Risk Management

Croatian Insurance Days 2010

15th November 2010

Jiri Fialka
Contents

Risk Appetite 3

Stakeholder Expectations 4

Challenges 5

Current Industry Approaches 6

Metrics 7

Where on the distribution? 11

Embedding Risk Appetite 12

Setting Risk Appetite Limits 13

Conclusion 14
2 2010 Deloitte Czech Republic
What is Risk Appetite?
Risk Appetite

At the highest level, risk appetite defines the amount of overall risk that a firm is
willing to accept in pursuit of its business objectives.

Some regulators (such as the FINMA in Switzerland) distinguish that from risk
tolerance, the amount of overall risk a firm CAN take.

Risk Appetite Framework

The board ultimately needs to set risk appetite and cascade it within the firm.
A risk appetite framework defines the approach for :
o setting the firms overarching risk appetite,
o the processes, controls and methodology for setting and managing against
risk limits
The framework will be dependent on a number of factors including the nature,
size and complexity of the business. The two aspects of the framework that are
within the control of management are the level of granularity chosen and the
suite of risk metrics used.
3 2010 Deloitte Czech Republic
What are Stakeholder Expectations?
Solvency II text (CP33)
The regulatory text thus far contains high level statements
establishing the imperative for a risk appetite framework:
well documented risk management strategy that includes... risk
appetite
The appetite needs to then be expressed in acceptable levels of
risk limits for each risk type
The risk management function will maintain an organisation-wide
and aggregated view on the risk profile
an appropriate own risk and solvency assessment (ORSA)
S&P
Companies will be viewed as having weak, adequate, strong, or
excellent ERM. Companies are expected to:
Knowingly take considered risks and understand that losses are
probable. In effect, risk management should provide a company
with reasonable grounds to believe that it will be able to manage
any events and losses within predetermined bounds.
Measure all of their risks on comparable measures so that the
risk-management process of managing risk taking and limiting
losses to within company tolerances can be performed across all
risks and for the total enterprise.
4 2010 Deloitte Czech Republic
FSA (Insurance Sector Briefing)
The FSA is disappointed with progress in insurers and made the
following observations as early as November 2006:
Risk appetite is not well understood in many firms to a level of
clarity that provides a reference point for all material decision
making. There is a big step between defining and applying risk
appetite
Producing meaningful statements of risk appetite has posed
significant challenges for many firms.
....slow progress by boards and management to go beyond
definition and apply them a point of reference for material decision
making.
A Deloitte perspective
Risk Appetite is the mechanism by which the owners of the firm
express to the management of the firm the risk profile they wish
to take. This is measured at multiple time horizons
Risk Appetite is both qualitative and quantitative
Risk appetite frameworks provide a pivotal link between
strategic objectives of the organisation and its risk management
framework and limit structures.
Risk appetite should be cascaded to the business to inform day
to day business decisions and become embedded in the firms
risk management framework.
Challenges Implementing Risk Appetite
Many firms will face a number of challenges around the development of their risk appetite, particularly ensuring it
is:
meaningful across a number of metrics and at an appropriate level of granularity, and
embedded within the day-to-day running of the business.
Challenges Examples of Weaknesses
Developing Generic statement by Boards published in annual results but meaningless in practice
Meaningful Risk Limit based frameworks where limits are established on experience, gut-feel and expert
Appetite knowledge. The result is inconsistent and unconnected to strategy and extreme losses
Statements of high, medium and low appetite but without any definition of what these mean
Lack of clarity in statements of what the firm wont do, and loose definitions of what the firm
will do

Embedding Risk Lack of linkage between the quantification of risk appetite and the internal capital framework or
Appetite stress testing
Cottage industries producing KPIs and KRIs. Little or no link to appetite statements and a
heavy focus on lag (rather than lead) indicators
Lack of operational linkage between the risk appetite statements made and the operation of the
firm, i.e. translating Risk Appetite from a written document into commercial decisions
Firms and Boards playing lip-service, i.e. because the regulator insists organisations have it

5 2010 Deloitte Czech Republic

Current Industry Approaches
The insurance industry is slowly finding its way into Risk Appetite. Solvency II provides considerable impetuous.

Risk Appetite Firms all have some form of Appetite statements

frameworks are not We are not aware of many firms who have in place a robust Risk Appetite
in place framework
Solvency II and FSA FSA Arrow reviews are increasingly focusing on risk appetite
is driving thinking Solvency II strongly establishes the requirement without providing any detail

Firms are reaching out to consultants to provide intellectual input

External inputs and
benchmarking Appetite is increasingly included as a work stream within Solvency II programmes

Long term risks Long terms insurance risks potentially make appetite more complicated than
make appetite banking
complicated
The same complication should demand a robust approach to setting appetite for
risks
No linkage between Existing Appetite frameworks are operated without reference to or input from risk
ICA models and drivers within the capital model.
Appetite Volatility or earnings at risk should be drawn from the same model as the capital
Few firms contain a CRO with holistic risk responsibilities these individuals drive
No obvious sponsor
Appetite frameworks within banks. This is not a Chief Actuary mind set.
or driver, e.g. CRO
Solvency II requires firms to think as Groups not just legal entities. How will firms
6 complete a Group-wide ORSA without a robust Appetite framework?

2010 Deloitte Czech Republic

Metrics Its not just about capital!
Business Objectives
To date, many life companies have only used a
capital metric to define their risk appetite.
For example, firms have defined risk appetite as
having sufficient capital to cover its internal capital
requirements based on a particular credit rating (e.g.
AA).
A capital metric focuses on preservation of
policyholder benefits without providing sufficient Risk Capital
insight into how the risks can be managed to meet
the broader business objectives.
Including other value metrics in the framework, such
as earnings or cashflow, allows a firm to set its risk Value
appetite more broadly and ensures a clearer link to
business objectives.

Risk Appetite needs to be

articulated in the context of
broader business objectives.

7 2010 Deloitte Czech Republic

Metrics Capital at Risk

The capital requirement (or capital at risk) provides a measure of the level of risk exposure for an organisation. In
isolation, the nominal capital requirement does not provide much information. However, it is possible to use
relative metrics to help articulate risk appetite.

Risk capacity and risk exposure Relative capital requirements by risk class

Company balance sheet Company balance sheet

Additional Risk
Surplus capacity Surplus
indicator Risk class 1
Capital Capital
Risk exposure Risk class 2
Requirement Requirement
indicator Risk class N

Assets Assets Relative risk

exposure
Liabilities Liabilities indicator by risk
class

The capital requirement represents a measure of the risk Metric

Metric Description
that the organisation is currently exposed to. Type
The surplus represents additional risk capacity, giving Excess assets over Provides insight into how much more
Risk
insight into the ability of the organisation to take on further liabilities/ Capital risk the business can take on relative
Capacity
risk. requirement to existing risk exposure.
Provides insight into the level of risk
The capital requirement should be able to be split by risk Capital requirement/
exposure that exists within the
liabilities
class. business.
Risk
Consideration can be made of both current relative risk exposure Provides insight into the relative
Capital requirement for
exposures to specific risk classes
exposures and forecasted/ projected relative risk exposures. risk class N/ Capital
in the current risk profile of the
requirement
business.

8 2010 Deloitte Czech Republic

 Metrics Capital at Risk
In this section we look at how Capital at Risk could be developed at the next level of granularity.

Risk Exposure Risk Exposure

Group Capital Required as % of liabilities - Diversified Risk % of Liabilities - Interest - Diversified

30% 8%

25% 7%
Capital required as % of 6% Interest
Legal Legal 20% liabilities (CRL%) - Diversified
5%
Entity 1 Entity 2 15% 4%
Risk Appetite - Interest Rate
Risk Appetite - CRL% - contribution - Diversified - Low
10% Diversified - Low 3% Risk Appetite - Interest Rate
Risk Appetite - CRL% - 2% contribution - Diversified - High
5% Diversified - High
1%
0% 0%
Term
Annuities Pensions Legal BU 1 - BU 2 - Legal BU 3 - Legal BU 1 - BU 2 - Legal BU 3 -
Assur. Entity 1 Term Annuities Entity 2 Pensions Entity 1 Term Annuities Entity 2 Pensions
Assurance Assurance

Group Legal Entity 1 Legal Entity 2 Group Legal Entity 1 Legal Entity 2
Business Business Business
unit 1 unit 2 unit 3
Risk Exposure Risk Exposure
Risk % of Liabilities - Credit Spreads - Diversified Risk % of Liabilities - Asset Share Volatility - Diversified
In the example, the Group is 14%
8%
exposed to 5 risks: 12% 7%
Asset Share Volatility
10% Credit Spreads
6%

Interest 8%
Risk Appetite - Credit Spreads 5%
Risk Appetite - Asset Share
6% contribution - Diversified - Low
4% Volatility contribution -

Credit Spreads
Risk Appetite - Credit Spreads Diversified - Low
4% 3%
contribution - Diversified - High
Risk Appetite - Asset Share
2% 2% Volatility contribution -

Asset Share Volatility 1% Diversified - High

0%
Legal BU 1 - BU 2 - Legal BU 3 - 0%
Entity 1 Term Annuities Entity 2 Pensions
Legal Entity BU 1 - Term BU 2 - Legal Entity BU 3 -

Equity
Assurance
1 Assurance Annuities 2 Pensions
Group Legal Entity 1 Legal Entity 2
Group Legal Entity 1 Legal Entity 2

Mortality
Risk Exposure Risk Exposure
Risk % of Liabilities - Equity - Diversified Risk % of Liabilities - Mortality - Diversified

8% 16%

7% 14%
6% Equity Levels 12% Mortality Level
5% 10%
Risk Appetite - Equity Levels Risk Appetite - Mortality
4% 8%
contribution - Diversified - Low contribution - Diversified - Low
3% 6%
Risk Appetite - Equity Levels Risk Appetite - Mortality
2% contribution - Diversified - High 4% contribution - Diversified - High

1% 2%
0% 0%
Legal BU 1 - BU 2 - Legal BU 3 - Legal BU 1 - BU 2 - Legal BU 3 -
Entity 1 Term Annuities Entity 2 Pensions Entity 1 Term Annuities Entity 2 Pensions
Assurance Assurance

Group Legal Entity 1 Legal Entity 2 Group Legal Entity 1 Legal Entity 2
9
Metrics Earnings at Risk

Earnings at Risk attempts to address the value aspect of risk appetite, to provide a more complete picture of the
nature of risks that the organisation could be exposed to. Earnings at Risk provides a different perspective on risk
relative to Capital at Risk as it focuses on how risks impact earnings and also potentially cashflow. Thus, there
are likely to be conflicts as different risks will bite for Earnings at Risk relative to Capital at Risk.
The Earnings at Risk number can be considered as the difference between a projected earnings and stressed earnings value.
This diagram depicts how Earnings at Risk could be analysed separately for a forecasted period and risk appetite set for each year
(refreshed annually).

Year 1
Risk 1
Earnings Risk 2
At
Risk Risk N

Earnings volatility due to

Projected Stressed individual risk drivers
Earnings Earnings
Year 1 Year 1

Year 1 Year 2 Year 3 Year 4 Year 5

Earnings at risk is likely to be focused on different points on
the distribution relative to capital at risk (e.g. 1 in 10 vs 1 in
200).
Earnings at risk will be focused on both New Business and
Existing Business.
Cashflow at risk is a another metric that can be considered.
Important in relation to dividend payments by the
organisation.
10
There will be challenges around projecting a risk-based
balance sheet to assess earnings at risk. In particular:
Methodology and Technology
What-if capability
Achieving the right balance between accuracy and ability to
carry out What-if analysis
Likely to be conflicts as different risks will bite for Earnings
at Risk relative to Capital at Risk. Difficult management
decisions.
2010 Deloitte Czech Republic
Where on the distribution?
To support Risk Appetite and ORSA an Internal Model should do more than calculate the tail.

If the model analyses different loss

horizons risk managers can understand
Loss distribution
drivers of risk
Drivers of losses At which horizon is the firm managing its
are different Risk Appetite?
Risks driving difficulty (aka reverse
stresses) are not the same as the
catastrophic tail risks of capital
Expected Scenario 1 Scenario 2 Worst case
Limit frameworks and concentration risks
will be different at different horizons

Banks Insurers Banks Insurers

Credit cards Motor claims Wholesale Catastrophe

Retail loans Equity Fin. Institutions Longevity

Small business Interest Rate Mortgages Default

Market risk Spread

Limit frameworks should be clear on which limits are managing tail risk and which profit volatility
Risk appetite frameworks can leverage the model to identify risk drivers at the varying horizons and
ensure suitable limits are in place, e.g. concentration risk within a card portfolio

11 2010 Deloitte Czech Republic

Embedding Risk Appetite

Risk appetite should be set by the Board as part of the annual planning cycle

Cascaded to business and regional units as part of their operational planning

Risk appetite set at Group, Business Unit, Major-Product and Risk Class

Periodic (monthly / quarterly) risk reporting should include MI which monitors

risk exposures against limits

Consistent process for treatment of breaches

Board and senior management training, awareness and engagement

Standing item on terms of reference of risk committees

Continuous refinement and iteration

Linkage between risk appetite limits and operational limits around risk drivers
(such as products and asset allocations)

Inclusion in performance management (role profiles and objectives)

12 2010 Deloitte Czech Republic
 Setting Risk Appetite Limits
Limit setting should consider and involve:

Risk Philosophy Illustration of risk appetite limits

Risk appetite limit thresholds

What-if Analysis
Current capital
cover ratio

Historical Analysis Capital cover

position

Loss horizons Approaching thresholds

Hard and soft limits

Treatment of breaches

Top-down and bottom-up approaches a range of

operational limits will already be established
Time
Senior management, SME, risk and actuarial function
input

Iteration and refinement

13 2010 Deloitte Czech Republic

Conclusion

Risk Appetite is not currently embedded within the life industry.

Solvency II will act as a significant catalyst towards embedding Risk Appetite.

Risk Appetite is not just about capital.

To be meaningful, risk appetite will need to be sufficiently granular across a

suite of metrics.

To be effective, risk appetite will need to be embedded in the day-to-day

management of the business.

Timely management information and forward-looking KPIs will be critical to

successful implementation.

14 2010 Deloitte Czech Republic

This document is confidential and prepared solely for your
information. Therefore you should not, without our prior
written consent, refer to or use our name or this document
for any other purpose, disclose them or refer to them in
any prospectus or other document, or make them
available or communicate them to any other party. No
other party is entitled to rely on our document for any
purpose whatsoever and thus we accept no liability to any
other party who is shown or gains access to this
document.
15
Deloitte refers to one or more of Deloitte Touche
Tohmatsu Limited, a UK private company limited by
guarantee, and its network of member firms, each of
which is a legally separate and independent entity. Please
see www.deloitte.com/cz/about for a detailed description
of the legal structure of Deloitte Touche Tohmatsu Limited
and its member firms.
2010 Deloitte Czech Republic