The role of the risk professionThe role of the risk profession in a Solvency II worldin a Solvency II worldA (personal) view(p )Philip Whittingham, European Chief Enterprise Risk Officer

XL Group plcXL Group plc 22 March 2010

Session Aims

“Successful Solvency II implementation hinges on embedding risk managementhinges on embedding risk management practices across an insurance organisation and demonstrating that risk and solvency information is used in making keyinformation is used in making key decisions. But what is the unique selling point (USP) of risk professionals and how can ERM make a real different to the creditcan ERM make a real different to the credit rating of insurers?”

AgendaAgenda

Outline of Solvency II scope and timeline

Links between Solvency II and Rating Agency Expectations

ERM at the core of successful implementationERM at the core of successful implementation

Drill down on the “Use Test”

E t ti f Ri k M i S l IIExpectations for Risk Manager in Solvency II

Backgro nd to Sol enc IIBackground to Solvency II

The business driver to be compliant with SII is about Cost and Risk avoidance. Could lead to loss of insurance

Insurance legislation over the last 30 years:

Solvency I established in the 1970’s but had inadequate capital allocation

Inconsistency across Europe - territories introduced their own regulation e.g. ICAS in the UK that resulted in a patchwork of regulation

licenses in the EU, reputational risk, rating declines.

Single EU market in early 1990’s led EU regulators to draft the Level I Solvency II Directive in 2002

The Insurance market was weak in the following areas before Solvency II:

Lack of transparency of risk and volatility

Solvency I CURRENT in Europe

Uneven playing field in Europe

Solvency II FUTURE in Europe Replaces Solvency I across Europe and ICA in the UK, promising a (more) level

playing field

Lack of transparency on economic volatility of balance sheets

‘One size fits all’ rather than risk based approach to solvency capital requirements

Individual Capital Adequacy (ICA) CURRENT in UK

playing field

Is risk based, encouraging and rewarding evidenced integrated risk management

Uses market consistent valuation methods for all insurers with set risk parameters calibrated with industry experience

Firms subject to standard formula unless able to demonstrate suitability of internal model

Principles based not rules based

Risk based capital assessment

Must meet individual capital guidance provided by the FSA

Greater attention on Own Risk Solvency Assessment (ORSA) which is more onerous than ICA (in the UK)

Requirement for risk management, governance, actuarial and internal audit embedded in the business

Requires annual report on solvency and condition financial report (SFCR) , Report to Supervisor (RTS) and quarterly reporting (QRT)

Private, no disclosure required on nature of model (i.e. set formula) or output

Supervisor (RTS) and quarterly reporting (QRT)

Approach extended to both assets and liabilities, defining quality and market benchmarks required as part of capital

3 Pillars of Solvency II3 Pillars of Solvency II

Solvency IIis based on 3

guiding principles whichcut across market, credit, liquidity,

operational and insurance risk

The new system is intended to offer firms incentives of lower capitalreq irements to enco rage better meas rement and management of risk

Pillar I Pillar II Pillar III

requirements to encourage better measurement and management of riskThe new system includes both quantative and qualitative aspects of risk, each pillar

focusing on different regulatory component

Internal

ORSA pulls together all the

Requirements to report on specific basis

ithi h tPillar I

Quantative Requirements

R l ti

Pillar II

Qualitative Requirements &

Supervision

Pillar III

Supervisory Reporting and

Public Disclosure

Internal models

Big challenge

elements of SII within short timeframes

Regulations on minimal capital

requirement

S l C it l

Supervision

Supervision regulation

ORSA

Public Disclosure

Transparency

Disclosure R i tSolvency Capital

Requirement (SCR)

Technical provisions

ORSA

Capability and powers of regulators

Requirements

Competition related elements

Investment rulesQuantification Governance Disclosure

Impact on risk management standards within the industryCurrent State:

Many components parts exist already driven by local regulation (e.g. UK), rating agency expectations or firm’s own good practice.

S l II t tSolvency II state:

More industrialised risk framework, with more demonstrable independent oversight of all risk types

Specific new functional expectations (e g risk)Specific new functional expectations (e.g. risk)

Driving use of the model within the business for a “single version of the truth”(use test)

Some component parts need developing or enhancing

Firms typically developing enhanced approaches around:Risk appetite

Risk governance

Model integration

Risk reporting

Stress tests (Multi year and reverse)

ORSA – risk and capital managementA traditional risk framework?

ORSA risk and capital management

Operational risk

Risk policy

Structure of the SCRStructure of the SCR

Solvency II project progressSolvency II project progress

2010 2011 2012 2013

•Dry runs of Internal Models. •QIS5 to calibrate technical provisions.p•Est. risk appetite and changes to governance

ValidationBy October 2011•Run internal model on 2012 plan. •ORSA & industrialisation

Regulatory discussions•IMAP Pre-application (if req ) of risk processes

•Drafting waiver application

Waiver application

req.)•Group supervision discussions (if req.)

•Use test embedded•Systems build, incl. production of QRTs

Ongoing operation

By October 2012Compliant with S II

g g p

Outline of Solvency II scope and timeline

Links between Solvency II and Rating Agency Expectations

ERM at the core of successful implementationERM at the core of successful implementation

Drill down on the “Use Test”

E t ti f Ri k M i S l IIExpectations for Risk Manager in Solvency II

Rating Agency Views on Solvency IILondon, 23 November, 2010 - The impending implementation

of Solvency II and the increasing expectations among rating agencies are driving insurers to continue to bolster their

enterprise risk management (ERM) programmes, according to a recent survey conducted by global professional services

company Towers Watson

“Also included in the regulations is the requirement for a ‘use test’ before companies can use their internaluse test before companies can use their internal models for Solvency II purposes. We believe that our definitions of ‘Strong’ and ‘Excellent’ Strategic Risk Management (one of the five components of our ERM criteria) are closely aligned to the potential ‘use test’. If this is a guide then only around 14% of Europeanthis is a guide then only around 14% of European insurers today would be candidates for internal model recognition by supervisors. “

Source: S&P on Solvency II Experts Group

Outline of Solvency II scope and timeline

Links between Solvency II and Rating Agency Expectations

ERM at the core of successful implementationERM at the core of successful implementation

Drill down on the “Use Test”

E t ti f Ri k M i S l IIExpectations for Risk Manager in Solvency II

Vision of Solvency II Risk Manager

Scope of model

“Principal 1 Senior management and the

Scope of model

Principal 1. Senior management and the administrative, management or supervisory body, shall be able to demonstrate understanding of the internal model”model …

Firms need to define “the scope and purpose of the internal model and the risks covered by theof the internal model and the risks covered by the internal model, as well as those not covered.”

Scope of model?Scope of model?

Model approval key areasModel approval – key areas

Scope of Model

Use test

Internal Model Governance

Statistical Quality Standards

Calibration standards

Profit and Loss Attribution

Validation

Documentation

External Models and data

Outline of Solvency II scope and timeline

Links between Solvency II and Rating Agency Expectations

ERM at the core of successful implementationERM at the core of successful implementation

Drill down on the “Use Test”

E t ti f Ri k M i S l IIExpectations for Risk Manager in Solvency II

Use Test

A fundamental requirement for an undertaking to qualify for an internal

Use Test

A fundamental requirement for an undertaking to qualify for an internal model approach …is that it demonstrates… that there is sufficient discipline in its internal model development and application such that it is “widely used and plays an important role in” the course of s de y used a d p ays a po ta t o e e cou se oconducting its regular business, particularly in risk management.

From a regulatory perspective, the Use test philosophy boils down to the following: if an undertaking does not trust its model sufficiently to use it, why should the supervisory authority?y p y y

Use Test framework assumptions

I d i d t ki t h l

Use Test framework assumptions

Insurance and reinsurance undertakings must have only one modelling framework

The internal model is more than the calculation kernel (“actuarial model” ), but may have different tools.

The integration into the risk-management system shall be on a i t t b i f ll A t t f diff t t f thconsistent basis for all uses. Any outputs from different parts of the

modelling framework with their decision-making processes need to be reconciled.

Requirement for Use TestRequirement for Use Test

Article 120 Use Test (extract)

“insurance and reinsurance undertakings shall demonstrate that“insurance and reinsurance undertakings shall demonstrate that the internal model is widely used in and plays an important role in their system of governance, in particular:Their risk-management system and their decision making processesTheir risk management system and their decision making processesTheir economic and solvency capital assessment and allocation processes”

U T t tUse Test caveat

“CEIOPS does not expect that an undertaking will make decisions based solely on the output of the internal model …..but that decision-making will:

• take account of the output of the internal model,

• [demonstrate] understanding the shortcomings of the internal model ”of the internal model.

Use Test and Internal Model approval processUse Test and Internal Model approval process

“Please provide details of how you will develop your system of governance………to make sure that …………….the internal model is

id l d i i k t d d i i kiwidely used in your risk management and decision-making processes, including your economic and solvency capital assessment and allocation processes.” (FSA)

Survey of 30 London Market respondentsSurvey of 30 London Market respondents

Capital Allocation and management (96.4%)

Catastrophe Risk assessment and aggregates (82.1%)

Reinsurance purchase (78 6%)Reinsurance purchase (78.6%)

Business strategy setting (75%)Business strategy setting (75%)

Investment management (67.9%)

Product development / pricing (67.9%)

(Source: Institute of Risk Management )

Possible uses for the model• Adequate pricing• Asset liability management

• Product development / pricing• Reconciliation between internal model outputs and

internal/external financial reporting

Possible uses for the model

• Business planning / strategy • Capital management • Developing and monitoring risk appetite

D l i i k t t

internal/external financial reporting• Reconciliation between internal model and

technical implementation of management actions• Reconciliation between internal model and

technical provisions • Developing risk strategy• Efficient use of capital• Exposure management and limit setting • External risk reporting

p• Regulatory capital• Reinsurance decisions (e.g. strategic)• Reinsurance programme design

• External risk reporting • Incentive and target setting• Financial reporting (IFRS)• Investment decisions (e g strategic tactical and

• Reinsurance strategy and development of reinsurance programme *

• Reporting on business performance• Reporting on performance including return onInvestment decisions (e.g. strategic, tactical and

operational) • M&A• Measurement of material risks

ORSA

Reporting on performance including return on capital

• Risk balancing (efficient use of capital)• Risk mitigation

S tti fit t t• ORSA• Other risk mitigation• Portfolio transfer pricing • Producing MI

• Setting profit targets• Setting return on capital targets and remuneration• Underwriting policies

• Producing MI

Genesis of the Risk Manager and Risk Management in Insurancein Insurance

Outline of Solvency II scope and timeline

Links between Solvency II and Rating AgencyLinks between Solvency II and Rating Agency Expectations

ERM at the core of successful implementationERM at the core of successful implementation

Drill down on the “Use Test”

Expectations for Risk Manager in Solvency IIExpectations for Risk Manager in Solvency II

Genesis of Risk Management In InsuranceGenesis of Risk Management In Insurance (UK example)

Solvency II State?

Risk

Rol

e

Compliance Risk

Function

ority

of R based risk

management

Risk manager

Seni Silo risk

managemente.g. cat man

Ad hoc risk

Technical Sophistication

Ad hoc risk management

Technical Sophistication

Required Duties of the Risk FunctionThe undertaking shall embed the risk management function….a manner which ensures that the function is objective and free from influence from other functions …..

The tasks of the risk management function shall include:

a) …….the effective operation of the risk management system, in particular…..performing specialist analysis and performing quality reviews;

b) Monitoring the risk management system;

c) Maintaining an organisation wide and aggregated view on the risk profile ofc) Maintaining an organisation-wide and aggregated view on the risk profile of

the undertaking; and

d) Reporting details on risk exposures and advising the administrative management ord) Reporting details on risk exposures and advising the administrative, management or supervisory body with regard to risk management matters in relation to strategic affairs like corporate strategy, mergers and acquisitions and major projects and investments; and

e) Identifying and assessing emerging risks.

Required Duties of the Risk function relating to Internal Model

The risk management function is

Required Duties of the Risk function relating to Internal Model

The risk management function is required to:• Design and implement the internal model g• Test and validate the internal model and any

changes to it; A l d t th f f th d l• Analyse and report on the performance of the model;

• Monitor compliance with the on-going requirements for internal model approval; and

• Suggest areas for improvement to the internal model to the Board.

Skill Set for the Solvency II Risk Manager?• Able to influence at Board level

• Able to understand ALL risk types

Abl t ith t i• Able to engage with actuaries

• Able to engage with the business

• Able to engage with regulators• Able to engage with regulators

• Able to drill down on risk areas and undertake specialist reviews

• Able to understand capital planningp p g

• Able to understand business and risk strategy

• Able to understand actuarial and other modelling techniques

Conclusions

• Solvency II is absolutely about risk

Conclusions

Solvency II is absolutely about risk management

• There are clearly defined roles for risk managers within Solvency II

• Good risk managers will be in heavy d d d S l IIdemand under Solvency II

Email: philip.whittingham@xlgroup.comphilip.whittingham@xlgroup.com

Tel: +44(0)20 7933 7254Tel: +44(0)20 7933 7254Fax: +44(0)20 7469 1012

The views expressed in this presentation are those of the

k d d ilspeaker and do not necessarily represent those of XL Group plc or any of its subsidiaries.