Andrew Howe suggests ways in which an insurer's risk management might be improved, using the concepts of risk registers, capital, risk appetite and risk-adjusted returns
Andrew Howe suggests ways in which an insurer's risk management might be improved, using the concepts of risk registers, capital, risk appetite and risk-adjusted returns.
Risk registers
Often implemented using a spreadsheet, a risk register lists each risk and assigns it a probability and impact. In practice both probability and impact are ranges which are given an index number (often 1-5). The risks are then prioritised, combining probability and impact e.g. by multiplying the index numbers.
Risk registers are simple tools, used across most industry sectors. While useful as a checklist of risks, risk registers give rise to a number of challenges, including:
Event focus: In reality only a subset of uncertainty is considered, so that "the" probability makes sense. Effectively this compresses the richness of uncertainty into two numbers.
Inconsistency: it is likely that different people have final responsibility for the assessment of various risks. In the absence of guidance (e.g. specifying the probability level at which the impact is being assessed) completely different scenarios may be assessed for different risks.
Aggregation: Perhaps due to inconsistency, risks in registers are rarely aggregated to calculate an enterprise risk exposure.
An improved approach should be clear to an actuary: use probability distributions. Less obvious is how to get the desirable improvements without confusing non-technicians. A Stanford Professor1 believes that:
"... modelling every distribution in the world as triangular, specified by a minimum, maximum, and most likely value, would be a significant improvement over the status quo."
The "triangle approach" has several advantages:
It works well for risk types where data is typically sparse e.g. operational risks and, especially, strategic risks (financial risks have more data and sophisticated models).
The distribution can be grasped intuitively: lowest, highest and most likely values (for event-like risks we should also specify the probability of a zero outcome).
It serves as a first step, to which enhancements can be introduced when appropriate e.g. when we are more confident about the form and parameterisation of distributions.
As well as providing a faster proof of concept, such simple models reveal errors and limitations which can be inadvertently hidden by full and complex models.
Capital
Capital obviously has some (usually unspecified) relationship to risk. It can play a role in calculating "risk-adjusted return". Limits within risk appetite statements may also be expressed in terms of capital. The focus of capital is always on downside risks to the balance sheet. Consider the following situations, where capital makes little contribution:
Franchise value management: Some approaches to risk management give this insufficient emphasis. What can capital do about, for example, product launches and salesforce management?
No ongoing liabilities: A non-financial services company has no policyholder liabilities, deploying capital only in its attempt to grow.
Upside uncertainty: Consider a situation with only financial upside e.g. a game show. There is only "upside uncertainty". Risk management should contribute, but it's not about capital.
An improved approach emphasises value, eg. shareholder value (this can be extended to public and third sector entities). Using insurance terminology, we can actively pursue value in two ways:
1. Up-front opportunity selection: Deals, business lines, distribution channels etc. The emphasis is largely on the franchise value, which has always been a core management responsibility. Risk management has a contribution to make.
2. Ongoing risk modification: Hedging, reinsurance, business and asset mix. This includes the "4Ts" (terminate, transfer, treat and tolerate). The emphasis is largely on the existing business at a corporate level, ie. embedded value.
A "governance, risk and compliance" approach to risk management may make little contribution to item 1 above and focus only on protecting the downside under item 2. How can risk modification add value? We can keep the status quo or transfer a risk. Both result in risk-adjusted corporate value, but which one is bigger? This can also be applied to risk termination and, with care, to risk treatment - which should never be just about risk.
The value-focussed approach of both items 1 and 2 above should appeal to senior management and result in more natural integration with the core business, rather than a retrospective embedding exercise.
Risk management: a value focus
Risk appetite
The Institute of Risk Management suggests that risk appetite is often "nebulous"2. The main emphasis is often limiting types and amounts of risk.
An improved approach refuses to consider risk in isolation; for example, a "risk return appetite" which emphasises risk-adjusted returns.
Risk adjusted return
This phrase is often used in an abstract way: results based on a best estimate are "risk adjusted". Some use more specific phrases such as RAROC - "risk adjusted return on capital". A common risk adjustment process is as follows:
a) Calculate economic capital.
b) Project best estimate cash flows, including the setting up and release of capital.
c) Solve for the premium rate giving the required rate of return.
Features of such a process include:
Allowance for risk. The only risk adjustment is via economic capital; thereafter it is as if the future is certain. The trade-off between risk and reward comes, at best, through the level of return required, which is usually not just a function of risk. We get "return on risk-adjusted capital" (RORAC) rather than RAROC.
Price makers. For those who can set prices, opportunities are often seemingly equally attractive. The pricing process sets both economic capital and the premium(s) such that the expected return is the required target.
Price takers. For those who follow market prices, each opportunity might be assessed by calculating the return given a) and b) above (set by the company) and the premium rate (set by the market). This often results in a simple "maximise RORAC" approach.
An improved approach may be found among the following - especially the "survival-adjusted" approach, which considers the full spectrum of uncertainty and its corporate impact.
Subtract something for risk: This works well if the output is normally distributed, say N(µ,s). For this distribution, s captures all aspects of uncertainty. Risk adjustment might replace the expected value µ with µ - k * s for some k. This has the advantage that (µ - k * s , µ + k * s) is a confidence interval for the output. But of course many outputs are not normally distributed.
Maximise return per unit of risk: This approach maximises µ / s, perhaps subject to a minimum value for µ and a maximum value for s (here s is not necessarily standard deviation).
Maximise the survival-adjusted value of profits: Many value calculations do not reflect results which place the future of the company in jeopardy. The 1950s Kelly investment criterion tackles the issue in an intuitively appealing way (vanilla Kelly deals with discrete risks with known payoffs and probabilities). More recently, US risk management expert Bill Panning3 suggested an approach with insurance implications.
General insurance example
A hypothetical insurer can write one of two business lines, A and B, each with an expected loss ratio and volatility, measured by standard deviation, as shown in the table below. Following Panning, we model losses as a lognormal distribution. We calculate the probability of the company being in various states at the end of each year:
Being profitable: excess capital is distributed to shareholders.
Losing less than a critical percentage of capital: the firm is recapitalised.
Losing more than this percentage: the firm is then liquidated and there are no future profits.
The survival-adjusted value of future profits is calculated for A and B. This showed that risk-adjusted value would be maximised by writing ("riskier") line B.
Business line Loss ratio Std deviation Value from line (m)
Line A 73.5% 1% 650
Line B 70% 25% 688
In an extended version of this example we found that A and B both lie on the efficient frontier. A traditional analysis makes the choice between them a matter of taste. Maximising risk-adjusted value suggests a potentially useful alternative for decision makers.
References
1. Professor Sam Savage, Statistical Analysis for the Masses
2. Institute of Risk Management: Risk appetite and risk tolerance guidance paper.
3. Bill Panning, Managing the Invisible: Measuring Risk, Managing Capital, Maximizing Value (2006)
