George Orros believes a well-articulated risk appetite lies at the heart of effective ERM
General insurers operate in a market characterised by high-transaction volumes of sales, customer service activity and claim incidents. Underlying this are longer-term trends in the external business environment, emerging risks and opportunities accompanied by sharp discontinuities and step changes.
Risk appetite can engender increased rigour, internal consistency and constructive debate about how the insurer pursues its business objectives and evaluates strategic alternatives in the market and the broader environment.
There is a wide diversity of views on what risk appetite really means and how it should be implemented. The Risk Appetite Working Party has been grappling with this important issue over the past year and has come to some conclusions on risk appetite for general insurance undertakings. The findings were the subject of our paper and workshop for the GIRO 2011 conference.
There is no single, universally accepted definition of risk appetite or prescribed path to develop a concept of risk appetite and embed it within an enterprise. Risk appetite can be broadly expressed as the degree of risk that a business is willing to accept in pursuit of its objectives. It is widely recognised that risk appetite has multiple dimensions and many metrics, rather than a single deterministic value - otherwise, stochastic dominance could be used to decide which risks are acceptable and which should be avoided.
Risk appetite is a relatively new concept within ERM. Although sometimes discussed in the context of risk tolerance and/or risk threshold, risk appetite is a much more complex concept. Whereas risk tolerance and risk threshold imply that risk has only a negative or painful aspect and has financial limits, risk appetite recognises that risk includes upside risks as well as downside risks and so risk appetite decisions involve more than trying to quantify downside risk potential.
Risk and opportunity management
Considering risk appetite as a matrix of risk and opportunity and plotting the firm's efficient risk frontier are both useful concepts to start to develop a coherent and internally consistent exposition of risk appetite that recognises 'upside' and 'downside' risk.
In Figure 1, the major risks may need to be terminated, avoided or transferred out to another company, other risks can convert to potential opportunities where migrated to an outsourcer or to another corporate 'parent' who can add more value. Opportunities may be of major value to the company, considered of negligible value or may contain a latent major risk.
The company can also try to map its risk efficient frontier or 'boundary line' using a risk heat matrix. The positioning of major 'risks' - or, conversely, opportunities - indicates where they lie individually and the positioning of inter-related risks.
In Figure 2 below, risk 'R1' exceeds the risk tolerance of the organisation and should be terminated, avoided or transferred out to another company. 'R2' is in the moderate danger zone - therefore, action plans are required to validate the risk positioning and, if necessary, take action as per 'R1'. As 'R5' lies within the acceptable zone, the region in which there is an acceptable balance to the enterprise between risk and reward. But 'R6' is too simple for the enterprise and should be transferred out to another corporate 'parent' that can add more value.
Multiple dimensions of risk appetite
Risk appetite is articulated using multiple dimensions, multiple sets of financial data, quantitative and qualitative data sources. These dimensions will include, for example:
Capital. The level of capital in excess of the desired 'minimum' target and the accessibility and cost of new capital, particularly in a post-loss scenario. When considering aversion to losing capital, it is useful to consider survivability (including measures used by regulators and rating agencies) and sustainability (including a defined buffer above the survivability measure)
Earnings. Unforeseen financial outcomes can lead to a lack of investor confidence, thereby damaging the enterprise value of an organisation. For publicly traded companies the ultimate measure is the difference between the market and book value. For private and mutual companies - or risk pools/funds - the position is less clear. It is possible to define 'earnings' volatility measures using an Internal Model but this can be slightly arbitrary. Careful interpretation is required with reference to more qualitative factors
Market size. Market size will often limit a company's risk appetite below the levels implied by overall capital and earnings factors. It may be possible to prescribe certain internal model criteria that are influenced by market size although this issue is not measurable via a model
Risk confidence. Uncertainty over how a risk may behave will suggest caution for example, when considering risk retentions, especially for volatile lines of business or new products/classes. Underwriters' expertise and credibility will affect risk appetite.
Making risk decisions
There are associated concepts, such as 'risk tolerance', 'risk-bearing capacity', 'risk strategy' and 'risk limits' that can help the insurer apply and mediate its risk appetite to practical risk decisions.
Risk tolerance is distinct from risk appetite as it may exceed the level of downside risk the company was expecting to take. It can encompass not only desirable risks, but also risks that, while not desirable or sought, would be acceptable under some scenarios. In respect of the potential downside risks, it is a broader concept than risk appetite and is generally concerned with those deviations from the risk appetite that, while unplanned, can be tolerated.
Risk-bearing capacity represents the maximum level of downside risk that is acceptable. Risk strategy represents the type, source, size and time horizon of risks and helps to determine the risk-response strategies, while risk limits provide a more detailed practical articulation that can be implemented - for example, limits on levels of underwriting, outwards reinsurance and operational risk.
The risks faced by different organisations may differ in type and complexity and also from their ability to mobilise risk appetite when making risk decisions. Enterprise size is likely to be a significant factor that will affect how effectively an organisation can deploy risk appetite...