19 Emphasis 2016/1

Mike Wilkinson Specializes in insurance management consulting. Willis Towers Watson, London

Matthew Peters Specializes in risk and capital management. Willis Towers Watson, Chicago

Kevin Madigan Specializes in P&C enterprise risk management. Willis Towers Watson, New York

What Can Insurers Really Do With ERM?Strategize Wisely to Deliver ValueBy Kevin Madigan, Matthew Peters and Mike Wilkinson

Enterprise risk management (ERM) remains an important strategic partner for insurance companies and will become even more embedded in business processes as tangible operational and strategic benefits accrue.

ERM is now well established as a way to integrate sound risk decisions throughout an organization. Initially, its growing acceptance was driven largely by external stimuli such as regulation or rating agencies. That’s changing. Although still important, an insurance company’s investment in ERM is now equally likely to be driven by its board of directors or senior management (Figure 1).

These new proponents are important, as those intimately familiar with the operations of a company are engaged in a systematic approach to risk management. Insurers that focus primarily on their own businesses and tie their programs directly to their business planning and goals are more likely to be satisfied with ERM. In fact, Willis Towers Watson’s most recent ERM survey found that 74% of insurers view risk management as a strategic partner in the business, and 73% of those insurers are happy with their ERM programs.

Those companies that haven’t yet engaged their risk management function as a strategic partner should consider the business benefits of making this connection. Insurers can begin this exercise by asking themselves what it means to be strategic and what they can do now to advance their ERM priorities in the context of the company’s broader business objectives.

Figure 1. Key ERM change drivers

0% 20% 40% 60% 80%

We have not made substantial changes to our ERM framework in the last two years

Other

International Association of Insurance Supervisors global capital standards

Senior management/board desire to manage costs (e.g., to produce a leaner, more e�cient ERM framework)

Rating agency requirements

Regulatory requirements in other jurisdictions (current/under development)

Group reporting requirements

Board desire for improved ERM as good business practice

Senior management desire for improvedERM as good business practice

Local regulatory requirements (current/under development)6161

4444

2525

1717

1414

1111

44

33

77

33

59% cite either senior management and/or board desire for improved ERM

72% Asia Pacific63% Europe47% North America

20 willistowerswatson.com

Where to Start?

Acknowledging your company’s most pressing ERM challenges can be a useful place to start. Common areas of uncertainty we hear from the industry include:

ß What to do when paralyzed by all the possibilities

ß Where to find the most cost-effective solutions

ß How to embed model results within business processes

ß How to integrate risk strategy across the organization

ß How ERM helps in the current soft-market environment

ß How to synthesize complex, multiple metrics for decision making

This groundwork can help a company get a basic sense of how it is progressing. Some insurers are well on their way to integrating ERM into their decision-making and business processes, and some are not quite there yet but have made significant progress. Other companies are just now getting started.

Even those insurers that have established ERM programs intend to continue to develop and refine them. During the last two years, the desire by senior management and boards to improve ERM as a good business practice has been a key driver for change at six out of 10 companies. There is good reason for this: Insurers are over 50% more likely to be satisfied with their ERM programs if they have integrated them with their strategic planning, business planning or risk appetite, or linked their risk appetite and risk limit frameworks.

In fact, Willis Towers Watson’s survey found that when ERM is embedded in a company’s operations, there is significantly greater satisfaction with the ERM program than when no direct link exists (Figure 2).

The Initial Assessment

Once a company understands its most pressing ERM challenges and where it falls in the spectrum of ERM readiness, it can begin to answer the questions, “Precisely what do we need?” and “How can risk management become more strategic?”

Answering these questions is easier if an insurance company has a clear focus on its mission and how risk management helps to achieve it. For instance, does risk management exist largely to prevent a company from going out of business? Or are there other drivers such as smoothing shareholder returns or ensuring that a company adheres to its business plan?

There are benefits to being clear about the purpose of your ERM program, understanding what you’re testing for, and staying true to your company’s mission and communicating that purpose. In fact, nearly half of all respondents (47%) have set up processes for the external communication of risk exposure against risk appetite. More than half (57%) indicate that further work is needed in this area.

A clearly defined risk culture also helps senior management identify ERM needs: 64% of the respondents to the Willis Towers Watson survey reported that risk culture enhanced business performance over the last 24 months. An ERM framework, and especially the carefully crafted risk appetite and risk tolerance framework, needs to completely align with a company’s risk culture. Without that connection, there is the risk of a tick-box approach to risk management processes and rules, or that they will be completely ignored.

Each element of risk management also needs to be linked cohesively. If risk appetite is not linked with strategy, there is a good chance a company will fail to meet its mission. Efficiently using ERM in business planning helps make the risk appetite framework meaningful and useful. Risk tolerances and limits, and monitoring components of ERM not only ensure that a company’s risk profile is aligned with its risk appetite; they also help an insurer determine if its risk appetite and associated risk tolerances are appropriately aligned to its mission, and highlight areas where adjustments may be needed.

Figure 2. ERM satisfaction* is stronger when linked to operations

0% 20% 40% 60% 80% 100%

ERM to strategic planning

Risk appetite frameworks to specific risk limits

ERM to business planning

n Program linkage n No business linkage

84845555

76765050

82825353

*Two distinct participant groups were surveyed in separate questions: those insurers that linked ERM to their companies’ operations and those that didn’t.

Insurers that focus primarily on their own businesses and tie their programs directly to their business planning and goals are more likely to be satisfied with ERM.

21 Emphasis 2016/1

Perhaps that is why more than three-quarters of respondents view risk appetite and culture as being highly important to their ERM programs — the two top-ranking aspects in the ultimate/end-state vision of an ERM program.

However, while risk appetite and risk tolerance are an integral part of ERM, the Willis Towers Watson survey still revealed that 24% of insurers didn’t consider risk appetite and tolerance as highly important to ERM. This may in part be explained by the tendency for respondents to give higher ranking to current priorities and gaps rather than areas they feel they have addressed. We also found that:

ß 84% of insurers have a documented risk appetite statement.

ß 57% expect to make further changes to their risk strategy or appetite in the next 24 months.

ß 95% cite relevant and robust risk reporting systems that provide timely information as important to their ERM program.

Risk appetite is a nuanced process, requiring an understanding of risk aggregations and diversification. In practice, this understanding takes time to master and requires a combination of mathematical and empirical approaches to ensure that the results are both understandable by, and useful to, the wider business. Flexibility to explore risk alternatives is therefore a necessary complement to a mathematical, data-driven framework that implements reporting and marketing intelligence that provides risk insights for the business.

Where Do We Stand?

An initial self-evaluation of risk culture and management prepares an insurance company to begin examining its risk framework: Is there a risk framework, and if so, is it adequate? Is there a strong ERM program in place?

A company must decide whether it is better served to build upon a basic ERM framework or to develop a comprehensive model that can immediately be applied to all facets of the business. Ultimately, it depends upon an insurer’s profile, including size, product mix, geographical footprint and distribution, as well as its overall strategy. All frameworks should be scalable, but the company needs to decide the starting point. Perhaps it needs to be a very simple framework with rudimentary risk assessments, and simplistic capital and solvency projections. More robust risk and capital models may be needed that better reflect the company’s mission and risk management objectives.

Multinationals will need to build safeguards in any ERM program to ensure that regional regulations and risks are recognized and that work from other projects, such as work done to prepare for Solvency II implementation, is incorporated into ERM frameworks (Figure 3).

Another consideration is whether an insurer is sufficiently leveraging its ERM program. A company needs to examine whether there are additional uses for a framework that may not have been contemplated, or that may need to be contemplated as a company’s strategic direction or business goals mature or change. If the framework can be better leveraged, is it flexible enough to change as well?

Figure 3. Risk management integration by region

Total EuropeNorth America

Asia Pacific

Asset/Investment strategy 56% 66% 53% 56%

Capital adequacy assessment/management/allocation 52% 70% 51% 45%

Risk transfer 50% 53% 59% 42%

Regulatory and financial reporting disclosures 40% 49% 42% 35%

Product design and pricing 40% 41% 36% 42%

Mergers and acquisitions, and divestitures 36% 54% 36% 26%

Annual business planning 35% 59% 34% 27%

Strategic planning 30% 41% 33% 24%

Bonus/Credit rating strategy 29% 45% 27% 25%

Performance management 22% 23% 23% 20%

Incentive compensation 21% 25% 22% 17%

Outsourcing 20% 29% 12% 25%

Distribution 13% 14% 10% 15%

22 willistowerswatson.com

The right amount of information is needed to best leverage a framework. Too much data can paralyze ERM efforts. Complex ERM models generate a lot of data, but the risk function needs to present understandable information that allows the board and senior management to make strategic decisions that will advance the company’s objectives. A risk function can help the business look at risk drivers, both qualitative and quantitative, derived from both capital models and the business’s leading indicators.

Practical Considerations

Insurance companies benefit by making ERM a strategic partner that helps effectively align risk management with decision making. Strategic partnering is facilitated with a careful evaluation of linkages and operations. Those insurers that are able to achieve this partnering can more effectively manage a wide variety of responsibilities including reaching out to clients and other stakeholders, managing distribution systems and using reinsurance programs to manage risk.

LinkagesIt’s important to align all business functions with ERM processes. However, some insurers struggle in practice to link up capital modeling, reserving, pricing, claims and underwriting with risk management. But as the many insurers that are already making this alignment can attest, the communication among different business functions helps advance medium- and long-term goals (e.g., capital modeling takes on a dimension beyond its most basic function and contributes to broader business strategy goals).

Ultimately, senior management, especially the C-suite team and the board of directors, must impress the company’s commitment to ERM upon employees and external stakeholders, including institutional investors and rating agencies. While this engagement is a well-known, critical component of ERM, refreshing the message can be valuable. Clear, consistent communication and regular reinforcement of commitment from the top is essential. Communication should also be linked to result-focused activity, such as the creation of cross-participation committees tasked with monitoring performance.

Linkages should also reflect the ties between enterprise risk tolerances, and both companywide and local risk limits.

OperationsA sustainable ERM program needs to be both cost effective and efficient. Here, models and technology can play an important role under business-as-usual conditions, beyond the main development phases.

Technology is a powerful tool that can facilitate ERM efficiency with model results that are faster and more reliable. While we are seeing some exciting advances such as cloud computing, it’s essential to remember that a model’s appropriate role is to inform the decision-making process; it should not be the sole basis for decision making. By automating and simplifying the day-to-day running of models, including data validation, business teams are empowered to explore more what-ifs and have more time to focus on strategy rather than the process of churning out and validating numbers. The real value add of faster software calculations is freeing up time to provide meaningful insights that advance business functions, such as improving the connections between product development and risk management, for example.

Flexibility is also needed. Models should be sufficiently flexible so that they can be adapted to fit changing needs, including software improvements, and remain fit for purpose over time by adapting with the business. Our survey found that many companies are making model improvements: 35% have identified using better methodology for individual risks as a priority, and 31% have done the same for implementing better control of model data and calculations, and better model validation. However, even with improvements, models can have limitations such as length of run time or not addressing the underlying causes of market variables.

An insurer should also perform frequent, independent model validations of all models used for management and strategic decision making. Validations help manage model risk, ensure the reasonableness and appropriateness of relying on key models to make decisions, and help assess data quality and the value of information generated by them. A robust, practical and well-designed validation process and reporting protocol can help the board and senior management engage more effectively with their key models, understand their value and limitations, and build greater trust in their results.

Once ERM challenges are understood, a company can ask, “Precisely what do we need?” and “How can risk management become more strategic?”

23 Emphasis 2016/1

programs were over half complete in 2014 compared with 59% in 2012, and 71% said the same of their risk appetite and tolerance statements in 2014 versus 57% in 2012.

There is good reason for this interest. Seventy percent of respondents reported they expect ERM to result in increased shareholder value through enhanced risk/return decision making, and 61% expect greater risk taking as the result of an enhanced ability to manage risks. Other value adds to the business include those listed in Figure 4.

As ERM matures, we’re seeing more positive drivers that reinforce the importance of strategic partnering, including investment decisions, how to make the best use of capital and financial resources, and how to change a portfolio or make M&A decisions, which is particularly important in today’s market. In other words, connecting risk management to company strategy can help maximize a company’s limited resources on a risk-adjusted basis. Strategize wisely about how you will use ERM to deliver value.

For comments or questions, call or email Kevin Madigan at +1 212 309 3608, kevin.madigan@willistowerswatson.com; Matthew Peters at +1 312 201 5183, matthew.peters@willistowerswatson.com; or Mike Wilkinson at +44 207 170 3018, mike.wilkinson@willistowerswatson.com.

The Right Fit

Insurers that view the risk function as a strategic partner are more likely to realistically assess their risk positions and remain true to their missions. This strategic partnering doesn’t require a complex ERM framework, but rather the most deft, flexible ERM program that frees company talent to make strategic business decisions.

That deftness is possible when all of a company’s business functions are on board with ERM and cooperate to ensure that each of their responsibilities contribute to the overall sound risk management of the company. When business functions participate in the ERM process, the right risk choices can be made, the company’s positioning can be on point, and it can weather current and future industry conditions such as today’s soft P&C market and broader economic trends.

Risk management input needs to be an early part of the planning process. Companies that maximize a risk/return trade-off as opposed to merely reducing risk are most likely to have successful ERM programs. Risk management needs to be routinely integrated into strategic decision making at the beginning to better influence decisions.

Indeed, it appears that many insurers are now interested in a far more strategic use of their ERM programs: 59% reported that there is a desire by either the board of directors or senior management for improved ERM as a good business practice. The progress made by our survey participants supports this growing interest: 75% of respondents said their risk monitoring

Figure 4. How ERM programs add business value

0% 20% 40% 60% 80% 100%

Reduced ongoing costs of risk management due to more e�cient and e�ective processes

Reduced cost of capital, or haircuts to valuation, through enhanced stakeholder perceptions of the business

Reduced impact of day-to-day risk losses

Greater risk taking through enhanced ability to manage risks

Reduced capital requirements through improved understanding of the business risk profile

Increased shareholder value through enhanced risk/return decision making

Avoidance of large unexpected losses that threaten the organization's viability

Stronglyagree

Somewhatagree

Neither agreenor disagree

Somewhatdisagree

Stronglydisagree

2727 4646 1515 77 55

2727 4343 2020 66 44

1717 4040 2525 1212 66

1414 4747 2323 1212 44

1010 4040 3434 1313 33

88 3333 4040 1414 55

77 3333 3737 2020 33

74% of non-mutual companies agree or strongly agree

Insurance companies benefit by making ERM a strategic partner that helps effectively align risk management with decision making.