Emphasis: Risk Appetite: A Boundary for Decisions

By Linda Chase-Jenkins and Ian Farr     

For many insurers, defining their risk appetite now ranks high on the list of priorities in response to the external demands of rating agencies and regulators as well as the growing need to incorporate enterprise risk management (ERM) in strategic decision making. Standard and Poor’s (S&P) in particular has been a leading proponent of the use of ERM in strategic decision making, insisting insurers provide a clear articulation of risk appetite as a foundation.

In addition, important regulatory solvency frameworks, including the Individual Capital Adequacy Standards (ICAS) in the U.K. and the emerging Solvency II program in Europe, are requiring insurers to explicitly consider their risk appetite and to build it into their risk management processes. So, what is this thing called risk appetite?

THE DIMENSIONS OF RISK APPETITE

Defining an organization's risk appetite requires a clear articulation of its preferences for risk taking. This covers a number of aspects:

• the nature of the risks to be assumed (market risk, insurance risk, etc.) — often referred to as the organization’s risk strategy
• the amount of risk to be taken on
• the desired balance of risk versus reward.

An organization's risk appetite also needs to be articulated in a way that satisfies the interests of all the organization’s key constituencies — policyholders, shareholders, debtholders, regulators, rating agencies, management and employees. Each of these has a different perspective on risk and will look for different things in the risk appetite statement. For example, policyholders are primarily concerned that their policy benefits will be paid, whereas shareholders are primarily concerned with the risk to the value of their stock.

Thus, a statement of risk appetite will have multiple dimensions and include numerous metrics to address the varying interests of a wide range of stakeholders.

SETTING THE BOUNDARIES FOR RISK TAKING

A statement of risk appetite provides the reference point against which to benchmark all risk taking and risk mitigation activity within the organization, defining boundaries within which risk-based decision making can occur.

In evaluating the ERM capabilities of insurers, S&P looks at whether risk appetite has been clearly articulated and whether processes have been set up to ensure that the organization keeps within that defined appetite. More specifically, S&P looks at what constraints are placed on management decisions across the organization to ensure that the aggregate risk profile of the organization does not violate the defined risk appetite.

Systems and processes also need to be in place to enable assessment of all key metrics for the decisions being taken. These systems will, however, reflect the nature of the decisions and the time frames available for making them. For example, asset/liability management decisions often have to be made quickly, but do lend themselves to statistical analysis. With appropriate systems, risk metrics can be assessed with some precision for alternative strategies. On the other hand, decisions to start or expand operations in emerging markets are much more difficult to assess statistically and require a more qualitative approach.

Those companies rated "strong" and above by S&P need to have shown that they understand and have articulated their risk appetite, and have developed a process to translate this articulation into individual risk limits, taking into account the risk-adjusted returns for the various alternatives. The risk appetite statement thereby helps direct decision making toward the areas where the organization has the greatest chances of high returns, for example, through its sources of competitive advantage.

While the risk appetite statement needs to set the boundaries for risk taking, it is the role of risk-based performance measures to facilitate the final selection of one course over another in a risk-adjusted environment. A key objective of ERM is to maximize overall returns for the risks taken. To do so, the risk appetite needs to be well defined in terms of specific risks and a desired risk profile so that returns are maximized within the articulated risk appetite.

ADDRESSING THE INTERESTS OF KEY CONSTITUENCIES

An organization’s appetite for risk will affect a wide range of interested parties, each with very different interests.

• Shareholders are looking for return on their investment and are therefore interested in the risk exposure of the value they have locked up in their stock. Shareholder value has a number of components, including the net asset value of the organization, the value of its in-force business and its franchise value. All of these are at risk from the shareholder perspective.
  
  Shareholders care, for example, about the risk of loss of product distribution capability just as much as loss of tangible assets. Some shareholders have a long-term, value-based focus; others may have a need to realize value in the near future and hence are more concerned by short-term stock price movements.
  
  Moreover, shareholders are interested in all aspects of the statistical distribution of risk. This includes the upside opportunities as well as the downside risks and how they balance. It also includes the shape of the risk distribution (e.g., the potential for occasional extreme losses versus more routine mild variability) and the nature of the risks undertaken.
  
  Shareholders also need a clear understanding of the risk profile of the organization (e.g., credit, market or insurance risk) so they can make informed decisions as to how the company’s risk profile fits within their own investment portfolio structure.
  
  
• Policyholders are risk-averse — that is why they have taken out insurance. They are looking for security of payment of the contractual benefits under their policies. They are therefore concerned about the organization’s level of capital and how the business will be managed over the term of their policies to ensure that their benefits can be paid when due.
  
  Typically, policyholders are thus only interested in the ability of the company to cope with extreme downside risk — they are not usually interested in the upside possibilities. However, where policies involve discretionary bonuses or dividends, policyholders do also have an interest in the upside returns, at least to the extent they have a reasonable expectation to receive a share in them.
  
  Finally, in contrast to shareholders, policyholders are relatively insensitive to the nature of the risks undertaken. They care little whether it is market or insurance risk that puts their benefits in jeopardy.
  
  
• Debtholders have a similar interest to policyholders, although for them it is only the shareholder capital protecting their interests. Like policyholders, they are protected primarily by the capital held by the organization, but also by its future profitability and by the risk management framework and practices of the organization.
  
  
• Regulators act primarily as representatives of policyholders, albeit focused more on ensuring a minimum base level of capitalization across the industry than establishing the higher standards that provide competitive advantage to the stronger companies.
  
  
• Rating agencies also act as representatives of policyholders, but are also concerned with debtholders.
  
  
• Management and employees are also interested in the organization’s risk appetite, as it is they who have to make decisions involving organizational risks — and are consequently exposed to the adverse outcomes of those decisions.

ASSEMBLING THE ASPECTS OF RISK APPETITE

The need to balance the concerns of a number of interested parties, as described above, means that a comprehensive definition of risk appetite will involve multiple aspects of risk and multiple risk measures, covering the nature and amount of risk and the risk/reward balance.

In considering each of these aspects, it should be noted that external risk transfer techniques such as hedging, reinsurance and securitization are available to complement internal options to help shape the net risk profile of the organization. Considering these techniques and options, a company can gain access to business opportunities which, on a gross basis, would fall outside its target net risk appetite.

Nature of Risk
The nature of risk to be taken on, often referred to as the organization’s risk strategy, is a key component of the risk communication between the organization and its shareholders. Since it is primarily the shareholders who are interested in the nature of the risk, it will be risk compared to total shareholder value that is important here, covering the risk to the franchise value as well as to the net assets and in-force business value.

The nature of unhedged risks retained will be shaped by the organization’s view of the strategic opportunities available (e.g., lines of business, sizes of risks, geographies) and its sources of competitive advantage, both from existing capabilities and those that it can realistically build. It is the organization’s risk strategy that ensures that its capital remains allocated to those risks where it can utilize its competitive advantage.

A risk strategy might well also include a target mix of risks designed to achieve adequate diversification. Organizations with significant scale and a variety of operations (for example, multinational insurers and reinsurers) have a natural advantage with their ability to efficiently retain diversifiable risk on their balance sheets. Regulators and rating agencies permitting, the capital they need to hold against this risk can, through diversification, be significantly lower than that required by smaller, more specialized players.

Organizations also need to remember that their shareholders can access many market risks directly and often with greater control over the nature of that risk. Justification, in terms of competitive advantage, therefore needs to be provided for assuming market risk indirectly on behalf of shareholders.

Amount of Risk

All parties have an interest in the amount of risk that an organization assumes and more particularly in the amount of risk it retains (after risk mitigation and transfer strategies have been effected). However, the nature of constituent interest differs markedly:

• Policyholders, debtholders and their representatives in the form of regulators and rating agencies are primarily interested in risk appetite statements that limit the probability of, and the extent to which, the organization might default on its liabilities. These will necessarily concern the extreme adverse tail of the risk distribution — typically, events occurring with probabilities in the range of 1 in 200 to 1 in 2,000.
• Shareholders, while not disinterested in the probability of default to policyholders and debtholders (when the value of shareholders' stock falls to zero), assume that regulation and rating agency attention will make this a very remote possibility. Shareholders will therefore focus more on the swings in value that occur closer to the center of the distribution. These might involve, for example, limiting risk to avoid the probability of a rating downgrade, with its consequent loss of franchise value, or the probability of incurring a quarterly loss. Care is needed in developing such statements so that they genuinely represent the shareholders' interests, not solely those of management (see exhibit).
  
  
  

Risk/Reward Balance

The final aspect of risk appetite is the target risk/reward balance of the organization. While all organizations will seek to achieve at least a minimum level of reward for risk — typically that implied by market prices, where available — most will also set a target premium above this level for all investments. Organizations setting a higher premium will reject potentially value-adding (but lower) return opportunities and focus their capital on those investments offering high returns. This will tend to focus the organization closely on its competitive advantages for managing the risks associated with high-return investments; this aspect of risk appetite is therefore closely associated with risk strategy.

Organizations setting a lower risk/reward premium will be able take on a wider range of opportunities, thus potentially building a larger organization, albeit one with a lower return on capital.

ROLE OF RISK APPETITE BOUNDARIES AND METRICS

Implementation of ERM requires a transition from traditional silo-based assessment of various types of business risks to a systematic, integrated management of all business risks together. Risk appetite defines the boundaries for an ERM system by addressing individual and combined risks from the varied perspectives of a firm's key constituents, using appropriate measurement metrics and analysis methodologies. Historically, regulators and rating agencies have accepted traditional risk management programs where they are found to be reasonably effective. They are now increasingly insisting on more integrated programs founded on well-articulated statements of risk appetite, if they are to grant recognition of the lower capital requirements achieved through effective risk management. Therefore, a clear risk appetite statement will soon become a competitive necessity.

 

For comments or questions, call or e-mail Linda Chase-Jenkins at 1-212-309-3897,
linda.chase-jenkins@towersperrin.com or Ian Farr at 44-20-7170-2395, ian.farr@towersperrin.com.