Enterprise Risk Management in the Financial Services Industry: From Concept to Management Process

Step 1: Assessing Risks

The first step in developing best strategies is to assess the current risk environment. The assessment includes examining both financial and operational risks, using qualitative and quantitative methods. Financial risks include credit, interest rate, currency, mortality, liability, and reinvestment risks. Operational risks include people, technology, distribution, political, and regulatory risks.

Risks should be described as fully as possible, taking into account such aspects as:

• Causal factors and consequences
• Timing, e.g., short-term versus long term, seasonal, etc.
• Correlation with other risks, including whether a given risk could trigger or be triggered by other risks and, importantly, whether certain risks are negatively correlated and therefore represent "natural hedges" against each other
• Current risk mitigation strategies and their effectiveness to date
• Either historical data on or expert assessment of a given risk's impact on financial performance

This process involves a combination of gathering historical data, reviewing documents, and conducting interviews to gather information on business processes, organization, technology, people, and culture. There are several ways to document the output of the risk identification process. A simple method is to create tables where each row represents a unique risk and each column is used to organize information gathered for each risk. An alternative method is to develop risk maps that graphically illustrate both the causes and consequences of each risk.

However they "plot" the risks, managers can then decide which risks require their greatest attention by classifying them as "manageable" or "strategic." Manageable risks are those that the organization can address with existing capabilities. These risks might include such things as weak contingency planning in critical facilities or midlevel employees dissatisfied with opportunities for advancement. The proper response to manageable risks is simply to use the existing organizational capabilities to mitigate them by assigning them to the appropriate managerial level.

Strategic risk factors, on the other hand, are those that have to be addressed with substantial expenditures and/or a change in strategic direction. These can arise, for example, when an organization enters unfamiliar business territory because of a major acquisition, or when a new competitor emerges, or when customers change their buying preferences.

Strategic risks require greater analysis and often need to be analytically modeled. The models represent the uncertainty associated with each strategic risk factor regarding how, when, and the degree to which it will manifest itself. These models may range from entirely quantitative, relying strictly on hard data, to entirely qualitative, relying almost entirely on expert testimony. In either case, the objective is to develop probability distributions for each risk factor. Models that use both qualitative and quantitative "inputs" offer the greatest potential for modeling operational risks to which financial institutions may be exposed—at least until the industry's ability to gather and maintain data on operational risks matures.

Step 2: Articulating Strategies

The next step in developing best strategies is to articulate financial and operational strategies in a way that allows measurement of their impact on the risks identified in the preceding step. For an insurer, these strategies represent a set of basic decisions regarding core business activities, including product mix, asset-class allocation, the structure of reinsurance programs, design of business processes, performance-incentive systems, and risk mitigation. The objective of this step is to propose alternative financial and operational strategies and to develop a financial model that will be used in later steps to evaluate these strategies.

These strategies are intended to maximize value in light of the risk environment. The "value" or "values" being maximized may include earnings growth, return on capital, and consistency of financial performance. These objectives are often in conflict with each other. Some decisions may grow earnings at the expense of return on capital while others may increase return in the long term but create short-term instability. Thus, financial and operational strategies must be carefully coordinated to optimize the trade-offs and maximize overall value based on management objectives.

In order to make those choices, management needs to evaluate the various potential financial and operational strategies in light of the risk environment identified in the risk assessment stage. A stochastic financial model is constructed for this purpose. The model is designed to generate pro-forma financial statements. It is constructed by breaking down each item on the financial statement into its operational and financial components. Each risk and strategy affects one or more of these components that are then rolled up into the financial statement.

Risks affect elements of the financial statements or their constituent variables by making their value uncertain. These variables are replaced by the probability distributions for the corresponding risk that were developed in the risk assessment step. For example, the number of policies sold in a given period is a constituent variable in calculating revenue. Risk of competition makes the number of policies sold uncertain. Risk of competition can be modeled in the risk assessment step as a probability distribution on the number of policies sold. This distribution is used to represent the uncertainty associated with the number of policies sold in the financial model. In this manner, all strategic risks modeled in the risk assessment step, and their correlation, are reflected in the financial model—making this a stochastic financial model. The output of this stochastic financial model is a probability distribution on key financial metrics such as net earnings.

The first two steps in the strategy development process—assessing risk and articulating strategies—constitute the bulk of the analytical effort. The remaining steps use the risk models and the stochastic financial model to evaluate strategies.

Step 3: Evaluating Strategies from the Policyholders' Perspective

To select the best strategies, management at insurance companies needs to evaluate the alternatives from the standpoint of both customers (policyholders) and owners (shareholders). Generally, policyholders are concerned with the solvency of the business, whereas shareholders are concerned with returns on their investment. This step focuses on the interests of policyholders, while the next step shifts emphasis to shareholders. Policyholders' interests are reflected in the amount of capital the company holds against adverse performance. The greater the level of capital, the lower the risk of insolvency, all else equal. However, too high a level of capital will dilute the returns to shareholders. Therefore, the objective is to establish the minimum level of capital that will achieve the desired level of policyholder protection.

From the standpoint of policyholders, an insurer can determine its overall economic capital requirement by using a concept known as "economic cost of ruin" (ECOR), which reflects both the probability and the severity of ruin—the risk that most concerns policyholders. ECOR goes beyond simple percentile-value measures of solvency risk, such as "value at risk," by taking into account not only the likelihood of insolvency but also how devastating an insolvency would be. In a severe insolvency, there would be less surplus remaining after liquidation to distribute to policyholders. The proper amount of economic capital is the amount sufficient to reduce ECOR to a targeted level, based on the insurer's level of solvency risk tolerance.

The same principle and concept is then used to allocate capital to the company's different business segments. First, senior managers apply a common "ECOR ratio" (ECOR divided by the present value of expected customer payments) to their various business segments so that each policyholder effectively "pays for" the same amount of protection against insolvency. Next, managers use dynamic financial analysis to make sure the capital allocated to each segment also reproduces the company's solvency risk tolerance measure—assuring that the parts and the whole are aligned. Finally, because the sum of all segment capital allocations at this point will generally exceed the organization's overall capital requirement, each segment's capital is adjusted further to reflect the organization's "diversification benefit" philosophy.

Step 4: Evaluating Strategies from the Owners' Perspective

While the determination of economic capital is focused on the needs of the policyholders, this step primarily focuses on the interests of the owners of the enterprise. Owners are primarily interested in three objectives: growth of the business, return on their investment, and consistency of financial performance—the three pillars of the value edifice.

Strategies will distinguish themselves based on their relative impact on each of these value drivers. Some strategies are meant to primarily focus on growing the business, while others focus on return. Yet others focus on reducing variability. A combination of financial and operational strategies will likely affect all three objectives in positive and negative ways. Therefore, evaluating strategies will require optimizing the trade-offs among the objectives based on the preferences of managers who represent owners' interests.

In order to evaluate strategies against management preferences, each objective must be defined in terms of measures that are generated by the stochastic financial model developed earlier. Note that the financial model generates projections of financial statements—specifically, it generates probability distributions on each major element of the financial statement.

Growth is typically measured as the expected value of the average percent change in revenue over the time horizon. The return for a business segment is measured as the expected value of average net earnings over the time horizon as a percent of allocated economic capital. Consistency, however, can be measured in several ways. Consistency typically refers to net earnings but can also apply to return on capital, revenue growth, growth in embedded value, or any other financial metric that the owners consider important. In all cases, consistency can be represented by risk metrics, such as standard deviation, variance, shortfall risk, VAR, and Below-Target-Risk, or BTR. We prefer BTR-type measures for this step because they are designed to capture the risk characteristics (e.g., what is the probability of not meeting the expected return?) of most concern to enterprise owners.

Once management selects the measures that define each objective, the management team can evaluate the various alternative strategies to achieve those objectives. The simplest method is to plot all combinations of financial and operational strategies on a two-dimensional chart representing risk and value. Then either growth-based or return-based measures can be used to analyze risk and value.

A more sophisticated approach uses mathematical optimization technology to automatically evaluate and eliminate some of the strategy options. Given the number of alternatives proposed in Step 2 for each independent financial and operational strategy, there may be hundreds or possibly thousands of possible combinations of strategies that must be evaluated. In this case, it's practical to subject some strategies to mathematical evaluation rather than a manual evaluation.

In any case, the final evaluation and selection of the best combination of strategies is accomplished through discussion by management decision-makers, armed with insight into the risks and values of each strategy.

Step 5: Refining Strategies

Although alternative financial and operational strategies were developed in Step 2, often, promising new strategies come to light in the process of discussion and analysis of strategies in Steps 3 and 4. Therefore, management may need to loop back to Step 2 to ensure that the financial model can model the new strategy and then repeat Steps 3 and 4 to evaluate the new alternatives against the best candidates from prior analysis.

This additional evaluation step involves decomposing the prior analysis into root causes. That is done by turning the uncertainty associated with a variable in the financial model "on" or "off." Turning "on" a variable means converting it from a deterministic variable to a stochastic variable. This is done by replacing it with the probability distribution of the risk source that it is associated with. Turning "off" a variable means replacing the probability distribution with the expected value of the variable, i.e., the mean of the distribution.

The difference in the values represents the contribution of that risk source to the uncertainty of return on capital. Repeating this exercise with each risk source provides information that can be used to compare each source of risk. Similarly, evaluating results based on changes to an isolated strategy, e.g., reinsurance, can be used to determine the relative impact of each strategy within the complete set of financial and operational strategies. By constantly applying this iterative process of decomposing risk and isolating the impact of each strategy, management can not only refine its strategies, but be assured that it is selecting the best strategies.

Recap

The five-step process we've outlined in this article represents the logical flow of activities in developing strategy. The risk assessment process establishes the complete risk environment by considering both financial and operational risks. Manageable risks are assigned to appropriate managerial levels, while strategic risks are quantified and included in the financial analysis. Alternative financial and operational strategies are overlaid on the risk environment and modeled using an extension of existing financial models.

Strategies are evaluated in consideration of both customers' interests and owners' interests. Customers' interests are reflected in establishing capital based on the Economic Cost of Ruin (ECOR), the premium needed to insure against ruin. ECOR-based allocation methods are used to allocate capital to business segments as a charge for protection against insolvency against which to evaluate returns. Owners' interests are reflected by evaluating each combination of strategies in terms of its impact on growth, return on capital, and consistency of results.

The difference in policyholder concerns versus owners' interests is captured by the use of Below-Target-Risk measures to evaluate strategies. The evaluation process can be computationally intensive but relies ultimately on the analysis and discussion among decision-makers who voice their relative preferences for multiple objectives. Finally, decomposition of risk can provide opportunities to develop potentially better strategies.

At this point, insurance managers can be confident that they have, in fact, developed a set of "best strategies" to manage risk at the enterprise level and increase the value of their enterprise.