D. “Market premium” Ⅲ Definition Ⅲ Definition — Eight-year (1992-1999) least-squares — 1999 Standardized Market Value EBIT growth rate. Added (MVA) based on 1992 ending invested capital base. Ⅲ Formula — Regress log-adjusted operating income Ⅲ Formula after depreciation against time to deter- — Std MVA = MVA % Capital x mine growth rate. Indexed Capital = (M/C – 1) x Indexed Ⅲ Comment Capital — Growth rate based on regression is — M/C = (Stock price x Common more accurate than CAGR (which shares outstanding + Preferred stock is biased by endpoints). + Total debt)/(Shareholders’ C. “Earnings consistency” equity + Total debt). ! All data reflect year-end 1999 Ⅲ Definition — Indexed Capital = (1999 — ValueLine Earnings Predictability Shareholders’ equity + 1999 Total score as reported in ValueLine debt)/(1992 Shareholders’ Investment Survey. equity + 1992 Total debt). Ⅲ Formula Ⅲ Comment — ValueLine earnings predictability scor- — MVA captures value of growth (unlike ing based on stability of year-to-year M/B ratio) since it is measured in comparisons, with recent years being dollars. Standardizing MVA (by index- weighted more heavily than earlier ing every company’s capital to same ones. The earnings stability is derived base year) corrects size bias of measure from the standard deviation of percent- (so big companies with lots of capital age changes in quarterly earnings over — but low M/C — don’t dominate an eight-year period. Special adjust- smaller companies with higher M/C). ments are made for comparisons around zero and from plus to minus. Appendix D Page 73

Appendix D what happens at the extreme adverse “tail” of the probability distribution of financial outcomes for the enterprise. That is, they are con- Risk Measurement — for Policyholders cerned with the “probability of ruin,” which, and for Enterprise Owners for banks, is often calibrated by Value at Risk One of the salient features of our measures. Conceptually, capital is added to the RiskValueInsightsTM approach is the explicit enterprise in sufficient amounts to reduce the recognition of the fact that risk has different probability of ruin to an acceptable level. A faces for policyholders and for enterprise own- more robust risk measure is one that captures ers. This difference manifests itself directly in not only the probability of ruin, but the degree the measures of risk we adopt in Steps 3 and of ruin should it occur, which is how many 4 of our Strategy Development process stage “cents on the dollar” can ultimately be paid (Chapters VII and VIII, respectively). to policyholders once the enterprise becomes technically insolvent. There is a direct analog Step 3 is concerned with determining capital in the case of bond ratings, where not only the requirements for the enterprise, which is driven probability of default but also the expected by the security needs of the policyholders, or salvage value is considered in rating the bond their proxies, the regulators and rating agen- offering. The ECOR measure put forth in cies. These stakeholders are concerned with Step 3 is such a robust measure.

FIGURE 41 Distinction between the concerns of customers and owners can be represented by the sections of the probability distribution of earnings. Customers are concerned with extreme outcomes that affect the ability of the insurer to pay their claims, whereas owners are concerned with volatility of earnings below their target or expected return

100%

Owners are Policyholders concerned with are concerned results below with insolvency target; not degree and resulting of nonperformance degree of non- once insolvency performance occurs Cumulative Probability

0% (-) 0 Target (+) Cumulative Earnings Page 74 Appendix D

Step 4, on the other hand, is concerned with ital requirements to be low so as to enhance evaluating the returns on capital generated by returns in relation to capital invested. While alternative risk management strategies. This is a policyholders are interested in the enterprise concern of the owners of the enterprise. These being run successfully enough to ensure their stakeholders are interested in a different seg- security, once at that level, they are indifferent ment of the probability distribution, namely the to how well owners do on their investment of “middle segment” surrounding the target capital. And, all else equal, they would prefer return level. When owners evaluate returns, capital requirements to be high. Clearly, risk they are concerned with the expected value of measures that fail to recognize these essentially the return in light of the riskiness of the return, different perspectives/needs and that try to force where the riskiness is represented by the range a single risk metric to measure both the risk of of outcomes in this middle segment. For these insolvency (for capital adequacy purposes) and purposes, the Below-Target-Risk measure the riskiness of returns (for strategy optimiza- described in Step 4 is best suited. tion purposes) are fundamentally flawed.

The concerns of these two groups of stakehold- A graphical representation of these concepts is ers are fundamentally different and distinct. contained in Figure 41. While owners are interested in seeing the enterprise remain solvent, once insolvency occurs, they are indifferent to how deep the insolvency runs. And, all else equal, they would prefer cap- Appendix E Page 75

Appendix E distributions. Typically, several years of high- frequency data are necessary. These methods are most often used to model risks that are Glossary of Risk Modeling Methods traded in the financial markets such as interest There is a continuum of methods for develop- rate, foreign exchange, asset risks, claims, etc. ing probability distributions (see Figure 42). The choice of method depends significantly on Empirical distributions the amount and type of historical data that is The simplest and the most direct approach is to available. The methods also require varying assume that the historical data fully defines the analytical skills and experience. Each method probability distribution. Then the data can be has advantages and disadvantages over the used directly to develop a discrete probability other methods, so it is important to match the distribution. Of course the danger is in assum- method to the facts and circumstances of the ing that the data is complete and the time peri- particular risk type. od over which the data is gathered is long enough to have “seen” or experienced the We have loosely organized the modeling meth- full range of outcomes. ods into three categories: Fit parameters of theoretical probability Ⅲ methods based primarily on analysis of histor- density functions ical data An alternative to empirical distributions is to Ⅲ methods based on a combination of historical assume that the risk can be described by a theo- data and expert input retical probability density function. Then the data is used to estimate the parameters of the Ⅲ methods based primarily on expert input. theoretical distribution. For example, for property/casualty claims, the frequency of claims Methods based primarily on analysis of is often assumed to follow either a Poisson historical data or negative binomial distribution, whereas the These methods are the most appropriate when severity of claims is often assumed to follow a there is enough historical data to apply standard lognormal or a Pareto (for conditional claim statistical approaches to develop probability or tail distribution).

FIGURE 42 There is a continuum of methods for modeling risks. Each method has advantages/ disadvantages over others, so it’s important to select the best method based on facts and circumstances

DATA ANALYSIS MODELING EXPERT INPUT

Empirically System Direct assessment from historical Stochastic Influence dynamics diagrams of relative likelihood data differential simulation or fractiles equations (SDEs)

Fit parameters for theoretical Neural Bayesian Preference among distribution networks belief bets or lotteries networks

Extreme Regression over Delphi method value variables that Fuzzy logic theory affect risk Page 76 Appendix E

Stochastic differential equations (SDE) EVT models the limiting distribution of the A stochastic differential equation (SDE) extreme values of a random variable, which cor- expresses the difference (or change) in the responds to the happening of rare events. A value of a variable (e.g., interest rate) at time t description of the method is beyond the scope and the value one time period later, t +1. It’s a of this monograph; however, several useful ref- stochastic differential equation because the dif- erences are cited. ference is expressed as a combination of a pre- dictable change and an uncertain or random Regression change during the time period. The random Often it’s necessary and useful to develop a change is represented as a random variable with model of a variable by examining its drivers or a specified probability distribution (typically causal variables. A regression equation expresses normal distribution). Starting with an initial a dependent variable as a function of one or value, the SDE is used to iteratively determine more predictor variables. Regression equations a scenario of how the value changes over a provide managers more information on the forecast period (e.g., 10 years). Hundreds or dynamics underlying a specific risk to help possibly thousands of scenarios are generated in manage, insure or hedge the risk. this way. The scenarios can then be summarized as probability distributions for each point in Methods based on a combination of time over the forecast period. See “Scenario historical data and expert input Generation” in the References for helpful pub- Often there is not enough data to reliably lications that provide more detail on use of quantify risks directly through data analysis. In SDEs to model risk. these cases it’s necessary to develop a model of the underlying dynamics that give rise to the Extreme Value Theory data. This requires drawing on the experience In risk management, often the most important and knowledge of domain experts to fill in the part of a probability distribution is the tail rep- data gaps. The following methods attempt to resenting the downside risk. The tail distribu- model the dynamics of a system by using a tion is used to determine capital and shortfall combination of both historical data and risk constraints for optimizing strategies. expert input. However, most risk modeling methods focus on accurately representing the main body of System Dynamics simulation the distribution. Extreme Value Theory (EVT) System Dynamics is a robust modeling method is a technique for increasing the accuracy with that explicitly simulates the cause-effect rela- which to model the probability of large values tionships underlying the dynamics of a system. in the tail distribution. EVT is devoted to the The approach leverages both existing historical modeling and estimating the behavior of rare data and the knowledge and experience of events. Different EVT models and techniques senior managers to develop a stochastic simula- have been developed and applied to deal with tion model. The model is used to run Monte some environmental issues like sea levels, wind Carlo simulations and develop probability speeds, pollution concentrations, etc., where distributions for the variable of interest. there is a potential for catastrophic results, but it happens rarely. Recently, EVT has been used The System Dynamics approach has several increasingly in finance and insurance. advantages over parametric approaches described above, particularly for modeling The main difficulty of estimating rare events is operational risks: that in most cases there is a small amount of, Ⅲ or even no, data available. The EVT approach It provides a systematic way to fill any gaps in develops models based on asymptotic theory. historical data with input from experts, relying Appendix E Page 77

on their knowledge and experience. This is it’s clear that there is no precise cutoff for applicable particularly for modeling opera- determining whether someone has a fever, and tional risks, where it’s often the case that the boundary between “normal” and “fever” is there isn’t enough representative data to fuzzy. Fuzzy set theory was developed to rec- apply the statistical methods described above. ognize these gray areas. According to fuzzy set theory, a person with a temperature of 101.5O F Ⅲ It provides a way to determine how opera- would be classified as having some membership tional risks change as a function of changes in in both categories “normal” and “fever.” Fuzzy operations. Since the approach explicitly cap- logic is the reasoning based on fuzzy set theory. tures the cause-effect linkages, it is easier to develop effective ways to mitigate risks, and Fuzzy logic has advantages in modeling com- measure their impact than with noncausal plex business problems where linguistic vari- methods. ables are used to express the logic rules, the Ⅲ As businesses become more complex, knowl- information is subjective, incomplete or unreli- edge of their underlying dynamics becomes able, and the problem spaces are often nonlin- more fragmented and localized. Although ear. A fuzzy system is closer to the way people many managers have a good understanding reason and is therefore often used to build of their own functional areas, few have a solid expert systems. The fuzzy nature of the rule grasp of the dynamics of the entire organiza- spaces makes it easy to model multiple, often tion. Obtaining a complete picture, for different or conflicting expert views toward the example, of the sources of operational risks same model variables. In terms of risk modeling and how they affect financial performance and assessment, fuzzy logic shows potential to requires the combined knowledge of man- be a good approach in dealing with operational agers across functional areas. The System risk, where the probability assessment is often Dynamics approach facilitates this interaction based on expert opinion and the risk space is through a structured, participative modeling multidimensional and highly nonlinear. and decision-making process. Estimating probabilities through expert Fuzzy logic testimony In spite of its name, fuzzy logic is a well-established engineering science used successfully In extreme cases, there aren’t any data at all. In in control systems and expert reasoning. It is these cases, one must rely on the knowledge an approach to modeling complex systems, and experience of domain experts. Probability where much of the complexity comes from the distributions for events for which there is sparse ambiguous, uncertain or undecided representa- data can be estimated through expert testimo- tion of the variables of the system. Traditional ny. A naive method for assessing probabilities is quantitative models tend to interpret reality in to ask the expert, e.g., “What is the probability binary terms. For example, imagine a device that a new competitor will enter the market?” that identifies whether a person has a fever. However, the expert may have difficulty Given the temperature of an individual, a quan- answering direct questions and the answers titative model programmed in the device will may not be reliable. Behavioral scientists have use a discrete, binary rule, such as: “If the tem- learned from extensive research that the naive perature is at or over 103O F then the person has method can produce unreliable results due a fever, else normal.” Even if it has other cate- to heuristics and biases. For example, individu- gories in between, such as “light fever,” it will als tend to estimate higher probabilities for still use a discrete binary rule to determine events that can be easily recalled or imagined. whether a person falls in the “light fever” cate- Individuals also tend to anchor their assess- gory or “fever” category. However, in reality ments on some obvious or convenient num- Page 78 Appendix E

ber resulting in distributions that are too relative to a reference lottery. The expert is narrow. (See Clemen, 1996 and von Winterfeldt asked to indicate whether the probability of & Edwards, 1986 in the list of references for the event occurring is more likely, less likely or further examples.) Decision and risk analysts equally likely compared to a lottery with known have developed several methods for accounting probabilities. Typically, a spinning wheel (a for these biases. Several of these methods are software implementation of the betting wheels described below. in casinos) is used on which a portion of the wheel is colored to represent the event occur- Preference among bets ring. The relative size of the colored portion Probabilities are determined by asking the is specified. The expert is asked to indicate expert to choose which side she prefers on a whether the event is more, less or equally likely bet on the underlying events. To avoid issues of to occur than the pointer landing on the col- risk aversion, the amounts wagered should not ored area if the wheel was spun fairly. The col- be too large. For example, a choice is offered ored area is reduced or increased as necessary between the following bet and its opposite: depending on the answers until the expert indicates that the two events are equally likely. This Bet method is often used with subjects who are naive about probability assessments. Win $x if a new competitor enters the market. Lose $y if no new competition. Decomposition to aid probability assessment Opposite Side of Bet Often, decomposing an event into conditional Lose $x if a new competitor enters the market. causal events helps experts assess risk of com- Win $y if no new competition. plex systems. The structure of the conditional causal events can be represented by an influence diagram. Influence diagrams illustrate The payoffs for the bet, amounts $x and $y, are the interdependencies between known events adjusted until the expert is indifferent to taking (inputs), scenarios and uncertainties (intermedi- a position on either side of the bet. At this ate variables) and an event of interest (output). point, the expected values for each side of the An influence diagram model comprises risk bet are equal in her mind. Therefore, nodes representing the uncertain conditions $x P(C) – $y [1-P(C)] = – $x P(C) + $y [(1-P(C)] surrounding an event or outcome. Relation- where P(C) is the probability of a new com- ships among nodes are indicated by connecting petitor entering the market. Solving this equali- arrows, referred to as arcs of influence. The ty for P(C): P(C) = $y / ($x + $y). graphical display of risks and their relationships to process components and outcomes facilitates For example, if the expert is indifferent to taking visualization of the impacts of external a position on either side of the following bet: uncertainties. Win $900 if a competitor enters the market Lose $100 if no new competition While this approach increases the number of then the estimated subjective probability of probability assessments, it also allows input a new competitor entering the market is from multiple experts or specialists, and helps $100/($100 + $900) = 0.10. combine empirical data with subjective data. For example, a new competitor entering the Judgments of relative likelihood market may be decomposed using an influence This method involves asking the expert to pro- diagram such as this one: vide information on the likelihood of an event Appendix E Page 79

be used to assess probabilities from a group of Adverse change in individuals. This process structures group com- regulation munication and usually involves anonymity of responses, feedback to the group as collective views, and the opportunity for any respondent New Product to modify an earlier judgment. The Delphi competitor process leader poses a series of questions to a group; the answers are tabulated, and the results are used to form the basis for the next Introduction round. Through several iterations, the process of new synthesizes the responses, resulting in a consen- technology sus that reflects the participants’ combined intuition, experience and expert knowledge. The probability of a new competitor, P(C) can be estimated, using a Bayesian approach. The The Delphi technique can be used to explore approach uses “Bayes’ Rule,” which is a formal, or expose underlying assumptions or informa- optimal equation for the revision of probabili- tion leading to differing judgments and to cor- ties in light of new evidence contained in con- relate informed judgments on a topic spanning ditional or causal probabilities. a wide range of disciplines. It is useful for problems that can benefit from subjective judg-

P(C) = i P(Ci | Ri, Ti) P(Ri, Ti) ments on a collective basis.

where i is a product index, P(Ri, Ti) is the joint Pitfalls and biases probability of an adverse change in regulation Estimating subjective probabilities is never as

and introduction of new technology, and P(Ci | straightforward as implied in the description of Ri, Ti) is the conditional probability of a new the methods above. There are several pitfalls competitor entering a market for product i. and biases to be aware of. This formula is useful when assessing the con-

ditional probabilities P(Ci | Ri, Ti) and is easier None of the methods works extremely well by than a direct calculation of P(C). itself. Typically, multiple techniques must be used. To increase consistency, experts should be Several different experts may be asked to assess asked to assess both the probability of an event the conditional and joint probabilities. For and separately the probability of the comple- example, one expert (or group of experts) may ment of the event. The two should always add assess the probability of adverse regulation for up to 1.0; however, in practice they seldom do a specific product, another expert may assess without repeated application of the assessment probability of introduction of new technology, method. The events must be defined clearly to and yet a third may assess the probability of a eliminate ambiguity. “What is the probability of new competitor given the state of new regula- a new competitor entering the market?” is not tion and technology. unambiguous. “What is the probability that a new competitor will take more than 5% market The Delphi technique share of product A in the next two years?” more Scientists at the Rand Institute developed the clearly defines the event. When assessing proba- “Delphi process” in the 1950s for forecasting bilities for rare events, it is generally better to future military scenarios. Since then it has been assess odds. Odds of event E are [P(E) / used as a generic strategy for developing con- P(complement of E)]. sensus and making group decisions, and can Page 80 Appendix E

Appendix F performing workplace. Creating an environment where everyone has the right information to do the right things at the right times helps An Overview of Change Management to fully engage employees in their work. Regardless of the precise process undertaken, we have learned through client experience that Involvement. To change employees’ thinking, there are four elements that must be in place you must first show them the advantages of if change is to take root in an organization. changing (or the negative consequences of fail- These are the “change enablers” (see Figure ing to change). You must also give them the 43 below). power to act — by expressing their point of view, giving feedback on new systems, identify- Leadership. Because leadership credibility is ing obstacles to change, and brainstorming and essential to motivating people, the single most developing solutions. In other words, employ- important factor in building and sustaining ees need to be involved, to some degree, every change is the example set by the people who step of the way. The interactive, self-selective command respect and influence others. When nature of Internet technology can rapidly facili- leaders communicate well and engage directly tate this kind of employee involvement. in the process, they have an enormous impact. This means that leaders have to look at and Measurement. If you don’t have the right acknowledge their own behavior and, in many information, you can’t make appropriate deci- instances, be willing to change it. sions about the right course of action. Accurate measurement is fundamental to effective Communication. A communication-rich change. Organizations can customize an array culture is essential to creating lasting change. of proven research tools and establish a com- Communication is the glue that holds an prehensive “dashboard” of measures against organization and its people together, and it which to determine appropriate action. This creates real employee connection. In fact, effec- helps to gauge progress and make midcourse tive, multimedia, multidirectional communica- corrections, assess the effectiveness of various tion between an organization and its primary interventions and evaluate return on invest- stakeholders is critical to a fast-paced, high- ments in new processes or programs.

FIGURE 43 Implementing some strategies requires a change management process

Change Enablers

Leadership Communication Involvement Measurement

t I es m B p s St le p ie ra m o g te l e e e t g a i n v e r t e t s

D S

o n e it c a o n n r a d Perform E nt nvironme Appendix G Page 81

Appendix G This memorandum explains that: Ⅲ the probability of default is an incomplete Use of Appropriate Risk Measures in measure of the security offered to Determining Capital policyholders The following memorandum is based largely on a Ⅲ another measure of security, the “Economic presentation entitled “Security Measures and Cost of Ruin” (ECOR) provides superior Determination of Capital Requirements” by our information about the security offered by a colleague Jean-Pierre Berliet to the Forum on company Global Risk Management at Fox School of Ⅲ ECOR measures of security have important Business and Management, Temple University on advantages over probability of default measures April 20, 2001. While the example described is to help a company greatly simplified, it is illustrative of situations — determine its aggregate capital that have arisen in actual client assignments. requirements — attribute capital to individual business At the most intuitive level, policyholders, regu- segments correctly. lators and insurance executives believe that the level of security (or quality of guarantee) The example that follows demonstrates these offered by a company is directly related to the points. It also suggests that probability of probability of the company defaulting (i.e., hav- default measures can lead to erroneous conclu- ing insufficient financial assets) in relation to its sions about capital requirements and result obligations to policyholders. in inappropriate attribution of capital across business segments.

Minimum Policyholder Policyholder ECOR Company A Probability Claims Required Assets Payments Deficit Ratio Scenario 1 97% 8,784 10,000 8,784 0 Scenario 2 2% 10,000 10,000 10,000 0 Scenario 3 1% 28,000 10,000 10,000 18,000 Expected 100% 9,000 10,000 8,820 180 (=ECOR) 2.0%

Minimum Policyholder Policyholder ECOR Company B Probability Claims Required Assets Payments Deficit Ratio Scenario 1 97% 8,505 10,000 8,505 0 Scenario 2 2% 10,000 10,000 10,000 0 Scenario 3 1% 55,000 10,000 10,000 45,000 Expected 100% 9,000 10,000 8,550 450 (=ECOR) 5.0% Page 82 Appendix G

Measuring Policyholder Security is clearly higher than the quality of the guarantee The following tables compare the security of Company B, even though both companies offered by two insurance companies (A and B) have the same probability of default. that have the same basic financial resources, measured by total assets, expected losses and This observation leads us to the view that an probability of default — and yet offer a differ- insurance company needs to assess the security ent level of security to their policyholders. offered to policyholders in relation to the expectation of economic loss that can be suffered Company A and Company B have the same by policyholders, i.e., the expected cost of ruin probability of default of 1% (i.e., under Scenario (or, equivalently, the “Economic Cost of Ruin,” 3), but offer policyholders very different levels or ECOR). of security. Company A exposes its policyholders to maximum losses of 18,000 (the difference ECOR for Company A above is 180 (i.e., between their claims of 28,000 and the 10,000 18,000 cost of ruin with a 1% probability), of assets available to pay these claims), while while ECOR for Company B is 450. In relation Company B exposes its policyholders to losses to expected liabilities, Company A’s ECOR of 45,000. Under Scenario 3, policyholders of ratio is 2.0% (180/9,000) while that of compa- Company A will suffer an economic loss of ny B is 5.0%. Both absolute and relative ECOR 64.3% (18,000/28,000) of their claims, while measures correctly show that company B offers policyholders of Company B will suffer an less security to its policyholders than Company economic loss of 81.8% (45,000/55,000). The A at the level of assets needed to meet a 1% quality of the guarantee offered by Company A probability of default constraint.

Company C

Minimum Policyholder Policyholder ECOR Scenarios Probability Claims Required Assets Payments Deficit Ratio A1 x B1 94.09% 17,289 38,000 17,289 0 A2 x B1 1.94% 18,505 38,000 18,505 0 A1 x B2 1.94% 18,784 38,000 18,784 0 A2 x B2 0.04% 20,000 38,000 20,000 0 A3 x B1 0.97% 36,505 38,000 36,505 0 A3 x B2 0.02% 38,000 38,000 38,000 0 A1 x B3 0.97% 63,784 38,000 38,000 25,784 A2 x B3 0.02% 65,000 38,000 38,000 27,000 A3 x B3 0.01% 83,000 38,000 38,000 45,000 Expected 18,000 38,000 17,740 260 (=ECOR) 1.4% Appendix G Page 83

Assessing Capital Requirements and when Company A and Company B are com- Attributing Capital to Business Segments bined to form Company C. This result is The use of probability of default risk measures obtained because the loss distributions of and probability of default risk constraints also Company A and Company B are not correlated leads to erroneous determination of capital uniformly across the range of outcomes of their requirements and faulty attribution of capital activities. With regard to this characteristic of across segments. This can be seen from the fol- their business, the probability of default risk lowing example in which we look at the capital measure is “incoherent.” Expect this to be the requirement of Company C, which combines case across many insurance businesses, especially the businesses of Company A and Company B those whose volatility cannot be simply described discussed in the previous section. by their mean/variance characteristics or whose probability distributions involve heavy tails. The distribution of losses of Company C is obtained by convolution of the distributions of Using ECOR measures of risk as constraints for the results of Company A and Company B. the determination of capital requirements and The following table shows this distribution the attribution of capital across business seg- (with scenarios arranged in order of increasing ments produces results that are substantially claim), the related deficits for policyholders, different and consistent with conventional and the absolute and relative ECOR measure wisdom. They show that diversification reduces of security, under the assumption that capital requirements at a given security level. Company C has assets needed to meet the 1% probability of default constraints that were The following table compares the capital imposed on Company A and Company B. requirements of Companies A, B and C under:

Note that at the 1% probability of default con- — a 1% probability of default constraint, which straint, Company C needs assets of 38,000, yields a 1.4% expected ECOR ratio for that is 18,000 more assets than Company A Company C and Company B would need on a separate — 1.4% expected ECOR ratio constraint. basis! The 1% probability of default measure implies a counterintuitive diversification penalty

At 1% Probability of Ruin At 1.4% ECOR Ratio

Minimum Minimum Required ECOR Required Assets ECOR Ratio Assets ECOR Company A 10,000 180 2.0% 15,039 130 Company B 10,000 450 5.0% 42,039 130 Company C 38,000 260 1.4% 38,000 260 Sum of A and B 20,000 57,078 Diversification Benefit/(Penalty) (18,000) 19,078 Page 84 Appendix G

The 1.4% ECOR ratio is used to calculate the Conclusion minimum assets that Company A and The choice of the measure used to assess the Company B require to offer policyholders the security of an insurance company, determine its level of security implied by the 38,000 of assets aggregate capital requirement and drive attribu- needed by Company C to meet the 1% proba- tion of capital to business segments has a signif- bility of default constraint. With a 1.4% expect- icant impact on the outcome of the analyses ed ECOR ratio constraint, Company A needs performed. This memorandum suggests that the 15,039 of assets, while Company B, which has widely accepted probability of default measure been shown to be riskier, needs 42,039 of can produce seriously erroneous results. It also assets. The sum of the capital requirements of suggests that the serious difficulties created by Company A and Company B operating on a the use of the probability of ruin can be avoided stand-alone basis is 57,078, which is greater by the use of the ECOR ratio as a measure of than the 38,000 needed by the companies’ security and as a risk constraint for the determi- combined operations (Company C), revealing nation of capital requirements and for capital that the combination provides a diversification attribution across business segments. benefit of 19,078, a theoretically sound and intuitively pleasing result. See references: Artzner, Delbaen, Eber, Heath (1999) Embrechts, McNeil, Strauman (1999) Wirch, Hardy (2000) Index to Figures Page 85

Index to Figures

Part One, Chapter II: Figure 1. Will ERM help address the top 10 issues? ...... 6 Figure 2. What are the barriers to an industry-specific ERM?...... 7 Figure 3. How satisfied are you with your current tools to manage risk?...... 8

Part One, Chapter III: Figure 4. Internal and external environments create financial and operational risks ...... 10 Figure 5. The complete array of financial and operational strategies should be investigated...... 10 Figure 6. The objective is to increase enterprise value by establishing the proper foundation of capital, enhancing growth opportunities, increasing return on capital and improving the consistency of results...... 11 Figure 7. The RiskValueInsightsTM framework for insurance companies integrates financial and operational risk assessment in developing financial and operational strategies to increase value ...... 12 Figure 8. ERM integrates all risks and all strategies...... 12

Part One, Chapter IV:

Figure 9. The RiskValueInsightsTM framework is made a reality through strategy development, implementation and monitoring...... 14 Figure 10. The RiskValueInsightsTM strategy development stage has five steps...... 15 Figure 11. To implement certain strategies, a change management process should be followed...... 16 Figure 12. Operational and financial measures are used to monitor strategy performance...... 17 Figure 13. A “risk dashboard” provides a monitoring and early avoidance system for unacceptable deviations in financial and operational performance...... 18

Part Two, Chapter V: Figure 14. A risk map of cause-effect relationships can be used to document the output of the risk identification process ...... 21 Figure 15. A risk table can provide a relatively simple way to prioritize risks...... 22 Figure 16. Risks can also be prioritized using a two-dimensional grid...... 23 Figure 17. A “heat map” classification/prioritization scheme identifies areas in need of immediate senior management attention...... 24 Figure 18. There is a continuum of methods for modeling risks. Each method has advantages/disadvantages over others, so it’s important to select the best method based on facts and circumstances...... 25 Page 86 Index to Figures

Figure 19. Global CAP:Link employs a cascade structure for modeling macroeconomic risks...... 26 Figure 20. Price elasticity can be modeled stochastically...... 29 Figure 21. Flight simulators let managers evaluate alternative strategies...... 30

Part Two, Chapter VI: Figure 22. Risks and strategies are linked to key performance indicators through a stochastic pro forma financial model of the enterprise...... 34

Part Two, Chapter VII: Figure 23. The Probability of Ruin can be calculated from the probability density function by measuring the area under the curve corresponding to the section where liabilities exceed assets on a present value basis...... 38 Figure 24. The Economic Cost of Ruin (ECOR) can be calculated from the cumulative description function by measuring the area under the curve to the left of the capital cushion...... 39

Part Two, Chapter VIII: Figure 25. Plot of Alternative Strategies on Risk/Value Grid...... 45 Figure 26. Plot of Alternative Sets of Strategies on Risk/Value Grid ...... 46

Part Two, Chapter IX: Figure 27. This tornado graph illustrates the relative impact of each source of risk on the deviation of earnings from the expected value...... 49

Part Two, Chapter X: Figure 28. The five-step strategy development stage is recapped...... 50 Figure 29. A “flight simulator” allowed management to evaluate alternative distribution channel strategies ...... 51 Figure 30. The company’s overall economic capital requirement was attributed to each business segment ...... 52 Figure 31. By comparing the risk/return characteristics of different business segments against alternative investments of capital, underperformers were identified...... 53 Figure 32. Different business segments consume different amounts of capital, and some do not return more than the cost of their capital...... 53 Figure 33. Through redeployment and more efficient use of capital, returns — and value — were greatly enhanced ...... 53 Figure 34. Investment strategies reflecting asset and liability scenarios are more efficient than those reflecting assets alone ...... 54 Index to Figures Page 87

Figure 35. Each reinsurance program component was measured on its contribution to reducing insolvency risk; this was translated into reduction in required capital ...... 54 Figure 36. By comparing capital reduction to program cost, it was determined that some program components added significant value; others were inefficient...... 55 Figure 37. Reinsurance creates value when the cost of reinsurance is offset by a reduction in the required rate of return ...... 56 Figure 38. Integrating investment and reinsurance strategy evaluation produces considerable benefits ...... 56

Appendix C: Figure 39. Investors assign substantial additional value to companies that achieve greater consistency of results than their peers...... 69 Figure 40. The impact of consistency on value can be seen more clearly by first normalizing the effects of growth and return...... 70

Appendix D: Figure 41. Distinction between the concerns of customers and owners can be represented by the sections of the probability distribution of earnings...... 73

Appendix E: Figure 42. There is a continuum of methods for modeling risks...... 75

Appendix F: Figure 43. Implementing some strategies requires a change management process...... 80 Page 88 References and Recommended Reading

References and Recommended Reading Ⅲ Berliet, Jean-Pierre, “Security Measures and Determination of Capital Requirements,” There is a rapidly growing list of papers, articles Proceedings of Forum on Global Risk and books on Enterprise Risk Management. Management, Fox School of Business and The following list is by no means complete, Management, Temple University, April 20, and the references cited are not necessarily the 2001. definitive publications on the topics. However, Ⅲ Britt, Stephen, “Scenario Generation these publications provide more detail and for Financial Simulation — A Primer,” expand on the concepts introduced in this Tillinghast – Towers Perrin Technical monograph and should prove useful for the Reference, October 2000. reader who is interested in delving into these Ⅲ Clemen, Robert T. Making Hard Decisions, subjects more deeply. 2nd edition, Duxbury Press, 1996. Ⅲ A.M. Best Co., “A.M. Best’s Enterprise Risk Ⅲ Embrechts, P., A. McNeil, D. Strauman, Model: A Holistic Approach to Measuring “Correlations and Dependency in Risk Capital Adequacy” at www.ambest.com/ Management,” 30th ASTIN Colloquium, rp2001/specialreports.html Tokyo, Japan, 1999. Ⅲ Archer-Lock, P. R., A. J. Czernuszewicz, N. Ⅲ Embrechts, Paul, Sidney I. Resnick and R. Gillott, P. H. Hinton, D. Ibeson, S. A. Gennady Samorodnitsky, “Extreme Value Malde, D. Paul, J. P. Ryan and N. Shah, Theory as a Risk Management Tool,” “Financial Condition Assessment Paper,” North American Actuarial Journal, Vol. 3, Presented to the Institute of Actuaries, Number 2, April 1999. March 26, 2001. Ⅲ International Actuarial Association, Ⅲ Artzner, P., F. Delbaen, J. M. Eber, “Insurance Liabilities — Valuation and D. Heath, “Coherent Risk Measures,” Capital Requirements: General Overview of a Mathematical Finances, Vol. 9, Number 3, Possible Approach.” www.actuaries.org/ July 1999, (pages 203-228). Members/Documents/submissionse.cfm Ⅲ Artzner, Philippe, “Application of Coherent Ⅲ Jorion, Phillipe, Value at Risk, McGraw-Hill, Risk Measures to Capital Requirements in 1997. Insurance,” North American Actuarial Journal, Vol. 3, Number 2, April 1999. Ⅲ Linstone, H.A. and M. Turoff, The Delphi Method: Techniques and Applications, Ⅲ Berg, Theo and Herwig Kinzler, “ALM Addison-Wesley Publishing Company Inc., Invades Continental Europe,” Emphasis, 1975. 2000/4. References and Recommended Reading Page 89

Ⅲ Lowe, Stephen P. and James N. Stanard, “An Ⅲ Philbrick, Stephen W. and Robert A. Painter, Integrated Dynamic Financial Analysis and “DFA Insurance Company Case Study, Part Decision Support System for a Property II: Capital Adequacy and Capital Allocation,” Catastrophe Reinsurer,” ASTIN Bulletin 27:2 Casualty Actuarial Society Forum, Spring (1997), pages 339-371. 2001, pages 99-151. Ⅲ Miccolis, Jerry, “Enterprise Risk Ⅲ Ryan, John P., “Operational Risk in Financial Management in the Financial Services Institutions,” Risk Management Guide, Industry: From Concept to Management 2001, published by White Page in association Process,” International Risk Management with the London Stock Exchange. Institute webzine at www.irmi.com/expert/ Ⅲ Smith, R. L., “Extreme Value Theory,” articles/miccolis003.asp, November 2000. Handbook of Applicable Mathematics, Ⅲ Miccolis, Jerry, Kevin Hively and Brian Supplement, Wiley, 1990. Merkley, “Enterprise Risk Management: Ⅲ Superintendent of Financial Institutions, Trends and Emerging Practices,” Institute Canada, “Supervisory Framework: 1999 and of Internal Auditors Research Foundation, Beyond,” Office of the Superintendent of June 2001. Financial Institutions, Canada, 1999. Ⅲ Miccolis, Jerry and Samir Shah, Enterprise Ⅲ Standard & Poor’s, “Standard & Poor’s Risk Management: An Analytic Approach, Revises Its Risk-Based Capital Adequacy Tillinghast – Towers Perrin monograph, Model for Financial Products Companies,” January 2000. July 17, 2000. www.standardpoor.com/ Ⅲ Miccolis, Jerry and Samir Shah, “Causal ResourceCenter/RatingsCriteria/Insurance/ Modeling and Operational Risk,” index.html Operational Risk, published by Risk Ⅲ Tillinghast – Towers Perrin, Enterprise Risk Publications, April 2000. Management in the Insurance Industry: 2000 Ⅲ Miccolis, Jerry and Robert Schneier, Benchmarking Survey Report, January 2000. “Enterprise Risk Management,” Strategy Ⅲ von Winterfeldt, D. and W. Edwards, & Leadership, March/April 1998. Decision Analysis and Behavioral Research, Ⅲ Moody’s Investors Service, “One Step in the Cambridge University Press, 1986. Right Direction: The New C-3a Risk-Based Ⅲ Wirch, J., M. Hardy, “Ordering of Risk Capital Component,” Global Credit Research, Measures for Capital Adequacy,” Proceedings June 2000. of the AFIR Colloquium, Tromsö, Norway, Ⅲ Mulvey, John, Gordon Gould and Clive 2000. Morgan, “An Asset and Liability Management System for Towers Perrin– Tillinghast,” Interfaces, Vol. 30, Number 1, January– February 2000. Page 90 Acknowledgments

Acknowledgments Ⅲ Alastair Longley-Cook Ⅲ Stephen Lowe The principal authors wish to acknowledge the Ⅲ Kathleen McClave considerable assistance of their colleagues, past and present, from whom they received both Ⅲ Brian Merkley substantial intellectual capital and critical review Ⅲ Hubert Mueller of early drafts of this monograph: Ⅲ John Nigh Ⅲ Clive Aaron Ⅲ Randall O’Connor Ⅲ Thomas Akins Ⅲ John Ryan Ⅲ Manuel Almagro Ⅲ Kenneth Tannenbaum Ⅲ Jean-Pierre Berliet Ⅲ Stuart Thompson Ⅲ Rick Berry Ⅲ Emory Todd Ⅲ Anthony Bice Ⅲ John Yonkunas Ⅲ Amy Bouska Ⅲ Stephen Britt We are also indebted to Robert Cornet, who helped edit the text, and to Robyn Hennessy Ⅲ Tony Dardis and Mona Zisimopoulos, who guided the Ⅲ Mark Davis production. Ⅲ David Finnis This monograph was immeasurably improved Ⅲ Charles Gilbert by the generous contributions of these individuals. Any errors that remain are the sole Ⅲ Robert Gruhl responsibility of the principal authors. Ⅲ Heather Handler Ⅲ Tigran Kalberer Ⅲ Herwig Kinzler Principal Authors Page 91

The Principal Authors develop and provide enterprise risk management services, has authored several articles and is a Jerry Miccolis, a risk management consultant frequent speaker on the topic. He specializes in and consulting actuary with Tillinghast– the application of Operations Research meth- Towers Perrin, has over 20 years of consulting ods, such as computer simulation, optimization experience. He is a principal of Towers Perrin and decision and risk analysis to management and is architect of several of Towers Perrin’s decision-making. Mr. Shah is a Fellow of the multidisciplinary service offerings, including Society of Actuaries and holds an M.S. degree workers compensation cost management, in Industrial Engineering and Management strategic risk financing and enterprise risk man- Sciences from Northwestern University. He is agement. He has served in a number of practice a member of the International Association of leadership positions, including practice leader Financial Engineers and the Institute for for the worldwide risk management practice. Operations Research and Management Sciences. He is a widely quoted speaker and author on You may contact the authors as follows: risk management issues. A Fellow of the Casualty Actuarial Society and a Member of the Jerry Miccolis American Academy of Actuaries, Mr. Miccolis Principal has served both groups on a number of profes- Tillinghast–Towers Perrin sional committees, chairing several, and sitting Morris Corporate Center II, Building F on the Casualty Committee of the Actuarial One Upper Pond Road Standards Board. He currently chairs the CAS Parsippany, NJ 07054-1050 Advisory Committee on Enterprise Risk Direct Dial: 973-331-3524 Management. Mr. Miccolis also has authored Fax: 973-331-3576 and reviewed/refereed professional papers in E-mail: [email protected] the actuarial literature and has served as an editor of CAS and Towers Perrin publications. Samir Shah Managing Consultant He holds a B.S. in mathematics from Drexel University. Tillinghast–Towers Perrin 2107 Wilson Blvd., Suite 500 Samir Shah, a managing consultant with Arlington, VA 22201 Tillinghast– Towers Perrin’s Strategy Direct Dial: 703-351-4875 Economics practice, has over 17 years of con- Fax: 703-351-4848 sulting experience. He works across multiple E-mail: [email protected] practice areas in developing intellectual capital and working with clients to provide unique and customized applications of engineering sciences to management decision-making. Mr. Shah is a leading contributor to the firm’s efforts to Page 92

About Tillinghast–Towers Perrin and Towers Perrin Reinsurance:

Tillinghast–Towers Perrin and Towers Perrin Reinsurance help clients improve business performance through quantitative analysis, insight, execution and risk transfer solutions. Tillinghast–Towers Perrin provides management consulting to the financial services industry worldwide. In addition, our risk management practice consults to a wide range of companies beyond the financial services market and our health sector practice consults to organizations that finance and manage health care risks.

Towers Perrin Reinsurance provides reinsurance intermediary services and consulting expertise that focus on the creative blending of traditional and nontraditional risk transfer vehicles. We work with clients to develop strategies that are tailored to their needs.

Tillinghast–Towers Perrin and Towers Perrin Reinsurance are part of Towers Perrin, one of the world’s largest independent management and human resource consulting firms, with nearly 9,000 employees and 78 offices in 74 cities worldwide. Towers Perrin helps organizations improve business performance and manage their investment in people, advising them on human resource strategy and management, organizational effectiveness, compensation, benefits and communications.

Serving leading companies worldwide

Tillinghast–Towers Perrin serves:

38 of the Fortune 50 insurance companies

80 of the largest 100 life insurance companies worldwide

78 of the largest 100 property/casualty companies worldwide

18 of the 20 largest insurance groups in Europe.

Towers Perrin overall serves:

370 of the Fortune 500 companies

763 of the Fortune 1000 largest U.S. companies. Argentina Japan United Kingdom Buenos Aires Tokyo London

Australia Malaysia United States Melbourne Kuala Lumpur Atlanta Sydney Boston Mexico Chicago Bermuda Mexico City Dallas Denver Brazil The Netherlands Detroit Rio de Janeiro Amsterdam Hartford São Paulo Irvine, Calif. Singapore Jacksonville Canada Minneapolis Montreal South Africa Cape Town New York Toronto Parsippany, N.J. China South Korea Philadelphia St. Louis Hong Kong Seoul San Francisco France Spain Stamford Paris Madrid Washington, D.C.

Germany Sweden Cologne Stockholm Frankfurt Switzerland Italy Geneva Milan Zurich Rome