The Risk Management and Own Risk Solvency Assessment Model Act(RMORSA), which is in the process of being implemented in statelaw, requires insurers to manage a comprehensive enterprise riskmanagement framework that is embedded within company operations byJanuary 2015.

Setting the risk strategy and achieving a risk-aware culturethroughout the organization, which are crucial to a comprehensiveand effective ERM program, could take a couple of years. However,some lead state regulators are already examining insurers' ORSAs orsimilar documentation, as part of the risk-focused examinationprocess. Furthermore, states that have adopted the newly revisedNAIC Model Holding Company Act will look for more enhanced annualreporting of ERM practices, through the mandated filing of the FormF. This process will begin in 2014 in most states.

While the RMORSA deadline is quickly approaching, almost 40percent of insurance company boards are not engaged, or onlypassively engaged, in risk management, according to PwC's recent“2012 U.S. Insurance ERM & ORSA Readiness Survey.” In addition,only 65 percent of companies indicated they have a risk appetitestatement that reflects tolerance, strategy and financial goals..Insurers may be underestimating the amount of work it will take tomeet the RMORSA requirements.

ERM programs have four key areas that organizations need totackle now, to not only be compliant with RMORSA requirements, butalso to support enhanced risk-adjusted decisionmaking.

Risk strategy

Risk strategy should be at the heart of any organization. Riskshould be a core consideration when setting strategy, formulatingbusiness plans and managing performance. Risk appetite should beclearly articulated and reflect the organization's risk carryingcapacity, business strategy and financial goals.

A fully operational risk strategy and process brings thepotential for significant benefits, such as a better rating agencyview of the ERM framework, lower impact regulatory exams, betterrisk practices and enhanced collaboration between actuaries andrisk managers. In the short term, dedicating resources and budgetto develop the overall risk strategy will help companies with lessdeveloped ERM functions align with their more advanced competitors.In the longer term, the focus of leading market participants islikely to move beyond mere regulatory compliance and become morestrategic, as companies will focus on not only the basicrequirements, but approach their ORSA from a commercial,value-adding perspective.

Insurers will benefit from establishing a formal risk appetitestatement with their boards. For companies with less complex riskprofiles, the risk appetite statement should still be developed. Arelatively simple risk profile does not mean a formal risk appetitestatement is any less relevant. A formal risk appetite statementshould be the universal template an organization uses to assess allmajor decisions and enhance risk governance.

Risk governance

A key component of successful ERM is a risk culture thatinvolves the entire organization and fosters shared responsibilityfor risk management. However, sharing key responsibilities toobroadly presents the risk that key tasks will go unperformed or anorganization may not adequately address critical issues because ofa common perception that they are someone else'sresponsibility.

The CRO or risk committees will be largely responsible forcompliance with the RMORSA requirements. Two-thirds of insurers inthe survey have a dedicated CRO, but in the absence of a CRO,individuals should be clearly identified who will be responsibleand accountable for the RMORSA and ensuring that the company isproperly addressing all aspects of the ERM framework.

Risk management

A formal risk identification process will improve the likelihoodthat companies will identify all significant existing and new riskson a regular basis. We believe that a robust stress and scenariotesting process is an essential part of a risk managementframework. Preparing for RMORSA is an ideal time to stress- andscenario-test business plans, risk exposures and appetite metricsin a comprehensive and coordinated manner.

When properly orchestrated, the RMORSA will take place inconjunction with an organization's business planning process,leading to a high degree of coordination between risk,underwriting, strategy, finance and compliance functions. Insurersshould appropriately tailor risk management metrics and dashboardsto facilitate the monitoring of exposures and tracking againstappetite according to roles, responsibilities and authoritylevels.

Risk quantification

Internal risk and capital models are at the heart of an ERMframework. While the latest NAIC ORSA Guidance Manual requires onlythat the ORSA Summary Report should demonstrate the insurer'sprocess for model validation, including factors considered andmodel calibration, emerging best practices require that models meetthe highest quality standards, be fully tested and documented andbe subject to independent scrutiny and validation.

Almost 40 percent of survey respondents are not using aneconomic capital measure in addition to the more traditionalcapital metrics of statutory capital, GAAP capital and ratingagency capital. Although not mandated under RMORSA, economiccapital models are very useful tools in risk management and riskaggregation, but even those organizations that have them in placedo not necessarily use the information to the fullest when makingstrategic decisions. Where economic capital is used, more than 70percent of insurers have the ability to project economic capitalinto the future, and more than half of those respondents canproject it beyond three years.

In conclusion, having a well embedded ERM framework can helpinsurers exploit key opportunities and maximize risk-adjustedreturns, while protecting policyholders' interests. Meetingregulatory requirements as a by-product of an effective ERMframework and risk-aware culture, rather than seeing the RMORSA asa pure compliance requirement, will help differentiate tomorrow'swinners in the market.