Newsletter Sign-up

Today and in the future, the senior managers of all businesses--insurance and otherwise--will have to deal with risk and uncertainty. Regulators, investors, clients and other stakeholders now expect senior managers to understand and manage all the material risks facing a business.

Changes at the very top of some leading financial institutions in the wake of multibillion-dollar write-downs of mortgage-backed securities attest to the personal consequences of failing to measure and manage risk. Downsizing and declines in the market value of affected institutions exemplify the economic consequences.

Experience sheds light on the range of hazard risk that insurers face. There's no denying that insurers were stunned by the enormous losses from Hurricane Andrew in 1992 and then again by the even more enormous losses from Hurricane Katrina. In those cases, it was only the magnitude of the losses that was unexpected--the risk of severe hurricanes striking densely populated areas was widely recognized.

On the other hand, the possibility of a major terrorist attack against civilian targets on U.S. soil was foreseeable, but virtually no one anticipated the attack on September 11, 2001. And insurers that sold liability coverage back in the 1950s and 1960s to asbestos producers and those using asbestos had no inkling that decades later they would face huge losses.

This history illustrates that insurers must address at least three types of risk: known risks (those that are recognized and can be quantified); known unknowns (foreseeable risks that cannot be quantified given current knowledge); and unknown unknowns (risks that are not foreseeable.)

But the problem is multidimensional. Those types of risk exist for at least four categories of risk: hazard risk (the risk of insured losses); operational risk (e.g., the prospect of a major computer failure or other calamity that disrupts an insurer's ability to operate or the ever-present risk of fraud); financial risk (e.g., the current crisis in credit markets or a stock market crash); and strategic risk (e.g., major changes in competitive dynamics, customer needs, or laws and regulations).

Moreover, risks may be correlated with one another--positively or negatively. To illustrate positive correlation: An insurer domiciled in California and writing earthquake insurance could find that a geologic event cripples its operations at a time when claims come pouring in. To illustrate negative correlation: An economic recession that causes the value of an insurer's stock portfolio to drop could also lead to decreased driving and fewer personal auto bodily injury claims.

Insurers must understand the correlations between risks and manage with those correlations in mind.

The first step in the enterprise risk management process is to identify and judgmentally assess all the risks facing the enterprise. Yet even informed judgments can be way off base. And it is very easy to be biased without even realizing it. Good corporate (risk) management requires that senior managers leverage existing information to measure risks as accurately and objectively as possible. That translates into using the most accurate and complete information available to quantify known risks.

For large and complex organizations, the uncertainty associated with risks and opportunities must be measured consistently across all operations, so that the amount of uncertainty facing different parts of the enterprise can be compared and aggregated to arrive at a meaningful assessment of the overall uncertainty facing the entire organization. Ideally, an ERM team would be charged with ensuring consistency, transparency and risk quantification across all operations. And the ERM team would be independent of operations that generate or assume risk, so that it can function objectively.

Moreover, one or more ERM team members should have an appreciation for each of the material risks and opportunities associated with each activity of the entity, including the expected results and the distribution of possible outcomes for each activity, as well as the factors affecting results. Understanding these factors enables the ERM team to identify common factors giving rise to correlations that compound the effects of events.

Having assessed and quantified the uncertainty associated with each material risk and opportunity and the correlations between them, the ERM team would be positioned to determine which events are the most likely to occur and which could have the most severe consequences.

The ERM team would also be positioned to suggest and evaluate opportunities to manage risk through diversification, reinsurance or hedging, and other means. But all of this may come to naught if the ERM team doesn't provide its analysis to senior management in a way that is understandable and actionable.

Operationally, sound risk management has implications for insurer rate-making, reserving, reinsurance programs and an array of other activities, including due diligence for mergers and acquisitions.

Insurer rate-making should expand beyond determining the best central forecast for future (expected) losses. Rate-makers should also determine the distribution of potential losses around their expected value, so that risk can be factored into the pricing of insurance products.

Addressing underwriting risk also requires that insurers quantify and manage market uncertainty--the risk that insurers may have to settle for a price lower than they hoped to charge, and the opportunity that the market will permit insurers to charge more than they planned.

Analysis of the uncertainty associated with pending claims is also critical to the reserving function. Reserving specialists should provide the ERM team and senior management with not just their central forecasts for ultimate losses but also the distributions of possible outcomes around those forecasts.

Quantifying the uncertainty associated with potential losses is also critical to reinsurance decision-making. The measurement of expected losses and the distribution of possible outcomes enable reinsurance specialists to evaluate alternative reinsurance options.

But maximizing the payoff from such analyses requires that they be coordinated across the entire enterprise, so that reinsurance purchases are optimized for the organization as a whole and dovetail with the insurer's capital management program.

For rate-making, reserving and reinsurance programs, an insurer can use competitor and industry information to enhance its assessment of risk--but it must do so intelligently. When including data for other insurers in its own risk analysis, an insurer should develop insight into why its data differs from that of its competitors and then factor that insight into its decision-making. Insurers that don't do so are vulnerable to bad decisions that fail to reflect the unique attributes of their own businesses.

Insurers also need to understand how their actions contribute to changes in their risk profiles. For example, when an insurer tightens its underwriting standards, the amount of risk in its book of business may decline. On the other hand, when an insurer loosens its standards or writes more business with higher limits, the amount of risk in its book may increase.

Finally, with many mergers and acquisitions failing to yield the desired results, ERM has a role to play in the due-diligence process. More specifically, the ERM team could develop a risk profile for the post-merger enterprise.

With that accomplished, the team could help senior management make a range of critical decisions, including whether the possible returns are indeed worth the risk, how the risks associated with a transaction could be managed and how much capital the new entity may need to assure its viability.

JOHN J. KOLLAR is vice president, personal lines, increased limits and rating plans, at ISO.

MICHAEL R. MURRAY is ISO's assistant vice president for financial analysis.

May 1, 2008

Copyright 2008© LRP Publications