Objective 2 - Health Insurance Risks Flashcards
Regulatory actions levels for Health RBC ratios
Actions are based on the Health RBC ratio (defined in a separate list)
- Company Action Level (ratio of 150%-200%) - requires that a company submit a corrective action plan
- Regulatory Action Level (ratio of 100%-150%) - allows the commissioner to examine the company and issue and order specifying corrective actions
- Authorized Control Level (ratio of 70%-100%) - allows the commissioner to place the company under regulatory control if deemed to be in the best interests of policyholders and creditors
- Mandatory Control Level (ratio less than 70%) - requires the commissioner to take regulatory control of the company
Formula for Health RBC after Covariance
- RBCAC = H0 + {H1^2 + H2^2 + H3^2 + H4^2} ^ (1/2), where
a. H0 is the Asset Risk for Affiliates - the risk that a stock investment in an affiliate may lose value
b. H1 is the Asset Risk for Other Assets - the risk that investments may default or decrease in value
c. H2 is the Underwriting Risk - the risk of having inadequate premiums in the future (most impactful risk for health insurers)
d. H3 is the Credit Risk - the risk of not recovering the amounts owed to the insurer
e. H4 is the Business Risk - includes several misc. types of risk, such as admin expense risk and excessive growth risk - Authorized control level capital = RBCAC / 2
- Health RBC ratio = total adjusted capital / authorized control level capital
Formulas for the H2 (U/W Risk) component of Health RBC
- U/W Risk = Claim Experience Fluctuation Risk + Other U/W Risk
- Claim Experience Fluctuation Risk is the sum of risk charges for 5 product groupings (comprehensive, Med Supp, dental and vision, Medicare Pt D, and other)
a. For each grouping, the risk charge = premium * ratio of incurred claims to premium * risk factor * managed care risk adjustment factor
b. The last 2 components of this formula are pulled from tables of factors that vary by coverage type - Other U/W Risk includes:
a. Coverages not included in claim experience fluctuation risk, such as DI, LTC, stop loss, and AD&D. Various tables of factors are used for calculating risk charges for these coverages.
b. Adjustments for rate guarantees and premium stabilization reserves
Features of ERM that distinguish it from traditional risk management
- Instead of focusing on risk mitigation or avoidance, ERM creates organizational resilience in achieving corporate goals
- ERM views the organization holistically, rather than in silos
- ERM is embedded within the management framework, rather than being the responsibility of a single risk manager
- ERM provides a common language to discuss risks and opportunities
- ERM provides a framework for identification and evaluation of potentially harmful conditions and events
- ERM ensures the organization assumes no more risk than necessary in order to achieve its goals
The process of the typical risk management approach
- Identifying risk - identifying circumstances and events that may cause harm to the organization. This is where most risk management programs fall short because they are focused only on known risks.
- Evaluating risk - determining the likelihood and severity of those events
- Mitigating risk - applying methods that reduce the possibility these events will occur or reduce the financial impact when they occur
Reasons why organizations fail to detect emerging risks
- An uncertain future - it is likely to be different than what is expected
- Poor info about the current conditions in the organization and the environment lead to flawed expectations for the future
- Poor understanding of organizational complexity makes it difficult to understand the meaning of the info available
- Poor judgment in deciding how to respond to organizational challenges
- Financial incentives given to management do not align with other stakeholders
The ERM process for managing enterprise-wide risk
The traditional process (see separate list) is still used, but is approached differently
- ERM expands the risk profile by searching for unknown risk. This consists of:
a. Developing a detailed description of the business system (consider questions related to reasons it is difficult to detect emerging risks), and
b. Constructing the risk hypothesis, which is a structured understanding of the organization’s risk profile and its ability to achieve corporate goals under both normal and stressed conditions - Then traditional risk management is used to evaluate and mitigate known risks, with ERM ensuring that an integrated approach is used
a. Risk evaluation includes developing ranges of the likelihood and severity of potential harmful events
b. Risk mitigation involves deciding what to do about the various potentially harmful conditions - Then an appropriate risk capital is determined - regulators have mandated minimum capital requirements, but insurers should also hold additional surplus to reduce the likelihood of regulatory intervention
- ERM follows up with monitoring and oversight by the board of directors and senior management
Possible indicators of emerging risk
- High employee turnover
- Frequent reassignment or replacement of project managers for major initiatives
- Frequent downtime of computer systems
- Frequent manual overrides or intervention required
- Numerous manual processes
- Frequent complaints from internal or external customers
- Significant variance of key indicators from normal or best practice
- Reactive, rather than proactive, approach to problem solving
- The frequency of surprises
Typical information contained in the risk register
This register is created to record scenarios and events that have been considered in the risk evaluation
1. Description of the risk scenario
2. Details of how and when the scenario was identified
3. Which corporate goals the scenario affects
4. Description of the method used to quantify risk exposure and the time horizon for modeling
5. The range of outcomes considered
6. The outcome of a reverse stress test, which identifies the conditions that would cause risk capital to be exceeded
7. Assessment of likelihood and impact prior to mitigation under both normal and stressed environments
8. Description of mitigation strategies and assessment of their effectiveness and cost
9. Assessment of the likelihood and impact after mitigation
10. Assignment of responsibility for monitoring the risk scenario
11. Details regarding action plans
(Also see risk register list in Sweeting Ch. 8)
Types of risk mitigation strategies
- Risk avoidance - for example, choosing not to expand into new areas. This method will not work on most business risks because they are simply too unavoidable
- Risk transfer - the most common method is through insurance. For example, ceding large claim risk to a reinsurer
- Risk control - done through performance improvement. For example, actuarial and U/W risk is controlled through internal policies and using best practice methodologies
Characteristics to enter into the risk dashboard for each identified risk
The dashboard provides a high-level overview of the organization’s exposure to risk
- Brief description of the risk
- Line of business affected
- Gross likelihood - expected frequency of occurrence prior to mitigation
- Gross impact or severity - potential loss prior to mitigation
- Gross risk rating - the combination of likelihood and severity
- Control effectiveness - ability of mitigation strategies to reduce likelihood or severity
- Net likelihood after mitigation
- Net impact or severity after mitigation
- Net risk rating - combining likelihood and severity after mitigation, and including the effect on capital
- Tolerance - willingness to accept the risk remaining after mitigation
- Net risk rating vs. tolerance
- Action plan status - implementation status of mitigation strategies
Senior management responsibilities for implementing ERM
- Communicating support of the ERM process to the rest of the company
- Maintaining a culture of performance improvement and learning from successes and failures
- Allowing for open discussion of risk
- Providing direction to the risk management committee and chief risk officer
- Determining risk appetites and limits
- Establishing limits of authority for risk assumption
Responsibilities of the chief risk officer (CRO)
- Being the chief champion of the ERM process
- Leading the risk management committee
- Directing the ERM process by guiding business units as they prioritize, evaluate, and mitigate risk
- Guiding info collection and performance monitoring
- Testing the perceived risk profile
- Modifying the risk profile and risk models using emerging experience and knowledge
- Ensuring the organization continues to learn from emerging experience and that the risk profile is continuously update
Benefits of ERM
- Credit agencies may be willing to offer lower borrowing costs
- Regulators and the board of directors may allow management more flexibility in managing the company
- Management will better understand the business system
- The organization will know how much corporate risk capital should be held
- There will be fewer unknown risks
Common features of ERM frameworks
- An assessment of the context in which the framework is operating. This includes understanding the internal and external environments and the interests of stakeholders
- A consistent risk classification must be established
- The risks to which the organization is exposed must be identified
- The risks must be assessed and compared to target levels of risk
- A decision must be taken on how to deal with risks that exceed targets
- Measures to manage risk are implemented
- The process needs to be monitored, documented, and communicated
Models of risk management
- “Three lines of defense” - consists of the following tiers of risk management:
a. Day-to-day management by first-line business units
b. Ongoing monitoring by the central risk function (CRF)
c. Occasional audits of first-line business units and the CRF - “Offense and defense” - says the first-line business units should take as much risk as they can to maximize returns while the CRF should reduce risk as much as possible to minimize losses. Should be avoided because it sets up the first two lines of defense to be in opposition.
- Policy and policing - says the CRF should set risk management policies and then monitor compliance with those policies. But often results in the CRF being too “hands-off”.
- Partnership - says the first-line business level units and the CRF should work together closely to maximize returns subject to an acceptable level of risk. This may leave the CRF too involved to give and independent assessment of first-line units.
Categories of risk faced by organizations
- Market risk - the risk inherent from exposure to capital markets (eg, fluctuations in value of assets held)
- Economic risk - eg, price and salary fluctuation
- Interest rate risk - the risk arising from unanticipated changes in the overall level of interest rates or in the shape of the yield curve
- Foreign exchange risk - the risk when cash flows received are in a currency different from the cash flows due
- Credit risk - default risk (eg, a default on loans or a reinsurer failure)
- Liquidity risk - the risk that a firm cannot easily trade its assets or that it cannot raise additional financing when required
- Systemic risk - the risk of failure of a financial system (see separate list)
- Demographic risk
a. Mortality risk - the risk that a portfolio will suffer from mortality being greater than expected (negatively affects life insurance)
b. Longevity risk - the risk that a portfolio will suffer from mortality being less than expected (negatively affects pension and annuity business) - Non-life insurance risk - the risk related to the incidence of claims and their intensity
- Operational risks - risks that impact the way in which a firm carries on business (see separate list)
- Residual risks - risks that remain once action has been taken to treat a risk. For example, if an interest rate swap is used to reduce exposure to changes in interest rates, the residual risk is that the bank will not be able to make its payments on the swap.
Types of systemic risk
- Financial infrastructure - eg, a bank unable to pay back loans from other banks
- Liquidity risk - can become systemic if a run on banks occurs
- Common market positions - feedback risk is the risk that a change in an investment’s price will result in further changes in the same direction. This could then impact all investors who have common investment positions.
- Exposure to common counter-party - the risk that a relatively small failure will cascade through several layers of investors
Types of demographic (mortality or longevity) and non-life insurance risk
- Level risk (for life insurance) or U/W risk (for non-life insurance) - the risk that the average level of claims for a particular population will differ from what was assumed
- Volatility risk - the risk of claims differing from assumed due to volatility in a small population
- Catastrophe risk - the risk of large losses due to some significant event (such as a natural disaster)
- Trend risk - the risk claim rates will change unexpectedly from current levels
Types of operational risks
- Business continuity risk - the risk that an external event will affect the physical ability of a firm to carry on business at its normal place of work
- Regulatory risk - the risk that an organization will be negatively impacted by a change in legislation or regulation, or that it will fail to comply with current legislation or regulation
- Technology risk - the risk of a technology failure, including loss or disclosure of confidential info, data corruption, and computer system failure
- Crime risk - this results from the dishonest behavior of individuals (eg, theft of money or intellectual property by an employee)
- People risk (see separate list)
- Bias - a type of systemic risk
a. Deliberate bias can arise if key risks are intentionally omitted or downplayed
b. Unintentional bias may occur due to overconfidence in one’s ability to complete a difficult task - Legal risk - the risk arising from poorly-drafted legal documents
- Process risk - the risk inherent in the processes used by firms (eg, underwriting and claim handling)
- Model risk - the risk that financial models used to assess risk or otherwise help make financial decisions are flawed
- Data risk - the risk of using poor data
- Reputational risk - failures related to other risks can lead to a loss of confidence in the organization and a subsequent loss of business
- Project risk - refers to all of the various operational risks in the context of a particular project
- Strategic risk - the risk the organization will not make a conscious decision of what its strategy is and how it intends to implement it
Types of people risk
- Employment-related risks - the risk that the wrong people are employed, retained, or promoted
- Adverse selection - the risk that the demand for insurance will be positively correlated with the risk of loss
- Moral hazard - the risk that people who are insured will be less likely to avoid risk
- Agency risk - the risk that a party that is appointed to act on behalf of another will instead act on its own behalf
Broad areas in the risk identification process
- Risk identification tools (see separate list)
- Risk identification techniques (see separate list)
- Assessment of the nature of risks
a. Quantifiable risks can be modeled
b. Unquantifiable risks can often be analyzed by the groups that identify them - Recording risks in a risk register - the register details all of the risks faced by the organization. It should be constantly updated to reflect the changing nature of risks and the evolving environment
Risk identification tools
- SWOT analysis - identifies the organization’s:
a. Strengths (eg, market dominance, economies of scale, and effective leadership)
b. Weaknesses (eg, high costs, a lack of direction, and financial weakness)
c. Opportunities (eg, innovation, additional demand, and cheap funding)
d. Threats (eg, new competitors, price pressure, falling liquidity, and increased regulation) - Risk checklists - lists that are used as a reference for identifying risks in a particular organization or situation
- Risk prompt lists - similar to checklists, but rather than seeking to pre-identify every risk, they simply identify categories of risk that should be considered
- Risk taxonomy - more detailed than a prompt list, containing a description and categorization of all risks that might be faced
- Risk trigger questions - lists of situations or areas in an organization that can lead to risk
- Case studies - can suggest specific risks to consider, particularly if there are similarities to the organization in the case study
- Risk-focused process analysis - involves constructing flow charts for every process used by the organization and analyzing the points at which risks can occur
Risk identification techniques
- Brainstorming - this is an unrestrained or unstructured group discussion
- Independent group analysis - without collaboration, all participants write down ideas on risks that might arise. These ideas are aggregated and there is a discussion. Risks are anonymously ranked.
- Surveys - participants are given a list of questions about different aspects of the organization to try to draw out the risks faced
- Gap analysis - consists of a survey that asks two types of questions: the desired level of risk exposure and the actual level of exposure
- Delphi technique - begins with an initial survey of experts who comment on risks anonymously and independently. Is followed by subsequent surveys that are based on earlier responses. Continues until there is a consensus or stalemate.
- Interviews - individuals are interviewed independently to identify the organization’s risks
- Working groups - comprised of a small number of individuals who have familiarity with the risks identified. They investigate more fully the risks which have been identified already.
Information to include for each entry in the risk register
- A unique identifier
- The category within which the risk falls
- The date of assessment for the risk
- A clear description of the risk
- Whether the risk is quantifiable
- Info on the likelihood of the risk
- Info on the severity of the risk
- The period of exposure to the risk
- The current status of the risk
- Details of scenarios where the risk is likely to occur
- Details of other risks to which this risk is linked
- The risk responses implemented
- The cost of the responses
- Details of the residual risks
- The timetable and process for review of the risk
- The risk owner
- The entry author
(See also risk register list in Bluhm ch 47)