Barings and Sumitomo, where a lack of management oversight allowed traders Nicholas Leeson to bankrupt the first and Yasuo Hamanaka to hide $2.6 billion in copper futures losses at the second, are among the names that catapulted from the business pages to the front page. Likewise, the mutual fund late-trading cases and the global settlements of the investment banking retail analyst investigations brought the business of Wall Street into the consciousness of Main Street.

These failures, scandals and headlines all share one common theme: Better operational controls could have prevented them. The ability of an institution to properly manage these types of exposures, including conflicts of interest and regulatory and legal risks, are essential components of operational risk management.

In a typical enterprise risk management structure, risk is measured and aggregated across four main areas: operational, market, credit and insurance risks. Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, personnel, systems or external events.

Failure to manage operational risk can have catastrophic results. One of the biggest operational risks–in addition to a direct disastrous financial loss–is the longer-term reputational risk, which can be equally devastating to a company's franchise.

Even in cases where a company could have overcome the initial financial impact, the loss of franchise often made its existence as an ongoing entity impossible.

In the United Kingdom, an analysis by the Financial Services Authority into insurer failures across the world found that in many cases, losses caused by adverse claims or market changes were exacerbated by operational failures. With today's markets so interdependent, the failure of a large financial institution may have dire consequences for companies and markets worldwide.

Insurers are in the business of taking and pricing risk. Traditionally, they have generally concentrated on the underwriting function. However, the increasing complexity of the risks, whether in the insurance business or investments, has necessitated a catching-up process in managing operational risks for most large U.S. insurers.

The development of operational risk management varies widely in the U.S. insurance industry, from no operational risk function to a quantifiable operational risk management function within a robust ERM function, overseen by a chief risk officer.

Among large insurers, most ERM operations have been created relatively recently and are at various stages of implementation. An operational risk management function is rare at small and medium-sized insurers. Across the board, the insurance industry is behind the securities industry in this area.

As the New York Insurance Department's examinations are modernized toward a risk-focused approach, where operational areas determined to be more risky are evaluated in more depth, a company's risk management approach becomes an essential part of the process.

We expect the examination process to be expedited for companies with a robust ERM function, and ERM will be taken into consideration when determining the nature and extent of exam procedures.

On the positive side, many large firms have developed an ERM function which incorporates operational risk management. At some of the larger insurers, ERM not only includes operational risk but also market, credit, insurance, strategic, reputational, information technology and business continuity risks as well as economic capital allocation models.

Some large and sophisticated insurers have further refined operational risk by developing methodologies to quantify operational risk and embedding operational risk management into day-to-day decision-making processes. But a lot of work remains to be done before a state-of-the-art ERM structure is the norm even among the large insurers.

This is despite the fact that various stakeholders–including investors, creditors, rating agencies, regulators and Congress (note the Sarbanes-Oxley Act of 2002)–have driven the push for firms to implement more robust risk management systems, leading to the larger publicly traded companies moving further along in the implementation of ERM.

Understandably then, smaller, medium-sized and nonpublic companies have been more difficult to prompt, and therein lies a challenge.

Insurers with a robust ERM function should be rewarded for their efforts–and in fact they are, to some degree. Rating agencies now consider the quality of ERM in their rating process, and insurance regulators have begun to take ERM into account when planning an examination.

Not only is sophisticated ERM an integral part of prudent management, it is also a necessary part of the move toward principles-based regulation.

U.S. insurers have already expressed concerns about being at a disadvantage to their European competitors, which are allowed to adopt a principles-based approach. But the principles-based approach to insurance regulation requires more of companies than the current rules-based regulation.

The insurance department's switch to risk-focused examinations is a concrete step toward principles-based regulation.

At the onset of an exam, regulators determine which of the company's activities are deemed to be risky and focus on those areas. Companies that demonstrate they are able to measure, manage and mitigate risks through their ERM processes receive a “regulatory dividend” in the form of a lower level of oversight–and thus a competitive advantage.

The New York Insurance Department takes an active role in encouraging the continued development of ERM in the companies we regulate. Insurers well know the need to manage risk. Now they must lead by example in managing their own.

Special Reports /

Principles-Based Regulation Needs Robust RM Structure

Related Stories

Recommended For You