Knowing the amount of surplus an insurer needs to support risk is fundamental to enterprise risk management (ERM) and to the own risk and solvency assessment (ORSA).
With the increasing focus on ERM, regulators, rating agencies, and insurance and reinsurance executives are more focused on risk capital modeling than ever before.
Risk – and the economic capital associated with it – cannot actually be measured as you can measure your height. Risk is about the future.
To measure risk, you must measure it against an idea of the future. A risk model is the most common tool for comparing one idea of the future against others.
Types of Risk Models
There are many ways to create a model of risk to provide quantitative metrics and derive a figure for the economic capital requirement.
Each approach has inherent strengths and weaknesses; the trade-offs are between factors such as implementation cost, complexity, run time, ability to represent reality, and ease of explaining the findings. Different types of models suit different purposes.
Each of the approaches described below can be used for purposes such as determining economic capital need, capital allocation, and making decisions about risk mitigation strategies.
Some methods may fit a particular situation, company, or philosophy of risk better than others.
Factor-Based Models
Here the concept is to define a relatively small number of risk categories; for each category, we require an exposure metric and a measure of riskiness.
The overall risk can then be calculated by multiplying “exposure × riskiness” for each category, and adding up the category scores.
Because factor-based models are transparent and straightforward to apply, they are commonly used by regulators and rating agencies.
The NAIC Risk-Based Capital and the Solvency II Standard Formula are calculated in this way, as is A.M. Best’s BCAR score and S&P’s Insurance Capital Model.
Stress Test Models
Stress tests can provide valuable information about how a company might hold up under adversity. As a stand-alone measure or as an adjunct to factor-based methods, stress tests can provide concrete indications that reflect company-specific features without the need for complex modeling. A robust stress testing regime might reflect, for example:
Worst company results experienced in last 20 years Worst results observed across peer group in last 20 years Worst results across peer group in last 50 years (or, 20% worse than stage 2) Magnitude of stress-to-failure
Stress test models focus on the severity of possible adverse scenarios. While the framework used to create the stress scenario may allow rough estimates of likelihood, this is not the primary goal.
High-Level Stochastic Models
Stochastic models enable us to analyze both the severity and likelihood of possible future scenarios. Such models need not be excessively complex. Indeed, a high-level model can provide useful guidance.
Categories of risk used in a high-level stochastic model might reflect the main categories from a factor-based model already in use; for example, the model might reflect risk sources such as underwriting risk, reserve risk, asset risk, and credit risk.
A stochastic model requires a probability distribution for each of these risk sources. This might be constructed in a somewhat ad-hoc way by building on the results of a stress test model, or it might be developed using more complex actuarial analysis.
Ideally, the stochastic model should also reflect any interdependencies among the various sources of risk. Timing of cash flows and present value calculations may also be included.
Detailed Stochastic Models
Some companies prefer to construct a more detailed stochastic model. The level of detail may vary; in order to keep the model practical and facilitate quality control, it may be best to avoid making the model excessively complicated, but rather develop only the level of granularity required to answer key business questions.
Such a model may, for example, sub-divide underwriting risk into several lines of business and/or profit centers, and associate to each of these units a probability distribution for both the frequency and the severity of claims. Naturally, including more granular sources of risk makes the question of interdependency more complicated.
Multi-Year Strategic Models with Active Management
In the real world, business decisions are rarely made in a single-year context. It is possible to create models that simulate multiple, detailed risk distributions over a multi-year time frame.
And it is also possible to build in “management logic,” so that the model responds to evolving circumstances in a way that approximates what management might actually do.
For example, if a company sustained a major catastrophic loss, in the ensuing year management might buy more reinsurance to maintain an adequate A.M. Best rating, rebalance the investment mix, and reassess growth strategy.
Simulation models can approximate this type of decision making, though of course the complexity of the model increases rapidly.
Key Questions and Decisions
Once a type of risk model has been chosen, there are many different ways to use this model to quantify risk capital. To decide how best to proceed, insurer management should consider questions such as:
What are the issues to be aware of when creating or refining our model?
What software offers the most appropriate platform?
What data will we need to collect?
What design choices must we make, and which selections are most appropriate for us?
How best can we aggregate risk from different sources and deal with interdependency?
There are so many risk metrics that can be used to determine risk capital – Value at Risk, Tail Value at Risk, Probability of Ruin, etc. – what are their implications, and how can we choose among them?
How should this coordinate with catastrophe modeling?
Will our model actually help us to answer the questions most important to our firm?
What are best practices for validating our model?
How should we allocate risk capital to business units, lines of business, and/or insurance policies?
How should we think about the results produced by our model in the context of rating agency capital benchmarks?
Introducing a risk capital model may create management issues – how can we anticipate and deal with these?
In answering these questions, it is important to consider the intended applications. Will the model be used to establish or refine risk appetite and risk tolerance?
Will modeled results drive reinsurance decisions, or affect choices about growth and merger opportunities? Does the company intend to use risk capital for performance management, or ratemaking?
Will the model be used to complete the NAIC ORSA, or inform rating agency capital adequacy discussions?
The intended applications, along with the strengths and weaknesses of the various modeling approaches and range of risk metrics, should guide decisions throughout the economic capital model design process.
In 1952, Harry Markowitz wrote the article “Portfolio Selection” which became the seed for the theory called Modern Portfolio Theory. Modern Portfolio Theory (MPT) promises a path to follow to achieve the maximum return for a given level of risk for an investment portfolio.
It is not clear who first thought to apply the MPT ideas to a portfolio of risks in an insurer. In 1974, Gustav Hamilton of Sweden’s Statsforetag proposed the “risk management circle” to describe the interaction of all elements in the risk management process, including assessment, control, financing and communication. In 1979, Randell Brubaker wrote about “Profit Maximization for a multi line Property/Liability Company.” Since then, the idea of risk and reward optimization has become to many the actual definition of ERM.
In 2005, Standard & Poor’s called the process “Strategic Risk Management”.
“Strategic Risk Management is the Standard & Poor’s term for the part of ERM that focuses on both the risks and returns of the entire firm. Although other aspects of ERM mainly focus on limiting downside, SRM is the process that will produce the upside, which is where the real value added of ERM lies.“
The Risk Reward Management process is nothing more or less than looking at the expected reward and loss potential for each major profit-making activity of an insurer and applying the Modern Portfolio Management ideas of portfolio optimization to that risk and reward information.
At the strategic level, insurers will leverage the risk and reward knowledge that comes from their years of experience in the insurance markets as well as from their enterprise risk management (ERM) systems to find the risks where their company’s ability to execute can produce better average risk-adjusted returns. They then seek to optimize the risk/reward mix of the entire portfolio of insurance and investment risks that they hold. There are two aspects of this optimization process. First is the identification of the opportunities of the insurer in terms of expected return for the amount of risk. The second aspect is the interdependence of the risks. A risk with low interdependency with other risks may produce a better portfolio result than another risk with a higher stand alone return on risk but higher interdependence.
Proposals to grow or shrink parts of the business and choices to offset or transfer different major portions of the total risk positions can be viewed in terms of risk-adjusted return. This can be done as part of a capital budgeting/strategic resource allocation exercise and can be incorporated into regular decision-making. Some firms bring this approach into consideration only for major ad hoc decisions on acquisitions or divestitures and some use it all the time.
There are several common activities that may support the macro- level risk exploitation.
Economic Capital Economic capital (EC) is often calculated with a comprehensive risk model consistently for all of the actual risks of the company. Adjustments are made for the imperfect correlation of the risks. Identification of the highest-concentration risks as well as the risks with lower correlation to the highest-concentration risks is risk information that can be exploited. Insurers may find that they have an advantage when adding risks to those areas with lower correlation to their largest risks if they have the expertise to manage those risks as well as they manage their largest risks.
Risk-adjusted product pricing Another part of the process to manage risk reward involves the Consideration principle. Product pricing is “risk-adjusted” using one of several methods. One such method is to look at expected profits as a percentage of EC resulting in an expected return-to-risk capital ratio. Another method reflects the cost of capital associated with the economic capital of the product as well as volatility of expected income. The cost of capital is determined as the difference between the price to obtain capital and the rate of investment earnings on capital held by the insurer. Product profit projections then will show the pure profit as well as the return for risk of the product. Risk-adjusted value added is another way of approaching risk-adjusted pricing.
Capital budgeting The capital needed to fulfill proposed business plans is projected based on the economic capital associated with the plans. Acceptance of strategic plans includes consideration of these capital needs and the returns associated with the capital that will be used. Risk exploitation as described above is one of the ways to optimize the use of capital over the planning period. The allocation of risk capital is a key step in this process.
Risk-adjusted performance measurement (RAPM) Financial results of business plans are measured on a risk-adjusted basis. This includes recognition of the cost of holding the economic capital that is necessary to support each business as reflected in risk-adjusted pricing as well as the risk premiums and loss reserves for multi-period risks such as credit losses or casualty coverages. This should tie directly to the expectations of risk- adjusted profits that are used for product pricing and capital budgeting. Product pricing and capital budgeting form the expectations of performance. Risk-adjusted performance measurement means actually creating a system that reports on the degree to which those expectations are or are not met.
For non-life insurers, Risk Reward Management involves making strategic trade-offs between insurance, credit (on reinsurance ceded) and all aspects of investment risk based on a long-term view of risk-adjusted return for all of their choices.
Insurers that do not practice Risk Reward Management usually fail to do so because they do not have a common measurement basis across all of their risks. The decision of many insurers to develop economic capital models provides a powerful tool that can be used as the common risk measure for this process. Economic capital is most often the metric used to define risk in the risk/reward equation of insurers.
Some insurers choose not to develop an EC model and instead rely upon rating agency or regulatory capital formulas. The regulatory and rating agency capital formulas are by their nature broad market estimates of the risk capital of the insurer. These formulae will over-state the capital needs for some of the insurer’s activity and understate the needs for others. The insurer has the specific data about their own risks and can do a better job of assessing their risks than any outsider could ever do. In some cases, insurers took high amounts of catastrophe exposure or embedded guarantee and option risks, which were not penalized in the generic capital formulas. In the end, some insurers found that they had taken much more risk than their actual loss tolerance or capacity.
Risk Reward Management provides insurers with the framework to take full advantage of the power of diversification in their risk selection. They will look at their insurance and investment choices based on the impact, after diversification, on their total risk/reward profile. These insurers will also react to the cycles in risk premium that exist for all of their different insurance risks and for all of their investment risks in the context of their total portfolio.
Sales of most insurance company products result in an increase in the amount of capital needed by the business due to low or negative initial profits and the need to support the new business with Economic Capital. After the year of issue, most insurance company products will show annual releases of capital both due to the earnings of the product as well as the release of supporting capital that is no longer needed due to terminations of prior coverages. The net capital needs of a business arise when growth (new sales less terminations) is high and/or profits are low and capital is released when growth is low and/or profits are high.
The definition of the capital needs for a product is the same as the definition of distributable earnings for an entire business: projected earnings less the increase in Economic Capital. The capital budgeting process will then focus on obtaining the right mix of short and long term returns for the capital that is needed for each set of business plans.
Both new and existing products can be subjected to this capital budgeting discipline. A forecast of capital usage by a new product can be developed and used as a factor in deciding which of several new products to develop. In considering new and existing products, capital budgeting may involve examining historic and projected financial returns.
This multi year view of capital usage does in fact apply to non-life products where the claims are not fully settled in the calendar year of issue.
Pitfalls of Risk Reward Management
In theory, optimization processes can be shown to produce the best results for practitioners. And for periods of time when fluctuations of experience are moderate and fall comfortably within the model parameters, continual fine tuning and higher reliance on the modeled optimization recommendations produce ever growing rewards for the expert practitioner. However, model errors and uncertainties are magnified when management relies upon the risk model to lever up the business. And at some point, the user of complex risk models will see that levering up their business seems to be a safe and profitable way to operate. When volatility shifts into a less predictable and/or higher level, the highly levered company can find it self quickly in major trouble.
Even without major deviations of experience, the Risk Reward Management principles can lead to major business disruptions. When an insurer makes a major change in its risk profile through an acquisition or divestiture of a large part of their business, the capital allocation of all other activities may shift drastically. Strict adherence to theory can whipsaw businesses as the insurer makes large changes in business.
Insurers need to be careful to use the risk model information to inform strategic decisions without overreliance and abdication of management judgment. Management should also push usage of risk and reward thinking throughout the organization. The one assumption that seems to cause the most trouble is correlation. The saying goes that “in a crisis, all correlations go to one”. If the justification for a major strategic decision is that correlations are far from one, management should take note of the above saying and prepare accordingly. In addition, management should study the variability of correlations over time. They will find that correlations are often highly unreliable and this should have a major impact on the way that they are used in the Risk Reward Management process.
RISKVIEWS believes that this may be the best top 10 list of posts in the history of this blog. Thanks to our readers whose clicks resulted in their selection.
Instructions for a 17 Step ORSA Process– Own Risk and Solvency Assessment is here for Canadian insurers, coming in 2015 for US and required in Europe for 2016. At least 10 other countries have also adopted ORSA and are moving towards full implementation. This post leads you to 17 other posts that give a detailed view of the various parts to a full ORSA process and report.
What kind of Stress Test? – Risk managers need to do a better job communicating what they are doing. Much communications about risk models and stress tests is fairly mechanical and technical. This post suggests some plain English terminology to describe the stress tests to non-technical audiences such as boards and top management.
ORSA ==> AC – ST > RCS– You will notice a recurring theme in 2014 – ORSA. That topic has taken up much of RISKVIEWS time in 2014 and will likely take up even more in 2015 and after as more and more companies undertake their first ORSA process and report. This post is a simple explanation of the question that ORSA is trying to answer that RISKVIEWS has used when explaining ORSA to a board of directors.
The History of Risk Management – Someone asked RISKVIEWS to do a speech on the history of ERM. This post and the associated new permanent page are the notes from writing that speech. Much more here than could fit into a 15 minute talk.
Hierarchy Principle of Risk Management– There are thousands of risks faced by an insurer that do not belong in their ERM program. That is because of the Hierarchy Principle. Many insurers who have followed someone’s urging that ALL risk need to be included in ERM belatedly find out that no one in top management wants to hear from them or to let them talk to the board. A good dose of the Hierarchy Principle will fix that, though it will take time. Bad first impressions are difficult to fix.
Risk Culture, Neoclassical Economics, and Enterprise Risk Management– A discussion of the different beliefs about how business and risk work. A difference in the beliefs that are taught in MBA and Finance programs from the beliefs about risk that underpin ERM make it difficult to reconcile spending time and money on risk management.
What CEO’s Think about Risk– A discussion of three different aspects of decision-making as practiced by top management of companies and the decision making processes that are taught to quants can make quants less effective when trying to explain their work and conclusions.
Decision Making Under Deep Uncertainty– Explores the concepts of Deep Uncertainty and Wicked Problems. Of interest if you have any risks that you find yourself unable to clearly understand or if you have any problems where all of the apparent solutions are strongly opposed by one group of stakeholders or another.
The Own Risk and Solvency Assessment (or Forward Looking Assessment of Own Risks based on ORSA principles) initially seems daunting. But the simple formula in the title of this post provides a guide to what is really going on.
To preform an ORSA, an insurer must first decide upon its own Risk Capital Standard.
The insurer needs to develop the capacity to project the financial and risk exposure statistics forward for several years under a range of specified conditions.
Included in the projection capacity is the ability to determine (a) the amount of capital required under their own risk capital standard and (b) the projected amount of capital available.
The insurer needs to select a range of Stress Tests that will be used for the projections.
If, under a projection based upon a Stress Test, the available capital exceeds the Risk Capital Standard, then that Stress Test is a pass. AC – ST >RCS
If, under a projection based upon a Stress Test, the available capital is less than the Risk Capital Standard, then that Stress Test is a fail and requires an explanation of intended management actions. AC – ST < RCS ==> MA
RISKVIEWS suggests that Stress Tests should be chosen so that the company can demonstrate that they can pass (AC – ST >RCS) the tests under a wide range of scenarios AND in addition, that one or several of the Stress Tests are severe enough to produce a fail (AC – ST < RCS ==> MA) condition so that they can demonstrate that management has conceptualized the actions that would be needed in extreme loss situations.
RISKVIEWS also guesses that an insurer that picks a low Risk Capital Standard and Normal Volatility Stress Tests will get push back from the regulators reviewing the ORSA.
RISKVIEWS also guesses that an insurer that picks a high Risk Capital Standard will fail some or all of the more severe Stress Tests.
Furthermore, RISKVIEWS predicts that many insurers will fail the real Future Worst Case Stress Tests. Only firms that hold themselves to a Robust Risk Capital Standard are likely to have sufficient capital to potentially maintain solvency. In RISKVIEWS opinion, these Future Worst Case Stress Tests are useful mainly as the starting point for a Reverse Stress Test process. In financial markets, we have experienced a real life worst case stress with the 2008 Financial Crisis and the following events. Imaging insurance worst case scenarios that are as adverse as those events seems useful to promoting insurer survival. Imagining events that are much worse than those – which is what is meant by the Future Worst Case Scenario idea – seems to be overkill. But, in fact, the history of adverse events in the recent past seems to indicate that each new major loss is at least twice the previous record.
A Reverse Stress Test is a process under which an insurer would determine the adverse scenario that drives the insurer to insolvency. Under the NAIC ORSA, Reverse Stress Tests are required, but it is not specified whether those tests should be based upon a condition of failing to meet the insurer’s own Risk Capital Standard or the regulators solvency standard. RISKVIEWS would recommend both types of tests be performed.
This discussion is the heart of the ORSA. The full ORSA requires many other elements. See the recent post INSTRUCTIONS FOR A 17 STEP ORSA PROCESS for the full discussion.
Insurers in the US and Canada are required to state their own internal Risk Capital Standard in their ORSA Summary Report. From RISKVIEWS observations over the years of actual insurer actions, insurers have actually operated with four levels of Risk Capital Standards:
Solvency – enough capital to avoid take-over by regulators
Viable – enough capital to avoid reaching Solvency level with “normal” volatility
Secure – enough capital to satisfy sophisticated commercial buyers that you will pay claims in most situations
Robust – enough capital to maintain a Secure level of capital after a major loss
In many cases, this is not necessarily a clear conscious decision, but insurers do seem to pick one of those four levels and stick with it.
Insurers operating at the Solvency levels are usually in constant contact with their regulator. They are almost always very small insurers who are operating on the verge of regulatory takeover. They operate in markets where there is no concern on the part of their customers for the security of their insurer. Sometimes these insurers are government sponsored and are permitted to operate at this level for as long as they are able because the government is unwilling to provide enough capital and the company is not able to charge enough premiums to build up additional capital, possibly because of government restrictions to rates. This group of insurers is very small in most times. Any adverse experience will mean the end of the line for these companies.
Many insurers operate at the Viable level. These insurers are usually operating in one or several personal/individual insurance lines where their customers are not aware of or are not sensitive to security concerns. Most often these insurers write short term coverages such as health insurance, auto insurance or term insurance. These insurers can operate in this manner for decades or until they experience a major loss event. They do not have capital for such an event so their are three possible outcomes: insolvency and breakup of the company, continued operation at the Solvency level of capital with or without gradual recovery of capital to the Viable level.
The vast bulk of the insurance industry operates at the Secure level of capital. Companies with a Secure capital level are able to operate in commercial/group lines of business, reinsurance or the large amount individual products where there is a somewhat knowledgeable assessment of security as a part of the due diligence process of the insurance buyer. With capital generally at the level of a major loss plus the Viable capital level, these companies can usually withstand a major loss event on paper, but if their business model is dependent upon those products and niches where high security is required, a major loss will likely put them out of business because of a loss of confidence of their customer base. After a large loss, some insurers have been able to shift to operating with a Viable capital level and gradually rebuild their capital to regain the Secure position and re-engage with their original markets. But most commonly, a major loss causes these insurers to allow themselves to be acquired so that they can get value for the infrastructure that supports their high end business model.
A few insurers and reinsurers have the goal of retaining their ability to operate in their high end markets in the event of a major loss by targeting a Robust capital level. These insurers are holding capital that is at least as much as a major loss plus the Secure capital level. In some cases, these groups are the reinsurers who provide risk relief to other Robust insurers and to the more cautious insurers at the Secure level. Other firms in this groups include larger old mutual insurers who are under no market pressure to shed excess capital to improve Return on Capital. These firms are easily able to absorb moderate losses without significant damage to their level of security and can usually retain at least the Secure level of capital after a major loss event. If that major loss event is a systematic loss, they are able to retain their market leading position. However, if they sustain a major loss that is less broadly shared, they might end up losing their most security conscious customers. Risk management strategy for these firms should focus on avoiding such an idiosyncratic loss. However, higher profits are often hoped for from concentrated, unique (re)insurance deals which is usually the temptation that leads to these firms falling from grace.
One of the goals of Solvency II in Europe has been to outlaw operating an insurer at the Solvency or Viable levels of capital. This choice presents two problems:
It has led to the problem regarding the standard capital formula. As noted above, the Solvency level is where most insurers would choose to operate. Making this the regulatory minimum capital means that the standard formula must be near perfectly correct, a daunting task even without the political pressures on the project. Regulators tendency would be to make all approximations rounding up. That is likely to raise the cost of the lines of insurance that are most effected by the rounding.
It is likely to send many insurers into the arms of the regulators for resolution in the event of a significant systematic loss event. Since there is not ever going to be regulatory capacity to deal with resolution of a large fraction of the industry, nor is resolution likely to be needed (since many insurers have been operating in Europe just fine with a Viable level of capital for many years). It is therefore likely that the response to such an event will be to adjust the minimum capital requirement in one way or another, perhaps allowing several years for insurers to regain the “minimum” capital requirement. Such actions will undermine the degree to which insurers who operate in markets that have traditionally accepted a Viable capital level will take the capital requirement completely seriously.
It is RISKVIEWS impression that the Canadian regulatory minimum capital is closer to the Viable level. While the US RBC action level is at the Solvency level.
It is yet to be seen whether the US eventually raises the RBC requirement to the Viable level or if Canada raises its MCCSR to the Secure level because of pressure to comply with the European experiment.
If asked, RISKVIEWS would suggest that the US and Canada waits until (a) the Europeans actually implement Solvency II (which is not expected to be fully inforce for many years after initial implementation due to phase in rules) and (b) the European industry experiences a systematic loss event. RISKVIEWS is not likely to be asked, however.
It is RISKVIEWS prediction that the highly theoretical ideas that drive Solvency II will need major adjustment and that those adjustments will need to be made at that time when there is a major systematic loss event. So the ultimate nature of Solvency II will remain a complete mystery until then.
Insurers all hold capital as a cushion against losses. But how much capital is enough?
There are three criteria that management use to determine how much capital needs to be held:
Level of Risk
Regulatory Requirements
Market Expectations
In a perfect world, those three criteria would all be the same. But in this world, they are not. The answer to the “How Much Capital?” question gets a different answer from each of those criteria. And it varies for different risks, which is the most restrictive.
RISKVIEWS has always been of the opinion that management needs to juggle the three points of view so that the capital is adequate in total to meet all three, but they may well have an opinion about one or several risks that it has a much less lower level of risk and therefore lower need for capital than may be indicated by either the regulators or the market. That kind of view is a natural consequence of the fact that management has more expertise and insight into some of its risks than either outside view.
The WillisWire series on ERM practices continues with a discussion of Risk Capital.
Risk models can be used primarily to answer two very important questions for an enterprise whose primary activity is the risk business.
How did we do?
What should we do?
The “how did we do” question looks backwards on the past, usually for 90 days or a full year. For answering that question properly for a firm in the risk business it is absolutely necessary to have information about the amount of risk that the firm is exposed to during that period.
The “what should we do” question looks forward on the future. The proper time period for looking forward is the same as the length of the shadow into the future of the decision. Most decisions that are important enough to be brought to the attention of top management or the board of a company in the risk business have a shadow that extends past one year.
That means that the standard capital model with its one year time frame should NOT be the basis for making WHAT SHOULD WE DO? decisions. That is, unless you plan on selling the company at the end of the year.
Let’s think about it just a little bit.
Suppose the decision is to buy a laptop computer for the business use of one of the employees of an insurer. You can use two streams of analysis for that decision. You can assume that the only use of that computer is what utility that can be had from the computer during the calendar year of purchase and then you plan to sell the computer, along with the rest of the company, at the end of the calendar year. The computer is valued at the end of the year at a fair market value. Or you can project forward, the utility that you will get from that employee having a computer over its useful life, perhaps three years.
The first calculation is useful. It tells us “HOW DID WE DO?” at the end of the calendar year. But it not a sensible basis to make the decision about whether to buy the computer or not. The reason for that is not because there is anything wrong with the calendar year calculation. In theory, you could even run your company by deciding at the end of each calendar year, whether you wanted to continue running the company or not. And then if you decide to continue, you then must decide whether to sell every laptop or not, and similarly to sell every part of your business or not.
Most companies will automatically make the decision to continue, will not consider selling every part of their company, even if they have gone through the trouble of doing a “for sale” valuation of everything. That approach fits better with Herbert Simon’s “Satisficing” idea than with the theory of maximizing value of the enterprise.
But from a less theoretical point of view, putting absolutely everything on the table for a decision could be very time consuming. So what most companies is to imagine a set of conditions for the future when a decision is made and then as the future unfolds, it it does not deviate significantly from those assumptions, decisions are not reopened. But unfortunately, at many companies, this process is not an explicit conscious process. It is more vague and ad hoc.
Moving away from laptops to risk. For a risk decision, first notice that almost all risk decisions made by insurers will have an effect for multiple years. But decision makers will often look forward one year at financial statement impact. They look forward one year at a projection of the answer to the “How DID WE DO? question. This will only produce a full indication of the merit of a proposal if the forward looking parts of the statement are set to reflect the full future of the activity.
The idea of using fair value for liabilities is one attempt to put the liability values on a basis that can be used for both the “How did we do?” and the “What should we do?” decisions.
But it is unclear whether there is an equivalent adjustment that can be made to the risk capital. To answer “How did we do?” the risk capital needed has been defined to be the capital needed right now. But to determine “What should we do?”, the capital effect that is needed is the effect over the entire future. There is a current year cost of capital effect that is easily calculated.
But there is also the effect of the future capital that will be tied up because of the actions taken today.
The argument is made that by using the right current year values, the decisions can really be looked at as a series of one year decisions. But that fails to be accurate for at least two reasons:
Friction in selling or closing out of a long term position. The values posted, even though they are called fair value rarely reflect the true value less transaction costs that could be received or would need to be paid to close out of a position. It is another one of those theoretical fictions like a frictionless surface. Such values might be a good starting point for negotiating a sale, but anyone who has ever been involved in an actual transaction knows that the actual closing price is usually different. Even the values recorded for liquid assets like common equity are not really the amounts that can be achieved at sale tomorrow for anyone’s actual holdings. If the risk that you want to shed is traded like stocks AND your position is not material to the amounts normally traded, then you might get more or less than the recorded fair value. However, most risk positions that are of concern are not traded in a liquid market and in fact are usually totally one of a kind risks that are expensive to evaluate. A potential counterparty will seek through a hearty negotiation process to find your walk away price and try to get just a litle bit more than that.
Capital Availability – the series of one year decisions idea also depends on the assumption that capital will always be available in the future at the same cost as it is currently. That is not always the case. In late 2008 and 2009, capital was scarce or not available. Companies who made commitments that required future capital funding were really scrambling. Many ended up needing to change their commitments and others who could not had to enter into unfavorable deals to raise the capital that they needed, sometimes needing to take on new partners on terms that were tilted against their existing owners. In other time, cheap capital suddenly becomes dear. That happened when letters of credit that had been used to fulfill offshore reinsurer collateral requirements suddenly counted when determining bank capital which resulted in a 300% increase in cost.
RISKVIEWS says that the one year decision model is also just a bad idea because it makes no sense for a business that does only multi year transactions to pretend that they are in a one year business. It is a part of the general thrust in financial reporting and risk management to try to treat everything like a bank trading desk. And also part of a movement led by CFOs of the largest international insurers to seek to only have one set of numbers used for all financial decision-making. The trading desk approach gave a theoretical basis for a one set of numbers financial statement. However, like much of financial economics, the theory ignores a number of major practicalities. That is, it doesn’t work in the real world at all times.
So RISKVIEWS proposes that the solution is to acknowledge that the two decisions require different information.
In 1952, Harry Markowitz wrote the article “Portfolio Selection” which became the seed for the theory called Modern Portfolio Theory. Modern Portfolio Theory (MPT) promises a path to follow to achieve the maximum return for a given level of risk for an investment portfolio.
It is not clear who first thought to apply the MPT ideas to a portfolio of risks in an insurer. In 1974, Gustav Hamilton of Sweden’s Statsforetag proposed the “risk management circle” to describe the interaction of all elements in the risk management process, including assessment, control, financing and communication. In 1979, Randell Brubaker wrote about “Profit Maximization for a multi line Property/Liability Company.” Since then, the idea of risk and reward optimization has become to many the actual definition of ERM.
Standard & Poor’s calls the process “Strategic Risk Management”.
“Strategic Risk Management is the Standard & Poor’s term for the part of ERM that focuses on both the risks and returns of the entire firm. Although other aspects of ERM mainly focus on limiting downside, SRM is the process that will produce the upside, which is where the real value added of ERM lies.“
The Risk Portfolio Management process is nothing more or less than looking at the expected reward and loss potential for each major profit making activity of an insurer and applying the Modern Portfolio Management ideas of portfolio optimization to that risk and reward information.
At the strategic level, insurers will leverage the risk and reward knowledge that comes from their years of experience in the insurance markets as well as from their enterprise risk management (ERM) systems to find the risks where their company’s ability to execute can produce better average risk-adjusted returns. They then seek to optimize the risk/reward mix of the entire portfolio of insurance and investment risks that they hold. There are two aspects of this optimization process. First is the identification of the opportunities of the insurer in terms of expected return for the amount of risk. The second aspect is the interdependence of the risks. A risk with low interdependency with other risks may produce a better portfolio result than another risk with a higher stand alone return on risk but higher interdependence.
Proposals to grow or shrink parts of the business and choices to offset or transfer different major portions of the total risk positions can be viewed in terms of risk-adjusted return. This can be done as part of a capital budgeting/strategic resource allocation exercise and can be incorporated into regular decision-making. Some firms bring this approach into consideration only for major ad hoc decisions on acquisitions or divestitures and some use it all the time.
There are several common activities that may support the macro- level risk exploitation.
Economic Capital
Economic capital (EC) flows from the Provisioning principle. EC is often calculated with a comprehensive risk model consistently for all of the actual risks of the company. Adjustments are made for the imperfect correlation of the risks. Identification of the highest-concentration risks as well as the risks with lower correlation to the highest-concentration risks is risk information that can be exploited. Insurers may find that they have an advantage when adding risks to those areas with lower correlation to their largest risks if they have the expertise to manage those risks as well as they manage their largest risks.
Risk-adjusted product pricing
Another part of the process to manage risk portfolio risk reward involves the Consideration principle. Product pricing is “risk-adjusted” using one of several methods. One such method is to look at expected profits as a percentage of EC resulting in an expected return-to-risk capital ratio. Another method reflects the cost of capital associated with the economic capital of the product as well as volatility of expected income. The cost of capital is determined as the difference between the price to obtain capital and the rate of investment earnings on capital held by the insurer. Product profit projections then will show the pure profit as well as the return for risk of the product. Risk-adjusted value added is another way of approaching risk-adjusted pricing.
Capital budgeting
The capital needed to fulfill proposed business plans is projected based on the economic capital associated with the plans. Acceptance of strategic plans includes consideration of these capital needs and the returns associated with the capital that will be used. Risk exploitation as described above is one of the ways to optimize the use of capital over the planning period. The allocation of risk capital is a key step in this process.
Risk-adjusted performance measurement (RAPM)
Financial results of business plans are measured on a risk-adjusted basis. This includes recognition of the cost of holding the economic capital that is necessary to support each business as reflected in risk-adjusted pricing as well as the risk premiums and loss reserves for multi-period risks such as credit losses or casualty coverages. This should tie directly to the expectations of risk- adjusted profits that are used for product pricing and capital budgeting. Product pricing and capital budgeting form the expectations of performance. Risk-adjusted performance measurement means actually creating a system that reports on the degree to which those expectations are or are not met.
For non-life insurers, Risk Portfolio Management involves making strategic trade-offs between insurance, credit (on reinsurance ceded) and all aspects of investment risk based on a long-term view of risk-adjusted return for all of their choices.
Insurers that do not practice Portfolio Risk Management usually fail to do so because they do not have a common measurement basis across all of their risks. The recent move of many insurers to develop economic capital models provides a powerful tool that can be used as the common risk measure for this process. Economic capital is most often the metric used to define risk in the risk/reward equation of insurers.
Some insurers choose not to develop an EC model and instead rely upon rating agency or regulatory capital formulas. The regulatory and rating agency capital formulas are by their nature broad market estimates of the risk capital of the insurer. These formulae will over-state the capital needs for some of the insurer’s activity and understate the needs for others. The insurer has the specific data about their own risks and can do a better job of assessing their risks than any outsider could ever do. In some cases, insurers took high amounts of catastrophe exposure or embedded guarantee and option risks, which were not penalized in the generic capital formulas. In the end, some insurers found that they had taken much more risk than their actual loss tolerance or capacity.
Risk Portfolio management provides insurers with the framework to take full advantage of the power of diversification in their risk selection. They will look at their insurance and investment choices based on the impact, after diversification, on their total risk/reward profile. These insurers will also react to the cycles in risk premium that exist for all of their different insurance risks and for all of their investment risks in the context of their total portfolio.
Sales of most insurance company products result in an increase in the amount of capital needed by the business due to low or negative initial profits and the need to support the new business with Economic Capital. After the year of issue, most insurance company products will show annual releases of capital both due to the earnings of the product as well as the release of supporting capital that is no longer needed due to terminations of prior coverages. The net capital needs of a business arise when growth (new sales less terminations) is high and/or profits are low and capital is released when growth is low and/or profits are high.
The definition of the capital needs for a product is the same as the definition of distributable earnings for an entire business: projected earnings less the increase in Economic Capital. The capital budgeting process will then focus on obtaining the right mix of short and long term returns for the capital that is needed for each set of business plans.
Both new and existing products can be subjected to this capital budgeting discipline. A forecast of capital usage by a new product can be developed and used as a factor in deciding which of several new products to develop. In considering new and existing products, capital budgeting may involve examining historic and projected financial returns.
Pitfalls of Risk Portfolio Management
In theory, optimization processes can be shown to produce the best results for practitioners. And for periods of time when fluctuations of experience are moderate and fall comfortably within the model parameters, continual fine tuning and higher reliance on the modeled optimization recommendations produce ever growing rewards for the expert practitioner. However, model errors and uncertainties are magnified when management relies upon the risk model to lever up the business. And at some point, the user of complex risk models will see that levering up their business seems to be a safe and profitable way to operate. When volatility shifts into a less predictable and/or higher level, the highly levered company can find it self quickly in major trouble.
Even without major deviations of experience, the Risk Portfolio Management principles can lead to major business disruptions. When an insurer makes a major change in its risk profile through an acquisition or divestiture of a large part of their business, the capital allocation of all other activities may shift drastically. Strict adherence to theory can whipsaw businesses as the insurer makes large changes in business.
Insurers need to be careful to use the risk model information to inform strategic decisions without overreliance and abdication of management judgment. Management should also push usage of risk and reward thinking throughout the organization. The one assumption that seems to cause the most trouble is correlation. The saying goes that “in a crisis, all correlations go to one”. If the justification for a major strategic decision is that correlations are far from one, management should take note of the above saying and prepare accordingly. In addition management should study the variability of correlations over time. They will find that correlations are often highly unreliable and this should have a major impact on the way that they are used in the Risk Portfolio Management process.
Mine only shows the numbers every 20 and has markers for gradations of 5. So the people who make cars think that it is sufficient accuracy to drive a car that the driver know the speed of the car within 5.
And for the sorts of things that one usually needs to do while driving, that seems fine to me. I do not recall ever even wondering what my speed is to the nearest .0001.
That is because I never need to make any decisions that require the more precise value.
What about your economic capital model? Do you make decisions that require an answer to the nearest million? Or nearest thousand, or nearest 1? How much time and effort goes into getting the accuracy that you do not use?
What causes the answer to vary from one time you run your model to another? Riskviews tries to think of the drivers of changes as volume variances and rate variances.
The volume variances are the changes you experience because the volume of risk changes. You wrote more or less business. Your asset base grew or shrunk.
Rate variances are the changes that you experience because the amount of risk per unit of activity has changed. Riskviews likes to call this the QUALITY of the risk. For many firms, one of the primary objectives of the risk management system is to control the QUANTITY of risk.
QUANTITY of risk = QUALITY of risk times VOLUME of risk.
Some of those firms seek to control quantity of risk solely by managing VOLUME. They only look at QUALITY of risk after the fact. Some firms only look at QUALITY of risk when they do their economic capital calculation. They try to manage QUALITY of risk from the modeling group. That approach to managing QUALITY of risk is doomed to failure.
That is because QUALITY of risk is a micro phenomena and needs to be managed operationally at the stage of risk acceptance. Trying to manage it as a macro phenomena results in the development of a process to counter the risks taken at the risk acceptance area with a macro risk offsetting activity. This adds a layer of unnecessary cost and also adds a considerable amount of operational risk.
Some firms have processes for managing both QUANTITY and QUALITY of risk at the micro level. At the risk acceptance stage. The firm might have tight QUALITY criteria for risk acceptance or if the firm has a broad range of acceptable risk QUALITY it might have QUANTITY of risk criteria that have been articulated as the accumulation of quantity and quality. (In fact, if they do their homework, the firms with the broad QUALITY acceptance will find that some ranges of QUALITY are much preferable to others and they can improve their return for risk taking by narrowing their QUALITY acceptance criteria.)
Once the firm has undertaken one or the other of these methods for controlling quality, then the need for detailed and complex modeling of their risks decreases drastically. They have controlled their accumulation of risks and they already know what their risk is before they do their model.
In a post last week, it was noted that US insurers are starting to admit to managing their risks in their public disclosures. The 671 word discussion of the ERM process of Travelers was reproduced. (Notice that over 100 of those words talk about the unreliability of the ERM system. )
But disclosure of ERM processes has been much more widespread and much more extensive in other parts of the world for more than 5 years.
For Example, Munich Re’s 2010 annual report has a 20 page section titled Risk Report. That section has sub headings such as:
Risk governance and risk management system
Risk management organisation, roles and responsibilities
Control and monitoring systems
Risk reporting
Significant risks
Underwriting risk: Property-casualty insurance
Underwriting risk: Life and health insurance
Market risk
Credit Risk
Operational risk
Liquidity risk
Strategic risk
Reputation Risk
Economic Capital
Available Financial Resources
Selected Risk Complexes
It is not just Munich Re. Manulife’s Risk Management disclosure is 22 pages of their annual report. Below is the introduction to that section:
Manulife Financial is a financial institution offering insurance, wealth and asset management products and services, which subjects the Company to a broad range of risks. We manage these risks within an enterprise-wide risk management framework. Our goal in managing risk is to strategically optimize risk taking and risk management to support long-term revenue, earnings and capital growth.
We seek to achieve this by capitalizing on business opportunities that are aligned with the Company’s risk taking philosophy, risk appetite and return expectations; by identifying, measuring and monitoring key risks taken; and by executing risk control and mitigation programs.
We employ an enterprise-wide approach to all risk taking and risk management activities globally. The enterprise risk management (“ERM”) framework sets out policies and standards of practice related to risk governance, risk identification, risk measurement, risk monitoring, and risk control and mitigation. With an overall goal of effectively executing risk management activities, we continuously invest to attract and retain qualified risk professionals, and to build, acquire and maintain the necessary processes, tools and systems.
We manage risk taking activities against an overall risk appetite, which defines the amount and type of risks we are willing to assume. Our risk appetite reflects the Company’s financial condition, risk tolerance and business strategies. The quantitative component of our risk appetite establishes total Company targets defined in relation to economic capital, regulatory capital required, and earnings sensitivity.
We have further established targets for each of our principal risks to assist us in maintaining appropriate levels of exposures and a risk profile that is well diversified across risk categories. In 2010, we cascaded the targets for the majority of our principal risks down to the business level, to facilitate the alignment of business strategies and plans with the Company’s overall risk management objectives.
Individual risk management programs are in place for each of our broad risk categories: strategic, market, liquidity, credit, insurance and operational. To ensure consistency, these programs incorporate policies and standards of practice that are aligned with those within the enterprise risk management framework, covering:
■ Assignment of risk management accountabilities across the organization;
■ Delegation of authorities related to risk taking activities;
■ Philosophy and appetite related to assuming risks;
■ Establishment of specific risk targets or limits;
■ Identification, measurement, assessment, monitoring, and reporting of risks; and
■ Activities related to risk control and mitigation.
Such frank discussion of risk and risk management may be seen by some US insurers’ management to be dangerous. In the rest of the world, it is moving towards a situation where NOT discussing risk and risk management frankly and openly is a risk to management.
In a recent post, RISKVIEWS stated six key parts to ERM. These six ideas can act as the outline for describing an ERM Program. Here is how they could be used:
1. Risks need to be diversified. There is no risk management if a firm is just taking one big bet.
REPORT: Display the risk profile of the firm. Discuss how the firm has increased or decreased diversification within each risk and between risks in the recent past. Discuss how this is a result of deliberate risk and diversification related choices of the firm, rather than just a record of what happened as a result of other totally unrelated decisions.
2. Firm needs to be sure of the quality of the risks that they take. This implies that multiple ways of evaluating risks are needed to maintain quality, or to be aware of changes in quality. There is no single source of information about quality that is adequate.
REPORT: Display the risk quality of the firm. Discuss how the firm has increased or decreased risk quality in the recent past and the reasons for those changes. Discuss how risk quality is changing in the marketplace and how the firm maintains the quality of the risks that are chosen.
3. A control cycle is needed regarding the amount of risk taken. This implies measurements, appetites, limits, treatment actions, reporting, feedback.
REPORT: The control cycle will be described in terms of who is responsible for each step as well as the plans for remediation should limits be breached. A record of breaches should also be shown. (Note that a blemish-less record might be a sign of good control or it might simply mean that the limits are ineffectively large.) Emerging risks should have their own control cycle and be reported as well.
4. The pricing of the risks needs to be adequate. At least if you are in the risk business like insurers, for risks that are traded. For risks that are not traded, the benefit of the risk needs to exceed the cost in terms of potential losses.
REPORT: For General Insurance, this means reporting combined ratio. In addition, it is important to show how risk margins are similar to market risk margins. Note that products with combined ratios over 100% may or may not be profitable if the reserves do not include a discount for interest. This is accomplished by mark-to-market accounting for investment risks. Some insurance products have negative value when marked to market (all-in assets and liabilities) because they are sold with insufficient risk margins. This should be clearly reported, as well as the reasons for that activity.
5. The firm needs to manage its portfolio of risks so that it can take advantage of the opportunities that are often associated with its risks. This involves risk reward management.
REPORT: Risk reward management requires determining return on risk for all activities as well as a planning process that starts with projections of such and a conscious choice to construct a portfolio of risks. This process has its own control cycle. The reporting for this control cycle should be similar to the process described above. This part of the report needs to explain how management is thinking about the diversification benefits that potentially exist from the range of diverse risks taken.
6. The firm needs to provision for its retained risks appropriately, in terms of set asides (reserves or technical provisions) for expected losses and capital for excess losses.
REPORT: Losses can be shown in four layers, expected losses, losses that decrease total profits, losses that exceed gains from other sources but that are less than capital and losses that exceed capital. The likelihood of losses in each of those four layers should be described as well as the reasons for material changes. Some firms will choose to report their potential losses in two layers, expected losses, losses that reach a certain likelihood (usually 99.5% in a year or similar likelihood). However, regulators should have a high interest in the nature and potential size of those losses in excess of capital. The determination of the likelihood of losses in each of the four layers needs to reflect the other five aspects of ERM and when reporting on this aspect of ERM, discussion of how they are reflected would be in order.
Riskviews was once asked by an insurance sector equity analyst for 10 questions that they could ask company CEOs and CFOs about ERM. Riskviews gave them 10 but they were trick questions. Each one would take an hour to answer properly. Not really what the analyst wanted.
Here they are:
What is the firm’s risk profile?
How much time does the board spend discussing risk with management each quarter?
Who is responsible for risk management for the risk that has shown the largest percentage rise over the past year?
What outside the box risks are of concern to management?
What is driving the results that you are getting in the area with the highest risk adjusted returns?
Describe a recent action taken to trim a risk position?
How does management know that old risk management programs are still being followed?
What were the largest positions held by company in excess of risk the limits in the last year?
Where have your risk experts disagreed with your risk models in the past year?
What are the areas where you see the firm being able to achieve better risk adjusted returns over the near term and long term?
They never come back and asked for the answer key. Here it is:
5. In the sub prime market prior to the crisis, investors were buying AAA securities but getting a little more yield. Since they were AAA rated, the capital required was minimal. So the return on equity could be attractive. Unless you held that story up to the light and freely admitted that your bank profits were bolstered by exploiting the fact that the market and the regulators had different opinions of the creditworthiness of the sub prime securities.
So, if the banks had answered honestly, they would have been saying that their profits were coming from regulatory arbitrage. There are only three possible outcomes from this situation. First, the market could wise up and the excess profits would disappear. Second, the regulators could wise up and suddenly the banks would find themselves needing lots more capital, and third, the market persists in its opinion of higher risk and it turns out the market is correct. But since under this third option, the bank is playing the regulators for the fools, as the risks stay the same or grow ever larger, the banks take more and more advantage of the stupid regulators. They pretend to their board that the bank is safe because they are holding the capital that the regulators require. The banks takes more and more risk – the compulsion to grow and grow earnings in the face of the shrinking spreads for everything with “normal” risk is an immutable imperative that requires banks to multiply their risk.
So one of the possible reasons that Risk Adjusted Return is high is that the risk adjustment is based upon regulatory requirements – not on an actual assessment of risk. And there are three possible outcomes of playing the regulatory arb game that are unfavorable.
Another reason for higher risk adjusted returns is a competitive advantage. Investors should be happy to hear about a competitive advantage. They should also do their own assessment about how permanent that advantage might be.
From the point of view of assessing an ERM system, the answer to this question should reveal how seriously that management takes the idea of risk management. High and unexpected returns are as good a signal as any of higher risk. In fact, in the financial markets, high returns are almost always a symptom of higher risk.
Stochastic Monte Carlo simulations (SMCS) of insurer activities have been used to create nearly continuous distribution curves of expected gains and losses. Economic Capital models are often aggregations of these separate SMCS models to create a similar distribution of total group gains and losses. There are several primary characteristics of the results of these models:
They produce a nearly infinite number of numerical results giving an incredibly rich vision of the possibilities for the results of the activities of the firm.
That tidal wave of numeric results is very difficult to digest and make sense of.
While the modelers may have developed methods for validating the models, it is extremely difficult for general management who are supposed to be the primary users to “validate” the models and therefore, very difficult for them to trust the models
What would validation mean for the general managers? It would mean that they would have confidence that the experiences that they have of the company’s risks and their expectations of future experience would be consistent with the model.
Ultimately, managers should have the same sort of reliance on the model that they have on the speedometer in their car or the clock on their wall. The same sort of confidence that a cook might have on the thermometer on the oven. They get that confidence not by having an expert show them a report, they get that confidence by experience. The speedometer tells them that they are driving within the speed limit and they go past a police speed trap and they are not stopped for speeding. They leave for work with enough time to get there and they arrive on time. The cook puts the cake in the oven and it does not burn and it does cook appropriately in the time expected. Not just once, but over and over again.
The problem is trickier for the SMCS model. The output is really a set of likelihoods. But when that output is presented as the infinite stream of numbers, there is no intuitive way to validate it naturally against experience. And also, when the output is presented as a single remote number, like a 1 in 200 loss, it is also nearly impossible to validate naturally, by experience.
Tranching a security means splitting up the cashflows in some particular, predetermined way. The idea of tranching can be used to help with promoting the natural validation process for a SMCS model. The future possibilities can be tranched into 6 or 8 natural stories. Then the model results can be sorted into the scenarios that match up with the stories. The model output can be characterized as predictions of likelihood for the stories. Here are some possible stories:
Highly favorable results – Bonuses are maximized
Favorable results – Bonuses are above expected/average
Somewhat unfavorable results – Bonuses are paid but below average/expected
Critical Loss – Company has to drastically change activity – may go into runoff
Disaster – company insolvent – seised by regulator
Management can participate in defining the range of results that frame each story there. Then the model can provide its prediction of likelihood of each tranche. Management can also provide their prediction of the likelihood of each tranche. The stories do not have to be compensation related. Riskviews has found that if the bonus program of a company was thoughtfully constructed, there are likely to be other stories that can be told of company experience to define the same ranges of results.
A seriously valuable and interesting discussion might result.
Riskviews was once an executive manager for a business unit within an insurer. The insurer’s risk model was used to produce a projection of what might happen to that business in an adverse market. Riskviews response was to ask on which day of that crisis the modeler was predicting that Riskviews was going into a coma, because the business decisions that are predicted would never happen if Riskviews was conscious.
These stories can be used to promote the validation process by the managers. At the conclusion of each period, the modelers and the managers can review the actual experience in terms of the stories. Then they can all decide if the experience validated the model or if it provided experience that suggests recalibrating the model.
Now if this process happens once per year, then it will take a very long time for that natural validation to take place. Probably longer than the tenure of any single management team. And as the management team turns over, the validation process is likely going to need more time. Therefore, it is highly recommended that this process be repeated quarterly. And perhaps repeated for each of the sub models of the economic capital model.
The way that the cook or the driver or the commuter got to rely on their tools was by repeated experiences. The same sort of repeated experience is needed to validate the SMCS model in the minds of the management users.
Riskviews was once asked by an insurance sector equity analyst for 10 questions that they could ask company CEOs and CFOs about ERM. Riskviews gave them 10 but they were trick questions. Each one would take an hour to answer properly. Not really what the analyst wanted.
Here they are:
What is the firm’s risk profile?
How much time does the board spend discussing risk with management each quarter?
Who is responsible for risk management for the risk that has shown the largest percentage rise over the past year?
What outside the box risks are of concern to management?
What is driving the results that you are getting in the area with the highest risk adjusted returns?
Describe a recent action taken to trim a risk position?
How does management know that old risk management programs are still being followed?
What were the largest positions held by company in excess of risk the limits in the last year?
Where have your risk experts disagreed with your risk models in the past year?
What are the areas where you see the firm being able to achieve better risk adjusted returns over the near term and long term?
They never come back and asked for the answer key. Here it is:
2. One of the large banks that is no longer with us had, on paper, a complete ERM system with a board risk committee that they reviewed their risk reports with every quarter. But in 2007, when the financial markets were starting to crack up, their board risk committee had not met for more than six months. The answer to this question is the difference between a pretend ERM system and a real risk system. The time spent should be proportionate to the complexity of the risk positions of the firm. For the banks with risk positions that are so complex that they feel that they cannot possibly find enough paper to disclose them, there needs to be much more board time spent, since investors are relying on board oversight rather than market discipline to police the risk taking. Ask Bernie what you can get away with if there is no disclosure and no oversight.
Many CEOs will tell you that the board has always spent plenty of time talking about risk. This might be true. But the standard now is for boards to have a formal risk committee. Boards that have simply added risk to the Audit committee’s agenda ends up short changing either audit or risk or both. The Audit Committee had a full plate before the Risk responsibility was added.
And for a larger complex firm, a single annual risk briefing on risk is definitely not sufficient. For a firm with an ERM program, the board needs to review the risk profile, both actual and planned for each year, approve the risk appetite, approve the ERM Framework and policies of the firm, review the risk limits and be informed of each breach of the limits or policies of the firm. If the firm has an economic capital model, the model results need to be presented to the board risk committee each year and updated quarterly. Risks associated with anything new that the company is doing would be presented as well.
Does that sound like anything other than a full committee? So your follow up question, if the CEO gives a vague answer is to ask about whether the board reviewed each of the items listed in the preceding paragraph in the past year.
Back to that former bank. Their risk reports showed a massive build up in risk in violation of board approved limits.
And the board risk committee saved time by not meeting during the period of that run up in risk.
The dilemma is a classic – in order for a risk model to be credible, it must be an Echo Chamber – it must reflect the starting prejudices of management. But to be useful – and worth the time and effort of building it – it must provide some insights that management did not have before building the model.
The first thing that may be needed is to realize that the big risk model cannot be the only tool for risk management. The Big Risk Model, also known as the Economic Capital Model, is NOT the Swiss Army Knife of risk management. This Echo Chamber issue is only one reason why.
It is actually a good thing that the risk model reflects the beliefs of management and therefore gets credibility. The model can then perform the one function that it is actually suited for. That is to facilitate the process of looking at all of the risks of the firm on the same basis and to provide information about how those risks add up to make up the total risk of the firm.
That is very, very valuable to a risk management program that strives to be Enterprise-wide in scope. The various risks of the firm can then be compared one to another. The aggregation of risk can be explored.
All based on the views of management about the underlying characteristics of the risks. That functionality allows a quantum leap in the ability to understand and consistently manage the risks of the firm.
Before creating this capability, the risks of each firm were managed totally separately. Some risks were highly restricted and others were allowed to grow in a mostly uncontrolled fashion. With a credible risk model, management needs to face their inconsistencies embedded in the historical risk management of the firm.
Some firms look into this mirror and see their problems and immediately make plans to rationalize their risk profile. Others lash out at the model in a shoot the messenger fashion. A few will claim that they are running an ERM program, but the new information about risk will result in absolutely no change in risk profile.
It is difficult to imagine that a firm that had no clear idea of aggregate risk and the relative size of the components thereof would find absolutely nothing that needs adjustment. Often it is a lack of political will within the firm to act upon the new risk knowledge.
For example, when major insurers started to create the economic capital models in the early part of this century, many found that their equity risk exposure was very large compared to their other risks and to their business strategy of being an insurer rather than an equity mutual fund. Some firms used this new information to help guide a divestiture of equity risk. Others delayed and delayed even while saying that they had too much equity risk. Those firms were politically unable to use the new risk information to reduce the equity position of the group. More than one major business segment had heavy equity positions and they could not choose which to tell to reduce. They also rejected the idea of reducing exposure through hedging, perhaps because there was a belief at the top of the firm that the extra return of equities was worth the extra risk.
This situation is not at all unique to equity risk. Other firms had the same experience with Catastrophe risks, interest rate risks and Casualty risk concentrations.
A risk model that was not an Echo Chamber model would be any use at all in these situation above. The differences between management beliefs and the model assumptions of a non Echo Chamber model would result in it being left out of the discussion entirely.
Other methods, such as stress tests can be used to bring in alternate views of the risks.
So an Echo Chamber is useful, but only if you are willing to listen to what you are saying.
Of course it is. The equipment never wins the game. It never runs the game. But a team that shows up without proper equipment has only a slim chance of prevailing.
And ERM is about more than just models. Some people have mistakenly equated ERM with Economic Capital or VAR models. That makes no more sense than the idea that football is all about the shoes.
Football is about having the right team, assigning the the right roles, setting the strategy and finally mostly about execution. If you asked 1000 experts about football, few if any of them would even list the shoes.
But for ERM, you do need to also find the right people, assign the the right roles, set the risk strategy and execute.
So why have models found their way into the debate about ERM in financial affairs?
Models in general and Economic Capital in specific has become central to the ERM process because insurers and banks have traditionally used very crude and very different approaches to measuring risks, when they actually did try to measure them. It is difficult to believe that an industry that exists by taking on risks from others like insurance would not have a clear tradition of measuring how much risk it was taking on in any clear and consistent way.
The methods that tended to be employed by insurers worked when the risks that they were taking stayed the same over time. When the risks could be adequately tracked by reference to something that indirectly tracked with the level of the risk. But when businesses and people and markets are changing the nature and level of risk constantly, those old relationships completely broke down.
The promise of economic capital and VaR models is to replace the old rules of thumb with timely and consistent scientific assessments of risk.
But even if that promise is achieved, the insurer or bank has only then got to the point of buying shoes for their football team. Now they need to start training and coaching the team and watching to see how the team performs, providing feedback and constantly making adjustments as the other teams adjust their teams and strategies.
So the model is a start but it is the start of the football season, not even the start of the playoffs.
#2 Higher Interest Rates and Tighter Money in Emerging Markets
#3 Political Crises in the Middle East
#4 Surging Oil Prices
#5 An Increase in Interest Rates in Developed Markets
#6 The End of QE2
#7 Fiscal Cuts and Sovereign Debt Crises
#8 The Japanese Disaster
How should ideas like these impact on ERM systems? Is it at all reasonable to say that they should not? Definitely not.
These potential shocks illustrate the need for the ERM system to be reflexive. The system needs to react to changes in the risk environment. That would mean that it needs to reflect differences in the risk environment in three possible ways:
In the calibration of the risk model. Model assumptions can be adjusted to reflect the potential near term impact of the shocks. Some of the shocks are certain and could be thought to impact on expected economic activity (Japanese disaster) but have a range of possible consequences (changing volatility). Other shocks, which are much less certain (end of QE2 – because there could still be a QE3) may be difficult to work into model assumptions.
With Stress and Scenario Tests – each of these shocks as well as combinations of the shocks could be stress or scenario tests. Riskviews suggest that developing a handful of fully developed scenarios with 3 or more of these shocks in each would be the modst useful.
In the choices of Risk Appetite. The information and stress.scenario tests should lead to a serious reexamination of risk appetite. There are several reasonable reactions – to simply reduce risk appetite in total, to selectively reduce risk appetite, to increase efforts to diversify risks, or to plan to aggressively take on more risk as some risks are found to have much higher reward.
The last strategy mentioned above (aggressively take on more risk) might not be thought of by most to be a risk management strategy. But think of it this way, the strategy could be stated as an increase in the minimum target reward for risk. Since things are expected to be riskier, the firm decides that it must get paid more for risk taking, staying away from lower paid risks. This actually makes quite a bit MORE sense than taking the same risks, expecting the same reward for risks and just taking less risk, which might be the most common strategy selected.
The final consideration is compensation. How should the firm be paying people for their performance in a riskier environment? How should the increase in market risk premium be treated?
A.M. Best added a Supplemental Rating Questionnaire (SRQ) for insurers at the end of 2010. While it will provide interesting information that will aid the analyst develop questions for a face-to-face meeting, the mainly checklist format will limit its value. A better option would be for a company to utilize this SRQ to develop an internal risk management report that could be presented to the board and external stakeholders much as insurers generate an investment management report. The A.M. Best checklist could be a by-product of this process. A.M. Best’s statement that “each company’s need for ERM is different” is absolutely correct. Organizations with complex and varied product mixes should spend their time understanding both the silo risks and the interactions between those silos. Going into 2006 insurers (and rating agencies) did not have leading indicators in place to monitor housing prices, yet that proved to be the driver leading to the financial crisis. There is little in this questionnaire that is forward looking toward new and emerging risks.
Concentration
The questionnaire does not do enough to focus on concentration of exposures. No credit is awarded for a diversified group of independent risks. There is also no mention of counterparty risk with reinsurers. The financial crisis left reinsurers ever more entangled, and if one ever experiences financial difficulties a contagion effect could drag quite a few down with them. If that happens there is no reason to think that insurers would not batten down the hatches as banks did with their loan portfolios. Insurers should have a contingency plan for this possibility, along with performing other stress tests and board discussions.
Key Risk Indicators
The questionnaire refers to reporting risk metrics. This should be more specific. Financial statements do a pretty good job of reporting lagging indicators such as revenue and net income. What would be more useful when managing risk are leading indicators. What metric can I look at today to anticipate future revenue? Keeping track of metrics such as agent retention, applications received, or unemployment will allow the line manager to better understand the business line and the risk manager to better identify potential risks. Today, many insurers are developing this process but it is still evolving.
Risk Culture
In the risk culture section of the questionnaire, terms such as risk/return measures and reporting risk jump out at me. Not all risks can be measured, and many can’t be measured accurately. That does not mean they can’t, and certainly does not mean they should not, be managed. Examples would include the likelihood and severity of civil unrest around the world. It is not important to judge precisely how likely these events might be, but it is important to think about how you might react if such an event does occur. Options are generally limited after an event occurs, and time is often the critical factor. Reporting risk means many things to many people. It would be preferred to have a dialogue about risks, using a written report as a starting point.
Identifying Risks
In the Risk Identification/Measurement/Monitoring section of the questionnaire, A.M. Best asks “Who is the most responsible for identifying material risks to the company’s financial position?” This seems to be a no-win question, as no matter who is listed shortcomings will be associated with it. If you list the CEO, then the CRO is short-changed. If you list the CRO, the line managers wonder what their role is. Perhaps a better question would be to ask who is responsible for consolidating risks and looking at them holistically, scanning for emerging risks as well. It will be interesting to see what A.M. Best does with the table considering the largest potential threats to financial strength. There is no consistent approach to estimated potential impact. Two companies with the exact same exposure to a risk might report vastly different dollar figures. The higher number might be generated by the organization that better understands the risk.
Economic Capital
The most interesting question to me would be to ask how independent of results are the modelers? Who do they report to? How is their bonus determined? My perception is that there is subtle pressure put on modelers to hit certain results and that they should understand their models well enough to know which levers to pull that won’t raise a warning flag. At this point there is no audit requirement for an economic capital model.
Forward Looking
Missing in this questionnaire, as well as the NAIC’s Risk Focused Examinations, is a view of the future. In my opinion, if there is not an immediate solvency issue then the most interesting question is what could impair this organization in the future. For many insurance firms this will be related to selling profitable products and being flexible. It is hard to find distribution without giving away either options or returns. Consolidation in the insurance industry is likely. How many companies have considered their competitive position is their competitors merge? For distressed firms it is rarely a previously managed risk that takes them down. What environmental scanning is being done? What Risks are you Worried about Today? Risks that could be included in this type of analysis would be considered stress tests by many, but how many organizations would share more than they think their competitors are sharing? Here are some risks to ponder, along with their unintended consequences, in no order.
Low interest rate environment is replaced by an inflationary shock
A new competitor enters the insurance market with a known and trusted brand and new distribution channel (WalMart comes to mind)
A reinsurer becomes insolvent due to investment losses, stressing other reinsurers.
The insurance industry experiences higher trending mortality, with a flurry of 30-50 deaths due to obesity
Climate change results in changing weather patterns, with more volatile weather and crop patterns
A consolidator enters the industry, generating economies of scale that reduce potential returns by 2%.
Infrastructure around the world ends its useful lifetime and is not replaced.
Water wells are drilled in developed countries by farmers and local communities to access an aquifer.
Warning: The information provided in this newsletter is the opinion of Max Rudolph and is provided for general information only. It should not be considered investment advice. Information from a variety of sources should be reviewed and considered before decisions are made by the individual investor. My opinions may have already changed, so you don’t want to rely on them. Good luck! Warning: The information provided in this newsletter is the opinion of Max Rudolph and is provided for general information only. It should not be considered investment advice. Information from a variety of sources should be reviewed and considered before decisions are made by the individual investor. My opinions may have already changed, so you don’t want to rely on them. Good luck!
Many people struggle with clearly identifying how to measure the success of their risk management program.
But they really are struggling with is either a lack of clear objectives or with unobtainable objectives.
Because if there are clear and obtainable objectives, then measuring success means comparing performance to those objectives.
The objectives need to be framed in terms of the things that risk management concentrates upon – that is likelihood and severity of future problems.
The objectives need to be obtainable with the authority and resources that are given to the risk manager. A risk manager who is expected to produce certainty about losses needs to either have unlimited authority or unlimited budget to produce that certainty.
The most difficult part of judging the success of a risk management program is when those programs are driven by assessments of risk that end up being totally insufficient. But again the real answer to this issue is authority and budget. If the assumptions of the model are under the control of the risk manager, that is totally under the risk manager’s control, then the risk manager would be prudent to incorporate significant amounts of margin either into the model or into the processes that use the model for model risk. But then the risk manager is incented to make the model as conservative as their imagination can make it. The result will be no business – it will all look too risky.
So a business can only work if the model assumptions are the join responsibility of the risk manager and the business users.
But there are objectives for a risk management program that can be clear and obtainable. Here are some examples:
The Risk Management program will be compliant with regulatory and/or rating agency requirements
The Risk Management program will provide the information and facilitate the process for management to maintain capital at the most efficient level for the risks of the firm.
The Risk Management program will provide the information and facilitate the process for management to maintain profit margins for risk (pricing in insurance terms) at a level consistent with corporate goals.
The Risk Management program will provide the information and facilitate the process for management to maintain risk exposures to within corporate risk tolerances and appetites.
The Risk Management program will provide the information and facilitate the process for management and the board to set and update goals for risk management and return for the organization as well as risk tolerances and appetites at a level and form consistent with corporate goals.
The Risk Management program will provide the information and facilitate the process for management to avoid concentrations and achieve diversification that is consistent with corporate goals.
The Risk Management program will provide the information and facilitate the process for management to select strategic alternatives that optimize the risk adjusted returns of the firm over the short and long term in a manner that is consistent with corporate goals.
The Risk Management program will provide information to the board and for public distribution about the risk management program and about whether company performance is consistent with the firm goals for risk management.
Note that the firm’s goals for risk management are usually not exactly the same as the risk management program’s goals. The responsibility for achieving the risk management goals is shared by the management team and the risk management function.
Goals for the risk management program that are stated like the following are the sort that are clear, but unobtainable without unlimited authority and/or budget as described above:
X1 The Risk Management program will assure that the firm maintains profit margins for risk at a level consistent with corporate goals.
X2 The Risk Management program will assure that the firm maintains risk exposures to within corporate risk tolerances and appetites so that losses will not occur that are in excess of corporate goals.
X3 The Risk Management program will assure that the firm avoids concentrations and achieve diversification that is consistent with corporate goals.
X4 The Risk Management program will assure that the firm selects strategic alternatives that optimize the risk adjusted returns of the firm over the short and long term in a manner that is consistent with corporate goals.
The worst case situation for a risk manager is to have the position in a firm where there are no clear risk management goals for the organization (item 4 above) and where they are judged on one of the X goals but which one that they will be judged upon is not determined in advance.
Unfortunately, this is exactly the situation that many, many risk managers find themselves in.
In practice, the risk tolerance constraints (i.e. maximum expected default probability at the company’s target rating) of rating agencies determine the minimum amount of capital that a company needs to secure the rating it needs to execute its strategic plan on a going concern basis. When a company’s available capital is higher than this minimum, the company uses a fraction of its risk capacity, equal to the ratio of this minimum amount to available capital. If available capital is lower than this capital requirement, the ratio becomes greater than one; the company is overextended and needs to take corrective action.
In this discussion, we are deliberately refraining from using “economic capital” as a measure of capital utilization, capital availability, risk capacity or risk capacity utilization because the term “economic” can have several distinct meanings that create confusion. We focus on measures of capital and risk capacity that can provide robust guideposts for making decisions about management and deployment of a company’s risk capacity, in relation to its available capital.
The figure below displays how the proposed risk capacity and capital concepts interact with each other and provide a framework for an insurance company to assess the adequacy of its risk capacity and its capital as well as determine its risk appetite. It sets out a framework that links the principal uses of an insurance company’s total available capital, to strategic drivers of capital and risk capacity utilization. Under this framework, a company needs to:
Set aside a “strategic reserve” intended to fund unforeseen opportunities (e.g. acquisitions) that is deducted from available capital to determine available risk capacity
Determine the risk capital requirement needed to execute its growth strategy, including i) the modeled strategic risk capital requirement derived from analysis of its prospective risk profile and ii) a “safety buffer” ensuring that its strategy can be executed, at a high level of confidence set by its Board of Directors, in spite of:
Catastrophic loss or investment scenarios that might cause downgrading by rating agencies or RBC adequacy to so decline that regulators would be required to intervene
Understatement of the modeled strategic risk capital requirement caused by “model risk”, or by risks that are inherently difficult to model appropriately (e.g. systemic risk, operational risks that increase insurance or investment losses, parameter risks, unstable correlations)
Extreme circumstances that can reduce and sometimes eliminate benefits from diversification across lines or across insurance and investment activities
The risk that a company might not be able to raise capital from investors on terms acceptable to shareholders when needed to restore its capital position
In the wake of the financial crisis, many companies are trying to determine how large a capital safety buffer (including off balance sheet contingent capital) they should have to absorb losses caused by catastrophic events while containing the negative impact of additional capital on profitability metrics, especially their return on shareholders’ equity. In practice, they would like to hold enough capital to ensure that their insurance strength rating would remain at or above the level needed to sustain the confidence of customers and regulators over a suitably long time period (e.g. ten years) at a high confidence level, while avoiding declines in returns that might reduce their valuation multiples.
As shown by the figure, a company’s capital requirement represents its risk capacity utilization under its strategic plan as well as its risk appetite. When this capital requirement, including the suitable safety buffer discussed above, is smaller than the company’s risk capacity (as shown on the figure) the company has “excess capital”. It has an option to deploy some or all of its excess capital productively or return it to investors. When this capital requirement, including the safety buffer, is greater than the company’s risk capacity, a company is overextended and need to take action to reduce planned capacity utilization or raise additional capital to increase its risk capacity.
The mutual dependency of a company’s risk profile, risk capacity utilization, risk capacity, capital available and risk appetite and the irreducible uncertainty of financial results of insurance activities create a context in which management needs to ensure that risk capacity management and strategy management are aligned with the return expectations and risk concerns of shareholders.
Note: This article is abstracted from the “Risk Management and Business Strategy in P/C Insurance Companies” briefing paper published by Advisen (www.advisen.com) and available at the Corner Store.
But what should you do SECOND? The list of ERM practices is long. Riskviews uses an eight item list of ERM Fundamentals to point the way to early ERM developments.
And you want to make sure that you avoid Brick Walls and Touring Bikes.
But the Second Step is not a practice of ERM. The Second Step is to identify the motivation for risk management. As mentioned in another post, there are three main motivations: Compliance, Capital Adequacy and Decision making.
If Compliance is the motivation, then the ERM development process will be to obtain or develop a checklist of items that must be completed to achieve compliance and to work to put something in place for each of those items that will create the ability to check off that item.
If Capital Adequacy is the motivation, then building an Economic Capital model is the main task that is needed for ERM development.
If Decision making is the motivation, then the process becomes somewhat more involved. Start with identifying the risk attitude of the firm. Knowing the risk attitude of the firm, the risk management strategy can then be selected. Each of the ERM Fundamentals can then be implemented in a way that is adapted to the risk strategy.
This process has been described in the post Risk Attitudes and the New ERM Program.
But knowing the motivation is key. A newly appointed risk management officer might have fallen in love with literature describing the Risk Steering strategy of ERM. They would set up a big budget for capital modeling and start to set up risk committees and write rules and policy statements…..
And then hit a brick wall.
That is because they did not clearly identify the motivation for their appointment to be the risk management officer. The term ERM actually means something totally different to different folks. Usually one of the three motivations: Compliance, Capital Adequacy, or Decision Making.
A company that is primarily motivated by Capital Adequacy will have minimal interest in any of the active parts of the ERM practices. A company motivated by compliance will want to know that each and every step in their ERM process satisfies a requirement. Talking about enhanced decision making as the reason for steps in the ERM development process will either confuse or even anger management of these companies.
The reaction to a mismatch of ERM program to motivation is similar to someone who booked a cruise for their vacation and found themselves on a cross country biking tour.
Most modern cruise ships feature the following facilities:
Casino – Only open when the ship is in open sea
Spa
Fitness center
Shops – Only open when ship is in open sea
Library
Theatre with Broadway style shows
Cinema
Indoor and/or outdoor swimming pool
Hot tub
Buffet restaurant
Lounges
Gym
Clubs
Keep that contrast in mind when you are making your plans for a new ERM system.
In insurance companies, where “production” consists of risk assumption and risk accumulation, measuring a company’s risk capacity and risk capacity utilization is not as straightforward as in companies that manufacture widgets. Like industrial companies, insurance companies need to measure and manage their “production” or rather “risk” (accumulation) capacity.
The recent crisis has demonstrated that insurance companies need to measure and manage their risk capacity utilization in relation to the amount of risk capacity lest they become overextended. In insurance companies, risk capacity needs to be determined so as to satisfy:
Solvency concerns of policyholders, for which insurance strength ratings assigned by the leading independent rating agencies and A.M. Best are generally accepted as proxies. Shareholders are also interested in these ratings, which they view as indicators of companies’ ability to attract and retain customers and achieve their financial objectives.
Maintenance of regulatory Risk Based Capital (RBC) adequacy ratios sufficient to prevent regulators from intervening in company management.
Risk capacity is most commonly a measure of an insurance company’s ability to accumulate risk exposures, on a going concern basis, while meeting risk tolerance constraints of solvency-focused stakeholders (policyholders, rating agencies and regulators). Risk concerns of these stakeholders are generally expressed as confidence levels at which a company is capable of meeting particular standards of performance, (e.g. maximum probability of default, maintenance of the capital needed to support a target rating or RBC adequacy level) over a defined time horizon.
A company’s risk capacity is customarily measured by its available capital and its risk capacity utilization is measured by the amount of capital needed to meet the risk tolerance constraints of credit-sensitive stakeholders, given its present portfolio of risk exposures. In order to gain the confidence of investors and customers and to enjoy a viable future, an insurance company needs to understand how its strategic plan impacts the prospective utilization of its risk capacity, and therefore the adequacy of its capital in relation to its projected financial performance and growth aspirations.
To perform this assessment, a company needs to estimate its prospective risk capacity utilization (i.e. capital required) for executing its strategic plan. To perform this analysis, it needs to project its risk profile over a three to five years planning horizon (approximating going concern conditions), under growth assumptions embedded in its strategic plan. A properly constructed risk profile should enable a company to consider the impact of extreme conditions, often scenarios that include multiple catastrophes or financial crises, as well as the contribution of earnings retention to risk capacity. This basic strategic planning exercise, completed in a risk-aware framework will demonstrate the risk capital (and, thus, capacity utilization) required to execute the strategic plan.
Ideally, the required financial models should be capable of producing i) full distributions of financial outcomes rather than tail sections of these distributions, ii) elements of the balance sheet and P&L statements needed to calculate earnings, earnings volatility, downside risk from planned earning amounts in future periods, iii) calculations of RBC, and associated capital adequacy ratios, including A.M. Best’s capital adequacy ratio (BCAR) and iv) financial performance reports developed under multiple accounting standards, including statutory and GAAP or IFRS, or on an economic basis. These data are needed for management to explore how capital requirements and thus also risk capacity utilization respond to changes in risk strategy and business strategy.
The company’s risk profile can be derived from the aggregation of the distributions of financial results of individual lines or business segments based on the amount and volatility characteristics of exposures, limits assumed, applicable reinsurance treaties, and asset mix, over a three to five year time horizon so as to approximate going concern conditions.
The use of multi-year solvency analyses of companies’ risk profile, instead of a one year horizon required under the regulatory provisions of many jurisdictions, typically results in significantly higher estimates of risk capital requirements and risk capacity utilization than those obtained under the one year horizon. As a result, companies that rely primarily on one year solvency analyses to assess the adequacy of their capital tend to understate their capital requirements and are more likely to overextend themselves. Importantly, the underlying assumption that capital shortfalls could be covered as and when needed by raising capital from investors has been shown to be unrealistic during the recent financial crisis, highlighting what may be a fundamental flaw in the widely touted Solvency II framework.
Note: This article is abstracted from the “Risk Management and Business Strategy in P/C Insurance Companies” briefing paper published by Advisen (www.advisen.com) and available at the Corner Store.
Capital estimation for Liquidity Risk Management is a difficult exercise. It comes up as part of the internal liquidity risk management process as well as the internal capital adequacy assessment process (ICAAP). This post and the liquidity risk management series that can be found at the Learning Corporate Finance blog suggests a framework for ongoing discussion based on the work done by our team with a number of regional banking customers.
By definition banks take a small Return on asset (1% – 1.5%) and use leverage and turnover to scale it to a 15% – 18% Return on Equity. When market conditions change and a bank becomes the subject of a name crisis and a subsequent liquidity run, the same process becomes the basis for a death chant for the bank. We try to de-lever the bank by selling assets and paying down liabilities and the process quickly turns into a fire sale driven by the speed at which word gets out about the crisis.
Figure 1 Increasing Cash Reserves
Reducing leverage by distressed asset sales to generate cash is one of the primary defense mechanisms used by the operating teams responsible for shoring up cash reserves. Unfortunately every slice of value lost to the distressed sale process is a slice out of the equity pool or capital base of the bank. An alternate mechanism that can protect capital is using the interbank Repurchase (Repo) contract to use liquid or acceptable assets as collateral but that too is dependent on the availability of un-encumbered liquid securities on the balance sheet as well as availability of counterparty limits. Both can quickly disappear in times of crisis. The last and final option is the central bank discount window the use of which may provide temporary relief but serves as a double edge sword by further feeding the name and reputational crisis. While a literature review on the topic also suggest cash conservation approaches by a re-alignment of businesses and a restructuring of resources, these last two solutions assume that the bank in question would actually survive the crisis to see the end of re-alignment and re-structuring exercise.
Liquidity Reserves: Real or a Mirage
A questionable assumption that often comes up when we review Liquidity Contingency Plans is the availability or usage of Statutory Liquidity and Cash Reserves held for our account with the Central Bank. You can only touch those assets when your franchise and license is gone and the bank has been shut down. This means that if you want to survive the crisis with your banking license intact there is a very good chance that the 6% core liquidity you had factored into your liquidation analysis would NOT be available to you as a going concern in times of a crisis. That liquidity layer has been reserved by the central bank as the last defense for depositor protection and no central bank is likely to grant abuse of that layer.
Figure 2 Liquidity Risk and Liquidity Run Crisis
As the Bear Stearns case study below illustrate the typical Liquidity crisis begins with a negative event that can take many shapes and forms. The resulting coverage and publicity leads to pressure on not just the share price but also on the asset portfolio carried on the bank’s balance sheet as market players take defensive cover by selling their own inventory or aggressive bets by short selling the securities in question. Somewhere in this entire process rating agencies finally wake up and downgrade the issuer across the board leading to a reduction or cancellation of counterparty lines. Even when lines are not cancelled given the write down in value witnessed in the market, calls for margin and collateral start coming in and further feed liquidity pressures.
What triggers a Name Crisis that leads to the vicious cycle that can destroy the inherent value in a 90 year old franchise in less than 3 months. Typically a name crisis is triggered by a change in market conditions that impact a fundamental business driver for the bank. The change in market conditions triggers either a large operational loss or a series of operation losses, at times related to a correction in asset prices, at other resulting in a permanent reduction in margins and spreads. Depending on when this is declared and becomes public knowledge and what the bank does to restore confidence drives what happens next. One approach used by management teams is to defer the news as much as possible by creative accounting or accounting hand waving which simply changes the nature of the crisis from an asset price or margin related crisis to a much more serious regulatory or accounting scandal with similar end results.
Figure 3 What triggers a name crisis?
The problem however is that market players have a very well established defensive response to a name crisis after decades of bank failures. Which implies that once you hit a crisis the speed with which you generate cash, lock in a deal with a buyer and get rid of questionable assets determined how much value you will lose to the market driven liquidation process. The only failsafe here is the ability of the local regulator and lender of last resort to keep the lifeline of counterparty and interbank credit lines open. As was observed at the peak of the crisis in North America, UK and a number of Middle Eastern market this ability to keep market opens determines how low prices will go, the magnitude of the fire sale and the number of banks that actually go under.
Figure 4 Market response to a Name Crisis and the Liquidity Run cycle.
The above context provides a clear roadmap for building a framework for liquidity risk management. The ending position or the end game is a liquidity driven asset sale. A successful framework would simply jump the gun and get to the asset sale before the market does. The only reason why you would not jump the gun is if you have cash, a secured contractually bound commitment for cash, a white knight or any other acceptable buyer for your franchise and an agreement on the sale price and shareholders’ approval for that sale in place. If you are missing any of the above, your only defense is to get to the asset sale before the market does.
The problem with the above assertion is the responsiveness of the Board of directors and the Senior executive team to the seriousness of the name crisis. The most common response by both is a combination of the following
a) The crisis is temporary and will pass. If there is a need we will sell later.
b) We can’t accept these fire sale prices.
c) There must be another option. Please investigate and report back.
This happens especially when the liquidity policy process was run as a compliance checklist and did not run its full course at the board and executive management level. If a full blown liquidity simulation was run for the board and the senior management team and if they had seen for themselves the consequences of speed as well as delay such reaction don’t happen. The board and the senior team must understand that illiquid assets are equivalent of high explosives and delay in asset sale is analogous to a short fuse. When you combine the two with a name crisis you will blow the bank irrespective of its history or the power of its franchise. When the likes of Bear, Lehman, Merrill, AIG and Morgan failed, your bank and your board is not going to see through the crisis to a different and pleasant fate.
Standard & Poor’s started including an evaluation of insurers’ enterprise risk management in its ratings in late 2005. Companies that fared well under the stick of ERM evaluation there was the carrot of potentially lower capital requirements. On 24 January, S&P published the basis for an economic capital review and adjustment process and announced that the process was being implemented immediately.
The ERM review is still the key. Insurers must already have a score from their ERM review of “strong” or “excellent” before they are eligible for any consideration of their capital model. That strong or excellent score implies that those firms have already passed S&P’s version of the Solvency II internal mode use test — which S&P calls strategic risk management (SRM). Those firms with the strong and excellent ERM rating will all have their economic capital models reviewed.
The new name for this process is the level III ERM review. The level I review is the original ERM process that was initiated in 2005. The level II process, started in 2006, is a more detailed review that S&P applies to firms with high levels of risk and/or complexity. That level II review included a more detailed look at the risk control processes of the firms.
The new level III ERM review looks at five aspects of the economic capital model: methodology, data quality, assumptions and parameters, process/execution and testing/validation.
There are three news items about changes to approach by two rating agencies and a regulator.
AM Best announced that they were adding two pages of ERM questions to their Supplemental Ratings Questionnaire (SRQ)
S&P announced that they are now going forward with reviewing internal capital models for consideration in their view of capital adequacy.
The IAIS has adopted an Insurance Core Principal (ICP 16) that requires that all insurance regulators adopt requirements that insurers should perform an Own Risk and Solvency Assessment (ORSA) and the NAIC will be starting to announce their plans for compliance with this in mid-February.
The place for insurers to stand and ignore ERM is shrinking quickly.
But Riskviews has noticed that when you talk people in the insurance industry about ERM, there are at least three different topics that they think about:
Economic Capital Modeling – a large fraction of people think that ERM means Economic Capital modeling. So when they hear that rating agency or regulator wants to hear about ERM, they might say that they do not have one, so there is nothing to talk about. The S&P announcement confirms their belief. They read the Best SRQ questions and only see the spots that require numbers, completley ignoring as unimportant the parts about culture.
Compliance with rating agency or regulatory requirements. These three news items are strong motivators for those who think that ERM is compliance. These folks had heard AM Best asking about ERM, but saw no outcome from that process so they eventually lost interest in ERM themselves. Now they are back to being interested. The ORSA idea is confusing to these folks, because they already are doing their compliance regarding capital adequacy. The ORSA seems like redundant regulation to them. They do not see the shift of responsibility from the regulator to the board and management that is fundamental to the ORSA idea.
Management decision making. These firms are using ERM to enhance their decision making processes. They hear these announcements and are annoyed at the additional distraction from the real risk management. Some of them will not change what they are doing at all to enhance their “score” with the rating agencies or regulators. There is too much of the firm;s real value at stake to risk changing their risk management program to suit these outsiders who do not know much about the company or its risks.
The news comes in threes and the reactions comes in threes as well.
Role of Own Risk and Solvency Assessment in Enterprise Risk Management
Insurance companies tend to look backwards to see if there was enough capital for the risks that were present then. It is important for insurance companies to be forward looking and assess whether enough capital is in place to take care risks in the future. Though it is mandatory for insurance firms to comply with solvency standards set by regulatory authorities, what is even more important is the need for top management to be responsible for certifying solvency. Performing Own Risk and Solvency Assessment (ORSA) is the key for the insurance industry.
Global Convergence of ERM Regulatory requirements with NAIC adoption of ORSA regulations
Importance of evaluating Enterprise Risk Management for ORSA
When to do an ORSA and what goes in an ORSA report?
Global ERM Webinars – January 12 – 14 (CPD credits)
We are pleased to announce the fourth global webinars on risk management. The programs are a mix of backward and forward looking subjects as our actuarial colleagues across the globe seek to develop the science and understanding of the factors that are likely to influence our business and professional environment in the future. The programs in each of the three regions are a mix of technical and qualitative dissertations dealing with subjects as diverse as regulatory reform, strategic and operational risks, on one hand, and the modeling on tail risks and implied volatility surfaces, on the other. For the first time, and in keeping with our desire to ensure a global exchange of information, each of the regional programs will have presentations from speakers from the other two regions on subjects that have particular relevance to their markets.
Criticisms of risk managers for not anticipating some emerging future are overdone. When a major unexpected loss happens, everyone missed it.
Risk managers do not have any special magic ball. The future is just as dim to us as to everyone else.
Sometimes we forget that. Our methods seem to be peering into the future.
But that is not really correct. We are not looking into the future. Not only do we not know the future, we do not even know the likelihood of various future possibilities, the probability distribution of the future.
That does not make our work a waste of time. However.
What we should be doing with our models is to write down clearly that view of the future that we use to base our decisions upon.
You see, everyone who makes a decision must have a picture of the future possibilities that they are using to weigh the possibilities and make that decision. Most people cannot necessarily articulate that picture with any specificity. Management teams try to make sure that they are all working with similar visions of the future so that the sum of all their decisions makes sense together.
But one of the innovations of the new risk management discipline is to provide a very detailed exposition of that picture of the future.
Unfortunately, many risk managers are caught up in the mechanics of creating the model and they fail to recognize the extreme importance of this aspect of their work. Risk Managers need to make sure that the future that is in their model IS the future that management wants to use to base their decisions upon. The Risk Manager needs to understand whether he/she is the leader or the follower in the process of identifying that future vision.
If the leader, then there needs to be an explicit discussion where the other top managers affirm that they agree with the future suggested by the Risk Manager.
If the follower, then the risk manager will first need to say back to the rest of management what they are hearing to make sure that they are all on the same page. They might still want to present alternate futures, but they need to be prepared to have those visions heavily discounted in decision making.
The Risk Managers who do not understand this process go forward developing their models based upon their best vision of the future and are frustrated when management does not find their models to be very helpful. Sometimes, the risk manager presents their models as if they DO have some special insight into the future.
My vision of the future is that path will not succeed.
It is easy to blame CROs (Chief Risk Officers) and ERM (Enterprise Risk Management) for the impact of the crisis on companies, but such blame is often unfair and disingenuous. In few companies did CROs have the power to prevent the execution of strategies that, although fraught with risk, were pursued to deliver on investor profit expectations and management incentive targets.
The primary objective of crisis mitigation must be to realign risk exposures with risk bearing capital and to improve capital adequacy. Realigning exposures with capital (and implied “risk capacity”) enhances insurance strength ratings and the confidence of investors and customers. Without such confidence, a company’s business and franchise would erode rapidly.
In response to the present crisis, many companies improved capital adequacy by (a) cutting expenses, (b) decreasing dividend payments, (c) discontinuing share repurchase programs, and (d) selling assets and non-strategic operating subsidiaries, all to preserve or increase capital. There are few buyers during a crisis, however, and so divestitures and asset sales are at lower prices than in normal times (e.g. sale of HSB Group by AIG) and are therefore very expensive sources of capital.
Realignment strategies also involve retrenchment from businesses with substandard returns on capital. Typical outcomes are: (a) sales of blocks of business and renewal rights, (b) cessation of certain coverage types, (c) sales of entire subsidiaries, (d) changes in underwriting limits, terms, and exclusions, (e) reinsurance strategies, etc. ERM risk analysis models provide a basis for assessing the relationship between capital needs and value contributions of various businesses. Without that assessment, it is hard to align risk exposures with available capital.
Estimates of capital requirements based on risk measures over a one-year horizon (typical of solvency regulations) are not credible during a crisis because they assume that fresh “recovery” capital can be raised. Rating agencies, regulators, and investors, however, know that many solvent companies cannot raise fresh capital during a crisis. Capital is only adequate if it can sustain the company’s operations on a “going concern” basis in the absence of access to recovery capital, but with credit for capital generated internally.
Companies need robust insights from ERM to assess their capital needs (on or off balance sheet, including contingent capital) and to develop effective mitigation strategies. Their ERM must:
Measure capital consumption by activity and risk type
Identify the relative value creation of individual businesses, with appropriate recognition for differences in risk
Demonstrate the impact and future value creation of alternative retrenchment strategies
Through such ERM informed views of capital utilization, capital adequacy, and value creation, insurance companies can chart effective strategies to restore their capital adequacy and mitigate the impact of crises.
It seems that Solvency II is perfectly designed to reproduce the conditions that led US banks to believe that they were impervious to risks. They and the regulators believed that they knew what they were doing with regard to Risks and Risk Management.
In 2004, the US Federal Reserve allowed investment banks to cut their capital levels by 2/3, tripling their potential leverage! Not to worry, they knew how to manage risk.
European insurers are all being told that they need to have economic capital models to manage risks. A few firms have had these models for more than five years now. Those models tell us that those firms can reduce their capital by a third or more.
But everyone leaves out of their thinking two important things that will always happen.
The first is called the Peltzman effect by economists. John Adams calls it the Risk Thermostat effect. In both cases, it means that when people feel risk decreasing due to safety measures, they often respond by increasing the riskiness of their behaviors. So the success of Solvency II will make some firms feel safer and some of them will take additional risks because of that.
The second effect is what I call the Law of Risk and Light. That says that you will accumulate risks wherever you are not looking out for them. So anywhere that there is a flaw in the Economic Capital model, the activity that accentuates that flaw will look like the best, most desirable business to be in.
But read Maggid’s post. He provides some actual analysis to support his argument.
In the recent post, Rational Adaptability, four types of ERM programs are mentioned. One of those four types of ERM is Risk Steering.
If you ask most actuaries who are involved in ERM, they would tell you that Risk Steering IS Enterprise Risk Management.
Standard & Poor’s calls this Strategic Risk Management:
SRM is the Standard & Poor’s term for the part of ERM that focuses on both the risks and returns of the entire firm. Although other aspects of ERM mainly focus on limiting downside, SRM is the process that will produce the upside, which is where the real value added of ERM lies. The insurer who is practicing SRM will use their risk insights and take a portfolio management approach to strategic decision making based on analysis that applies the same measure for each of their risks and merges that with their chosen measure of income or value. The insurer will look at the possible combinations of risks that it can take and the earnings that it can achieve from the different combinations of risks taken, reinsured, offset, and retained. They will undertake to optimize their risk-reward result from a very quantitative approach.
For life insurers, that will mean making strategic trade-offs between products with credit, interest rate, equity and insurance risks based on a long-term view of risk-adjusted returns of their products, choosing which to write, how much to retain and which to offset. They will set limits that will form the boundaries for their day-to-day decision-making. These limits will allow them to adjust the exact amount of these risks based on short-term fluctuations in the insurance and financial markets.
For non-life insurers, SRM involves making strategic trade-offs between insurance, credit (on reinsurance ceded) and all aspects of investment risk based on a long-term view of risk-adjusted return for all of their choices. Non-life SRM practitioners recognize the significance of investment risk to their total risk profile, the degree or lack of correlation between investment and insurance risks, and the fact that they have choices between using their capacity to increase insurance retention or to take investment risks.
Risk Steering is very similar to Risk Trading, but at the Total Firm level. At that macro level, management will leverage the risk and reward information that comes from the ERM systems to optimize the risk reward mix of the entire portfolio of insurance and investment risks that they hold. Proposals to grow or shrink parts of the business and choices to offset or transfer different major portions of the total risk positions can be viewed in terms of risk adjusted return. This can be done as part of a capital budgeting / strategic resource allocation exercize and can be incorporated into regular decision making. Some firms bring this approach into consideration only for major ad hoc decisions on acquisitions or divestitures and some use it all of the time.
There are several common activities that may support the macro level risk exploitation:
Economic Capital. Realistic risk capital for the actual risks of the company is calculated for all risks and adjustments are made for the imperfect correlation of the risks. Identification of the highest concentration of risk as well as the risks with lower correlation to those higher concentration risks is the risk information that can be exploited. Insurers will find that they have a competitive advantage in adding risks to those areas with lower correlation to their largest risks. Insurers should be careful to charge something above their “average” risk margin for risks that are highly correlated to their largest risks. In fact, at the macro level as with the micro level, much of the exploitation results from moving away from averages to specific values for sub classes.
Capital Budgeting. The capital needed to fulfill proposed business plans is projected based on the economic capital associated with the plans. Acceptance of strategic plans includes consideration of these capital needs and the returns associated with the capital that will be used. Risk exploitation as described above is one of the ways to optimize the use of capital over the planning period.
Risk Adjusted Performance Measurement (RAPM). Financial results of business plans are measured on a risk-adjusted basis. This includes recognition of the economic capital that is necessary to support each business as well as the risk premiums and loss reserves for multi-period risks such as credit losses or casualty coverages.
Risk Adjusted Compensation. An incentive system that is tied to the risk exploitation principles is usually needed to focus attention away from other non-risk adjusted performance targets such as sales or profits. In some cases, the strategic choice with the best risk adjusted value might have lower expected profits with lower volatility. That will be opposed strongly by managers with purely profit related incentives. Those with purely sales based incentives might find that it is much easier to sell the products with the worst risk adjusted returns. A risk adjusted compensation situation creates the incentives to sell the products with the best risk adjusted returns.
A fully operational risk steering program will position a firm in a broad sense similarly to an auto insurance provider with respect to competitors. There, the history of the business for the past 10 years has been an arms race to create finer and finer pricing/underwriting classes. As an example, think of the underwriting/pricing class of drivers with brown eyes. In a commodity situation where everyone uses brown eyes to define the same pricing/underwriting class, the claims cost will be seen by all to be the same at $200. However, if the Izquierdo Insurance Company notices that the claims costs for left-handed, brown-eyed drivers are 25% lower than for left handed drivers, and then they can divide the pricing/underwriting into two groups. They can charge a lower rate for that class and a higher rate for the right handed drivers. Their competitors will generally lose all of their left handed customers to Izquierdo, and keep the right handed customers. Izquierdo will had a group of insureds with adequate rates, while their competitors might end up with inadequate rates because they expected some of the left-handed people in their group and got few. Their average claims costs go up and their rates may be inadequate. So Izquierdo has exploited their knowledge of risk to bifurcate the class, get good business and put their competitors in a tough spot.
Risk Steering can be seen as a process for finding and choosing the businesses with the better risk adjusted returns to emphasize in firm strategic plans. Their competitors will find that their path of least resistance will be the businesses with lower returns or higher risks.
JP Morgan in the current environment is showing the extreme advantage of macro risk exploitation. In the subprime driven severe market situation, JP Morgan has experienced lower losses than other institutions and in fact has emerged so strong on a relative basis that they have been able to purchase several other major financial institutions when their value was severely distressed. And by the way, JP Morgan was the firm that first popularized VaR in the early 1990’s, leading the way to the development of modern ERM. However, very few banks have taken this approach. Most banks have chosen to keep their risk information and risk management local within their risk silos.
This is very much an emerging field for non-financial firms and may prove to be of lower value to them because of the very real possibility that risk and capital is not the almost sole constraint on their operations that it is within financial firms as discussed above.
Sometimes quants who get involved with building new economic capital models have the opinion that their work will reveal the truth about the risks of the group and that the best approach is to just let the truth be told and let the chips fall where they may.
Then they are completely surprised that their project has enemies within management. And that those enemies are actively at work undermining the credibility of the model. Eventually, the modelers are faced with a choice of adjusting the model assumptions to suit those enemies or having the entire project discarded because it has failed to get the confidence of management.
But that situation is actually totally predictable.
That is because it is almost a sure thing that the first comprehensive and consistent look at the group’s risks will reveal winners and losers. And if this really is a new way of approaching things, one or more of the losers will come as a complete surprise to many.
The easiest path for the managers of the new loser business is to undermine the model. And it is completely natural to find that they will usually be completely skeptical of this new model that makes their business look bad. It is quite likely that they do not think that their business takes too much risk or has too little profits in comparison to their risk.
In the most primitive basis, I saw this first in the late 1970’s when the life insurer where I worked shifted from a risk approach that allocated all capital in proportion to reserves to one that recognized the insurance risk as well as the investment risk as two separate factors. The term insurance products suddenly were found to be drastically underpriced. Of course, the product manager of that product was an instant enemy of the new approach and was able to find many reasons why capital shouldn’t be allocated to insurance risk.
The same sorts of issues had been experienced by firms when they first adopted nat cat models and shifted from a volatility risk focus to a ruin risk focus.
What needs to be done to diffuse these sorts of issues, is that steps must be taken to separate the message from the messenger. There are 2 main ways to accomplish this:
The message about the new level of risks needs to be delivered long before the model is completed. This cannot wait until the model is available and the exact values are completely known. Management should be exposed to broad approximations of the findings of the model at the earliest possible date. And the rationale for the levels of the risk needs to be revealed and discussed and agreed long before the model is completed.
Once the broad levels of the risk are accepted and the problem areas are known, a realistic period of time should be identified for resolving these newly identified problems. And appropriate resources allocated to developing the solution. Too often the reaction is to keep doing business and avoid attempting a solution.
That way, the model can take its rightful place as a bringer of light to the risk situation, rather than the enemy of one or more businesses.
The companies that withstood the crisis and are now poised for continuing success have been disciplined about holding sufficient capital. However, the issue of how much capital an insurance company should hold beyond requirements set by regulators or rating agencies is contentious.
Many insurance executives hold the view that a company with a reputation for using capital productively on behalf of shareholders would be able to raise additional capital rapidly and efficiently, as needed to execute its business strategy. According to this view, a company would be able to hold just as much “solvency” capital as it needs to protect itself over a one year horizon from risks associated with the run off of in-force policies plus one year of new business. In this framework, the capital need is calculated to enable a company to pay off all its liabilities, at a specified confidence level, at the end of the one year period of stress, under the assumption that assets and liabilities are sold into the market at then prevailing “good prices”. If more capital were needed than is held, the company would raise it in the capital market.
Executives with a “going concern” perspective do not agree. They observe first that solvency capital requirements increase with the length of the planning horizon. Then, they correctly point out that, during a crisis, prices at which assets and liabilities can be sold will not be “good times” prices upon which the “solvency” approach is predicated. Asset prices are likely to be lower, perhaps substantially, while liability prices will be higher. As a result, they believe that the “solvency” approach, such as the Solvency II framework adopted by European regulators, understates both the need for and the cost of capital. In addition, these executives remember that, during crises, capital can become too onerous or unavailable in the capital market. They conclude that, under a going concern assumption, a company should hold more capital, as an insurance policy against many risks to its survival that are ignored under a solvency framework.
The recent meltdown of debt markets made it impossible for many banks and insurance companies to shore up their capital positions. It prompted federal authorities to rescue AIG, Fannie Mae and Freddie Mac. The “going concern” view appears to have been vindicated.
Directors and CEOs have a fiduciary obligation to ensure that their companies hold an amount of capital that is appropriate in relation to risks assumed and to their business plan. Determining just how much capital to hold, however, is fraught with difficulties because changes in capital held have complex impacts about which reasonable people can disagree. For example, increasing capital reduces solvency concerns and the strength of a company’s ratings while also reducing financial leverage and the rate of return on capital that is being earned; and conversely.
Since Directors and CEOs have an obligation to act prudently, they need to review the process and analyses used to make capital strategy decisions, including:
Economic capital projections, in relation to risks assumed under a going concern assumption, with consideration of strategic risks and potential systemic shocks, to ensure company survival through a collapse of financial markets during which capital cannot be raised or becomes exceedingly onerous
Management of relationships with leading investors and financial analysts
Development of reinsurance capacity, as a source of “off balance sheet” capital
Management of relationships with leading rating agencies and regulators
Development of “contingent” capital capacity.
The integration of risk, capital and business strategy is very important to success. Directors and CEOs cannot let actuaries and finance professionals dictate how this is to happen, because they and the risk models they use have been shown to have important blind spots. In their deliberations, Directors and CEOs need to remember that models cannot reflect credibly the impact of strategic risks. Models are bound to “miss the point” because they cannot reflect surprises that occur outside the boundaries of the closed business systems to which they apply.
In the 1980’s a dozen or more firms in the US and Canadian Life Insurance sector created and used what were commonly called required surplus systems. Dale Hagstrom wrote a paper that was published in 1981, titled Insurance Company Growth . That paper described the process that many firms used of calculating what Dale called Augmented Book Profits. An Augmented Book Profit later came to be called Distributable Earnings in insurance company valuations. If you download that paper, you will see on page 40, my comments on Dale’s work where I state that my employer was using the method described by Dale.
In 1980, in the first work that I was able to affix my newly minted MAAA, I documented the research into the risks of Penn Mutual Life Insurance Company that resulted in the recommendation of the Required Surplus, what we would now call the economic capital of the firm. By the time that Dale’s paper was published in 1981, I had documented a small book of memos that described how the company would use a capital budgeting process to look at the capital utilized by each line of business and each product. I was the scribe, the ideas come mostly from the Corporate Actuary, Henry B. Ramsey. We created a risk and profit adjusted new business report that allowed us to show that with each new product innovation, our agents immediately shifted sales into the most capital intensive or least profitable product. It also showed that more and more capital was being used by the line with the most volatile short term profitability. Eventually, the insights about risk and return caused a shift in product design and pricing that resulted in a much more efficient use of capital.
Each year, throughout the 1980’s, we improved upon the risk model each year, refining the methods of calculating each risk. Whenever the company took on a new risk a committee was formed to develop the new required surplus calculation for that risk.
In the middle of the decade, one firm, Lincoln National, published the exact required surplus calculation process used by their firm in the actuarial literature.
By the early 1990’s, the rating agencies and regulators all had their own capital requirements built along the same lines.
AND THEN IT HAPPENED.
Companies quickly stopped allocating resources to the development and enhancement of their own capital models. By the mid-1990’s, most had fully adopted the rating agency or regulatory models in the place of their own internal models.
When a new risk came around, everyone looked into how the standard models would treat the new risk. It was common to find that the leading writers of a new risk were taking the approach that if the rating agency and regulatory capital models did not assess any capital to the new risk, then there was NO RISK TO THE FIRM.
Companies wrote more and more of risks such as the guaranteed minimum benefits for variable annuities and did not assess any risk capital to those risks. It took the losses of 2001/2002 for firms to recognize that there really was risk there.
Things are moving rapidly in the direction of a repeat of that same exact mistake. With the regulators and rating agencies more and more dictating the calculations for internal capital models and proscribing the ERM programs that are needed, things are headed towards the creation of a risk management regime that focuses primarily on the management of regulatory and rating agency perception of risk management and away from the actual management of risks.
This is not what anyone in the risk management community wants. But once the regulatory and rating agency visions of economic capital and ERM systems are fully defined, the push will start to limit activity in risk evaluation and risk management to just what is in those visions – away from the true evaluation of and management of the real risks of the firm.
It will be clear that it is more expensive to pursue the elusive and ever changing “true risk” than to satisfy the fixed and closed ended requirements that anyone can read. Budgets will be slashed and people reassigned.
The ERM Symposium is now 8 years old. Here are some ideas from the 2010 ERM Symposium…
Survivor Bias creates support for bad risk models. If a model underestimates risk there are two possible outcomes – good and bad. If bad, then you fix the model or stop doing the activity. If the outcome is good, then you do more and more of the activity until the result is bad. This suggests that model validation is much more important than just a simple minded tick the box exercize. It is a life and death matter.
BIG is BAD! Well maybe. Big means large political power. Big will mean that the political power will fight for parochial interests of the Big entity over the interests of the entire firm or system. Safer to not have your firm dominated by a single business, distributor, product, region. Safer to not have your financial system dominated by a handful of banks.
The world is not linear. You cannot project the macro effects directly from the micro effects.
Due Diligence for mergers is often left until the very last minute and given an extremely tight time frame. That will not change, so more due diligence needs to be a part of the target pre-selection process.
For merger of mature businesses, cultural fit is most important.
For newer businesses, retention of key employees is key
Modelitis = running the model until you get the desired answer
Most people when asked about future emerging risks, respond with the most recent problem – prior knowledge blindness
Regulators are sitting and waiting for a housing market recovery to resolve problems that are hidden by accounting in hundreds of banks.
Why do we think that any bank will do a good job of creating a living will? What is their motivation?
We will always have some regulatory arbitrage.
Left to their own devices, banks have proven that they do not have a survival instinct. (I have to admit that I have never, ever believed for a minute that any bank CEO has ever thought for even one second about the idea that their bank might be bailed out by the government. They simply do not believe that they will fail. )
Economics has been dominated by a religious belief in the mantra “markets good – government bad”
Non-financial businesses are opposed to putting OTC derivatives on exchanges because exchanges will only accept cash collateral. If they are hedging physical asset prices, why shouldn’t those same physical assets be good collateral? Or are they really arguing to be allowed to do speculative trading without posting collateral? Probably more of the latter.
it was said that systemic problems come from risk concentrations. Not always. They can come from losses and lack of proper disclosure. When folks see some losses and do not know who is hiding more losses, they stop doing business with everyone. None do enough disclosure and that confirms the suspicion that everyone is impaired.
Systemic risk management plans needs to recognize that this is like forest fires. If they prevent the small fires then the fires that eventually do happen will be much larger and more dangerous. And someday, there will be another fire.
Sometimes a small change in the input to a complex system will unpredictably result in a large change in the output. The financial markets are complex systems. The idea that the market participants will ever correctly anticipate such discontinuities is complete nonsense. So markets will always be efficient, except when they are drastically wrong.
Conflicting interests for risk managers who also wear other hats is a major issue for risk management in smaller companies.
People with bad risk models will drive people with good risk models out of the market.
Inelastic supply and inelastic demand for oil is the reason why prices are so volatile.
It was easy to sell the idea of starting an ERM system in 2008 & 2009. But will firms who need that much evidence of the need for risk management forget why they approved it when things get better?
If risk function is constantly finding large unmanaged risks, then something is seriously wrong with the firm.
You do not want to ever have to say that you were aware of a risk that later became a large loss but never told the board about it. Whether or not you have a risk management program.
Many are concerned about what the “Use Test” will be. Will it be a pop quiz or will companies be allowed to study?
Well, I have a suggestion for a simple and, I believe, fairly foolproof test. That would be for top management (not risk management or modeling staff) to be able to hold a conversation about their risk profile each year.
Now the first time that they can demonstrate that would not be the “Use Test”. It would be the second or third time that would constitute the test.
The conversation would be simple. It would involve explaining the risk profile of the firm – why the insurer is taking each of the major risks, what do they expect to get out of that risk exposure and how are they making sure that the potential losses that they experience are not worse than represented by their risk model. This discussion should include recognition of gross risk before offsets as well as net retained risk.
After the first time, the discussion would include an explanation of the reasons for the changes in the risk profile – did the profile change because the world shifted or did it change due to a deliberate decision on the part of management to take more or less or to retain more or less of a risk.
Finally a third part of the discussion would be to identify the experience of the past year in terms of its likelihood as predicted by the model and the degree to which that experience caused the firm to recalibrate its view of each risk.
To pass the test, management would merely need to have a complete story that is largely consistent from year to year.
Those who fail the test would be making large changes to their model calibration and their story from year to year – stretching to make it look like the model information was a part of management decisions.
Some firms who might have passed before the crisis who should have failed were firms who in successive years told the same story of good intentions with no actions in reducing outsized risks.
For firms who are really using their models, there will be no preparation time needed for this test. Their story for this test will be the story of their firm’s financial management.
Ideally, I would suggest that the test be held publicly at an investor call.
Risk management is sometimes summarized as a short set of simply stated steps:
Identify Risks
Evaluate Risks
Treat Risks
There are much more complicated expositions of risk management. For example, the AS/NZ Risk Management Standard makes 8 steps out of that.
But I would contend that those three steps are the really key steps.
The middle step “Evaluate Risks” sounds easy. However, there can be many pitfalls. A new report [CARE] from a working party of the Enterprise and Financial Risks Committee of the International Actuarial Association gives an extensive discussion of the conceptual pitfalls that might arise from an overly narrow approach to Risk Evaluation.
The heart of that report is a discussion of eight different either or choices that are often made in evaluating risks:
MARKET CONSISTENT VALUE VS. FUNDAMENTAL VALUE
ACCOUNTING BASIS VS. ECONOMIC BASIS
REGULATORY MEASURE OF RISK
SHORT TERM VS. LONG TERM RISKS
KNOWN RISK AND EMERGING RISKS
EARNINGS VOLATILITY VS. RUIN
VIEWED STAND-ALONE VS. FULL RISK PORTFOLIO
CASH VS. ACCRUAL
The main point of the report is that for a comprehensive evaluation of risk, these are not choices. Both paths must be explored.
I question whether sufficient attention is being paid to the definition of risk in most risk measures and in solvency II. In this case the use of 1-year VAR. Insurance companies makes long term promises as compared to other financial institutions. Yet we have seen the inadequacies of this risk measure for these other institutions. 1-year VAR is based on the assumption that if a company can survive a year it can re-capitalize. The credit crisis has shown that in a period of economic distress when it is most likely that many companies will be “in the tail” the ability to re-capitalize is suspect if non-existent. Companies such as, Lehman Brothers, Northern Rock, AIG and INDYMac could not re-capitalize. Bear Stearns, Merrill Lynch and WaMU required government support to facilitate the sale of their liabilities.
I believe one of the lessons of the credit crisis is that is that either the 1-year VAR analysis needs to reflect the potential drying up of capital during a tail event or insurance companies need to re-think the 1-year VAR measure. US Risk Based Capital, while an imperfect measure, has had ruin theory as its fundamental premise. This measure has held up well as most US life insurance operating companies maintained sufficient capital to survive to the point where it was possible to re-capitalize
Economic capital models can be complex, embodying many component parts and it may not be immediately obvious that a complex model works satisfactorily. Moreover, a model may embody assumptions about relationships between variables or about their behaviour that may not hold in all circumstances (e.g under periods of stress). We have developed an algorithm for Dynamic Financial Analysis (DFA) that enables the creation of a comprehensive framework to manage Enterprise Risk’s Economic Risk Capital. DFA is used in the capital budgeting decision process of a company to launch a new invention and predict the impact of the strategic decision on the balance sheet in the horizon. DFA gives strategy for Enterprise Risk Management in order to avoid undesirable outcomes, which could be disastrous.
“The Quants know better than anyone how their models can fail. The surest way to replicate this adversity is to trust the models blindly while taking large-scale advantage of situations where they seem to provide ERM strategies that would yield results too superior to be true”
Dynamic Financial Analysis (DFA) is the most advance modelling process in today’s property and casualty industry-allowing us to develop financial forecasts that integrate the variability and interrelationships of critical factors affecting our results. Through the modeling of DFA, we see the company’s relevant random variables is based on the categorization of risks which is generated solvency testing where the financial position of the company is evaluated from the perspective of the customers. The central idea is to quantify in probabilistic terms whether the company will be able to meet its commitments in the future. DFA is in the capital budgeting decision process of a company launching a new invention and predicting the impact of the strategic decision on the balance sheet in a horizon of few years.
The validation of economic capital models is at a very preliminary stage. There exists a wide range of validation techniques, each of which provides corroboration for (or against) only some of the desirable properties of a model. Moreover, validation techniques are powerful in some areas such as risk sensitivity but not in other areas such as overall absolute accuracy or accuracy in the tail of the loss distribution. It is advisable that validation processes are designed alongside development of the models rather than chronologically following the model building process. There is a wide range of validation processes and each one provides evidence for only some of the desirable properties of a model. Certain industry validation practices are weak with improvements needed in benchmarking, industry wide exercises, back-testing, profit and loss analysis and stress testing and followed by other advanced simulation model. For validation we adhere to the below mentioned method to calculate.
Calculation of risk measures
In their internal use of risk measures, banks need to determine an appropriate confidence level for their economic capital models. It generally does not coincide with the 99.9% confidence level used for credit and operational risk under Pillar 1 of Basel II or with the 99% confidence level for general and specific market risk. Frequently, the link between a bank’s target rating and the choice of confidence level is interpreted as the amount of economic capital necessary to prevent the bank from eroding its capital buffer at a given confidence level. According to this view, which can be interpreted as a going concern view, capital planning is seen more as a dynamic exercise than a static one, in which banks want to hold a capital buffer “on top” of their regulatory capital and where it is the probability of eroding such a buffer (rather than all available capital) that is linked to the target rating. This would reflect the expectation (by analysts, rating agencies and the market) that the bank operates with capital that exceeds the regulatory minimum requirement. Apart from considerations about the link to a target rating, the choice of a confidence level might differ based on the question to be addressed. On the one hand, high confidence levels reflect the perspective of creditors, rating agencies and regulators in that they are used to determine the amount of capital required to minimise bankruptcy risk. On the other hand, use of lower confidence levels for management purposes in order to allocate capital to business lines and/or individual exposures and to identify those exposures that are critical for profit objectives in a normal business environment. Another interesting aspect of the internal use of different risk measures is that the choice of risk measure and confidence level heavily influences relative capital allocations to individual exposures or portfolios. In short, the farther out in the tail of a loss distribution, the more relative capital gets allocated to concentrated exposures. As such, the choice of the risk measure as well as the confidence level can have a strategic impact since some portfolios might look relatively better or worse under risk-adjusted performance measures than they would based on an alternative risk measure.
…different and potentially much more difficult issues arise in the identification and measurement of risks where past experience is an uncertain or potentially misleading guide. When risk materialises, it may do so as a risk previously thought to be understood and managed that turns out to be very different indeed, and may do so quickly, well within normal audit cycles. The valuation of an asset or liability in a stressed market environment and the identification of other potential risks that may not previously have been encountered pose major questions for real-time assessment that are unlikely to have been factored into construction of the pre-existing business model.
Excerpt from the Walker Review
To survive such situations, it seems that the ability to quickly assess new situations, especially ones that look like old tried and true but that are seriously more dangerous, and to change what the organization is doing in response to these risks is key.
But to do that, significant amounts of senior resources must be dedicated to determining whether such risks are NOW in the environment each and every day. The findings of this review must be taken very seriously and the organization must consider the possibility of changing course – not just a minor correction – a major change of business activity.
In addition to the discernment to identify such situations, the organization must cultivate the capacity to make such changes quickly and effectively.
An organization that can do those things have true adaptability and have a much better chance of survival.
However, for a business to be very profitable, it needs to be very focused, very efficient. Everyone in the organization needs to be pointed in the same direction. Doubt will undermine.
Within capitalism, the conflict is resolved by allowing individual businesses to maximize profits and relying on an assumption that there will be enough diversity of businesses that enough businesses will have chosen the right business model for the new environment. Some of the most successful businesses from the old environment will fail to adapt, but some of the laggards will now thrive.
And therefore, the system survives.
But, that is not always so. In some circumstances, too many firms choose the exact same strategy. If the environment stays unchanging for too long, individual firms lose any adaptability that they might have had, they all become specialists in that one “most profitable thing”. A major change in the environment and too many businesses fail too fast.
How does that happen?
Regulators play a large role. The central bankers work very hard to keep the environment on a steady course, moderating the bumps that encourage diversity.
Prudential and risk management regulation also play a large role, forcing everyone to pay attention to the exact same risks and encouraging similar risk treatments through capital regime incentives.
So for the system to remain healthy, it needs adaptability and adaptability comes from diversity. And diversity will not exist unless the environment is more variable. There needs to be diversity in terms of both business strategy and interms of risk management approaches.
So improving the prudential regulation will have the effect of driving everyone to have the same risk management – it will have the perverse effect of diminishing the likelihood of survival of the system.
Learn how to cut to the core of ERM and identify those elements your strategic plan cannot live without. Gain confidence in your knowledge on ERM by attending this can’t-miss worldwide webcast.
The Casualty Actuarial Society (CAS), The Faculty and Institute of Actuaries (UK), Joint Risk Management Section(JRMS), the Institute of Actuaries of Japan (IAJ), the Institute of Actuaries of Australia(IAAust) and The Society of Actuaries (SOA) present the Global Best Practices in ERM for Insurers and Reinsurers Webcast.
December 1, 2009 Session times vary depending upon location. Speakers from three different regions (Asia Pacific, Europe and North and South America) will provide their own unique perspective on four topics affecting ERM around the world:
Value Creation vs. Systemic Risk Consider some of the concerns around systemic risk and the drivers of value creation that have come under close attention by virtue of their links to systemic risk. The Asia Pacific Region will include a discussion of pension schemes.
Different approaches to ERM and Capital Models Learn how different stakeholders including insurers, banks, regulators and rating agencies are approaching the development of an ERM / ECM framework.
Economic Capital Models Focus on the processes associated with designing, calibrating, validating and the updating of internal models based on bringing new information and intelligence as they arise.
Governance, Strategic Risk and Operational Risk Discuss issues such as ERM governance, tools and techniques to assess strategic and operational risks and their integration into an overall ERM framework.
NEW THIS YEAR! Earn up to 18.0 Continuing Professional Development credits by participating in all four sessions in each region! And with each session presented in at either a basic or advanced level, there is no reason to miss this important global event.
Not listening to your CRO – having him too low down the management chain;
Hiring a CEO who “doesn’t want to hear bad news”;
Not linking the Board tolerance for risk to the risk management practices of the company;
Having the CRO report to the CFO instead of to the CEO or Board, i.e., not having a system of checks and balances in place regarding risk practices;
The board not leading the risk management charge;
Not communicating the risk management goals;
Not driving the risk management culture down to the lower levels of the organization;
Ignorance is not Bliss
Not doing your own risk evaluations;
Not expecting the unexpected;
Overreacting to risks that turn out to be harmless;
Don’t shun the risk you understand, only to jump into a risk you don’t understand;
Failure to pay attention to actual risk exposure in the context of risk appetite;
Using outsider view of how much capital the firm should hold uncritically;
Cocksureness
Believing your risk model;
The opinion held by the majority is not always the right one;
There can be several logical, but contradictive explanations for one sequence of events, and logical doesn’t mean true;
We do not have perfect information about the future, or even the past and present;
Don’t use old normal assumptions to model in the new normal;
Arrogance of quantifying the unquantifiable;
Not believing your risk model – waiting until you have enough evidence to prove the risk is real;
Not Seeing the Big Picture
Making major changes without heavy involvement of Risk Management;
Conflict of interest: not separating risk taking and risk management;
Disconnection of strategy and risk management: Allocating capital blindly without understanding the risk-adjusted value creation;
One of the biggest mistakes has to be thinking that you can understand the risks of an enterprise just by looking at the components of risk and “adding them up” – the complex interactions between factors are what lead to real enterprise risk;
Looking at risk using one single measure;
Measuring and reporting risks is the same as managing risks;
Risk can always be measured;
Fixation on Structure
Thinking that ERM is about meetings and org charts and capital models and reports;
Think and don’t check boxes;
Forgetting that we are here to protect the organization against risks;
Don’t let an ERM process become a tick-box exercise;
Not taking a whole company view of risk management;
Nearsightedness
Failing to seize historic opportunities for reform, post crisis;
Failure to optimize the corporate risk-return profile by turning risk into opportunity where appropriate;
Don’t be a stop sign. Understand the risks AND REWARDS of a proposal before venturing an opinion;
Talking about ERM but never executing on anything;
Waiting until ratings agencies or regulatory requirements demand better ERM practices before doing anything;
There is no obstacle so difficult that, with sufficient thought, cannot be turned into an opportunity;
No opportunity so assured that, with insufficient thought, cannot be turned into a disaster;
Do not confuse trauma with learning;
Using a consistent discipline to search for opportunities where you are paid to accept risk in the context of the entire entity will move you toward an optimized position. Just as important is using that discipline to avoid “opportunities” where this is not the case.
undertake positive NPV projects
risk comes along with these projects and should be priced in the NPV equation
the price of risk is the lesser of the external cost of disposal (e.g., hedging) or the cost of retention “in the context of the entire entity”;
also hidden in these words is the need to look at the marginal impact on the entity of accepting the risk. Am I better off after this decision than I was before? A silo NPV may not give the same answer for all firms/individuals;
What is important is the optimization journey, understanding it as a goal we will never achieve;
More Skin in the Game
Misalign the incentives;
Most people will act based on their financial incentives, and that certainly happened (and continues to happen) over the past couple of years. Perhaps we could include one saying that no one is peer reviewing financial incentives to make sure they don’t increase risk elsewhere in the system;
Not tying risk management practices to compensation;
Not aligning risk management goals with compensation;
Some good and not so good parts to this conference. Hosted by Courant Institute of Mathematical Sciences, it was surprisingly non-quant. In fact several of the speakers, obviously with no idea of what the other speakers were doing said that they were going to give some relief from the quant stuff.
Sad to say, the only suggestion that anyone had to do anything “different” was to do more stress testing. Not exactly, or even slightly, a new idea. So if this is the future of risk management, no one should expect any significant future contributions from the field.
There was much good discussion, but almost all of it was about the past of risk management, primarily the very recent past.
Here are some comments from the presenters:
Banks need regulator to require Stress tests so that they will be taken seriously.
Most banks did stress tests that were far from extreme risk scenarios, extreme risk scenarios would not have been given any credibility by bank management.
VAR calculations for illiquid securities are meaningless
Very large positions can be illiquid because of their size, even though the underlying security is traded in a liquid market.
Counterparty risk should be stress tested
Securities that are too illiquid to be exchange traded should have higher capital charges
Internal risk disclosure by traders should be a key to bonus treatment. Losses that were disclosed and that are within tolerances should be treated one way and losses from risks that were not disclosed and/or that fall outside of tolerances should be treated much more harshly for bonus calculation purposes.
Banks did not accurately respond to the Spring 2009 stress tests
Banks did not accurately self assess their own risk management practices for the SSG report. Usually gave themselves full credit for things that they had just started or were doing in a formalistic, non-committed manner.
Most banks are unable or unwilling to state a risk appetite and ADHERE to it.
Not all risks taken are disclosed to boards.
For the most part, losses of banks were < Economic Capital
Banks made no plans for what they would do to recapitalize after a large loss. Assumed that fresh capital would be readily available if they thought of it at all. Did not consider that in an extreme situation that results in the losses of magnitude similar to Economic Capital, that capital might not be available at all.
Prior to Basel reliance on VAR for capital requirements, banks had a multitude of methods and often used more than one to assess risks. With the advent of Basel specifications of methodology, most banks stopped doing anything other than the required calculation.
Stress tests were usually at 1 or at most 2 standard deviation scenarios.
Risk appetites need to be adjusted as markets change and need to reflect the input of various stakeholders.
Risk management is seen as not needed in good times and gets some of the first budget cuts in tough times.
After doing Stress tests need to establish a matrix of actions that are things that will be DONE if this stress happens, things to sell, changes in capital, changes in business activities, etc.
Market consists of three types of risk takers, Innovators, Me Too Followers and Risk Avoiders. Innovators find good businesses through real trial and error and make good gains from new businesses, Me Too follow innovators, getting less of gains because of slower, gradual adoption of innovations, and risk avoiders are usually into these businesses too late. All experience losses eventually. Innovators losses are a small fraction of gains, Me Too losses are a sizable fraction and Risk Avoiders often lose money. Innovators have all left the banks. Banks are just the Me Too and Avoiders.
T-Shirt – In my models, the markets work
Most of the reform suggestions will have the effect of eliminating alternatives, concentrating risk and risk oversight. Would be much safer to diversify and allow multiple options. Two exchanges are better than one, getting rid of all the largest banks will lead to lack of diversity of size.
Problem with compensation is that (a) pays for trades that have not closed as if they had closed and (b) pay for luck without adjustment for possibility of failure (risk).
Counter-cyclical capital rules will mean that banks will have much more capital going into the next crisis, so will be able to afford to lose much more. Why is that good?
Systemic risk is when market reaches equilibrium at below full production capacity. (Isn’t that a Depression – Funny how the words change)
Need to pay attention to who has cash when the crisis happens. They are the potential white knights.
Correlations are caused by cross holdings of market participants – Hunts held cattle and silver in 1908’s causing correlations in those otherwise unrelated markets. Such correlations are totally unpredictable in advance.
National Institute of Financa proposal for a new body to capture and analyze ALL financial market data to identify interconnectedness and future systemic risks.
If there is better information about systemic risk, then firms will manage their own systemic risk (Wanna Bet?)
Proposal to tax firms based on their contribution to gross systemic risk.
Stress testing should focus on changes to correlations
Treatment of the GSE Preferred stock holders was the actual start of the panic. Leahman a week later was actually the second shoe to drop.
Banks need to include variability of Vol in their VAR models. Models that allowed Vol to vary were faster to pick up on problems of the financial markets. (So the stampede starts a few weeks earlier.)
Survival. That is what you really want to know. When the Board meeting ends, the last thing that they should hear is management assuring them that the company will be in business still when the next meeting is due to be held.
S
But it really is not in terms of bankruptcy, or even regulatory take-over. If your firm is in the assurance business, then the company does not necessarily need to go that far. There is usually a point, that might be pretty far remote from bankruptcy, where the firm loses confidence of the market and is no longer able to do business. And good managers know exactly where that point lies.
S
So S is the likelihood of avoiding that point of no return. It is a percentage. Some might cry that no one will understand a percentage. That they need dollars to understand. But VAR includes a percentage as well. Just because no one says the percentage, that does not mean it is there. It actually means that no one is even bothering to try to help people to understand what VAR is. The VAR nuber is really one part of a three part sentence:
The 99% VAR over one-year is $67.8 M. By itself, VAR does not tell you whether the firm has trouble. If the VAR doubles from one period to the next, is the firm in trouble? The answer to that cannot be determined without further information.
S
Survival is the probability that, given the real risks of the firm and the real capital of the firm, the firm will sustain a loss large enough to put an end to their business model. If your S is 80%, then there is about 50% chance that your firm will not survive three years!But if your S is 95%, then there is a 50-50 chance that your firm will last at least 13 years. This arithmetic is why a firm, like an insurer, that makes long term promises, need to have a very high S. An S of 95% does not really seem high enough.
S
Survival is something that can be calculated with the existing VAR model. Instead of focusing on a arbitrary probability, the calculation instead focuses on the loss that management feels is enough to put them out of business. S can be recalculated after a proposed share buy back or payment of dividends. S responds to management actions and assists management decisions.
If your board asks how much risk you are taking, try telling them the firm has a 98.5% Survival probability. That might actually make more sense to them than saying that the firm might lose as much as $523 M at a 99% confidence interval over one year.
In the last ten years, we have had major problems from Credit, Natural Catastrophes and Equities all at least twice. Looking around at the risk exposures of insurers, it seems that we are due for a fall on Interest Rate Risk.
And things are very well positioned to make that a big time problem. Interest rates have been generally very low for much of the past decade (in fact, most observers think that low interest rates have caused many of the other problems – perhaps not the nat cats). This has challenged the minimum guaranteed rates of many insurance contracts.
Interest rate risk management has focused primarily around lobbying regulators to allow lower minimum guarantees. Active ALM is practiced by many insurers, but by no means all.
Rates cannot get much lower. The full impact of the historically low current risk free rates (are we still really using that term – can anyone really say that anything is risk free any longer?) has been shielded form some insurers by the historically high credit spreads. As the economy recovers and credit spreads contract, the rates could go slightly lower for corporate credit.
But keeping rates from exploding as the economy comes back to health will be very difficult. The sky high unemployment makes it difficult to predict that the monetary authorities will act to avoid overheating and the sharp rise of interest rates.
Calibration of ALM systems will be challenged if there is an interest rate spike. Many Economic Capital models are calibrated to show a 2% rise in interest rates as a 1/200 event. It seems highly likely that rates could rise 2% or 3% or 4% or more. How well prepared will those firms be who have been doing diciplined ALM with a model that tops out at a 2% rise? Or will the ALM actuaries be the next ones talking of a 25 standard deviation event?
Is there any way that we can justify calling the next interest rate spike a Black Swan?
Everything needs to balance. A requirement that management understand the model creates and equal and opposite obligation on the part of the modelers to really explain the assumptions that are embedded in the model and the characteristics that the model will exhibit over time.
This means that the modelers themselves have to actually understand the assumptions of the model – not just the mechanical assumptions that support the mechanical calculations of the model. But the fundamental underlying assumptions about why the sort of model chosen is a reliable way to represent the world.
For example, one of the aspects of models that is often disturbing to senior management is the degree to which the models require recalibration. That need for recalibration is an aspect of the fundamental nature of the model. And I would be willing to guess that few modelers have in their explanation of their model fully described that aspect of their model and explained why it exists and why it is a necessary aspect of the model.
That is just an example. We modelers need to understand all of these fundamental points where models are simply baffling to senior management users and work to overcome the gap between what is being explained and what needs to be explain.
We are focused on the process. Getting the process right. If we choose the right process and follow it correctly, then the result should be correct.
But the explanations that we need are about why the choice of the process made sense in the first place. And more importantly, how, now that we have followed the process for so long that we barely remember why we chose it, do we NOW believe that the result is correct.
What is needed is a validation process that gets to the heart of the fundamental questions about the model that are not yet known! Sound frustrating enough?
The process of using risk models appropriately is an intellectual journey. There is a need to step past the long ingrained approach to projections and models that put models in the place of fortune tellers. The next step is to begin to find value in a what-if exercise. Then there is the giant leap of the stochastic scenario generator. Many major conceptual and practical leaps are needed to move from (a) getting a result that is not reams and reams of complete nonsense to (b) getting a result that gives some insight into the shape of the future to (c) realizing that once you actually have the model right, it starts to work like all of the other models you have ever worked with with vast amount of confirmation of what you already know (now that you have been doing this for a couple of years) along with an occasional insight that was totally unavailable without the model.
But while you have been taking this journey of increasing insight, you cross over and become one of those who you previously thought to talk mostly in riddles and dense jargon.
But to be fully effective, you need to be able to explain all of this to someone who has not taken the journey.
The first step is to understand that in almost all cases they do not give a flip about your model and the journey you went throughto get it to work.
The next step is to realize that they are often grounded in an understanding of the business. For each person in your management team, you need to understand which part of the business that they are grounded in and convince them that the model captures what they understand about the part of the business that they know.
Then you need to satisfy those whse grounding is in the financials. For those folks, we usually do a process called static validation – show that if we set the assumptions of the model to the actual experience of last year, that the model actually reproduces last year’s financial results.
Then you can start to work on an understanding of the variability of the results. Where on the probability spectrum was last year – both for each element and for the aggregate result.
That one is usually troublesome. For 2008, it was particularly troublesome for any firms that owned any equities. Most models would have placed 2008 stock market losses almost totally off the charts.
But in the end, it is better to have the discussion. It will give the management users a healthy skepticism for the model and more of an appreciation for the uses and limitations of the entire modeling methodology.
These discussions should lead to understanding and balance. Enough understanding that there is a balanced view of the model. Not total reliance and not total skepticism.
The above was the title of a conference in London that I attended this week. Here are some random take-aways:
Sometimes it makes sense to think of risk indicators instead of risk limits.
Should MVM reflect diversification? But who’s diversification?
Using a Risk and Control Self Assessment as the central pillar to an Operational Risk program
Types of Operational Losses: Financial, Reputation, Opportunity, Inefficiency
Setting low thresholods for risk indicators/KRIs provides an early warning of the development of possible problems
Is your risk profile stable? Important question to consider.
Number of employees correlates to size of operational risk losses. May be a simple way to start thinking about how to assign different operational risk capital to different operations. Next variable might be experience level of employees – might be total experience or task specific experience. If a company goes into a completely new business, there are likely to be operational issues if they do not hire folks with experience from other firms.
Instead of three color indicators, use four – Red, Orange(Amber), Yellow, Green. Allows for elevating situations out of green without raising alarm.
Should look at CP33
Controls can encourage more risk taking. (See John Adams work on seatbelts)
Disclosures of safety margin in capital held might create market expectations that would make it impossible to actually use those margins as a buffer without market repercussions.
Serious discussions about a number of ways that firms want to deviate from using pure market values. Quite a shift from the discussions I heard 2 -3 years ago when strict adherence to market values was a cornerstone of good financial and risk management. As Solvency 2 is getting closer to reality, firms are discovering some ways that the MTM regime would fundamentally change the insurance business. People are starting to wonder how important it is to adhere to MTM for situations where liquidity needs are very low, for example.
Times vary by location. Program runs for 18 hours to allow for daytime viewing in all locations.
Location:
This webcast takes place via the Internet. At your location.
Speakers from Europe, Americas and Asia-Pacific areas.
ERM is a unique field that is developing in all parts of the world at more or less the same time; therefore it is a new practice area where a global actuarial community of practitioners is developing. The webcast includes speakers from Europe and Asia/Pacific, as well as the Americas, and allows risk officers to share emerging risk management practices across different geographical regions.
The objective of this webcast is to provide the global actuarial community with new and emerging enterprise risk management (ERM) practices from different geographical regions. This webcast will include speakers from Asia/Pacific, Europe and the Americas offering insight into ERM best practices.
The webcast objectives
Disseminating and promoting global ERM best practices to the actuarial community
Offering accessible information about ERM to actuaries
Facilitating the discussion of practical and theoretical ERM issue and possible solutions
Promoting global standards of best practices in ERM
Who Should Attend
Actuaries who are currently practicing in the ERM area within Insurers or consultancies and
Actuaries and actuarial students who wish to get exposed to ERM practices so they can participate in ERM programs at insurers in the future
Riskviews 