Objective 2 Flashcards
Regulatory action levels for Health RBC ratios
- Company Action Level (Ratio 150-200%) - company must submit a corrective action plan
- Regulatory Action Level (ratio 100-150%) - allows commissioner to examine the company and issue order specifying corrective actions
- Authorized Control Level (ratio 70-100%) - allows commissioner to place the company under regulatory control if deemed in the best interest of policyholders and creditors
- Mandatory Control Level (ratio lt 70%) - commissioner must take regulatory control
Formula for Health RBC after Covariance
- RBCAC = H0 + (H1^2 + H2^2 + H3^3 + H4^2) ^1/2
a) H0 = asset risk (affiliates)
b) H1 = asset risk (other)
c) H2 = underwriting risk
d) H3 = credit risk
e) H4 = business risk - Authorized control level capital = RBCAC/2
- Health RBC ratio = total adjusted capital / authorized control level capital
Formulas for H2 (underwriting risk) component of Health RBC
- Underwriting Risk = Claim Experience Fluctuation Risk + Underwriting Risk
- Claim Experience Fluctuation Risk is sum of risk charges for five product groupings (comprehensive, Med Supp, dental / vision, Med PD, and other)
a) for each grouping, risk charge = premium * ratio of incurred claims to premium * risk factor * managed care risk adjustment factor
b) The last two components come from tables of factors that vary by coverage type - Other Underwriting Risk includes
a) Coverages not included in 2, such as DI, LTC, stop loss, and AD&D. Tables of factors are used to calculate risk charges.
b) Adjustments for rate guarantees and PSRs
Features of ERM that distinguish it from traditional risk management
- Instead of focusing on risk mitigation or avoidance, ERM creates organizational resilience in achieving corporate goals
- Holistic (vs. siloed) view of org
- Embedded in management framework
- Provides common language to discuss risks and opportunities
- Provides a framework for identification and evaluation of potentially harmful conditions/events
- Ensures the org assumes no more risk than necessary to achieve corp goals
The process of the typical risk management approach
- Identify
- Evaluate
- Mitigate
Reasons why organizations fail to detect emerging risks
- Uncertain future
- Poor info about current conditions in org / environment lead to flawed future expectations
- Poor understanding of org complexity makes difficult to understand meaning of avail info
- Poor judgement in deciding how to respond
- Misaligned incentives between management / other stakeholders
ERM Process for managing enterprise-wide risk
Traditional process still used, but approached differently
- ERM expands risk profile by searching for unknown risk. Consists of:
a) Detailed description of business system
b) Construct risk hypothesis (structured understanding of risk profile / ability to achieve goals) - Traditional risk management is used to evaluate and mitigate known risks
- Appropriate risk capital is determined
- Monitoring and oversight by board / senior mgmt
Possible indicators of emerging risk
- High Ee Turnover
- Frequent reassignment of Proj Mgrs for major initiatives
- Frequent downtime of computer systems
- Frequent manual overrides or intervention required
- Numerous manual processes
- Frequent complaints from internal/external customers
- Significant variance of key indicators from normal / best practice
- Reactive (vs proactive) problem solving
- Frequent surprises
Typical information contained in the risk register
Created to record scenarios and events that have been considered in the risk evaluation
- Description of the risk scenario
- Details of how / when the scenario was identified
- Which corporate goals the scenario affects
- Description of the method used to quantify risk exposure and the time horizon for modeling
- The range of outcomes considered
- The outcome of a reverse stress test (IDs conditions that would cause risk capital to be exceeded)
- Gross likelihood and impact (normal / stressed envs)
- Description of mitigation strategies, assessment of effectiveness and cost
- Net likelihood and impact
- Assignment of responsibility for monitoring
- Details regarding action plans
Types of risk mitigation strategies
- Avoid
- Transfer
- Control
Characteristics to enter into the risk dashboard for each identified risk
High-level overview of the organization’s exposure to risk
- Brief description of the risk
- Line of business affected
- Gross likelihood
- Gross impact
- Gross risk rating
- Control effectiveness
- Net likelihood
- Net severity
- Net risk rating
- Tolerance
- Net risk rating vs. tolerance
- Action plan status
Senior management responsibilities for implementing ERM
- Communicate support of ERM process
- Maintain culture of performance improvement and learning from successes and failures
- Allow for open discussion of risk
- Provide direction to RM committee and CRO
- Determine risk appetites and limits
- Establish limits of authority for risk assumption
Responsibilities of the chief risk officer (CRO)
- Chief champion of ERM process
- Lead risk management committee
- Direct ERM process by guiding bus. units as they prioritize, evaluate, and mitigate risk
- Guiding info collection and perf monitoring
- Testing the perceived risk profile
- Modifying the risk profile and risk models using emerging experience and knowledge
- Ensuring the organization continues to learn from emerging experience and that the risk profile is continuously updated
Benefits of ERM
- Credit agencies may be willing to offer lower borrowing costs
- Regulators and the board of directors may allow management more flexibility in managing the company
- Management will better understand the business system
- The organization will know how much corporate risk capital to hold
- There will be fewer unknown risks
Common features of ERM frameworks
- Assessment of the context in which the framework is operating (int/ext env, interests of stakeholders)
- Consistent risk classification established
- Risks identified
- Risks assessed and compared to targets
- Decision made on risks that exceed targets
- Measures to manage implemented
- Monitor, document, communicate
Models of risk management
- Three lines of defense
a) Day-to-day management by first-line business units
b) Ongoing monitoring by central risk function (CRF)
c) Occasional audits of first-line business units and CRF - Offense and defense - first-line units take as much risk as they can, CRF reduces as much as possible. Avoid - puts first 2 lines in opposition.
- Policy and policing - CRF sets RM policies and then monitors compliance. Often results in “hands-off” CRF
- Partnership - first-line business units and CRF work together closely to maximize returns subj. to acceptable risk level. May leave CRF too involved to give ind assessment of first-line units.
Categories of risk faced by organizations
- Market
- Economic
- Interest rate
- Foreign exchange
- Credit
- Liquidity
- Systemic
- Demographic (mortality / longevity)
- Non-life insurance
- Operational
- Residual
Types of systemic risk
- Financial infrastructure
- Liquidity (in a run on banks)
- Common market positions
- Exposure to a common counter-party
Types of demographic and non-life insurance risk
- Level
- Volatility
- Catastrophe
- Trend
Types of operational risks
- Business continuity
- Regulatory
- Technology
- Crime
- People
- Bias (deliberate / unintentional)
- Legal
- Process
- Model
- Data
- Reputational
- Project
- Strategic
Types of people risk
- Employment-related
- Adverse selection
- Moral hazard
- Agency
Broad areas in the risk identification process
- Risk identification tools
- Risk identification techniques
- Assessment of nature (quantifiable / unquantifiable)
- Recording in a risk register