ERM Risk Regime and IFRS17

Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Fundamentals of Insurance and Enterprise
Risk Management

Agenda
The agenda for our presentation is:
1. Foundational concepts of insurance
2. Introduction to ERM- core concepts
3. Qualitative aspects- risk register
4. Quantitative-capital modeling

The price of an insurance product is the combination of:
cost of insurance (loss-cost) + other factors
Expected/Burning cost = frequency * severity
Premium = expected cost/(1-loadings)
For example, frequency =5%, severity= $ 136,000. loadings = 30%
Expected/Burning cost= 5%*136,000= $ 6,800
Premium= 6,800/(1-30%)= $ 9,714
Cost of Insurance :
 The cost of insurance is a function of risk exposure.
 We only know risk exposure (lives exposed, the car value, the property value etc)
in advance, at the time the product is sold, not the actual claim cost. This is
because claims might or might not occur and the amount of claims is not known
in advance as well.
 The risk exposure, although depends on the nature of the product, is generally
known as:
-The assets exposed to loss (Car, property..etc)
-The cause of possible loss (Fire, Theft,..etc)
-The financial consequences of loss (Loss of income, legal liability..etc)

Depending on the nature of product, the factors that may
have direct & significant impact on the loss-cost are:
For Medical,
• Age & Gender
• Coverage & Benefits Limits
• IP
• OP
• Maternity
• Dental & Optical
• Plan & Network
• Deductible & Co-Insurance
For Marine,
• Insured Type
• Means of Transport
• Origin and Destination
• Commodity & Material
• Sum Insured
• Clause Type
For Motor,
• Driver Profile (Age, Gender..)
• Car Profile (Make, Model..)
• External Factors
• Type of Coverage (TPL..)
• Sum Insured
For Travel,
• Age
• Destination
• Travel Duration
• Sum Insured
• Coverage & Benefits

Acquisition Cost
Reinsurance Arrangement
UW Expense
Admin Expense
Margins/Loadings

The need to acquire technical skills… Why
acquire technical skills…?
Make a judgment and quote
1% , 2%....of Risk Exposure
Claim may
or may not
happen
End
If Large
Claim
Incidence
Happens
If survive
then
continue
….
OR
Judgment could
be based on
past experience
or market trend
…..

Try make sense out of historical experience ……
Analyze Claim Experience and Estimate Insurance Cost Using practical
scientific techniques.
….Quantify the Risk…. Calculate the Odds and
keep improving the experience…

• If company does not know its true-price needs, then it cannot
know if the price dictated by the market is sufficient to
produce its planned or target returns.
• If the market dictated prices are too low, the company must
know what other actions (e.g. changes in underwriting rules,
product mix, segmentation, marketing emphasis or claims
handling) are necessary in order to produce the planned
results.
The Optimum Strategy :Top-Down Approach

Competitive behavior of market cannot force an
insurance company to price its product consistently
below the ‘actual cost-of-insurance’ over a longer
period…
Price adjustment is required on technical bases;
otherwise the losses will erode the captial
Over
capitalization of
the companies
causes irrational
market
competitive
behavior

Different Distribution Channel
Different Reinsurance Arrangement
Different Business & Product Mix
Different Claims Handling Practice
Different Target for Returns and Target Market-segment
It is important to understand that every company has a different structure.
The competition or market competitor could have:
TechnicalStreetPrice
Rationalize the
Approach and Strategy

“From Technical Price to Street Price”
Combining Technical Pricing with Market Intuition
“ Why be divided into actuary VS management, when together, we can
achieve so much more?

•The actuary of this generation is not an isolated rocket scientist who has
nothing of value to deliver to the ground realities of the management.
•It is a well known fact that markets are not entirely efficient, and following
what the market dictates without proper consideration can lead to numerous
consequences that the company could not have foreseen.
•That is why our motto is “learn globally, apply locally”; and to build-in
solutions that are tailored made for the specifics of the insurance company’s
experience, while taking account of the market as well.
•The result is that instead of actuaries going in one direction, and the
management in another direction, both can join heads to achieve powerful
competitive advantages.
•The marketing department can generate the required data mentioned
ahead, which the actuary can use to reveal potent insights. It’s a win-win
situation for all.
The Powerful Merger of technical and street price

•First step is to generate relevant data; for instance, for motor insurance,
make a list of all the clients and potential clients that the company has sent
quotations to and the price given, and the premium ultimately accepted by
the policyholder. Whole data should be available which shows which
quotations were successful and which were not as well.
•Along with these, mention all the rating factors as well such as age, gender,
type of vehicle etc for each quotation sent.
•A GLM (Generalized Linear Model) can be built into this data to generate the
price elasticity of demand.
How to achieve this combination?

•Price Elasticity of demand simply the responsiveness of the quantity
demanded, i.e, sales to change in price.
What is Price Elasticity of Demand?

•Hence, we can know that what price ‘makes’ the sale for a particular
customer profile and what price ‘breaks’ the sale for a particular customer
profile. For example, we can numerous observations and insights such as
quantitatively assessing that men are less sensitive to increase in price, those
with non-luxury cars are more sensitive to price changes, customers who are
single are less sensitive to price changes then married customers and so on.
•This will allow the specific experience of the insurance company in the
market to be taken into account. We would be no more shooting blanks in the
dark based on market prices that are made by companies with different
situations than ours, neither are we basing it on entirely actuarial cost-based
prices that might be difficult to sell in the marketplace.
•We are revealing insights into the market from our data and knowing where
it would be profitable to increase prices and where it would not be. This
would result in Price Optimization; the precise element need to maximize our
objectives.
What are the benefits of this combination?

Underwriting and it’s holistic connections
• It is clear that underwriting, pricing and reserving are all interlinked and share the
same fortunes. Moreover, the business objectives & planning, insurance cycles and
risk management situates these three interlinked functions in their proper context
as illustrated below:
•risk
management•capital
adequacy
•insurance
cycles
•business
objectives
underwriting pricing
claims
experience
reserving

• Regarding underwriting, there are usually tiers like preferred risk, normal risk, adverse
risk and declined risks. The business strategy defined how much proportion of business
should be targeted for each of these tiers. The business strategy might be that it is a
new company and so has plenty of capital available; it will aim to establish market share
and so will usually try to except adverse risks and quote at lower premiums than other
competitors. This is directly linked to claims and reserves; for instance, if we are
underwriting undue proportion of old age members for health insurance than it will be
no surprise to see high loss ratios.
• The insurance cycle also plays its role; in soft markets there will be pressure to sustain
market share and profitability will be reduced. In hard markets, the insurer can be more
ambitious in terms of new products, focusing on profitability and so on. Lastly, a firm on
the brink of non-compliance with minimum solvency standards set by the regulator
cannot afford to be more ambitious than the company which has ample unappropriated
profits and capital.
• Likewise, reserving for Premium Deficiency Reserve (PDR) and pricing are interlinked.
The pricing exercise will be given a clear signal to increase prices if the reserving shows
that PDR is required because premiums are not adequate enough to cover the risks
undertaken. Similarly, if we compare actual claim experience to expected reserves held
to cover these, and there arises a negative shortfall, than pricing needs to see whether
the premium assumptions on loss ratios, expenses etc. were appropriate or not.

• The underwriting results are obviously a function of reserves (and especially claims
reserves). These should be separately reviewed in actuarial reserving report and
satisfaction obtained that the reserves set out are adequate.
• Having low prices for capturing market share alone is not an appropriate
justification because it underprices the risk that is actually being underwritten. The
pricing report can determine a set of net rates (i.e., net of loadings for
commissions, expenses and profits) are low relative to the rates observed in the
market and still be justified. This can be due to a pricing strategy of risk avoidance,
where the underwriters utilize policy terms which included sizeable deductibles,
increasing deductibles in cases of risk which experienced multiple claims within a
calendar year, and other surcharges to discourage risks that are not attractive in
the eyes of the underwriter.
• In aggregate, current net book rates for normal group business can appear
adequate when compared to the underlying claims experience but significant
cross-subsidies can exist between the book rates of the various products within
the current rating structure.
• With this holistic framework, the company has to decide on the appropriate
groupings to undertake; for instance, long tailed and short tailed, commercial
personal insurance, conventional takaful and so on.

Introduction to ERM
Building the Basics

Introduction to ERM
“Enterprise risk management is a process, effected by an entity’s board of directors, management and
other personnel, applied in strategy setting and across the enterprise, designed to identify potential
events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable
assurance regarding the achievement of entity objectives”. (Source: ‘COSO Enterprise Risk
Management Framework.’)
The term ERM implies some sort of process- not just the management of risk itself, but the broader
approach of:
• Recognizing the context
• Identifying the risks
• Assessing and comparing the risk with the risk appetite
• Deciding on the extent to which risks are managed
• Taking the appropriate action; and
• Reporting on and reviewing the action taken
ERM is not just a one-off event that is carried out and forgotten. It is an ongoing process with constant
monitoring where the results are fed back into the process.

Introduction to ERM
If we can anticipate everything that can go wrong and prepare for it, we will be prepared for the
unanticipated. In other words, despite all the risk management preparation that we do, we may not
have that exact scenario come to pass. But our general state of preparedness will reduce our reaction
time, and our response to any risk management variation will be superior to our competitors. ERM
Emphasizes the Relationship Between Risk and Value and is:
• Not just focused on preventing the erosion of value and reducing risk to target levels
• looks at the role ERM has in creating, preserving and realizing value
• Viewed as integral to strategy setting and Identifying opportunities that create value

Introduction to ERM
Insurance companies do not become insolvent due to having
vulnerable balance sheets. As insurance is the business of risk
taking so there are always vulnerabilities that have the potential
to cascade and develop into a larger crisis. This vulnerability is
kept in balance by risk management and market confidence.
ERM is all about a holistic viewpoint and an integrated
viewpoint. That goes beyond a ‘siloed’ approach to looking at
risks, but it's not intended to replace the specialized approach. It's
about coordinating the specialized perspectives. It's also not just
about mitigating risk. It's about leveraging opportunities within a
particular risk appetite.
In short, the goal is not just to become better forecasters, but
better evolvers.

Introduction to ERM
Benefits of ERM
The sole purpose of implementing ERM Framework within the company’s operations
and management is to link each and every action to the long-term strategic objectives
from risk perspective. This can lead to risk-controlled management of the business and
allow the company to sail towards its objectives successfully and cater for any
upcoming risks. Enterprise risk management enables management to operate more
effectively in a business environment filled with fluctuating risks. Enterprise risk
management provides enhanced capability to:
• Align risk appetite
Risk appetite is the degree of risk, on a board-level, that a business is willing to accept
in pursuit of its objectives. Management considers the business’s risk appetite first in
evaluating strategic alternatives, then in setting boundaries for downside risk.
• Minimize operational surprises and losses
Businesses have enhanced capability to identify potential risk events, assess risks and
establish responses, thereby reducing the occurrence of unpleasant surprises.

Introduction to ERM
• Enhance risk response decisions
ERM provides the rigor to identify and select among alternate risk responses – risk removal,
reduction, transfer or acceptance.
• Resources
A clear understanding of the risks facing a business can enhance the effective direction and use of
management time and the business’s resources to manage risk.
• Identify and manage cross-enterprise risks
Every business faces a myriad of risks affecting different parts of the organization. The benefits of
ERM are only optimized when an enterprise-wide approach is adopted, integrating the
disparate approaches to risk management within the company. Integration has to be effected
in three ways: centralized risk reporting, the integration of risk transfer strategies and the
integration of risk management into the processes of a business. Rather than being purely a
defensive mechanism, it can be used as a tool to maximize opportunities.

Introduction to ERM
• Link growth, risk and return
Businesses accept risk as part of wealth creation and preservation and they expect return
commensurate with risk. ERM provides an enhanced ability to identify and assess risk
and establish acceptable levels of risk relative to potential growth and achievement of
objectives.
• Rationalize capital
More robust information on risk exposure allows management to more effectively assess
overall capital needs and improve capital allocation
• Seize opportunities
The very process of identifying risks can stimulate thinking and generate opportunities as
well as threats. Responses need to be developed to seize these opportunities in the same
way that responses are required to address identified threats to a business.
ERM adoption leads to improved business performance, increased organisational integration
& effectiveness and better risk reporting.

Introduction to ERM
It is important to understand the structure of an insurance company to place risk review in context.
Capital adequacy is the core of the insurance company while financial performance is the outer
covering which is subject to profit and losses and variance in results. Risk management is the
connecting bridge that integrates these two systems so that they act in unison and synergy to
achieve management objectives. The main tenants of this notion can be captured as follows:

Thinking about Risk Selection in Health Insurance
Applying ERM in Practice

Health Insurance and ERM: Diverse Perspectives
Example is better than concept!

Risk Selection: Health Insurance and ERM
There are many flavors of medical insurance.
Each has its own risks and risk modeling issues.
Rate competition is almost always fierce with
very thin profit margins.
So the validation of cost management strategies
is integral to a company's ability to compete.
Regulatory risk, litigation risk, and reputation risk
are not only issues, but they can also fold back
on themselves. Not only can litigation create
financial problems, but it can also create
operational issues with our provider network.
These risks may exacerbate each other

In health, clients often want to have as many claims as
possible. We are living longer which means that proportion of
old people in total population is increasing. Morbidity is
getting worse every year (increase in health issues, modern
diseases, chronic prevalence). Health claims are subjective;
your claim entitlement is what you want it to be. group lives
are very seldom underwritten. There's little information
about the people you're covering on the health side.
For group medical, claim volatility is quite high (esp. in small
sized groups). Profit Margins are very thin as a percentage of
premium. Premiums aren’t guaranteed. we don't guarantee
coverage for any long period of time, so we don't have much
risk there. Claims are short-tailed. There is some catastrophic
risk too.

Types of Claims by Severities
Normal claims Large claims
Catastrophic
claims both man
made and natural

Large claims due to man made catastrophes or concentration of
risks. For example, fire at mall injuries from that. Hotel fire like the
recent one in Regent Plaza. Parking lots explosions in office
buildings. Explosion in a factory causing multiple injuries.
Terrorism events injuring scores of people.
Other examples are increase in morbidity due to malaria, dengue,
zika, chikungunya, congo virus especially during winter and eid ul
azha. Dengue is a huge problem especially in Karachi and Punjab.
Diseases created after catastrophes are major problems too like
diseases after flood, earthquake or droughts. Karachi had a
heatstroke in 2015; even if we exclude mortality that group life
pays, morbidity increased for the heatstroke as well.
ERM prescribes to transfer such large claim risks to reinsurers in
the form of Excess of Loss (XOL) treaties (instead of quota
treaties). This will stabilize our claims and earning patterns.

Expanding further, there are other parameters that the company should give due
attention to. These are group insurance and individual insurance, agents or
bancassurance and takaful or conventional health insurance. Jumbo groups are more
capital intensive than small groups and individual medical insurance generally, groups
have higher concentration risks than individuals but greater economies of scale,
bancassurance is sensitive to banking boom and busts and takaful is a different
business model than conventional where wakala fees, participant takaful fund,
shareholder fund, mudarib fees, qard-e-hasan create different dynamics than those
for conventional health insurance.
Underwriting parameters are crucial too and can lead to further insights into the
insurance portfolio, especially with the advent of big data and data science. A
detailed description of such parameters are Age profile of the portfolio, smoker or
non-smoker; size of group ; occupation; designation cadres; type of premium
payment frequency; ( annual provide regular liquidity whereas single premium
provides lump sum quantity that boosts the company but also no further liquidity for
the future and no prospect of increase in premiums) sum assured and benefits
covered like riders, income, education, cultural orientation; family members insured;
dependents age profile; distribution channel and so on. Don’t be surprise if this year
we aggregate the census sheet and see that old population has increased
significantly from last year. Expect higher losses by default in such situations.

Smaller companies with personal general insurance like medical insurance have
shorter tail line which means that they have an immediate demand for cash outlay
and, therefore, do not have the option to seek capital infusions, exit troublesome
lines of business, implement rate increases, or pursue merger opportunities. Liquidity
risk is hence quite prominent here.

Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Risk
Governance
ERM
Control
Cycle
Risk
Regime
Risk
Types
Risk
Reporting
Risk
Treatment
5. Risk
Tolerance
1. Risk
Mitigation
4. Risk
Controls
2. Risk Profile
3. Risk
Appetite
ERM
Framework
Risk
Register
Capital
Model
Strategies
in Place
Proactive
Leadership
Risk
Identification
Risk
Assessment
Risk
Management
Risk
Monitoring
Risk
Modification

Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Risk
Governance
ERM
Control
cycle
Risk
Regime
Risk
Types
Risk
Reporting
Risk
Treatment
1. Risk mitigation; the way we aim to contain our risks.
2. Risk Profile: the broad parameters a firm considers in executing it
business strategy in its chosen market space.
3. Risk Appetite: the level of uncertainty a company is willing to
assume given the corresponding reward associated with the risk. A
company with a high risk appetite would be a company accepting
more uncertainty for a higher reward, while a company with a low
risk appetite would seek less uncertainty, for which it would accept a
lower return.
4. Risk controls: the procedures in place to minimize our risks.
5. Risk Tolerance: a stated amount of risk a company is willing and/or
able to keep in executing its business strategy – in other words, the
limits of a company’s capacity for taking on risk.

Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Risk
Governance
ERM
Control
cycle
Risk
Regime
Risk
Types
Risk
Reporting
Risk
Treatment
The following elements are necessary in order to have a risk regime in
place in the company:
1. ERM framework
2. Risk Registers
3. Capital model
4. Various strategies in place for each important function
5. Proactive leadership; risk culture from the top

Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Risk
Governance
ERM
Control
Cycle
Risk
Regime
Risk
Types
Risk
Reporting
Risk
Treatment
Risk Identification: This is the first step
in any risk management exercise.
company should define and record all
risks in a consistent manner.
Risk Assessment: Considering
qualitatively and/or quantifying risks in
the context of their risk appetite.
Capital modeling should be done to
measure risks in the risk context
provided by risk registers.
Risk Management: This implies
managing ongoing treatment of the
risks.
Risk Monitoring: This involves
continuous recording, review and
reporting of risks, losses and
effectiveness of treatments.
Risk Modification: Approaches have to
be altered as business and risk
environment changes.

Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Risk
Governance
ERM Control
cycle
Risk
Regime
Risk
Types
Risk
Reporting
Risk
Treatment
ERM Control Cycle: Recommendations
A common pitfall we have observed is that the ‘Monitoring’ stage is
given least importance. Investments are done for making risk
models and implementing them after long time intervals. However,
risk models are not monitored in day to day activities of the
management.
This is mostly because models , in general, are seen as regulatory
burden and there is little or no attempt at changing the culture
through which risk is assessed.
The consequence of inadequate monitoring is that it breaks all the
other steps in the control cycle as well. Only if there is appropriate
monitoring can we judge whether circumstances have changed or
not and whether we need to revise our identification and so start
the whole process again.

Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Risk
Governance
ERM
Control
cycle
Risk
Regime
Risk
Types
Risk
Reporting
Risk
Treatment
Risk Governance Structure
B.O.D
Risk Management
Committee
Internal Control / Risk Management
Department
Head of Functions / Risk Champions
Risk Owners

Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Risk
Governance
ERM Control
cycle
Risk
Regime
Risk
Types
Risk
Reporting
Risk
Treatment
• Regular review and re-assessment of all risks along with business
performance review should be performed.
• Documentation of all important strategies is also required. Aside
from regulatory concern, documentation is a good form of
governance as it provides adequate audit of risks, records decisions
& actions and encourages continuous ERM implementation.
Regular
Discussions and
Timely reports to
RM committee
RM committee
Reports to Board
of Directors
Promotion of risk
culture, training of
employees and ERM
committee reports to
Board risk and audit
committee

Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Risk
Governance
ERM
Control
cycle
Risk
Regime
Risk
Types
Risk
Reporting
Risk
Treatment
Risk Treatment
The Insurance business by its nature involves significant level
of operational risk. However, the insurer should adopt the
following strategy for treating such risks:
• Tolerate Risk: Develop an automated trigger to initiate
action when risk trend is nearing the set risk appetite;
• Transfer Risk: Develop and implement reinsurance
strategy to transfer the internal risk to third party;
• Treat Control Risk: Identify and assess the existing control
to manage risk; and
• Terminate Risk: Terminate the risk in instances where it
cannot be mitigated by developing & implementing an exit
strategy and updating the business plan.

Risk Registers
Uncovering the
Universe of Risks!
Qualitative
Aspects
Quantitative
Modeling
Risk
Treatment
Residual
Risk
Inherent
Risk
What is a
Risk
Register?
Core Concepts

What is a Risk Register?
• Risk register is a compilation of all the risks exposed to the company, from day-to-
day operational activities to company’s business strategy and objectives. Risk
identification is carried out on horizontal and vertical structures of the company in
order to fully capture existing and potential risks into the risk universe.
• The purpose of completing a risk identification exercise is to identify, discuss and
document the risks facing the company. The risk register serves three main
purposes:
• It is an information source to report the key risks throughout the company, as well
as to stakeholders.
• Management can use the risk register to focus their priorities.
• It helps the auditors to focus on the company’s top risks.
We would recommend evaluating risks at two levels:
• inherent risk rating, i.e. before management controls have been considered, and
• residual risk rating, i.e. the gross risk rating combined with an assessment of management
controls.
Qualitative
Aspects
Quantitative
Modeling
Risk
Treatment
Residual
Risk
Inherent
Risk
What is a
Risk
Register
Core Concepts

What is a Risk Register?
The management should assess risks on the basis of the likelihood
(Frequency) of the risk occurring and the impact of its occurrence
(Severity) as follows:
Risk = Likelihood x Impact or
Risk = Frequency x Severity
Likelihood/Frequency represents the possibility an event will occur;
impact/severity represents its effect on the company. In the process of
risk assessment, the company should consider its “risk appetite,”
broadly defined as the amount of risk that an entity is willing to accept
in pursuing its objectives. Higher the risk, higher is the priority of
addressing it, in order to keep within the risk appetite of the company.
Qualitative
Aspects
Quantitative
Modeling
Risk
Treatment
Residual
Risk
Inherent
Risk
What is a
Risk
Register
Core Concepts

Inherent Risk
Inherent Risk Rating Before Management Control
Inherent risk is intrinsic to every business activity and arises from exposure and uncertainty from
potential events. Inherent risks are evaluated by considering the probability of occurrence and
the potential size of an adverse impact on the company’s capital and earnings. Inherent risk
involves considering the likelihood and impact of the risk in the absence of any management
control interventions.
This level of assessment provides a perspective of the consequences of the risk to the company
in the absence of controls to prevent an event from happening. Inherent risk is categorized as:
• Very high: Unacceptable level of risk. Take urgent action to mitigate the risk to an
acceptable level
• High: Identify and evaluate additional steps to mitigate the risk to an acceptable level
• Moderate: Consider actions that may improve the tradeoff between risk (with its associated
reward) and cost
• Low: Keep risk and control under review
• Very low: No action required
Qualitative
Aspects
Quantitative
Modeling
Risk
Treatment
Residual
Risk
Inherent
Risk
What is a
Risk
Register
Core Concepts

Inherent Risk
Likelihood (Frequency)
The probability or likelihood of an event is
• Highly probable: The risk is already occurring, or is likely to occur more than once within
the specific duration, subject to management decisions.
• Likely: The risk could easily occur, and is likely to occur at least once within the specific
duration, subject to management decisions.
• Possible: There is an above average chance that the risk will occur at least once within
the specific duration, subject to management decisions.
• Unlikely: The risk occurs infrequently and is unlikely to occur.
• Rare: The risk is conceivable but is only likely to occur in extreme circumstances.
Impact (Severity)
The impact of each likelihood event is categorized as:
• Critical: Negative outcomes or missed opportunities that are of critical importance to
the achievement of objectives
• Major: Negative outcomes or missed opportunities that are likely to have a relatively
substantial impact on the ability to meet objectives
• Material: Negative outcomes or missed opportunities that are likely to have a relatively
moderate impact on the ability to meet objectives
• Minor: Negative outcomes or missed opportunities that are likely to have a relatively
low impact on the ability to meet objectives.
Qualitative
Aspects
Quantitative
Modeling
Risk
Treatment
Residual
Risk
Inherent
Risk
What is a
Risk
Register
Core Concepts

Inherent Risk
Inherent risks can be found by the probability and severity of the risk from the table below:
Perceived Controls Effectiveness
After identifying the impact and likelihood of each risk it is RMC’s responsibility to check whether
controlling that particular risk is possible for the company. This will be done by identifying the
personnel/officers/staff involved in the activity/operation related to that risk area.
After applying the current controls of management, effectiveness will be assessed as:
• Very Good: Risk exposure is effectively controlled and managed.
• Good: Majority of risk exposure is effectively controlled and managed.
• Satisfactory: The controls are at satisfactory level, there is some room for improvement.
• Weak: Some of the risk exposure appears to be controlled, but there are major deficiencies.
• Unsatisfactory: Control measures are ineffective and need urgent attention.
Qualitative
Aspects
Quantitative
Modeling
Risk
Treatment
Residual
Risk
Inherent
Risk
What is a
Risk
Register
Core Concepts

Residual Risk
Residual Risk Rating after Management Control
Residual risk is the level of risk remaining after the mitigating influences of the existing control
interventions are considered. Normally, management would introduce sufficient controls to
reduce the risk to within a pre-determined level, as per the risk appetite of the Company. The
residual risk is a critical indicator of whether the existing controls are effective in reducing the
risk to an acceptable level.
• Very High: Unacceptable level of residual risk – Implies that the controls are either
fundamentally inadequate (poor design) or ineffective (poor implementation). Controls
require substantial redesigning, or there needs to be greater emphasis on proper
implementation.
• High: Slightly better than Very High.
• Medium: Unacceptable level of residual risk – Implies that the controls are either
inadequate (poor design) or ineffective (poor implementation).Controls require some
redesigning, or there needs to be more emphasis on proper implementation.
• Low: Mostly acceptable level of residual risk – Requires minimal control improvements.
• Very Low: Slightly better than Low.
Qualitative
Aspects
Quantitative
Modeling
Risk
Treatment
Residual
Risk
Inherent
Risk
What is a
Risk
Register
Core Concepts

Residual Risk
The table below shows how Residual Risk Rating of the
company can be calculated from the inherent risk of the
business and its perceived control effectiveness:
Residual Risk Perceived Control Effectiveness
Exposure Insignificant Minor Material Major Critical
Probability
Highly
Probable Medium High High Very High Very High
Likely Low Medium High High High
Possible Low Low Medium Medium Medium
Unlikely Very Low Low Low Low Low
Rare Very Low
Very
Low Very Low Very Low Very Low
Qualitative
Aspects
Quantitative
Modeling
Risk
Treatment
Residual
Risk
Inherent
Risk
What is a
Risk
Register
Core Concepts

Risk Treatment
There are a number of options available for treating risks. These
should be considered on the basis of a cost/benefit analysis:
• Avoid the Risk: This can be done by deciding not to start or
continue with a particular activity that gives rise to the risk.
However, the business objectives must always be kept in mind
and inappropriate risk aversion may increase other risk areas.
• Reduce the Likelihood and Impact: This may be achieved by
introducing more preventive and corrective measures by having
policies and procedures.
• Accept the Risk: Where risks are identified as unavoidable or no
suitable treatment plans are available, company should accept
the risk.
• Transfer the Risk: This involves other parties bearing or sharing
the risk either partially or in full. This may be through
reinsurance arrangements, contracts, partnerships and/or joint
ventures.
Qualitative
Aspects
Quantitative
Modeling
Risk
Treatment
Residual
Risk
Inherent
Risk
What is a
Risk
Register
Core Concepts

Capital Modeling- Quantitative Considerations
Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Main
Consider
ations
Main
Outputs
Stress
Testing
Basic
Construct
Pricing
Risk

Capital Modeling- beyond the numbers
As insurance is inherently a promise to
cover contingent costs in the future, it
is imperative to have adequate capital
in the present to cover for these
obligations. Capital held not only
provides financial security and
confidence to the company and the
consumers but it also provides
necessary capitalization so that minor
inconsistencies or shortfalls do not
transmute into bigger crises.
Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Main
Consider
ations
Main
Outputs
Stress
Testing
Basic
Construct
Pricing
Risk A major tool to ensuring capital adequacy is capital modeling.
Capital modeling is an extensive exercise that aims to deliver an
opinion of the capital adequacy of an insurance company given the
external conditions, internal tendencies and decisions which a
company adopts.

Capital Modeling
An ever increasingly
important part of capital
modeling is taking extreme
events into account.
Catastrophe modeling, stress
testing and scenario analysis
as well as business
contingency plans are used to
take extreme events into
account.
Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Main
Consider
ations
Main
Outputs
Stress
Testing
Basic
Construct
Pricing
Risk

Capital Modeling
Basic construct of a capital modeling can be described as
follows:
• Comprehensive understanding of the various assets and
liabilities of the company. Deep understanding of risk
typologies and connecting these two together to formulate
exposure levels as well as identify various vulnerabilities
and risks faced by the company.
• Once the qualitative assessment as well as risk registers
have been chartered, it is time to operationalize these
concepts into quantitative and readily testable numeric loss
functions. Risk factors are combined, exposures are
merged with probabilities and assets and liabilities are
stressed in a number of scenarios to check the robustness
of the portfolios of the insurance company. Stress testing is
a must-have tool for handling and preparing for the ground
realities due to uncertain economic conditions becoming
quite frequent.
• Required capital figures are generated which are capable in
sustaining majority of the stressed scenarios and selected
through appropriate setting of risk metrics such as Value at
Risk or Tail Value at Risk.
Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Main
Consider
ations
Main
Outputs
Stress
Testing
Basic
Construct
Pricing
Risk

Risk Registers
Material Risk Profile
Key Risk Indicators
Risk Control Cycle
Company Data
Strategies
Capital Modeling
Stress Testing and
ORSA
Internal Modeling
Inputs OutputsProcess
Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Main
Consider
ations
Main
Outputs
Stress
Testing
Basic
Construct
Pricing
Risk

Investment Portfolio Risk Based Capital Requirement
60% 35%
Equities Bonds
Key RatiosMovement in Gross Premiums
90%
85%
65%
40%
Loss Ratio
Capital
Adequacy
Retention
Ratio
Reserves as % of
Premiums
Investment
Risk
Market
Risk
Reputational
Risk
Underwriting Risk
Main Outputs of a Capital Model and Risk Dashboard

Main Outputs & Results
Percentiles
AmountsinPKR
Eligible Capital
Minimum Capital Required
Solvency Capital Required
Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Main
Consider
ations
Main
Outputs
Stress
Testing
Basic
Construct
Pricing
Risk

Challenges in ERM implementation
• Making ERM mandatory is a double edged sword. This is the biggest challenge we have
seen in our experience. A company does not bother to do it, so regulator makes it mandatory.
But with making it mandatory, it comes to be seen as a regulatory burden rather than exercise
in learning more about the business and the risks it faces.
• ERM does not come on its own. When there is a focus on strategy making, then as part of
those initiatives, ERM starts getting attention, too. So if we want to make ERM more
commonplace, we should propagate strategy making and corporate governance further.
• Breaking down silos. Silos are not perceived as a disadvantage by a company’s
management and are deliberately made so that no one function or department has the whole
data and to prohibit the holistic data and its massive power going into another’s hands through
any form. We should acknowledge that we are aware of this criticism and that is why holistic
data is only given to few top posts in the risk hierarchy with adequate safeguards and controls
in place.
• It is extremely difficult to break traditional hierarchies. In traditional hierarchies, there is
no risk department or Chief Risk Officer (CRO) at a director post. Establishing a Risk
department is seen as an additional cost that does not generate any direct revenues. Top
leadership might not take a proactive approach to building risk culture in the organization
which might lead to other functions seeing risk management as additional work burden instead
of delivering any value addition.

Culture
Level
Soft Facts
Organizational
Level
90%
Risk Culture is Everything in ERM!
Hard Facts
10%
Top leadership Board of
Directors driven
initiative is key to
establishing Risk Culture
and subsequently ERM

Stress Testing
The realistic side of stress testing also shows that practically stakeholders do not
withhold action until the entire share capital has evaporated to react to an insurance
company under stress. Their actions are preemptive while they can still reclaim some
of their investments. So despite the stress testing showing insolvency in for example,
4 years, the realistic bankruptcy will usually likely occur much sooner.
a
b
Financial
Projections of
Balance Sheet
and Profit & Loss
Realistic
future
Stressed
future
Current
Year
Next Year Next to
Next Year
Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Main
Consider
ations
Main
Outputs
Stress
Testing
Basic
Construct
Pricing
Risk

Main Considerations: Capital Modeling
In tranquil times, statistics and measurement are important but
in crises, economics and management are more important.
Risk management is about thinking creatively of scenarios, not
just following the output of a model as risk management is
ultimately about survival and not profits and losses.
Insurance companies should break away from traditional data
stores and experience the liberation afforded by the new
technologies. Advanced actuarial applications, Data science,
big data, machine learning, deep learning and so on has
brought about revolution in analytics that previously could not
be thought possible of. If companies are not that adventurous,
they can try the technologies in parallel.
Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Main
Consider
ations
Main
Outputs
Stress
Testing
Basic
Construct
Pricing
Risk

Situating pricing risk in its proper context
Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Main
Consider
ations
Main
Outputs
Stress
Testing
Basic
Construct
Pricing
Risk

Pricing Factors affecting insurance prices
We need to develop scoring factors, risk inventories, risk measurements, and early warning
signals. For example; if total census sheet shows old people have materially increased than
last year, then expect higher losses. We need business continuity plans if stressed events
come into reality.
A recent study by PricewaterhouseCoopers examining the drivers of rising health care costs
in the U.S. pointed to increased utilization created by increased consumer demand, new
treatments, and more intensive diagnostic testing, as the most significant. People are also
living longer. The population of countries is aging, and a larger group of senior citizens
requires more intensive medical care than a young, healthier population. Advances in
medicine and medical technology can also increase the cost of medical treatment. Lifestyle-
related factors can increase utilization and therefore insurance prices, such as: increases in
obesity caused by insufficient exercise and unhealthy food choices; excessive alcohol use,
smoking, and use of street drugs.
Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Main
Consider
ations
Main
Outputs
Stress
Testing
Basic
Construct
Pricing
Risk

Pricing is an exercise in complex systems. There are a myriad of complex features in action
simultaneously and despite our best predictive modeling, it can have low predictive power beyond
a reasonably short period of time. But while predicting the macro- structures upon which to base
ratemaking upon can be less effective, we can train our approach, our tools and our management of
ratemaking to be better evolvers rather than better predictors alone.
There is a traditional trade-off between what is known as homogeneity and credibility, where the
actuary must decide how finely to divide up the databases available. One reason that there is an
almost infinite variety of actuarial models is that each model necessarily incorporates an element
of judgment or intuition or speculation in the definition and weighting of probable future events.
We should be aware that precision implies confidence. We must be very alert to not fall into this
trap of surgical precision. While point estimates are often required (we have to quote and file a
specific premium), there are many cases where ranges of estimates are more appropriate. While
statistical techniques can sometimes be used to generate precise confidence intervals, mostly
statistical rigor is not possible or even necessary for many general insurance risks. By discussing a
range of estimates, actuaries can provide more value to their stakeholders by painting a more
complete picture of the potential impacts of decisions related to emerging liabilities.
Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Main
Consider
ations
Main
Outputs
Stress
Testing
Basic
Construct
Pricing
Risk

Underwriting cycle
The general insurance actuary cannot ignore the role the underwriting cycle has to play
when pricing medical liabilities. This is not life insurance. While Property-Casualty
insurance is quite competitive, it has its share of collective irrationalities and unintended
consequences of actions as well. The winner’s curse is where insurer continuously quote
low premiums in a bid to gain greater market share. They then suffer heavy losses when
claims start erupting and the premiums and hence reserves are inadequate to cover them.
Given that there are pricing wars raging in medical insurance, this curse is the order of the
day.
Excessive competition over prices to secure greater market share leads to eventual
worsening of underwriting performance. Executives eventually decry this trend in
publications like surveys and trade magazines as well as in conferences. This signals to
the market that higher prices need to be insisted upon now. It may take only a few market
makers to raise prices as they are well established and source of comparison and
transparency for all of the industry. Following this, every other insurer follows suit in
raising premiums.
Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Main
Consider
ations
Main
Outputs
Stress
Testing
Basic
Construct
Pricing
Risk

Another reason for underwriting cycles is identified by Fitzpatrick (2004)
as due to the “ebb and flow of bureaucratic influence" among different
departments within an insurance company. Different departments have
different roles, functions and objectives. Insurance companies are
ultimately composed of individuals and their judgment affects pricing
decisions and this itself drives the cycles on insurance markets.
Underwriters have the upper hand in profitable times and they push prices
down to maximize sales and revenue. The more risk cautious claims
adjusters and actuaries are more powerful at times when the insurer is in
financial distress; they lobby to raise prices to restore profitability.
In simple words, greed is promoted in times of greed and fear is adhered to
in times of fear.
Core Concepts
Qualitative
Aspects
Quantitative
Modeling
Main
Consider
ations
Main
Outputs
Stress
Testing
Basic
Construct
Pricing
Risk

Integrating ERM into the DNA of the
Company: Conclusion & Way Forward

Embedding ERM within the
organization and ensuring that it
is part of the DNA of every
strategic and operational
decision hinges on people and
culture. This includes connecting
with a diverse stakeholder
community.
Conclusion & Way Forward
DNA
DNA

An organization is only as strong as the weakest link across its value chain.
The health insurer must take the broadest view of its own value chain and
how and who it interfaces with. This is enabled by an exhaustive analysis of
the insurer’s value chain and the development of appropriate risk
management processes
Conclusion & Way Forward
Each department and important function will be required to populate the risk
registers. This qualitative documentation will allow us to highlight the top risks
faced to the company for the attention of the board.
DNA

ERM health insurance
practitioners need to build a
culture and business processes
which value learning from the
people within the insurer’s
stakeholder community:
Learn from the people
Plan with the people
Begin with what they have
Build on what they know
Of the best leaders
When the task is accomplished
The people all remark
We have done it ourselves
Source: Taoist sage, Lao-tzu.
People
Integrity
Expertise
Final Words and Conclusion
DNA
DNA

ERM Risk Regime and IFRS17

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to ERM Risk Regime and IFRS17

Similar to ERM Risk Regime and IFRS17 (20)

Recently uploaded

Recently uploaded (20)

ERM Risk Regime and IFRS17