Presented by: G. Lawrence Buhl, CPA Retired Audit Partner at Ernst & Young 1 Risk Management & ERM: What Insurer Boards Need to Know

Responsibilities of the Board of Directors 2 Fiduciary Counsel Mission Oversight

3 Strategy Policy Governance Tactics Risk Tolerance Oversee Or Establish?

Risk 4 Management’s job-assess & manage risk exposures The Board-ultimate responsibility to oversee risk Board Committees-can be delegated specific oversight responsibility for selected risks Enterprise Risk Management

Risk Management 5 Standards Controls Limits Guidelines Policies Discipline Framework Definition Inventory Evaluation

Risk Inventory 6 Interest rate Counterparty Finance Operational Liquidity Reputation Accounting Compensation Capital Governance Underwriting Product & Pricing Regulatory Legal Reinsurance Extreme events Credit Loss management Vendor Investment Servicer/Manager IT security IT strategic IT implementation IT operations Compliance Cybersecurity People Market conduct Business Continuity Ratings Financial Reporting

The ERM Process 7 Risk Appetite Statement Risk Inventory Key Risk Identification and Risk Level Evaluation Inherent Risk Assessment Residual Risk Profile Identify Risk Owners—1 st Line of Defense Develop Key Risk Indicators Formalize the 2 nd Line of Defense Establish Reporting Vehicle to Sr. Mgmt & Board Develop Guidelines for Independent Review

What Can Go Wrong 8 ALM Collectability Loss Environment Litigation Liquidity Lapses Catastrophes Concentrations Outsourcing Expertise Evolution Intercompany

What’s It Take To Oversee Risk? 9 Three Lines of Defense-where do you fit A Process Alliance with CRO/Internal Audit/Actuarial Understand the details of the Business Analysts/Rating Agencies/Insur Dept Reports What Has Been Rejected/Accepted Deep Dives (e.g., Cyber/Continuity/Reins/Models) Stress Testing/Extreme Events/Correlation Review of ORSA Project Implementation Oversight

Do You Need A Board Risk Committee? 10 How important is Risk Tolerance to the Board Oversight Responsibilities, compared to Policy, Governance, Strategy, and Tactics ? How complicated is the business? Can the Board do it? Does the Board have time and inclination? Can the Audit Committee do it? Can Other Committees do the rest?

Risk Oversight Committee 11 Risk Culture & Appetite & Process & Inventory Is Risk Management getting the right attention and priority and effort and focus? Role of a CRO? Are risks and rewards balanced and appropriate? Is the right information being provided timely and transparently and completely? To All? Are risks aligned with Capital and Liquidity?

The Risk Committee Agenda 12 Current Underwriting Existing Portfolio Compliance with Policies and Guidelines Investment and Liquidity and Capital Risks ORSA Deep Dives WCGW—the unexpected Compliance Reputation Operational

Top 10 Risks 13 Regulatory Concerns Economic Conditions Cyberthreats Succession/Recruiting Cultural Response to Risk Aversion to Change IT Security and Privacy Reputational Risk Defense Customer Preference Changes Meeting Performance Expectations