31, Implementing ERM

Question 1

What is proportionality?

Answer 1

Framework appropriate to one org (eg small motor insurer) not appropriate to diff one (e.g. global composite insurer), i.e., one size doesn’t fit all

Question 2

What is the Pareto principle?

Answer 2

 For ERM to add value, RM activities must feed through into action
 Take decisions based on data, info and analysis
 80% must be in data collection, analysis and reporting/ 20% in decision making. But 80% of value of ERM is due to informed decision making

Question 3

What are the 4 key questions you must ask if you want ERM to be implemented successfully

Answer 3

• Governance structure and politics – who’s responsible for risk oversight and critical RM decisions?
• Risk assessment and quantification- how (ex-ante) will they make decisions?
• Risk management- decisions to be made to optimise risk/return profile?
• Reporting and monitoring- how (ex-post) will decisions be monitored

Question 4

What are the 3 stages of ERM implementation

Answer 4

1. Loss reduction- protect against downside losses
2. Uncertainty management
3. Performance optimisation - use in decision making

Question 5

Outline controls that may be used as a form of loss reduction

Answer 5

o Credit controls – reduce P(default) and maximise recovery
o Investment + liquidity policies – minimise portfolio losses + ensure liquidity, by perhaps adopting lower-risk investment policies
o Other internal controls – reduce probability and severity of operational losses
o Audit processes- ensure finances in order
o Insurance coverage – risk transfer to 3rd parties

Question 6

Outline controls to manage uncertainty/volatility?

Answer 6

o Credit models- better understand credit risk, predict and make provision for losses
o Market measurement and management techniques – e.g., simulation models, measurement tools incl. VaR and economic capital
o Increased management of operational risks, esp. crisis management + prevention
o Improved corp gov policies
o Wider application of risk transfer- derivatives, sophisticated insurance products, ART

Question 7

Outline three business activities to optimise performance

Answer 7

o Active credit risk portfolio management – pricing for risk and disaggregating credit business into distinct activities
o Active balance sheet management – consider all A+L to optimise risk/reward trade-off
o Re-engineering processes to minimise operational risk and better understand + reduce costs

Question 8

What are some challenges with ERM implementation?

Answer 8

1. Promoting risk awareness
2. Implementing a culture change

Question 9

What are some strategies to promote risk awareness?

Answer 9

• Set tone from top -CEO act as role-model
• Ask right “risk” questions:
  o Return/risk balance
  o Limits and controls to minimise downside risk
  o Systems
  o Knowledge
• Ensure common risk taxonomy
• Induction and ongoing train
• Link compensation to tisk to reward desired behaviours

Question 10

How can you implement a culture change

Answer 10

• Set tone from top
• On an incremental basis
• As profile of new recruits changes staff views

Question 11

List 4 ERM maturity models

Answer 11

1. Lam’s 5 stage ERM maturity model
2. McKinsey 4-stage ERM maturity model
3. Deloitte 5-stage ERM maturity model
4. IAA stages of ERM maturity

Question 12

What are some key questions to ask when considering ERM maturity according to IAA?

Answer 12

• Board- what is their role?
• Risk appetite- how well is it defined, reviewed and communicated?
• Risk management policy- how comprehensive is it?
• Management accountabilities- how clearly are they defined?
• Management commitment and leadership – how committed is management to ERM?
• RMF- what responsibilities and resources does it have?
• Risk “language” – how well developed and documented is it?
• Risk management culture- how well developed is it?
• Performance management and reward systems- how well aligned with ERM are they?
• Risk and solvency assessments – how sophisticated are they?
• Reporting and monitoring processes and systems- how comprehensive are they?
• Internal audit of compliance with risk management policy- how comprehensive is it?
• New activities- to what extent are RM techniques applied?
• Business continuity plans / analysis- how comprehensive are they?