Insurer CROs Cite Operational Risks As The Next Frontier

Even for CROs with analytical backgrounds, such as the actuaries profiled in this edition, the challenges of getting a handle on operational risk–and quantifying it–are among the biggest they face in their roles as chief risk officers.

Taking a definition from banking regulators, Donald Mango, managing director of Guy Carpenter & Company in New York, said operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from natural hazards.

In simple terms, the first part of the definition speaks of the risk of “the wrong people doing the wrong things at the wrong time,” Jeff Mohrenweiser, an analyst from Fitch Ratings, told NU last year.

“What it really involves is process effectiveness,” Mr. Mango said, listing human resources issues such as incentive compensation, performance objectives and hiring practices, as well as IT development, data management and business continuity planning as activities falling in the realm of operational risk management.

He noted that banks, which have been insuring the hazard risk piece of operational risk with property-casualty insurers for many years, have more recently decided they would like to transfer out as much of their other operational risk as they can.

“They would like to be able to find insurance for these other things that are not necessarily insurable in the traditional sense,” he said, adding that “they're going to have their work cut out for them there to try to get that from the insurance market.”

In the insurance world, Michael Angelina, CRO of Endurance Specialty, said actuaries are just beginning to get involved in HR, legal and IT issues that have historically been the responsibility of more traditional risk managers. “I think that's really the next evolution for the actuary as CRO,” he said.

Mr. Mango said there's a view of operational risk in the insurance industry that suggests a lot of what manifests itself as underwriting risk, pricing risk and reserving risk is actually operational in nature.

As an example, he said, “if you have a lousy reserving model that indicates a low reserve, and you keep booking that reserve every year and then go insolvent, that's an operational risk by definition because your model failed to work.” Even an excellent reserving model can be run incorrectly because the claims data feeding it is incomplete, he added.

The same thing holds on the pricing side.

“If you underprice business for years with an inadequate pricing model, is that pricing risk or operational risk? The answer is it's both, but we don't know how much” of each risk there is, he said–predicting that over the next several years, insurance industry CROs will spend a lot of time trying to weed out the operational pieces from the irreducible aspects of reserve and pricing risks.

Janet Nelson, CRO for London-based Catlin Group, agreed that this won't be an easy task.

“You can argue that when you analyze historical loss experience, there's an element of operational risk embedded in it because some losses happened because the execution of the underwriting wasn't perfect,” she said–noting, for example, that operational issues such as failing to put an exclusion on a policy are partially already contemplated in traditional actuarial analyses of losses.

Making attempts to quantify this, Catlin and other companies are planning to build operational databases of “near misses–historical records of the things that might have gone wrong,” such as breaches of authority by managing general agencies that could have generated big losses, she said.

Citing some technical statistical issues inherent in trying to extrapolate low-risk near-miss information in order to quantify potentially extreme capital-depleting events, she said she personally believes the best way to deal with operational risk is not to put capital up against it, but instead to institute controls to monitor and mitigate the risk.

Mr. Angelina agreed. “When we look at operational risk, we really focus on loss prevention or mitigation. It's incredibly difficult to quantify, but you can certainly look at what happens if power goes out and you lose three-person days.”