Aon Risk Maturity Index Report 2013

With the potential for early implementation of Pillar 2 on the horizon for Europe's insurers, Aon's release of their latest research on Risk Maturity Index is perhaps a timely one, particularly for anyone in the small-to-midsize bracket who wants to get a feel for the proportionality of their current approach (and for UK IMAP candidates, whether it might fold under ICA+ questioning in the next two years!)

Their claim that that the Risk Management Index fills the current "void" which prevents interested parties from benchmarking their risk management frameworks against those of their peers, and indeed reaching recommendations on how to further enhance them has a whiff of bolshiness about it, but nevertheless, the output is valid for practitioners in all industries.

Fundamentals behind the research, conducted in conjunction with Wharton Business School, are;

• Aon's "Risk Maturity Index" is an online self assessment of risk management practices.
• It asks 125 questions regarding 40 "key components" of risk management - all tied in to the following 10 characteristics of risk maturity:

 1. Board Understanding & Commitment to Risk Management

 2. Executive Level Risk Management Stewardship

 3. Risk Communication

 4. Risk Culture: Engagement & Accountability

 5. Risk Identification

 6. Stakeholder Participation in Risk Management

 7. Risk Information & Decision Making Processes

 8. Integrating Risk Management & Human Capital Processes

 9. Risk Analysis & Quantification to Understand Risk & Demonstrate Value

10.Risk Management Focus on Value Creation

• Allows for a ranking between 1-5 across various sub-cuts of the data collected, and an assessment in aggregate of each firms "risk maturity"
• Data was then analysed against over 100 listed companies from 20 industries, geographically spread, to see if "risk maturity", or a lack of it, translated into anything measurable
• Over 500 companies have responded to the survey since 2011, this being its second periodic summarisation (results from first one summarised here).

The headline news was that a correlation was identified between organisations with superior risk maturity and stock price volatility, with a reduction of up to 50% potentially up for grabs between the 'best' and the 'worst' - a particularly visceral way to "derive and demonstrate financial value from...risk management frameworks" which, let's face it, is a hard sell for the best of us!

I observed some more general points from the white paper, namely;

• The insurance industry was third only to Aviation and Consumer Goods in the assessment of risk maturity - something to be learnt from these industries (in particular around Op Risk maturity in Aviation)?
• Only 15% of respondents were rated at 4+ out of 5, or "operational/advanced" in Aon's terminology
• Lower revenues seem to translate into lower risk maturity on the whole
• Responses from CRO's resulted in the best aggregate maturity scores, while Internal Auditor/CFO responses resulted in the worst aggregates - expected biases nicely exhibited

Of particular note though were the three areas of common differentiation between higher and lower rated firms which are worthy of more attention than might otherwise come from reviewing average maturity scores. 

Awareness of the complexity of risk - more mature organisations are able to demonstrate:

• Risk adjusted return expectations by business unit/department
• Documented and applied assumptions in forecasts/projections
• Supporting forecasting ranges with applicable historical data

Agreement on [risk] strategy and action - more mature organisations stabilise their performance by:

• Re-evaluating risk management strategy based on experience
• Reviewing and validating risk tolerances based on external conditions
• Evaluating strategic decisions with reference to quantified risk tolerances

Alignment to execute [the risk strategy]

• Communicating negative results and predictions (nicely tied into Risk Culture by Aon)
• Developing cross-functional risk understanding, and how organisational activity relates to overall risk management strategy 
• Incorporating risk/return approaches into strategy, in particular recognising up-side potential in decision making, rather than loss minimisation

These are particularly interesting findings for the EU insurance industry, who will be waddling into Live ORSA territory in the coming weeks and months. Fair to say that Solvency II Pillar II accommodates much of what is covered here, so worth thinking about leveraging this benchmarking work in one's 2013 activities.

Aon Benfield's CRO guide to Solvency II - in case you're not ready yet...

For all those CROs who are about to get left holding the Solvency II baby three years early by their over-enthusiastic executive colleagues, Aon Benfield pulled together a CRO guide to Solvency II which aims to take the journey "from complexity to best practice". 10 out of 10 for ambition...

It leans heavily towards General Insurers/Reinsurers (indeed it reads like a reinsurance sales brochure in many parts!), but nevertheless contains a suite of very useful content for anyone in the Risk space, as well as attempting to shatter a few myths. I took the following from it;

• Steady early bits on capital planning and common questions a CRO should be posing in that space
• On page 5, an excellent table comparing standard formula against internal modelling by risk driver, in particular emphasising why internal modelling may be more appropriate, rather than how much capital it could shave off. Being able to explain to the national regulator why one has neglected to apply the enhancements that internal modelling introduces to the accuracy of one's quantitative risk profile would be a smart thing for CROs to practice!
• The undo some of that noble work by suggesting part of any IM feasibility study should include estimating the capital benefits!
• Nice examples at the top of p6 of what mixes of business lend themselves to benefitting from an IM approach
• Highlighting that domicile of firm continues to dictate feasibility of IMs for smaller firms (i.e some countries can't staff it!).
• Recommend reviewing SF SCR factoring in the draft L2 asap. As was clear from the E&Y research I covered yesterday, many firms across the EU consider themselves to be advanced in the Pillar 1 space while disregarding draft L2. They highlight the Swiss experience as one where they struggled to authorise models for "Day 1" approval, and the Aon crowd propose some meaningful contingencies on p8
• Useful analysis of capital drivers and optimisation strategies (p9-10)
• Section on expert judgement validation (p15), touching on the Level 3 expectations, and in particular how a (non-Actuarial) CRO may struggle to adequately challenge certain judgement calls, such as selected data series or correlation matrices, without specialist advice. Very hard for smaller firms to obtain that, as most of their actuarial function will have probably contributed to the judgement!
• Note that one of the key challenges for documenting the IM is getting the best-placed people (who are normally swimming in BAU) to pick up a pen and write!
• Neat section on ORSA (p27-29), emphasising that SF firms with complex risk profiles may find they struggle to justify that approach when concluding the assessment. They go on to suggest that early experiences of ORSA Report/process documentation submissions have left CROs feeling that the regulatory approach is (Level 3?) tickbox as to content expectations.
• Key challenges for CRO in briefing and educating senior colleagues for Solvency II-readiness are all fair, in particular the gap that could emerge if a CRO is not also an executive member.
• The section on Risk Appetite is particularly useful for smaller non-IMAP firms, who may struggle to quantify their target measures - whether using Standard Deviations/volatility measures as suggested is a touch too simple depends on the business I guess.
• The Pillar 3 section hits on the same issues I (and the FSA!)have picked up on earlier, such as end-user computing, inability to transition to BAU, data ownership issues etc.

I did take exception to a couple of bits in here, where the industry or indeed common sense appears to suggest otherwise;

• The "fallacy" outlined on p5 that an IM enables a firm to hold less capital than an SF equivalent. The research I pointed to yesterday (p20) suggests across the EU that modellers are already "making it rain" with their capital savings
• That the IM alternative for Op Risk is based on ORIC and individual loss event info. I'd certainly seen Milliman suggest that this approach is as flimsy as the SF approach, recommending options such as Bayesian networks to generate IM inputs.
• Concerns that evidencing senior management model "use" could create a "value-destroying documentation burden". Is that what we call "minutes" these days!
• Comments around the documentation delivery for the Internal Model Application Process becoming detached from the underlying processes referenced in those docs influencing BAU value-adding activity are perfectly valid, but no real solution is proposed.
• The operation of the Model Change Policy features heavily (p19-21), as anyone in that space would expect. Again. little offered in the way of solutions, but I certainly would have expected more discussion on the "scope" of the model, which in my experience is a solid, liquid or gas depending on which control function you speak to, and I'm sure the FSA would agree!

PS All the best to you guys on the US East Coast, let's hope the worst has passed...

AON research paper - Solvency II revealed

AON have fired out another worthy paper regarding the changing landscape for insurers during Solvency II implementation, as well as what an "optimal" insurer will look like post-Solvency II.

I enjoy reading anything that looks at post-Solvency II implementation, as well as anything which touches on the reinsurance potential on the capital requirements front, so this was right up my street. I particularly liked;

• Their process for optimising insurance risk and asset strategy in tandem (rather than the two, being the preserve of the actuarial and investment functions respectively, being operated in isolation)
• Articulation of "risk appetite" as a percentage of own funds surplus volatility above and beyond SCR (interesting way to communicate it)
• Table on capital changes for market risk and implications for insurers by sub-module - easy to digest
• Good sections on Catastrophe risk (if that is your cup of tea!)
• Ratings agency drivers, which stress the importance of transitional measures (for orderly transitions to preferred Tier 1 capital vehicles), the likelihood of ORSA-related criteria on future solvency sliding into their assessments.

Nice sales pitch for ReMetrica at the end as well - for all your ORSA needs...

AON Report on Regulatory, Accounting and Rating Agency critera changes

A decent piece from AON covering influences of Solvency II (amongst other similarly flavoured risk-based capital regulatory influences), IFRS, and ratings agency criteria for ERM on capital allocation strategies.

Some (surely sympathetically sampled) stats are included on how ratings strength will be more important than Solvency ratios - remains to be seen which measures are preferred for economic capital measurement for those who don't necessarily want or need to chase ratings agency favour.

Also includes country specific details on ORSA in the US, Risk based capital in Asia and Latin America, and references the AM Best supplemental rating questionnaire for ERM, which sounds like there might be some merits in reading