Actuarial profession and the Risk Function - from 'land grab' to 'colonisation'?

Back in the early days of this Blog I used to post frequently on the Solvency II-sponsored creep towards Risk functions in insurers being 'Chiefed' by members of the actuarial profession as a matter of course rather than choice (here, here and here for a start). It was even a thread in a presentation I delivered to ILAG in late 2012 around areas of control function crossover, in particular that the actuarial profession was acknowledging that there were professional deficiencies in their ability to address the basics of an actuarial function under Solvency II, yet preferred the ambition of conquering a newer (less arduous?) space ahead of remedying them.

Whilst a quant is no doubt a decent fit for such a task, it was an evident snub to the nascent Risk Management 'profession', who took umbridge at the implication of such compulsion from the UK regulator in April 2011, though with seemingly little impact. However, limits to the amount of time and money bodies such as the IRM and FERMA can throw at developing a one-size-fits-all Risk Management qualification package that can appeal to quants and non-quants alike, plus some furious inter-squabbling in the ISO 31000 world, are certainly not lending any credence to "Risk Management" as a profession in its own right as we stand.

Risk and Actuarial professions - 'Poles' apart?

Over in Ireland, the opportunity for the Actuarial profession to secure an additional control function has been pursued so rabidly that the SAI incoming and outgoing presidents were recently able to congratulate themselves on having busted into "the new frontier" of Risk, and are now moving on into "colonisation mode" (p2)! In the UK, the Institute and Faculty of Actuaries already seem to consider that area of influence secured judging by the new president's remarks recently, indicating a desire to influence more mainstream debates than those around risk management systems and corporate governance.

The UK and Ireland don't appear to be the only ones afflicted by the perception of compulsory quants in Risk functions. Munich Re's excellent Knowledge Series delivers a Germanic take that there is "no doubt" that professional mathematicians will be needed for tomorrow's Risk functions.

When considering the history of the Actuarial profession (beautifully summarised here), there should be no reason why Risk Management cannot achieve a similar position given time, regardless of the disparity in existing approaches from representative bodies. A modular qualification which can prepare a 'risk professional' for their favoured activity (insurance buying/continuity management/financial risk/op risk/ERM) is surely an ambition which those bodies can harbour in concert? My concern would naturally be that I probably don't have another 50-100 years to wait for the that convergence to happen and enhance my own career prospects!

Or maybe I do - does anyone know an expert in longevity?

COSO - understanding and communicating Risk Appetite

Hot on the heels of materials pushed out on the Irish front from both the regulator and the consultancies, as well as the IRM's efforts in autumn of last year, COSO have stepped up to the plate with their take on understanding and communicating Risk Appetite, a topic which will be spectacularly relevant to insurers over 2012 for ORSA purposes, and indeed for anyone in and around the Irish Sea for corporate governance compliance reasons.

Having had a good sniff through, I struggled to find anything controversial in COSO's take on things, and, whether by accident or by design, it treads the same path as Richard Anderson's paper from the IRM.

The following quotes provide some of the more salient points made by the authors;

• "Risk appetite is the amount of risk, on a broad level, an organisation is willing to accept in pursuit of value" - not a bad way to think of it for an insurer (i.e. embedded value), though the 'broad level' add-on is unnecessarily and disconcertingly vague. This incidentally  runs against one of the IRM's key principles, namely that risk appetite must be measurable (p7).
• Authors believe that "...when properly communicated, risk appetite provides a boundary around the amount of risk an organisation might pursue" - without splitting hairs, the definition of risk appetite above isn't especially black and white!
• The three risk appetite steps of "Develop-Communicate-Monitor and update" are spot on, however, one might think that the "develop" piece is already done in most organisations (or why would the owners get up in the mornings?), and communicating it is the big issue.
• Should create a Risk Appetite Statement which is "broad enough yet descriptive enough for organisational units to manage risks consistently within it" - good point, as of course some departments of a business would struggle without such breadth in their appetite statement (business continuity and marketing spring to mind)
• Similarly, that statement should "balance brevity with the need for clarity"
• Confidently states that "we all know the costs of failing to manage risk", but dished out some pretty generic examples, bearing in mind the zingers which have pitched up over the last three years
• Exhibit 1 on considerations affecting risk appetite is a very smart schematic for provoking thought at executive level
• Box on p5 has a rather definitive statement around there being a lack of risk appetite articulation which contributed to the current financial crisis - certainly wasn't a problem at Lehman's, more that it was a moveable feast!
• Handy box on p7 which covers the tie-in between what rates as an "adequate" ERM Framework in the context of S&P's ratings methodology, and what management must be able to articulate on the Risk Appetite front.
• Some very nice examples (p8-10) of risk appetite statements from different industries, and of risk tolerance statements anchored to associated risk appetite statements (p13-14).
• The big one - differentiating Risk Appetite and Risk Tolerance - is on p11. Whether you agree with the COSO conclusion (i.e. that Risk Tolerances implement Risk Appetite within each operating unit's sphere of influence), it does at least try to square the circle, and the clarity should benefit practitioners. However, the statement "While Risk Appetite is broad, Risk Tolerance is tactical and operational" is poor - I'm guessing one could substitute "broad" for "strategic", or "tactical and operational" for "specific", and it makes sense.
•  Interesting list on p16 of questions to facilitate Board-level discussions on Risk Appetite which I suspect is probably too wordy for many Boards to throw themselves into wholeheartedly.
• Starts to peter out towards the end, which is normally the case with such guidance materials (once you start descending into 'performance models', communications strategies and risk culture, the ability to prescribe content and form to disparate organisations diminishes substantially).

Ultimately, while the document is of considerable use for anyone who needs a reputable crutch on the topic (and is perhaps outside of financial services), it is probably too generic to be of great use as an aide-memoire to any Solvency II-covered insurers, and I would stick with the IRM's take ("those risks that [an organisation] actively wants to engage with" when scripting a Risk Appetite Statement. 


Chapeau for the good parts nevertheless...