1. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 1 - The New World Order in Insurance Regulation: What Boards and Management Need to Know and Why What the Regulator is Expecting Mid-Atlantic Mutual Advantage Convention Baltimore, Maryland

2. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 2 - What is Happening in the Regulatory World There have been seismic shifts in regulatory approach by the NAIC and Insurance Departments RetrospectiveProspective CompanyEnterprise Financial StatementGovernance RulesPrinciples Regulators are expecting more Board involvement in this new regulatory approach Is your management ready?

3. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 3 - What are Regulators Looking at Now Corporate Governance – Group level as well as Legal entity level Interviews with Chairman of the Board and Head of Audit Committee as part of Financial Examinations Importance of Audit Committee NAIC Corporate Governance Annual Disclosure Model Act Enterprise Risk Management How does the process work? Is it effective? Is it used by Management and Boards? “Risk Management became Risk Justification”

4. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 4 - What are Regulators Looking at Now Own Risk and Solvency Assessment (ORSA) NAIC Guidance Manual The Proposed NAIC Model Law (first one due in 2015) NAIC Pilot Program Control Environment Board’s need to take on more responsibility Effective or not Boards need to make certain representations to Insurance Departments within Amended Holding Company Law

5. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 5 - What are Regulators Looking at Now (Cont’d.) Capital Management How is this done by Management and Boards Effective or not Group Capital (ORSA) Strategic Management Does the Board have a plan?

6. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 6 - Risk Management Initiatives Form B –Annual registration statement new requirements: Financial statements of holding company Statement that the insurer’s board of directors is responsible for and oversees corporate governance

7. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 7 - Risk Management Initiatives New Form F—Enterprise Risk Report Annual confidential supplement identifying material risks within the insurance holding company system that could pose financial and/or reputational contagion to the insurer (enterprise risk management) Form F shall provide information regarding the following areas that could produce enterprise risk: Any material developments regarding strategy, internal audit findings, compliance or risk management affecting the insurance holding company system; Acquisition or disposal of insurance entities and reallocating of existing financial or insurance entities within the insurance holding company system; Any changes of shareholders of the insurance holding company system exceeding ten percent (10%) or more of voting securities;

8. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 8 - Risk Management Initiatives New Form F—Enterprise Risk Report Developments in various investigations, regulatory activities or litigation that may have a significant bearing or impact on the insurance holding company system; Business plan of the insurance holding company system and summarized strategies for next 12 months; Identification of material concerns of the insurance holding company system raised by supervisory college, if any, in last year;

9. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 9 - Risk Management Initiatives New Form F—Enterprise Risk Report Identification of any negative movement, or discussions with rating agencies which may have caused, or may cause, potential negative movement in the credit ratings and individual insurer financial strength ratings assessment of the insurance holding company system (including both the rating score and outlook); Information on corporate or parental guarantees throughout the holding company and the expected source of liquidity should such guarantees be called upon; and Identification of any material activity or development of the insurance holding company system that, in the opinion of senior management, could adversely affect the insurance holding company system.

10. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 10 - Risk Management Initiatives ERM Framework Description of the Risk Management Policy Quantitative Measurements of Risk Exposure in Normal and Stressed Environments Group Risk Capital Assessment Prospective Solvency Assessment Who is required to File (Exemptions) ORSA will be unique for each company Evergreen Approach to ORSA Group or Legal Entity Level Own Risk and Solvency Assessment (ORSA) proposal

11. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 11 - Risk Management Initiatives Risk Management and Own Risk and Solvency Assessment Model Act Vehicle that will be used to require the ORSA Summary Report to be filed Will provide for confidentiality provisions Lead State Concept Effective date-1/1/2015 (Will you be ready??)

12. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 12 - Risk Management Initiatives ORSA Key Questions What is our strategy? What level of risk are we willing to assume in pursuit of this strategy? What are the key risks that could hinder our ability to achieve our strategy? How much capital do we need to cover those key risks? What risks—individually or collectively—would subject us to losses that exceed our tolerance levels? What risk scenarios would cause us to fail or stop operating as a going concern?

13. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 13 - Risk Management Initiatives How will Regulators use the ORSA? Details to be worked out Reviewed Company’s ORSA Summary Reports that were submitted voluntarily in 2012 and 2013 Should fit like a glove with our Risk Focus Exam Process Rating Agencies want to know about your ERM Process and I am sure your ORSA/Regulators want to know what Rating Agencies are thinking Quality ORSA and ERM starts with governance and ends with quality of your data

14. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 14 - Risk Management Initiatives What can smaller companies take away from all of this? It is scalable Has your management thought about this

15. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 15 - Why are Regulators Doing This? It is a better regulatory process-looking out of the front of the car window (prospective risk) then looking out of the back window. AIG-Reputational Risk/Group Risk My International Friends (EU, IAIS, G-20)

16. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 16 - What Boards Should Be Doing About All This Change Get educated Set up a Risk Committee of the Board Should we hire or designate a Chief Risk Officer (CRO Council of North America) Is the Board receiving proper Risk Summary Reports from Management

17. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 17 - What Boards Should Be Doing About All This Change (Cont’d.) How does the Board know that the Company’s ERM System is working AIG-Derivatives operation JPMorgan Chase $2B trading loss (Now $5.8B) UBS-Rogue Trader How do we learn from the ERM failure?

18. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 18 - What Boards Should Be Doing About All This Change (Cont’d.) Boards need more individuals with an Insurance Regulatory Background-Where do we find them? Should the CEO and Chairman of the Board be split roles? Is your Board receiving updates on Regulatory Issues (Regulatory Risk)? Has your Board ever thought about inviting your Domestic Regulatory to one of your Board Meetings?

19. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 19 - Concluding Thoughts from your Regulator: Boards Can Never Fall Asleep

20. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 20 - What Can Happen if a Board is Asleep at the Switch Information discussed today and the new regulatory model is to prevent Boards from falling asleep Boards should never stop getting educated and asking the right questions What questions were never asked by Boards in the past that should have been: Why are we always reserving at the low end of the actuary’s range? Why are our reserves always deficient? Why does our actuary not give the Board a presentation?

21. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 21 - Questions (Cont’d.) Why do we take so much risk on our investments? How do we know we are pricing right? Why do we do business with reinsurers we never heard of? What are we doing about our RBC being below 300%? How often do we waive our underwriting standards? Why are we using an accounting firm we never heard of? Why are we expanding so fast?

22. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 22 - Questions (Cont’d.) Why did we get into a new line of business? Do we need to change management? What is our future? Insolvency

23. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 23 - Solvency Update

24. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 24 - Solvency Update Low insolvency level (low severity also) 7 straight calendar years (2005-2011) without an insolvency of a Pennsylvania domestic insurer First Time in 64 Years! Last Liquidation of a P/C PA domestic: 7/28/2003 Last Liquidation of a Life PA domestic: 7/2/2004 Companies saved in PA since 1997: 102 Streak ended on February 8, 2012-First Sealord (a surety only company) placed into liquidation GAO Report (June 2013)-States did a great job during meltdown

25. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 25 - Insolvencies 200820092010201120122013 P & C3710121513 L & H5 (1 caused by economic crisis) 10 (1 caused by economic crisis) 3323 Title202001 Fraternal000100 Total1017151617

26. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 26 - Number of Bank Failures YearBank Failures 200825 2009140 2010157 201192 201251 201324 Source: FDIC Failed Bank List www.fdic.govwww.fdic.gov

27. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 27 - Low interest rate environment CATS Reserve adequacy ComFrame Group supervision Regulatory Change Execution of Regulatory Change The many things that keep me up at night The Future of Reinsurance Affordable Health Care Act Feds getting more involved Run-off companies Long-term care insurance Regulatory talent Cyber Risk Can I make it to retirement

28. What Boards & Management Need to Know and Why August 4, 2014 Stephen J. Johnson, CPA, Deputy Insurance Commissioner Office of Corporate and Financial Regulation - 28 - Questions?