ERM Flashcards
Five Main Areas/Subfactors of ERM
- Risk management culture
- Risk controls
- Emerging risk management
- Risk models
- Strategic risk management
Insurer’s ERM Score - Describe overall score based on subfactors
- Very strong - strong & positive score for all subfactors and Economic capital model is assessed as either good or superior
- Strong - risk management culture, risk controls, and strategic risk management subfactors are scored positive, one or both of the other two subfactors is scored neutral, no subfactor is scored negative
- Adequate with strong risk controls - risk controls subfactor is scored positive, strategic risk management subfactor is scored neutral, and no subfactor is scored negative
- Adequate - risk controls and risk management culture subfactors are scored at least neutral; overall doesn’t satisfy the requirements for Adequate with strong risk controls
- Weak - one or both of the risk controls and risk management culture subfactors are scored negative
Considerations for the scoring of each risk under ERM
- Risk identification
- Risk measurement and monitoring
- Risk standards and limits
- Procedures to manage risks to stay within limits
- Execution of risk control programs
Uses of risk models under ERM
- Measure risk exposures
- Test risk correlation and diversification
- Validate risk mitigation strategies
- Quantify capital requirements for a given risk profile
Key areas of analysis for strategic risk management score under ERM
- Company’s strategic planning
- Product pricing and re-pricing
- Strategic asset allocation
- Reinsurance strategy
- Net retained risk profile
- New risk-bearing initiatives
- Capital budgeting
- Economic budgeting
- Optimization of risk-adjusted returns
Main risks for life insurers and health insurers
- Life insurers main risks
- Policyholder behavior risks
- Mortality risk
- Longevity risk
- Morbidity risk
- Health insurers main risk
- Morbidity risk
Two key items of uncertainty of reserving risk for P&C
- Level of reserves that will utltimately be needed to meet all liabilities
- Timing of those liabilities
Significant concerns for health insurers and key risks under ERM
- Significant conerns
- Rising medical costs
- Changing regulations and legislation
- Less-than-perfect data in the underwriting and pricing processes
- Key risks
- Underwriting risk
- Pricing risk
- Claims management risk
- Provider renewal risk
Key elements essential to all insurers’ Operational Risk Controls under ERM
- Procedures in place to systematically identify operational risks and to monitor, assess, and mitigate those identified risks.
- Sound business continuity plan that has undergone mutliple drills
Key areas of an insurer’s risk management culture
- Risk governance and organization structure
- Risk appetite framework
- Risk reporting and communication
- Incentive compensation structures
Definition and Two key principles of ERM
- Definition: ERM is a structured analytical process focused on identifying and eliminating the financial impact and volatility of a portfolio of risks, rather than focusing on risk avoidance alone.
- Key Principles of ERM:
- Recognizes broad range of risks as either sources of capital or potential for losses
- Holistic approach to managing diverse risks - risks are not isolated in silos
Risk domains of ERM
- Operational - organization’s core business, including systems and practices
- Financial - organizations ability to earn, raise, or access capital, as well as costs associated with transfer of risk
- Human - recruiting, retaining and managing workforce
- Strategic - ability of organization to grow and expand
- Legal/Regulatory - health care statutory and regulatory compliance, licensure, and accreditation
- Technological - associated with biomedical and information technologies, equipment, devices and telemedicine
Issues with traditional risk management
- Fails to appreciate relationships among risks
- Lacks optimization of collective risk evaluation
- Lacks common definition of risk and how to guage risk management efforts
Risk handling categories under ERM (ways to deal with risk)
- Risk avoidance
- Acceptance
- Reduction
- Sharing
Roles and responsibilities under ERM
- CRO - responsible for identifying and quantifying risks and managing the process, analyzing risk strategically. Facilitator, liaison, etc.
- Board of Directors - provides oversight, understand key elements and discuss risks regularly
- CEO/President - responsible for molding corporate cutlure and making sure ERM functions effectively
- CFO - provides analytical insight to determine risk appetite
- Health Care Risk Manager - front lines of risk management and focused on daily operations
- Middle Managers and Others - understand risks they are accountable for and manage them within approved tolerances
COSO ERM Framework
- Process
- Effected by people
- Applied in strategy setting
- Applied across enterprise
- Designed to identify potential events
- Manages risks to be within risk tolerance
- Provides “reasonable assurance”
- Supports achievement of key objectives
What distinguishes CRO from Risk Manager?
- Risk Manager
- Snapshot view
- Lacks wider view to see patterns/relationships
- Not sufficiently involved with sr. leadership
- Decisions based on isolated issues or circumstances
- CRO
- Decision based on total picture of risks and opportunities
- Connects dots among risks in all departments; Empowered to examine workings of all departments
- Unlimited access to sr. management
- Thinks outside the box
Three major tasks for CRO (broad list)
- Coordinating all risk management activities
- Introducing integrated framework
- Improving risk communication with internal and external partners
Key tasks for CRO (different from major tasks for CRO)
- Train and communicate with workforce on policies and structures
- Educate investment committee on risk management strategy
- Chair ERM committee
- Determine risk tolerance
- Develop alternative risk strategies
- Ensure compliance with regulations
- Disclosures (internal and external)
- Evaluate insurance coverage
- Assure business continuity
- Identify and monitor emergent risks
- Extend risk principles to broader strategy
- Policy assessment
- Inform board of significant risk issues
- Deliver integrated picture of risk
- Develop data strategy to build picture of operational risk
- Develop framework for risk management
HINT: TIC TAC DICES PB PDF
Regulatory action levels for health RBC ratios
- Company action: 150%-200% - submit corrective action plan
- Regulatory action: 100%-150% - submit corrective action plan and Commissioner may issue an order specifying corrective actions
- Authorized control: 70%-100% - Commissioner may place company under regulatory control
- Mandatory control: <70% - Commissioner must take regulatory control of the company
Reasons why NAIC RBC model influences states that haven’t adopted the model act
- All companies filing an Orange blank (medical) must calculate health RBC for annual statement
- Regulators are familiar with the RBC concept and express concerns when TAC/ACL ratio is below 200%
- Quasi-regulatory agencies like BCBS have embraced Health RBC ratios and may require these levels from companies associated with them
Formula for health RBC after Covariance (RBCAC)
RBCAC = H0+Sqrt(H12+H22+H32+H42)
- H0 - Asset risk for affiliates
- H1 - Asset risk for other assets
- H2 - Underwriting risk
- H3 - Credit risk
- H4 - Business risk
Authorized Control Level (ACL) = RBCAC/2
Health RBC ratio = total adjusted capital (TAC) / ACL
Components of Underwriting risk (H2)
- Claims fluctuation risk
- Other underwriting risk
Life RBC formula
RBCAC = C0+C4a+sqrt[(C1o+C3a)2+(C1cs+C3c)2+C22+C3b2+C4b2]
- C0 - Asset risk - affiliates
- C1cs - Asset risk - unaffiliated common stock and affiliated noninsurance stock
- C1o - Asset risk - all other
- C2 - Insurance risk
- C3a - Interest rate risk
- C3b - Health credit risk
- C3c - Market risk
- C4a - Business risk
- C4b - Admin component of business risk
Procedures and uses of the simplified RBC estimations
- For health insurance H2 is the dominant risk, so the RBC = H2
- As a result, RBC Rationew ≈ RBC Ratioprior * (oldH2/newH2)
Categories of risk faced by organizations
- Basis risk
- Foreign exchange risk
- Liquidity risk
- Non-life insurance risk
- Systemic risk
- Demographic risk
- Operational risk
- Credit risk
- Residual risk
- Interest rate risk
- Market and economic risk
- Environmental risk
HINT: BELLS DO CRIME
Types of systemic risk
- Common market positions
- Financial infrastructure
- Liquidity risk
- Exposure to common counter-party
HINT: MILC
Types of demographic (mortality/longevity) and non-life insurance risk
- Level risk (for life insurance) or underwriting risk (for non-life insurance)
- Volatility risk
- Catastrophe risk
- Trend risk
Basel Committee definitions of types of operational risk
- Internal fraud
- External fraud
- Employment practices and workplace safety
- Client, products, and business practices
- Damage to physical assets
- Business disruption and system failures
- Execution, delivery, and process management
Other types of operational risk (non-Basel definitions)
- Crime risk
- Technology risk
- Cyber risk
- Regulatory risk
- People risk
- Legal risk
- Model risk
- Data risk
- Reputational risk
- Project risk
- Strategic risk
Other types of operational risk (non-Basel definitions): Types of People risk
- Indirect employment-related risks
- Adverse selection
- Moral hazard
- Agency risk
- Bias
Broad areas in the risk identification process
- Risk identification tools
- Risk identification techniques
- Assessment of the nature of the risks
- Recording risks in a risk register