Managing Internal Risks.

New risk-management information systems help insurers manage their own operating risks.

Unlike the cobbler whose children had no shoes, insurers manage a host of their own risks while helping their clients manage theirs. "[We] have risks arising from underwriting on the liability side of the balance sheet, but we have risks arising from our asset side as well," said Paul Nealon, risk manager and actuary at Ace Ltd. in Hamilton, Bermuda. And like any other business, insurers face the everyday risks of doing business, including threats to business continuity, marketing strategies, physical facilities and more.

But whereas the cobbler had only awls and needles to rely on, the information age has given insurers an array of new risk-management information systems.

Enterprise Risk Management

For Ace, the latest approach is a strategic risk-management role in which it models the total company. The model uses dynamic financial analysis to project future loss scenarios as well as future international economic scenarios. Ace is interested in how fluctuation of inflation, interest and currency exchange rates and other economic factors could affect its business, Nealon said. To simulate these risks, Ace uses Global CAP:Link, an economic scenario generator recently offered for lease by Tillinghast-Towers Perrin, New York.

Global CAP:Link is software that allows users to create simulations at their workstations, said Stephen Britt, a Tillinghast-Towers Perrin consultant. It can simulate capital market conditions for six countries at a time, based on interest and inflation rates, currency exchange rates and returns on large-cap and small-cap equities and corporate bonds.

For the first scenario, the user enters a baseline forecast for factors such as the long-term bond rate. The software creates from 100 to 5,000 scenarios for those factors, which on average reproduce the base case, but each scenario has a range of different results, Britt said.

In the past, insurers might have modeled the effects of economic scenarios separately for liability risks and asset risks. But with enterprise risk management, they now want to put them together, Nealon said. "There's a correlation between the two," he said.

For example, inflation will affect a long-tail liability like a workers' compensation claim that's going to pay out over 15 years. Depending on the inflation rate, a $100 payment today could be $102 or $120 in 15 years. At the same time, an equity exposure could provide a hedge. The earnings of the companies are paid in dollars of the day, so over time their earnings will go up with inflation, and the value of the company will increase.

On the flip side, the value of long-term bonds tends to go down as inflation rates go up, so bonds would not be a good investment in a steep inflation scenario. In that case, the value of the insurer's assets would go down as its claims went up.

Global CAP:Link works better for this type of long-term modeling than short-term modeling, Britt said. Insurance companies can use it to decide if investing in short-term bonds, long-term bonds or equities makes the most sense. It also can help companies decide whether to cede more premium to reinsurers or to pull out of a particular line of business that is becoming more risky, he said. If a company expects a high return on equities, it may not need as much reinsurance.

From a reinsurance standpoint, Ace has used comprehensive modeling to create dual-trigger products, Nealon said. An insurer may want to buy reinsurance to protect itself in the event of an earthquake. The insurer also may want to invest in equities, but it can't afford the financial risk of a stock market

crash, so it wants a derivative to hedge against that scenario. Ace has been successful in packaging the two coverages into a single policy that pays if both events happen. But to price it correctly, the company has to know the probability of a stock market crash and an earthquake.

If the coverage includes earthquakes in Japan, Ace also has to know the likelihood of changes in the currency exchange rate.

Global CAP:Link and its type of capital-markets simulation could benefit a life insurance company offering deferred-annuity products with guaranteed returns, Britt said. If a company is offering a positive return even when the S&P 500 is negative, the insurer needs to know the chances that the index will drop, so it can estimate the expected losses arising from the guarantee.

The Price Is Right

When it comes to pricing and assessing the risks associated with the underwriting side of the business, insurance companies need to be able to take a good look at prospects and customers. A lot of decisions need to be made--the more quickly the better--and effective software can be key.

Insurance Decision System, new software from Fair, Isaac & Co., San Rafael, Calif., allows insurers to design and apply their own complex decision strategies for targeted treatment of customers.

Although the system has so far been used mostly for personal-lines underwriting, it can be used for all lines and has applications for marketing, claims handling and retention, said Scott Horwitz, Fair, Isaac's insurance market manager. "This software is usable in any area where the company is going to make a decision," he said.

In the past, Fair, Isaac has provided insurers with risk models and scorecards that facilitated automated underwriting. The new software builds on that analytic work, but allows for more flexibility in strategies and is more user-friendly, in that it can be programmed by "regular businesspeople," said Wendell Larson, Fail, Isaac's director of insurance sales.

IDS can run on an individual workstation or it can be scaled up to run on a mainframe.

The software will automatically use the multiple criteria the user gives it to target and segment populations. For example, an automobile insurance underwriter might want to separate applicants into standard, nonstandard and preferred tiers based on age, driving record, marital status and other factors. "That takes a certain amount of time, and an underwriter has other things to do," Horwitz said. "Also, it's a judgmental process as well as a manual one, and each underwriter might do it differently."

An underwriter may want to use the scores that Fair, Isaac developed, which weight information associated with a particular risk and then assign the risk a numerical value. The number indicates the level of the risk. The user could program the software to segment by scores, saying, for example, that 0-100 is nonstandard, 101-200 is standard and 201+ is preferred.

The flexibility of IDS, however, allows the company to use a scoring system and retain some of its own rules, even if they contradict the scoring guidelines. "A company may not want to include a person who had a single violation in their first tier, although the scoring system says it's OK, provided the person's in a certain score range," Larson said. The new system accommodates that kind of customization.

Another application of the software is to generate a characteristic, such as the number of violations for all drivers on the policy vs. the violations for the primary driver only. A user can "generate those new combinations in a fairly straightforward, nonprogramming way," Horwitz said.

Once an application is segmented, IDS can prescribe documents needed to support the application, including motor-vehicle reports and loss histories, and it can trigger other systems to order the reports.

A key facet of the software in helping insurers manage their risks is its objectivity and consistency, Horwitz said. "If I have 10 underwriters, I could get a different answer from each," he said. IDS ensures objective application of the rules and puts all the rules in one place, so the company doesn't run the risk of an underwriter missing one. In some cases, an application could go directly from an agent to the decision system without going through an underwriter, or the company could use the system to decide when to send an application to an underwriter.

Commercial insurers can insert their own rules about matters such as building structures and purposes, Larson said.

Mind Your Own Business

There are dangers for all who do business every day, and insurers are no exception. They can fall victim to natural disasters, technology meltdowns, human errors and other problems. When a water main breaks or a data system disintegrates, they have to have a plan. Horizon, a new software tool created by J.P. Morgan and distributed by Ernst & Young LLP, helps insurers and other businesses manage these risks by assessing how well prepared they are.

The system will match a risk against the best practices that should be in place in regard to that risk, said Craig Spielmann, vice president and head of information technology controls for New York-based J.P. Morgan. With business continuity, for example, the system might say the company should have a robust plan that includes moving services to an alternate site in case of an interruption. The person doing the assessment will assign the risk a "green" rating if there is an effective, updated plan, Spielmann said. If the plan has not been updated recently, the risk is rated a "yellow," and if there is no plan at all, it becomes a "red." The three choices correspond to full compliance, partial compliance and noncompliance.

The second control for business continuity may be to test the plan. The third may be to recognize any problems with the plan. Each risk will have several controls, each of which has a weighting, Spielmann said. Horizon will "run the weighting of the control procedure, plus the red, yellow or green that you've assigned that procedure through an algorithm," he said. "Then we'll give you an overall score for how you're doing with business continuity."

Companies have to feed into the software the controls that they think will mitigate the risk, which is where a consulting practice could be helpful, Spielmann said.

A risk that might particularly interest insurers is client suitability. Controls surrounding that risk could include checks to ensure the products that agents are selling meet the needs of the client. "You wouldn't want to sell something that will come due in 30 years to somebody who's already 70 years old," Spielmann said. Controls also could include training for agents about proper selling.

Horizon enables insurers to monitor their large distribution systems, said Paul Farfel, a partner at Ernst & Young, New York. In regard to client suitability, the tool could monitor transaction documentation and disclosures about sales materials, he said.

Normally, a company would run Horizon on its intranet. Therefore, it can collect data from offices around the world and feed the data to experts for monitoring. It also allows interactive sessions with the people doing the monitoring. Since everybody sees the same information, offices that are scoring greens in mitigating particular risks can share their ideas with less successful offices, Spielmann said.

If a company receives an overall low score on a risk in a particular office, it has to decide, given the business conditions of that office, whether it wants to spend the money to improve the score, Spielmann said. If an office doesn't do a lot of business and isn't in a location heavily threatened by natural disasters, the company may not worry too much about business continuity, he said. Once a company has developed its action plans, Horizon can help it predict goals for future scores and track progress toward those goals.

Looking Ahead

How insurance companies manage their risks is likely to become more important as more financial-services institutions merge, Farfel said. "The regulatory environment for banks and securities firms is more onerous and far advanced in terms of control responsibilities on management," he said. If the combinations involve insurance companies, "they will be required to have some type of self assessment to ensure that all of the combined entities' operations are subject to the same level of scrutiny by management."