How much impact can an effective risk management strategy have upon a company's ratings?

Having an effective enterprise risk management approach can have a beneficial impact on your company's ratings. Laura Santori explains why ERM has become such a significant factor in Standard & Poor's rating decisions.

Risk management is always at the heart of Standard & Poor's analysis of insurers and reinsurers. Within each category of analysis, there is an evaluation of risk and how risks are managed. However, in October 2005, S&P introduced a set of criteria for its insurance analysts to assess enterprise risk management (ERM). Since then, it has been applying these criteria and incorporating the resulting evaluations into its ratings. This means risk management has become a separate, explicit category, rather than an implicit one. The insurers and reinsurers that perform best in this category are those that have robust risk management processes across the entire enterprise, processes that form a basis for informing and directing the firm's fundamental decision making.

Specifically, ERM:

  • Allows a more prospective view of a (re)insurer's risk profile and capital needs;
  • Is a highly tailored analytical process that recognises each (re)insurer's unique structure, products, mix of business, potential earnings streams, cash flows, and investment strategy; and
  • Recognises the benefits and risks of a diversified base of products, investments, and geographic spread of risk that can quantify the benefits of uncorrelated or partially correlated risks.

ERM is a subjective view of an insurer or reinsurer's risk-management practices, focusing on how the company's loss tolerance is defined and measured and on the processes it undertakes to ensure this tolerance is not exceeded. ERM criteria also assess how well management balances risk and returns within the context of overall corporate strategy.

Risk management culture
Underpinning the effectiveness of the entire risk management process is the risk management culture. This is the degree to which risk and risk management are important considerations in all aspects of corporate decision making. Risk management culture encompasses the policy dimensions of ERM. This includes the insurer's or reinsurer's philosophy toward risk and its risk appetite; the governance and organisational structure of the risk management function; the risk and risk management external disclosures and internal communications; and the degree to which there is broad understanding and participation in risk management across the company. For each insurer or reinsurer, S&P develops an opinion on the important risks of that company within the general areas of credit risk, market risk, insurance risk and operational risk.

An insurer with a large US variable annuity business or a UK life with-profits business, for example, will be highly exposed to equity market risk. Any insurer or reinsurer with a predominantly long-tail book of business would be highly exposed to insurance risk and interest rate risk arising from possible reserve inadequacy. A reinsurer with very highly automated back-office systems would be exposed to IT operational risk, and a reinsurer with a low-tech back office would have a high exposure to people and process operational risk.

To ensure that insurers and reinsurers are identifying and monitoring risk limits, S&P looks for programmes that routinely operate controls to maintain losses and exposure within defined limits. Its focus is on assessing the processes that insurers and reinsurers use to imagine, track, prepare for and learn from new risks that could emerge. The processes should evaluate the potential impact on the (re)insurer's reputation, liquidity and overall financial strength of new risks, and the degree to which these are offset by the implementation of contingency plans. Risk model evaluation focuses on the quality of the processes that support the models used to provide risk information.

The review assesses the underlying methodologies and principles that model an insurer or reinsurer's processes and controls to ensure that timely, accurate, and complete data is used by the models, that the assumptions used are robust and appropriate and that the company has an adequate process for updating the assumptions. A (re)insurer's process for running, maintaining, validating, and checking its models will also be assessed. Models that can produce up-to-date and timely information that provide insight into an insurer's or reinsurer's risks are preferable.

An important factor is how well a (re)insurer integrates its risk management practices into its overall corporate strategy by understanding its risk profile and how it allocates risk capital throughout the organisation. Starting with a view of required risk capital and a sensitive process for allocating that capital among products and businesses, an insurer or reinsurer can develop programmes that will support the optimisation of risk-adjusted returns. For large, diverse (re)insurers with complex risks, that view of risk capital might require economic capital or other similarly complex models. S&P looks for a number of components of strategic risk management. For a (re)insurer to have excellent strategic risk management, it is expected to execute all these components. A (re)insurer with strong strategic risk management will execute most of these components and be planning to put the remainder in place in the near future.

Impact of Solvency II
The expectation is that ERM will become a competitive advantage for those insurers and reinsurers that choose to utilise it. The process of selecting choices that have the best risk-adjusted returns should eventually result in lower losses per unit of income, allowing these businesses to choose between offering lower prices, paying higher dividends, retaining higher capital, or obtaining capital at a lower net cost than competitors without the ERM advantage.

To date S&P has conducted around 200 ERM assessments through to December 2006. About 80% of the opinions were adequate and 5% were weak. Only 3% were excellent and the remaining were strong. This outcome is not surprising for a discipline in its infancy. Many insurers and reinsurers are investing heavily in ERM, and the expectation is for the profile to improve steadily over time.

European insurers and reinsurers come out favourably in our analysis. This is partly because there are already regulatory incentives in place in certain countries to demonstrate ERM, and this should be the case for the whole of the EU when Solvency II is implemented in 2010. Given the far-reaching consequences of Solvency II, many insurers and reinsurers have already anticipated its impact. The larger international groups also tend to score well in S&P's ERM analysis. Given the diversity of their risks, these groups have the greater need and the greater capacity to invest in ERM. Members of the European CRO Forum fare particularly well. The need for ERM is less among (re)insurers focused on a few lines of business or in a single country, in view of the lower complexity of their risks.

Mergers and acquisitions are seen as another activity where an ERM discussion might have a significant impact on S&P ratings. There are three specific areas of discussion. The first is the impact of the transaction on the risk profile. Some acquisitions are made to add to strategic mass of an existing business. These would be additional to risks that the company already has. Other acquisitions are meant to be complementary, bringing in risks where the insurer or reinsurer is currently less concentrated. In either case, S&P would want to determine the (re)insurer's awareness of the impact on risk profile and to learn whether the resulting risk profile is acceptable. If the resulting risk profile is not exactly acceptable, the plans to trim the profile will be discussed. The second area of concern is the operational risk posed by the new business combination that is being formed. This has always been a key concern for S&P and is an example of a longstanding area of analysis that is now seen as an integral part of ERM. The final area of concern is the integration of the risk management personnel of the two organisations.

Letting the industry lead the way
The final component of S&P's ERM criteria is the analysis of economic capital models. This will be developed in the first half of 2007, with reviews starting soon after. The reviews will only be conducted for groups that have achieved strong or excellent ERM assessments and where their model is a key component of their overall approach to ERM. Where it is determined that economic capital models are credible, the results will gradually be permitted to influence S&P's views on capital adequacy. Until now, views on capital adequacy have been mainly influenced by the results of S&P's own capital adequacy modelling, which offers no benefit for inter-line diversification.

S&P has no plans to introduce its own stochastic capital model, believing this would create an additional unnecessary complex dialogue around risk, one that insurers and reinsurers themselves would find it difficult to relate to. Healthier dialogue is to be had by focusing on insurers' and reinsurers' own models, where those models have reached a level of development such that they influence strategic and day-to-day business decision-making.

Laura Santori is a director at Standard & Poor's.