Risk Management and Own Risk Solvency Assessment Model Act Check-Up

Risk strategy

Risk strategy should be at the heart of any organization. Risk should be a core consideration when setting strategy, formulating business plans and managing performance. Risk appetite should be clearly articulated and reflect the organization's risk carrying capacity, business strategy and financial goals. 

A fully operational risk strategy and process brings the potential for significant benefits, such as a better rating agency view of the ERM framework, lower impact regulatory exams, better risk practices and enhanced collaboration between actuaries and risk managers. In the short term, dedicating resources and budget to develop the overall risk strategy will help companies with less developed ERM functions align with their more advanced competitors. In the longer term, the focus of leading market participants is likely to move beyond mere regulatory compliance and become more strategic, as companies will focus on  not only the basic requirements, but approach their ORSA from a commercial, value-adding perspective. 

Insurers will benefit from establishing a formal risk appetite statement with their boards. For companies with less complex risk profiles, the risk appetite statement should still be developed. A relatively simple risk profile does not mean a formal risk appetite statement is any less relevant. A formal risk appetite statement should be the universal template an organization uses to assess all major decisions and enhance risk governance. 

Risk governance

A key component of successful ERM is a risk culture that involves the entire organization and fosters shared responsibility for risk management. However, sharing key responsibilities too broadly presents the risk that key tasks will go unperformed or an organization may not adequately address critical issues because of a common perception that they are someone else's responsibility. 

The CRO or risk committees will be largely responsible for compliance with the RMORSA requirements. Two-thirds of insurers in the survey have a dedicated CRO, but in the absence of a CRO, individuals should be clearly identified who will be responsible and accountable for the RMORSA and ensuring that the company is properly addressing all aspects of the ERM framework. 

Risk management

A formal risk identification process will improve the likelihood that companies will identify all significant existing and new risks on a regular basis. We believe that a robust stress and scenario testing process is an essential part of a risk management framework. Preparing for RMORSA is an ideal time to stress- and scenario-test business plans, risk exposures and appetite metrics in a comprehensive and coordinated manner. 

When properly orchestrated, the RMORSA will take place in conjunction with an organization's business planning process, leading to a high degree of coordination between risk, underwriting, strategy, finance and compliance functions. Insurers should appropriately tailor risk management metrics and dashboards to facilitate the monitoring of exposures and tracking against appetite according to roles, responsibilities and authority levels. 

Risk quantification

Internal risk and capital models are at the heart of an ERM framework. While the latest NAIC ORSA Guidance Manual requires only that the ORSA Summary Report should demonstrate the insurer's process for model validation, including factors considered and model calibration, emerging best practices require that models meet the highest quality standards, be fully tested and documented and be subject to independent scrutiny and validation. 

Almost 40 percent of survey respondents are not using an economic capital measure in addition to the more traditional capital metrics of statutory capital, GAAP capital and rating agency capital. Although not mandated under RMORSA, economic capital models are very useful tools in risk management and risk aggregation, but even those organizations that have them in place do not necessarily use the information to the fullest when making strategic decisions. Where economic capital is used, more than 70 percent of insurers have the ability to project economic capital into the future, and more than half of those respondents can project it beyond three years. 

In conclusion, having a well embedded ERM framework can help insurers exploit key opportunities and maximize risk-adjusted returns, while protecting policyholders' interests. Meeting regulatory requirements as a by-product of an effective ERM framework and risk-aware culture, rather than seeing the RMORSA as a pure compliance requirement, will help differentiate tomorrow's winners in the market.