Nick Ford and Rob Spiers examine what the recent introduction of the Prudential Regulation Authority means for insurers
The Prudential Regulation Authority (PRA) issued a document1 in October 2012 outlining the approach it would follow when it took over as the prudential regulator of insurance companies in April 2013. In the document the PRA stated its overall objectives as promoting financial safety and soundness, and protecting policyholders.
Although these objectives are aligned with Solvency II, and the work insurers have done to meet Solvency II developments will act as a good foundation for the work needed to meet PRA objectives, there are additional areas companies will need to consider. The PRA will regulate at both a solo and group level so companies must be mindful of impacts on the Insurance Group as well.
To concentrate effort on the insurers that could cause the most risk to meeting the PRA's objectives, companies will be allocated to one of five categories. These categories consider (1) the potential disruption that an insurer could cause to the wider UK financial system; and (2) the capacity of the insurer to cause disruption to the interests of a substantial number of policyholders.
The categorisation will be performed using simple criteria such as size, complexity and business type. However, it will also reflect the degree that the company is connected with the rest of the sector (eg, via derivatives or reinsurance); vulnerabilities in the financial position and deficiencies in risk management /governance; and what plans the firm has in place to return to a stable position after a stress event.
The category assigned to a company will determine the intensity and frequency of PRA supervision and the degree of individual examination and interaction. For smaller firms, individual examination is only likely when automated tools used to analyse regulatory submissions identify outliers or adverse trends. As a result, PRA visits to smaller firms will not be on a fixed schedule. However, the PRA could still perform on-site work, with some period of notice, at any time.
Although the PRA will be undertaking the categorisation of companies (and will have done so for most firms by the time this article is published), it is important for planning purposes that insurers get a feel for the likely level of scrutiny they will be under.
Risk management
The PRA will expect insurers to have a strong control framework and system of governance including risk management, actuarial, finance and internal audit functions that have adequate access to the board.
Insurers will need to be able to articulate their own risk appetite and this should be consistent with the PRA's objectives of financial safety and soundness, and policyholder protection. It should also have direct links to the insurer's strategy and business model. In order to articulate the risk appetite (and to monitor it), an insurer should consider how they identify, measure and control high impact/low frequency risks.
This requires firms to have a robust risk management framework in place that is consistently implemented across the business. To support this, insurers will be required to perform a detailed analysis including:
> forecasting future capital and liquidity requirements;
> consideration of the impact of scenarios on the capital and liquidity requirements (ie, stress and scenario testing);
> recovery and resolution planning;
> assessing the robustness of the business model and the assumptions it depends on.
By scrutinising the business in this way, a company will have greater knowledge of the risks that may impact its strategy. Coupled with an analysis of the risks to the business plan, this will feed into the company's own assessment of the level of capital and liquidity buffers it needs.
Business model analysis
The key area of development for companies under the PRA regime is the business model analysis. The business model can be defined at a high level as the approach undertaken by a firm to generate economic value, together with the associated risks that the firm is exposed to while generating that value.
Business models vary significantly between companies, but it is important to realise the analysis required is more than a business plan projection and some qualitative analysis. The PRA's supervisory approach will include a detailed consideration of the viability and sustainability of future profits, new business sales, solvency and many other metrics.
Viability
Viability largely considers the here and now.
A company will need to consider its current financial performance, where profits are coming from (eg, are they from legacy books or new sales?), how diversified the portfolio is (both by product and distribution channel) and how all of these relate to the business model and strategy of the firm as well as the capital position and the quality of capital held.
Sustainability
Companies will also need to show that their strategy is well defined and that the business model is sustainable over the long term. This can be demonstrated by considering how measures such as profits, solvency, new business contribution and so on are affected by changes in the market and operational events. However, it also looks at the drivers and sources of future profits and how this links to the strategy. For example, current profits may stem from a certain product line but the strategy may be to grow in a different product line, so it must be considered what the drivers of this new source of profit will be.
Drivers of future profits are often examined as part of regular business planning exercises. Output from these exercises could be used as evidence of sustainability, provided there is appropriate governance around the assumptions and processes. This should ensure that all material assumptions are justifiable and not overly optimistic. For example, firms may find it difficult to justify any increase in the market share of a product without considering the impact on other assumptions such as profitability. Companies should therefore also highlight the interaction between various assumptions. For example, a high rate of market share growth may only be sustainable through weakened underwriting and the associated increase in reserves.
Companies with a good track record of meeting their business plan targets could use this to support their plans, while new firms will need to prove they have the skills and expertise to generate the forecast profits.
Vulnerability
Once a company has understood the viability and sustainability of the business model, it should be able to understand the risks. Firms should consider vulnerabilities specific to their books of business (such as catastrophe or longevity risk). Stress and scenario testing can form an important component of this analysis, with management actions and trigger points clearly identified and documented.
Profits of insurers are also susceptible to changes in the economy. One current concern is the impact of a long-term low interest rate environment. The effect of this on future investment returns and the cost of options and guarantees should be quantified.
The key for the PRA will be that there is a full understanding of what the target profit is from the business, what factors drive that profit, the level of risk the firm is prepared to take to generate the profit and a degree of sensitivity. If the target profit is increased, how do the risks change? Does the business remain within risk appetite? In this way, any assessment needs to be dynamic.
The PRA may use business model analysis to understand the insurer's ability to generate future profits and the medium-term risks this involves. Alongside peer comparisons and qualitative analysis, this may inform the level of capital that the PRA feels the firm should be holding and the risk management system it should have in place. It is therefore vital to provide evidence of a business model that is robust and has controls and governance built in. This should include consideration of the impact the business model will have on other participants in the system.
Conclusion
The PRA requirements focus on many concepts that are familiar to insurers through the Solvency II ORSA process, including stress and scenario testing, projections of capital requirements, and recovery and resolution planning, plus some of the validation requirements that are well known to Solvency II internal model firms. The requirements of the business model analysis go further than the basic Solvency II requirements.
Although the Solvency II delays have made many insurers consider 'downing tools', the PRA requirements will ensure that the Solvency II Pillar 2 developments remain high on the agenda. The question for insurers is how to best utilise the developments they have made to date and combine these into a single risk management framework that considers all the areas identified by the PRA.
References
1. 'The PRA's approach to insurance supervision' http://www.fsa.gov.uk/static/pubs/other/pra-approach-insurance.pdf
