[Skip to content]

Sign up for our daily newsletter
The Actuary The magazine of the Institute & Faculty of Actuaries
.

ERM strategy: Plan of action

Economic turbulence and regulatory pressures have focused a bright spotlight on risk, and companies are more engaged than ever with risk management. Now is the time for more actuaries to really make a name for themselves in this exciting and growing area, by helping our clients manage these new challenges.

In our experience, companies’ risk management strategies typically fall into one of four types:
1. Awareness — the areas where there is most uncertainty are identified
2. Measurement — risks are quantified in silos across the business
3. Understanding — a holistic picture of the overall risk profile is built
4. Harnessing — the detailed risk profile is an important consideration when making business decisions.
The most appropriate strategy will be different for each business. Individual companies must determine what works best for them and this is a decision for the board. Identifying the current type of strategy is helpful when assessing the actions that will be most effective right now and how strategy should best develop in the future.

Actuaries can add particular value for companies looking to understand and harness risk, where quantitative analysis is often needed. However, our analytical skills, judgment and clear communication are important throughout.

In this article I consider typical characteristics of each type of risk management strategy and draw on my experience in the field to give case studies of how actuaries are helping with the development of risk management outside traditional areas of actuarial work.

Risk
Almost all companies have processes in place to identify and monitor key risks. Tools such as risk registers or matrices are common. These provide an important foundation for all risk management by creating awareness of where uncertainties lie. Companies with an ‘awareness’ type of risk management strategy typically:
>> Have developed these risk registers separately within each business function, which can lead to inconsistencies and overlap
>> Do not have a dedicated risk manager and, if they do, it is a compliance role with limited presence at board level
>> Have limited risk controls
>> View risk only as a threat, rather than an opportunity.

This can lead to companies overstating their risks, resulting in money wasted on unnecessarily high insurance premiums, or other disproportionate and expensive action.

Risk measurement
For companies with a ‘measurement’ type of risk management strategy, the potential severity and frequency of each risk is typically estimated using a qualitative scale such as ‘one to five’ or ‘low, medium and high’. Risks are considered in isolation, rather than holistically.

A log of historical loss incidents is maintained and risks are reported upwards. A rudimentary aggregation of the risks may have been attempted, but the business will not yet have tackled diversification, often meaning the overall risk exposure is still overstated. For example, this siloed approach does not allow for natural hedges between different areas of the business.

It is important to have effective processes in place to measure and monitor risk. This allows companies to focus on the most important risks, and avoid long checklists that hide the wood from the trees.

Understanding risk
For companies really wanting to get a handle on risk, a more sophisticated understanding and quantification is required. In addition, companies with this type of strategy usually have a dedicated risk manager or department and undertake regular reporting of risk to senior management and externally.

It is for the ‘understanding’ type of strategy where the actuarial skill-set really starts to come into its own, particularly as companies analyse the interactions between different risks.

For example, a global investment manager can be helped to better understand the operational risks across their business and meet FSA requirements. Operational risk is both the biggest risk facing investment managers and the hardest risk to quantify as:
>> There is usually limited data on historical loss incidents within a firm, in particular for rare and more extreme incidents
>> Information on losses by other firms in the industry requires adjustment so that it is relevant due to each firm’s unique risk exposure, processes and controls.

These challenges mean that, when modelling operational risks, a greater reliance on expert judgment is needed than when modelling other risks such as credit and market risk. These challenges can be addressed using a method known as the Delphi process, which is an efficient and unbiased way to incorporate expert judgment within the risk modelling.

The Delphi process involves running workshops attended by relevant experts from across the business. These are similar to normal group meetings, but with a facilitator setting questions and participants giving answers anonymously. The output from the workshops provides an excellent foundation on which to build a model of the client’s overall operational risk exposure, using fat-tailed distributions to capture extreme events, and copulas to allow for co-dependency between risks.

By using these advanced statistical techniques, actuaries ensure that the modelling is robust. However, the thing that clients usually value most is clear presentation and communication of the results so that the modelling is transparent and well understood.

Harnessing risk
As companies start to harness risk, their unique risk fingerprint becomes an important factor in corporate decisions. A consistent risk management approach is likely to be used across the business and regular reporting, including to the board, means visibility of risk management is high. The risk appetite or risk budget will usually be clearly articulated.

The idea of harnessing risk is already common across many traditional areas of actuarial work. For example, setting a reinsurance strategy, managing an investment portfolio or de-risking a pension scheme all require risk and uncertainty to be harnessed. In each case, a powerful approach is to build a model of the issue under consideration to gain understanding of the expected outcome and the range of possible variance — in other words, the risk versus reward trade-off.

In these traditional areas, techniques including stresses and scenario testing and metrics such as Value at Risk provide management with the toolkit to harness risk, reduce uncertainty and improve business decisions. Exactly the same principles apply in less well-established areas of actuarial work.

An example of this would be building a powerful predictive tool to help analyse the impact of policy on the building of new power stations on CO2 emissions, blackouts and electricity prices. To do this, we could develop a stochastic model to simulate the risk and reward profile of each policy under consideration, by projecting supply and demand across the whole UK power system over the next 40 years.

One possible methodology would be to use a ground-up agent-based approach to model individual agents and the interactions between them. For example, each power station is an agent and the model takes into account the cost and time of development, operations, eventual decommissioning and overall return on capital.

This is an excellent example of actuaries applying their modelling and risk consulting skills to a non-traditional area as part of a multi-disciplinary team. As another example, consider a large utilities company that wants to better manage its use of offshore call centres. Advance bookings receive preferential rates, but the client is not able to accurately predict call volumes so is often forced to pay high rates to purchase additional capacity at the last minute. Here we could develop a dynamic model to predict call centre demand and variability, including allowance for weekly and seasonal cyclical trends and the impact of customer mailings on call type and volume. This tool could then be used to manage call centre capacity and understand the risk and reward implications of related decisions.

The support that a company requires is highly dependent on the type of risk management strategy in place and the nature of the risks faced. By fully engaging with those close to the business, actuaries can help to develop appropriate and effective risk management processes. Actuaries can help businesses see not only the dangers that risk can pose but also the opportunities it creates.

_______________________________________________________________

Tom Durkin is a partner in LCP’s Business Analystics practice and specialises in the area of risk management The views expressed in this article are those of the author and not necessarily those of LCP as a firm