PWC's Risks in Review - White Paper, Black Sabbath...

A quick dive into the wider world of ERM, courtesy of one of our Big 4 friends, ambiguously titled Risks in Review.  PwC's document (short sign-up required) is US-centric and multi-industry, so for the Solvency II crowd you might need to sift for the goodies (a good illustration of which side of the Atlantic it leans towards is that CFO.com reported on its highlights), but for anyone in the ERM space, there should be something for you here.

A bizarre stat is laid out at the beginning in that 73% of the 1,200+ senior executive[s] and Board members respondents to the survey agreed that "risks to their companies are increasing". Whether this be in reference to the number of risks faced, increases in the likelihood/severity of one's existing risk universe, or their perceptions on emerging risks, it certainly suggests that exogenous and endogenous concerns have not abated in the minds of corporate leaders. However, given the risk immaturity within firms that the rest of the document serves to highlight, the lack of definition is rather unhelpful.

Appetite - For Risk or Bats?

As the survey covers multiple industries, it has the more generic risk classifications in mind (i.e all major quantitative risk balled up into "Financial Risk"), which will no doubt gnaw at anyone on the financial services side, but at the same time, it's not all about you!

The pat on the back for those surveyed is the sobriquet of "true risk management leaders", handed out to 12% of respondents. It frankly doesn't feel like a valid aspiration for an entity, more that being a "risk management leader" would be an implicit part of the make up of any firm which successfully delivers on its strategic objectives.

That aside, the Leaders (of which financial services companies "...represent a sizeable portion" of!) are congratulated for;

• Aligning RM Programs with their businesses.
• Communicating Risk Appetite and Risk Tolerance through the business - nothing on hard risk limits in the paper though
• Being "able to take greater business risks" - I don't necessarily make the link between being "good" at risk management equating to taking greater risks, unless that is part of the business strategy one has aligned the RM Program with.
• Take aggregated views of risk over multiple areas
• Using techniques such as emerging risk identification/forecasting, scenario planning and stress testing

Laggards on the other hand

• Have no formal Risk Appetite Framework (only 38% of respondents do)
• Don't integrate Risk Management Strategy with business strategy (only 31% do)

They also hook the leadership qualities of risk management to some quantitative "value of good risk management" work on p5 (a topic which Towers Watson recently tiptoed around due to a lack of quant), namely that their profit margins and margin growth will outstrip peers. The growth of profit margins might be a bum steer, as the macroeconomic environment is perhaps less kind to industries other than financial services, who of course would have seen margins peak comparably faster over recent years due to the size of the trough in 2006/08!

As ever, the lexicon used in papers such as this takes a dip in the lake of dubiosity, for example:

• That companies should "...treat risk management strategically" - as opposed to what, "operationally"? This kind of expression suggests that risk is not already considered in strategy, which feels unfair and unrealistic, even on the immature firms surveyed. That there isn't a functional ERM Framework to enhance that work does not mean it isn't done at all.
• Risk Appetite Framework should have "buy-in" from senior management and the Board. Why "buy-in"? They should be deeply involved in the construction of an RAF, and their successes or failures as management should be inextricably linked to operating in line with it, not asked to nod in approval at the next Board/EXCO
• "Having a clearly defined risk appetite framework allows companies to quickly assess strategic decisions in the context of risk" - that of course was not a given...
• They also follow the tactic used in the Towers Watson paper in referring to risk management "programs" as opposed to "systems" or "frameworks- again, I'm not trying to labour the sematics of it, but a Programme for me has an end, and the work of a risk management function simply does not. This is perhaps just a psychological angle being worked here to drill into prospective clients that Programs can be boosted with a burst of external advice, but I find it increasingly disagreeable, particularly given the risk management leadership traits highlighted in this document, which most certainly do not lend themselves to the workings of a transient Programme.

Other stand out points would include

• Alignment of RM Programmes against each business function (p9) - horrible result for Sales & Marketing, even for Leaders, and suggests it is an area for us all to redouble our efforts
• Similar to Towers, talk of firms "drowning in data" - cannot fathom this for the life of me, but perhaps that's because I can use pivot tables and SQL server!
• GE Capital's approach to administering Risk Appetite (p16) - very clean, and in a manner which the CRO Forum would appreciate.
• Finally, a really nice section on p19 which shows the discrepancies between executives and risk professionals regarding their own firms' prospects. The Fannie Mae CRO suggests that Risk Management staff are "paraniods by profession" which given his employer's recent history, doesn't mean people aren't out for you!

NAIC's ORSA Manual for US Insurers - a helping hand?

"Tired and Emotional" - European
Insurance industry in 2013 

After the self-inflicted Solvency II transformational pressures of 2011 and 2012 resulted in more wobbly legs than a teenage disco at midnight, the relative calm of 2013 (to date) will have come as a blessed relief for European regulators and industry alike. Not so over in the States though, as they crack on with their take on the Own Risk and Solvency Assessment, releasing their industry guidance manual a few weeks back, in preparation for a proper crack at implementation in 2015, the driver of course being IAIS ICP obeisance rather than Solvency II equivalence.

They have kindly summarised the changes made since their 2011 version of the same manual on p9, which focus on accounting basis, scope (for groups) and ensuring certain year-on-year changes are appropriately flagged. 

Generic ORSA content - what
regulators "really really want"?

Unlike in the UK where there has been a marked reluctance to offer anything in the way of meaningful assistance to smaller insurers, such as a report template or checklist of suitable content/processes, the NAIC, just like the Spice Girls before them, are happy to "tell ya what I want", regardless of the potential for genericism.

That said, a recent Towers Watson survey suggested that there is still plenty of work to be done and staff to be hired in order to get with their ORSA programme.

The NAIC clarify that the US ORSAs are expected to be conducted no less than annually, with insurers documenting the process and results. After that, a high level "ORSA Summary Report" is to be submitted to the lead/state regulator once a year, which "should contain";

1. Description of the Risk Management Framework
2. Assessment of Risk Exposure (we would read as "risk profile" from what I can see)
3. Assessment of Risk Capital and prospective solvency

The Manual states that "[it] is intended to provide guidance for completing each section of the ORSA Summary Report", which should therefore make the job a doodle!

Some interesting bits jump out, not necessarily in contrast to reported/observable differences from the EU approach, more the fact that they are specified in the manual rather than taken as given;

GENERAL

• Chief Risk Officer/executive head of ERM Framework must sign the ORSA Summary Report
• Timing of supervisory reporting may move to match up to strategic planning cycle of an insurer
• Internal documentation expectations seemingly not as exhaustive as EU "repeatable by independent knowledgeable third party", simply to allow a more in-depth look at a given are at supervisor's request

DESCRIPTION OF RISK MANAGEMENT FRAMEWORK

• Specifies in principle what an "effective ERM Framework" comprises of (p18) - includes our old friends 'risk appetite', 'risk tolerance' and 'risk limits' in this, though they are isolated and defined in a passable manner on p25!
• Asks for various descriptive texts around processes
• Specifies that weaknesses/omissions found in the report here may change the supervisor's approach to the insurer!

ASSESSMENT OF RISK EXPOSURE

• Quantitative and/or qualitative assessments of risk exposure, in normal and stressed environments, for each "material" risk. Noticeably don't list Strategic/Frictional risks in the examples of "material" risk, though do mention Reputational risk as one for which "quantitative methods may not be well established"
• "Simple stress tests or more complex stochastic analyses" may be used in assessing the stressed environment
• Potential for supervisory intervention in the levels of stress assessed (in deterministic scenarios) or  even parameters in the ESG (for firms with stochastic capability)
• On risk correlation, "History may provide some empirical evidence of relationships, but the future is not always best estimated by historical data" - not sure where that leaves everyone!

ASSESSMENT OF RISK CAPITAL AND PROSPECTIVE SOLVENCY

• Provide a non-exhaustive list of considerations that an insurer/group will need to cover when assessing the adequacy of capital over its business planning period, which touches on many of the areas prominent in the EU's work (time horizon of assessment, valuation basis, definitions of "Solvency")
• Defines that this part of the assessment should identify "...the capital needed within a holding company system to achieve its business objectives"

Is this the type of demi-prescription that the smaller EU insurers are looking for? Is it too much to ask for national regulators (Ireland a notable exception) to take a similar stab at communicating what they want to see?

Internal Model Validation - the "desire for certainty"

Some useful snippets on the links here for anyone in the model validation space, whether if be the practical applications of Monte-Carlo simulation outside of the insurance industry, actuarial perspectives on model risks themselves such as parameter uncertainty and goodness of fit testing where "the problem is more often too many candidate distributions" as opposed to restrictions in choice.

This fantastic blog post from one of Willis's finest is about as blunt a critique of actuarial modelling activity and its potential for subsequent misuse as I have read, and I would strongly recommend it on to non-expert risk practitioners who may one day find themselves in the model validation/use test firing line. A few of the pearls of wisdom offered (focused on reinsurance industry, but relevant to all) include;

• How the human "want to believe" and "desire for certainty" can lead to models making rather than guiding decisions
• Reliance of models on "large numbers of heroic assumptions"
• "Data is always limited and flawed"
• That "models take combinations of assumptions and torture them to come to conclusions"
• The revisiting of assumptions only when the answers don't fit expectations ("euphemistically called 'calibration'", hilarious!)
• That using models for setting regulatory capital, rather than just informing decision making, has led to "extremely onerous" IMAP activity i.e. the limitations noted above are so well established that the regulators cannot ignore them at a granular level.

Then there this piece from Deloitte US on model validation, or more specifically, research into the quality of existing actuarial modelling controls, is an eye-opener for anyone working in the validation space. With RMORSA and associated capital modelling firmly on the agenda Stateside, it is interesting to watch how aggressively they approach validation, bearing in mind this work was commissioned by the Society of Actuaries, whose members may ultimately be charged with applying some of these recommendations!

This research in particular assesses current state versus best practice controls over the assumptions, inputs and outputs of actuarial models, and though the sample of respondents to the survey is relatively small (representing "30 unique companies"), the absence of suitable supporting documentation around model governance so evident in the UK's IMAP process appears to be a depressingly constant theme. This report at least includes recommendations as to how the US actuarial profession may bridge some of the gaps Deloitte identify.

In the NAIC's ORSA Manual, they ask that "ORSA Summary Report should provide a general description of the insurer’s process for model validation, including factors considered and model calibration" (p7), which I guess is what one expects to see in the EU (i.e. validation being a sub-process of the ORSA, which can be summarised in the ORSA reports). That said, the breadth of validation work performed over there will surely be driven by S&P expectations communicated in ERM Level III reviews, rather than profession-sponsored consultancy recommendations!


Finally (and slightly off track), an odd piece from Towers Watson on validating ORSAs, pitched to a room full of Internal Auditors. Would be unfair to say there aren't some salient points throughout, but given that there is "no clear requirement" to validate ORSAs (there was something on the matter in the original CEIOPS ORSA pre-consultation, but it was dropped in the public consultation and the final advice), then you would think it could be covered in less than 30+ slides!

As it happens, the TW slide pack for internal model validation appears to have been raided and had the acronym 'ORSA' jemmied into the text for much of the second half of it.

USA and ORSA - Let's do it baby!

Promising sounds from across the pond, as the NAIC make some definitive movements (detail here and here) towards the inclusion of Own Risk and Solvency Assessments as part of their regulatory reporting package - difficult to find the exact paperwork, but the summary of what was tabled by the ORSA subgroup at their August jamboree is here, while a statement to cover their adoption of the Risk Management and Own Risk and Solvency Assessment model act is available here.

I have touched on the movement of the US towards production of ORSAs in earlier blog posts, including recently on the preparedness of firms to meet ORSA reporting requirements,

From another earlier post, I can see the 15 volunteer company pilot which was mooted at the start of the year ultimately became 13 companies by the conclusion of the pilot (no word on who started, but couldn't be bothered finishing!). According to the Clearwater information, only 8 participants ORSA Reports were considered "complete", this despite the NAIC providing an ORSA Manual from which to work from.

Is this ratio of incompleteness indicative of what the 27 EU national regulators are likely to encounter in 2014, or is the lack of prescriptive guidance at Level 1 and Level 2 handy in this regard (i.e. ORSA Supervisory Reports will be "passed" regardless of quality, and regulatory arbitrage is back on the agenda).

Either way, Clearwater also note that 2015 is looking like the most likely time for imposition of ORSA reporting, so the guys will still have time to borrow from our experiences, as we can from theirs - suggested improvements  from the NAIC's sub-group to the participants (none of which would hurt anyone in the ORSA space over here!) include;

• Include a summary of “significant changes” from prior year
• Provide additional detail regarding risk managers and compensation
• Include additional stress testing, specifically for liquidity

 Looking forward to the sub-group's next report, the approach over there appears to be relatively easy to follow and well led, which I guess it can afford to be if it isn't masquerading as something other than a filing requirement... 

StoneRiver Financial Regulatory Survey - ERM and ORSA in the US

An interesting US perspective published today touching on the near term future of ERM and ORSA reporting in the States from the guys at StoneRiver (need to fill out a little form for the download).

They are of course attacking it from a "buy some reporting software" perspective so the questions are a touch loaded, but the findings from the survey (68 in the sample, majority of P&C insurers) are certainly sobering for the NAIC, namely;

• Only a quarter were confident enough to state that they had a formal process for ERM, including reporting
• 44% claim to have "in-house expertise" on ORSA, despite the requirements being in a state of flux (guess I'm not getting a green card anytime soon!)
• Only 40% were confident that their existing software will efficiently handle ORSA reporting requirements

Bearing in mind when I blogged on the draft NAIC ORSA manual in November the regulatory filing aspect was heavily emphasised, the combination of undocumented ERM processes and software fallability may be cooking up an administrative nightmare for the insurance industry over there - welcome to our world!

NAIC's Spring National Meeting - "Go ORSA, it's your birthday"

Kindly summarised by these lads, the NAIC's Spring National Meeting seems to have breathed life into the Stateside ORSA project, with the ORSA Manual (from p12) tabled in November now approved by the plenary, and a 15 company ORSA pilot group due to report at end of June. Feel free to drop me a line if you want any ideas! The legislative side of it (through an ORSA Model Act) is mooted to take a year, but from what point it is not clear - this article seems to have plenty of insight in this regard however.

Also relative was the NAIC's desire to set up an ERM training program for staff - sounds like a smart idea if ORSAs are in the offing, so should be interesting to see what they come up with

ORSA - Stateside view from NAIC's "ORSA manual"

Having already dropped a few words down on EIOPA's new ORSA consultation for us Solvency II folk, I also spotted that the guys in the States have also made a few moves with regards to their ORSA Manual (from p12 of this NAIC bundle from their meet up the other day).

What had jumped out at me earlier last week was this article quoting AIA's assistant general counsel which very much framed the US ORSA as a periodic filing requirement with which he had "privacy concerns", voiced that it “should not be compulsively adopted”, and was very much a poor cousin to the existing framework.

This of course flies in the face of the ambitions of the Solvency II ORSA which, while clearly creates a regulatory filing requirement, is intended to demonstrably drive the decision making of the undertaking.

Having had a leaf through the ORSA Manual, a few things jumped out;

• Primary goals are different to the Solvency II version (though both drink from the IAIS ERM ICP cup, the US ORSA stays on message with ERM effectiveness).
• Not compulsory, rather a requirement to be subjected to (subject to minimum premium income limit of $0.5bn as entity, or $1bn as a group)
• Can also be imposed on entities who would be considered on the "ladder of intervention" in Solvency II-speak
• Allows for cross-referencing documents, rather than summarising within an ORSA report (which gives it the look of a Pillar 3 document on Solvency II side)
• Potential option to satisfy US regulatory demands for ORSA by using any which are produced for "non-US jurisdictions" - see, Solvency II preparation is not a waste of energy for any groups with subsidiaries over there after all!
• Great comment that, wishing to use IAIS ICPs to assess the quality of non-US ORSAs, that "one of the NAIC's goals is to avoid creating duplicative regulatory requirements for internationally active insurers".
• Very concise prescriptive summaries of content - agin, they veer towards Pillar 3 requirements over here (SFCR in particular, though I haven't been through today's Pillar 3 consultations yet, so they may have changed!), but these are still very useful for people on both sides of the Atlantic.
• They go with Credit, Liquidity, Operational, Market and Underwriting risks as main "material risk categories". I'll come on to the fantastic paper on risk classification I recently attended the public rollout of later, but it has a lot of relevance to how one might approach this aspect of the proposed ORSA, including avoiding any double coverage.
• No prescribed suite of stresses, such as for the SCR standard formula - this seems to imply that "internal models" are either obligatory, or are considered to be whatever is in place currently (i.e don't need a phenomenal amount of resource to validate to the authorities). The regulators therefore are able to "provide input" into model component calibration if they don't like what is presented via ORSA.

Would love to hear from anyone over in the States to see how this is going down industry-wide, as I can't quite gauge how much of an additional imposition this is to business as usual!

PwC Annual Corporate Director survey 2011 - more time for Risk?

PwC kindly fired out the findings from their (US-centric) poll of corporate directors. Decent sample at 834 respondents, and two-thirds were sitting on boards with $1bn+ in revenue, so worth heeding. Both RM Professional and Norman Marks have taken it to task, so I won't dwell on the findings other than the following;

• 72% would reconsider pay awards in the face of "significant shareholder dissatisfaction" - just wondering what "significant" is.
• Relatively little planned change in reaction to clawback legislation embedded in Dodd-Frank
• Almost 60% of boards wanted to spend more time on Risk Management, putting it third behind Strategic and Succession planning
• Less than 10% plan further than 5 years ahead
• Almost half discuss strategy viability no more frequently than annually
• Amusingly, both racial and gender diversity is referred to as a "Skillset/Attribute" - 23% find it very difficult to obtain directors with the racial "attribute", while 15% struggle to get the "gender" one!

Handy in its own way for the Europeans amongst us as a proxy, a more pertinent document for the statesiders.

Solvency II Internal Model Validation slides - from the US!

Of use to anyone working on internal model validation, I clocked this presentation from one of Ernst and Young's finest across the pond. Some useful context within it, particularly showing where the E&Y guys have come across gaps in validation policies, methodologies, documentation.

This is all in the context of the States' own preparations for ORSA under the guise of the NAIC (indeed I touched on it the other day), but is of course very handy on our side of the Atlantic!

North American ERM/Solvency developments

The guys over the pond are having a busy week (actually two ponds for me, coming from the Isle of Man!), so worth summarising here.

RIMS Conference is underway over in Canada, and while I will need to wait before I go hoovering up material, the Risk Management Monitor dropped this curious piece out on top ERM mistakes - a little hard to substantiate some of the examples, but relevant nonetheless, in particular #5 on the difference between risk appetite and risk tolerance (lack of definition somewhat addressed in the IRM's release last week).

The Canadians, US and Bermudans got together for a group hug in the inaugural North American CRO Council. A very handy looking agenda to start with, particularly "industry leading" emerging risk research and 'harmonizing regulatory capital requirements across jurisdictions' - is this the promised "equivalence on a true outcomes-basis" as alluded to by Mr. Leonardi from the NAIC last month?

Last thing was the NACD Directorship roundtable on the new realities of risk management summarised here. Of particular interest was the attitudes noted, such as; which elements of risk oversight need to be addressed by the full board; need for specialist risk committees (not required outside of financial services); directors saying the are receiving more information on risk than ever before (quality a likely casualty I suspect); Risk managers said to be "less than optimally familiar" to the directors, and then some very generic comment on CRO's, risk and strategy alignment, risk appetite, material risk and risk culture.

My concern with this is that it sounds very much like the output from a lot of these round tables, where the 'risk rabbit' on good practices fills a gap where a more substantial discussion on defining terminology and responsibilities would be more useful.

Bermuda, Solvency II and equivalence (and some US comment)

No doubt you would have seen the release of EIOPA's equivalence work to date on Japan, Switzerland and Bermuda. Summary articles here and here if you haven't.

I will take a more substantial look at Bermuda's report shortly (in the context of Ireland's captive preparations, it could be a welcome fillip to the country if there is an exodus). They were certainly singled out as the least-well prepared, being criticised on a number of legal requirements as well as wholesale gaps in governance requirements and, more worryingly, capital requirements which, in EIOPA's words, "in practice can be very low for insurers with a high risk profile".

Interestingly one of the USA's finest insurance commissioners weighed in on equivalence this week. I suspect it was not intended as a sleight to refer to the prevailing European regime as "admittedly outmoded", though he appears to be to be staunchly conservative in his stance, commenting "...any equivalence process must respect the different legal and regulatory systems that exist around the globe".

A request perhaps to "respect his authoritaah" a la Mr Cartman? Certainly a view not shared by the queue of other countries wishing to attain equivalence, and a repetition of the IFRS/US GAAP protracted convergence the most likely result.

Insurance Day Summit 2011 - Bermuda shorts

Exceptional pun in the headline aside (?), there was a few tasty pieces from the Insurance Day summit in chilly Bermuda at the end of last week. Not sure if these are free or not, but I didn't struggle this morning;

Bermuda Monetary Authority
- their man Jeremy Cox spoke, emphasising how mutually beneficial the Bermuda/EU market is, and why it justifies increased headcount spend to ensure equivalence. He also spoke of their 3 year roadmap to equivalence, as well as 6 areas where they have expanded their output to achieve equivalence.

Mike McGavick speech
- CEO of XL Capital chipped in with a more industrial quality speech, albeit making the salient point that, should Solvency II inadvertently lead to mergers and larger insurers, it would not be a systematically great thing.

He comments (ironically, bearing in mind my last two posts about soft launching) that because the EU like their version of the rulebook, then "everyone else should follow suit".

He followed that with "...why is it that we just have to swallow your [the EU's] proposal" - again, this seems a little misguided, bearing in mind the IAIS have xeroxed most of the Solvency II text and obligations, so this is not far off being international best-in-class, as opposed to being EU-centric.

Certainly didn't stay on the fence, and should be applauded for that at least.

NAIC CEO speech

Pretty blunt speech from the head of the National Association of Insurance Commisioner in the US - that, while she likes soome parts of Solvency II ("ORSA and some of those Pillar II things"), the Pillar I stuff will not wash over there. In particular, quite scathing about regulatory capital being used to incentivise good risk management.

Value of Corporate Governance - US Research

With a book named "Corporate Governance Matters", I was immediately interested in this piece of research from a couple of Stanford University dons trying to pinpoint the value of "good" corporate governance.

I found the summary here very light (and some of the citings are incredibly old for such a hot topic), but they have probably kept the good stuff for the book! There are certainly some good alternative angles for supporting the value of Solvency II/Corporate Governance Code obligations etc in here (impact of majority "independent" boards on stock prices, board information gaps and merger & acquisition outcomes).

Solvency II and the USA - start de-risking or close the door!

Very cute article citing Moody's research on how Solvency II is already driving asset selection (and even product viability) in the United States, a jurisdiction that still hasn't made too many steps towards jumping through the "equivalence" hoops!

It is of course a given that products with embedded options and guarantees are going to be pricey under the new regime, but to hear that it is already driving capital allocation away from a country which will no doubt get equivalence (thus avoiding extra capital charges) is quite something.