26 November 2009
Published in: Risk governance
Risk tolerance and limits are not such foreign concepts
Try thinking of them like curfews for teenagers
Most of us can relate to the issue that arises between parents and teenagers about curfews and whereabouts. Some have recent memories of being on the parent side of that discussion, some on the teenager side and a few can even remember both.
An ideal discussion might involve reaching an understanding of what is the acceptable curfew and what are acceptable places to visit, the degree of communication expected and the process for granting waivers to the original agreements. At the opposite extreme, in a poor "discussion" the parent and teenager never discuss any specifics and expectations are totally situational and communicated only when they are violated.
Perhaps not so surprisingly, a good discussion of risk tolerances, risk preferences and risk limits in an insurance company has the same characteristics as the good discussions about curfews and whereabouts, but in many firms, the discussions are more similar to the poor curfew "non-discussion." By looking at the parallels, insurers can see how to move closer to the ideal.
In its January 2008 publication Risk management and the ratings process for insurers, A M Best mentions risk tolerance 14 times. Best expects to hear about how insurers' aggregate and specific event-risk tolerances relate to their earnings and surplus. In addition, A M Best is interested in how these are applied to lines of business.
We suspect that Best does that because it has the understanding that a fundamental part of enterprise risk management (ERM) is the clear communication of expectations to facilitate effective management process.
Let's go back to that teenager. You might start with a statement of motivation for your position: "I am concerned that you be safe." A clear curfew would be something like "be home by midnight," and for whereabouts, a clear list of acceptable places like "the mall, the coffee shop, or Mary/Joanne/Sue's home." To be collaborative and to allow for reasonable future discussions, you might say why you selected those places. With that sort of communication, there is little room for doubt about what is over the line and what is inside.
That translates easily to insurance company risks. A motivation for risk tolerances could be something like "the company will take risks that add to the value of the firm." Then that can be further turned into a specific statement (like the time for the curfew) about how the risk tolerance relates to earnings and/or capital. These statements range from "We will not take risks that create any significant likelihood that we will have a loss of more than two quarters of earnings" to the more common "We will limit our risks to those that maintain our ratings with the expected capital levels."
Many firms make the motivation and the tolerance statements separately. Best practice would be to link the two directly with analytical work that shows that the risk tolerance level is consistent with all the corporate objectives, as well as the stated motivation for the tolerance. In the example given above, that could be done with a model that shows the link between risk and value.
Then, like the statement of where the teenager is expected to be, the insurance company can write down what risks it is expecting to be taking. Those risks would be selected based on criteria that would include the company's expertise in selecting and managing the stated risk types, as well as stakeholder expectations for the types of risks that it takes.
For example, it might be unstated but understood that an insurer that operates solely in a single jurisdiction would not take large amounts of currency risk. Applying enterprise risk management (ERM) principles, insurers might want to explicitly state their limitations on currency risk, rather than assuming that "everyone knows we do not do that". Certainly problems have arisen when sensible limitations have not been stated. For instance, Orange County, California, was bankrupted in 1994 because of unexpected risk-taking.
The overall tolerance can then be divided up between the business units and/or according to risk types. The apportioned amounts might then be called the limits. With a teenager, the parent would be well served to spell out what to do when the teenager finds a compelling reason to stay out later and/or go somewhere not pre-approved (and what self-respecting teenager will not find such a reason?). Just the same thinking applies to risk. Management and the board need to agree to what steps will be taken when there is a compelling reason to exceed the pre-agreed risk-taking amount, as well as agreeing on what will happen when there is excess risk-taking (or a late arrival at home) without any compelling reason.
If the risk-taking is to create value for the firm, then one good compelling reason would be a chance to create more value with more of the risks that the firm has expertise with selecting and managing. But just as with the teenager who finds a new reason to be late, the stated reason for extensions of limits in an insurer will sometimes be to take more of the new risks with which the firm has a questionable level of experience or expertise. Just as the parent might excuse small infractions for these weak reasons, a firm might extend small amounts of risk limit to the new and untried risks. But while parents might be very happy if their teenager never comes home late or questions the curfew, management of an insurance company would be expected to be working to find ways to enhance the firm value and some of those alternatives will challenge the firm to find the resources to fund the best of those ideas. And for insurers, the best looking alternatives will often be the new risks that are not co-dependent with the largest current risks of the firm.
In the end, the insurer will not want to manage its risk tolerance and risk limits system to eliminate all independence, but to facilitate communication on the way to creating value. In just the same way, the parent who is too rigid about their curfew rules risks losing touch with their teenager.
So there you see it: risk management is no more difficult than parenting a teenager!
Dave Ingram, CERA, FRM, PRM, is Senior Vice President, Willis Re, in New York