2.1. Bank Risk Reporting Practices

The general vagueness in risk reporting by insurers is in stark contrast to the banking industry. In addition to being required to report “risk-weighted assets” (RWA), Basel Committee has also recently developed specific guidance for risk reporting principles. These are summarised in Appendix 1.

Despite this, one of the great ironies of the financial crisis is that, ahead of its impact, according to the general purpose and specific risk reporting standards applicable time, regulation and guidance then in operation, the banking system appeared well capitalised. Banks were reporting capital ratios well above the minimum levels required under Basel 1. And Basel 2, due to be implemented just as the crisis hit, proposed no overall increase in the level of capital held by the banking sector.

In this section we briefly summarise the results of a study conducted by one of the authors (Klumpes & Welch, Reference Klumpes and Welch2011) concerning recent trends in both accounting and regulatory supervision after the financial crisis. By comparing the risk-weighted capital ratios calculated in accord with the fully implemented Pillar III requirements of Basel 2, with the unweighted equivalent capital ratios estimated under IFRS (leading to the calculation of the subsequently implemented “leverage ratio”), the analysis identifies areas of deficiencies in the transparency of IFRS-based financial reports and regulatory-based capital risk disclosures and calculations by the major UK banks around the time of the crisis.Footnote ⁴

We briefly outline capital risk disclosures of the big UK five banks, as well as Northern Rock and UBS, two of the banks worst hit by the first phase of the crisis during the second half of 2007. At end of 2006, Northern Rock reported a Tier 1 ratio 8.5% more than twice the regulatory minimum and higher than the 7.7% ratio it reported at end of 2005. Meanwhile, UBS reported a Tier 1 ratio of 11.9% at end of 2006, one of the highest in the European banking sector.

Why did banks appear so strongly capitalised? Was there a simple flaw in the Basel approach to the risk weighing of bank assets that contributed to this illusion of capital strength?

Under Basel, assets are effectively risk weighted from a 100% ceiling rather than around a 100% mid-point. Few asset categories are weighted more than 100% with major asset categories (interbank loans, mortgages) risk weighted at significantly <100%.

Weighting from a ceiling rather than a mid-point has a crucial effect on asset values and capital ratios. It disconnects the total value of RWAs from the total unweighted value of bank assets. Crucially, it pushes down the risk-weighted value of assets, so they are significantly lower than unweighted asset values. And this in turn disconnects RWA-based capital ratios (such as benchmark Tier 1 ratio) from unweighted leverage ratios (e.g. equity as a proportion of total balance sheet assets). Risk-weighted capital ratios are significantly higher than capital ratios based on unweighted assets.

Prior research demonstrates that changing the anchor can have an important impact on the behaviour of investors and analysis, who rely on the quality of capital risk disclosures contained in financial reports in making investment decisions (Klumpes & Manson, Reference Klumpes and Manson2008). In their reporting, banks tended to focus on their “strong” Basel capital ratios rather than the value of the RWAs. Yet, the capital ratios only looked strong because the value of RWAs was so much lower than the value of unweighted assets. Thus, the recalibration gave the illusion of a systemic reduction in the underlying risk, when it should have been calibrated neutrally. As a result, investors and regulators lost sight, or failed to realise that “strong” Basel Tier 1 ratios were compatible with surprisingly low unweighted capital ratios.

Northern Rock and UBS were major players in asset categories – residential mortgages and trading book assets, respectively – that were only lightly weighted relative to the 100% ceiling under Basel. As a result, Northern Rock’s RWAs of £30.8 billion at end of 2006 were less than a third of its balance sheet assets of £101.0 billion. And its Tier 1 ratio of 8.5% at end of 2006 was more than twice as high as its unweighted leverage ratio (equity-to-balance sheet assets) of 3.2%.

The value of UBS’s total balance sheet assets of CHF 2.4 trillion at end of 2006 was an astonishing seven times greater that it’s RWA of CHF 342 billion. As a result, its Tier 1 ratio of 11.9% compared with an unweighted leverage ratio of only 2.1%. UBS’s large and lightly capitalised investment bank trading book appears to be the main factor behind the disconnect. UBS’s large investment banking business accounted for over 80% of its balance sheet.

But this disconnection between the value of risk-weighted and unweighted assets was not limited to the more specialist mortgage or investment banking players. Take, for example, the big five UK-based universal banking groups (Barclays, HBOS, HSBC, Lloyds and RBS). At end of 2006, only HSBC’s RWAs were valued at more than 50% of its unweighted balance sheet assets. And even in the case of HSBC, the value of its RWAs was only 50.4% of its balance sheet assets. Overall, for the five banks combined, RWAs were valued at only 43% of unweighted balance sheet assets, by 2012 that had increased to 67%. By contrast, the unweighted leverage ratios has hardly changed, from 3.8% in 2006 to 4.3% in 2012.

Almost everyone agrees that the Basel risk weightings need to be re-calibrated to increase banking sector capital. As part of that reform, the risk-weighting valuation framework should be reconfigured so that 100% becomes a mid-point rather than a ceiling. This would significantly improve transparency by reconnecting the total value of RWAs in the banking system with the unweighted value of those assets.

At the time of the financial crisis, there was a significant lack of clarity concerning key financial statement numbers underlying the calculation of capital and leverage ratios under Basel and IFRS-based comprehensive GAAP. Subsequently, the leverage ratio has been introduced as a way of “de risking” bank capital ratios. Further, most banks now routinely provide footnote reconciliation of RWAs to unweighted GAAP assets. Any currently off-balance sheet assets should be recognised in full in GAAP-based reporting so that there are no opportunities for “regulatory arbitrage” between GAAP-based reporting and regulatory accounting principles under Basel 2.Footnote ⁵

However, significant discretion is still available for banks to manipulate key elements of the capital ratio under relevant GAAP, such as the reclassification of certain types of bank assets that use inconsistent measurement bases (Klumpes & Welch, Reference Klumpes and Welch2010). Consequently, key elements of bank assets, the fair value of the loan portfolio is not recognised in their financial statements, but can be instead reported at amortised cost.Footnote ⁶ By contrast, insurers must report the fair value of their insurance liabilities, and a number of insurers even report voluntarily their embedded value.

An important point to consider in analysis is that the audit profession is not currently required to verify or check the validity usefulness or reliability of either disclosed capital and leverage ratios or Pillar III reports published by banks. This was subject to a discussion paper by the former Financial Services Authority that was never subsequently implemented. However, in recent years both the United Kingdom and other regulators have sought to require auditors to move away from the strict “pass or fail” report towards greater disclosure of key areas of uncertainty affecting their audits. Most recently, the US Public Company Accounting Oversight Board has just implemented this for all US-listed companies, although the effectiveness of that requirement remains unclear.Footnote ⁷

2.2. Risk Reporting Regulations for Insurers

Before the financial crisis, there was almost no requirement on insurers, either specifically or generally, to provide narrative on their insurance, business or emerging risks. Unlike the Basel Committee Pillar 3 reports, which have been fully implemented by banks since 2006, there is still no equivalent disclosure provided by insurers, either to their policyholders or shareholders. With the exception of AIG, most of the pressures for increased disclosure affected the banking industry. In the United Kingdom, the Walker review of corporate governance in UK banks proposed the preparation of risk reporting by banks to help investors better understand the governance of risk taking and risk appetite and performance of their investee company (Walker, Reference Walker2009, 104).

The integration of risk reporting into Solvency II is still (as of date of publication) relatively unspecified and still lacks clarity in key areas (KPMG, 2012; Morgan, Reference Morgan2012). This is in contrast to the fully implemented Pillar III disclosure requirements of Basel capital adequacy requirements as discussed above.

Moreover, there is almost no authoritative guidance on risk reporting practices by insurance. Neither the Actuarial Standards Board, the UK accounting standards board or the International Financial Standards Board provide any detailed promulgation concerning specific or even general guidance for risk reporting for insurance enterprises. This is despite both issuing draft amendments to existing GAAP in the last few months (ASB, 2013; International Accounting Standards Board (IASB), 2013). For instance, the IASB (2013, para 86) states blandly that “an enterprise shall disclose information about the nature and extent of risks that arise from insurance contracts”. It further states that an entity shall disclose the exposures to risks and how they arise, and its objectives, policies and processes for managing risks that arise from insurance contracts (IASB, 2013, para 87 (a) and (b)). However, it does not actually state comprehensively what those risk categories are or provide specific guidance on reporting within each of those broad categories.

As similar lack of clarity pervades the ASB’s FRED 49, which merely states (2013, para 4.6) that an insurer “shall disclose information that enables users of its financial statements to evaluate the nature and extent of risks arising from insurance contracts”. It then demands that insurers disclose information about insurance, credit, liquidity and market risks without specifying the nature, type of scope of such disclosures (ASB, 2013, para 4.7).

The only specific general purpose reporting guidance available on risk reporting for insurance enterprises was provided by the German Accounting Standards Board (Deutschen Standardisierungsrat or DSR), standard DSR 5-20. The standard, effective from 2004 for all German insurers, provides requirements concerning the provision of information about general risks as well as specific risks and the type of risks and overall risk provision of the consolidated group. It requires that risks are quantified only where this can be done “with reliable and recognised methods” and “without undue economic expense”, but does not specify a method of quantification. It also includes model risks and minimum disclosures relating to underwriting, default receivables and investment risk. As discussed below, the DSR 5-20 is also the only standard that has been subject to thorough empirical study.

2.3. Review of Prior Research

More recently, most accounting professional bodies and accountancy companies have produced or sponsored definitive studies on the topic, including the Institute of Chartered Accountants in England and Wales (ICAEW) (2011), Abraham et al. (Reference Abraham, Marston and Darby2012), PriceWaterhouseCoopers (2011), Chartered Institute of Management Accountants (CIMA) (2012) and Franken et al. (Reference Franken, Szwejiczewski and Kutsch2013) in mainly non-financial settings. Most recently, the Basel Committee on Banking Supervision (BIS) (2013) produced a definitive guidance on principles for more effective risk reporting by banks.

After an extensive review of the limited evidence available on risk reporting practices in general, the ICAEW (2011, 14) concludes that “there is no basis to arrive at any firm conclusions”. Abraham et al. (Reference Abraham, Marston and Darby2012, 5) notes that “while the quantity of information has increased, questions have been raised over the quality of information disclosed”. CIMA (2012, 6) reports that the main outcome of what went wrong at RBS was that “too much emphasis was placed on the need to quantify risks” and its weakness as a financial institution was due primarily to undocumented “macros imbalances”. For example, the compartmentalisation of risk into silos resulted in portfolio risk aggregating across the silos developed unchecked.Footnote ⁸

By contrast, there is little definitive research at the academic or practitioner level on risk reporting by insurance companies. With the exception of long-standing German GAAP on this topic (discussed briefly in more detail below) there is also no definitive guidance on risk reporting by insurance enterprises. This seems surprising given the importance of risk monitoring as a key component of the overall risk management process that is now subject to scrutiny by both regulators and credit rating agencies.

Although multinational insurance companies are subject to various disclosure requirements, and there is a significant and growing body of literature concerning risk reporting generally, very little research has investigated risk disclosures and their link to overall corporate and risk strategy adopted by large insurance enterprises. In a recent study, Horing & Grundl (Reference Horing and Grundl2011) examine the extent of risk disclosure practices in annual reports of a sample of EU insurers during the period 2005–2009. They construct and implement a self-constructed disclosure index that is mainly based on the Chief Risk Officer (CRO) forum proposal for public risk disclosure (IAIS, 2002). This was then applied to examine the extent, trends and determinants of risk disclosure practices in a sample of 31 European insurance firms.

Horing & Grundl (Reference Horing and Grundl2011) predict and find that the extent of risk disclosure is positively related to size, book-to-market ratio, ownership dispersion, cultural differences across Europe and listing status. They also find that the introduction of IFRS 7, Basel II and the financial crisis potentially triggered this improvement in risk disclosure. Aggregated risk overview and operational risk reporting received the most attention with the highest growth rates. Consistent with the results of prior research on risk reporting practices in many other contexts, they find that the extent of risk reporting is positively associated with firm size and negatively associated with profitability.

However, there are a number of reasons why the results and analysis of Horing & Grundl (Reference Horing and Grundl2011) may be limited in their application.

• ∙ Since they relied primarily on DSR 5-20, which requires categorical disclosure of the following types of risk: market risk, credit risk, liquidity risk, underwriting risk and operational risk. Unfortunately, these risks are oriented to financial risk management procedures, such as VaR, which may not necessarily resolve risk management problems associated with financial crises or broader issues.Footnote ⁹

• ∙ They studied a relatively large cross-sectional sample of insurers across the European industry, so they were unable to discern results on an individual firm basis. This is important since their results confirmed those of prior risk reporting studies that size is a significant influence on risk reporting quality.

• ∙ Since they adopted the CRO forum and DSR 5-20 method of risk classification framework categorisation, their compartmentalisation of risks ignored the analysis of broader portfolio-level risks global insurers face that might cross these silos, and they ignored other “soft risks” such as strategic and frictional risk. We discuss this issue in the next section. Moreover, their analysis of disclosure index items within each major category of risk was confined to a quantification of the risk exposure only (e.g. definitions, description of risk mitigation activities, value at risk at specified confidence intervals and period, description of stress tests and/or sensitivity analysis and description of major risk concentrations). Consequently, they did not separate adequacy of disclosure of various stages after risk exposure, such as an analysis of risk measurement or an assessment of management effectiveness.

• ∙ Finally, they only studied disclosures up to 2007. In the light of the financial crisis and the gradual implementation of Solvency II, evaluating trends in disclosure quality over time between the pre- and post-crisis period would seem to be of interest and relevance in a more up-to-date analysis.

3.1. Corporate Governance

Perspectives on corporate governance can be characterised in two ways. The UK and US legal systems generally adopt a “shareholder perspective” on governance. Thus, it is not surprising that the ICAEW’s paper on this topic is constrained to “business risks” and is directed primarily to shareholders only. By contrast, Continental European insurance companies operated in a “stakeholder perspective” on corporate governance. This may involve the operation of multiple boards of management and processes for consultation with stakeholders, including policyholders and employees that are not usually formalised in Anglo-American countries.

These differences are subtle and yet may have a significant bearing on the nature of risk reporting within insurance companies operating in different countries. For example, under the US approach, there is much less emphasis on stakeholder reporting, while the regulatory reporting tends to be separately supervised by state of incorporation and through the National Association of Insurance Commissioners. There is a plethora of US GAAP on this topic by business line with no clear delineation for risk reporting.

By contrast, in the European context, the disclosure environment is more complicated since there is usually a single national regulatory authority and the reporting to shareholders is subject to disclosure requirements by the European Commission (PAIEC). However, these regimes can vary significantly in terms of both the requirements of the national regulator and the interaction and enforcement of EU directives and principles. There is also continued uncertainty over the nature of the implementation of the Solvency II, including the effective date and crucial details about the Pillar III requirements.

The United Kingdom is even more complex in so far as reporting can be subject to UK GAAP (FRS 27, soon to be updated to FRS 103), SORPs (e.g. the ABI SORP on embedded value) and IFRS (with the soon to be implemented revised IAS 4). Further, besides the general corporate governance codes that have influenced the form and content of risk reporting (particularly related to management remuneration), the role of the UK Actuarial Profession itself has been subject to significant scrutiny with the Penrose Commissions’ recommendations for reform and the creation and promulgation of rules by the UK Actuarial Standards Board. Finally, the regulatory environment is currently in a state of transition with the evolution of the former Financial Services Authority regime to the newly created Financial Conduct Authority and the Bank of England. Consequently, it remains unclear what, if any, these bodies will seek to amend the regulatory oversight of UK insurance industry reporting.Footnote ¹⁰

An alternative perspective on corporate governance is that of complexity theory, which depicts shareholders, employees, stakeholders and gatekeepers as part of the complex social ecosystem surrounding risk reporting by insurance companies (Goergen et al., Reference Goergen, Mallin and Swe2011). A major insight of this theory is that comprehending the full scope of risk reporting requires a deeper understanding of the various formal and informal processes by which shareholders, regulators, management and other external stakeholders that affect and are affected by the insurance enterprise, can and/or should interact.Footnote ¹¹

This research topic seeks to identify areas where risk functions could/should advocate structures or methods that promote organisational resilience. Evaluating the cost-benefit of corporate investment in resilience requires a slightly different calculation, which involves considering the possibility that changes in the operating environment cause the organisation to unintentionally find itself in a new paradigm which is suboptimal. An important insight of this approach is a greater emphasis on the analysis of risk tolerance, resilience and culture, in contrast to the decision hierarchical approach of standard corporate governance theory.

In this paper, we will adopt the complexity theory approach because unlike the more traditional and narrow “shareholder” and “stakeholder” perspectives there is likely to be better insight into recent and current trends in risk reporting and the incentives facing the players involved in or using this process.

Table 1 shows how subtle differences in reporting regime affect the nature, scope and scale of risk reporting. It is interesting to note how differences affect both the nature and scope of reporting.

Table 1 Alternative Bases For Risk Reporting

^≅ See, for example, Culp (Reference Culp2000) for a definition and delineation among these alternative perspectives.

Table 1 shows that different governance bases for reporting risk has a significant impact on the major focus and frame of reference. From a shareholders’ perspective, the major reference is the disclosure requirements of relevant accounting standards. In this case, only IAS 32, 37, and IFRS 7 and 9 provide specific guidance on risk reporting in general purpose financial reports sent to investors, but only in connection with the reporting of financial instruments. The annual report (particularly the quantitative and narrative footnotes concerning risk reporting) will be most relevant – these are mainly concerning market (diversifiable) risk sources, as well as pension and other sources of retained risk. The valuation basis for shareholder reporting is a combination of historical cost or fair value for the balance sheet assets and liabilities. The risk management process is implicitly assumed to focus on accounting measures of a firm’s financial condition such as earnings. Therefore, risks are primarily concerning the extent to which companies actively hedge factors affecting the volatility of earnings, such as commodities, interest rates or currencies. The appointed auditor is primarily responsible for vetting compliance with relevant general purpose reporting requirements, and may indeed seek to constrain the scope for voluntary reporting beyond this.

By contrast, the major focus for regulatory-focused risk reporting is downside risk based on parameters set by the regulator (e.g. one in a 100 year thresholds). Risk reporting is therefore constrained by regulatory fiat and pre-specified format, and is likely to focus more on prudence rather than relevance.

An important distinction between regulatory and shareholder reporting of risk is that presumably the former requires more conservative, verifiable and neutral valuation measurement bases, whereas the latter is tending towards fair value measurement bases. This is indeed an important distinction between Core Tier 1 capital under Basel versus IFRS-defined shareholder capital. Since the focus of regulators is more balance sheet than performance oriented, it would seem logical that most risk reporting would relate to assets at risk such as traditional VaR measures. However, post-crisis the credibility of such measures has declined, particularly beyond the traditional portfolios. Of course, unlike general purpose financial reports, risk reporting information would not be subject to audit, although audit companies do specialise in helping insurance companies prepare such reports to regulators.

From an internal management perspective, the scope of governance reporting is constrained by the idiosyncratic and unique organisation of the C-Suite, job titles and professional qualification of the CRO/CFO user of internally generated risk reports. In recent years there has been a significant increase in demand for risk monitoring and it has been combined with broader expertise in enterprise risk management, where actuaries are increasingly working.

One would also expect that risk reporting would be tailored to the business segment or internal organisation of risk functions, and to be more disaggregated in nature than for external reporting. It might also be expected to be future oriented and the valuation bases might therefore be more likely based on future expected cash flow. Since the form and content of such reports may depend on the strategy of the firm, it may also be less standardised in nature than for external or regulatory purposes.

3.2. Disclosure Effectiveness Framework

Although the regulation of financial ratios, financial statements and detailed financial statements is pervasive, very little is known regarding how individual investors assimilate such disclosures into their purchase decisions. Financial theory often assumes that the primary decision makers of interest are professional investors or decision makers, who typically have some experience in reviewing financial documents, adopt relatively focused and well-defined decision-making strategies, and use a limited number of information cues. By contrast, individual strategic managers of large global insurance companies often make decisions in unstructured environments, and must cope with vast amount of financial condition and non-financial risk disclosures that are provided directly by multiple sources. These limitations of human decision heuristics have given rise to a growing popularity of behavioural theories of decision-making behaviour that model risk taking in terms of “loss aversion” rather than “risk aversion” (e.g. Kahneman & Tversky, Reference Kahneman and Tversky1979).Footnote ¹²

The increasing complexity of mandated risk disclosures raises questions over the disclosure effectiveness of risk reporting, defined as the trade-off between the value relevance of the information provided to the investor and its costs of provision in terms of either;

1. (i) direct and indirect costs involved in preparing, printing and distributing financial statements containing regulated financial disclosures; or

2. (ii) information overload to users induced by inclusion of regulated financial or non-financial disclosures (FASB, 1995). The ICAEW (2005) proposes that public policy information requirements should take account of individuals’ limited information processing abilities.

This study investigates the disclosure effectiveness of regulated financial risk disclosures conveyed by insurance enterprises both in their annual reports issued to stakeholders and to idiosyncratic risk communications and/or disclosures disseminated to individual internal decision makers that might use internally generated reporting processes. We undertake a survey of practices within organisational decision-making processes to supplement the content analysis of externally generated risk reports following the approach of Horing & Grundl (Reference Horing and Grundl2011). Disclosure effectiveness is defined in terms of both information load (i.e. financial solvency disclosures in the form of financial statements, abbreviated financial reports or financial ratios) and news favourableness.Footnote ¹³

3.3. Accountability Framework

A third dimension of our study concerns the content of risk reporting, i.e. should it be primarily concerning risk exposures or the impact of risk events on reporting pure risk exposure.

In a recent paper, Kelliher et al. (Reference Kelliher, Wilmot, Vij and Klumpes2012) developed a proposed common system of risk characteristics for the Actuarial Profession.Footnote ¹⁴ Appendix 2 summarises the main insights garnered by that paper in terms of various risk categories and their connection with components of insurance company value.

The intention of the exercise was to identify a common set of themes and definitions that would allow Actuarial Professionals to deal with regulators and to foster better understanding and a common language among those charged with developing enterprise risk management systems.

While the developments are welcomed, a number of issues arose from the paper:

• ∙ Whether the relevant frame of reference in adopting any proposed system of risk classification (see section 3.1 above) should be based on actuarial or risk management practice or regulatory frameworks.

• ∙ The definition of and nature of “strategic risk” and its relation to other types of risk.

• ∙ The extent to which the proposed system is applicable to different types of entity.

• ∙ What particular aspects of “risk” which accountants would deem to be of greater importance than actuaries, and hence are “missing elements” of the proposed framework.

We now briefly discuss some issues related to each of these major concerns.

The Kelliher et al. (Reference Kelliher, Wilmot, Vij and Klumpes2012) framework is based mainly by reference to regulatory frameworks for categorising risk, such as Basel II (III) and Solvency II. Both of these frameworks are in turn based on the “event-based” categorisation system originally developed by the Global Derivatives Study Group (1993), often called the “group of thirty report”. This classified three major types of risk: market risk, credit risk and operational risk. Below these one might add additional elements, such as liquidity risk and insurance risk. There is considerable variation in practice and regulation, such as whether idiosyncratic risk elements such as “strategy risk” should be separately included, and whether “frictional risks” such as accounting or regulatory costs need to also be included.

Most actuaries would regard ERM in connection with relevant guidance by the PRA, IAA or, in the near future, by the proposed Solvency II along those lines. By contrast, most accountants’ understanding of the concept is from a much narrower frame of reference related to general purpose financial reporting. Indeed, ERM for many accountants is understood in connection with “compliance-oriented” internal control frameworks originated out of US legislation. Specifically, in the US context, the Sarbanes Oxley Act mandates relates to the provision of internal control framework that needs to be used to establishing an appropriate control structure for compliance. The act specifies that such a framework is proven and “publicly vetted”, and further recommends the use of COSO framework for general purpose financial reporting in compliance with US GAAP. This suggests that ERM is broader than just the market-based categories identified by the earlier framework.

While financial organisations based in other jurisdictions can choose to use any other framework that fits the criterion described above (including the COCO framework from Canada or Turnbull paper from United Kingdom), the current industry trends in financial reporting suggest that COSO framework as being the one that is widely adopted for companies adopting IFRS.

The COSO framework and the ERM concept were originally embedded in financial reporting, with a focus primarily on accountability to owners or shareholders and the corporate governance issues this raises. This implies a different focus from regulators, who are primarily interested in the total or “enterprise value” focus of the Kelliher et al. (Reference Kelliher, Wilmot, Vij and Klumpes2012) framework. Solvency II has given additional impetus to improvements in the regulatory review of returns by insurance companies. However, the implications for accountants and auditors are not yet that clear. In particular, there are corporate governance and aggregation issues related to the fact that the “reporting entity” may be a much higher level of analysis than a regulated entity subject to PRA regulation. It is important to recall that the role of ERM and COSO as “compliance-oriented” internal control frameworks originated out of US legislation. The report by Sir David Walker suggests that “board-level engagement in the high-level risk process should be materially increased with particular attention to the monitoring of risk and discussion leading to decisions on the entity’s risk appetite and tolerance” (Walker, Reference Walker2009).

This implies that board and corporate governance is primarily defined by the COSO ERM framework, whereas, many Actuarial Professionals’ attention is rather confined to relevant pronouncements by the profession, the FSA and the IAA.Footnote ¹⁵

3.4. Risk Classification Framework

In this study we consider two alternative methods of classifying risk as a basis for analysis of risk reporting; the Basel II framework as adopted by both the CRO forum and the DSR 5-20 and used as a basis for disclosure content analysis by Horing & Grundl (Reference Horing and Grundl2011), and the Kelliher et al. (Reference Kelliher, Wilmot, Vij and Klumpes2012) risk classification framework developed for actuarial use. The key differences between these frameworks is summarised in Table 2.

Table 2 Differences Between Alternative Risk Classification Frameworks

Sweeting (Reference Sweeting2011) notes there are many other types of risk classification, including RAMP, IRM/AIRMIC and COSO. However, it should be noted that the COSO (2012) revised framework does not explicitly define or categorise major types of risk, and in any case is limited to financial risk management systems as regulated under SOX. By contrast, the Kelliher et al. (Reference Kelliher, Wilmot, Vij and Klumpes2012) model is more comprehensive because it covers different categories of risk particular to the insurance industry, as well as strategy risk.

There are also a number of proprietary risk frameworks developed by credit rating agencies and while undoubtedly there is controversy of the unit of analysis and the frame of reference, a more practical issue concerns the “auditability” of any proposed system of classification of risks. The Kelliher et al. (Reference Kelliher, Wilmot, Vij and Klumpes2012) model appears primarily geared towards the risk-assessment work the FSA carries out in many financial companies. However, although the requirements are now being implemented, there is little transparency relating to the requirements. Specifically, there is no requirement for auditors to comment on the quality of or reporting on supervisory or regulatory compliance. A similar issue arises for banks with their Basel II to IFRS capital adequacy requirements and reported accounting ratios. Finally, it is surprising that there are still no auditing requirements for the monitoring of Basel II or Solvency II as they are outside the financial statements. In 2009, the FSA proposed that this issue be addressed; however, it has not been subsequently endorsed by the PRS.Footnote ¹⁶

There have been recent controversies surrounding accounting manipulation and creative accounting (e.g. AIG, Enron). These have arisen from the scope for banking and insurance entities to place undesirable exposures off-balance sheet. Much of this controversy surrounds the role of functional versus institutional or legal interpretation of accounts. This is currently defined in the Kelliher et al. (Reference Kelliher, Wilmot, Vij and Klumpes2012) framework as an issue of “frictional risk” but one wonders whether off-balance sheet exposures are really included in that definition.

An important aspect of the Kelliher et al. (Reference Kelliher, Wilmot, Vij and Klumpes2012) is the definition of “strategic risk” in terms of the “inherent goodwill”, which is defined by reference to embedded value. Such numbers are effectively off-balance sheet because they are not currently “recognised” in balance sheets published by insurance companies to satisfy either regulatory reporting or conservative financial reporting; rather they are disclosed by way of footnote or supplementary financial statements. Recent evidence suggests that embedded values are “value relevant” for capital market participants in both Taiwan and the United Kingdom. The evidence appears to condone moves towards such reporting in the revised IFRS 4 (Wu & Hsu, Reference Wu and Hsu2011).

It is possible that an accountant would define “strategy risk” not in terms of the difference between “embedded value” and “total market value” but in terms of the more conservatively defined on (or off) balance sheet equity or book value to market value (market to book). On the other hand, an economist might define it in terms of market to replacement cost of assets (or Tobin’s Q). It is hard to know which is more applicable in the case of insurance companies, except that we know that most of the assets and liabilities are “fair value” and hence the strategic risk would presumably “disappear” since market values are already supposedly recorded on the balance sheet.

In conclusion, while efforts such as those of Kelliher et al. (Reference Kelliher, Wilmot, Vij and Klumpes2012) to classify risks are to be applauded, the interrelationship between strategy risk, ERM practices, and capital management and risk reporting remain obscure. For instance, the footnotes concerning risk management practices incorporate reference to off-balance sheet exposures and the status of ERM implementation and provide details of the outcome of regular supervisory reviews of those practices, thereby enhancing the reliability and transparency of such practices to investors and other users? Such developments can help investors to better appreciate the link between regulatory-based and financial reporting-oriented views of ERM. In particular, one wonders about the role of “model risk” and whether actuaries are prepared to admit that sometimes the “models used” can lead to wrong or erroneous outcomes (e.g. compare the esoteric arguments over the application of alternative fair valuation approaches of either “mark to model” versus “market”-based valuations of bank investments in Greece (Financial Times, 20 August 2011).

Finally, the objective of financial reporting is to prepare and/or audit accounts intended primarily to provide information relevant to capital providers. Analogous to this argument is that the “event-based” classification system appears specifically geared to identifying and “managing” specific sources of asset or liability risk, rather than equity risk. Yet, there are a number of material sources of “equity risk” that raise issues for shareholders. More subtly, there are a number of “unhedged” exposures or “valuation errors” which may themselves be manifestations of actuarial and risk management processes, and are often hidden in form of “reserve” accounts related to “other comprehensive income”. Examples include pension valuation errors, available for sale securities and cash flow hedges and foreign currency translation changes.

These raise issues concerning the appropriate scope and nature of risk reporting practices from various shareholder, regulatory and managerial perspectives. We consider this issue empirically in the next section.

4.1. Sample Selection Procedure

The sample is based on the list constituting the Global 25 insurers as listed by AM Best Services for the period 2006–2012, both by sales and assets under management. This results in a final sample of 13 companies as listed in Table 3.

Table 3 Sample of Global Insurers

Of these companies, eightare based in Europe and the remainder either in the United States (two) or Asia-Pacific (three). The business lines vary from life to general, bancassurance, and reinsurance and composite. The analysis reported below was conducted both for individual companies and by region. Since the cultural, regulatory and economic environments in which these companies operated were so diverse, we avoided generalising the results for the entire sample.

4.2. Construction of Disclosure Indices

Three indices used to evaluate the quality of risk disclosures by the sample of global insurance companies that represent the various key accountability relationships as outlined in section 2.2, are defined below, including the major categories of disclosure:

1. 1. Shareholder disclosure index: covers usefulness of general purpose reporting to capital providers; two constructions covering the risk classes – market, credit, insurance and demographic, liquidity, operational, strategic, frictional and aggregation.

2. 2. Regulatory disclosure index: covers robustness and prudence and objectives per Pillar III type disclosures – principles, recognition, measurement, strategic, functional.

3. 3. CRO reporting index: covers resilience of companies’ internal processes to sustain competitive advantage: principles, recognition, measurement, strategic, functional.

The shareholder disclosure index was constructed in the following four steps:

1. i. Index construction. This was based initially on the Horing & Grundl (Reference Horing and Grundl2011) approach as outlined in section 3.3 above, with a maximum of 45 “points” possible for each of the six major categories outlined in Table 2. It should be noted that the possible number of points available under each category differed, ranging from 15 points for the “risk overview” and 14 points for the “insurance risk” categories, to only 4 points for each liquidity and operational risk categories.

2. ii. Scope of analysis. Annual reports that are available on the website of each of the sample companies identified in Table 3 were then analysed for each year 2006–2012, consecutively. A keyword search was then conducted to identify each of the items, with a score of 1 if fully disclosed (based on a subjective judgement about the frequency of keyword occurrence, in this case judged to be at least six separate disclosures), 0.5 if partly disclosed (between one and five disclosure instances) and 0 otherwise. This process was repeated for each company annual report and for each of the six categories identified in Table 2. This resulted in a total score out of 45 points, which was recalculated to a score out of 100 points to ensure consistency with the disclosure indices outlined below.

3. iii. Recalibration (Kelliher et al., Reference Kelliher, Wilmot, Vij and Klumpes2012). The same procedure for index construction was applied, but using the Kelliher et al. (Reference Kelliher, Wilmot, Vij and Klumpes2012) system of risk classification instead. The generic category “risk overview” was replaced with a combination of strategic, frictional and aggregation risk categories that added to a maximum of 15 points. Further, the identified sub-components of each risk category was changed from a description of the standard procedures used to quantify the risk as performed by Horing & Grundl (Reference Horing and Grundl2011) to functional sub-categories that are unique to each category risk as identified by Kelliher et al. (Reference Kelliher, Wilmot, Vij and Klumpes2012). For instance, in the case of market risk, the standardised (Horing & Grundl, Reference Horing and Grundl2011) sub-categorisation of descriptions of definitions, limits, risk mitigation, VaR, stress tests and stress tests were replaced with identified sub-categories of market risk such as equity, property, interest rate, bond, commodity and foreign exchange risk.

4. iv. Recalibration – reweighting to non-financial risks. Finally, to reflect our concern that the (Horing & Grundl, Reference Horing and Grundl2011) risk categories over weighted financial versus non-financial risks, the above procedure used to construct the disclosure index under Kelliher et al. (Reference Kelliher, Wilmot, Vij and Klumpes2012) was reweighted so that sub-totals for each category of risk were equalised, except for insurance risk. This meant, for example, that market and credit risk were reduced from 6 to 5 points, insurance risk reduced from 14 to 10 points and all other risk categories increased to 5 points each. This resulted in a “reweighted” total disclosure score for each company.

Steps 1 to 3 above were repeated for the construction of separate disclosure indices reflecting regulatory and “managing the business” perspectives. For the regulatory reporting perspective, the five major functional (Kelliher et al., Reference Kelliher, Wilmot, Vij and Klumpes2012) categories identified above were again used but their sub-categorisation was slightly altered reflecting the interests of a regulator, rather than for an external user. These were weighted equally with 6 points each, adding to a sub-total of 30 points. In addition, four new categories of risk-related disclosure were identified that were specific to the different stakeholders. These comprised general disclosure principles (12 points), specified areas of disclosure (26 points) and measurement issue (22 points) categories were identified, as well as strategic issue category (10 points) concerning reference to Solvency II and ERM adoption. These were again totalled to a maximum possible score of 100. The weighting of each of the four new categories relative to the standard functional risk category as used in the shareholder disclosure index based on the relative perceived importance of such disclosures to other users.

4.3. Descriptive Statistics: Overall Average Disclosure Scores

Table 4 summarises the average disclosure scores (out of a possible 100 maximum), for each of the sample companies and by region for the study period 2006–2012, for the shareholder, regulatory and managing the business (internal) disclosure indices, respectively. Standard deviations are shown in brackets below the average scores.

Table 4 Average Disclosure Indices by Company

Standard deviation in brackets.

The results reported in Table 4 support our prediction that on average European companies have significantly higher overall levels of disclosure than either US or Asia-Pacific competitors. This result is consistent across all disclosure indices, except for the regulatory disclosure index, where Asia-Pacific companies are comparable to European companies. By contrast, US companies have generally relatively poor levels of disclosure, except from an internal business reporting perspective.

In general, the disclosure quality is highest in all three regions under the regulatory perspective, whereas it is the lowest for the Horing & Grundl (Reference Horing and Grundl2011) based shareholder perspective for Asian and US companies, and for the Kelliher et al. (Reference Kelliher, Wilmot, Vij and Klumpes2012) based shareholder perspective for European companies. This should not be surprising given the significant level of regulatory oversight of insurance companies worldwide.

On a company-specific basis, Allianz (Horing & Grundl, Reference Horing and Grundl2011) and Axa (Kelliher et al., Reference Kelliher, Wilmot, Vij and Klumpes2012) and reweighted provide the highest average level of disclosure quality, while AIG provides the highest quality disclosure under the regulatory perspective. Zurich has the highest quality average disclosure under the internal management perspective.

By contrast, Di-ichi has consistently the lowest quality disclosure of all companies, for all perspectives. These results are again consistent with our expectations, since the larger and most politically visible companies in the European and US regions tend to face greatest incentives to disclosure more risk information, particularly given the relatively high levels of underlying risk exposure they face. By contrast, the Japanese companies are relatively opaque in terms of risk disclosure quality, a result that is also consistent with prior international-based studies of disclosure quality generally.

4.4. Descriptive Statistics: Detailed and Time Series Analysis

Figures 1–5 report the overall breakdown of the major sub-categories of risk disclosure to shareholders, i.e. market, credit, liquidity, operational and strategy risk.

Figure 1 Market risk disclosure

Figure 2 Credit risk disclosure

Figure 3 Liquidity risk disclosure

Figure 4 Operational risk disclosure

Figure 5 Strategy risk disclosure

The breakdown outline of major trends can be summarised as follows:

• ∙ Market risk (Figure 1): average European and Asia-Pacific regulatory disclosures score similar and scoring less than half of available scores, average European, US and Asia-Pacific companies score similar for CEO disclosure scoring less than half of available scores, while average Asia-Pacific and US companies score higher than European companies on shareholder, and scored more than half of available scores.

• ∙ Credit risk (Figure 2): European companies and Asia-Pacific companies broadly similar on regulatory disclosure and relatively high scores. European, US and Asia-Pacific companies broadly similar on CEO disclosure and relatively high scores. Asia-Pacific companies scored highest on shareholder disclosure than either US or European companies. However, there is no clear trend towards improvement year-on-year post-crisis.

• ∙ Liquidity risk (Figure 3): average European companies and Asia-Pacific companies score broadly similar. Average European, US and Asia-Pacific companies score broadly similar. Average Asia-Pacific companies score highest than either US or European companies on shareholder disclosure. However, again there is no clear trend towards improvement year-on-year post-crisis.

• ∙ Operational risk (Figure 4): average European companies score higher than Asia-Pacific companies on regulatory disclosure. Average European companies, US companies and Asia-Pacific companies score broadly similar on CEO disclosure, scoring less than half of available score. US companies scored highest than either Asia-Pacific or European companies on shareholder disclosure, scoring more than half available scores.

• ∙ Strategy risk (Figure 5): average European companies score higher than Asia-Pacific companies on regulatory disclosure (one-third of available scores) difference between the regions. Average European and US companies also score higher than Asia-Pacific companies. Average US companies score higher than either European or Asia-Pacific companies on shareholder disclosure. Out of 11 points, US companies scored 4 points more than Asia-Pacific companies.

The overall results and trends are consistent with our expectations. European firms have relatively higher quality disclosure in the areas of market, operational and strategy risk from a regulatory perspective, whereas US companies on average produce higher quality reporting of market, liquidity and credit risk from a business-internal perspective. The shareholder results by risk category are more equivocal and depend on whether a Horing & Grundl (Reference Horing and Grundl2011), Kelliher et al. (Reference Kelliher, Wilmot, Vij and Klumpes2012) or reweighted index basis is used.

The trends over time are also very significant for most firms with a significant increase in disclosure quality after the financial crisis took effect in 2007–2008. There is a continuing increase in the quality of all types of disclosure in the latest period, 2011–2012, suggesting that the overall complexity and sophistication of communication of various risks has improved significantly. However, whether this improvement is because of pure managerial effort or regulatory environment changes is an unresolved question that requires further analysis beyond the scope of this paper.

5.1. Design of Survey Instrument

Appendix 3 summarises the survey instrument that was administered. The survey focused on the following five qualitative attributes of risk reporting quality that we have previously outlined in section 3; governance and fit for purpose, risk to overall risk appetite, usefulness and capabilities of risk reporting. The survey was originally designed to be self-assessed and targeted to the main internal user of internal risk reporting within global insurance companies. While we did not designate an exact title of this person, it was assumed to be the CRO or similarly titled senior executive.

Each of the four sections involved up to 12 closed form questionnaires that facilitated an unambiguous response, or at least provided for some uncertainty into the scope of answers expected.

The main purpose and nature of each of these five sections are outlined briefly below.

1. i. Governance and fit for purpose: this section was intended to provide some insight into the overall organisational framework in which risk reporting processes are generated and produced. There is a scope for ambiguity and duplicity of purpose and the deemed significance of the reporting for due diligence and performance management.

2. ii. Relevance and usefulness: this section focused attention on whether risk reporting processes were deemed to be used primarily for planning and control or for operational and strategic decision making. There is some scope for participants to comment on the overall significance of the process.

3. iii. Risk appétite: the main purpose of this section was to identify and comprehend the extent of integration between risk reporting and other key managerial decision-making processes. Relevant considerations include both the granularity of reporting and identifying the appropriate risk owner within the organisation to which the reports are sent.

4. iv. Reporting capabilities: this section focuses mostly on the scale, scope and complexity of risk reporting and its location within the overall system of managerial provision of information inside the organisation. Issues include confidence in and complementarity of risk reporting processes with other aspects of managerial information systems.

5.2. Survey Administration

The survey was administered initially via the CRO forum of the Actuarial Profession and through identification and call for participants both at the 2013 Risk and Investment Conference in Brighton and via the profession’s website. External media sources (e.g. ai-CIO) also provided some publicity for the survey to intended participants.

The survey was administered via a survey monkey run from the profession’s own administrative sources. The results were anonymised so that participant’s names, company positions and companies could not be reported or monitored. While this step ensured anonymity of response it also severely constrained the ability to interpret the results in conjunction with the disclosure content analysis results reported in section 4 above.

5.3. Survey Results

Overall, there were ten responses to the survey, although it could not be verified that the respondents were uniquely and solely connected with the sample of global insurance companies, as reported in Table 1. However, as it was made clear in the instructions and questions, the survey could only be realistically completed by the status, profile and seniority of management role that was intended by the survey. Consequently, we have sufficient confidence that notwithstanding these caveats, the results are reasonably reflective of the type and role of person responsible for receiving and acting upon internally generated risk reports within global insurance companies.

A brief outline analysis of the major results obtained in the survey by major section outlined in section 5.2 is summarised below:

1. i. Governance and fit for purpose: most respondents expressed confidence in the purpose and appropriateness of their risk reports. However, nearly half of respondents indicated that the terms of reference for various management committees did not include requirements for risk reporting. A majority of participants also expressed frustration that there were elements of reporting that were relatively routine in nature and not directly relevant to overall strategic decision making. In terms of content, most recipients also noted that escalation triggers and processes were not well defined. Only a slight majority of participants felt that all risk reports were directly useful to strategic decision making. In terms of production processes, actuarial functions in most organisations were mostly responsible for the production and analysis of risk reports, but not their design, delivery or review.

2. ii. Relevance and usefulness: the overall content and presentation was felt to be subject to information overload problems. There is an even mix of companies where internally generated risk reports are also used for external reporting. Most users felt that management committees’ understanding of risks diverged from the business functions’ view. The challenge and discussion of risk reports is mostly evidenced by minutes and formal documents. Only a slight majority of participants agreed that the audience was sufficiently informed of reliances and limitations underlying the reports.

3. iii. Risk appétite: a majority of participants felt that risk reporting processes were generally credible but that more granularity is required. Only a slight majority agreed with the assertion that risk owners understand the risk reporting and the business risk drivers thereby communicated therein. Most also were equivocal as to whether risk owners actually use risk reports in the business.

4. iv. Capabilities: most respondents agreed that different reporting systems are only partially in synergy with other reporting systems and consistent in terms of the information and data. Most also felt that internal risk reporting units did not have sufficient resource capability to be effective. A slight majority had a high level of confidence in the information and data load effectiveness of risk reporting processes. Most respondents also felt that risk reports were not particularly timely and that a minimum of a week was needed to gain access to consolidated financial information.

5.4. Discussion of Overall Survey Results

The overall survey results provide only equivocal evidence that internally generated risk reports are useful and relevant to key strategic decision makers within global and complex insurance organisations. Furthermore, while actuarial departments play a key role in these processes, their influence appears to be relatively limited in scope. Finally, the results support the conclusion that risk reporting capabilities and processes are only part of the full management information systems used and applied by key decision makers in executing their responsibilities. Accordingly, there seems to be further scope for improvement in the design, application and communication capabilities of internally generated risk reports.