10 June 2010

Published in: Risk governance

Approach your risk with CARE

A CARE report is like an applied actuarial view of the ERM process, explain Andy White and Jeremy Waite who summarize the key features of a project on comprehensive actuarial risk evaluation undertaken by the IAA.

A working party of the International Actuarial Association recently undertook a project to consider what dimensions of risk should be considered in an enterprise risk management (ERM) assessment. The working group consisted of 15 actuaries and non-actuaries from five countries (including two Australian fellows).

The resultant report is a working paper. It's not intended as a standard of practice but rather to encourage discussion that might someday lead to the establishment of a standard for actuarial risk assessment. The report "Comprehensive Actuarial Risk Evaluation (CARE)" has recently been published by the IAA (under the Enterprise & Financial Risk Committee) and is posted on the association's website:
http://www.actuaries.org/CTTEES_FINRISKS/Documents/CARE_EN.pdf.

This article aims to give insight into the core ideas presented in the paper.

ERM background

ERM has moved up the agenda of many organizations, particularly as a result of the recent global financial crisis. The CARE paper considers the core elements of an enterprise-wide risk assessment from an actuarial perspective.

This is an area where actuaries can find a useful role for their expertise and experience because of their alternative risk perspective and unique skills that set them apart from many other professions in the ERM area. For example, the European Solvency II mission has explicitly stated the roles that it expects actuaries to fulfil in the new regulatory environment (article 48 - actuarial function, directive of the EU parliament (Solvency II), Strasbourg 25 November 2009).

The financial crisis revealed some significant gaps in risk management. The underlying cause was, in truth, a variety of contributory factors. One factor, often singled out as a root cause, is the reliance the banking industry placed on their mathematical models. There are two elements to this issue, firstly the extent and use of the models to make informed decisions, and secondly the models themselves.

Mathematical models are deductive by nature, and simplifications of real life. The problems with models can be the premise, the use or the validity/accuracy of the underlying process they try to represent. There is scope for fundamental misunderstandings between model creators (and their models) and management who make decisions based upon the outputs.

As the designers and owners of many risk models, actuaries are well positioned to understand precisely how much reliance should be placed on models and where additional judgment is needed. The failure of management to understand the nature of the models and any associated over-confidence in their decision-making ability can be addressed, at least in part, by having a CARE performed by an actuary.

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) is a private sector initiative that has a well established ERM framework, as shown in figure 1. The sponsors are the five main accounting professions in the US.

The framework is useful as it clearly lays out the multi-dimensional nature of risk and places strategy as the first step of this framework. It is important to consider risk in a strategic context. For example, risk depends on the organizational frame of reference, i.e. the core competences of the firm; what is highly risky for one firm may be business as usual for another. The CARE can play a role in being objective and independent in the assessment of the risks for the firm, given their context, history, culture and strategic positioning, and works within this framework.

Figure 1: The COSO ERM framework

Risk assessment

As can be seen in figure 1, risk assessment is a key step in any ERM framework, and a CARE is primarily used to support risk management activities. While a CARE might be part of a process for determining accounting values or solvency values for risk, it is primarily intended to support the work of making decisions to treat or not treat risks. There are three broad categories of risk management uses for risk assessments:

• loss controlling,
• risk trading and
• risk steering

This is illustrated by the following graphic, and shows how risk management can be used with different levels of strategic linkage in any particular firm. One of the core goals of any company is to gain competitive advantage over its rivals, and choosing how to deal with risks is crucial to this strategic activity.

Figure 2: Uses of risk assessments

Within this article and the CARE paper the definition of risk used is the potential for an outcome with negative consequences. A negative consequence can be the failure to meet objectives, fulfill realistic expectations or take advantage of a positive (profitable) opportunity. To fully evaluate risk we must look at all potential negative outcomes. Narrowly defining risk can make evaluation more convenient -- but incorrect, like looking for your lost keys under the nearest lamp post because that's where the light is.

Common failings in risk assessment include:

• relying too heavily on historical data (e.g. assuming house prices will continue to rise);
• focusing on narrow measures;
• overlooking knowable risks;
• overlooking concealed risks; and
• failing to communicate (risk managers/actuaries not communicating the model error well enough)

A CARE report would provide a platform to discuss the issues of risk in a company-specific context, it can make recommendations and it would be a useful read for auditors and shareholders alike.

The CARE paper

A key component of the CARE paper is the multi-dimensional nature of risk. The dimensions selected in the paper are not intended to be exhaustive. The key dimensions to consider include:

• market-consistent value vs. fundamental value;
• accounting basis vs. economic basis;
• regulatory measure of risks;
• short -term vs. long-term risks;
• known risks vs. emerging risks;
• frequency risk (earnings volatility) vs. severity risk (solvency);
• stand-alone vs. full portfolio risk; and
• risk types

There is more detail in the full paper but the following covers briefly the core risks considered:

A framework for communicating the outputs of a CARE can be seen in figure 3 below.

Figure 3: Description of a CARE report

Not every single aspect of risk can be considered in every evaluation, so the communication of the limitations of any analysis is crucial. This includes avoiding over-reliance on any particular model and abandonment of judgement.

Any situations of deficient data should be identified along with any significant assumptions (implicit or explicit) and any areas where the models used diverge from reality. It is just as important to consider what is not covered by a model or analysis as it is to understand what is.

It's worth recalling The Financial Modelers' Manifesto that Emanuel Derman and Paul Wilmot issued at the end of 2008: "I will never sacrifice reality for elegance without explaining why I have done so. Nor will I give the people who use my model false comfort about its accuracy. Instead, I will make explicit its assumptions and oversights."

Andy White is actuarial manager, QBE Australia Asia Pacific

Jeremy Waite is executive director - actuarial & financial modelling, Willis Re Australia

Back to top