Risk Management in Insurance: the regulator perspective1

Manuel Aguilera-Verduzco2

Good afternoon ladies and gentlemen,

First of all, I would like to take this opportunity to express my deepest recognition to the International Actuarial Association (IIA) and to the organizers of this Twelfth International Colloquium of the AFIR, for their generous hospitality. Also, I would like to congratulate their splendid work in identifying the key issues that are being addressed during this gathering, and for being able to assemble an outstanding group of speakers. It is also a pleasure for me to assist to such a beautiful site as the Mayan Riviera, which region is a place full of culture and cradle of the Mayan Civilization. Thinking of Mexico, I really cannot imagine a better frame and outstanding natural environment for this event. 1 Speech presented in the XIIth AFIR Colloquium, 27th International Congress of Actuaries, Cancún, México. March 19th, 2002. 2 Manuel Aguilera-Verduzco is the President of the Insurance and Surety National Commission (CNSF-Mexico) and the Chairman of the Executive Committee of the International Association of Insurance Supervisors (IAIS).

The subject which I will deepen in this opportunity is the risk management in insurance. There is no doubt that in the current days, this important issue raises an enormous challenge to the insurance companies that have to control and to manage adequately its technical and investment risks, among other important matters. As well, it is fair to say that counting with a correct risk management has a direct influence on the companies’ solvency, economic reliability and its overall financial situation. For these reasons, the insurance industry has increasingly developed risk controls and prevention methods according to international standards which contribute, although not to eliminate them, to confer a suitable and correct risk management in order to avoid future financial problems.

- 1 - Introduction Insurance companies, by the very nature of their business, are exposed to risk. Every firm in this industry should meet prudential standards established to limit or manage the amount of risk that they retain. In order to assure an adequate risk management, it is of the utmost importance that insurance companies apply appropriate and reliable

2

methods for the risk evaluation of all the business they assume. By following this approach, companies can evaluate the impact that the retained risks have in the overall solvency of the company. The evaluation of risk is complex and its control should not be constrained by the statutory rules alone. It must be the responsibility of the insurance company in the first instance. The regulator cannot necessarily assess the risk in the same way as the company, because it does not have the same precise information on the nature of every individual risk that the company is exposed to or the relationships between risks. So, the regulatory regime sets rules only for general prudence, as well as some aspects of risk management that need to be assessed. In general terms, an insurance company is solvent if it is able to fulfill its obligations under all contracts at any time, or at least, under most circumstances. And I make this last statement due to the fact that given the very nature of the insurance business, in a liberalized and deregulated environment, it is not possible to guarantee solvency with certainty. Nevertheless, it is generally accepted that in order to keep a solvent position or, in other words, to stay financially healthy in the long run, an insurance company needs to take into account the risks to which it is exposed and which may threaten its financial standing. In other words, to assess the potential risk that the company may become exposed to.

3

• How much risk would the company face derived from its current business and from its future business plan?

• Does the company have enough assets to face this future risks? • Will the company need a capital injection in the future to support

the risks? To discuss about what are these risks, and how can they be limited and controlled is the main purpose of this session. And I will do it, of course, from the supervisor viewpoint. A classification of risks Normally, insurance companies face a substantial amount of different kinds of risks. These risks can be classified into three main categories according to their immediate impact on the solvency of the insurer and their attributes. These broad categories are:

• the technical or liability risks, • the investment or asset risks and • the non-technical risks.

First, the technical risks refer to the liabilities and are directly or indirectly associated with the technical or actuarial bases of calculation for premiums and technical provisions.

4

Technical risks Technical risks result directly from the type of insurance business transacted. They differ depending on the class of insurance, and their effect, if they materialize, is that the company may no longer be able to fully meet the guaranteed obligations using the funds established for this purpose, because the claims frequency, the claims amounts, or the expenses for administration and settlement are higher than expected. When considering the technical risks, it may be worthwhile to distinguish between “current risks” and “special risks”. In the first place, current risks consider:

• the risk of insufficient tariffs or miscalculations, leading to premiums that are too low to cover the insurer’s expenses related to claims, claims handling and administration;

• the deviation risk or the risk emerging when the actual

development of claims frequencies, mortality, interest rates, inflation etc., does not correspond to the bases of premium calculations;

• the risk of error, which depends on the quality of the basis of

computation and arising due to the lack of knowledge about the expected development of the insured risk;

5

• the evaluation risk, that may lead to a situation in which the technical provisions are insufficient to meet the liabilities of the insurer;

• the reinsurance risk, which is related to the risk of insufficient

reinsurance covers or the failure of reinsurers to pay their part of the claims;

• the operating expenses risk, that materilizes when the actual or

future expenses exceeds, to a considerable degree, the estimations used in the bases of calculation; and finally,

• the risks associated with major or catastrophic losses, or

accumulation of losses caused by a single event (for instance, an earthquake).

On the other hand, the special technical risks consist of:

• the risk of excessive or uncoordinated growth, that may lead to a rapidly increasing claims ratio or an aggravated expenses ratio, and secondly,

• the liquidation risk, meaning that an insurer’s funds are not

sufficient to meet all liabilities, in cases of discontinuation of major parts or the whole business that was previously written by the company.

6

The second category is the investment risks. The investment risks are those directly or indirectly associated with the insurers’ asset management. The nature of the insurance business implies not only the formation of technical provisions, but also the holding of assets to cover these provisions and the solvency margin. Detailed analysis and management of this asset / liability relationship will therefore be a pre-requisite to the development and review of investment policies and procedures, which seek to ensure that the insurer adequately manages the investment-related risks to its solvency. Specifically, investment risks concern the performance, returns, liquidity and structure of the insurer’s investments. Such risks can have a substantial impact on the asset side of the balance sheet and therefore on the company’s overall liquidity, and potentially can lead to the company being insolvent. Investment risks Investment risks consist of:

• the depreciation risk, or the risk associated with a depreciation of the value of investments due to various changes in capital markets, exchange rates or to the non–payment by the debtors of the insurer. Therefore, credit and market risks are considered within this category;

7

• the liquidity risk, which refers to the risk emerging when the insurer fails to make investments liquid in a proper manner, as its financial obligations fall due;

• the matching risk, that emerges when the future cash flows

generated by assets, do not cover the cash flow demands of the corresponding liabilities in a suitable manner;

• the interest rate risk, which is materialized when the prices of

fixed–interest assets fall, due to an increase in market interest rates, as well as the reinvestment risk related to falling market interest rates;

• the evaluation risk, that occurs when the investments have

been evaluated at a disproportionably high price;

• the participation risk, which is the risk related to the holding of an ownership or a financial interest in other companies and the possibility of being affected by financial difficulties within the latter companies. It is important to mention that when an insurer is part of a financial group, its overall risk exposure depends to a large extent on intra–group relations, basically participations and other financial transactions which may lead to a dangerous risk concentration.

And finally:

8

• the risks related to the use of financial derivative instruments and, especially, the credit, market and liquidity risks associated with those instruments.

The last broad category of risks is the non–technical risks. This category corresponds to the various kinds of risks which cannot, in any suitable manner, be classified as either technical or investment risks. Non-Technical risks Among the non-technical risks is important to stress in four of them. In the first place:

• the management risk, which is the risk associated with an incompetent management or, even, a management with criminal intentions, This includes matters willfully caused by management. For example, the risk arising if the charged premiums were consciously calculated too low in order to gain market share.

• Second, the risks connected with guarantees in favor of third

parties, that refers to the potential strain on the economic capacity of an insurer caused by a call on a guarantee furnished for the purpose of the financial commitments of a third party.

• The general business risk, which is related to changes in the

economic and social environment, as well as changes in business profile and the general business cycle. And

9

• the legal risk, that normally concerns the unexpected changes to the legal conditions to which insurance undertakings are subject.

Risk control and risk prevention methods Carefully analyzed, technical risks exist partly due to factors outside the company. Thus, when establishing the risk management strategy, it is important to consider that there are external factors that shape a company’s solvency profile. These include macroeconomic factors, natural and environmental factors, and political and social factors. However, the company’s business strategy and its management decisions can directly influence and limit exposure to risks by using preventive measures. Such measures normally include actions taken within the company, as well as regulations imposed on the insurer by law or special action of the supervisor. As you all know, statistics show that, at least theoretically and when certain basic conditions are present, the more homogeneous and larger the portfolio, the better the technical risks can be predicted and thus calculated. Therefore, management strategies that can directly influence and limit exposure to technical risks use preventive measures in the areas of:

• tariffication, • policy conditions, • underwriting policy,

10

• supporting the insured to prevent losses; and • reinsurance.

Reinsurance cover is an inevitable tool for the insurer to reduce its risk exposure as regards certain features of its technical risks. But al the same time, reinsurance cessions might be a burden to the solvency of the insurer as two kinds of risk remain inherent:

• The reinsurance cover might prove insufficient to adequately handle the risk in question, because reinsurance needs have not been precisely identified.

• And a reinsurer might prove to be unable or unwilling to pay its

part of the claims incurred, which can put the insurer’s liquidity at risk and even cause its bankruptcy.

Therefore, reinsurance risk should be monitored and controlled by both management and supervisors. Investment risks are also, to a great extent, attributable to macroeconomic, social or political factors which influence interest rates, stock exchange quotations and currency exchange rates, or simply the lack of transparency in the markets or unforeseeable governmental decisions. But again, the management of an insurer can limit exposure to these risks by the taking of appropriate measures like a prudent evaluation, spreading and diversifying of assets and a proper asset–liability matching. For this purpose, derivative instruments may also be used.

11

However, it is important to note that the use of derivatives also represent risks, so the primary components of a sound risk management process for derivatives, include written policies and procedures that, as in other kinds of risk:

• clearly establish lines of responsibility for managing risk, • set in place adequate systems for measuring risk, • create structured limits on risk taking, • prescribe comprehensive and timely risk monitoring and

reporting, and • establish effective independent internal controls.

- 2 - Regulation and supervision: trends The regulatory framework plays an important role in the risk mitigation and control. In recent years, this regulatory framework has evolved towards encouraging the insurance industry to set up private mechanisms and institutions for the application of business guidelines and a code of conduct to limit detrimental practices. Self-regulatory principles and organizations, including professional bodies, can be a useful complement to the public supervisory structure. However, supervisory

12

authorities need to scrutinize such arrangements in order to ensure that they promote effective market functioning. The other fundamental regulation scheme is the foundation for good corporate governance. That is, insurance companies should be encouraged to develop an ownership structure that fosters stakeholder oversight. This is essential for strengthening the monitoring of management performance and reducing distortions in incentives and avoiding political interference in management. Good institutional governance requires comprehensive internal control procedures and policies that are implemented by skilled personnel and carefully monitored by management. Reforms leading to a market economy, particularly competition and liberalization measures, promote entrepreneurial freedom, responsibility and accountability, optimize allocation of resources, increase efficiency and bring a better match between supply and demand and, ultimately, better quality services at reasonable prices. Subject to prudential regulations, competition in the insurance sector should be fostered by removing unnecessary restrictions and allowing participation of sound insurance companies in the insurance market. In order to achieve a pro-competitive solvency regulation, it is necessary that domestic regulators and insurance companies comply with the international regulation and supervision standards. It is also necessary that within each jurisdiction a reinforcement of the institutional corporate governance and mechanisms to incentive a high self-regulation level are implemented. Given the foreseeable role of the

13

supervisors, they must be able to outsource to third parties, auditors and actuaries, supervisory tasks such as monitoring the solvency position or the sufficiency of technical provisions. Pro-competitive Solvency Regulation The so called “pro-competitive solvency regulation model” supposes a three part collaboration scheme. That is, an effective coordination between the supervisory body, the independent third parties and the companies’ board of directors. Besides collaboration, each of these parts has a fundamental role. The insurance supervisory authority should fulfill the international regulation and supervision standards, have broad knowledge and expertise ranging from actuarial science to contract law and must modernize its procedures in order to achieve an adequate supervision in this new scheme. The third parties should impel the modernization and the improvement of the rules that guide the performance of the Financial External Auditors, Actuarial External Auditors and independent actuaries, in order to achieve a better overall company’s monitoring. The Board of Directors must incentive the reinforcement of the institutional corporate governance. Also it is important that such body looks forward to improve the precision concerning the ascertainship in the board functions, as well as the compliance of both, internal and external regulation.

14

Regarding the risk management function, the Board of Directors should be responsible for the formulation and approval of the strategic investment policy, taking into account the analysis of the asset / liability relationship, the insurer’s overall risk tolerance, its long-term risk-return requirements, its liquidity requirements and its solvency position. In the case of deregulated markets, the role of the independent actuary is of great relevance, because it is used (directly or indirectly) as part of a formal supervision model. As part of it, the independent actuary must comment on:

• the adequacy of technical provisions, • certify that the data are adequate to support the valuation and

that the premiums charged are adequate in relation to the corresponding liabilities being taken on, having regard to the overall financial position of the company,

• and give and independent opinion about the solvency of the company.

Specifically, the independent actuary plays a key role in determining and monitoring the risk management policy of the company.

The main purpose of supervising insurers is to maintain efficient, fair, safe and stable insurance markets, for the benefit and protection of policyholders.

15

Insurance supervisory authorities require insurers to maintain assets or surplus capital in excess of liabilities, that is, a solvency margin. As to the important issue of preventing or reducing various risks, insurers are not left to their own devices. Preventive measures usually are not left to the discretion of an insurer’s management. Most of the times, they are required by specific regulations in order to reduce effectively the mentioned risks. The International Associations of Insurance Supervisors (IAIS) has set out some insurance principles and standards that are relevant for evaluating the capital adequacy and solvency of insurers, supplemented by risks management systems.

The Insurance Core Principles comprise the basic principles that need to be put in practice in order to have an effective supervisory system. These principles are intended to serve as a basic reference for supervisors. Adherence to these principles by insurance supervisory authorities does not eliminate the need to implement another kind of measures to address particular conditions and to take the utmost care in the management of the risks in the insurance system of a given jurisdiction. A sound supervisory system has to apply insurance principles as well as insurance standards, that set out the best or most prudent practices.

One of the primary aims of insurance supervision is to ensure that an insurer is able to fulfill all its obligations towards the insured. However,

16

the insurance principles do not remove the need of an insurer to carefully manage the risk of the business it undertakes. A sound supervisory system has to combine the core principles and standards with specific requirements for risk management systems.

Besides the different supervisory schemes around the world, there are some factors that must be taken into account regarding technical risks:

First, general prudential principles are usually established by law, and these have to be met when the company determines the amount of the technical provisions. Second, supervisors may also require premiums and technical reserves to be calculated on reasonable actuarial assumptions. Third, considering that reinsurance arrangements are a primary tool for risk transfer, any contract should consider the effective transfer of insurance risk. Fourth, the insurance supervisor must be aware that without a transfer of significant insurance risks, reinsurance agreements that simply provide favorable effects to the insurer’s balance sheet, may mask the true obligations and risk exposure of the insurer. And finally, if such is the case, and those kind of financial arrangements are allowed, their existence should be fully disclosed to prevent uninformed reliance on a potentially misleading or distorted statement of financial conditions.

17

Therefore, supervisors must receive sufficient and relevant information on the reinsurers used and the reinsurance cover arranged. Relevant information may include: reports that describe the reinsurance cover, the reinsurance programs or treaties; and the financial statements, including the result of reinsurance and any amounts outstanding from reinsurers, including financial reinsurance. To face technical risks, insurance supervisors should require insurers to maintain adequate technical provisions that should be valued on a prudent and transparent basis. Such technical provisions should usually include allowance for outstanding claims, for future claims and guaranteed benefits for policies in force, as well as expenses. The objective valuation of provisions means an unbiased assessment using an objective actuarial process, even though this valuation includes some uncertainty in the estimation of claims. Also, supervisors should ask insurers to maintain a minimum capital requirement in order to provide a minimum assurance of the financial capacity and soundness of the insurer. Regarding investment risks, the insurance supervisor must make sure that insurance companies invest having regard to safety and return. So the regulatory framework may impose prudential investment rules for the assets covering technical provisions and solvency margin. These prudential bases could adopt the form of “quantitative limits” or the so called “prudent man rule”.

18

The assets must be sufficiently diversified and spread and should secure liquidity in order to ensure that the liabilities under insurance contracts can be fulfilled as they fall due. An important remark is that objective and consistent valuation of assets is based on prudent and transparent accounting standards and practices. Besides, another key issue is that capital adequacy and solvency regimes have to address necessarily the matching of assets with liabilities. In evaluating the risk that an insurance company assumes, problems may arise by underestimating the risks, changes in the claims experience, or inadequate investment or underwriting. In these cases, capital requirements are needed to absorb losses that can occur from technical and investment risks. Finally, in order to face non-technical risks, the insurance regulatory framework requires the insurers to implement sound business decisions and, if necessary, to provide the supervisor with the capacity to ask for an increase of the equity.

19

- 3 - Risk Management Function Insurers should be capable of identifying, monitoring, measuring, reporting and controlling the risks related with their activities. First of all, the insurer should monitor the compliance level with respect to the approved risk management policies. The responsibility for the preparation of a written investment mandate, setting out the operational policies and procedures for implementing the overall investment policy established by the Board of Directors will frequently be delegated to senior management. The precise content of the mandate will be different for each insurance company but the level of detail should be consistent with the nature of the regulatory scheme and with the complexity and volume of its operations. Therefore, the senior management should ensure that all individuals conducting, monitoring and controlling risk management activities are suitable qualified and have appropriate levels of knowledge and experience. Given the collaboration scheme in a pro-competitive solvency regulation model, the risk management function should regularly report to the appropriate company’s authorities and, in some especial cases, to the supervisory agency. The reports should provide aggregate information, as well as sufficient detail to enable management to

20

assess the sensitivity of the company to changes in market conditions and other risk factors. The frequency of reporting should provide these individuals with adequate information to judge the changing nature of the insurer’s asset-liability profile, the risks that stem from it and the consequences for the company’s solvency. As it was said, the required solvency margin has to be considered the last resort, after all other measures taken by the insurer to secure its financial stability have failed. The insurer also has to have in place risk management tools and systems appropriate to the complexity, size and mix of the insurer’s operations. If efficient control systems are in place to monitor risk exposures, a company will be able to adapt more quickly to changing situations. To be aware of a company’s risks, management should also control the profitability of each line of business on an on-going basis. Actuaries can play a dominant role in this context. Risk management systems An efficient risk management system should ensure that both existing and potential risks are identified and measured as completely as possible. That’s why a system should rely on complete data bases, in order to calculate any risk jeopardizing solvency as early as possible. On the other hand, the insurer should establish internal policies on how to manage risks which are identified, analyzed and measured.

21

As we know, such systems may vary among different companies, but each system must be comprehensive and sufficiently robust to reflect the scale of the risks and the activity undertaken; capable of accurately capturing and measuring all significant risks in a timely manner; and understood by all the relevant personnel at all levels of the company.

- 4 - Actuarial Issues An insurance company needs to take into account in an appropriate manner the risks to which it is exposed to. Accordingly, it is important for the insurer to have access to professional expertise with relevant skills in mathematics, modern statistical models and methods (including risk theory), as well as economics and finance, in order to ensure that these risks are analyzed in a proper manner and adequate risk prevention methods are applied. In this perspective, the most important areas related to solvency and with the insurance management are:

• The analysis of risks and pricing of insurance products. • Evaluation of technical liabilities and the estimation of sufficient

technical provisions. • Asset-liability matching. • Evaluation regarding the need for a solvency margin. • Solvency assessment.

22

• Evaluation of reinsurance needs. Regardless of regulatory traditions, the role of the actuary, both within the insurance companies and in the supervisory agency, is critical to the maintenance of financially sound insurance companies. In some jurisdictions, every insurance company has to submit (annually) the opinion of a qualified actuary on the adequacy of the technical provisions and related actuarial issues. Also the actuary has to submit an annual report on the financial position and future financial condition of the company, identifying possible risks and their consequences to the financial position of the company, as well as proposing actions that could mitigate the materialization of the risk.

- 5 - Final remarks The main purpose of the insurance supervision is to ensure that insurers have the capacity to meet their obligations to pay the present and the future claims. Regulation aims to reduce the risk of failure for insurers by establishing prudential principles and capital requirements.

23

However, it is important to stress that the statutory solvency requirement is not designed to completely eliminate the risk of institutional failure. Management, external auditors, independent or responsible actuaries play a key role in this purpose. And risk management practices are essential components of the solvency assessment.

* * * Given the globalization and liberalization trends on insurance markets, this has become a more interrelated world. Risk management, as part of the monitoring of the solvency position of insurance companies, is no more a domestic issue for a single market or a single supervisor. More than that, it has become an issue that has to do with international financial stability. The setting and implementation of standards, has become, as well, a key part of the international strategy to control financial stability. And this is an effort that necessarily implies the participation not only of the insurance supervisors, but of the industry, and the independent professional bodies that, like in the case of the International Actuarial Association (IAA), are closely involved in the development of the insurance industry all around the world. We all, supervisors, insurance industry and independent professional bodies, have the commitment to successfully face the challenges that lei before us.

24

* * * Thank you again for your kind invitation to participate in this Colloquium, and I hope that some of these comments may have been of interest to you in your own thinking about risk and risk management in insurance. Thank you very much.

25