Everyone knows the best way for insurers to manage their totalbusiness risk is simply to install a single enterprise riskmanagement system. These systems predict underwriting loss onindividual accounts and aggregated books of business, projectultimate values of open claims, assess the overall health andmortality rates of policyholders, manage the companys investmentportfolio, and evaluate the insurers own susceptibility to lossfrom such events as employee fraud, technology failure, andgeopolitical crisis.

Only one problem, though. If you were made a chief risk officertomorrow, and you wanted to buy an [enterprise] package, you simplycouldnt, says Vincent Oliva, vice president of research for Gartnerresearch group. That is, such a single system for enterprise riskmanagement doesnt exist.

Part of the reason for this is the nature of risks; for example,how do you find a common measurement for weather risks to a book ofproperty business and for credit risk of a carriers bond holdings,both of which have an impact on the bottom line? Also, the data andmeasurement of risk in companies is in silos, says Oliva, making itdifficult to bring all the data together.

Insurance also differs from other industries and even otherfinancial services firms in that part of the total business riskcarriers face comes from the uncertain nature of the promissoryproduct they write. Therefore, the greatest interest in riskmanagement technologies at insurers has been in those that focus ontheir raison dtre: underwriting and claims handling.

Particularly in the market were in, its critical to maintainvery precise underwriting practices, matching exposure to price andcoverage in a very exact way, says Rick Harold, director of ZurichNorth Americas workstation development.

Underwriting Management

The North American insurance division of Tokyo-based MitsuiSumitomo In-surance Group writes commercial lines insurancethroughout the United States. The division recently consolidatedits risk management strategy and front-end technology tools in itsproperty business. Up until a year ago, the underwriting departmentwas assessing weather and catastrophe risks using a variety ofdifferent manual charts and methods and varying degrees ofautomation.

In 2002, the company installed two products from AIR WorldwideCorpora-tion, a subsidiary of Insurance Services Office, Inc. Theseincluded AIRProfiler, a Web-based tool that uses addressinformation to analyze a locations hurricane, earthquake, flood,and severe thunderstorm risk, and Classic/2, a client-server-basedcatastrophe-modeling tool.

[AIRProfiler] is a quick look at a location. We use it to get anunderstanding of new risks were considering to see if they raiseany red flags, says David Donlick, marketing coordination managerin the insurers Warren, N.J., office. Classic/2 is used to evaluatesegments of business or the entire book for catastrophe risk.

Donlick reports the reason Mitsui Sumitomo chose AIR and, inparticular, Classic/2 was the solution didnt limit underwriters toassessing one category of risk at a time. All the products weconsidered did accumulation, but with AIR, if we want to focus onearthquake, windstorm, and hurricane exposures combined, we can dothat without having to re-enter address information. We can get aloss prediction on an individual account for the selected exposureseither combined or separated and do the same for the entirebook.

Zurich North Americas risk management strategy also starts atthe line level. We need to provide our underwriters all the toolsthey need to assess and price the risk, says Harold.

The workstation is a portal Zurich created in-house. It's partof the enterprise underwriting management strategy initiated withthe creation of the Underwriting Management and Technical ServicesUnit, which was set up in January 2001. The unit led to thecreation of the underwriting workstation strategy, which wasformally unveiled in November 2002 (for more on Zurich'sworkstation strategy and implementation, see Information Station,p. 30). The workstation provides staff in underwriting, claims, andrisk engineering access to a variety of in-house and third-partyunderwriting information sources, reporting tools, and hazardanalysis systems, such as catastrophe modeling software from RiskManagement Solutions (RMS).

Over the past year, Zurich also has worked to better understandits accumulation of risk by creating a database system it calls(coincidentally) Harold to store location data from all theinsurers various processing systems and to run analytics againstit. In the first iterations [of Harold], were looking at ourproperty business, says Tom Peach, senior vice president,underwriting and policy administration. Zurich will ex- tend thatsystem to include other exposures such as workers compensation.

Described by Peach as a tactical system designed to be deployedquickly, aggregated data from Harold will be available via theworkstation. Its functionality will be embedded in future upgradesof the RMS system at Zurich.

Changing Markets, New Threats

The cyclical nature of the marketplace always has had an impact oninsurers risk management strategy. However, a hard market combinedwith new loss exposures (see Proximate Cause), regulations, andindustry standards of measurement have carriers looking fortechnological solutions.

We are definitely taking a more scientific approach to writingour property risks, using geocoding to determine more accuratelythe hazard or exposure, Donlick says.

Gail McGiffin, associate partner in Accentures InsuranceSolution Group, sees four main technology trends in insurance riskmanagement. The first three include continued movement from paperto electronic processing to speed information gathering,implementation of rules-based decision-making, and utilization ofautomated workflow systems in many functional areas of thecompany.

The fourth trend is a sharply increased interest in geographicinformation systems. These have evolved to offer not juststandardization of address formats and address verification, butalso geocoding of individual risks to plot latitude and longitudeand analytics. These analytics include spatial analytics, whichhelp determine the relative proximity of locations to each other orto geophysical hazards, and radial analytics, which determine thehazards within a circular distance of a particular location.

Hurricane Andrew was the first wake-up call, where carriers sawthe need to have better accumulation of risk. But 9/11 has takenthat to a new level; it brought the need for greater assessment ofwhat is in the four-wall structure, the aggregation of not justproperty exposures and fixed assets, but the accumulation acrossproduct lines, such as workers compensation loss, death benefits,and medical costs. It is no longer sufficient to aggregate exposureat a ZIP code level, McGiffin says.

To go beyond ZIP code analysis, systems extract location datafrom policy files, cleanse the data to standardize and verifyaddresses, and then run that data through a geocoding engine. Aspatial analytics application can then determine if, for instance,not only are two tenants in the same building, but that twobuildings with completely different street addresses may sit backto back.

Importantly, this process takes insurance risk management beyondthe traditional post-loss activities of claims modeling to aproactive activity that is part of both strategic and tacticaldecision-making. Carriers are trying to leverage data earlier inthe process for improved decision-making and, most important, tothink across product lines, McGiffin says. This involves suchactivities as giving more departments and users access to analytictools, making the results of disparate Risk Management Solutionsavailable via portals, and using collaboration technologiesor evensimply good business practicesto bring staff together from variousfunctional areas.

Our underwriting, tech services, engineering, and claims allwork together to determine best practices for not only riskselection, but also other critical processes, says Zurichs Harold.Peach adds the goal of Zurichs IT department is to make its riskmanagement technology available to the widest array of users. Wewill browser-base an application that sits on risk-intelligentdata, and that can then be pushed to anywhere from underwriters to[external] MGAs [managing general agents].

Making Better Connections

Just as carriers have taken the concept of risk management from theindividual account to the aggregated line of business and then tothe departmental level, there is a strong push toward making riskmanagement connections across departments. Consider a scenariowhereby underwriting assesses its accumulation of risk by usinggeocoding to determine proximate locations. This same assessmentcan be used in the event of a claim.

An adjuster getting a first notice of loss or learning of anevent could check the location datastore and be armed withinformation about the existence of other potential claimants, saysMcGiffin. Not only can that consolidate the adjusters work, but italso can help a carrier be proactive in its claims management. Acompany could also deploy its catastrophe unit more effectivelyrather than guessing based on the general area, McGiffin adds. Frominterdepartmental deployment, its a natural leap for insurers totarget the evolution to enterprisewide risk management.

But waitisnt there an absence of enterprisewidetechnology?
Yes, inasmuch as no system exists to extract automatically datafrom every disparate system an insurer has and to perform thediffering calculations of risk that each functional area considers.However, there are methods and tools that can help insurers createan enterprise risk management process.

What insurers have done in the absence of holistic modelingcapabilities is to try to get at [enterprise] issues throughbusiness organization and procedures, says McGiffin. Theyrebreaking down, if you will, the functional silos of business andhaving cross-functional teams of those responsible for singularevent analysis at least manually assess exposures to those multipleevents.

The creation of a dedicated risk management division also is anew development for insurers, which traditionally have relegatedrisk management to their actuarial departments. Historically, riskmanagers were little more than insurance buyers, even in insurancecompanies, says Oliva. Insurers are just starting to latch on tothe concept of enterprise risk management beginning withdesignating a top-level officer as the chief risk officer.

This top-level effort is necessary, Oliva maintains, forinsurers to bring together insurance risk management with thegrowing emphasis on operational risk management. Operational riskmanagement looks at the innumerable threats to businesscontinuation from divergent internal and external factors, such asemployee turnover, public relations fiascos, or supplyinterruption.

There has been increasing emphasis on the regulatory side, Olivaadds. Financial information has to be at [insurers] fingertips, notonly for corporate transparency [full disclosure of financial andkey performance information], but also for the other regulationsthey have to comply with, such as capital adequacy and the Basel 2accord, which specifies capital requirements for financialinstitutions. Also, there is a bevy of regulations that affectcustomer relationships; for example, what are the risks ofnoncompliance with the Patriot Act, money-laundering detectionrequirements, privacy regulations, and so on.

Working Toward Enterprisewide

Combining technology with a dedicated, centralized riskmanagement strategy is the Royal Bank of Canada (RBC) FinancialGroup, which has five different divisions including RBC Insurance,the largest bank-owned insurance carrier in Canada. Headquarteredin Mississauga, Ontario, RBC Insurance provides life insurance,property/casualty insurance, travel insurance, creditor insurance,and reinsurance.

Within each of its five divisions,_RBC manages business risksunique to those operations. [We] believe everybody throughout ourorganization is responsible for managing risk, says Bob Aylward,senior vice president of operational risk at RBC Financial Group.RBC Insurance, for example, uses a variety of modeling andforecasting tools for underwriting and actuarial risk.Additionally, RBC Financial Group manages certain types of risk,including operational risk, at the enterprise level. It has acentral risk management department that establishes policies forrisk management and also has a chief risk officer who is vice-chairof the corporation and a member of its top managementcommittee.

The company looks at four broad categories of operationalriskpeople, processes, technologies, and external eventsand hasdesignated 30 subcategories within those. In May 2002, the companyalso installed Portiva, a portal-based risk management system forcapturing risk assessment data.

RBC Insurance has segmented its operations into smallercomponents it calls operational risk entities, which representprocesses within product and functional lines. Each of thoseentities conducts risk and control self-assessments based on a setof common deliverables, says Aylward. Those assessments begin withunderstanding what are the business objectives, what are the areasof operational risk that reside within that business, how are thoserisks mitigated, what is the likelihood of a particular event, andwhat is the probable impact if something does go wrong.

Designated staff in each of those entities use Portiva to recordthese self-assessments in a scorecard format. Portiva providesanalytics from these assessments that are used by the operationalrisk entities and divisions to manage risk. Additionally, thecentral risk management department uses Portiva to combine theseline-level assessments with the relative importance (from a riskmanagement perspective) of each risk entity to the overallbusiness.

RBC Financial Group therefore is able to assess residual risks(the remaining likelihood of a loss occurring and its impact) anddecide whether or not action is needed, Aylward explains. Thataction could be any of a range of solutionsdeveloping back-upstrategies, purchasing additional insurance, or providingadditional staff training, for example.

In addition to the database that supports the Portiva system,RBC Financial Group also has created an additional loss eventdatabase. We capture data regarding any of the operational lossesthat occur across the corporation, Aylward says. We track where theloss occurred, the value, what the corrective action was, and whythe loss occurred. The company is working toward implementing anOLAP tool to provide analytics that take both systems intoaccount.

Building for the Future
Gartner doesntexpect to see technology that can fully integrate the many types ofRisk Management Solutions and strategies in play across theenterprise until at least 2006. However, there are strategiesinsurers can use to prepare for this development today.

When doing their technology planning, particularly for datamining and warehousing, insurers need to look at data tools andfilters that will enable them to capture not only past loss data,but future projection data for the whole enterprise, says Oliva.Then, when they get into analyzing the eventsstatistical modeling,event modeling, predictive modelingthey have to look at it acrossthe enterprise and not by silos.

The problem is these [risk management] projects are done in thebusiness units, but insurers have to look at them across businessunits, says Neal Oswald, financial services practice leader at CapGemini Ernst & Young. In a classic insurance company scenario,where you have 42 legacy systems, 15 divisions, and globaloperations, unless you start specifying design principles foraggregation, youre lost before you start. You have to standardizeyour design principles around data, reporting, infrastructure, andcustomer.

While portal technologies can provide users access to theresults of these tools and help create aggregated viewpoints, itsstill a far cry from true technology-based enterprise riskmanagement.

Is it possible to have one system that does all of this? I thinkthe answer is probably no, Oliva says. It becomes a matter of sometype of a middleware that would be pulling data from varioussystems to a risk managers desktop. So for at least the firstiteration of enterprise risk management, Oliva says, it will be aconnection and integration issue, rather than building a singlesystem that can understand so many different units of measure.

Those connections could be made by an aggregation tool, a pieceof software like SAS to bring it together, or even a simple DB2 orOracle environment with a query tool to run against it, saysOswald. Importantly, not everything in business can be distilled tofinancial risk, so there will always be an art to risk managementthat technology will likely never completely replace.

Proximate Cause

Even as the industry scrambles to create terrorism exclusionsfor property policies, it must still evaluate this new catastropherisk due to its impact on all lines of insurance. Before, it didntmatter if you had three or four buildings [insured] in Manhattan;now insurers need to model for terrorism the way they always didfor events such as floods or hurricanes, says Tom Peach, seniorvice president of underwriting and policy administration atZurich.

Measuring terrorism risk adds another level of complexity tocatastrophe modeling. That is, there are decades of weather datathat can be relied upon, and more important, Mother Nature has nointent when she creates an earthquake or hurricane. Terrorism riskmanagement, however, involves monitoring the ever-changinggeopolitical climate of the world and assessing the attractivenessof a businesss operations to a terrorist. Catastrophe riskmanagement solution providers, such as the Insurance ServicesOffices and Risk Management Solutions, have all come out withterrorism models that consider these complex factors.

For example, Oxxford Information Technologys Vulnerability Indexprovides a database of 28 million businesses nationwide andidentifies threats for high-risk businesses. Certain industries aremore subject; they make a product, they are a delivery mechanism,and so on. We have a scoring mechanism using 40 different methods,including a weighting method for the type of terrorism that may beinvolved, the type of patents and processes, whether they havegovernment contracts, and whom they are selling to, says RayGreenhill, Oxxfords CEO and founder.

However, an insured risk also may be subject to terrorism losseven though it isnt specifically a terrorist target. By usinggeocoding, the Oxxford index can be used to assess not only thedirect risk of an insured location, but also potential loss due toproximity to more attractive terrorist targets, such as powerplants and communications facilities. The risk at a particularinsured location therefore is determined by the highest riskpotential at the site, whether that comes from the insureds orothers operations.

The objective is to allow insurers to manage the risk of theiroverall book of business, selecting business in lower-impact areasto balance what they might already have on the books, saysGreenhill.

Risk Management and Modeling Tools VendorList

AIR Worldwide
Boston, Mass.
617-267-6645
www.air-worldwide.com

CSC Financial Services
Austin, Tex.
512-275-5000
www.csc-fs.com

Delphi Technology
Cambridge, Mass.
617-494-8361
www.delphi-tech.com

Effisoft
Boston, Mass.
617-437-9600
www.effisoft.com

Entegra Corp.
Oakbrook Terrace, Ill.
630-613-7661
www.entegracorp.com

Envision Technology Solutions
Midvale, Utah
801-568-1818
www.envision-ts.com

Fair, Isaac & Co.
San Rafael, Calif.
415-472-2211
www.fairisaac.com

Forensic Analysis & Engineering Corp.
Raleigh, N.C.
919-872-8788
www.forensic-analysis.com

GenSource Corp.
Valencia, Calif.
661-294-1300
www.gensourcecorp.com

International Security Technology, Inc.
New York, N.Y.
212-557-0900
www.ist-usa.com

Insurance Information Exchange
College Station, Tex.
800-683-8553
www.iix.com

Ivega Corp.
San Francisco, Calif.
415-274-2699
www.ivega.com

Marsh USA
Los Angeles, Calif.
213-346-5828
www.marsh.com

MountainView Software
Layton, Utah
800-533-1122
www.mvsc.com

Portellus
Irvine, Calif.
949-250-9600
www.portellus.com

Risk Laboratories
Marietta, Ga.
678-784-4615
www.risklabs.com

Risk Management Solutions
Newark, Calif.
510-505-2500
www.rms.com

Risk Sciences Group, Inc.
Schaumburg, Ill.
800-619-0224
www.risksciencesgroup.com

RISKTRAC
Portsmouth, N.H.
800-294-3316
www.libertymutual.com/risktrac

RMIS/Lab
Hartford, Conn.
860-543-7341
www.rmislab.com

Silver Plume
Boulder, Colo.
800-677-4442
www.silverplume.com

Valley Oak Systems, Inc.
Alamo, Calif.
925-552-1650
www.valleyoak.com

Worldinsure Limited
Quincy, Mass.
416-594-2172
www.worldinsure.com