EY - The ORSA opportunity: from compliance to business value

1. The ORSA opportunity: Compliance and business value 15 October 2013

2. Disclaimer ► This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax, or other professional advice. Please refer to your advisors for specific advice. ► The views expressed by the presenters are not necessarily those of EY. ► This presentation is © 2013 Ernst & Young LLP Limited. All Rights Reserved. EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organization, and may refer to one or more of the member firms, of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. Ernst & Young LLP is a member firm serving clients in the US. For more information about our organization, please visit ey.com. Page 2 The ORSA opportunity: compliance and business value

3. Today’s presenters Moderator: Bill Spinard Ernst & Young LLP Presenters: Chad Runchey James Collingwood Ernst & Young LLP Page 3 Adam Walter Ernst & Young LLP Ernst & Young LLP The ORSA opportunity: compliance and business value

4. Today’s agenda ► Background and regulatory update ► ORSA overview ► Industry perspectives ► Achieving long-term business value Join today’s Twitter discussion: Page 4 #EY_ORSA The ORSA opportunity: compliance and business value

5. Fact check What industry or industries do you focus on? A. Property casualty B. Life C. Health D. Other Page 5 The ORSA opportunity: compliance and business value

7. Background and regulatory update Own Risk and Solvency Assessment (ORSA) per the US NAIC* ► Definition ► ► “an internal assessment… conducted by [the] insurer of the material and relevant risks associated with an insurer’s current business plan and the sufficiency of capital resources to support those risks” Primary goals ► ► ► To foster an effective level of enterprise risk management at all insurers through which each insurer identifies, assesses, monitors and reports on its material and relevant risks, using techniques that are appropriate to the nature, scale and complexity of the insurer’s risks, in a manner that is adequate to support risk and capital decisions To provide a group-level perspective on risk and capital, as a supplement to the existing legal entity view Other jurisdictions with an ORSA process include ► Bermuda, the European Union and Canada * National Association of Insurance Commissioners Page 7 The ORSA opportunity: compliance and business value

8. Background and regulatory update ► ORSA Summary Report – highlights ► ► ► ► Section 1: Description of Insurer’s Risk Management Framework Section 2: Insurer’s Assessment of Risk Exposure Section 3: Group Risk Capital and Prospective Solvency Assessment ORSA Summary Report – expectations ► Annual reports due starting in 2015 ► ► ► ► ► Page 8 Exemption criteria for smaller insurers/groups No specified report date, NAIC states it will be dependent on when ORSA is performed Can utilize ORSA reports prepared for other jurisdictions Should facilitate a more in-depth review by the regulator through analysis and examination processes Horizon for key risks and capital adequacy should align with business plan (e.g., 1-3 years) The ORSA opportunity: compliance and business value

9. Background and regulatory update State adoption ► To date, the Risk Management and ORSA Model Act has been fully or substantially adopted by: ► ► ► ► ► ► ► ► Iowa Maine New Hampshire Rhode Island Vermont California The Risk Management and ORSA Model Act was considered by legislatures in other states in 2013 (CT, OH, PA, TX, VA, WY) The NAIC has advocated for full and uniform adoption of the model act by states during the 2013-14 legislative sessions Page 9 The ORSA opportunity: compliance and business value

10. Fact check How would you assess the current state of readiness at your company? A. Ready for regulatory submission B. Have all of the capabilities – just need to put the report together C. Understand the gaps and have a plan to close them D. Understand the requirements and potential gaps E. Unclear on requirements or state of readiness F. Does not apply (EY, faculty, alumni, other) Page 10 The ORSA opportunity: compliance and business value

12. ORSA overview ORSA requirements Description Page 12 • • • • • Section 2: Assessment of risk exposures • Documentation of quantitative measurements of risk exposure in both normal and stressed environments • Quantification of risk exposure under a range of outcomes using risk measurement techniques that are appropriate to the nature, scale and complexity of the risks • Detailed descriptions and explanations of the risks identified and quantitative methods used Section 3: Group risk capital and prospective solvency assessment Components Section 1: Description of risk management framework • Documentation of the combining of qualitative and quantitative elements of risk management policy • Determination of the level of financial resources needed to manage current business for the next 2-5 years • Completion of an annual group risk capital assessment, complete with a description of the approach used to conduct the analysis • Discussion of how risk and capital interrelate over various time horizons and the interplay between group risk and other capital frameworks (e.g. rating agency and regulatory) Risk culture and governance Risk identification and prioritization Risk appetite, tolerance and limits Risk management and controls Risk reporting and communication The ORSA opportunity: compliance and business value Considerations • Identify assessment tools used to monitor and respond to changes in risk profile • Explain how new risk information is incorporated • Risk quantification method is prescribed; should be consistent with way in which business in managed • Impact of stresses on capital; consider risk capital requirements, available capital, regulatory, economic, rating agency or other views of capital • Demonstrate process for model validation, including factors considered and model calibration • Capital adequacy assessment process integrated into management and decision making culture • Projection of future financial position should include economic and regulatory capital given current risk profile, management policy, quality and level of capital, considering normal and stressed scenarios

13. ORSA overview ORSA requirements map to an ERM framework Overall governance arrangements • Strategy and risk appetite • Oversight arrangements Decision and planning support • Technical pricing and value contribution is core input to product design • Metrics to identify underperforming portfolios US ORSA Report Section 1: Description of the Insurer’s Risk Management Framework Risk identification • Covers all types of risks • Identifying emerging risks Risk assessment and measurement • Single version of truth • Reflects risks presented US ORSA Report Section 2: Insurer’s Assessment of Risk Exposures Risk monitoring and management • “Industrialized” production of risk analysis Risk reporting and management information • Information to drive business decisions • Clear, concise and reflective of current status US ORSA Report Section 3: Group Risk Capital and Prospective Solvency Assessment Data, IT, infrastructure • Integration of risk and finance systems architecture • Data to be consistent, complete, accurate and auditable Page 13 The ORSA opportunity: compliance and business value Reputational Legal/ Compliance Operational Liquidity Market Credit Insurance Policies, standards, internal controls, people and culture • Clear ownership of tasks and activities • Consistent policies and standards • Robust internal controls

14. Fact check What section of the ORSA requirements is the most challenging for your organization? A. Section 1 – ERM fundamentals B. Section 1 – Risk appetite C. Section 2 – Assessment of risk exposure D. Section 3 – Group risk capital E. Section 3 – Prospective solvency assessment F. Does not apply (EY, faculty, alumni, other) Page 14 The ORSA opportunity: compliance and business value

15. Today’s agenda ► Background and regulatory update ► ORSA overview ► Industry ► perspectives Achieving long-term business value Join today’s Twitter discussion: Page 15 #EY_ORSA The ORSA opportunity: compliance and business value

16. Industry perspectives ORSA readiness No activity – attending webcast ► ORSA/ERM gaps identified, roadmaps developed/under development Active projects to close identified capability gaps Participated in second pilot – capabilities to produce full report Companies are at different levels of readiness ► ► ► ORSA working group formed – limited activity In general – healthcare industry capabilities are behind life and property/casualty Companies with favorable ERM ratings from S&P likely have many capabilities in place Several companies across life/health and property/casualty industries participated in one or both pilots ► ► First pilot allowed incomplete submissions – many submitted partial ORSA reports Second pilot required more comprehensive ORSA report and participants indicated comfort with their capabilities Some companies use ORSA as the driver for ERM enhancements that drive business value Page 16 The ORSA opportunity: compliance and business value

17. Industry perspectives ► Key ORSA implementation questions for the insurance industry ► ► ► ► ► Page 17 For an insurance group with multiple insurance legal entities or with different types of business (e.g., both Life and P/C), should they prepare a single or multiple ORSA reports? What will the final report look like, what information should be included and what is an appropriate report length? How will all the information for the report, which will likely come from multiple business units, be pulled together effectively and efficiently? If capital is viewed through multiple lenses/bases (e.g., RBC, economic capital, rating agencies capital), should all of these be included in the report? What other stakeholders (e.g., rating agencies, external auditors) will want to receive a copy of the report? The ORSA opportunity: compliance and business value

18. Fact check What measurement approach do you plan to use for section 3 of the ORSA (the prospective solvency assessment)? A. Risk based capital B. Rating agency capital C. Existing economic capital approach D. New economic capital approach E. Does not apply (EY, faculty, alumni, other) Page 18 The ORSA opportunity: compliance and business value

19. Industry perspectives ► Section 1 - much of the industry has put an ERM framework on paper for the organization, but evidence of use and effectiveness remains inconsistent Industry perspective ► Most companies feel comfortable that current capabilities meet most of the requirements of Section 1 of the ORSA Guidance Manual ► Certain companies that have very immature ERM programs need to formalize their framework in place to cover all components ► Common capability gaps ► Risk appetite ► Strong risk culture ► Evidence of risk management’s role in key decisions Governance structures in the insurance industry are very different than other financial services companies ► Independent CRO reporting to CEO/Board ► Separate risk committee of the Board Page 19 Implementation challenges The ORSA opportunity: compliance and business value ► Companies continue the struggle to directly link risk appetite and limits/tolerances across key risk types ► Definition of the risk appetite to incorporate quantitative measures requires the adoption of a consistent quantitative measure of risk ► Consistent implementation of ERM framework across the group – specifically different countries and industries (e.g. P&C vs. Life)

20. Industry perspectives ► Section 2 - calls for the quantitative and qualitative assessment of risk exposures in normal and stressed conditions Industry perspective ► Current risk assessment is dependent on risk taxonomy ► ► ► In general, life companies are less focused on operational risk Common capability gaps ► Comprehensive risk inventory with quantitative and qualitative assessments ► Implementation challenges Consistent metric across risk types In general, P&C and Health companies are less focused on investment/market risk Companies that have moved towards an economic capital framework have a more mature quantitative approach in place ► Determining how to perform the assessment under “stressed” conditions when the metric may already be under a “stress” (e.g., economic capital may be defined as a 1 in 200 year stress) ► Building a more robust approach for both qualitative and quantitative assessment of broader range of operational risks The ORSA opportunity: compliance and business value Difficult due to lack of exposure data ► Page 20 ► Even more quantitative approaches require significant approximations

21. Industry perspectives ► Section 3 - includes two complex components group risk capital calculation prospective solvency assessment ► ► Industry perspective Common capability gaps ► Generally viewed as most complex component of ORSA Guidance Manual ► Complex groups typically don’t have a group risk capital calculation ► Was not typically part of a good ERM framework ► Capabilities to project future income statement and balance sheet under stressed conditions incorporating new business Implementation challenges ► Flexibility provided by the Guidance Manual leaves many question unanswered Apprehension exists with regards to the ultimate use of this section by regulators ► Page 21 Capabilities to project future capital requirements – in particular under internally developed measurement framework Used to require additional capital? ► ► Accounting differences across geographies and product lines increase difficulty in relying on existing frameworks ► Comprehensive views of future balance sheets under required accounting regime (Stat, GAAP, Economic) ► Approaches for calculating future required capital components for calculation intensive balances (e.g., future projections of stressed market value of liabilities) ► Incorporation of multiple capital frameworks to model future distributions of excess capital ► ► ► Reliable aggregation of financial statements across legal entities Used to compare companies? The ORSA opportunity: compliance and business value

23. Achieving long-term business value ► Link to ERM ► ► ► ► Page 23 The flexibility around the ORSA report and Guidance Manual minimize the “compliance” nature of the requirement ORSA compliance shouldn’t be a standalone item – but rather a way to push ERM capabilities forward The ORSA Guidance Manual is looking to formalize and document a robust ERM framework; the value to an organization comes from the value of ERM The ORSA requirement should push an organization to use and show evidence of their ERM program working when undertaking complex decisions The ORSA opportunity: compliance and business value

24. Achieving long-term business value ► Value from a strong ERM program ► ► ► ► ► ► Page 24 Improves focus on risk and further establishes the “tone at the top” Provides an independent challenge and review of key information, assumptions and business practices, allowing the ability to escalate issues Helps to improve decision making through increased rigor and standard / structured processes, as well as the ability to understand financial impact based on stress events Enhances collaboration with business units and leadership to identify emerging risks, understand current plans to address and focus on the future Improved executive level discussions about risk and strategic decision making Enhances the external stakeholder (rating agencies, policyholders, peer organizations) perspective of the organization resulting in improved opportunities for growth The ORSA opportunity: compliance and business value

25. One-minute recap Page 25 The ORSA opportunity: compliance and business value

26. Resources ► ► ► ► ey.com/us/insurance ORSA and ERM: Use the upcoming compliance deadline to boost existing ERM practices http://bit.ly/13lrRi5 ORSA readiness: The time is now (pdf) http://bit.ly/14gLIxg Connect with us ► Page 26 EY_Insurance The ORSA opportunity: compliance and business value

27. Contact us James Collingwood Ernst & Young LLP +1 312 879 6306 james.collingwood@ey.com Chad Runchey Ernst & Young LLP +1 212 773 1015 chad.runchey@ey.com Bill Spinard Ernst & Young LLP +1 703 747 1070 bill.spinard@ey.com Adam Walter Ernst & Young LLP +1 312 879 6031 adam.walter@ey.com Follow us on Twitter: Page 27 @EY_Webcasts The ORSA opportunity: compliance and business value

28. How do I get my CPE certificate? ► At the end of the webcast, complete the feedback ► ► Click on the URL in the slide window or click on the red feedback icon Then, click on the purple CPE icon to download your certificate ► Page 28 To download a certificate after this console has been closed, please visit ey.com/webcasts in about a week. The on-demand version of this webcast will contain your certificate. The ORSA opportunity: compliance and business value

29. Connect with us Follow on Twitter: @EY_Webcasts Watch on YouTube: Search on EY Webcast Page 29 The ORSA opportunity: compliance and business value

30. Viewing tips Disable your pop-up blockers now! If you are having trouble, press the ‘F5’ key Need more help? ► ► Page 30 Click the yellow question mark for a help/tips document Click the red QA icon to request immediate assistance The ORSA opportunity: compliance and business value

31. Viewing tips Slide size: ► Click to make larger ► Click again to reduce Media player volume Slide download Related links CPE/CE certificate: launch at end of webcast Help/tips Feedback form Page 31 The ORSA opportunity: compliance and business value

32. Receiving CPE/CE credit ► To be eligible for CPE/CE credit, you must meet all of the minimum eligibility criteria: ► ► ► ► ► ► Participate for a minimum of 50 minutes to start earning credit Respond to ALL polling questions Submit feedback Webcast technology automatically determines whether participants qualify for credit based on the eligibility requirements above Certificates will be available for qualified non-EY participants’ to print at the conclusion of the webcast by clicking on the purple CPE icon at the bottom of this interface EY participants’ awards will be posted in your CPE history within 10 business days Page 32 The ORSA opportunity: compliance and business value

33. If you are participating in a group ► Each person who logged in to the webcast should: ► ► ► ► Register for and log in to the live webcast Respond to the required number of poll questions Complete the feedback form At the end of the webcast, the group leader can: ► ► Print certificates for ALL qualified participants by clicking on the purple CPE icon at the bottom of this interface Or, complete the CPE/CE attendance sheet available on the Thought Center Webcast site and include all requested information ► ► Page 33 Submit the attendance sheet within 72 hours of the completion of the webcast by email to tcw.efaxdocs@ey.com Certificates will then be emailed to participants The ORSA opportunity: compliance and business value