Thursday, Oct 15, 2015

Enterprise Risk Management for Insurers

Overview^[1]

Enterprise risk management (ERM) is a critical pillar of corporate governance. It is a holistic approach to risk management that takes into account the correlations and dependencies of risks across all the core activities of an insurer.

A robust ERM framework enables insurers to better identify, measure, accept, control, report, and monitor all material risks. To be effective, the ERM framework must be embedded in business operations, and aligned with an insurer’s corporate culture and strategic goals.

An insurance supervisor’s role is to check that insurers’ boards of directors exercise effective oversight of their risk management functions as part of their corporate governance frameworks. Specifically, the board of directors of an insurer is ultimately accountable for implementing ERM tailored to the nature, scale, and complexity of its business and risk profiles.

The supervisor’s assessment of the effectiveness of insurers’ risk management is a key component of a risk-based supervision framework. To do this, supervisors need to have a good understanding of risks arising from insurance operations and different risk profiles of insurers. This allows them to adopt a principles-based approach, instead of one-size-fits-all rules. Such an approach minimizes unnecessary regulatory burden for insurers with lower risk profiles while providing regulatory incentives to those with large and complex operations to take additional measures to mitigate higher risks.

Enterprise Risk Management

Enterprise risk management is a process, effected by an entity’s board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.^[2]

Scope and Benchmarking

Insurance supervisors in many jurisdictions deal with insurers with multiple regional and/or global operations. Effective risk management addresses the risk profiles of insurers consistently across jurisdictions. In this regard, it is useful to benchmark against international best practices including supervisory standards issued by the International Association of Insurance Supervisors (IAIS).

This note highlights sources of key risks arising from insurance operations and the international standards and best practices of risk response strategies, within the context of an ERM framework. It is not intended to provide a comprehensive guide on the implementation of an effective ERM framework.

Risk management is a wide topic. For better focus, this note covers only the qualitative aspects of risk management, i.e., the conceptual framework, principles, policies, systems, and processes. The objective is to provide a broad overview of ERM from the supervisory perspective. Each of the risk factors outlined is worthy of detailed technical discussions. This note does not deal with specific risk measurement issues and quantitative aspects of risk management, e.g., pros and cons of using value-at-risk or modeling.

Overview of Insurance Operations

To assess the appropriateness and effectiveness of insurers’ risk management frameworks, supervisors must have a good understanding of the operating environment of insurers, insurers’ core activities, as well as sound corporate governance practices that are tailored to the nature, scale and complexities of their operations.

Core Activities of Insurance Operations

Business/Product Development

To support sustainable business growth, an insurer typically conducts market analysis, research, or surveys to identify emerging trends and opportunities, in line with its business strategies and competitive positioning.

Information and market intelligence gathered are useful inputs for designing new products or updating existing policies to better meet the clients’ needs. Some products may be withdrawn or re-priced due to unfavourable sales or claims experience.

In approving the introduction of new products, the board of directors and senior management should consider the:

• Scope and level of coverage including options and guarantees (for life insurance)
• Acceptability of the risk exposure in relation to the established risk strategies
• Appropriateness of pricing methodology, including the underlying assumptions
• Suitability of the proposed distribution channel(s)
• Robustness of underwriting criteria and guidelines
• Availability of reinsurance protection
• Feasibility of related investment strategy
• Projection of profitability and impact on solvency under different scenarios
• Adequacy of existing system and resources to administer the new product
• Relevance and frequency of product reviews, including criteria for re-pricing or withdrawal.

Pricing and Policy Terms

Insurers formulate pricing methodologies to ensure that they charge premium rates that are commensurate with the risks accepted and adequate to pay sales and other policy-related expenses and taxes, plus provide a profit margin.

The risks accepted reflect the terms and coverage of the policies and policy exclusions. Different premium rating methodologies may apply to each product. Different risk categories within the same product are subject to different premium rates in accordance with the underwriting guidelines. In practice, the actual insurance premium rates charged may differ from the technically-derived rates due to market and competitive considerations.

Actuarial inputs are important in the pricing process, especially for life insurance. Insurers may use pricing models as part of a systematic approach to pricing. For new products with little historical experience globally or where there is inadequate statistical analysis, multiple pricing models may be used to check for reasonableness.

Insurance Cycle

Non-life insurance and reinsurance businesses are susceptible to swings in pricing and profitability, driven by forces of demand and supply. The cycles typically average between five to seven years.

When the industry achieves profitable results, new entrants are attracted and existing players may take the opportunity to increase their market share. This may result in excess supply, i.e., (re)insurance capacity and, consequently, competitive price-cutting and more lenient policy terms drive down profitability.

As the industry loses money, some insurers leave the market while others raise their rates to sustain their operations, tighten policy terms or impose restrictions on coverage. For reinsurance, the cycle may be affected by catastrophic events such as earthquakes or hurricanes.

As profitability improves, the cycle repeats.

Distribution and Marketing

An insurer may distribute its products via various channels, including:

• Agents who act on behalf of an insurer under agency agreements
• Brokers and independent financial advisors who act for their clients, i.e., policyholders
• Bancassurance,, i.e., tie up with banks to sell insurance products by bank staff
• Direct marketing through in-house sales staff or through the internet or mass-mailing.

To promote professional conduct, an insurer establishes policies, systems, and procedures to ensure that its sales force:

• Meets appropriate recruitment criteria including minimum academic and professional qualifications
• Is properly trained on the concept of insurance, specific product knowledge and relevant regulatory requirements
• Complies with know-your-client requirements
• Properly conducts needs analysis and recommends only policies that meet clients’ needs
• Does not engage in unprofessional conduct, particularly in respect of life policies, such as misrepresentation of policy benefits, non-disclosure of investment risks, churning, improper switching, twisting, bogus policies, etc.

A professional insurer has policies and controls to check that information presented in its marketing materials and policy documentation are clear and in plain language; adequate for clients to make informed decisions; and not false or misleading. It is a good practice for an insurer who markets products using direct mailers or the internet to offer clients an opportunity to seek advice from its representative before committing to the purchase.

New Business and Underwriting

Underwriting is the assessment of an application from a prospective insured to decide whether to accept the risk and, if so, on what terms. Management of moral hazard is critical, as insurance has an inherent risk of anti-selection, e.g., those in poor health are more prone to buy a life policy.

Insurers design application forms to obtain essential underwriting information based on the type of policies, to suit the nature and scope of coverage. A prudent insurer establishes clear underwriting guidelines, risk and retention limits and authority levels.

For life insurance, the medical condition, life style and occupation of the prospective insured are the basic underwriting considerations. Life style includes factors such as drinking, smoking, or pursuit of hazardous sports. The underwriting criteria for non-life insurance vary according to the type of risks. In more complicated cases, surveys may be conducted to evaluate the risks, e.g., survey of a factory to check how it manages fire hazards in underwriting fire insurance.

Reinsurance

An insurer may accept risks that exceed its retention limits by transferring the excess to another insurer/reinsurer through reinsurance. These could be arranged on a treaty or facultative basis.

Increasingly, insurers use alternative risk-transfer mechanisms such as insurance-linked securitisation and finite reinsurance to control their risk exposures.

Reinsurance may be handled by the underwriting or actuarial function or by a separate reinsurance function, depending on the scale and complexity of the business. The process generally involves:

• Formulating a reinsurance strategy, aligned with established risk philosophy and appetite
• Documenting policies and procedures to implement the reinsurance strategy
• Underwriting and retention limits
• Policy on the use of different forms of reinsurance, e.g., treaty vs. Facultative, proportional vs. Non-proportional and use of alternative risk transfer mechanisms
• Criteria to select reinsurers, and list of approved reinsurers and their limits
• Diversification of reinsurance counterparties
• Identifying sources and magnitudes of risk concentrations
• Impact of catastrophic events
• Monitoring the availability and cost of reinsurance
• Reporting of and accounting for reinsurance transactions, including reporting of large claims and cash call
• Assessing the adequacy and effectiveness of reinsurance programs.

Claims Processing

The claims process involves:

• Acknowledging and registering claims notified by policyholders and third-party claimants
• Assessing the validity of the claims against policy documents and conditions; requesting additional information or documents to support the claim, where appropriate. If a claim is not valid, informing the claimant of the grounds for rejection
• Determining the amounts payable for valid claims
• Setting case reserves based on initial assessment
• Appointing adjusters, seeking legal opinion or advising reinsurers of large claims, as appropriate
• Ascertaining whether there are reinsurance or third-party recoveries and communicating with the relevant parties
• Approving claim payment and reporting to the finance function
• Reviewing and updating case reserves, based on additional information or progress in claims handling, on a regular basis
• Closing claim files upon satisfactory resolution of the claim, based on proper authorization.

Investment Management

Insurance business operates in the manner of an “inverse production cycle”, i.e., the majority of premiums are received well before the payment of benefits (or claims) is due. Income and capital gains derived from the investment of premium revenue contribute to the overall operating results of an insurer

Prudent investment management in line with business and risk strategy is the foundation of an insurer’s asset-liability management (ALM), which in turn is critical to its ERM. Some insurers manage all their investments in-house while others may sometimes outsource part or even a significant portion of their funds to be managed by external fund managers. Nonetheless, an insurer cannot outsource its responsibility for ALM. This means the insurer has to take full account of its asset positions regardless of whether these are managed in-house or outsourced.

Insurers typically implement policies and controls to ensure compliance with regulatory requirements or restrictions on their investments; monitoring and controlling of outsourced funds; proper accounting and valuation of investment transactions and positions; and safe custody of assets including documents evidencing title to assets.

Financial and Solvency Management

The finance function is responsible for the proper maintenance of the insurer’s books and records. As an insurer is a custodian of policyholders’ monies, its financial statements must present a true and fair view of its operations and should comply with the relevant statutory reporting requirements. There should be adequate audit trails for the accounts to be readily audited by external auditors and examined by insurance supervisors.

For long-term sustainability and to meet regulatory requirements, insurers should manage their solvency condition on an on-going basis. In this regard, the prevailing international best practice is the move towards risk-based solvency regimes. The objective is to provide regulatory incentives to promote robust risk management by insurers. Such a regime typically addresses all material risks arising from insurance operations, i.e., underwriting, credit, market, operational and liquidity risks. Insurance supervisors should be empowered to require insurers to hold additional capital or reduce their risks to ensure the financial soundness of insurers.

Internal Checks and Balances

Risk Management Function

Insurance is the business of pooling of risk among a large group of people so that each one will not be financially devastated by the occurrence of the risk. Therefore, insurers must have good understanding of the risks they underwrite and adopt sound risk management practices that are appropriate for the nature, scale and complexities of their businesses. The larger insurers with more complex operations usually have dedicated risk management functions and have well-documented group risk-management policies.

Internal Audit Function

An insurer should establish an independent internal audit function with a clear scope of responsibilities appropriate for the risk profile of the insurer. Some insurers may outsource their internal audits.

The internal audit function should report directly to the board of directors and may report administratively to the CEO. Increasingly, insurers establish audit committees of the board of directors, where majority of the audit committee members are independent from management or business associates. The board and/or the audit committee are responsible for reviewing the adequacy of internal controls and ensuring the effectiveness of the internal audit function.

The internal auditor should have unfettered access to the audit committee, the board of directors and senior management.

Compliance Function

There is an emerging trend for insurers to establish a separate compliance function to manage compliance risks which may expose an insurer to severe regulatory interventions such as suspension or termination of business and cause legal and reputational damages.

The essential elements of an effective compliance function include:

• A compliance program approved by senior management that spells out the roles and responsibilities of the compliance function and the compliance audit schedule
• Formalised compliance work procedures, processes and tools
• Independent reporting lines to management
• Sufficient resources
• Active involvement of management on the findings of the compliance audits
• Formalised guidelines on how instances of non-compliance would be dealt with.

Enterprise Risk Management

Introduction

This sections examines how ERM strengthens the resilience of insurers to significant risk exposures.

As mentioned above, an insurer must have proper ALM, i.e., managing its assets and liabilities in a coordinated manner. ERM goes beyond ALM by taking an enterprise-wide perspective and integrated approach to ensure long-term sustainability, enhance shareholder value, and safeguard the interests of policyholders.

ERM facilitates a holistic assessment of all risk exposures of an insurer. It provides an objective and consistent approach for an insurer to better understand its risk profile and manage its risks. By adopting a common risk language across diverse business units, an insurer can take into account the correlations and dependencies across different financial products and risk types.

Why is ERM Important to Insurers and Regulators?

Evolution of ERM

For about a decade, financial institutions including insurers have been moving away from the traditional silo approach to risk management. For example, the underwriting and claims systems and processes of an insurer might have been managed separately and not linked or different systems could have been used for different lines of business. In reality, there is a strong correlation between underwriting and claims. The emerging trend towards ERM has been partly driven by regulators and rating agencies.

The financial meltdown in 2007 is another lesson on how unexpected risk exposures and poorly managed risks can bring down financial institutions, both large and small. The bailing out of American International Group, Inc. (AIG) illustrated how a non-regulated entity exposed the entire insurance group to financial ruin.

Going forward, stakeholders in the global financial market will demand that financial institutions better understand their risks and improve their skills in managing them. A properly implemented ERM program is no longer an option but a necessity.

Why Is It Important to Insurers?

From an insurer’s viewpoint, an ERM program:

• Provides an integrated and comprehensive assessment of all material risks arising from its operations. This gives a clearer picture of its overall risk profile, taking into account the correlations and dependencies across different risk types, products and services.
• Presents a rigorous framework that facilitates an objective and consistent approach to manage risks across business units. ERM serves as a common language and view of risk throughout the enterprise to derive a realistic risk profile.
• Aligns its risk profile with its business strategies and risk appetite. The risks faced by various business units, including new products and services, can be assessed using common parameters and evaluated against strategic goals.
• Considers a full range of risks and potential events to minimize surprises while allowing calculated risks to be taken to proactively seize opportunities.

Why Is It Important to Regulators?

Insurance supervisors expect insurers to implement risk management practices that are commensurate with the scale, nature and complexities of their operations. Assessment of insurers’ risk management is a vital component of a risk-based supervisory regime.

In formulating a Common Structure for the Assessment of Insurer Solvency, the IAIS has adopted a total balance sheet approach. The objective is “to recognise the interdependence between assets, liabilities, capital requirements and capital resources and to ensure that risks are fully and appropriately recognised”. In particular, an insurer’s solvency should be assessed based on its overall financial position using consistent measurement of assets and liabilities and explicit identification and measurement of the impact of all material risks on its balance sheet.

The IAIS also recognises that ERM provides a link between the ongoing operational management of risk and longer-term business goals and strategies and has issued a Guidance Paper on Enterprise Risk Management for Capital Adequacy and Solvency Purposes.

Conceptual Framework of ERM

Introduction

There are two dimensions to ERM – the types of risks and the risk management process. Later sections of this note will provide more information of the key risk types for insurance operations.

The ERM process encompasses:

• Articulating risk strategies and promoting a positive risk culture
• Designing a risk governance structure
• Comprehensive and robust risk identification, assessment, and measurement
• Formulating a spectrum of risk response options
• Implementing risk control policies and procedures
• Monitoring and reporting.

ERM is a reiterative process and should be responsive to changes in internal and external operating environment including emerging new risks. The ERM framework should also incorporate a feedback loop to ensure the ERM is operating as intended by the board and senior management. The feedback loop allows the ERM to be updated in response to changes in risk, leading to changes in risk management policy, tolerance limits and risk mitigating actions. This will allow an insurer to better identify its strengths and weaknesses in risk governance and management.

Risk Strategies and Culture

The board of directors is responsible and accountable for establishing an insurer’s risk appetite and risk tolerance, both qualitative, and quantitative. The risk strategy should take into consideration its business objectives as well as financial and other resources, including expertise.

Increasingly, the challenge for the board is to proactively take leadership of an insurer’s risk strategy in a dynamic landscape driven by technology advances, globalization and financial innovation. The board sets the tone of an insurer’s risk culture through its top-down corporate culture, integrity and ethical value system. This shapes the philosophy and attitude towards how risk is viewed and addressed by management and staff. It is important to encourage robust discussions on difficult risk issues even in good times.

Given the multitude of risks that an insurer has to deal with, it is common for the board to focus a selected number of top risks which are subject to active board oversight. As it is impossible for the board to deal with all risks, the board should play a key role in promoting a pervasive risk-aware culture throughout the enterprise and an environment conducive to sustaining this culture.

Risk Governance Structure

An insurer should design its risk governance structure to suit its risk profile. The overriding principle is that the structure should facilitate effective board and management oversight and implementation of effective controls and processes.

The risk governance structure includes:

• Clear roles and accountabilities – authority level and limits, mandate of risk management function
• Adequate resources – headcount, skills, experience and competence; financial resources to implement proper processes, controls and documentation; information and knowledge management systems; and training
• Appropriate standing of the risk management function and access to the board or relevant board committees
• Role of senior management, risk-management committee (if established), internal audit and compliance functions
• Independence of risk management function from operational units
• Measures to address potential conflicts of interest and incompatible functions, e.g., proper segregation of pricing and underwriting, underwriting and claims handling, reporting of claims independent of underwriting function.

Risk Identification, Assessment, and Measurement

An insurer should ensure that its ERM is designed to identify and address all potentially material risks, including insurance risk, credit risk, market risk, operational risk and liquidity risk. These are the risk categories used in the IAIS’s structure for assessing an insurer’s solvency. The ERM framework considers the causes and impact of risks from internal and external sources and assesses the relationships among risk exposures.

A discussion of each of the five key risk categories is elaborated in subsequent sections of this note.

Risk Response Options

The options in managing risks include eradicating the sources of risks, avoidance, hedging or risk transfers (changing the probability or impact of risks), conscious decision to retain risks or even to assume higher risks to take advantage of perceived business opportunities.

Management and business units select the appropriate risk responses, within the broad parameters of the risk strategy and appetite established by the board, taking account of an insurer’s financial capacity to absorb unexpected losses. An insurer should be aware of any limitations of the methods it uses to manage risks and the potential impact these limitations may have, and adapt its risk management appropriately.

It is also important to recognise that risk response measures do not eliminate all risks, e.g., reinsurance reduces insurance risks but increases credit risks. In fact, ERM provides only reasonable assurance that an insurer operates in a way that is aligned with its strategies and objectives. The ultimate outcome may be affected by faulty management judgment, unintentional errors, fraud or collusion.

Risk Policies and Procedures

An insurer’s established risk strategy and tolerance limits should be embedded in its ongoing operations in the form of risk management policies and procedures.

Risk management policy should outline how each category of risk is to be addressed, e.g., reinsurance strategy and policies including diversification of reinsurance security, maximum probable loss, and use of financial derivatives. Clear and well documented processes must be in place to monitor, control and mitigate (or accept) risks. It is important to build automatic checks to detect deviations from limits as well as escalation and reporting procedures for exceptions.

To remain relevant, risk policies and procedures should be regularly reviewed and updated to reflect changing business and operating environment. Amendments to existing policies and procedures should also be properly documented and approved.

Risk Monitoring and Reporting

ERM should be supported by an effective management information system to facilitate monitoring and reporting of pertinent risk information to the board and management. The information flow should be both top-down and bottom-up as well as across the enterprise. Effective communication is critical for promoting common understanding and a consistent approach to dealing with risks.

A successful ERM program includes regular progress reports, comparisons against previous risk assessments and assessment of effectiveness of risk response options. These are important inputs into the feedback loop to facilitate refinements and to keep pace with evolving circumstances.

Monitoring Emerging Risks

An effective ERM program should be forward-looking and take account of an insurer’s external operating environment. This includes monitoring high growth/profitability areas to assess emerging risks arising from expansion in unfamiliar markets or venturing into new initiatives that tend to pose higher risks, e.g., a subsidiary engaging in non-insurance investment activities.

Key Risk Concepts

Risk-Return Trade-Off

A fundamental principle for efficient financial risk management is the risk-return trade-off, i.e., higher risk assumed should be compensated by an increase in potential returns. Insurers have to strike a balance between risk and returns, in line with their risk appetite and strategy.

Recognizing the risk-return trade-off, an insurer takes into consideration how much risk is involved in achieving the returns to arrive at the risk-adjusted returns. This provides a common basis for comparison across investment instruments or products to assess relative performance.

Diversification                             

Diversification refers to combining risks that are not fully correlated to reduce the overall level of risk of an investment portfolio or insurance portfolio, with the objective of maintaining or improving the rate of return. The assumption is that not all risks will materialize at the same time, particularly if the risk triggers are independent from each other.

The benefits of diversification may arise:

• At different levels of business operations, e.g., geographical diversification through establishment of branches or subsidiaries (e.g., risk from natural disasters)
• Between risk factors – reducing the insurance risk of a portfolio through reinsurance (assuming credit risk)
• Within a risk factor, e.g., spreading credit risk exposure to reinsurance counterparties by having a number of reinsurers.

Most risk exposures are partly diversifiable and partly non-diversifiable. For example, increasing the size of the motor insurance portfolio is expected to lower the volatility of the claim experience as the law of large numbers works better by pooling a larger number of independent homogenous risks. However, the risk of inflation on average claim cost remains as it is cannot be reduced by writing more policies. Similarly, investing in the shares of different companies may reduce the volatility of the portfolio performance but prices of all shares (or even across asset classes) may fall sharply at the same time in the event of a market meltdown.

Systemic risks are non-diversifiable, as demonstrated by the 2008-09 Global Financial Crisis. Furthermore, correlations between different risk factors tend to break down when a market is in distress.

Volatility of Insurance Portfolios

Under the risk-based solvency regime adopted in Singapore, volatilities of different lines of non-life insurance business are factors considered in estimating insurers’ technical provisions. Examples of the broad volatility categories used are:

Volatility category	Lines of business
Low	Personal accident Health Fire
Medium	Marine and aviation — cargo Motor Property Workmen’s compensation Bonds Engineering construction all risk/erection all risk Credit or political risk Other – non-liability classes
High	Marine and aviation — hull Professional indemnity Public liability Other – liability classes

 

Role of Stress Testing and Scenario Analysis

Why Stress-Test?

Stress testing is a technique used to determine the financial resilience of an insurer. The simplest form of stress testing is “sensitivity testing”, which examines the financial impact when the insurer experiences shocks from one risk factor at a time, such as stock market declines of 30 per cent, or claims volume increases of 50 per cent. As its name suggests, the purpose of sensitivity testing is to assess how sensitive the company’s financial condition is to various risk factors.

“Scenario testing” is another stress testing technique. It involves testing the financial condition of the insurer when the insurer experiences shocks from a number of risk factors at the same time due to the occurrence of an event. For example, a severe hurricane results in high volume of property and liability claims, while on the asset side, equity prices suffer a downturn and the liquidity squeeze drives up interest rates.

Stress testing plays an important role in:

• Providing a forward-looking assessment of risk
• Overcoming the limitations of models which assign little weight to extreme conditions as they occur rarely
• Feeding into liquidity and capital planning procedures
• Setting an insurer’s risk tolerance
• Facilitating the development of risk mitigation or contingency plans across a range of stressed conditions.

Involvement of the board of directors and senior management is critical in ensuring the appropriate use of stress testing as part of an ERM program. Their involvement should include setting test objectives, defining scenarios, discussing the results, assessing potential actions and deciding suitable measures to counteract any adverse consequences.

Creating Scenarios

In general, scenarios are used to assess extreme but possible situations, which have a significant impact on an insurer’s financial position. Before creating scenarios, it is necessary first to define the events that might lead to financial distress for the insurer. Examples of an event could be a natural disaster such as an earthquake, a stock market crash, or a flu pandemic.

From a specific event, different scenarios might emerge. In a pandemic event, one possible scenario might be a 50 per cent increase in mortality rates, a 200 per cent increase in incidence of hospitalization, a 25 per cent decline in stock market prices, and a 1 per cent decrease in bond yields. Another possible scenario might be a 50 per cent increase in new business coupled with adverse mortality and morbidity experience, and a downgrading of the insurer’s own credit rating leading to a higher cost of raising capital to finance the new business strain.

Scenarios can be based on observed historical events, such as the 2000-01 stock market crash, the 1918-19 Spanish flu pandemic, or the 2004 Pacific tsunami. Realism is the advantage of using historical events. However, in using historical scenarios, considerations must be given to changes resulting from:

• Technological advancements, especially in the medical fields
• Globalized and increasingly inter-connected financial markets
• Population movements
• New asset classes, particularly in the area of synthetic derivatives.

Insurance Risks

Product Features and Terms

Controlling Risk through Product Design

Insurance is a promise to pay when certain contracted events occur. Therefore, a major source of risk to an insurer is in the promises made, that is, the terms of the insurance contract.

Product features can be used to manage adverse selection and fraud, and to keep insurance affordable and viable. For example, exclusion of pre-existing medical conditions is a common feature in healthcare policies. Likewise, exclusion of suicides during the first few policy years is common in a life insurance policy. These are features designed to prevent adverse selection by policyholders. Otherwise, the insurance premium rates might be too low to keep the insurers financially sound, or would need to be too high to make the products marketable.

While proper product features serve as an effective risk management tool, care should be taken that they do not become discriminatory or unfair. For example, the right for an insurer to increase renewal premium rates on a guaranteed renewable healthcare policy should not be used as a means to force a policyholder to cancel by charging exceedingly high premium rates.

Embedded Options and Guarantees

Long-term products often have built-in options and guarantees. Some life insurance policies offer minimum interest rates, minimum death benefits, guaranteed rates to convert insurance proceeds into annuities, or various options upon surrender of a policy. The variable annuity market is dominated by products with all types of guarantees: guaranteed minimum income benefit, guaranteed minimum death benefit, and guaranteed lifetime withdrawal benefit, for example.

Historically, many of these embedded options and guarantees were included in the policy without being explicitly priced. Many of these features were thought to be conservatively designed and would rarely, if ever, come into play. However, the investment environment of 2008/2009 has proven that thinking wrong. These embedded features may represent sources of unexpected risk exposures

Pricing Methodology and Assumptions

Probability of Occurrence of Insured Risks

Pricing of insurance products is based on assumptions with regard to the probability of the occurrence of future events. Some events are quite predictable, such as mortality rates; even future improvements in longevity can be anticipated by studying past trends. Other events such as hurricanes or earthquakes are less predictable, despite scientific studies. Regardless of the nature of the insured event, assumptions with respect to the probability of the occurrence of the event and its severity must be made before the theoretical price of the insurance contract can be determined.

Historical data is the starting basis for the formulation of pricing assumptions. However, factors that affect future events must be taken into consideration in pricing as well. Continuing improvement in mortality rates, technological advancement in medical treatment, and the effect of climate changes on weather patterns are but a few obvious examples to illustrate the importance of not relying on historical data alone. Insurers should perform sensitivity testing of assumptions.

Expenses, Investment Rate of Return and Lapse Rate

Other assumptions needed in the pricing of products are expenses and investment rates of return. Expenses represent each policy’s share of the insurance company’s operating costs: fees for medical examinations and inspection reports, underwriting, printing costs, commissions, advertising, agency expenses, premium taxes, salaries, rent, etc. The impact of inflation on future expense levels forms part of the pricing assumptions for long-term products.

While investment rates of return might not be critical in the pricing of short-term non-life insurance products, it is critical in the pricing of long-term life insurance products. A 1 per cent difference in the assumed rate of return over 20 years can create a 20 per cent difference in pure premium rates.

The assumed lapse rate affects premium rates for long-term life insurance policies. When policies are lapsed before enough premium payments are made to cover early policy expenses, the insurer must make up this loss from remaining policyholders. Therefore, the lapse rate will affect the cost of the policy. Since most long-term life policies accumulate cash surrender values, the underlying investment strategy should allow sufficient liquidity to meet the anticipated cash flow demand.

Validating Assumptions through Experience Studies

An insurer should conduct an analysis of profits and losses by source at the end of each year. The analysis ascertains the sources of current year’s profits or losses, such as:

• The insured risks (mortality, morbidity, auto accidents, fire, etc.)
• Expenses
• Investments
• Policy lapse experience.

The results of the analysis either provide support of the pricing assumptions, or form the basis of revising the assumptions. Assumptions that have significant financial impact or where there is no or little past experience data should be monitored more closely.

Insurers should have clear procedures for withdrawing and re-pricing of existing products, e.g., when investments supporting the product are no longer available.

Non-life insurance and reinsurance business is susceptible to insurance cycles. Consequently, non-life insurers and reinsurers tend to lower rates in a downward cycle in order to maintain growth and market share while hoping to recoup losses during the upward phase. For effective ERM, insurers should proactively manage the insurance cycles to achieve stability of underwriting results, based on disciplined pricing principles rather than commercial considerations.

Keep in mind that each year’s experience is influenced by cyclicality, random statistical fluctuation, and possible extraordinary events peculiar to the year. The profit and loss analyses of the past few years should be examined together to form a holistic opinion of any emerging trend.

Managing Exposures

Determining Sound Risk Retention Limits

A prudent insurer limits its gross risk exposures and net risk retention (after reinsurance cessions) by policy/event, line of business and for the overall business portfolio. A robust methodology is important for diversifying exposures, dealing with catastrophic risks and ensuring stable underwriting results.

The relevant retention limits are typically guided by an insurer’s risk appetite and risk tolerance levels, as articulated by its overall risk strategy. The limits should be appropriate for its portfolio mix, and take into account cost and availability of reinsurance protection as well as its solvency and capital strength to support the risk retained.

Estimating Probable Maximum Loss (PML)

While there is no universally agreed definition, PML is the largest loss that is likely to arise from one or more insured peril(s), e.g., earthquake or windstorms, due to a concentration of risk exposures, before deducting reinsurance recoverable. It takes into account the probability of the loss. PML is commonly used:

• As a basis for determining net retention;
• To calculate the level of reinsurance protection required; and/or
• For limiting exposures to geographical zones or lines of business with higher risks of catastrophic losses so that a single risk event will not have significant adverse impact on the overall underwriting result.

Minimizing Accumulation Risk and Risk Concentration

Prudent underwriting controls include monitoring accumulation risks. For example, it is a common practice to classify properties insured according to geographical location and to limit the total risk exposures for each geographical region. To observe the established limits, there are controls to accumulate all gross risk exposures of individual policies and to ensure new risks are not accepted from those regions that have hit the limit.

Risk concentration typically arises from systemic risks, e.g., terrorism, earthquake, or other catastrophic events. A pertinent consideration is that a systemic event such as earthquake may affect multiple lines of business, e.g., property, vehicles, and business interruption covers. In this regard, the use of scenario evaluations may be useful to have a clearer picture of the interdependencies of various risk factors and lines of business to help in formulating an appropriate risk mitigation strategy.

New Business Strain

New business strain arises when the early years’ premiums under a life insurance contract, less the initial expenses and any early claims, are not sufficient to cover the statutory reserves, plus any explicit required solvency margin, that an insurer needs to maintain. Thus, there is a negative impact on its financial position when the policy is written. It primarily occurs at the outset, but it is possible to have further strains in subsequent years.

The main cause of the new business strain is the high initial selling expenses. Statutory reserving and solvency requirements can also contribute to the strain.

To illustrate, the emergence of profit and loss from a particular life policy might have the following pattern:

 

The losses in the initial years represent the new business strain, which is compensated by the profits in subsequent years.

Underwriting Criteria and Assessment

Underwriting Policies and Controls

The underwriting stage is the entry point of insurance risks. Thus, robust underwriting policies and controls, including clearly documented underwriting guidelines and criteria, are critical for:

• Ensuring adherence to retention and accumulation limits as well as underwriting authorities
• Checking that risks are properly assessed in line with underwriting guidelines, e.g., premium loadings or policy exclusions for higher risks, dealing with risks which are to be excluded or should be declined
• Identifying potential moral hazards, e.g., policyholders buying more insurance than they can reasonably afford
• Addressing potential conflict of interests, e.g., underwriters should not have claim handling or approving authorities
• Reviewing application forms to ensure relevance and adequacy of underwriting information collected.

As part of an ERM framework, an insurer should institute efficient insurance information systems that link key information on policies – from underwriting, accumulation, reinsurance, claims and underwriting performance – on the same IT platform.

Reinsurance Program and Security

Risks Arising from Reinsurance Arrangements

Reinsurance is a key measure to mitigate insurance risks through transferring risks that are in excess of a direct insurer’s net retentions to a reinsurer. Effective reinsurance reduces the volatility of an insurer’s underwriting results and enhances an insurer’s underwriting capacity, both technically and financially.

Nonetheless, reinsurance may expose an insurer to the following risks:

• Reinsurance Credit Risk: when a reinsurer or counterparty of an alternative risk transfer mechanism is unable and/or unwilling to honour its obligations
• Legal Risks: disputes over terms of the reinsurance agreement or non-enforceability of the agreement
• Reinsurance Basis Risk: discrepancies or gaps between the primary insurance policy and the reinsurance arrangement or alternative risk transfer mechanism
• Liquidity Risk: time lag between an insurer paying the policyholder and receiving payment from the reinsurer
• Operational Risks: mistakes or delays in finalising reinsurance agreements.

Managing Reinsurance Risks

The board of directors should approve an insurer’s reinsurance strategy, tailored to its business portfolios and risk profile. Senior management is responsible for implementing the reinsurance strategy with clearly documented policies and procedures. The reinsurance strategy should be reviewed regularly and whenever there are changes in an insurer’s operating and external environment.

A reinsurance strategy outlines an insurer’s:

• Risk appetite and risk tolerance levels including relevant net retention limits
• Objectives of reinsurance including the criteria and intended use of different types of reinsurance arrangements (treaty, facultative, proportional, non-proportional, etc.) and alternative risk transfer mechanisms
• Criteria and conditions for reinsurance counterparties including reinsurance brokers, e.g., threshold credit rating, track record, licensing status, i.e., locally licensed or overseas reinsurers not licensed locally
• Reinsurance risk management framework.

Reinsurance Risk Management Framework

An insurer’s reinsurance risk management framework should cover:

• Authority limits for approval and signing-off of reinsurance agreements
• Reinsurer selection process and diversification of counterparties
• On-going monitoring of the financial position of the reinsurers
• Review of the terms and conditions of reinsurance agreements to ensure the effectiveness of the risk transfer to the reinsurers

• Assessment of adequacy of reinsurance protection, e.g., stress testing and realistic disaster scenario analysis to assess catastrophe reinsurance cover and impact on solvency

• Controls to ensure:

• That risks are not accepted before the necessary reinsurance protection is finalized, e.g., facultative reinsurance

• Timely completion of reinsurance documentation
• Compliance with conditions/warranties in reinsurance agreements

• Completeness and accuracy of reinsurance accounting
• Monitoring of reinsurance claims recoveries
• A contingency plan in the event reinsurance coverage is disrupted, e.g., credit rating downgrade of an reinsurer
• Information on any changes in the scope or coverage of the reinsurance program and timely communication to relevant operating units.

Estimating Technical Provisions

The Role of Technical Provisions (TP)

Technical provisions (TP) comprises two components:

• The current estimate of the costs of meeting the insurance obligations, based on projected future cash flows arising from insurance policies
• A risk margin to address the intrinsic uncertainty of insurance obligations.

Under-estimation of TP would artificially inflate an insurer’s profitability. If such illusory “surpluses” are distributed as dividends, it would erode an insurer’s financial resources. It is widely recognized that inadequate TP is a common cause of insurer failures.

The estimation of TP is not an exact science:

• There is no one-size-fits-all methodology
• Sound judgment and strong technical experience are crucial in formulating and selecting an appropriate methodology
• Sometimes, an insurer may use more than one method to compare or validate the results. Where results of different methods differ significantly, an insurer should be able to comment on the likely causes for the differences and explain the basis for the choice of method.

Robust Methodology to Estimate TP

The international trend is to move away from factor-based formulas for computing TP to a cash flow modeling-based approach. The International Association of Insurance Supervisors (IAIS) has adopted a market consistent valuation of technical provisions based on the risk characteristics of an insurance portfolio.

The methodology for estimating TP should be sufficiently rigorous in addressing:

• The uncertainties of the claims experience of different insurance portfolios, taking account of volatility, time horizon, degree of diversification and other emerging risks, e.g., changes in the legal framework in favour of claimants
• Validity, credibility and reasonableness of valuation or modeling assumptions
• Quality and integrity of claims data used for estimation
• Regular review of methodology to ensure continued relevance and appropriateness.

Market Risks

General Considerations for Insurance Operations

General Considerations for Insurance Operations

While insurance risks are the key risks to the liabilities side of an insurer’s balance sheet, market risks have significant impact on an insurer’s investment assets.

The investment returns from premiums received is a major source of income to insurers. In some markets, insurers may under-price their premium rates with the expectation that investment gains will compensate for underwriting losses, due to competitive reasons. This is a practice that a professional insurers frown upon.

A pertinent consideration for managing market risks is the investment time horizon. Non-life insurances are typically annual policies while a life insurer has policy obligations that extend over varying durations. The difference in the nature of policy liabilities drives the investment time horizon.

Another key difference arises from the different stakeholders of the investment performance of an insurer. While a non-life insurer may retain some of the investment income as a buffer to strengthen its solvency or for other strategic reasons, its investment performance has a more direct effect on its shareholders than on its policyholders. On the other hand, a life insurer must share its investment gains/loss with policyholders of participating policies in an equitable manner, accrue the full investment results to investment-linked policyholders, and meet interest rate and other investment-related guarantees included in its policies. Thus, policyholder reasonable expectation is a consideration in setting investment objectives for life insurers.

In view of the above, life and non-life insurers have different philosophies in market risk management that are reflective of their investment outlook and interests of different stakeholders.

Factors Influencing Market Risks

Factors Influencing Market Risks

The key factors giving rise to market risks include:

• Interest rates
• Prices of equities and other traded financial instruments
• Foreign exchange rates
• Property prices
• Commodities prices.

Interest Rates and Price Movements

Due to long-term nature of their business, life insurers typically invest a significant proportion of their investments in bonds, the values of which are susceptible to interest rate movements. The general level of interest rates is affected by the macroeconomic environment such as inflation expectations and monetary policy.

Securities issued by governments are sometimes referred to as “risk-free”, although their relative levels of risk are reflected in the sovereign risk ratings assigned by rating agencies. Investors usually demand a premium for corporate securities, i.e., interest rates above the relevant risk-free rate. Therefore, interest rates also reflect the market’s perception of credit risk for specific securities.

Insurers also invest in equities and other securities that are traded in secondary markets, either on exchanges or over-the-counter. The market prices of these instruments are subject to both general market risks and specific market risks.

Foreign Exchange Rates, Real Estate Prices, and Commodities

Insurers’ exposure to foreign exchange risks may arise from:

• Operations in overseas territories
• Insurance policies denominated in foreign currencies
• Reinsurance premiums payable to and reinsurance recoverable from foreign reinsurers
• Investments denominated in foreign currencies.

Insurers traditionally have exposure to property prices. Physical properties are less liquid compared to traded securities due to the large size of investments involved. Liquidity considerations may preclude smaller insurers from investing in physical properties. Instead, to add exposure to the real estate sector for diversification purposes, they are more likely to invest in shares or bonds and debentures issued by real estate companies. Life insurers are also exposed to real estate risks through their common practice of granting loans to policyholders secured by properties. Thus, the declining housing prices that triggered the sub-prime crisis in the USA contributed to heightened credit risks and the collapse of many financial institutions, including some mono-line mortgage insurers. A prudent insurer establishes appropriate concentration limits and valuation policy for its real estate exposure.

It is uncommon for insurers to invest in commodities. An insurer’s board of directors must consider carefully the desirability of investing in the commodities market. Market prices of commodities are driven by global demand and supply factors and susceptible to volatile movements.

Asset-Liability Management

What is ALM?

Asset-liability management (ALM) is the practice of managing a business so that decisions and actions taken with respect to assets and liabilities are coordinated. It is important to the insurer’s management of its cash flow needs, capital requirements and pricing of products.

Traditionally, ALM focused primarily on the risk associated with changes in interest rates, which is more important to life insurers due to the long-term nature of life insurance products. Nowadays, ALM considers a broad range of risks including market risk (such as equity risk, currency risk, and sovereign risk), insurance risk and liquidity risk.

In formulating ALM strategies, the insurer should consider the risk characteristics of each line of business. The choice of tools and techniques to measure ALM depends on the identification of the primary risk of concern. For example, the level of future investment income is a major risk to the insurer arising from writing annuity contracts which may be in effect for 40 years or longer. Then, the use of duration-matched or cash flow-matched assets may be appropriate for the insurer’s annuity portfolio.

The typical methods used to measure ALM risk:

• Duration and Convexity: Measure the interest rate risk for fixed income securities
• Value at Risk: Quantifies the probable loss over a specific period at a prescribed statistical confidence level
• Liquidity Ratio: Provides a cushion based on a percentage of the normally expected cash-flow needed to meet liabilities over a specific period
• Scenario Testing and Stress Testing: Identifies the necessary financial resources to meet probable and extreme business and/or economic conditions

Implementation of ALM

The objective of ALM is not to eliminate risk. Alas, it is not possible to perfectly match a long-term liability portfolio due to the lack of suitable long-term assets, for example. Rather, the goal is to manage risks within a framework of self-imposed limits, taking into account the insurer’s solvency position and risk tolerance. The insurer should be able to identify, monitor, measure, report and control the risks within its ALM program.

While ALM is often done by product and business lines, overall risk tolerance, capital and cash flow requirements should also be set at the insurer level. Therefore, the board of directors is responsible for the enterprise-wide ALM policy. The insurance supervisor should be satisfied that the risk tolerance approved by the board of directors relating to ALM is appropriate for the solvency position and the expectation of its policyholders.

Proper measurement and monitoring of ALM involves a number of functional areas with the insurer: investment, product design, pricing, valuation, finance, risk management, etc. Insurers must understand the interdependence of these functions in carrying out effective ALM

Investment Risk Management

Setting Investment Strategy

The insurer’s investment strategy must take into account the following factors:

• The characteristics of its liabilities, such as the timing and volatility of incidence of claims
• Its solvency position, which affects the determination of prudent risk tolerance
• Regulatory requirements, where there may be restrictions on maximum allocations to certain asset classes, or minimum liquidity
• Reinsurance strategy, which affects the level of and volatility of liabilities.

An appropriate investment strategy should result in sufficient assets with suitable nature, term and liquidity to meet claims when due and to maintain the required minimum solvency position.

ALM forms an integral part of setting and refining investment strategy.

Strategic Policy Considerations

The investment management framework should be supported by operational policies governing:

• Identification of risks: market, credit and liquidity risks as defined in other sections in this note. Techniques and procedures should be established to monitor and measure each of the identified risks. When hedging is used, the appropriate hedging instruments should be identified and their effectiveness monitored. Stress testing and ALM should be employed to determine the appropriateness of its investment strategy.
• Approving authorities for investment decisions and execution.
• Ethical conduct of investment staff, e.g., disclosure of potential conflict of interests and related party transactions.
• Policy on outsourcing investment operations, either party or wholly.

Investment Controls and Reporting

Investment controls must be in place to check and ensure observance of established policies and procedures:

• Procedures to ensure investment risk exposures are within the internal limits on risk tolerance
• Investment transactions are executed within the approved investment strategy and limits and regulatory requirements on investments
• Proper documentation and audit trail for investment activities
• Valuation policy and procedure, e.g., prices or rates should be obtained from independent sources and basis for valuing illiquid or non-publicly traded investment holdings.

The board of directors and senior management should be updated on a regular and timely basis on:

• Breaches of investment limits and authorities
• Investment activities, positions/exposures and performance indicators.

Financial Derivatives

Role of Financial Derivatives

It is common for insurers to use derivatives to hedge or mitigate its market risks. On the other hand, the higher risks arising from speculative activities in financial derivative are widely recognized. In particular, insurers may not fully understand risks embedded in complex derivative instruments or the impact of leveraging.

In view of the above considerations, some regulators restrict or prohibit the use of financial derivatives by insurers. Typically, regulators limit the use of financial derivatives to reducing investment risks or efficient portfolio management.

Effective Oversight of Derivatives Activities

The board of directors of a prudent insurer ensures that it has sufficient understanding of the costs and benefits as well the risks related to the use of derivatives as a precondition for allowing derivative transactions.

The board must also ensure effective oversight, approving the policy on using derivatives as part of the overall strategic investment policy. The policy should be reviewed at least annually and should address:

• The authorized purposes for using derivatives
• Restrictions on the types of derivatives that can be used, e.g., illiquid derivatives or over-the-counter derivatives may be prohibited
• Exposure limits for permitted types of derivative instruments
• Minimum qualifications and experience as well as authority limits for relevant staff
• Lines of responsibility as well as monitoring and reporting requirements
• Internal controls to ensure compliance with established policies and limits

• Proper segregation of incompatible functions, e.g., execution, monitoring and valuation of positions
• Internal audit of derivative transactions and positions.

Operational Risks

Introduction

This section identifies the key sources of operational risks, and discusses the supervisor’s expectation of the insurer’s corresponding risk management measures.

There is no universal definition of operational risks. Generally, it refers to the risks arising from inadequate systems, internal procedures and controls. Sometimes, external events may pose operational risks, e.g., frauds or consequences (financial or otherwise) resulting from a systemic crisis. Some operational risks are non-quantifiable (e.g., reputational impact), and some operational risks may be partly quantifiable (e.g., legal fines), and partly non-quantifiable (e.g., legal sanctions).

Definitions of Operational Risks

The IAIS defines operational risk as the risk arising from failure of systems, internal procedures and controls leading to financial loss. Operational risk also includes custody risk.

Overview

Operational risk management is a more recent discipline relative to the management of insurance, market and credit risks. The development of systematic approaches to manage operational risks by insurers has been driven by the emergence of more complex and sophisticated products, the evolution of insurance conglomerates with complex operating structures, greater automation and reliance on information technology as well as the incidences of high impact and high profile losses due to operational risks. Regulators have also intensified their scrutiny of operational risks.

Traditionally, insurers viewed operational risks more as process risk arising from dealing with a large number of policies and tended to address operational risk indirectly through insurance risk. The emerging practice is to segregate operational risk and insurance risk. However, insurers who insure operational risks of business enterprises (including other types of financial institutions) treat risks arising from such insurance policies as insurance risk.

As part of its ERM, an insurer should communicate an appropriate definition of operational risks to be consistently applied across all business units. It should also establish clear policies for identifying, assessing, quantifying (where applicable), monitoring, controlling and reporting the relevant key operational risks.

Professional Market Conduct

Importance of Ethical Corporate Culture

Insurance is a legal contract, based on utmost good faith of both parties. Generally, policyholders are not legally trained to fully appreciate their rights and obligations under the contract. On the other hand, insurers have to rely on insureds to disclose all material facts that would influence their underwriting decisions. The increasing use of life insurance as an investment instrument adds another dimension to insurers’ dealings with consumers to ensure proper disclosure of investment risks and product suitability.

As part of their market conduct supervision, regulators expect insurers to ensure that their staff and appointed agents/representatives act with due skill, care and diligence and treat customers fairly.

Insurers are mindful that they will be exposed to financial losses, compliance risks and reputational risk due to unethical and unprofessional market conduct, e.g., non-disclosure of pertinent information and/or risks, mis-selling, misrepresentation, switching, churning, rejecting legitimate claims, etc.

It is important that the board of director sets the tone for an ethical corporate culture. The board should articulate clear policies that address conflicts of interest, fair treatment of customers and information sharing with stakeholders, and review these policies regularly.

Measures to Promote Professional Market Conduct

To promote professional market conduct, an insurer should have an appropriate code of ethics and implement effective policies, procedures and controls on:

• Competence of employees, agents or other intermediaries, e.g., relevant minimum qualification requirements and on-going training.
• Dealing with different types of customers, e.g., retail or sophisticated/professional or institutional customers.
• An incentive structure that will motivate a high quality of advice and meeting clients’ insurance needs. Remuneration should not be based solely on achievement sales targets and quotas, which tends to encourage aggressive sales behaviour. Insurers should also consider other key measurements of performance such as the number of complaints received, persistency ratio and compliance records.
• Guidelines on advertising – marketing materials should be balanced, presenting both benefits and costs/risks in clear and non-misleading language.
• Proper sale procedures to gather and analyse client information to understand their insurance needs, financial circumstances and risk appetites.
• Appropriate and timely disclosures to empower customers to make informed decisions:

• Product features, policy exclusions, risks, benefits, obligations, fees and charges
• Potential conflict of interest, e.g., an insurance broker may be influenced by production bonus to recommend products from a particular insurer
• Regular performance reports of life policies.

• Prompt and equitable claims handling.
• Fair and effective dispute resolution – proper due process to ensure fair outcome for complainants, in a timely manner.

Insurance Fraud

Types of Fraud

Given the nature of insurance business, an insurer may be exposed to:

• Internal Fraud: e.g., briberies, embezzlement, misappropriation of assets or unauthorized transactions by management or staff; bogus policies to boost sales quota; data theft, etc.
• External Fraud: e.g., withholding material underwriting information, fictitious or inflated claims from policyholders or third-party claimants, multiple claims on the same loss or collusion by loss adjusters.
• Intermediary Fraud: e.g., fraud by agents, financial advisers or brokers against policyholders or the insurer.

An insurer should formulate a fraud management strategy, which sets the direction for fraud management policies and procedures, as part of its overall business strategy. The strategy takes into consideration:

• Promoting high standards of integrity and ethics right from top at the board of directors level to all ranks of management and staff
• The desirability of establishing a dedicated fraud management function with clear reporting lines
• Raising awareness and training of directors, management and staff on potential fraud indicators as well as prevention and detection measures
• Clear policies and procedures to deal with fraud, including investigations and disciplinary actions, and coordination with law enforcement agencies
• Exchange of information with other insurers, e.g., the use of industry claims databases to deter multiple claims on the same loss.

Fraud Prevention and Detection

Effective fraud management hinges on robust preventive policies, procedures and controls:

• Fit and proper criteria for directors, management, staff and intermediaries that are appropriate for their positions and responsibilities
• Pre-appointment or pre-employment screening of directors, management and staff and regular post-appointment review, e.g., policy on self-declarations
• Mandatory vacation or job rotation for fraud-sensitive positions
• Segregation of incompatible functions, e.g., claims-handling staff should not approve claim cheques
• Adequate checks and balances - no one staff should be authorized to deal with a transaction from inception to closure as well as adopting the four-eyes-principle for critical functions and handling cash or high-value items
• Internal database on known fraudsters to prevent recurrence.

It is in the interest of an insurer to detect fraud early to minimize further financial losses or other damages. The probability of detection will be higher when there is a transparent process to deal with complaints, from both internal and external parties. Some insurers establish confidential whistle-blowing mechanisms to encourage management and staff to report irregularities.

Information Technology (IT) Risks

Benefits of and Risks Arising from IT

Insurers make extensive use of information technology (IT) to manage their underwriting process, policy administration, claims processing and financial reporting. Some insurers market their products on the internet and may even accept simple risks online. Technically, insurers rely on IT to help them manage risks (e.g., software for pricing models) and improve operational efficiency (e.g., imaging documentation to facilitate information retrieval).

While IT has improved insurers’ efficiency and market reach, the management of IT risks has to constantly keep pace the rapid developments. IT risk could stem from:

• Damage to equipment or records and databases
• Disruptions in business operations or processing errors due to irregularities or failure of computer hardware, software, electronic devices, networks and telecommunications systems
• Loss of client data
• Violations, e.g., breach of confidentiality of client data
• Malicious attacks, hacking or IT fraud.

Key Elements of IT Risk Management

The key objectives of an insurer’s IT risk management system should include:

• Identification of internal and external threats through regular risk assessments
• Raising security awareness to minimize abuse or inadvertent errors, e.g., mandatory change of passwords on a regular basis
• Safeguarding data confidentiality with the use of appropriate encryption algorithm and authentication controls
• Strengthening system security and integrity, e.g., use of firewalls, to provide assurance on the accuracy, reliability, and completeness of information received, processed, stored and transmitted
• Effective disaster recovery and business continuity planning to ensure that critical functions can resume promptly following disruption
• Proper management of IT outsourcing risks.

Legal and Compliance Risks

Why Should an Insurer Be Concerned with Legal Risks?

The insurance policies issued by an insurer and reinsurance agreements entered into with reinsurers/retrocessionaires are legal contracts, which are subject to the risk of:

• The terms of the contracts being interpreted against the insurer
• Gaps in the coverage or exclusions between the primary insurance policy and the reinsurance cover resulting in unintended risk exposures to the insurer
• Invalidity or unenforceability due to failure to meet relevant legal principles
• Privity of contract – This is a concern particularly for fronting arrangements whereby a direct insurer is legally liable to settle claims by insureds. Failure to be indemnified by reinsurers does not change the insurer’s legal liability to the insureds
• Court decisions that have significant impact on the admissibility and the quantum of claims, e.g., changing court attitudes towards insurers’ liabilities arising from asbestos claims in the U.S.A.^[3]

To minimize legal exposures, an insurer should ensure that its operations have the necessary legal support to advise on the legal implications of entering in a contract and its dealings with different counterparties.

Compliance Culture as a Key Pillar of Corporate Governance

Compliance is recognized as a vital support for insurers’ corporate governance framework, given the increasingly sophisticated and complex financial landscape as well as a dynamic regulatory environment.

To safeguard the interests of policyholders and other stakeholders, regulators expect insurers to manage their businesses in line with sound insurance principles and robust corporate governance principles. An insurer’s corporate governance culture sets the tone for compliance. A positive culture fosters honesty, integrity and good business ethics. This paves the way for a strong compliance culture that respects not only the letter but also the spirit of the law.

Ultimately, the board of directors is responsible for effective oversight of compliance risks. Senior management is responsible for ensuring that established compliance policies and procedures are observed, with the assistance of the compliance function.

Business Continuity Management

Timely Recovery from Operational Disruptions

It is in the interest of insurers to have a comprehensive and cost-effective response, in the event of a severe business disruption. The objective is to ensure that critical business functions could be recovered promptly to maintain consumer confidence, minimize financial losses and limit any possible contagion effect on the financial system.

An insurer’s business continuity management framework should cover:

• Robust business continuity plan (BCP) approved by the board of directors
• Definition and identification of critical business functions and an assessment of business impact
• Establishing target recovery time
• Identification of critical staff and their contact details. This should also include alternate staff to replace critical staff, if necessary
• Segregation policy for critical staff and resources based on cost-efficiency considerations
• Properly documented measures to deal with defined scenarios of disruptions, e.g., insurer-specific events, industry-wide disruption or global crisis
• Clear allocation of responsibilities and reporting structure in performing the defined measures
• Internal and external communication channels
• Co-ordination mechanisms, e.g., regulators and other authorities, key counterparties such as other financial institutions, reinsurers
• Frequency, intensity and coverage for testing the effectiveness of the BCP
• Policies and procedures for updating BCP.

Credit and Liquidity Risks

Credit Risks

Key Sources of Credit Risk Exposures

An insurer may be exposed to credit risk in the following areas:

• Full or partial defaults by reinsurers, agents, brokers, other trade debtors and related parties
• Financial losses due to default or deterioration in credit quality (typically measured by a rating downgrade) arising from balances held with deposit taking institutions, its loan portfolios, securities issuers or investment counterparties.

Common Credit Risks Mitigation Measures

The common credit risk mitigation measures include policies and controls on:

• Appropriate credit exposure limits to different types of approved counterparties. Such limits should take into account concentration risks to a group of related entities, economic sectors or geographical spread
• Credit criteria and analysis including the extent of reliance on ratings issued by external credit rating agencies
• Dealing with counterparties who no longer satisfy established criteria, e.g., pursuant to a trigger clause in a reinsurance agreement
• Approving, accepting and monitoring of collateral, if any
• Aging analysis of outstanding balances
• Monitoring the credit standing of debtors and counterparties
• Reporting of credit exposures and any breaches.

Liquidity Risks

Liquidity Risk Inherent in Insurance Operations

Insurers invest premiums received in excess of their daily funding needs to meet claims and other business expenditures. Given the uncertain timing and amounts of claims or policy benefit payments, insurers are exposed to:

• Funding Liquidity Risk: The risk that an insurer is unable to meet its cash needs arising from its insurance portfolio and other obligations
• Market Liquidity Risks: The risk that an insurer has to liquidate assets at a loss due to unfavourable market conditions.

The risk is greater for lines of business where the claims pattern is less predictable, such as hurricane insurance.

Common Liquidity Risk Mitigation Measures

Common liquidity risk mitigation measures include:

• Identification of potential liquidity strain (e.g., large cash calls and scenario analysis of catastrophic events) to supplement the day-to-day cash flow management and forecasts
• Investment policies to ensure that investment holdings have an appropriate liquidity profile
• Funding plan, including emergency sources of funding such as standby lines of credit and accessibility to capital markets
• Establishing minimum levels of liquid assets and an appropriate liquidity buffer.

Glossary

Accumulation Risk: The risk that arises when a large number of individual risks are correlated such that a single event will affect many or all of these risks.^[4]

Asset-liability Management: The practice of managing a business so that decisions and actions taken with respect to assets and liabilities are coordinated. ALM can be defined as the ongoing process of formulating, implementing, monitoring and revising strategies related to assets and liabilities to achieve an organization’s financial objectives, given the organization’s risk tolerances and other constraints. ALM is relevant to, and critical for, the sound management of the finances of any organization that invests to meet its future cash flow needs and capital requirements.^[5]

Case Reserves: Provisions for claims incurred determined by considering each claim individually. Case reserves that have not been paid often form a significant component of an insurer’s outstanding claims provision.

Cash call: If the amount of a loss exceeds a certain threshold, a direct insurer may request a reinsurer to pay its share of losses immediately, instead of quarterly, as part of funding liquidity management.

Cash Surrender Value - The amount available in cash upon voluntary termination of a policy by its owner before it becomes payable by death or maturity. The amount is the cash value stated in the policy minus a surrender charge and any outstanding loans and any interest thereon.

Churning: An intermediary persuades policyholders to take money from existing life policies to finance a new policy that does not meet the client’s needs in order to earn more commissions from the sale of the new policy.

Compliance risks: The risk of legal or regulatory sanctions, material financial loss, or loss to reputation a bank may suffer as a result of its failure to comply with laws, regulations, rules, related self-regulatory organization standards, and codes of conduct applicable to its banking activities.^[6]

Convexity: A measure of the rate of change of the duration with respect to the interest rate.

Corporate Governance: The manner in which boards of directors and senior management oversee the insurers’ business. It encompasses the means by which members of the board and senior management are held accountable and responsible for their actions. Corporate governance includes corporate discipline, transparency, independence, accountability, responsibility, fairness and social responsibility. Timely and accurate disclosure on all material matters regarding the insurer, including the financial situation, performance, ownership and governance arrangements, is part of a corporate governance framework. Corporate governance also includes compliance with legal and regulatory requirements. Corporate governance also includes compliance with legal and regulatory requirements.”^[7]

Correlation: The statistical relationship between two variables such as shares or business portfolios. This is expressed as correlation coefficient, within the range of -1 to +1. For example, if two shares have a correlation coefficient of +1, it means they are perfectly correlated, i.e., if the price of share A increase by X%, the price of share B will also rise by X%. Conversely, if the correlation coefficient is -1 and the price of share A drops by 1%, the price of share B is expected to go up by 1%. A correlation coefficient of 0 suggests that the price movements of the two shares will move randomly against each other.

Derivative: A financial asset or liability whose value depends on (or is derived from) other assets, liabilities or indexes (the "underlying asset"). Derivatives are financial contracts and include a wide assortment of instruments, such as forwards, futures, options, warrants, swaps and composites. [Source: IAIS Glossary]^[8]

Duration: An important measure of interest rate risk. It is a measure for the sensitivity of the value of an asset or liability to changes in interest rates.

Facultative: The reinsurance of individual risks. The direct insurer chooses which risk to be reinsured and the reinsurer is free to accept or reject the risk, on a case-by-case basis. Typically used to complement treaty reinsurance where a risk is excluded by treaty cover or exceeds the treaty limit and net retention limit.

Finite Reinsurance: A generic term that describes an entire spectrum of reinsurance arrangements that share limited risk for a limited amount of premium. Although there is no accepted global definition of “finite reinsurance,” a typical transaction may provide for: aggregating risk, aggregating limits of liability and explicitly recognising the time value of money. It is important to review the entire reinsurance contract and any side agreements to determine whether there is sufficient transfer of risk to qualify as a reinsurance contract.

Fronting Arrangements: An arrangement whereby insurer A issues an insurance policy as a front, on behalf of insurer B, without any intention to retain the risk. The risk is “reinsured” to insurer B or a related entity of insurer B. This is a common arrangement adopted by captive insurers to deal with regulatory requirements that require certain types of insurance be written by a licensed insurer.

Insurance-Linked Securitisation: Transfer of insurance risks from the insurance sector to the capital market. Future cash flows from a portfolio of insurance policies are pooled (typically under a special-purpose vehicle) and structured as tradable securities to be sold to investors.

Hedging: Measures used to reduce risk or limit losses by taking an off-setting position against an underlying asset or liability. A common practice is to hedge market risks with financial futures or derivatives.

While hedging may be full or partial, it is important to be mindful that even under a full hedge, residual risks remain. In particular, the use of over-the-counter derivative instruments substitutes market risks with counter-party credit risks and/or operational risks.

The cost of hedging is a pertinent consideration for insurers’ risk mitigation strategies. The cost could be direct, e.g., price of the futures or derivative contracts, which may be high in the absence of a deep and liquid market. Some insurers may consider the indirect costs of hedging in line with the established risk appetite, i.e., the opportunity cost of hedging is that the potential upside gains may also be capped.

The costs and benefits of hedging should be carefully considered before it is implemented.

Improper Switching: The replacement of one policy by another policy resulting in:

• The client suffering penalties for terminating the original product or incurring unnecessary transaction costs;
• A replacement product that confers a lower level of benefit at a higher cost or same cost, or the same level of benefit at a higher cost; and
• A less suitable replacement product.

Lapse Rate: The rate at which life insurance policies terminate because of non-payment of renewal premiums.

Law of Large Numbers: A fundamental tenet of insurance. It is based on the probability theory that the average outcome from a large number of unrelated risks moves closer to the expected value (mean) as more risks are added.

Liquid Assets: Assets that are readily convertible to cash such as deposits in banks, government securities and securities traded in deep and liquid markets. Some regulators impose a minimum liquidity ratio as a percentage of technical provisions.

Liquidity Risk: The risk that an insurer, though solvent, has insufficient liquid assets to meet its obligations (such as claims payments and policy redemptions) when they fall due. The liquidity profile of an insurer is a function of both its assets and liabilities.^[9]

Market Consistent Valuation: In the absence of deep liquid secondary markets that provide sufficiently robust values of insurance obligations, elements of insurance obligations should be valued using cash flow models or other methods that reflect the settlement of the insurance obligations and accord with principles, methodologies and parameters that the market would expect to be used. Such valuations could be considered to be “market consistent.”^[10]

Market Risk: The risk to an insurer’s financial condition arising from movements in the level or volatility of market prices. Market risk involves the exposure to movements of financial variables such as equity prices, interest rates, exchange rates or commodity prices. It also includes the exposure of derivatives to movements in the price of the underlying instrument or risk factor. Market risk also involves the exposure to other unanticipated movements in financial variables or to movements in the actual or implied volatility of asset prices and options. Market risk incorporates general market risk (on all investments) and specific market risk (on each investment).^[11]

General Market Risks: These are systemic risks in the financial markets resulting from general economic conditions such as a financial crisis or market confidence.

Specific Market Risks: Refer to changes in the prices of a specific security or financial instruments driven by factors unique to the issuer of the instrument.

Persistency Ratio: Percentage of the life policies sold that remains in force [since inception and as at the end of a specified period] one year later. This is the inverse of the lapse rate.

Privity of Contract: This is a legal doctrine which provides that only parties to a contract are entitled to the rights and obligations under a contract. A third party has no legal right to enforce the contract or claim damages for breach of contract.

Reinsurance Basis Risk: The reinsurance cover might prove insufficient to adequately handle the risk in question because reinsurance needs have not been precisely identified. This might result in relevant clauses of the reinsurance contract being inappropriate.^[12]

Reinsurance Credit Risk: A reinsurer might prove to be unable or unwilling to pay its part of the liabilities or the claims incurred which can put the insurer’s liquidity at risk and even cause its bankruptcy.^[13]

Reputational Risk: The potential that adverse publicity regarding an insurer’s business practices and associations, whether accurate or not, will cause a loss of confidence in the integrity of the institution. Reputational risk could arise from other risks inherent in an organization’s activities. The risk of loss of confidence relates to stakeholders, who include, inter alia, existing and potential customers, investors, suppliers, and supervisors.^[14]

Retention: The amount of risk that an insurer retains for its own account, i.e., not reinsured.

Risk Concentration: A risk concentration refers to an exposure with the potential to produce losses large enough to threaten an insurer’s health or ability to maintain core operations.^[15]

Risk Margin: The buffer added to the current estimate of the cost of meeting the obligations. It should be calibrated such that the value of the technical provisions is equivalent to the value that an insurer would be expected to require in order to take over the obligations. Please refer to the IAIS Common Structure for the Assessment of Insurer Solvency for a more detailed discussion on the concept and approaches to determining the risk margin.

Risk Tolerance: A statement of the nature and amount of risk exposure that the insurer is willing to accept. The risk tolerance will dictate the risk limits that are established as part of the insurer’s risk management policy.^[16]

Treaty: A reinsurance agreement under which a defined portfolio of insurance risks is reinsured automatically based on agreed terms between the direct insurer and reinsurer. It is obligatory as the direct insurer is obliged to cede and the reinsurer must accept all risks within the portfolio covered by the agreement. Treaty reinsurance can be proportional or non-proportional.

Trigger Clause: A common clause in reinsurance agreement that allows an insurer to terminate the agreement, at any time during the duration of the agreement, due to a rating downgrade of the reinsurer below a threshold level. The clause typically complements a general notice of termination and results in a pro-rata refund of premium by the reinsurer.

Twisting: An intermediary gives improper advice to clients to terminate a policy from one insurer to take up a similar policy from another insurer, to the detriment of the clients. Typically occurs when an agent moves from one insurer to another.

Volatility: The rate of change of a variable over a specified time period, as measured by its standard deviation. For example, shares are typically considered as having a higher volatility (compared to fixed income securities) as the price of shares can go up or down significantly in the short term.

Certain insurance portfolios are known to be more susceptible to volatile experience than others. For example, catastrophic insurance is more volatile due to its low frequency and high amount claims profile, as compared to a motor portfolio with high frequency and low amount claims experience. In some jurisdictions, insurers are required to maintain higher technical provisions to mitigate the uncertainties arising from more volatile insurance portfolios.

 

 

[1] This note was prepared by Mimi Ho and Su Hoong Chang on behalf of Toronto Centre.

[2] http://www.coso.org/Publications/ERM/COSO_ERM_ExecutiveSummary.pdf

[3] http://www.iii.org/media/hottopics/insurance/asbestos/

[4] IAIS Glossary.

[5] Ibid.

[6] Compliance and the Compliance Function in Banks, Bank for International Settlements, April 2005.

[7] Insurance Core Principles and Methodology – International Association of Insurance Supervisors, October 2003.

[8] IAIS Glossary.

[9] IAIS Guidance Paper on Investment Risk Management

[10] IAIS Common Structure for the Assessment of Insurer Solvency

[11] IAIS Glossary.

[12] Ibid.

[13] Ibid.

[14] Ibid.

[15] Ibid.

[16] IAIS Glossary.