It's a Whole New Ballgame at AM Best - Part II: ERM
By Alton Cogert
In our previous blog, we discussed material changes that AM Best is making to its Best Capital Adequacy Ratio. Or should we say Ratios, as effective with a planned implementation on Jan 1, 2017, we will be staring at five BCARs at different statistical confidence levels. As important as BCAR is as a key input into the rating process, A.M. Best also released a new Rating Methodology which takes a more comprehensive view of the insurer. That methodology, much more structured than in the past, has several components to it.
However, only one important component can adjust your company’s rating down the rating scale four times as much as upward: Enterprise Risk Management (ERM).
More concretely, if your company’s risk management capabilities contain severe deficiencies relative to the risk profile of the company, your initial BCAR assumed rating of, say, A- can be moved down to a below investment grade BB+. Or, from A to barely investment grade at BBB-. Of course, there would be an upward adjustment if your company’s risk management capabilities are excellent and are more than adequate for the risk profile of the company. But, that upward adjustment is limited to one notch versus the potential for a three notch downgrade.
Let’s begin with a few basic points Best considers when reviewing ERM with what we would call the ‘Mom and Apple Pie’ requirements (nobody would have a problem with these):
1. Establishing a risk-aware culture, using sophisticated tools to identify manage and measure risk is considered increasingly important.
2. Key categories of risk: Credit, Market, Underwriting, Operational and Strategic
3. ERM should be viewed in light of the company’s complexity of operations. Even ‘less complex’ operations should still be able to identify, measure, monitor and manage risk.
Now, ask yourself if your company has formally done this:
4. Each company must have an overall risk appetite and risk tolerance statement approved by the Board or senior management.
5. An insurer should be able to demonstrate the link between its core operating processes, business plan and risk management practices. In other words, integrate risk metrics in corporate, business line and functional area objectives and use risk-return measures in financial planning, budgeting, strategic planning, performance measurement and incentive compensation.
These last two items, of course, are where the rubber meets the road. And a bumpy one it might be for some, as the evaluation of these items can be more than subjective, even as Best has instituted a more structured approach.
Risk Impact Worksheet – Risk Profile v Risk Management Capability
A.M. Best will now use a Risk Impact Worksheet as their primary tool to assess ERM. This is big news, as it shows a very methodical way of evaluating the very complex topic of ERM. This Worksheet has ten broad risk categories and compares the insurer’s risk management capabilities to its risk profile.
In this example the company has inadequate risk management in the areas of Product and Underwriting, Concentration, Financial Flexibility, and Risk Appetite/Stress Testing, whereas risk management is adequate or more so in the other categories. The result, when combined, is a company with risk management capability just a little bit better (more than adequate) for its risk profile. How did they get to that summary judgement in this example? How were these factors weighted? How subjective is this process?
This really has yet to be fully explained by A.M. Best. But, for now, let’s focus on the impact on the investment area. As with the previous blog on BCAR, we will focus on the areas where investments are a large factor in the Worksheet, leaving the other categories to those with more specialized knowledge outside of investments.
Risk Category #6: Investments
Risk Profile in this category is focused on a review of investment mix and duration, which should reflect the liability profile. Investment risks should be balanced by underwriting risk and the company’s capabilities. Investment risk profile can also be viewed relative to peers and the industry. This is where ALM (Asset-Liability Management) philosophy, especially as it relates to potential and expected liability and liquidity needs, becomes very important, including default, interest rate, market and liquidity risks.
AM Best will be the judge of your company’s ability to create, execute, monitor and manage the investment policy and portfolio. Importantly, the use of an external asset manager alone is not considered a relevant capability. At SAA, we’ve been with our client at many an AM Best rating meeting. And, the thought is usually that trotting out your ‘big name’ manager will solve any investment problems or questions. If it was only so easy. Best goes on to note that the external manager should be ‘well-known’ and provide meaningful management information systems to the insurer who must then be able to explain the strategy to Best. Importantly, the insurer should explain what oversight and limitations are placed on external asset managers. And, in our opinion, this is where many insurers, without an in-house investment professional, will probably have difficulty. Interestingly, it is one area where pension funds and the like are well ahead of insurers, in reliance upon third party, independent investment professionals to assist in oversight. Importantly, the insurer (not the external manager) should be able to explain investment risk in light of the company’s stated risk appetite measures and demonstrate performance under stress scenarios.
Risk Category #10: Risk Appetite/Stress Testing
Risk Profile here is judged by the risk appetite statement. It should be documented in amount and type of risk the company is willing to seek or accept in pursuit of long term objectives. Risk tolerance, then, are the boundaries of risk taking.
AM Best will be the judge of your company’s ability to communicate its risk appetite in clear, measurable terms through the risk appetite/tolerance statement. Sophistication and clarity of risk measures will be evaluated relative to the level of risk. Stress testing and scenario analysis are expected to add additional insight. And, stress testing is very important, as it focused on those infrequent, yet costly events, enabling the company to identify potential sources of risk, its magnitude, develop tolerance levels for risk and generate strategies to mitigate risk.
The Risk Impact Worksheet Summary – Moving Up or Down the Ratings Scale
AM Best will summarize those ten categories when comparing your company’s risk profile to its risk management capability. Each of the ten categories will take on varying degrees of importance, as decided by your AM Best analyst.
AM Best will judge what your company’s overall risk profile is and determine which risks the company is most susceptible to and why. Best will then decide if your company has demonstrated an ability to manage the most material, identified emerging risks. Your AM Best analyst can identify and explain management strengths and shortfalls, and consider materiality in determining your company’s risk management capabilities. Best will use this chart as a guide to whether ERM will help or hurt your company’s rating and by how much.
Best has already reviewed about 1100 companies’ risk profiles and risk management capabilities. They do expect that most companies have either moderate or high risk management capabilities. However, there will be outliers. And, we would expect that the standards for what is ‘moderate’ or ‘high’ will change over time. With that in mind, we highly recommend that you carefully review ERM in the Rating Process in more detail as well as future documentation on this that we will probably see from Best.
Importantly, you may want to start asking: “How can we do a better job at ERM?” Because it is better that you ask that question internally, than getting more difficult questions from the structured, yet subjective review of ERM from A.M. Best.