Operational Risk Management in a Property/Casualty Insurance Company

1. Operational Risk Management in a Property/Casualty Insurance Company Mark Verheyen, FCAS, MAAA CAS Spring Meeting May 2005

2. Agenda • Traditional (P/C) Insurance Company Risk Measures • Operational Risk in an Insurance Company • Operational Risk’s Impact on the Insurance Industry • Quantification of Operational Risk in an Insurance Company • Management of Operational Risk in an Insurance Company

3. What are the traditional measures of risk in a Property / Casualty insurance company?

4. Traditional Measures of Risk • NAIC Risk Based Capital for Property / Casualty Insurers • R0 – Subsidiaries and Affiliates • R1 – Asset Risk – Fixed Income • R2 – Asset Risk – Equity • R3 – Credit Risk • R4 – Underwriting Risk – Reserves • R5 – Underwriting Risk – Premium

5. Traditional Measures of Risk • Best’s Capital Adequacy Ratio • B1 - Fixed Income Securities • B2 - Equity Securities • B3 - Interest Rate Risk • B4 - Credit Risk • B5 - Loss + LAE Reserve Risk • B6 - Premium Risk • B7 - Business Risk – Off-Balance Sheet Items

6. Traditional Measures of Risk • Standard & Poor’s Capital Adequacy Ratio • C1 – Asset Risk • C2 – Credit Risk • C3 – Premium Risk • C4 – Loss + LAE Reserve Risk • C5 – Business Risk

7. What is Operational Risk in an Insurance Company?

8. Operational Risk Operational Risk is not separate and distinct from the more traditional risk categories. Rather, it overlaps these categories.

9. Operational Risk • How does the banking industry define Operational Risk? • “Operational Risk is defined as the risk of loss resulting from inadequate or failed internal processes, people, and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk.” • Basel Committee on Banking Supervision • “International Convergence of Capital Measurement and Capital Standards”

10. Operational Risk * It is important to distinguish between the insurer’s operational exposure to natural catastrophe / terrorism and that exposure assumed from other parties as a covered insurance risk. Risks should be Serially Exclusive and Mutually Exhaustive (“SEME”). In other words, every risk falls in one and only one bucket.

11. How Has Operational Risk • Impacted the Insurance Industry?

12. Operational Risk’s Impact • “Failed Promises: Insurance Company Insolvencies” – a Congressional Report • Failures attributed to: • Under-reserving • Under-pricing • Unsupervised Delegation of Underwriting Authority • Rapid Expansion • Reckless Management • Abuse of Reinsurance • Etc. • Sounds like Operational Risk.

13. Operational Risk’s Impact • “The Failure of HIH Insurance” – a corporate collapse and its lessons. • Failure attributed to: • Under-reserving • Under-pricing • Lack of Internal Controls • Expansion into Unfamiliar Markets • Mismanagement • Abuse of Reinsurance • Etc. • Sounds like Operational Risk.

14. Operational Risk’s Impact “With the possible exception of insolvency due to catastrophe losses, in A. M. Best’s opinion, all the primary causes of insolvencies in this study were related to some form of mismanagement.” – Best’s Insolvency Study, Property Casualty U. S. Insurers, 1969-2002 Sounds like Operational Risk.

15. Operational Risk’s Impact Impairments increase following prolonged soft markets. Why is Operational Risk tied to the Underwriting Cycle?

16. How is Operational Risk Quantified in an Insurance Company?

17. Quantification of Operational Risk The significant sources of operational risk are implicitly included in regulatory and rating agency capital models.

18. Quantification of Operational Risk • NAIC RBC Model • Premium Risk • Base capital charge is derived using industry worst-case loss ratio by line, adjusted for company experience • Reserve Risk • Base capital charge is derived using industry average worst-case reserve development by line, adjusted for company experience • Growth Charge • Based on a regression against industry data applied to company growth • Significant sources of operational risk are implicitly included in the regulatory and rating agency capital models.

19. How is Operational Risk Managed in an Insurance Company?

20. Management of Operational Risk • Communication and discipline are key. • Everyone needs to be aware of what is going on in the current underwriting environment and be realistic about what the results are.

21. Management of Operational Risk • “For every clever person who goes to the trouble of creating an incentive scheme, there is an army of people, clever and otherwise, who will inevitably spend even more time trying to beat it.” – Levitt and Dubner, “Freakonomics” • “Insurance companies create powerful incentives… for underwriters to sell as many policies as possible at whatever price the market will bear” – Sean M. Fitzpatrick, “Fear is the Key: A Behavioral Guide to Underwriting Cycles” • Short-term incentives tend to be production based, while long-term incentives tend to be profitability based. • Everyone needs to be aware of what the incentives are and how they impact behavior.

22. Management of Operational Risk • What are the Key Risk Indicators of Operational Risk in an Insurance Company? • Production – hit ratios, retention ratios, item count, pricing levels (renewal business and new business), rate per unit of exposure • Internal controls – audit results, audit frequency • Staffing – employee turnover, training budget, premium per employee, policies per employee • Claims – frequency, severity, new classes of loss • Outside data sources – rating agencies, regulators, industry trade organizations, data warehousing firms

23. Concluding Thoughts • Operational risk isn’t a distinct class of risk that insurers are required to hold additional capital for. It is arguably the single largest threat to their solvency, though. • Regulators and rating agencies implicitly include capital requirements for Operational Risk through the premium and reserve charges in their capital models. These risk-based capital models can serve as a framework for company-specific models. • Proactive communication and the monitoring of Key Risk Indicators can encourage changes in behavior in the underwriting cycle.

24. Mark Verheyen is a Vice President with ReAdvisory, the consulting arm of Carvill, one of the world's largest privately owned reinsurance intermediaries. He assists client companies in evaluating and structuring reinsurance programs, providing dynamic risk modelling and capital allocation services.  Prior to joining ReAdvisory, he worked at both Ernst & Young and CNA Re. • Mark is a member of both the CAS Enterprise Risk Management Research Committee and the Committee on Reinsurance Research. • mverheyen@readvisory.com