Insurers Lag On Enterprise Risk Management

"The study confirms that ERM is a topic that insurance companies are increasingly getting interested in," said Shyam Venkat, a partner at PricewaterhouseCoopers in New York.

What was more of a confirmation than a surprise, Mr. Venkat noted, "was the lack of clarity around what ERM means to different companies in the insurance sector, with specific aspects of the program they might want to emphasize over others."

An interesting takeaway, he noted, is that some insurers view the industry "as not being quite as far along in ERM as others in the financial services sector, such as banking."

He said that when asked to compare their own progress relative to that of other companies in the industry, insurers "seem to always think they are further along."

He added that the reality is that "not a single respondent has implemented many or all of the aspects of what constitutes a well-defined, comprehensive enterprise-wide risk management program. Data suggests that each individual respondent has a fair bit of work to do."

The study found that leading companies look to ERM as a framework under which they can manage all the categories of risk, optimize their portfolios and enhance product development. Some, however, continue to struggle with the necessary infrastructure, people, processes and technology essential to fully reap the benefits.

Forward-thinking insurers have been developing ERM for some years, but the approach has only lately come to wider prominence in the wake of record losses, solvency scares and governance scandals, the survey found. Insurance companies acknowledge ERM as one of the key enablers to managing uncertainty.

Almost half of survey respondents viewed protection of shareholder value as the main advantage of ERM, but just 5 percent felt that ERM was fully integrated with their strategic business decisions, according to PwC.

Mr. Venkat said the industry has had wide interest in the survey. "Just going through the process of looking at the study and thinking about their responses has been an eye-opener for many of the survey respondents in terms of providing them with the clarity around what ERM actually means," he said.

Risk managers in the insurance sector, he said, are beginning to take more of a holistic view of what enterprise risk management means. In the past, however, "you might have had people focusing on the underwriting side or the investment side." Now, risk managers and chief risk officers are taking "a much broader view of risks to encompass financial risks, underwriting risks, operational risks, and even thinking explicitly about reputational risks and the like," he said.

Risk management in general, he noted, is very much "a top-of-mind issue with boards of directors, chief executives and senior business managers within companies as we continue to see surprises in the newspapers, whether driven by exposures that people did not know existed to specific market sectors or exposures from reputational issues."

Organizations are saying, "We need to get our risk management programs in order and not only eliminate these surprises, but also take a view of how risk management can help us make better risk adjusted decisions going forward," he added.

What's interesting, he noted, is that "we're seeing the same notion of risk management start taking hold in the corporate sector."

He said that firms are recognizing that they need to do a better job understanding their risks, where the risks reside within their operations, the level of the risks, and whether the level of risk management is sufficient to adequately manage the risks.

The survey found several areas which appear to be a continuing challenge, such as accumulating risk data and transforming it into useful management information. Only 6 percent of respondents were able to confirm aggregation capabilities across all risks and business units.

Although auditing existing risk policies and procedures was cited as a key success factor, only 26 percent of respondents stated that internal audit risk reviews were operating effectively.

Insurers are discovering that re-engineering data flows to address both compliance and financial risks will enable them to leverage existing infrastructure. However, systems and data also remained a significant obstacle to ERM effectiveness, with only 8 percent of survey participants being "very satisfied" with the technology used in risk management.

ERM Success Checklist

By Caroline McDonald

Enterprise-wide Risk Management for the Insurance Industry, the study by PricewaterhouseCoopers, found that there is no one size fits all" solution for designing and implementing an ERM program.

Rather, there is an emerging consensus about how to achieve effective ERM implementation and how it can benefit the organization. Some of those principles identified from the survey are highlighted below.

PwC said that an effective ERM framework should align the key fundamentals of governance and organization, standards and policies, risk measurement methodologies, and systems and tools. ERM success factors emerging from a governance and organization perspective were:

A clearly defined risk appetite articulated through limits and monitoring procedures.

Involvement of the board. (Fifty-seven percent of respondents had chief risk officers reporting risk issues to the board on a regular basis.)

Centralized ERM organizational functions in place. (Seventy-four percent of survey participants.)

A set of risk committees at both corporate and business unit levels that ensure proper communication and help to instill risk into the culture of the business.

Reproduced from National Underwriter Property & Casualty/Risk & Benefits Management Edition, March 12, 2004. Copyright 2004 by The National Underwriter Company in the serial publication. All rights reserved.Copyright in this article as an independent work may be held by the author.