ERM affects ratings for insurers

When correctly implemented and employed, we believe that an enterprise risk management system could sharply reduce the chances of an organisation experiencing outsized losses, and could also improve profitability and shareholder value. In our opinion, it may also reduce the cost of capital. The best ERM process strives to maximise the revenue for the level of risk associated with generating that revenue.

ERM may be seen as the development and unification of the individual strengths of existing risk controls to form a holistic, fully-developed, economic capital model that allows for overall risk oversight. In a recent survey conducted on behalf of Standard & Poor’s (The Use of Ratings in Insurance and Enterprise Risk Management), 94% of participants —mostly risk managers but also insurers and broker/intermediaries—indicated that they believed an increased focus on ERM from ratings firms would have a positive impact on risk management, but only 27% claimed to have a good understanding of the nature of ratings firms’ approaches to ERM assessment and the broader financial strength ratings. Some 74% of respondents said it would be useful for their organisation to understand more about the ratings process.

The pressures forcing changes

Standard &Poor’s believes that ERM has reached a critical point for the industry. The demands of regulators and the challenges presented by increased market volatility heighten the pressure on insurers to put risk considerations at the very heart of their strategy and operations. Traditional silo-based risk management often suffers systemic flaws. Its tools for managing risk insurance may become disconnected from the asset risk management process and in our experience, it tends to focus solely on the major risks that may affect the company in question, at the expense of emerging risks that are less likely, but not impossible. While we consider such an approach may be sufficient for some insurers – for example those that operate in narrow market segments or single geographical areas – for most, it could prove to be a costly future error.

The approaching implementation of the EU Solvency II Directive, which will govern the European insurance industry, increases the incentive to implement ERM, but the move toward fully-integrated risk management does not rely on regulatory pressures. Although the insurance sector has been buoyed by positive trends in equity markets and lower credit spreads over recent months, the risk of a double dip recession remains in our opinion and this could affect insurers in many ways. Lower investment yields, decreased investor confidence, a subdued housing market and – typical of recessionary times – an increase in claims may all yet strike a blow to insurers’ earnings and highlight the need for an industry-wide improvement in risk management.

This need is manifesting itself in the increasing industry focus on ERM as a tool to boost strategic management. We believe strong ERM frameworks could result in lower losses relative to long-term average income – particularly in turbulent times. In addition, we expect insurers with advanced ERM systems to select and maximize business opportunities with risk/reward profiles that are more favorable to their existing risk.

Defining the ratings process

It is clear that ERM will play an ever increasing role in future risk management efforts, which is why some ratings firms – Standard & Poor’s among them – have devised systems to give formal assessments to insurers’ ERM frameworks. In order to realise the full value of ERM, we believe a holistic view of risk must be part of strategic decision making at every level.

The study mentioned above revealed a clear preference amongst market participants for greater clarity surrounding the latest trends in ERM and, in particular, for qualitative assessment of the ERM framework. Participants have indicated that ERM assessments are of great use to them and they look to ratings firms to assess ERM as part of the overall criteria for a financial strength rating. That said, many participants expressed a need for a better awareness within the sector of key assessed criteria and the parameters that both determine an assessment and have the biggest influence on the final evaluation.

Standard & Poor’s ERM assessments are currently based on the analysis of the five principal subcategories of ERM: risk management culture, risk controls, emerging risk management, risk and economic capital models, and strategic risk management. We assess ERM at rated insurers as weak, adequate, strong, or excellent.

In our opinion, a company with adequate ERM would have a complete and reliable control process in place for the major risks of the firm and should experience no outsized losses in a normally adverse environment. However, some companies with an overall ERM assessment of adequate may have strong or even excellent risk controls in our opinion. However, they have simply not developed, or have not yet developed, a holistic view of their risk through a fully developed economic capital model or other tools. At the lower end of the scale are firms with what we would view as only adequate risk controls for their major risks, which they would generally manage on a silo basis.

In our opinion, ERM programmes show benefits when firms develop strong/excellent strategic risk management processes as well as strong/excellent risk controls. These companies have strong and excellent overall scores and would expect to have lower losses relative to long-term average income in adverse times and especially in extremely bad times. Over the years, these are the firms we expect to identify business opportunities with risk/reward profiles that match their existing risk portfolio.

In the majority of cases, our ERM assessments are analysed based on our view of improvements made to existing practices, as opposed to analyzing processes that have been implemented from scratch. Our study showed that this incremental approach to assessing ERM is considered appropriate by most market participants.

Which way next?

In Europe, we note that the development of risk models has helped insurers to define their risk tolerance (often expressed in terms of surplus in excess of economic capital), and this has been a positive development. However, this tolerance level may often remain a stand-alone statement. We believe the next step in the development of an insurer’s ERM would generally involve relating its stated tolerance level to overall risk limits.

We also observe that risk controls continue to be highly uneven amongst insurers. For most insurers, limits for different risks tend to be completely independent of each other, with no specific tie to an overall risk tolerance. In our rating analysis, we view as favorable, clear steps toward a holistic view of risk control, including the development of economic capital models and an enhanced approach to strategic risk management to align risk management with company objectives. That said, the development of an economic capital model is not, by itself, enough to gain a company a strong ERM assessment. The model must be embedded in the company’s strategic management decisions.

When assessing the quality of an insurer’s risk management culture, one element that Standard & Poor’s looks at is the formal risk reporting processes. Positive signs include high-level management committees that focus on risk management issues, although, again, mere possession of a committee is not enough. These committees should have a visible effect at a strategic level. For example, some companies review their appetite for risk and revise their strategy to reduce their risk in some areas and increase it in others. A number of firms have recently started to look not only at extreme events but also at earnings volatility.

While the more sophisticated European insurers have already begun to build – and reap the rewards – of holistic risk-management systems, others have yet to catch up. As we go forward, we would expect the use of ERM and the standardised evaluation of the strengths and weaknesses of existing frameworks, to be a component in the insurance purchasing process.

Companies are acutely aware that substandard ERM can lead to a variety of undesirable scenarios, including escalated borrowing costs. As a result, we would expect risk assessment – which we believe should encompass avoidance, reduction, sharing/insurance monitoring and a degree of readiness for the unexpected –to be upgraded. An enhanced internal approach to ERM could be the solution to effectively leveraging existing practices.

ERM is becoming the best-practice sector standard for risk management, and the value of a positive ERM assessment should not be underestimated. The benefits can be felt on many levels. For companies that rely on borrowing to fuel growth and innovation, a positive ERM assessment may improve capital costs, for example. As the financial climate remains stormy and the threats to the industry, such as credit risk, remain, we also believe improved ERM processes will also help mitigate these other risks.