02 June 2010

Published in: Risk governance, Regulation - supervision

Is your board fit for Solvency II?

Insurance company board members may think they understand the risks within their business. But Solvency II requires a huge shift for directors in demonstrating this to the satisfaction of regulators, says Rory O'Brien.

In marathon running parlance, many insurance company directors may think they are currently jogging along nicely in the pack while they leave the assimilation of most of the technical details of Solvency II to their risk and actuarial teams. If that's the case, they may be about to hit "the wall."

Chapter IV, article 40 of the Solvency II directive adopted in December 2009 makes it absolutely clear that the board has ultimate responsibility for meeting a company's obligations under the directive. Such responsibility, the directive goes on, cannot be delegated. As clear as this may appear on paper, perceptions of what this may entail vary widely between companies. Those that regard their responsibilities too lightly may be in for something of a shock.

Solvency II outlines six key areas of responsibility for the board:

1. implementation
2. risk appetite and business strategy
3. the company risk management system
4. risk management culture
5. the internal model and
6. internal and external disclosure.

That is not to say, of course, that boards are expected to do all the work themselves. But, by the same token, if directors fail to demonstrate sufficient understanding, oversight and investigation of these aspects of the business, they could prove to be the weak link in meeting their company's Solvency II's requirements.

So what can boards do to get themselves ready for 2012?

By now, most companies' implementation plans should be fairly well developed. If board members have not already routinely been reviewing such plans, now would be a good time to start, since the fifth quantitative impact study (QIS5) and critically for many, the approval process for internal models, will be upon them very soon.

Risk strategy 

"It won't be enough for the board to think that everyone supports its vision of appropriate risk; directors will need to test and verify this is the case." 

Risk appetite and strategy would seem a natural fit at board level and most would feel, I'm sure, that they already take control of these areas. Solvency II requires, however, that risk strategy should be a living, breathing part of the business with the board taking responsibility for more widely communicating the risk appetite and how this affects different functions.

It won't be enough for the board to think that everyone supports its vision of appropriate risk; directors will need to test and verify this is the case. What is more, Solvency II is introducing new risks to consider and account for in capital requirements such as integration risk from an acquisition strategy.

Boards will have to satisfy themselves that suitable systems are in place for managing risk within the business relating to underwriting, markets, liquidity, credit, operations, strategy and reputation. This may entail restructuring the business to ensure this is happening, including key appointments such as a chief risk officer, and examining committee structures and reporting lines. Processes for communicating risk, such as risk registers, will need reviewing, as will the policies and controls that are in place for managing risk.

What are your top 10 risks? 

Regulators are likely to expect board members to be able to answer questions such as "what are the top 10 risks facing your business?" How many board directors could, honestly, answer that question?

But, beyond simply identifying the risks, they will need to be able to defend the controls they have in place to manage them, to show how well they monitored and managed these risks in the previous year and to demonstrate the extent to which they were able to mitigate losses by appropriate risk identification. If they don't already, boards will be expected to have minutes documenting regular reviews of risk at their meetings.

"The ORSA ...is the opportunity for the board to show it has a detailed understanding of, and closely monitors, the firm's risk management strategy and appetite."

In any case, the ORSA (own risk solvency assessment) will ensure a more formalized approach to evaluating risk. This is the opportunity for the board to show it has a detailed understanding of, and closely monitors, the firm's risk management strategy and appetite.

Internal models will have a key role to play in achieving this requirement. The board's role will be to understand the structure and principles of the model, together with its underlying assumptions, dependencies and key parameters. There will have to be a way for it to be informed on a regular basis about the ongoing performance of the model, so that individual directors can respond to questions such as "Is the model of appropriate complexity for the business?" and "How is the model documented, checked and signed off?"'

Probably most importantly, Solvency II dictates that "the board is responsible for promoting a high level of integrity and for establishing a culture within the firm that emphasizes and demonstrates to all levels of personnel the importance of risk management." Models are destined to fail the "use test" unless they are embedded into the business and demonstrably used to support decision-making.

"Fundamentally, many insurance companies will have to reorganize the way they manage themselves as a result of Solvency II." 

Companies will have to reorganize 

Changes will have to go beyond board level: fundamentally, many insurance companies will have to reorganize the way they manage themselves as a result of Solvency II. Creating the right culture will entail activities such as wider sharing of good and bad news stories about risk and more widespread training on risk issues for all front-line staff.

This underlines how communication is a crucial component in a successful Solvency II implementation project. But it has to be driven by a clear set of objectives at board level. Boards can set the agenda by being clear about what they need to see and when, and what they need to show to the regulator and when.

Champion Solvency II within your company 

Some directors may take the changes in responsibility in their stride. A lot will hinge on whether the board has been sufficiently vocal in championing Solvency II within the organization, rallying the troops to their cause. Many have not.

Those who try and fob off responsibility for Solvency II on to risk and/or compliance teams are missing a trick, not to mention the wider point of the directive. Success will be about embracing Solvency II and the advantages it can deliver in running an insurance business, not sweeping it under the carpet.

Directors can expect to be taken outside their comfort zone. Once upon a time a non-executive seat on the board of an insurance company might have been seen as a cushy number for those of a certain age and experience. Solvency II will mean that is no longer the case. Even for executive directors, there is a steep learning curve to be climbed in improving understanding of how risk impacts the business.

Rory O'Brien is managing partner and leads the business consulting team at EMB

Back to top