1. Risk Management Shruti D Shah FIA, CERA AIO Life Seminar 25-27 November 2015, Lomé (Togo)

2. Insurance is all about undertaking risk Isn’t risk our raison d’etre? But do we understand the true nature of the risks we face? Do we understand the true nature of our business? What level of risk is acceptable? Redefining our Core Objective

3. “ The discipline by which an organisation assessed, controls, exploits, finances and monitors risk from all sources for the purpose of increasing the organisation’s short and long term value to its stakeholders” Casualty Actuarial Society Enterprise Risk Management

4. Computers have enabled people to make more mistakes faster than almost any invention in history, with the possible exception of tequila and hand guns. Mitch Ratcliffe

5.  Internal environment is the context within which the enterprise functions  This foundation and culture sets the course for how risk will be handled  The independence and involvement of the Board and the tone set by management have a critical influence on the internal environment  The Board and senior management determines risk objectives, risk appetite, risk tolerances and agree on risk management roles and responsibilities  Enterprise Risk Management Specialty Guide Society of Actuaries Implementing ERM – Internal Environment

6. Unpacking the insurance giant's collapse.  An allegedly sham financial reinsurance contract led to forced resignation in 2005 of the long-term CEO, weakening of its share price and credit rating  Two years later large losses experienced on Credit Default Swaps within AIG Financial Products leading to large losses, loss of investment credit rating, necessitating a rescue operation by the US government Risk Management Case Studies – AIG

7. 1.Know your business 2.Establish checks and balances 3.Set limits and boundaries 4.Keep your eye on the cash 5.Use the right yardstick 6.Pay for the performance you want 7.Balance the yin and the yang - Enterprise Risk Management (LAM) – From Incentives to Controls Key Lessons Learned

8.  Risk- effect of uncertainty on objectives  Risk management - coordinated activities to direct and control an organisation with regard to risk  Risk management framework - set of components that provide the foundations and organisational arrangements for designing, implementing, monitoring, reviewing and continually improving risk management throughout the organisation  Risk management policy - statement of the overall intentions and direction of an organisation related to risk management Key risk terminologies Source: ISO, ISO Guide 73:2009, Risk management - Vocabulary

9.  Risk management process- systematic application of management policies, procedures and practices to the activities of communicating, consulting, establishing the context, and identifying, analysing, evaluating, treating, monitoring and reviewing risk  Risk appetite - amount and type of risk that an organisation is willing to pursue or retain  Risk tolerance - organisation’s or stakeholder’s readiness to bear the risk after risk treatment in order to achieve its objectives  Risk profile - description of any set of risks Key risk terminologies Source: ISO, ISO Guide 73:2009, Risk management - Vocabulary

10. Some Insurance Risks Failure of processes and people Operational risk Related to the types of insurance products underwritten Insurance risk Demonstrate that material & catastrophic risks are covered appropriately Reinsurance risks Geographically or by product Concentration risk Degree of risk inherent in the investment portfolio Market risk Holds sufficient cash to meet liabilities Liquidity risk Default of third parties & reinsurers Counterparty default risk Risks associated with being part of a larger Group Contagion risk Arising from the conduct of the (re)insurer Legal risk Arising from the (re)insurer’s business plan Strategic risk

11. Risk Management Control Cycle 2. Establish the context 3. Identify risks 4. Analyse risks 5. Evaluate risks 6. Treat risks 1. Communicate and consult 7. Monitor and review

12.  Risk identification process: Risk Identification Identify events that may impact achievement of objectives What might be the effect on the objectives? When might this risk occur? Who might be involved or impacted? What? When? Who?

13.  Risk identification tools:  Checklists  Review of previous loss records  Flowcharts  Brainstorming sessions  Interviews  Facilitated workshops  Systems analysis  Use of the Risk Universe (taxonomy)  Risk register  Consider minimum risks required by the regulator Risk Identification

14. Risk Analysis Identifying controls currently in place Assessing the effectiveness of current controls Identifying the likelihood of the risk occurring Identifying the potential consequence/imp act Components Risk analysis componentsEvaluating existing controls Consistency of application Understanding control content Documentation of controls Possible evaluation processes Control self-assessment Internal audit review External audit review

15.  Risk evaluation process Risk Evaluation Rank risks Consider the overall risk profile (“reasonability check”) Develop list of priority risks Consequence rating 5 4 3 2 1 12345 Likelihood rating Risk Heat Map Ranking methodology “Reasonability check” on results

16.  Risk treatment process Risk Treatment Identify treatment options Select treatment option Assign treatment option Prepare treatment option Possible options: Avoid the risk Change the likelihood Change the consequence Share/transfer the risk Retain the risk Cost – benefit analysis Assign to responsible person for delivery Determine: Responsibilities Realistic due date Performance measures

17. How do we define high performance from an insurer’s perspective? Paradigm Shift: Managing for High Performance

18.  Identify all risks  Formal consideration of all facets of business  How and Why risk can occur?  “What if” considerations?  Quantify the risk  Source  Consequence and severity  Likelihood  Sensitivity analysis Risk Management Strategy (1)

19.  Evaluate the risk  Rating – qualitative and quantitative analysis  Consider controls or treatment  Risk treatment – weigh up the risk and  Retain  Avoid  Reduce likelihood of occurrence  Reduce the consequences  Transfer the risk (eg reinsure)  Establish controls Risk Management Strategy (2)

20.  In respect of risks retained:  Ensure capital is provided to cover risk  Price properly for the risk  If the market cannot bear the price, avoid the risk  Scenario test  Be wary of combinations of events  Be wary of undercutting without appreciating impact on overall business  Ensure all parties are aware of risks being undertaken  Ensure coordination between all parts of business  Continually review  Integrated approach is key to successful ERM Risk Management Strategy (3)

21.  Will all this help?  Beating the odds through a disciplined, rigorous approach to insurance business management based on a proper understanding of the business  Risk/reward optimisation  Risk preparedness  Effective enterprise culture  Competitive advantage  Isn’t this what our core business all about?  Isn’t this what high performance is all about? Paradigm Shift: Managing for High Performance The only alternative to risk management is crisis management - and crisis management is much more expensive, time consuming and embarrassing

22. Thank you

23.  This document has been prepared for use by clients of Alexander Forbes Financial Services (EA) Limited. Any other third party that is not a client of Alexander Forbes Financial Services (EA) Limited and for whose specific use this document has not been supplied, must be aware that Alexander Forbes Financial Services (EA) Limited shall not be liable for any damage, loss or liability of any nature incurred by any third party and resulting from the information contained herein. The information contained herein is supplied on an "as is" basis and has not been compiled to meet any third party’s individual requirements. It is the responsibility of any third party to satisfy himself or herself, prior to relying on this information that the contents meets the third party’s individual requirements.  Nothing in this document, when read in isolation and without professional advice, should be construed as solicitation, offer, advice, recommendation, or any other enticement to acquire or dispose of any financial product, advice or investment, or to engage in any financial transaction or investment. A third party should consult with an authorised financial advisor prior to making any financial decisions.  Alexander Forbes has taken all reasonable steps to ensure the quality and accuracy of the contents of this document and encourages all readers to report incorrect and untrue information, subject to the right of Alexander Forbes to determine, in its sole and absolute discretion, the contents of this document. Irrespective of the attempts by Alexander Forbes to ensure the correctness of this document, Alexander Forbes does not make any warranties or representations that the content will in all cases be true, correct or free from any errors. In particular, certain aspects of this document might rely on or be based on information supplied to Alexander Forbes by other persons or institutions. Alexander Forbes has attempted to ensure the accuracy of such information, but shall not be liable for any damage, loss or liability of any nature incurred by any party and resulting from the errors caused by incorrect information supplied to Alexander Forbes. Disclaimer