What Can Insurers Really Do
With ERM?
Strategize Wisely to Deliver Value
By Kevin Madigan, Matthew Peters and Mike Wilkinson
Enterprise risk management (ERM)
remains an important strategic partner
for insurance companies and will become
even more embedded in business
processes as tangible operational and
strategic benefits accrue.
Kevin Madigan
Specializes in P&C
enterprise risk
management.
Willis Towers Watson,
New York
Matthew Peters
Specializes in risk and
capital management.
Willis Towers Watson,
Chicago
Mike Wilkinson
Specializes in
insurance
management
consulting.
Willis Towers Watson,
London
ERM is now well established as a way to integrate sound risk
decisions throughout an organization. Initially, its growing
acceptance was driven largely by external stimuli such as
regulation or rating agencies. That’s changing. Although still
important, an insurance company’s investment in ERM is now
equally likely to be driven by its board of directors or senior
management (Figure 1).
These new proponents are important, as those intimately
familiar with the operations of a company are engaged in a
systematic approach to risk management. Insurers that focus
primarily on their own businesses and tie their programs
directly to their business planning and goals are more likely
to be satisfied with ERM. In fact, Willis Towers Watson’s
most recent ERM survey found that 74% of insurers view risk
management as a strategic partner in the business, and 73%
of those insurers are happy with their ERM programs.
Those companies that haven’t yet engaged their risk
management function as a strategic partner should consider
the business benefits of making this connection. Insurers
can begin this exercise by asking themselves what it means
to be strategic and what they can do now to advance their
ERM priorities in the context of the company’s broader
business objectives.
Figure 1. Key ERM change drivers
0%
20%
40%
60%
Local regulatory requirements (current/under development)
61
Senior management desire for improved
72% Asia Pacific
ERM as good business practice
63% Europe
44
47% North America
Board desire for improved ERM
as good business practice
25
Group reporting requirements
17
59% cite either senior
management and/or
board desire for
improved ERM
Regulatory requirements in other jurisdictions
(current/under development)
14
Rating agency requirements
11
Senior management/board desire to manage costs
(e.g., to produce a leaner, more efficient ERM framework)
4
International Association of Insurance Supervisors
global capital standards
3
Other
7
We have not made substantial changes to our ERM
framework in the last two years
3
19
Emphasis 2016/1
80%
Figure 2. ERM satisfaction* is stronger when linked to
operations
0%
Where to Start?
Acknowledging your company’s most pressing ERM
challenges can be a useful place to start. Common areas of
uncertainty we hear from the industry include:
ßß
What to do when paralyzed by all the possibilities
20%
ßß
How to integrate risk strategy across the organization
ßß
How ERM helps in the current soft-market environment
60%
80%
100%
ERM to business planning
55
84
Risk appetite frameworks to specific risk limits
76
50
ERM to strategic planning
ßß
Where to find the most cost-effective solutions
ßß
How to embed model results within business processes
40%
53
n Program linkage
82
n No business linkage
*Two distinct participant groups were surveyed in separate questions: those
insurers that linked ERM to their companies’ operations and those that didn’t.
ßß
How to synthesize complex, multiple metrics for decision
making
This groundwork can help a company get a basic sense of
how it is progressing. Some insurers are well on their way
to integrating ERM into their decision-making and business
processes, and some are not quite there yet but have
made significant progress. Other companies are just now
getting started.
Even those insurers that have established ERM programs
intend to continue to develop and refine them. During the
last two years, the desire by senior management and boards
to improve ERM as a good business practice has been a
key driver for change at six out of 10 companies. There is
good reason for this: Insurers are over 50% more likely to
be satisfied with their ERM programs if they have integrated
them with their strategic planning, business planning or risk
appetite, or linked their risk appetite and risk limit frameworks.
In fact, Willis Towers Watson’s survey found that when ERM
is embedded in a company’s operations, there is significantly
greater satisfaction with the ERM program than when no
direct link exists (Figure 2).
The Initial Assessment
Once a company understands its most pressing ERM challenges
and where it falls in the spectrum of ERM readiness, it can begin
to answer the questions, “Precisely what do we need?” and
“How can risk management become more strategic?”
Answering these questions is easier if an insurance company
has a clear focus on its mission and how risk management
helps to achieve it. For instance, does risk management exist
largely to prevent a company from going out of business? Or are
there other drivers such as smoothing shareholder returns or
ensuring that a company adheres to its business plan?
20
willistowerswatson.com
Insurers that focus primarily on their own
businesses and tie their programs directly to
their business planning and goals are more
likely to be satisfied with ERM.
There are benefits to being clear about the purpose of your
ERM program, understanding what you’re testing for, and
staying true to your company’s mission and communicating
that purpose. In fact, nearly half of all respondents (47%)
have set up processes for the external communication of risk
exposure against risk appetite. More than half (57%) indicate
that further work is needed in this area.
A clearly defined risk culture also helps senior management
identify ERM needs: 64% of the respondents to the Willis
Towers Watson survey reported that risk culture enhanced
business performance over the last 24 months. An ERM
framework, and especially the carefully crafted risk appetite
and risk tolerance framework, needs to completely align with
a company’s risk culture. Without that connection, there is the
risk of a tick-box approach to risk management processes
and rules, or that they will be completely ignored.
Each element of risk management also needs to be linked
cohesively. If risk appetite is not linked with strategy, there
is a good chance a company will fail to meet its mission.
Efficiently using ERM in business planning helps make
the risk appetite framework meaningful and useful. Risk
tolerances and limits, and monitoring components of ERM
not only ensure that a company’s risk profile is aligned with
its risk appetite; they also help an insurer determine if its risk
appetite and associated risk tolerances are appropriately
aligned to its mission, and highlight areas where adjustments
may be needed.
Figure 3. Risk management integration by region
Total
Asset/Investment strategy
56%
66%
North
America
53%
Asia
Pacific
56%
Capital adequacy assessment/management/allocation
52%
70%
51%
45%
Risk transfer
50%
53%
59%
42%
Regulatory and financial reporting disclosures
40%
49%
42%
35%
Product design and pricing
40%
41%
36%
42%
Mergers and acquisitions, and divestitures
36%
54%
36%
26%
Annual business planning
35%
59%
34%
27%
Strategic planning
30%
41%
33%
24%
Bonus/Credit rating strategy
29%
45%
27%
25%
Performance management
22%
23%
23%
20%
Incentive compensation
21%
25%
22%
17%
Outsourcing
20%
29%
12%
25%
Distribution
13%
14%
10%
15%
Perhaps that is why more than three-quarters of respondents
view risk appetite and culture as being highly important to
their ERM programs — the two top-ranking aspects in the
ultimate/end-state vision of an ERM program.
However, while risk appetite and risk tolerance are an
integral part of ERM, the Willis Towers Watson survey still
revealed that 24% of insurers didn’t consider risk appetite
and tolerance as highly important to ERM. This may in part
be explained by the tendency for respondents to give higher
ranking to current priorities and gaps rather than areas they
feel they have addressed. We also found that:
ßß
84% of insurers have a documented risk appetite statement.
ßß
57% expect to make further changes to their risk strategy
or appetite in the next 24 months.
ßß
95% cite relevant and robust risk reporting systems that
provide timely information as important to their ERM
program.
Risk appetite is a nuanced process, requiring an
understanding of risk aggregations and diversification. In
practice, this understanding takes time to master and requires
a combination of mathematical and empirical approaches to
ensure that the results are both understandable by, and useful
to, the wider business. Flexibility to explore risk alternatives is
therefore a necessary complement to a mathematical, datadriven framework that implements reporting and marketing
intelligence that provides risk insights for the business.
21
Europe
Emphasis 2016/1
Where Do We Stand?
An initial self-evaluation of risk culture and management
prepares an insurance company to begin examining its risk
framework: Is there a risk framework, and if so, is it adequate?
Is there a strong ERM program in place?
A company must decide whether it is better served to build
upon a basic ERM framework or to develop a comprehensive
model that can immediately be applied to all facets of the
business. Ultimately, it depends upon an insurer’s profile,
including size, product mix, geographical footprint and
distribution, as well as its overall strategy. All frameworks
should be scalable, but the company needs to decide the
starting point. Perhaps it needs to be a very simple framework
with rudimentary risk assessments, and simplistic capital and
solvency projections. More robust risk and capital models
may be needed that better reflect the company’s mission and
risk management objectives.
Multinationals will need to build safeguards in any ERM
program to ensure that regional regulations and risks are
recognized and that work from other projects, such as
work done to prepare for Solvency II implementation, is
incorporated into ERM frameworks (Figure 3).
Another consideration is whether an insurer is sufficiently
leveraging its ERM program. A company needs to examine
whether there are additional uses for a framework that
may not have been contemplated, or that may need to be
contemplated as a company’s strategic direction or business
goals mature or change. If the framework can be better
leveraged, is it flexible enough to change as well?
The right amount of information is needed to best leverage
a framework. Too much data can paralyze ERM efforts.
Complex ERM models generate a lot of data, but the risk
function needs to present understandable information that
allows the board and senior management to make strategic
decisions that will advance the company’s objectives. A
risk function can help the business look at risk drivers, both
qualitative and quantitative, derived from both capital models
and the business’s leading indicators.
Practical Considerations
Insurance companies benefit by making ERM a strategic
partner that helps effectively align risk management with
decision making. Strategic partnering is facilitated with a
careful evaluation of linkages and operations. Those insurers
that are able to achieve this partnering can more effectively
manage a wide variety of responsibilities including reaching
out to clients and other stakeholders, managing distribution
systems and using reinsurance programs to manage risk.
Linkages
It’s important to align all business functions with ERM
processes. However, some insurers struggle in practice
to link up capital modeling, reserving, pricing, claims and
underwriting with risk management. But as the many insurers
that are already making this alignment can attest, the
communication among different business functions helps
advance medium- and long-term goals (e.g., capital modeling
takes on a dimension beyond its most basic function and
contributes to broader business strategy goals).
Ultimately, senior management, especially the C-suite team
and the board of directors, must impress the company’s
commitment to ERM upon employees and external
stakeholders, including institutional investors and rating
agencies. While this engagement is a well-known, critical
component of ERM, refreshing the message can be valuable.
Clear, consistent communication and regular reinforcement
of commitment from the top is essential. Communication
should also be linked to result-focused activity, such as
the creation of cross-participation committees tasked with
monitoring performance.
Linkages should also reflect the ties between enterprise risk
tolerances, and both companywide and local risk limits.
22
willistowerswatson.com
Operations
A sustainable ERM program needs to be both cost effective
and efficient. Here, models and technology can play an
important role under business-as-usual conditions, beyond
the main development phases.
Technology is a powerful tool that can facilitate ERM efficiency
with model results that are faster and more reliable. While we
are seeing some exciting advances such as cloud computing,
it’s essential to remember that a model’s appropriate role is
to inform the decision-making process; it should not be the
sole basis for decision making. By automating and simplifying
the day-to-day running of models, including data validation,
business teams are empowered to explore more what-ifs and
have more time to focus on strategy rather than the process
of churning out and validating numbers. The real value add
of faster software calculations is freeing up time to provide
meaningful insights that advance business functions, such
as improving the connections between product development
and risk management, for example.
Flexibility is also needed. Models should be sufficiently
flexible so that they can be adapted to fit changing needs,
including software improvements, and remain fit for purpose
over time by adapting with the business. Our survey found
that many companies are making model improvements: 35%
have identified using better methodology for individual risks
as a priority, and 31% have done the same for implementing
better control of model data and calculations, and better
model validation. However, even with improvements, models
can have limitations such as length of run time or not
addressing the underlying causes of market variables.
An insurer should also perform frequent, independent model
validations of all models used for management and strategic
decision making. Validations help manage model risk, ensure
the reasonableness and appropriateness of relying on key
models to make decisions, and help assess data quality
and the value of information generated by them. A robust,
practical and well-designed validation process and reporting
protocol can help the board and senior management engage
more effectively with their key models, understand their value
and limitations, and build greater trust in their results.
Once ERM challenges are understood, a
company can ask, “Precisely what do we
need?” and “How can risk management
become more strategic?”
Figure 4. How ERM programs add business value
0%
20%
40%
60%
80%
100%
Avoidance of large unexpected losses that threaten the organization's viability
27
46
15
7
5
Increased shareholder value through enhanced risk/return decision making
27
43
20
6 4
74% of non-mutual
companies agree or
strongly agree
Reduced capital requirements through improved understanding of the business risk profile
17
40
25
12
6
Greater risk taking through enhanced ability to manage risks
14
47
23
12
4
Reduced impact of day-to-day risk losses
10
40
34
13 3
Reduced cost of capital, or haircuts to valuation, through enhanced stakeholder
perceptions of the business
8
33
40
14
5
Reduced ongoing costs of risk management due to more efficient and effective
processes
7
33
37
20 3
Strongly
agree
Somewhat
agree
Neither agree
nor disagree
Somewhat
disagree
The Right Fit
Insurers that view the risk function as a strategic partner
are more likely to realistically assess their risk positions
and remain true to their missions. This strategic partnering
doesn’t require a complex ERM framework, but rather the
most deft, flexible ERM program that frees company talent to
make strategic business decisions.
That deftness is possible when all of a company’s business
functions are on board with ERM and cooperate to ensure
that each of their responsibilities contribute to the overall
sound risk management of the company. When business
functions participate in the ERM process, the right risk
choices can be made, the company’s positioning can be
on point, and it can weather current and future industry
conditions such as today’s soft P&C market and broader
economic trends.
Risk management input needs to be an early part of the
planning process. Companies that maximize a risk/return
trade-off as opposed to merely reducing risk are most likely
to have successful ERM programs. Risk management needs
to be routinely integrated into strategic decision making at
the beginning to better influence decisions.
Indeed, it appears that many insurers are now interested in a
far more strategic use of their ERM programs: 59% reported
that there is a desire by either the board of directors or senior
management for improved ERM as a good business practice.
The progress made by our survey participants supports this
growing interest: 75% of respondents said their risk monitoring
23
Emphasis 2016/1
Strongly
disagree
Insurance companies benefit by making ERM
a strategic partner that helps effectively align
risk management with decision making.
programs were over half complete in 2014 compared with
59% in 2012, and 71% said the same of their risk appetite and
tolerance statements in 2014 versus 57% in 2012.
There is good reason for this interest. Seventy percent of
respondents reported they expect ERM to result in increased
shareholder value through enhanced risk/return decision
making, and 61% expect greater risk taking as the result of
an enhanced ability to manage risks. Other value adds to the
business include those listed in Figure 4.
As ERM matures, we’re seeing more positive drivers that
reinforce the importance of strategic partnering, including
investment decisions, how to make the best use of capital
and financial resources, and how to change a portfolio or
make M&A decisions, which is particularly important in
today’s market. In other words, connecting risk management
to company strategy can help maximize a company’s limited
resources on a risk-adjusted basis. Strategize wisely about
how you will use ERM to deliver value.
For comments or questions, call or email
Kevin Madigan at +1 212 309 3608,
[email protected];
Matthew Peters at +1 312 201 5183,
[email protected]; or
Mike Wilkinson at +44 207 170 3018,
[email protected].