Interview: Penny Shaw

What does your role involve?

I have an actuarial background and my role essentially has two components. First, I look after risk and capital. This involves both the actuarial capital modelling and embedding that in the business. And second, I look at our existing risk management and how that can be enhanced and upgraded so that it comes more within the enterprise risk management (ERM) model that the FSA is focusing on – aspects like risk appetite and risk committees. This also means taking account of what the rating agencies are considering such as how companies are developing operational risk controls.

It’s not an audit or compliance role. I liaise with the audit and compliance people but my role is independent and quite separate and I report to the CFO.

How much impact does regulation have on your work?

Certainly the FSA has been a big driver, particularly with its insurance sector briefing, ‘Risk Management in Insurers’ issued in November 2006. It is looking for companies to do some key things in ERM such as establishing their risk appetite and assessing their risks against that. Basically, it wants to see enhanced management and monitoring of risks.

As well as the push from the regulators, the Standard and Poor’s initiative of assessing insurers’ ERM has been a big driver for us.

What do you think are the key risks facing a group like yours?

From a wider perspective it is the underwriting cycle and managing the actual downturn in that.

More specifically from my role’s standpoint, I am looking at whether there are better ways of doing business specifically as regards we need to understand in more detail the volatility that we are taking on when writing business and measure that volatility. It’s an issue for the whole industry and doing this well means that we will get a competitive advantage. We need to implement an ERM approach to doing business in a practical and useful way to get the benefit from that.

“When you start using the models to look at the interaction of the businesses, that's when you really get buy-in.

Penny Shaw, head of risk management, Ace European Group

So one of the key risks is that if we don’t achieve this and our competitors do, they will get the advantage because they have managed their risks better and implemented effective practices and techniques.

How do you go about tackling these risks?

A lot of companies look first at building capital models and using those to come up with their return on capital targets for different lines, and then proposing a new set of targets to the underwriters. We don’t feel that works. There is no methodology for allocating capital that is appropriate for all lines of business – it is definitely not ‘one size fits all’. And actually allocating capital at the one in 200 level or similar is not that useful when it comes to helping make business decisions on what business is profitable to write.

We are focusing more on what practices we have currently got in place, ie reserving, planning, how we model aggregations, etc, and then looking at these processes to see how we can enhance them to take account of volatility. So while actuaries and underwriters work together to come up with a combined loss ratio for the next year, my team is looking to come up with a distribution of loss ratios. How likely is it that the actual figure is going to be higher or lower than that calculated and what factors, such as different to expected rate changes might affect these assumptions? That gives you the whole picture rather than just having one value for the next year.

Then we are working at getting that information into the processes and using it to build up buy-in for risk and capital modelling from the business. When you start using the models to look at the interaction of the businesses, that’s when you really get buy-in because people can see the value and where they have directly contributed.

What do you think will be the challenges going forward?

It comes back to my point about getting business buy-in. There is a time lag between when you start talking about this kind of approach and the analysis you need to do and actually seeing some real practical benefits. You need to be patient and also be committed and prepared to invest in quite a lot of research and development to find something that works. So people have to believe that they’re going to get some real practical benefits out of it.

How do you think risk management adds value to the activities of your organisation?

ERM gives you much better information against which to make your decisions. My job is about getting risk information to the people that need it For example, when you are doing your strategic planning for the next year, if you are only considering one number or a certain set of scenarios, you don’t have access to any information on the likelihood that this might actually be more or less and the level of prudence you have got in that, and then I don’t think you have got the full picture.