All Together Now.

Insurers can use enterprise risk management to balance the objectives of both policyholders and owners--enhancing the value of the enterprise in the process.

Recent events such as the financial difficulties at General American Life Insurance Co. point to the need for financial-services companies to redefine their approach to risk management. At many companies, risk management is carried out in silos, on a risk-by-risk or business-by-business basis, with little or no analysis of how events in one area could impact the enterprise as a whole.

General American's problems dramatize the shortcoming of this method; the unraveling of a reinsurance contract triggered a series of events that led to the company's voluntary rehabilitation and sale last month to Metropolitan Life Insurance Co. A more holistic approach to risk management takes into account how the effect of risks in one area can reverberate through an entire organization.

Enterprise risk management is a rigorous approach to assessing and addressing the risks--from all sources--that threaten the achievement of financial results or present opportunities that can be exploited to attain competitive advantage. Its objective is to enhance enterprise value by improving capital efficiency, supporting strategic decision making and building owner confidence.

Enterprise risk management's ability to reduce operational risk and, in turn, reduce earnings volatility is particularly prized by owners. A Tillinghast study of 86 publicly traded financial-services companies between 1989 and 1998 reveals that companies with low earnings volatility delivered a substantially higher level of "market-value added" than their more erratic peers. (Market-value added is a measure of the difference between market and book value at the end of a period, indexed to invested capital at the beginning of the period.) This result held true even after removing the effects of other factors influencing share value, such as earnings growth and return on capital.

Driving Forces

Both external and internal forces are pushing corporations to adopt enterprise risk management. Some organizations are responding to direct and indirect pressure from regulators and institutional investors. The demands are being felt in countries throughout the world.

For example, the London Stock Exchange's Combined Code, which took effect Dec. 31, 1998, makes directors responsible for reviewing and reporting to shareholders on their company's system of internal controls, including risk management. Germany requires management boards to establish supervisory systems for risk management and internal revision that are subject to examination by external audit.

In the United States, quarterly and annual financial reports required by the Securities and Exchange Commission must describe distinctive characteristics that could materially impact a company's future performance. The Committee of Sponsoring Organizations of the Treadway Commission--an alliance of five professional accounting organizations--and the Association of Independent Certified Public Accountants also have issued reports advocating an enterprisewide approach to risk management. Finally, in their quest for stronger corporate governance, institutional investors such as the California Public Employees' Retirement System have raised questions about risk-management practices.

Many organizations moving to enterprise risk management are doing so for internal reasons. They view it as a tool that can help them anticipate threats and eliminate the inefficiencies that result when risk is managed within individual silos. In addition, their managers recognize that reducing earnings volatility can help them control their cost of capital and directly enhance share value. Finally, by providing organizations with better information, enterprise risk management helps build negotiating leverage with reinsurers, ratings agencies, capital markets, stock analysts and merger-and-acquisition targets.

Examining the Process

Enterprise risk management for insurance companies is a five-step process: assess risks, articulate business and risk-management strategies, determine capital requirements, evaluate returns, and develop and optimize alternative strategies.

Step 1: Assess Risks

The first step is to identify risk factors from all sources, both financial and operational, that can prevent an organization from meeting its goals. Financial risks include credit, interest rate, currency mortality, liability and reinvestment risks. Operational risks include people, technology, distribution, political and regulatory risks.

While there are scores of quantitative models in use for financial risks, a qualitative approach is often best for operational risks. This involves soliciting expert opinion, from both inside and outside the organization, and reviewing pertinent documents, such as strategic plans, analyst reports and performance statistics. The process provides insight into how the business operates, key performance metrics, the organization's tolerance for risk and its capacity and readiness for change.

Once the risk factors have been identified, they must be prioritized. This also can be done subjectively, by assigning and then cross-validating a score that captures each risk factor's likelihood, severity, controllability, timing and duration. Although the scoring is qualitative, it is sufficient to rank risk factors to cull them to a manageable number for senior management's attention.

Next, risk factors should be classified to help determine how to deal with them. One useful method is to classify risk factors as "manageable" vs. "strategic."

Manageable risk factors are those that the organization can address with existing capabilities. These factors might include weak contingency planning in critical facilities and midlevel employees dissatisfied with opportunities for advancement. For whatever reason, perhaps underappreciation of their importance to the organization, management has not paid adequate attention to these risk factors. The proper response to manageable risk factors is simply to use the existing organizational capabilities to mitigate them.

Strategic risk factors, on the other hand, are those that require substantial expenditures and/or a change in strategic direction to address. These can arise, for example, when an organization enters unfamiliar business territory because of a major acquisition, emergence of a new competitor or change in customers' buying preferences. Such risk factors require greater analysis and often need to be analytically modeled. Modeling can represent the uncertainty associated with each strategic risk factor regarding how, when and the degree to which it will manifest itself. In practice, these models are developed using a continuum of methods that range from relying entirely on data to relying solely on expert testimony.

For example, in the case of a new competitor entering the market, expert testimony from sales and marketing managers about the uncertainty associated with the entrant would be used to develop a probability distribution on how new competition would affect sales volume. To develop the probability distribution, it would be helpful to dissect risk events into conditional causal events, such as changes in regulation and introduction of new technology.

Probability distributions developed for individual risk factors can be used to manage risk on an enterprisewide basis by taking advantage of natural hedges and reflecting correlations among risks. The results of these stochastic models need to be linked to a common financial measure, but not before reflecting the mitigating effects of relevant business and risk-management strategies.

Step 2: Articulate Strategies

For an insurer, business and risk-management strategies represent a set of basic decisions regarding core business activities, such as product mix, asset-class allocation, the structure of reinsurance programs, design of business processes, performance-incentive systems and investments in risk mitigation.

Risk-mitigation activities include both "conventional" controls, such as systems and processes, and "cultural" controls, which prevail when there is strong alignment between individual employees' goals and the organization's overall objectives. Proper balance between these two types of controls is essential.

For example, an organization with a strong risk culture but little conventional risk control would be operating in a gambling mode, similar to the merchant bank Barings Plc., which collapsed due to the failed strategies of a trader operating with minimal controls or supervision. Conversely, an organization with rigorous conventional controls and a weak risk culture could be stifled and unprepared to capitalize on opportunities. Striking the proper balance allows organizations to achieve a state that could be labeled "strategic risk advantage."

Once the business and risk-management strategies are overlaid on the risk factors, the impact of the risk factors on the common financial measure can be modeled.

This is done by breaking each element of the metric--for example, net earnings--down to the operational and financial measures that constitute the "value tree." Each risk factor influences one or more elements of this value tree. By adding to the model the correlations among risk factors, one can create a stochastic pro-forma financial model that links all the risks to net earnings. The model can be used to measure the effect of various risk-mediation strategies on the probability distribution of net earnings.

Step 3: Determine Capital Requirements

An insurer can determine its overall economic capital requirement by using a concept known as "economic cost of ruin," which reflects the probability and the severity of ruin. Economic cost of ruin goes beyond simple percentile-value measures of solvency risk, such as "value at risk," by taking into account not only the likelihood of insolvency but also how devastating an insolvency would be. In a severe insolvency, there would be less surplus remaining after liquidation to distribute to policyholders. The proper amount of economic capital is the amount sufficient to reduce the economic cost of ruin to a targeted level based on the insurer's level of solvency risk tolerance.

Economic cost of ruin also can be used to allocate capital to different business segments. When a common "ECOR ratio" (economic cost of ruin divided by the present value of expected customer payments) is applied, each policyholder effectively "pays for" the same amount of protection against insolvency. In addition, it avoids the misalignment of capital that can result from use of risk-based capital formulas. Finally, use of economic cost of ruin can lead to better decision making and make it easier for senior managers to analyze the performance of business segment managers.

Step 4: Evaluate Returns

While the determination of economic capital is focused on the needs of the policyholders, the owners of the enterprise are focused primarily on the return on that capital. Therefore, once economic capital is properly determined and allocated to different business segments, an insurer needs to make a systematic evaluation of returns. The relevant measures are the expected returns and the variability of returns around that expectation. This is done using the stochastic financial model described in Step 2.

A number of statistics are commonly used to determine volatility, including variance, semivariance and standard deviation. However, for evaluating returns, "below-target return" is a better measure, Variance and standard deviation give the same weight to dispersion below the mean as dispersion above the mean. A typically risk-averse person would place greater weight on the downside than the upside. Below-target return is calculated the same way as standard deviation, with two exceptions: deviations are measured from the "target" return, not the mean, reflecting the organization's pain threshold; and only those outcomes below the target return are included in the calculation. A closely aligned concept is the probability of not meeting the target return.

One common example of using this risk/reward measurement is found in the so-called "modified capital market line." This line represents the risks and returns associated with holding investment instruments of various types. If the insurer's current mix of business and risk-management strategies produce a point above this line, it can be expected to create value; if it falls below, it is likely to destroy value.

This relatively straightforward exercise can be used to preliminarily evaluate certain components of the insurer's overall business and risk-management strategies, such as product mix. It also can be used to help identify alternative product-mix strategies that might be preferable. But the main point of this step is that each business and risk-management strategy can and should be measured in terms of its contribution to both the expected return to the enterprise and the variability of that return. And the proper way to select strategies is to observe the effect at the enterprise level of all the component pieces in concert. The process to do this is described in Step 5.

Step 5: Develop and Optimize Alternative Strategies

By knowing the risk and return measures for alternative strategies, insurers can systematically decide among them. That is, by using dynamic financial analysis, they can model the effect of overlaying several alternative strategies on the underlying risks (as was done for the current strategy in Step 2) to optimize the risk/reward trade-off of the enterprise's return on capital.

To do this, the strategy decision must first be formulated as a portfolio-optimization problem to be solved. There are three parts to formulating and solving the problem:

* Identify optimization objectives. Comparison criteria are needed to evaluate portfolios of different combinations of business and risk-management strategies. These criteria become the objective function. Two approaches are most commonly used. The first is a weighted combination of measures, such as expected value of net earnings, standard deviation of net earnings, the 95th percentile of the net earnings distribution and the probability (and/or the expected value) of below-target return. The alternative approach uses a utility function as the measurement tool. The approach recognizes that management teams have different risk preferences and allows the objective function to be tailored to those preferences. Objective functions are typically specified so that higher values of the function are preferable and, therefore, optimal strategies are those that maximize the function.

* Identify constraints to optimization. These constraints are things that preclude an enterprise from pursuing the optimal risk-management strategy. They can include risk-management budget limitations, unavailability of reinsurance, restrictions on use of financial hedges and undesired results under statutory and/or generally accepted accounting principles. Constraints have the effect of lowering the maximum value of the objective function.

* Develop an efficient frontier of remediation strategies. The efficient frontier represents all the portfolios that maximize the objective function at a given risk level. This is often represented in two-dimensional "risk/reward space" that shows the strategies along the efficient frontier as those that maximize the reward at a given level of risk. (Alternatively, they minimize the risk at a given level of reward.) Along the frontier, the insurer can select the strategy that best suits its risk/reward trade-off preferences, knowing that there are no superior strategies.

Getting Started

Enterprise risk management may seem daunting, but all of the component processes are probably in use somewhere in the organization. Internal audit does some sort of risk assessment; finance typically employs business pro-forma modeling and value-tree analysis; actuarial often employs stochastic modeling; and the investment side is quite familiar with optimization modeling. The challenge is to bring these disciplines together. That is why enterprise risk management often is a senior management-led effort, with the champion being the chief executive officer or chief financial officer or, in some cases, a new position is created by appointing a chief risk officer.

Companies typically start with a small slice of the enterprise risk management pie. The initial slice might be a single business unit, such as the Canadian property/casualty unit of a global multiline carrier. It could be a subset of the universe of risk sources--for example, combining interest rate, currency and natural catastrophe risks to start--or it could be a narrow range of business and risk-management strategies, such as insurance and hedging solutions alone, without yet considering business and human-resources processes. The proper place to start varies by organization.

However they start, insurers that begin to implement enterprise risk management should be able to better concentrate resources against the most critical threats and toward the greatest opportunities; select the business and risk management strategies that optimize the relationship between risk and return; achieve more efficient use of capital; and balance the objectives of their policyholders and their owners.

Jerry Miccolis is a risk-management consultant and consulting actuary with Tillingbast-Towers Perrin, Parsippany, N.J., and a principal of Towers Perrin.

Earnings Volatility

Companies with low earnings votality deliver better "market-value added" than companies with high votality. Market-value added measures the difference between market and book value at the end of a period, indexed to invested capital at the beginning of the period. The effect of volatility can be seen more clearly by first stratifying the industry according to return and growth, thereby normalizing those effects.

                           Low Earnings Growth Companies
                                Earnings Volatility
High Return Companies High             1.43
                      Low              4.48
Low Return Companies  High             1.39
                      Low              3.62
                      High Earnings Growth Companies
                           Earnings Volatility
High Return Companies              6.26
                                  10.14
Low Return Companies               4.90
                                   5.94
Source: Tillinghast-Towers Perrin