1.1 The Definition of ERM

1.1.1 Enterprise risk management (ERM) is the now widely recognised term used to describe the processes and practices employed by organisations to manage their portfolio of risks. ERM is particularly important for insurance companies, given the risk-focused nature of their operations, and this is therefore the subject of the paper. The paper covers insurers regardless of the type of business they write (life, non-life, reinsurance, etc), regardless of their geographical location or legal/regulatory domicile, and regardless of their legal form or ownership structure.

1.1.2 There is a large body of work on the subject of ERM for companies in general, beyond the insurance industry. Characteristically, it is cast within a context of an organisation's strategic objectives, and, when effectively employed, a strong ERM framework will actively support the management of long-term value creation, cash flow and risk in order to create and protect value in the Group's activities.

1.1.3 Approaches to implementation of ERM frameworks will vary from organisation to organisation, but according to COSO are generally considered as eight inter-related components:

1. (1) Objective Setting.

2. (2) Internal Environment.

3. (3) Event Identification.

4. (4) Risk Assessment.

5. (5) Risk Response.

6. (6) Control Activities.

7. (7) Monitoring.

8. (8) Information and Communication.

1.1.4 Whilst much of the focus of an effective ERM framework must by necessity be inwards looking towards the business, it should not be forgotten that for the most part it is the investors – usually equity holders – who bear the residual risk of the company, with the role of management being to act as agent on their behalf.

1.1.5 An effective ERM Framework will recognise that it is the investor who is the ultimate customer. Thus, while good risk governance in the sense of good risk reporting to the Board is essential, it does not give the ultimate investors the information they need to understand the impact of the residual risk of the company on the rest of their investment portfolios.

1.1.6 From the organisation's perspective, the Framework should deliver the information necessary to drive risk communication to investors, ensuring that its objectives are aligned with the expectations of the providers of capital.

1.1.7 Key in ensuring this alignment are the disclosures made to investors. For insurance companies in particular, disclosure to investors, and the discipline that market scrutiny brings, is core to the three pillar approach so integral to the Solvency II regime. It is the ultimate risk control – ensuring that management is held accountable for decisions made.

1.1.8 From the investor's perspective, the information so disclosed should allow the investor to make sound rational judgments as regards the value of, and risks to, their investment in the insurance company, within the context of their wider portfolio. Disclosures must be sufficiently broad to serve the needs of a wide spectrum of investors; they must be clear, transparent and comprehensive.

1.1.9 This paper considers the measurement of value and risk, performance assessment and investor disclosures for insurance companies in general, in order to illuminate how perception of risk is transformed from different points of view. It aims to compare the relevance of Enterprise Risk Management from both the point of view of the insurance company (internal, looking out) with that of the portfolio investor (external, looking in).

1.1.10 There is a wide range of potential investors in an insurance company, including but not limited to:

1. (1) The stock market participants in publicly traded insurers.

2. (2) Larger financial or non-financial groups with their trading subsidiaries.

3. (3) Private equity funds or individuals with their holdings in their privately owner insurers.

4. (4) The owners of different types of investment instrument (equity, debt, hybrid) in an insurance company.

5. (5) At times, the insurers’ policyholders can also be thought of as providing capital, for example, purchasers of wealth-accumulation products.

1.1.11 The comments in the paper are intended to apply generally to all types of investor and all types of investment. Given the range of investors, it is not feasible to know all of the investors or all of the investors’ risk appetites. It is also difficult to judge whether the investor wants and is able to make use of all the data that might be given by an insurance company. However, the authors believe that the issues described in the abstract, namely systematic risk, potential correlations of earnings from future new business with macroeconomic trends, other risks to franchise value, and sources of model risk, are themes that are of interest to the vast body of investors in an insurance company, that are worthy of more attention than they currently receive in public disclosure, and are the natural outcome of a risk management framework that operates at the level of the overall enterprise.

1.1.12 For the avoidance of doubt, the authors wish to clarify their use of the phrase ‘systematic risk’. Following the definition given in wikipedia, systematic risk in finance, also sometimes called market risk, aggregate risk, or undiversifiable risk, is the risk associated with overall aggregate market returns, for example where an investment portfolio is correlated to general moves in the financial markets, both small and large. It should not be confused with systemic risk, which is the risk that the entire financial system will collapse as a result of some catastrophic event, not to any individual entity.

1.2 ERM from the insurance company's point of view versus the view of the portfolio investor

1.2.1 The contribution of ERM has been to bring all the risks in the insurer together, to be managed in a holistic manner.

1.2.2 A criticism of past risk management practice is that it tended to operate in silos; the objective of the more holistic ‘ERM’ approach is to minimise the risk of incorrect decision making, either accidental or as a result of agency risk, based on partial or incomplete data by ensuring proper and timely information flows on risk exposures, experience and value creation to the top of the organisation.

1.2.3 An example of a potentially incorrect decision could arise where the management of a local subsidiary bought reinsurance to cover local volatility risks, in order to smooth local earnings and bonus structures, rather than having regard to the balance sheet and requirements of the whole group, in other words, the managers’ objectives are not the same as the objective of increasing shareholder value in the subsidiary on a standalone basis.

1.2.4 An example of better information flows to the top of the organisation could arise where, say, investment risk was deemed to be less important within the context of the objectives and capitalisation of a particular local subsidiary, but is nevertheless consolidated with risks from other holdings of a Group, ensuring the Group can make decisions in full knowledge of all its sources of investment risk.

1.2.5 An example of where it may be critical for such information to be managed holistically might be when an insurance underwriter, for instance, offers a large line on a commercial lines insurance to a company where the investment department (a subsidiary of the same parent as the underwriter) has bought a substantial amount of corporate bonds issued by the same counterparty.

1.2.6 An excellent description of ERM at the level of the total insurance company is given by the paper “Practice Note on Enterprise Risk Management for Capital and Solvency Purposes in the Insurance Industry” (IAA, 2008), and the authors would refer the interested reader to this paper to gain an understanding of current best practice.

1.2.7 However, just as ERM requires the insurer to bring together all of the different risk and rewards characteristics of each risk ‘silo’, a similar process operates for the investor in the company. The investor wants to construct a portfolio as the combination of individual equity shares, and needs to bring together the risk and reward characteristics of the different shares in order to plan his overall investment strategy against his objectives/needs/liabilities, as shown in Figure 1.

Figure 1 Managing risk across silos.

1.2.8 In order for the investor to do this, the management of each company that he has invested in should provide him with information tailored to his needs at his total portfolio level. The implications of this are explored later in this paper.

1.3 Modelling and management of risk-adjusted returns from the insurance company's point of view versus the view of the portfolio investor

1.3.1 The management of an insurance company typically spends much effort on measuring and managing risk-adjusted performance against capital requirements.

1.3.2 The capital required to be maintained by the business must be sufficient to:

1. (1) Meet minimum regulatory requirements (usually based on modelling studies of regulatory requirements).

2. (2) Keep a buffer over the minimum in order to maintain confidence in the activities of the business appropriate to the market in which the organisation operates (usually informed by rating agency or analyst opinion).

3. (3) Ensure that future growth, acquisition, and other strategic plans can be funded and maintained after taking into account other capital requirements (noted above) and risk exposures.

4. (4) Protect the franchise value after shock events, i.e. enable the company to be able to carry on trading after a large but foreseeable insurance or market loss, in order to take advantage of improved pricing conditions after the event.

Further discussion of the economic costs and benefits of maintaining different levels of buffer capital is contained in Section 5.

1.3.3 The returns delivered to shareholders are derived from the performance of both the business's current in force portfolio as well as future new business and other activities that it may undertake. The rational valuation of an organisation should take account of both future activities and commitments as well as the risks to both.

1.3.4 The delivery of value to shareholders is usually subject to a wide range of financial, operational and strategic risks, each of which, to a degree, may be systematic or idiosyncratic in nature.

1.3.5 As with most commercial organisations, the returns delivered by an insurance company are likely to be correlated with the systematic risks affecting much of the rest of the investor's portfolio, the value of both the in-force portfolio and future activity being a function of the general economic health of the markets in which the company operates.

1.3.6 Similarly, both will be influenced by management behaviour and ability, and other specific risks.

1.3.7 Additionally, returns from the insurance company are also likely to be correlated with the overall macroeconomic variables because the assets are often held in stock market or similar risky investments – themselves exposed to systematic risk.

1.3.8 The rational investor seeks to compare risk-adjusted returns across the portfolio of individual equity shares. The amount invested (at risk) in each share is the market capitalisation.

1.3.9 The expected risk-adjusted return is a function of supply and demand (and its influence on the market capitalisation of a particular stock). In order to come to a view as to whether to participate – or not – at a given price, the investor must be able to weigh the risks in an investment against both the potential rewards and the risks borne elsewhere in his portfolio, seeking to identify undiversified risks for which a reward is normally sought (systematic) and diversified risks for which a reward often may not be available (idiosyncratic).

1.4 Transformation of risk behaviour at different levels

1.4.1 At each stage in the risk transfer process, the relevant participant diversifies one risk and accumulates another, as illustrated in Figure 2.

Figure 2 Transformation of risk behaviour at different levels.

1.4.2 One of the functions of an insurance company is to pool and transform risks accepted from customers, who are wanting to lay off risks that they do not want to bear, such as individual exposure to accidents or life contingencies.

1.4.3 At the level of individual business units, typically within a given territory, the insurance company pools and diversifies the risks of the individual customers. In that very process it tends to concentrate certain ‘parameter risks’, such as mortality, natural perils or legal risks at the level of that territory.

1.4.4 Then an insurance group can manage that parameter risk by spreading its business across many territories and product lines, but in that process it tends to concentrate risks at industry level, such as the parameter risks of its biggest territories, and the stock market risk attached to its investment holdings (net of any liabilities that are being matched).

1.4.5 Risk information that is useful and relevant at one level of the company may be transformed in its impact when viewed at another level:

1. (1) One subsidiary inside an insurance Group might find that, when modelling only its own risk-reward profile, the addition of modest amounts of extra investment risk in asset classes not previously used enhances return on capital because of diversification benefits. However, those external shareholders who are already long of that investment risk elsewhere in their portfolios may not see the same benefit.

2. (2) A subsidiary or Group that is heavily exposed to only one or two peak ‘unhedged parameter risks’ from the core products, e.g. mortality or natural perils, might seek to reinsure these to smooth its overall risk profile, even at the expense of some dilution of return on capital. However, some investors might prefer not to have the return on capital diluted, particularly if the risk in question acts as a source of diversification in their wider investment portfolio.

1.4.6 The ERM framework needs to support not only the management of the totality of risks within the insurance company, but also the understanding of how the total process concentrates and/or diversifies risk in the holdings of potential investors.

1. (1) Underwriting management looks at the acceptance of individual risks into the company.

2. (2) Capital management looks at how the totality of risks is financed at the level of the Group.

3. (3) The ERM framework needs to provide appropriate information up to the investors, who are the ultimate bearers of the risks that the Group has not diversified or hedged.

1.5 Bringing together the view of the company total and the investor

1.5.1 The paper will discuss Figure 3, and its implications for disclosure to investors, i.e. what do they need to know about the risk and value of ‘XYZ Ins Co’ in order to understand the impact on the risk and return characteristics of their entire portfolio of investments.

Figure 3 Investor's total risk and reward at portfolio level.

1.5.2 The topics to be discussed comprise:

1. (1) Modelling & managing systematic risk: from the insurance company point of view.

2. (2) Modelling & managing systematic risk of the insurance company: from the investors’ point of view.

3. (3) Modelling & managing risks to franchise value: from the insurance company point of view; and

4. (4) Modelling & managing risks to franchise value: from the investors’ point of view.

1.5.3 As regards topics 2 and 4 in Figure 3, anecdotal evidence suggests that certain investors can regard insurance companies as being too complicated, and that this may lead to a discount in the share price. For example, a report titled ‘Making sense of the numbers’ (PwC 2009) commented that, “Insurance analysts across the world believe that a lack of quality and consistency in current insurance reporting is increasingly leading to the under-valuation of a number of the world's leading insurance companies”.

1.5.4 The authors agree with this comment. There is the insurance side, i.e. products, growth, returns, just like any other industry. In addition, insurers hold in their balance sheets small equity shares of all of the other industries, i.e. a mix of all of the other equity risks that the investor could have. This leads to a lack of understanding, which leads to a discount in the share price. There is a strong requirement from the part of the investor for the insurer's management and its Board to give proper information flows:

1. (1) As previously expressed, to avoid incorrect decisions, either accidental or as a result of agency risk.

   1. (a) An example of an accidental one is if the insurance company decides to take a large shareholding in a share like BP that the investor already holds elsewhere. Even if there is a good risk-reward benefit to XYZ Ins Co from an internal point of view, it could be that from the investor's point of view the total risk becomes too large.

   2. (b) An example of a potential agency risk is if management buy too much reinsurance to lay off a particular insurance risk, such as mortality or natural catastrophe exposures, thereby smoothing earnings and protecting management's future bonuses. On the other hand, the investor might want to be long of that risk because it provides good diversification to the rest of his portfolio.

   3. (c) However, if the potential reinsurance purchase reduced the regulatory capital requirement of XYZ Ins Co, so that the company could return capital to investors and still maintain the same market share in its areas of expertise, it could be a beneficial decision. This is a complex decision process, and the point is that the right information needs to flow to the right recipients.

2. (2) The investor needs to know the potential risks in the firm both under ordinary conditions, and also under or approaching stress situations.

1.6 Layout of the paper

1.6.1 Section 1 says: good practices for an ERM framework exist, e.g. the IAA paper late 2008; we want to take this and look at the company from the view of an investor slotting the insurance company into his total portfolio.

1.6.2 Section 2 explains from a top-down view the relevant impacts of the topics of franchise value, market risk, and non-market risk.

1.6.3 Sections 3 to 5 discuss each of these topics from a more detailed point of view, including in Section 5 a discussion of the relationship between the amount of capital that the firm chooses to carry (‘target’ or ‘economic’ capital) and the franchise value.

1.6.4 Section 6 then discusses our view of what is [or should be] a good disclosure framework from the investor's point of view.

1.6.5 Section 7 discusses the issues of tackling this in practice, given the competing professional approaches involved, and the issues surrounding governance of risk at the total firm level.

1.6.6 Section 8 will discuss how actuaries could make themselves better positioned to help with these issues.

Measuring uncertainty

3.14 An effective ERM framework must be able to deal with all sources of uncertainty, whether arising from fluctuations in a market price or from inherent lack of certainty in future cashflows.

3.15 An objective of risk disclosure should be to communicate the extent to which the investor is exposed to risks (whatever the source) by investing in the insurance entity as compared to investing in other companies. They may then invest in the knowledge that if they buy shares in company A, B, C etc, they can form a view as to whether they are adding to or diversifying risk. There may initially be difficulty knowing how to meet the criterion of comparison to the other companies when they do not disclose their own risks and exposures; but in the opinion of the authors, somebody has to take the initiative (‘every road has a first step’), and there may be advantages to the reputation (and hence stock price!) of the early movers.

Role of the Replicating Portfolio

3.16 A tool which is increasingly being used to measure and monitor market-related risk and performance is the notion of a replicating portfolio, as shown in Figure 4.

Figure 4 The role of the replicating portfolio in profit attribution. Source: The economics of insurance, Hancock et al. (Reference Hancock, Huber and Koch2001), Swiss Re.

3.17 The replicating portfolio is a collection of assets whose risk and value characteristics, such as term structure and correlation with financial market risks, most closely reflect (‘match’ or ‘replicate’) those of the insurer's portfolio of liabilities. Conceptually, inserting the replicating portfolio into the picture in the manner shown in Figure 4 allows the investment risk and performance to be analysed between the portion which is an irreducible consequence of the liabilities, and the portion which arises on a voluntary basis as a result of investment decisions taken by the company. Further information on this concept is available in the Swiss Re publication quoted as the source.

3.18 When cash flows are fixed, the immunisation portfolio is thought of as the investment portfolio with the lowest risk. The replicating portfolio generalises this concept to add other risks. If a particular class of investor wants insurance companies to have as little ‘systematic risk’ as possible, then a likely insurer response is to invest assets in a portfolio that replicates the liabilities as closely as possible.

3.19 If the replicating portfolio – or an approximation to the replicating portfolio – is actually maintained, e.g. by a process of dynamic hedging, the shareholder's investment risk in the insurance company is reduced to a minimum. If the insurer decides to hold a different portfolio, e.g. as a deliberate decision to take on more investment risk in the hope of generating a higher investment return, then it can assess and communicate the effectiveness of this decision by:

1. (1) disclosing the extent to which it may expect to experience variance as a consequence;

2. (2) attributing the risk and return of the replicating portfolio to the insurance departments, when assessing say ROE targets and performance of its underwriting activities; and

3. (3) attributing to the investment department the risk and return of the difference between the actual investments and the replicating portfolio, when assessing the performances of its investment decisions.

3.20 Replicating portfolios are typically based on market values of assets, and correspondingly valued (‘market consistent’) liabilities. As discussed in Section 2, insurers writing annuity business may choose to reflect liquidity premia in the valuation. If so, it is important that the effect of incorporating liquidity premia (or other spread elements) in the valuation is clearly disclosed, so that investors can, if they wish, adopt alternative approaches, and that performance is measured relative to the expected earnings underlying the asset/liability matching strategy.

3.21 Investing in the replicating portfolio may not be fully effective at reducing either economic or regulatory capital requirements; for example, the basis for measuring assets and liabilities from a regulatory perspective might not match the internal basis for assessing the replicating portfolio balance sheet (e.g. in the case of annuities discussed above). In addition, investing in the theoretical replicating portfolio might not be possible in practice, as it may contain exotic synthetic assets not available in the markets, the fitting of the replicating portfolio may be not sufficiently precise, or the cost of rebalancing may be prohibitive.

3.22 Where material, any unavoidable capital requirements resulting from market risk should ideally be identified in the shareholder disclosure, with an appropriate cost. Similarly, unhedgeable risks (from not investing in the replicating portfolio) and their associated capital and costs should also ideally be disclosed, and the expected and actual return to shareholders resulting from such mismatching clearly stated.

3.23 The existence of unhedged market risk from a shareholder perspective will generally give rise to capital requirements and capital costs. As illustrated in Figure 5, the existence of market risk on the balance sheet not only gives rise to direct frictional costs of capital, but also gives rise to additional risk to the franchise value (since adverse outcomes of unhedged market risk may damage new business capability), and may lead insurers to naturally consider the replicating portfolio to be a benchmark.

Figure 5 The role of the replicating portfolio in cost of capital. Source: The economics of insurance, Hancock et al. (Reference Hancock, Huber and Koch2001), Swiss Re.

3.24 Finally, note that a replicating strategy hedges only the assets and liabilities in place, and will not necessarily eliminate any market-correlated elements of the insurer's franchise value. By this we mean, for example, the impact on the volume of new business of market conditions (e.g. equity market falls may damage the sales of a unit-linked insurer). However, as noted above, investing in the replicating portfolio will eliminate risks to franchise value arising from market fluctuations that damage capital adequacy.

Systematic Risk Arising from GI Products

4.2 The General Insurance (GI) company's typical beta and/or cost of capital is often stated to be low, because it is asserted that its risk diversifies against the risks of the general stock market. For example, at first sight there may seem to be no link between the level of the stock market and claims from property damage, accidents or workers’ compensation. However, on closer examination, many examples can be found of influences that affect both assets and liabilities:

1. (2) If the assets backing the technical liabilities do not hedge the liabilities well, e.g. they are invested in equity shares, or in government bonds dated longer than mean term of liabilities, or in corporate paper at risk of default.

2. (3) Some GI earnings streams tend to correlate with economic factors via the underlying impacts on claim frequencies and severities:

   1. (a) In motor business, the cost of bodily injury claims awards, especially those of higher amounts, may be strongly linked to wages inflation.

   2. (b) In household fire & theft business, claims frequencies may tend to be higher in a recession. This might be due to a combination of higher propensity to make legitimate claims as well as a possible increase in attempted fraud.

   3. (c) Commodity price inflation may hit business interruption claims. In recent years such as 2005 to 2008, the cost of claims for loss of profits from accidents in mining and oil companies was sharply increased by the high level of the underlying commodity prices compared to recent trends. Equally, after the effects of the financial banking crisis spread to the general economy, the cost of these mining and oil accident claims came down again.

   4. (d) Credit products may naturally suffer higher claims in a recession.

   5. (e) Even natural catastrophe risks are not entirely immune. After the Hurricanes Katrina, Ryta and Wilma in 2005, many oil rigs were destroyed in the Gulf of Mexico. The oil price hikes that followed exacerbated the cost of business interruption claims. However, it should be noted that this phenomenon is regarded as specific to each hurricane; it is common practice to model excess inflation, say in building costs arising from material and labour shortages, as part of the overall impact of the event itself, and to regard this as reasonably localised and not strongly linked to the general widespread behaviour of the economic variable involved.

   6. (f) Claims may be affected by levels of economic activity more generally; for example, motor accidents are affected by the number of vehicle-miles driven on the road, and property claims such as subsidence may be noticed only when a homeowner tries to sell a property.

   7. (g) Insurance profits are affected not only by uncertain claims but also cycles in premium rates which may correlate with economic upturns and downturns.

4.3 Where the above risk factors relate to liabilities already on the books, it may be possible to hedge away some or all of the risk. However, most of the above examples relate to risks attaching to the value of future new business, i.e. it can be seen that future GI earnings can correlate with future general economic factors. As a result, the ERM framework needs to provide the investor with sufficient information to understand the links between his franchise value risk and his overall level of systematic risk.

Systematic Risk Arising from Life Products

4.4 Although often more directly correlated with market risk, revenues from life assurance business are also exposed to more general risks arising from economic factors that can occur for example, as a consequence of correlation between:

1. (1) General levels of wealth and income affecting policyholder retention, and new business volumes and levels of contributions to savings and protection.

2. (2) House prices, house price inflation and market turnover correlate with sales of related mortgage protection business.

3. (3) Long-term improvements in economic conditions may influence mortality and general health of the insured population.

4. (4) Competitive premium cycles in certain lines of business.

In addition, for both life and general insurers, certain operational risks may display correlation with general economic conditions (e.g. fraud and other classes of financial crime).

Currency Risk of the Required Capital

4.5 For an insurance company with international exposures, it is well understood that the technical liabilities need to be backed by assets in the same currencies for good risk management reasons, e.g. to ensure that underwriting profits and the balance sheet are immune from currency fluctuations. The question also arises: what currency should the capital base be held in. If the liabilities are in sterling (GBP), then, since capital is needed partly in order to cover unexpected fluctuations in liability cash flows, the capital should be in sterling as being appropriate to cover such fluctuations. However, consider for example, the case of London based underwriting firms in the international specialty commercial lines and reinsurance markets. The liabilities of these companies are in a range of non-sterling currencies, typically dominated by the US dollar (USD), and then it is worth considering whether the capital should be held in a similar range of non-sterling currencies. The position is further complicated when the shareholders are from say continental Europe, Switzerland or Japan, as may often be the case in these international companies.

4.6 One temptation might be to hold the capital in the shareholder's currency, to preserve its value as measured in their terms in head office. Another temptation might be to hold the capital in the local currency of the company, i.e. GBP, to protect its reported value in the local financial statements. However, when GBP dropped in value by 25% relative to the USD in just three months in Q3 2008, another risk was exposed, namely that the business needs to be hedged to the risks of the required capital amount.

4.7 For example, consider Figure 6, where the authors have constructed a simple example of a company located in London (hence the expenses being GBP), where the main business streams are from outside the UK, and the shareholders are from one of the major international insurance groups located outside the UK. If the risks in the required capital amount are split 60%:20%:20% USD:GBP:EUR, then after a 25% drop in sterling against both these currencies, the required capital amount increases by 27% (80 goes to 80/0.75, i.e. 107, so (80 + 20) GBP goes to (107 + 20) GBP). If the capital in the firm had not previously been split by the currencies of the risks in the same proportion, then the firm would have had to raise more capital in order to keep to the same market share, i.e. to restore its franchise value. When planning such a hedging strategy to deal with this risk, it is necessary to consider the assumed correlation of currencies, particularly in the area of extreme shocks.

Figure 6 Currency risk of required capital base.

4.8 If this information were measured and disclosed to investors, it would help them to understand and manage the overall currency risk of their total portfolios. Some commentators have suggested that the rush of rights issues in the London Market in Spring 2009, advertised as being to take advantage of strong pricing conditions, had more than an element of topping up on capital that had been eroded by not being well matched to the currency risks of the business plans, for example the Insurance Insider, 9 December 2009 commented that “the bulk of the increase in capacity simply offsets the impact of sterling weakening against the US dollar which, on the 30 June, prompted Lloyd's to change the exchange rate from $1.99:£1 to approximately $1.5:£1. In the first half of the year, this caused a scramble among some US-focused Lloyd's businesses to source additional capital to come into line”.

4.9 The simple illustration above referred to the example of a single non-GBP or USD shareholder. In the case of a quoted company in the same market, where the investors and potential investors may not all be in one currency, then the location of the current shareholders is not necessarily crucial; shareholder value might be higher if, with some different investment strategy for the currency of the capital base and its associated hedging, the company might have a greater appeal to some other shareholders.

Insurance Company Risk Disclosure at the Stand-Alone Level

6.5 Insurers, like other firms, are already required to make statements in their reports and accounts concerning the risks and uncertainties to which they are exposed. This is an area that accounting standard-setters have been involved in for some time. In the US, Financial Reporting Release 48 on derivatives and market risk disclosures was introduced in 1997. The UK issued FRS13 in 1998, requiring risk disclosures from financial instruments, but exempted insurance companies. IFRS4 sets some specific requirements for insurers’ risk disclosures. IFRS7 relates to companies generally. The Financial Reporting Council recently issued a report on UK companies’ (not specifically insurers’) narrative disclosures, including comments on the way in which companies responded to the requirements to disclose the principal risks and uncertainties. The result of this can be seen in the Operating and Financial Review section of the financial statements of many companies.

6.6 For the benefit of the interested reader, we attach references to a sample of four insurance companies’ current public risk disclosures. The authors are at pains to stress that no significance should be read into the inclusion or exclusion of any particular company in this list; the extracts described are all in the public domain:

1. (1) Amlin (2008): as well as general descriptions of key risks on pages 36 to 39, pages 68 to 79 give detailed disclosures on insurance risks, and pages 80 to 88 on financial market risk.

2. (2) Munich Re (2008): pages 155 to 172 give much information on key risks and capital requirements by major segments, and pages 253 to 266 give more detailed risk information, including sensitivities to changes in key parameters.

3. (3) Prudential (2008): general descriptions of key risks are contained in the Business Review, and more detailed disclosures on topics such as the sensitivity of IFRS basis profit and equity to market and other risks are given at various places in the Notes on the Group financial statements.

4. (4) Swiss Re (2008): pages 66 to 83 give much information on key risks and capital requirements by major segments, including sensitivities to changes in key parameters.

6.7 Currently in the UK, insurers’ regulatory returns already contain some information about insurers’ risks and how they are managed. Solvency II will also impact on this under the Pillar 3 requirements. Typically, this information relates more to the risks of the insurance company as a stand-alone entity, from the point of view of say the policyholder looking at its potential strength before buying one of its products. What the paper is proposing in addition, are topics such as: systematic risk; potential correlations of earnings from future new business with macroeconomic trends; other risks to franchise value, and sources of model risk, which are themes that are of interest to the body of investors who are considering adding a holding in the company to the rest of their portfolio.

What Investors want to know at their Total Portfolio Level of Risk

6.8 ERM within insurers is maturing as a discipline, and has become increasingly sophisticated with the passage of time and greater experience. This sophistication entails better understanding and management of risks, including finer granularity and better data collection, as well as the use of more advanced statistical and computational techniques. Even more important than more sophisticated modelling is the qualitative side of embedding risk thinking on a holistic basis further and further into the business.

6.9 Investors are also starting to consider ERM approaches at a portfolio level, but currently this seldom steps beyond the analysis of a particular risk highlighted in news bulletins. Investment managers may take steps to understand the effect of a natural catastrophe, man-made event such as the World Trade Centre bombings or financial event such as the sub-prime mortgage losses across many investments in a portfolio. But day-to-day management of volatility and tracking error at the portfolio level is still largely based on measured volatilities, both historical and those implied by current market price structures, and correlations between share prices.

6.10 Investors who buck this trend and consider proactively how future events may affect their investments should be able to manage their portfolio risks better. They should be able to build a better picture of the distribution of outcomes, improving their understanding both of low frequency, high impact events (e.g. cat risk, terror risk) or high frequency, low impact events (e.g. poor or good investment practices. For example, the sample companies quoted in Section 6.6 publish information on the sensitivity of their financial results to sharp changes in interest rates and exchange rates, and also their exposures to peak natural perils events such as Atlantic windstorms or US earthquakes. This enables the investor to build up a higher level picture of his combined exposure to these risks from all of his shares at portfolio level.

6.11 In this section, we are discussing what ERM disclosures may be helpful to investors, to enable them to use more advanced ERM techniques in their portfolio constructions. We also recognise that a desire for information by investors is not the same as information being disclosed. Management may withhold information on the grounds it is costly to produce, and could undermine competitive advantage, out of fear that disclosure of bad news could harm share prices, or simply because of embarrassment. Much risk information in the context of ERM is forward looking and subject to significant assumptions and limitations. Management may fear that disclosure to the world at large could do more harm than good. If recipients fail to understand the uncertainties and limitations inherent in risk forecasts, a lack of pinpoint accuracy could be misconstrued as management incompetence. The views of the authors are that in the long run additional risk disclosures targeted on the key sensitivities are in the firms’ interests, but they accept that it is difficult to provide a hard and fast justification of this, based for example on setting out the costs and benefits to firms of the additional risk disclosures. Their views are based upon more general considerations that quality will win out in the long run.

The Range of Investment Management Styles

6.12 Different investment managers have a range of investment styles. Some analyse individual stocks looking for buy and sell signals; others adopt more statistical approaches to stock selection, some are large fundamental investors who will be undertaking fundamental analysis of individual companies, some are smaller investors, gaining their exposure both via equity and via insurance policies.

6.13 Most investors consider investment management styles primarily in terms of active versus passive. Passive styles attempt to track indices closely, the chief selling point for investors being the relatively low costs. Active styles involve deliberate deviations from the market norm portfolio. These deviations may be executed at the individual stock level, by sector or in terms of sub-portfolios that share certain characteristics, for example low price expressed as a multiple of annual profit, or high historic price volatility.

6.14 Existing fund management techniques have grown up around the disclosures that currently exist. Many insurers’ ERM disclosures currently say little more than to state that an ERM process is in place or under development, sometimes supplemented by quoting a rating agency view to the effect that the ERM programme is a good one. The hope is that investors will draw a link to ‘good corporate governance’ and this is then taken as a positive ‘signal’ of firm value by fundamental investors. However, the recent financial crisis has seen the failure of large financial firms, many of whom apparently had ERM processes in place. The sceptical analyst community is no longer satisfied with assurances that ERM information exists within an organisation, instead showing increased hunger for the ERM information itself.

6.15 There is a wide gulf between the detailed ERM information available within leading firms and what is made available to outside investors. It may be that in the longer term, comprehensive disclosure of ERM information spawns entirely new and more successful approaches to investment management. In the short to medium term, the likely effect of ERM disclosures is a modification of existing investment management approaches. Information disclosure develops in line with the companies’ willingness to disclose it (issues are commercial sensitivity as well as the volume of other disclosures), and only as fast as investors’ willingness to digest it. We have to ask, then, what opportunities exist incrementally to refine existing investment analysis to reflect ERM thinking.

6.16 Investment managers already using quantitative approaches are more likely to see a benefit in bottom-up risk modelling, as this may fit more naturally into their existing tool kit. We consider two popular quantitative approaches: fundamental stock analysis and historic regression.

6.17 Just as there are alternative approaches to investment management, so there are also different approaches to insurance management. Some insurers are opportunistic, demonstrating agility in allocating risk capacity in search of the highest annual returns. Other insurers see greater value in developing client relationships over the longer term, even if this means writing at a loss to retain business at some points in the cycle. Some insurers place a high reliance on quantitative analysis, with sophisticated mathematical models underlying any decision, while other insurers place greater emphasis on traditional underwriting skills. It is interesting to consider whether there might be some correspondence between insurance and investment management styles. Investment managers with a particular approach to portfolio selection may be more comfortable investing in insurers whose management style is similar.

Fundamental Stock Analysis

6.18 Fundamental stock analysis seeks to establish whether the market overvalues or undervalues certain stocks. The assessment typically uses some form of discounted cash flow analysis, to which the key ingredients are the expected cash flows and the discount rate. The classic work of Graham & Dodd (Reference Graham and Dodd1940) remains the authoritative reference in this field.

6.19 Analysts may explicitly extrapolate profit projections using an assumption of return on capital combined with a growth rate. In other words, historic profitability is analysed in terms of ROE, and this figure, combined with a view of how the future may differ from the past, forms the basis of cash flow projections that are then discounted. Each analyst has his own favoured metrics and ratios, fashions following the economic cycle. Repudiation of new fangled techniques and return to tradition are the current fashion, following a crisis to which some have argued the existence of complex models contributed. For example, Smithers (Reference Smithers2009) argues once more that only the replacement cost of a company's assets (Tobin's q) and the ‘cyclically adjusted price-earnings ratio’ provide reliable methods of valuing firms.

6.20 Just as cash-flow models are fundamental to the process of stock analysis, so cash-flow projections are at the heart of internal models. However, insurers’ cash- flow projections look very different from those of analysts. Specifically, insurers’ own models typically project explicitly the contracts that will be underwritten, including among other features the premiums and claims associated with those risks, investment income, expenses, charges, tax and so on. The required capital is a function of the premium volume and of the risk exposures, including among other features allowance for risk mitigation, for example by way of diversification or reinsurance, and reflecting management and policyholder actions as well as the volatility of risk/claim incidence/claims amounts. Thus, analysts’ models typically require an assessment of return on capital as a projection input, while for insurers’ internal models the return on capital is an output.

6.21 Let us assume for now that the internal models encapsulate information about the insurer which is not otherwise available. In that case, disclosures related to the internal model would in principle enable analysts to improve the accuracy of cash- flow forecasts, and potentially improve the reliability of buy/sell recommendations.

6.22 A second investor use of ERM could be to inform the assessment of the dividend discount rate, which is equivalently the shareholders’ required return. In theory, this required return should depend on how risky the cash flows are, with a particular emphasis on systematic risk that cannot be diversified. In current practice, this is often assessed by regression of historic share price moves against a market index, but such an analysis is backward-looking and may not detect the benefit of risk mitigation strategies that have been introduced only recently. There is also a broader link of ERM quality and the cost of capital. Exley & Smith (2007) explained how good ERM practices, particularly efforts to hedge assets and liabilities, can reduce the frictional costs of capital, including cost of capital raising, holding and distribution as well as financial distress costs.

Multi-Factor Quant Techniques

6.23 A paper by Griffiths et al. (Reference Griffiths, Imam-Sadeque, Ong and Smith1996) describes some of the most popular quant techniques. Many of these attempt to explain price performance of different stocks by reference to those stock attributes – such as accounting and price ratios or historic share price volatility. For example, an historic index might be calculated for the ‘P/E factor’, which is the extent to which, over a given period, stocks with a high initial price to earnings ratio out- or under-performed stocks with a low P/E. Historic analysis of this factor may help investment managers to characterise the periods in which high P/E shares outperform, and in particular, to forecast whether the forthcoming quarter is one of those periods.

6.24 In principle, any quantifiable attribute is a possible regression variable in this analysis. For example, we might consider partitioning companies in alphabetical name order. Analysts would surely welcome a measure from the ERM community of the extent of ERM programmes. This could then be used, together with other attributes, to determine the extent to which ERM programmes lead to out-performance. Currently, Standard & Poor's do rate ERM programmes, and the results are disclosed. Of course, it may be that the research tells us more about the quality of the assessment of ERM than the value of ERM.

6.25 The problem with giving information is that one cannot control how investors will use it. For example, investors like companies to have robust risk management processes in place. They dislike weak management whom consultants can easily sweet-talk into initiating expensive but ineffective projects. Markets could interpret the announcement of an ERM programme as either of these, and the issue with any such disclosures is being clear about the rationale for them and providing sufficient additional information for the recipients to understand them. The company also needs to realise that different levels are suitable for different users, e.g. policyholders versus analysts.

Enterprise and Systematic Risk Disclosures

6.26 Enterprise risk management is, tautologically, concerned with risk at the level of the enterprise. Bottom-up models of many risks are aggregated at the enterprise level to produce probability distributions of possible outcomes. These are sometimes expressed in terms of value-at-risk numbers, also rather grandly called ‘economic capital’.

6.27 Aggregate information is needed for value-at-risk calculations. Unfortunately, aggregate information is difficult for investors to build into portfolio risk models. The reason is that the value-at-risk number says little about the relationship between risk in one company and risk in the rest of the portfolio. For example, an insurer might be exposed to interest rates, but to put this into a portfolio context, the investor needs to know whether the exposures (not just for the insurer but also for other shares in the portfolio) are to a rise or to a fall.

6.28 In principle, this information could be made available. It would have been calculated as an intermediate step within the value-at-risk calculation. What investors need to make sensible investment decisions is the components of value-at-risk. These components are the exposures to specific events: interest rate rises and falls, equity or credit market moves, natural or man made catastrophes, customer behaviour and so on.

6.29 Relative to other types of enterprise, we believe that insurers are relatively well prepared. This is partly because the management of risk is core to insurance competency. This provides an opportunity for insurers to lead the way in risk disclosure, but we should also recognise that the ERM information becomes of significant value to investors only when the rest of industry has caught up, and comprehensive, consistent disclosures are available across the investment universe. For example, there are many businesses in the economy vulnerable to the effects of bad weather. An investor who would like to be in a position to understand the aggregate effect of a flood scenario on his investment portfolio must aggregate the effect on insurers with the effect on other sectors of the economy – for those insurers who disclose their peak flood exposure when it is material to their overall position, for example in a similar fashion to the companies in Section 6.6, then this would be achieved for their part of the equation.

6.30 Analysts may, at first, take risk disclosures at face value, as a statement of the risks to which an insurer is exposed. Analysts are also interested in the quality of forecasts, that is, the extent to which actual outcomes are consistent over time with previously disclosed distributions. With hindsight, risk disclosures may also provide meta-information about the quality of risk management. For example, an insurer may claim to have no material net derivative exposures and sufficient capital to withstand a 1-in-2,000 year event. If that insurer is subsequently brought to the brink of ruin by losses on credit default swaps, analysts may draw conclusions about ERM programme effectiveness. There is no certainty about risk management; it is a harsh discipline, as risky events will occur where the benefit of hindsight will be used as a means to criticise earlier decisions. But the company needs to be able to explain:

1. (1) why they had not mitigated the risk and/or why they had underestimated the impact/probability; and

2. (2) what action has been taken.

It would be right for analysts to question the ERM programme in the circumstances where these explanations were not sufficient.

Is There a Link to Market Prices?

6.31 Investment managers are measured primarily on their investment returns, calculated on a market value basis. Thus, the most convincing argument for analysts to take a greater interest in ERM would be a demonstrable link to market prices, often measured on performance relative to a benchmark rather than a change from a previous level.

6.32 There is also a recent paper published in the Journal of Financial Economics which suggests that cash flow volatility is negatively valued by investors (Rountree et al., Reference Rountree, Weston and Allayannis2008). If ERM promotes better risk management practices, then surely this results in smoother performance?

6.33 A step in this direction is to examine insurers that have failed, and identify the weaknesses in ERM which contributed to that failure. Ideally, we would like to demonstrate that the companies with strongest ERM avoid such disasters. Unfortunately, recent data is not supportive of this link, with several high profile insurance and banking failures having previously filled many pages of their annual report with self-congratulatory rhetoric about their ERM program. The assumption must be that those companies who failed did not have the strongest ERM in the sense of it being properly embedded, they had the form but not the content.

6.34 An alternative approach is to use existing shareholder value measurement approaches, based in some way on internal accounting numbers, and demonstrate how ERM improves shareholder value measured in this way. Here, the link should be much easier to identify. There is little doubt that ERM programmes have the potential to increase stated return on risk-based capital. The challenge then remains to convince the investment community that a higher stated return on risk-based capital merits a higher share price – an assertion which many insurers have been keen to support. Other challenges are evidenced by the debate on whether firms take steps to manage risk in order to increase shareholder value or in order to meet managerial objectives (e.g. job security or risk-related remuneration), or by the possibility that a firm has an ERM programme in place but that programme is inadequate and the firm takes its eye off the ball, and fails when there are unexpected adverse risk developments. In addition, whereas many ERM programmes have the potential to increase return, some have the potential to reduce it, in circumstances where the cost of protection may outweigh the risk cost, because the programme was more about reducing volatility. Research on the link between adoption of ERM programmes and shareholder value is necessarily in its early stages.

The role of Systemic Risk

6.35 In addition, either good practice or regulatory requirement may eventually lead to the need for public disclosure of the company's contribution to systemic risk exposures that are capable of threatening the industry as a whole on a combined basis. There are obvious examples for banking institutions that have been highlighted by the recent financial crisis. For the life insurance industry, an extraordinarily widescale flu pandemic or extended decrease in pensioner mortality could threaten the capital base of many firms simultaneously. For both life and general insurance companies, an extended period of loss of credit rating for the UK government's debt below sovereign rating levels could have the same effect. From the point of view of those investors who use sector selection as part of their decision making process, such information is of great interest when reviewing the risk profile of their portfolios.

Competing Modelling Professionals

7.4 There may be a large number of professionals involved in the management of risk in an insurance company, for example, underwriters, possibly surveyors, accountants, treasurers, investment professionals, and there are also the auditors, both internal and external. To understand better the issue of expertise from the point of view of the investor, the focus in this section is on four different groups of professionals with a contribution to make to identifying model risk:

1. (1) Actuaries, internal to the firm.

2. (2) Quants and other qualified risk management professionals, internal to the firm.

3. (3) Equity and rating agency analysts, external to the firm, and

4. (4) The Board and senior management, partly internal to the firm, and partly external to the firm, i.e. NEDs (non-executive directors).

7.5 This section will discuss what do the modelling professionals do well, what do they not do well, and what improvements they could make in their disclosure. The particular theme is model risk: this risk is borne by the investor, and the issue is how the modelling professionals can do a better job of disclosure in this area.

7.6 The first three types of modelling professionals belong to specific disciplines: their professions may or may not have disciplinary habits/sanctions for poor performance, be it through incompetence, negligence, or naughtiness. The fourth type are senior management and the Board: they get the best rewards, so what discipline should they be subject to? For example, they ‘ought to’ be responsible for the activities and outcomes of the first three types.

First kind of modelling professional: the actuaries

7.7 A key model risk is the expertise of those in charge of the economic capital modelling of the firm. The economic capital modelling is driven by the modelling of the liabilities, which are modelled by actuaries. They are strong at control modelling, with an historical perspective; they are less good at performance evaluation, with its forward looking perspective.

7.8 The authors believe that it is the actuary's job in any activity or piece of work, under the banner of ‘making financial sense of the future’:

1. (1) to produce a model to evaluate and advise on the different options [‘risk’]; and

2. (2) to explain the potential defects of that same model and its assumptions, and what impact they might have on the advice in (1) [‘uncertainty’].

7.9 Under task (1) in the previous section, the aim is to value or model risk in an intrinsic way (‘endogenised’), namely to develop a structure, creating parameters within an economic model that are internally consistent and verifiable. This is to be contrasted with the aim under task (2), to meet the needs of the investors, who are also interested in the modelling of uncertainty as well as the risk, and which requires forward looking views, often of a speculative and potentially unverifiable nature. This second mindset can be hard to achieve, especially as it can feel like such a different discipline to the logical rigour of the first. There is also a fine line to be trod, between expressing the uncertainty in such a way as to almost discredit the modelling of the risk, but also to achieve disclosure of the limitations of the modelling in an open and honest fashion.

7.10 The situation facing actuaries can be compared to that of a constrained valuation professional. In other contexts, the valuation expert has a significant influence over the market's understanding of total enterprise value. For example, a mining company's valuation is very sensitive to the appraisal developed by a geologist concerning the property rights, and an entrepreneur's skill in marketing that to investors and stakeholders. By contrast, an insurance company has many competing professionals, and the actuary's voice may not be the only one seeking for attention.

Second kind of modelling professional: the quants

7.11 In the banking and asset management sectors of the financial services industry, a group of professionals has emerged in recent decades, whose role is to design and implement mathematical models for the pricing of derivatives and other instruments, assessment of asset risk, and maybe even systems for predicting market movements, typically short-term anomalies. These are called the ‘quants’, and they are increasingly populating the investment and modelling departments of insurers and other financial institutions who also have liabilities to manage. Typically, they tend to focus their efforts on modelling and managing the risk measures centred around the mean, whereas the role of the actuaries has historically been more focused on modelling extreme events and rare shocks. However, it is important to realise that insurers have a strong commercial interest in not just managing risk, but also transforming risk for the benefit of shareholders. An example is the use of securitisation via insurance-linked securities, which can require the bringing together of the two different traditional skill sets. The growth of the quants therefore raises questions of modelling governance, in particular the trade-off between decision rights about allocation of capital (which ultimately lies with the CFO and the Board) versus decision control (which may reside with the delegated manager who can be influenced by the actions or recommendations of both quants and actuaries).

7.12 In an insurance firm, the above modelling professionals are competing for the ear of the CFO. Differences of approach between actuaries and quants can be to do with the extent to which franchise value is composed of kinds of capital not easily modelled, such as frictional costs:

1. (1) Signalling cost of buffer capital: capital locked up in the firm, particularly in idiosyncratic/specific risk, and the investor may not be aware of this.

2. (2) Tax tied up in historical decisions.

3. (3) Off balance sheet exposures, contingent risks and capital.

Third kind of modelling professional: the equity and rating agency analysts

7.13 In addition to quants and actuaries, who affect the management of the business, there are also equity analysts and rating agency professionals, who tend to sit outside the firm but make recommendations to investors about the worth of their shares (e.g. buy/sell, credit rating). Similar to quants, they may have accreditation by organisations such as the Securities Institute and/or the CFA institute. However, although these professionals are important for accrediting the quality and value-relevance of insurance firms to their shareholders, they typically may not fully appreciate the actuarial role, e.g. the interaction with regulators. Also, they may not fully appreciate the activities of the quants. If their impact is small, then this should not be a problem. However, if equity analysts and rating agency professionals are important conveyors of newsworthy information concerning the valuation of a firm to other investors, and if they are not well controlled, this can lead to two problems:

1. (1) Information asymmetry.

2. (2) Adverse selection. These are decisions made by the firm which the investor would not have made.

7.14 These factors are especially significant if the firm is made up of complex sub-divisions. Also, because they are so far away from the action and/or the details, these professionals can be the least informed on the details; it is the company's responsibility to inform them, which can require significant effort on an on-going basis.

Fourth kind of modelling professional: the Board and senior management

7.15 Overseeing the results of the modelling professionals are the people in charge of the firm at the highest level. They will need to supervise any conflicts between short-termism (seeking to meet a specific profit target by whatever means) versus long-termism (maintaining a more sustainable balance between risk and reward). They will also need to ensure that the issues of model risk are well managed and appropriately communicated to investors.

7.16 In the authors’ opinion, there needs to be an acceptance that banks and insurance companies will never be completely transparent because of the complexity and commercial pressures, there will always be ERM issues; they will never become as transparent as an institution such as a unit trust. However, reducing the information asymmetry by improving disclosure could lead to a better stock rating.

Implications for accounting policies and disclosures

7.17 There are important implications for accounting policies and disclosures. From the entity perspective, investors are just one set of stakeholders; regulators on behalf of policyholders also exert great power. This can lead to an outcome where effectively the owners of the firm are not the shareholders, but the Board; they want the objective of accounting to improve relevance of accounting to value. From the proprietary perspective, i.e. starting from the point-of-view of shareholders, they want two sets of accounting:

1. (1) stewardship, i.e. a true and fair focus on historical performance, together with placing a current value on the expected outcome of long term liabilities already incurred; and

2. (2) future value creation, i.e. value accounting, where managers give their best estimate of economic basis of capital consumption.

7.18 In addition, investors want to see not just accounting numbers, but proper economic views of value creation and prospective views of risk. But the distance between investors and management can lead to paradoxes. Consider the very powerful tool of monitoring actual outcomes against plan and publishing the results; even this can lead to misunderstandings because of the different points of view:

1. (1) Inside the firm (managers): the plan is the best estimate going forward.

2. (2) Outside the firm (shareholder views): if shareholders are too demanding against downside missing of the plan, this can lead to management being ‘conservative’; but then they give shareholders a one-sided view, i.e. deprive them of information, and may overstate risk, which is inefficient for shareholders.

Different needs of different investors

7.19 If you go outside the firm, it is hard to communicate effectively with a whole range of shareholders with different preferences:

1. (1) Some investors are in the first camp, being primarily interested in trading the share, focusing on changes in the quoted price for whatever reason.

2. (2) The second camp of investors comprises long-term holders, concerned with sustainable competitive advantage, owner earnings, and fundamental value.

3. (3) The third kind of investor is the hedge fund, hedging between fundamental value investors and behavioural finance investors (e.g. build on momentum strategies) or what the market actually does.

It should be noted that good ERM should reduce the difference between first and second camps, giving reduced opportunities for arbitrage.

Investors and aggregation

7.20 When investors make a buy or sell decision, they make it at the level of the stock. Stocks are issues by the firm, which is subject to consolidation accounting. The act of consolidation makes important assumptions about control, for example in the case of SPVs (special purpose vehicles) or minority holdings: yes you are buying one firm, but that firm contains much diversification and aggregation within it.

7.21 Traditional cost of capital approaches, e.g. CAPM, Fama French, also do not deal with important issues of internal correlations and/or diversifications, and the effect of significant idiosyncratic risk.

Seeking solutions to model risk: governance

7.22 Governance of model risk is now receiving much more attention than in the past. Chapter 6 of the recent Walker report (Walker, Reference Walker2009) says:

1. (1) A key distinction is between the responsibility of the Board for the management and control of risk and decision-taking against risk appetite and tolerance (‘known risks’), as opposed to the identification and measurement of risks where past experience is an uncertain or potentially misleading guide (‘unknown risks’). When risk materialises, it may do so as a risk previously thought to be understood and managed that turns out to be very different indeed, and may do so quickly, well within normal audit cycles.

2. (2) Thus, while it is necessary to have good governance and oversight of current risk in real-time in the sense of approving and monitoring appropriate limits on exposures and concentrations (backward-looking focus), this is almost an executive function; of more importance at Board level is a forward-looking focus, giving appropriate weight to risks on which the company had not previously focused and which were not therefore captured in conventional risk management, control and monitoring processes.

3. (3) Alongside assurance of best practice in the management and control of known and reasonably measurable risks, the key priority is for the Board's overall risk governance process to give clear, explicit and dedicated focus to current and forward-looking aspects of risk exposure, which may require a complex assessment of the entity's vulnerability to hitherto unknown and/or unmodelled risks. This can be thought of as a forward-looking process for determining risk appetite, i.e. the willingness of the Board to accept significant extra risk arising from potential model breakdowns.

Seeking solutions to model risk: disclosure

7.23 Governance is an internal matter; of greater interest is how disclosure of model risk might proceed: professionals will have to disclose in public where their models will not function well, and this may be a difficult issue. This disclosure could be as required under IFRS, or as emerges under Solvency II, or as a result of competitive pressure through general pressure from investors at large.

7.24 In the Walker report, recommendation 27 states: The Board risk committee (or board) risk report should be included as a separate report within the annual report and accounts. The report should describe the strategy of the entity in a risk management context, including information on the key exposures inherent in the strategy and the associated risk tolerance of the entity and should provide at least high level information on the scope and outcome of the stress-testing programme.

7.25 Within the context of stress testing, the Board risk committee and Board should understand the circumstances under which the entity would fail and be satisfied with the level of risk mitigation that is built in. This should obviously include a review of the circumstances in which modelling assumptions fail (e.g. the assumption of future liquidity that underpinned the banks taking on such high levels of exposure in the run-up to the recent financial crisis). There is already a wide body of risk disclosure as described in outline in Section 6, which identifies the traditional ‘shock type’ risks that face the company, but authors believe that the publication of stress tests that genuinely identify risk to the company's business model, even where they are part of generally accepted industry practice, could at least in the early iterations lead to difficult conversations with investors. The authors try to identify on a speculative basis a couple of examples in the next two sections, which reflect an understanding of the spirit of the recommendations, in order to illustrate their point.

7.26 Consider a potential example from general insurance: suppose a UK general insurer disclosed the following:

1. (1) on a ‘1-in-a-100 basis, it has exposure to UK windstorms of £1bn;

2. (2) it buys reinsurance excess of £200m, has a capital requirement for a single A rating level of £400m when its other exposures are factored in, and has carried capital of £500m;

3. (3) its household policies incept throughout the year and typically have durations of 12 months, but its reinsurance programme runs for 12 months on a losses occurring basis and renews on 1st January;

4. (4) if there were sudden unexpected dislocation in the reinsurance market such that capacity were not available, its capital requirement for a single A rating would rise to £800m (‘forward-looking process for determining risk appetite’);

5. (5) but it is (currently) accepted industry practice to manage this risk in this fashion;

6. (6) the question is, how would the stock market view this information: supportively or not?

7.27 A life assurance organisation may for example have exposure to mortality improvements though its annuity portfolio. Disclosures are typically based on best estimate assumptions (or at least on assumptions consistent with the methodology in question) with sensitivities shown around those estimates; however simple sensitivities often leave many questions arising, including:

1. (1) By how much could the model or expectations be wrong before causing moderate or severe financial distress to the organisation;

   1. (a) Moderate distress might be defined as, for example:

      1. (i) a need for organisational restructuring; or

      2. (ii) reprioritisation of activities; or

      3. (iii) requirement to reduce or pass on dividends.

   2. (b) Severe distress might be defined as, for example:

      1. (i) regulatory intervention; or

      2. (ii) default or deferral on junior or senior liabilities.

2. (2) What is the nature of the event(s) that might give rise to such a divergence between model and reality?

3. (3) What is the relative likelihood of such events (in management's view); what basis do they have for believing this?

4. (4) What correlations or confounding factors are likely to arise in conjunction with the emergence of this risk?

5. (5) Would such an event cause a short-term cashflow strain, or materialise as a longer term issue?

7.28 Another example of disclosure around the topic of model risk is the so-called ‘options table’ in Appendix 9.4A of the FSA returns for UK life insurance companies. This requires companies to publish the results of applying their economic scenario generator (ESG) to the evaluation of the prices for a standard set of options based upon a standard set of underlying financial instruments. Comparing the outputs across a range of different companies would allow an investor to assess the relative conservatism or optimism in the construction and calibration of the ESGs for the different companies, and so potentially draw conclusions about the conservatism or optimism of their earnings forecasts. Further discussion on the governance of the use of ESGs is given in the paper ‘ESGs and Solvency II’ by Varnell (Reference Varnell2009).

7.29 The authors can foresee the potential future requirement from investors to apply the thinking in Section 7.28 to other areas of operation:

1. (1) If a general insurance company has significant exposures to natural catastrophe risk which it evaluates using one of the models provided by the external vendors such as RMS, AIR or Eqecat, it seems natural for the investor, looking at the valuation of a range of such companies, to ask each of them how the results of their modelling compares to using one of the models on a standard basis (e.g. ‘100% of RMS with all secondary modifiers applied’).

2. (2) If a life insurance company has significant exposures to the longevity risk attaching to annuity business, it seems natural for the investor, looking at the valuation of a range of such companies, to ask each of them how the results of their modelling compares to using one of the standard mortality tables (e.g. ‘100% of Table X’).

7.30 The authors well understand the question of basis risk, and that disclosure on such issues starts to provide information that might be regarded as commercially sensitive. From the point of view of the investor who is providing capital to the company and owning part of it, it seems natural for him to ask for such information when comparing the stock market valuation of different insurance companies; but for the professionals and Boards concerned, it could bring an exceptionally strong light of external scrutiny to bear on their performance and their approach to the management of the risks of their business. In the opinion of the authors, this is a pressure that will only grow with time, and those companies who take on the challenge to use their ERM frameworks to gain an early starter benefit will achieve greater investor confidence in the long run.

Information on the contribution to systemic risk of insurance companies

7.31 CEIOPS in a recent a press release (CEIOPS, 2009) announced that they proposed to run an EU-wide stress test in the insurance sector in December 2009. They said that “The objective is an EU-wide exercise with common guidelines and scenarios, so as to increase the level of aggregate information among policy makers in assessing the European insurance sector's potential resilience to shocks and to contribute to the convergence among supervisory practices. Three scenarios will be tested. An adverse scenario mirroring the development of capital markets between end-September 2008 and end-September 2009. The second scenario reflects a more severe and prolonged recession and the third scenario reflects a situation of inflation picking up rapidly leading to a steep rise in interest rates. The stress test will focus on market and credit risks.” Although this exercise is focused on the needs of the supervisor charged with managing risk to the financial system overall, such information could clearly be of interest to prospective investors who are interested in the total risk of a significant investment across different shares in the insurance industry. The authors are not aware that the results of the CEIOPS exercise are to be made public, but it is easy to anticipate that at some time in the future, public investors could be interested in such information on an appropriate and timely basis in respect of their own holdings.