Pragmatic Risk Management Life Insurance Council ERM Committee

1. Pragmatic Risk ManagementLife Insurance Council ERM Committee Michael A. Cohen, Principal Cohen Strategic Consulting September 22, 2016

2. Perspective Over the past decade (which encompasses the financial crisis, of course), C-level insurance executives have felt that ERM has failed them because it was too theoretical and didn't address their strategies and the most pressing threats to it. This is especially pertinent to smaller companies who have limited resources to devote to ERM.

3. Vision, Mission, Goals:The Starting Point For Pragmatic ERM • Vision: The ‘concept’ you want your company to be • Mission: Your company’s role in the industry • Goals: What your company wants to accomplish (marketplace, financial, other)

4. Strategy/Operations and Risk:INSEPARABLE

5. Potential Risk Impact • Strategies and operations are modified and evolved in a fluid/iterative manner, in large part because the risks faced have changed • Q: What risks are there that could cause your strategy, operations, attainment of vision, mission, goals to be unsuccessful? • Q: Via what core capabilities does your company generate its earnings? What could erode them (or your capital)?

6. The Efficient Frontier Risk Return

7. Key Questions • What is your company’s appetite for risk? • What is your company’s appetite for pain? • What is your company’s TOLERANCE for risk?

8. Tolerance for Risk • Question: How much adverse risk impact is tolerable for your company? • Answer: The greatest amount so that key STAKEHOLDERS do not react in an unacceptable manner (ie the Risk Threshold) • Insurers need to ‘boil this down’ to a Risk Tolerance Statement - Philosophy - Specific metrics

9. Stakeholders • Customers • Producers • Board of Directors • Investors/Shareholders • Rating agencies • Regulators • Counterparties (Financial, Business partners) • Supply chain • Executives, management, critical staff

10. Stakeholder Behavior ‘Triggers’ • Financial outcomes: capital, earnings • Business line inadequacy (product, service, advice/information) • Business conduct/reputational impairment • Inordinate risk • Rating downgrades

11. Stakeholders’ Reactions • Cease doing business with you, or diminish the volume of business they do: Customers; producers; counterparties (financial, business partners); supply chain; executives/management/critical staff • Enhance their terms/diminish your terms in your transactions: customers; producers; counterparties (financial, business partners); investors/shareholders; supply chain: - Price/cost/rate - Remuneration • Impose more onerous governance requirements/ implications • Rating downgrades • Additional regulatory requirements

12. Risk Tolerance Determination:The greatest amount of adverse risk impact that would not trigger any unacceptable stakeholder reaction • Question: Among all of the stakeholders, which one(s) will react unacceptably to the smallest amount of adverse risk impact? • Hint: Which stakeholder (group) is studying and monitoring an insurer’s performance and risk exposure/impact most closely?

13. Risk Tolerance Audience • The most sensitive risk tolerance audience of all the stakeholder is the rating agencies. For smaller insurers, the answer is invariably A. M. Best, as very few are rated by the other rating agencies.

14. Strategy/Operations/Risk - Redux • Q: Which events/scenarios will cause you to be downgraded? • Events/scenarios that would cause an amount of adverse risk impact that would trigger a downgrade are the most serious risks • Referencing A. M. Best’s Impairment Studies, product, investment and organizational issues drive 70 – 80% of insurer impairments.

15. A. M. Best: Insurance Company Reasons for Impairment Qualitative credit underwriting focus areas: • Product lines • Investment / asset management activities • Parent and affiliate impact Covers 70%-80% of reasons for impairment

16. Risk Identification • Almost everyone who has worked in the insurance industry for any length of time can state the words identifying the risks • Risk Identification Process: - Executive input - Literature searches - Industry groups, consultants - Brainstorming, think tanks

17. High Risk Strategies, Tactics • Being 'all things to all people' (lack of focus or expertise) • Pursuing untried initiatives • Mergers and acquisitions • Competing against market leaders • Products with 'rich' product features • Aggressive or illiquid investment strategies • 'Buying' market share via lower pricing (causing thinner product margins) • Excessive leverage There is ample evidence of these scenarios causing great pain, and there is no need to repeat the mistakes of unfortunate industry cohorts!

18. Risk Quantification, Qualification • What is much more difficult is quantifying/ qualifying the adverse impact of risks - Modeling - Qualifying - Prioritizing • Which risks could be fatal?

19. ORSA • NAIC: Risk Management and Own Risk and Solvency Assessment Model Act in 2012 (since updated many times) • A confidential internal assessment appropriate to the nature, scale and complexity of an insurer conducted by the insurer of the material and relevant risks identified by the insurer associated with an insurer's current business plan and the sufficiency of capital resources to support those risks. • ORSA’s goals are two fold: - To foster an effective level of ERM at all insurers, through which each insurer identifies, assesses, monitors, prioritizes and reports on material ad relevant risks indentified by the insurer, and - To provide a group-level perspective of risk and capital, as a supplement to the legal entity view.

20. Risk (Impact) Mitigation Techniques: General • Change/modify strategy • Change/modify/enhance operations • Excess capital; how should this be measured?

21. Risk (Impact) Mitigation Techniques: Specific • Building core competencies, especially those that are fundamental to your generation of earnings • Pursue market opportunities with lesser competition • Focus, "Sticking To Your Knitting" • Seek 'offsetting risks' in the enterprise • Seeking strategic and investment opportunities at the lower end of the Efficient Frontier (lower returns/lower risk) • Avoiding complacency … continually seeking improvement and challenging assumptions

22. Questions(Remember Vision, Mission, Goals) • Is there such a concept as 'risk culture'? Are there tangible differences in how different organizations perceive risk and their tolerance for it, or can it be said that any company that studies its risk in light of its goals, objectives and strategies, and performs accurate risk analysis and shrewd risk mitigation will make relatively similar decisions? • How should an insurer differentiate between 'risks' and 'problems' in the ERM process? If a company can mitigate its risks and solve its problems concurrently, shouldn't that be a cause for celebration? • How should 'tail risks' be accounted for in the ERM thought process? There are some pithy sayings about whether exposure to tail risks should be considered: - "Don’t bet the farm" - "Don't drill below the water line" - Property and casualty executives talk about "one in a many year risk". I believe this is primarily a philosophical issue where companies may differ; this said, if a company can meet its goals and objectives while virtually eliminating its exposure to tails risks, wouldn't it want to do so?

23. Contact Information Michael A. Cohen, Principal Cohen Strategic Consulting (215) 595-7259 mcohen@cohenstrategicconsulting www.cohenstrategicconsulting.com Columbia University’s ERM Program: http://sps.columbia.edu/enterprise-risk-management/master-of-science-in-enterprise-risk-management