The notion of a risk appetite has been around for many years. However, it has tended to be a relatively high-level concept, with few insurers having comprehensively rolled it out into business as usual.
Now, the way risk appetite is formulated and applied within the business is changing as it comes to be seen as one of the key links between risk and reward. It is extremely difficult for an insurer to make the right decisions, demonstrate that it understands its exposures and ensure that it is managing them appropriately if it cannot articulate how much risk it seeks to take and how much risk it is able to take.
Risk appetite is a foundation requirement of Solvency II. There are around 20 separate references to risk appetite in the framework directive and consultation papers. They touch on almost every aspect of the business, ranging from risk modelling and measurement, through management information, and right into the heart of strategy in areas such as product development and market communications.
In turn, analysts and rating agencies are keeping a close eye on insurers’ risk appetites and how they are applied. The ability to articulate risk appetite and show how it is aligned with the overall objectives of the enterprise is therefore a key part of communicating a clear and convincing case for investment.
Analysts and rating agencies are not just looking at how much risk the business wants to run, but also how risk appetite influences management decisions. These factors are seen as a useful indicator of an insurer’s risk culture and the extent to which risk awareness permeates through the business.
Committee of Sponsoring Organizations of the Treadway Commission (COSO) [1]
Rather than being the maximum amount of risk an insurer can bear (‘risk capacity’), risk appetite sets out the parameters of risk that a company would choose to assume to deliver a target return. While these boundaries are clearly an important element of running the business safely, they can also help firms to capitalise on opportunities. If everyone is clear about how much risk the business is prepared to take, it makes it easier to respond swiftly and decisively to market openings and judge where, when and how to expand.
So how do you bring risk appetite into business as usual? The short answer is to create something that affects decisions and drives management actions. What this means in practice is that risk appetite has to be tangible and relevant to risk takers on the ground.
As Figure 1 outlines, the process of formulating the risk appetite and embedding it into decision making can be broken down into four distinct elements. The guiding group statement should ideally align the strategic objectives of the business with the expectations of key stakeholders, including shareholders, debt holders, policyholders, regulators and rating agencies.
1 ‘Strengthening enterprise risk management for strategic advantage’, published by Committee of Sponsoring Organizations of the Treadway Commission (COSO) in April 2009.
Clearly, the perspectives of the various stakeholders may differ. For example, debt holders are primarily concerned with the risk of default, while shareholders are looking to achieve a target return and balance the risks within their particular portfolio.
Key strategic considerations include which markets the company wants to operate in and where it wants to position itself in relation to its competitors. Ideally, these assessments should not only look at the company’s preference for particular risks, but also where it is best able to manage them.
This group statement is often articulated across four dimensions:
1. Capital
2. Earnings
3. Liquidity
4. Reputation
These combine quantitative criteria such as the required capital buffer or acceptable level of earnings volatility with qualitative expectations in areas such as operational control and customer protection. A clear example of how this articulation of risk appetite could be used to drive decisions would be in helping to judge whether the business should moderate/reinsure certain exposures or conversely that it has unused capital that could be deployed to take more risk.
The next stage is integrating the firm-wide risk appetite into divisional planning and creating limits and thresholds to apply it on the ground. In translating the high-level statement into individual risk or business unit limits, it is useful to consider what drives risk and value in each risk or operation and how this affects the risk profile of the business as a whole. It is also important to look at how the risk profile might develop and then set ‘soft’ limits (amber signs requiring closer monitoring/mitigation) and ‘hard’ limits (red signs requiring cessation and remediation).
Risk appetite cannot influence management action in itself. Comprehensive monitoring and real-time management information will be required to ensure the risk being assumed is in line with the overall appetite and business unit limits. It is also important to establish clear escalation procedures to anticipate, detect and respond to breaches in the risk limits.
To provide a more informed basis for decision making and to meet the demands of the Solvency II ‘use test’, it is vital that risk appetite is fully embedded into key business processes from the outset (see Figure 2). This is not about exercising a veto over what boards or business teams do; rather it is about fostering a sensible senior management debate about how much risk is acceptable and setting benchmarks against which the actual risk profile and risk-based performance can be monitored, judged and modified.
A tangible and actionable risk appetite is vital in both protecting the business and enabling it to capitalise on opportunities. It will also be a crucial part of meeting the use test under Solvency II.
Creating a viable risk management framework is a dynamic process. Companies will get better at articulating and managing their risk appetite as it becomes more embedded within decision making and more useful in the running of the business.
www.pwc.com
© 2010 PricewaterhouseCoopers. All rights reserved. "PricewaterhouseCoopers" and "PwC" refer to the network of member firms of PricewaterhouseCoopers International Limited (PwCIL). Each member firm is a separate legal entity and does not act as agent of PwCIL or any other member firm. PwCIL does not provide any services to clients. PwCIL is not responsible or liable for the acts or omissions of any of its member firms nor can it control the exercise of their professional judgment or bind them in any way. No member firm is responsible or liable for the acts or omissions of any other member firm nor can it control the exercise of another member firm's professional judgment or bind another member firm or PwCIL in any way.