In the first risk research to receive the Lumina Award, Dr Simon Ashby and Brendon Young assess the changing attitudes in the banking sector to the use of insurance as a risk management tool.

Introduction
Operational risk has been defined by a number of key banking organisations as ‘the risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from external events' (RMA, BBA, ISDA and PricewaterhouseCoopers 1999, Basel Committee on Banking Supervision 2001). Thus it would seem that a bank's operational risks only have a downside. In fact, operational risk events can have a significant negative effect on the financial position of a bank through the loss of valuable assets (e.g. buildings, computers, investments, etc.), increased liabilities (primarily via lawsuits or other compensation payments) and damage to its reputation.

Operational risk has become an area of growing concern in banking. The failures of banks such as Barings, Daiwa and Sumitomo, coupled with increases in the sophistication and complexity of banking practices (e.g. outsourcing, securitisation and new technology) have raised the industry's awareness of the need for effective operational risk management. Moreover, these developments have brought the management of operational risk to the attention of ‘Basel', the international banking regulator (see Basel Committee on Banking Supervision 1999, 2001) and a number of domestic banking regulators (such as the Financial Services Authority in the UK, see Quick (2000)).

In the light of this increased interest in the banking sector's operational risks, the question for insurers is – to what extent can they contribute towards improving the practice of operational risk management within a bank? Insurers have, for decades, played a role in financing the banking industry's operational risks by providing products such as the ‘banker's blanket bond' (i.e. fidelity), ‘director's and officer's Liability' and ‘Professional Indemnity' cover. However, whether these products go far enough in the current operational risk- aware environment is open to debate. Key criticisms have come from the regulators. In particular, although recognising the potential of insurance as a mitigant for the financial effects of operational risk, the Basel Committee on Banking Supervision (2001) has expressed doubts about the effectiveness of existing products, stating “it is clear that the market for insurance of operational risk is still developing”.

This article aims to review the effectiveness of three interesting developments in operational risk insurance for banks: basket insurance products; pre-claim settlement cash advances; and securitisation.

It is argued that these developments offer banks the chance to improve the financial management of their operational risks. However, it is also suggested that there are many supply-side issues that need to be resolved before their full potential can be realised and they can be accepted by both the banks and their regulators as viable operational risk management solutions. Conclusions about these developments are drawn for not only insurers, but also the banks and the regulators.

Multi-peril basket insurance products
What is basket insurance?
Traditional insurance products are sold on a peril-specific basis, with each product offering cover against losses that are the result of a limited set of causes. In the banking sector it is common for banks to purchase the following types of peril-specific operational risk insurance product:

  • fidelity/bankers blanket bond – this is designed to protect an employer against losses caused by dishonesty or default on the part of an employee as well as those that are caused by fraud and forgery. In addition, it may cover accidental damage to assets (whether this occurred in an office or in-transit), losses due to counterfeit currency and certain types of trading losses;
  • electronic computer crime – this provides cover against losses due to computer failure, viruses, data transmission problems, forged electronic funds transactions, etc;
  • professional indemnity – this typically covers liabilities to third parties for claims arising out of employee negligence while providing professional services (e.g. investment advice) to clients
  • director's and officer's liability – this covers the personal assets of directors and officers against the expenses that might be incurred due to legal actions arising from the performance of their duties
  • employment practices liability – this covers liabilities that might arise due to breaches in employment law, such as harassment, discrimination, breach of contract, etc;
  • non-financial property – this covers the usual range of property risks (fire, weather damage, etc.);
  • unauthorised trading – this is a relatively new product that offers financial protection against unauthorised trading losses that were either concealed or falsely recorded;
  • General & other liability – public liability, employer's liability, motor fleet etc.

    In its simplest form, basket operational risk insurance for a bank would involve an insurer bundling some or all of the above peril-specific policies into a single product1. There is, though, another and arguably more innovative approach to basket insurance. This is where payment is conditional on the broad effects of exposure to a risk (for example, a loss in earnings or simply a loss of assets/increase in liabilities, rather than the presence of a specific cause or combination of causes. In the banking sector only a very small number of insurers are claiming to offer effect-based cover. This claim is justified on the basis that they are offering cover against any operational losses that a bank might incur. However, these insurers are quite careful about how they define an operational loss. For example, one basket provider defines operational risk as: relationship risks, people risks, technology risks, physical asset risks and external fraud. Moreover, these policies still exclude some potential causes of operational loss (e.g. pollution, terrorism, insolvency, errors in computer programming, etc.).

    The advantages
    Just because basket insurance for operational risk is available does not mean that a bank should buy it. In fact the established market for peril-specific products already offers high levels of quality cover against quite a wide range of operational risks. Nevertheless, basket products are not just gimmicks. If designed and used correctly, they can help to improve the cost effectiveness of a bank's operational risk financing programme. Key advantages include:

    Elimination of gaps and overlaps
    One key advantage of basket operational insurance products is that they may provide a bank with more comprehensive cover, thereby helping to eliminate any gaps or overlaps that might exist between peril-specific products (see Butler (2000)).

    The elimination of gaps helps to improve the value of insurance as a risk financing tool by ensuring that money is available to finance a wider set of losses than before (see Figure 1). Basket products are especially valuable if they provide cover against losses that are typically excluded from standard peril-specific policies (e.g. losses that cannot be attributed to a specific cause). Where this is possible, insurance can increasingly be seen as a substitute (at least in part) for the self-financing of operational risk and perhaps even as a substitute for Basel's proposed capital charge (Basel Committee on Banking Supervision 2001). Currently the only way that most banks can be sure that finance will be available for all operational risks is to hold some of their own liquid assets in reserve, since the use of retained funds need not be contingent on specific causes.

    The presence of overlaps means that a bank may be paying for more cover than it actually needs. Overlaps exist where two or more similar peril-specific insurance products offer cover against the same loss event (e.g. fidelity and computer crime products may both offer protection against certain types of employee fraud). Another problem with overlaps is that they could lead to delays in the payment of claims if insurers argue over which of them is responsible for financing a particular loss.

    Complements ‘enterprise-wide' risk management
    ‘Enterprise-wide' or, as it is sometimes termed, ‘integrated' risk management is based around the notion that a firm can benefit by managing all of its risks (irrespective of their origin) together2. The rationale behind this approach is that the piecemeal management of individual risks can lead to inefficient risk management decisions. In part this may be because by not managing its risks as a portfolio, a firm may overstate its exposure to risk (and hence spend too much on risk management), since it is not taking into account the effects of diversification (see Miller 1998, Doherty 2000. In contrast, a firm that fails to take account of the fact that certain losses could all happen at once may underestimate its exposure to risk. For example, as shown by Barings the combination of unauthorised derivatives trading, poor management systems and fraud in a bank can lead to financial collapse.

    By providing a broad level of cover, basket operational risk insurance products fit very well into the principles of enterprise-wide/integrated risk management.

    A bank that purchases cover against a wide range of operational risks protects itself against the possibility of losses caused by the interaction of multiple perils. In addition, basket policies do not disrupt a bank's attempts to exploit the diversification benefits of its multiple exposures to risk. For example, a bank that purchases a basket insurance product may find that it does not need as much insurance as it thought it did when it bought insurance on a peril-specific basis and ignored the effects of diversification.

    Basket insurance products that provide cover against not only operational risks, but also, say, financial, credit, strategic and reputation risks would further enhance the degree to which insurance could complement the practice of enterprise-wide risk management in a bank. Non-banks have purchased insurance products that span broad risk groupings such as the weather, economic downturns and unfavourable currency movements (see Sclafane 1999, Roberts 2000). Whether such products become available to firms in the banking sector remains to be seen.

    Diversification benefits
    This ‘advantage' is far from straightforward. In theory, an insurance company that underwrites a large number of different perils in a basket product can create what is, in effect, a pool of pools and further exploit the benefits of diversification3. For example, an insurance company might use the profits earned from underwriting one particular peril (where claims are lower than expected) to subsidise the losses of another. As such, even where the losses on one peril exceed the value of its allocated pool of funds, an insurance company may be able to cross-subsidise, using funds from elsewhere. The net result of this is that the more perils an insurer underwrites in a basket product, the lower could be the necessary premium. Alternatively, the insurer could provide a higher level of cover via a lower deductible or a higher policy limit.

    However, diversification benefits are far from guaranteed. Consideration needs to be given to the possibility that the losses from some risks might be positively correlated or that several uncorrelated losses might simply all happen at the same time. Particular care also needs to be taken when an insurer includes a risk in a basket product that it has not underwritten before, especially when this risk is very different from those that it usually deals with. This is because any change in the composition of an insurer's portfolio of risks may have the effect of increasing the overall risk of this portfolio. This can occur when the standard deviation of the new risk is substantially greater than those risks that are already in the portfolio (see Doherty 2000).Key issues to be overcome
    Although basket operational risk insurance products offer a number of advantages over the traditional peril-specific route, there are a number of major issues that need to be overcome before they can be seen as a truly viable alternative for the majority of banks. However, the advantages of basket products are such that insurers and banks should not underestimate their potential. There is a need, therefore, to find and implement solutions to the problems that are listed below.

    Lack of critical mass
    The market for multi-peril basket operational risk insurance lacks a critical mass of both insurers and banks. A large number of insurers is necessary to achieve a viable re/insurance market for the spreading of risk. Similarly, a critical mass of banks is necessary to provide a pool of risks that is large enough to ensure accurate premium calculations.

    Given that there are insufficient banks and insurers participating in the basket operational risk insurance market to achieve critical mass, there will be an initial period of high risk for those insurers offering multi-peril operational risk products. This risk may well explain the reluctance of many insurers to offer such products; however, as more insurers enter the market and more banks buy basket products, things should improve. Consultations with a number of insurance/banking industry experts yielded the following estimates for critical mass:

  • on the demand side there is a need for between ten and 20 major banks to purchase basket operational risk insurance policies;
  • on the supply side there is a requirement for at least ten ‘A' or better rated insurers to act in concert. This would give insurers the ability to provide basket cover of around $1bn per bank. However, more insurers than this would be better, ensuring a competitive market. In addition, the more insurers there are, the easier it will become for a bank to find basket cover since no one insurer or small group of insurers would be able to underwrite every bank.

    Data and risk classification
    Data is important to the underwriting of all insurance products since it facilitates the quantification of risk and consequently allows insurers to calculate premiums accurately (and thus avoid making losses). Data is especially vital for multi-peril basket products. In part this is because of the inclusive nature of many basket products, where cover is not always restricted to specific, named perils. This means that insurers need to do all they can to find out about any unknown or non-quantifiable risks they may be insuring. In addition, basket insurers need to understand the interrelationships between risks. For example, a multi-peril insurer will need to know whether the occurrence of one insurable loss is likely to lead to another (a situation that could lead to an expensive ‘run' of claims). Similarly, a basket insurer should be aware of the possibility that large operational losses are frequently the result of multiple causes (as in the case of Barings). Where insurance is offered against only one cause (or a very limited sub-set) it may be possible for an insurer legitimately to deny liability for a large loss event that had multiple causes. However, where the included set of proximate causes is large this may not be possible.

    Currently, data on the operational risks of banks is limited, although efforts are being made to correct this problem. In fact, data collection is ongoing in a variety of quarters (e.g. the banks, insurers, rating agencies, industry associations and the regulatory authorities). Of particular interest are the industry-wide loss databases that have been established by the Basel Committee on Banking Supervision, the British Bankers Association (BBA) and the MorExchange. The benefits of initiatives like these are that they should increase the availability of operational risk information and should help in the creation of a standardised approach towards the classification and demarcation of operational risks. However, cross-sectional industry level data like this needs to be used with caution as it is not always readily transportable in time and place (Young 2000), especially when it is aggregated or where it is used to provide information on low frequency events. This is because many operational risks, especially low frequency ones, may be a direct consequence of the individual attributes of particular banks (as in the case of Barings, see for example Waring and Glendon 1998). Moreover, given the dynamic nature of the banking industry, even when data is recorded accurately and comprehensively its ‘shelf life' can be short.

    Using data – quantification and risk assessment
    Even where data is available, an insurer will need to process it correctly in order to ensure it has an accurate picture of a bank's operational risk exposures. This task can prove to be very difficult and possibly expensive for an insurer supplying basket products because of the range of possible eventualities that such a product may cover. For example, imagine a case in which a bank insures ten assets, each of which has four final loss states. If each of these assets was insured through separate contracts then there are only 40 potential insurance claims that need to be assessed. In contrast, if a single basket contract was offered for all these risks, there will be more than one million (i.e. 410) potential claims to consider (see Gollier and Schlesinger 1995).

    Given these issues it is doubtful whether traditional underwriting methods should be used to quantify the risks inherent in a basket operational risk insurance product. Indeed it will be interesting to see whether the banking industry's insurers have properly quantified the risks included in the basket operational risk products they are selling. One possible alternative is to adopt techniques like those used by risk-rating agencies, which typically consist of three separate activities:

  • a business risk assessment in which all operating divisions are reviewed, with factors such as the quality of management, strategy and competitive position being considered;
  • a financial risk assessment which includes a review of the financial history of the organisation together with an assessment of the future projections, in addition to comparison of 60 to 80 industry average ratios;
  • an overall assessment by the risk committee, which also considers the potential impact of external factors before awarding the final rating index.

    A similar system is adopted by the venture capital industry, with quantification signified by the internal rate of return on investment, which is then enhanced by the applied terms and conditions.

    Moral hazard
    Moral hazard occurs when, after purchasing insurance, an insured consciously or unconsciously reduces expenditure on loss prevention and loss reduction, since part of the benefit from these activities will now accrue to the insurer. Moral hazard can best be prevented where an insurer is able to monitor the risk management activities of an insured (something that insurers are very skilled at doing). This will only be fully effective, though if the insurer is able to assess the types and scale of risks faced by the insured. However, for multi-peril basket products this may prove to be difficult, especially when they offer cover against currently unknown or non-quantifiable risks. It is hard for an insurer to monitor the operational risk management performance of a bank when some of its operational risks are not properly understood in the first place. In addition, where multiple losses occur at the same time or where a particular loss is the result of multiple causes, it may prove difficult and possibly expensive for an insurer to look into every eventuality.

    Because of the problem of moral hazard it is likely that basket operational risk insurance products will only be made available to those banks that can prove they adopt high standards of operational risk management. Effectively this restricts cover to the larger banks which have both the resources and the incentives (in terms of consumer and regulatory scrutiny) to invest in the effective management of operational risk.

    Another consequence of the potential for moral hazard in basket products is the tendency of insurers to specify comparatively high deductibles. This leaves a substantial burden with the insured and thus provides them with a strong incentive to manage risk. One major basket operational risk insurer to the banking sector has already gone down this route, specifying a deductible of £100m. Obviously this strategy reduces the scope for moral hazard, however it does prevent banks from using basket insurance to cover their smallest losses.

    Operational risk insurance
    The way in which a bank might use operational risk insurance will depend on the presence of any general supply side problems, coupled with its own particular requirements and circumstances. As such it is hard to make firm recommendations about the role of basket insurance in a bank's risk financing programme. A number of general scenarios can be established though.

    Replace all peril-specific with basket insurance
    Where the advantages of basket insurance are very high a bank might decide to replace all of its peril-specific insurance policies with a single basket policy (see Figure 2). However, given that basket operational risk insurance is still in a very early stage of development, and that there are many issues about its supply that need to be overcome, this is not a viable strategy for most banks at the current time. This situation may well change in the future though.

    Start with peril-specific insurance, but buy basket cover for larger, more infrequent losses
    A bank adopting this strategy would purchase peril-specific cover for some of its more day-today operational losses, while retaining others. In addition it would buy a blanket protection policy against larger, more damaging losses (see Figure 3).

    The theoretical advantages of basket insurance mean that it should be particularly effective against larger risks. For example, the diversification benefits of insuring a bank's entire portfolio of operational risks could allow an insurer to offer high levels of cost-effective cover. Additionally, basket insurance is good at dealing with losses that have multiple causes, a feature common to many large losses.

    However, due to the lack of critical mass in the basket insurance market and data problems, very large amounts of basket operational risk cover are not yet available. The effective limit at the moment is $250m. It is expected that this limit will increase, to around $1.35bn (see Butler 2000), as more insurers enter the market and the quality and amount of operational loss data improves.

    Start with basket insurance, but buy extra peril specific cover of some losses
    The final strategy is to use basket insurance for small to medium losses that tend to be more frequent (see Figure 4). In this strategy a basket policy would be purchased to finance a bank's day-to-day losses. The bank would then identify specific risks that it feels it needs additional cover for and buy peril specific policies to cover them.

    A major advantage of this approach is that it is flexible. A bank that decides it needs $1bn of liability cover, but only $200m for its other operational risks does not want to have to go to the expense of purchasing the full $1bn for them all.

    ‘Pay now, argue later'
    One of the Basel Committee's key objections to the use of operational risk insurance is that delays in claims payment can, if the associated loss is large enough, threaten the financial stability of a bank. One major cause of delay is the need for an insurer to establish whether a claim is legitimate, i.e. whether a loss is covered by the policy on which it is being claimed. In addition it can take time before the true scale of a claim can be determined accurately, as in the case of many liability losses, for example. Finally, long delays may arise where the insured and insurer fail to agree on the amount, time, place and cause of loss or where a peril is covered by more than one insurance policy (placed with multiple insurers) as this can lead to disputes over responsibility.

    Recently an interesting solution to the problem of delays in operational loss claim payments to banks has emerged. This solution involves providing claimants with an upfront advance for any potential operational loss, before the exact cause of this loss, and hence validity of any claim, has been established. The advantage of this approach is that a bank is able to get the finance it needs to make good its losses quickly. As such, this strategy helps to make operational risk insurance a much closer substitute to holding liquid capital (giving a bank near instant access to cash).

    There are, however, problems with this approach. One is the possibility that a bank may either refuse or simply be unable to pay back the upfront advance. Another is that by providing immediate finance an insurer could lose several months (or even years) of investment income. As such this feature is only likely to be a practical proposition for select banks (i.e. those that can not only pay for it, but also demonstrate their ability to repay an upfront advance as necessary).

    Securitisation
    Although securitisation is not strictly a type of insurance, the convergence of insurance and financial risk management means that the boundaries are becoming blurred. Insurance products can now be purchased to cover financial risks, similarly it is possible to buy derivative products against risks that have traditionally been insured (e.g. the risk of weather related losses)4.

    Cruz (1999) has already discussed the possibility of securitisation acting as a substitute for conventional operational risk insurance products. The advantages of securitisation are linked to the fact that it provides banks with the potential to transfer operational risk to investors in the global capital markets. Therefore, compared to conventional insurance products, the scope for risk spreading and the availability of financial resources are much greater, reducing counterparty risk (i.e. the risk of an insurer defaulting on valid claim payments) and increasing cover limits.

    One possible means of securitising operational risk is via issuing a bond similar to the new style of catastrophe bonds. For example, a bank could issue a bond whose value is related to certain pre-specified operational losses. The bond purchaser would expect to receive a high yield.

    However, if one of the operational events described in the bond occurred, the purchaser would lose some or all of the principle and interest.

    Despite its potential, securitisation is unlikely to make much of an impact on the insurance market, at least currently. One key reason for this is that many investors (except perhaps insurance companies) are simply not ready for such unconventional investment products. In addition, so long as their remains insufficient data on operational losses especially for low frequency, high severity losses it will be difficult to price an operational risk bond accurately. As a result it is likely to be some time before investors demand a rate of return for operational risk bonds that is low enough to make them a cost-effective alternative to insurance.

    Conclusions
    The Regulators
    Although the operational risk insurance market may, in the eyes of the regulators, be ‘still developing', it is important for them to remember that it has a lot of potential. New developments such as basket insurance, pay now argue later and securitisation offer banks the chance to substantially improve their management of operational risks.

    It is imperative that the regulators do not underestimate the potential of insurance to help manage a bank's operational risks or hinder in any way new product development. The regulators could even take an active role by helping to develop the market for operational risk insurance. One of the ways in which they could do this is by offering banks that buy suitable insurance products a reduction in the proposed capital charge for operational risk (see Basel Committee on Banking Supervision 2001). Additionally, the regulators could work with insurers to help improve their ability to supply new operational risk insurance products. For example, the effectiveness of basket insurance could be improved if the regulators were to help insurers collect appropriate and accurate loss data.

    The insurers
    The involvement of certain insurance companies and brokers in new product development for a bank's operational risks indicates that the insurance marketplace is far from stagnant. However, there still appears to be a degree of reluctance from many in the insurance industry to embrace these new developments. Perhaps this is because many insurance companies and brokers are waiting to see how the pioneers of these new products fair. Although this may seem a sensible strategy, it does little to help develop the potential of insurance as an operational risk management tool. The increasing rate of change within the financial services sector means that insurers and brokers must be more responsive to the demands of their clients, providing products that clearly add value through enhancing operational risk management. Insurers and brokers that fail to respond may find that their products have become marginalised and that their more innovative and dynamic rivals have superseded them.

    The banks
    The demand for basket operational risk insurance products remains very low. Similarly, few banks are using securitisation to manage their operational risks or taking advantage of features like cash advances. One obvious reason for this is that there are currently too many supply-side problems for these developments to be truly viable for all but a small number of the larger banks. Another could be that many in the banking industry are presently unaware of the potential of these new developments.

    It is recommended therefore that risk/insurance managers in the banking industry assess carefully the benefits of these new developments for their firms. In particular these managers should remember that the purpose of risk management is to add value. Thus where new insurance products provide potential cost savings or help to increase the effectiveness of a bank's risk management programme they should be given careful consideration.