Best-practices-risk-mapping-rr-07-01-04.pdf

MILLIMAN

BEST PRACTICES

for THE RISK MAPPING PROCESS By David Ingram, FSA, FRM, PRM and Paul Headey, FIA

Risk mapping is a tool used by life insurers in the identification, control, and management of risk. It can form the first step in an Enterprise Risk Management (ERM) process or it can stand alone as the primary risk management process for companies that have not yet developed a full ERM system. Figure 1 illustrates the basic risk mapping cycle.

FIGURE 1

Understand

Evaluate

Identify

Risk Mapping Perhaps the most important feature of risk mapping is its lowcost, high-impact introduction to risk management that builds upon the existing infrastructure in the company. It does not require a large commitment to capital expenditure and, if done appropriately, will provide a valuable first step in rolling out risk management across the company. Companies considering the risk mapping approach it should be aware it is not a one shot solution and the results are not carved in stone. Rather it is an iterative process that refines managements’ understanding of the exposures that it is managing, and measures the effectiveness of the mitigation strategies employed in controlling risk. The following sections outline the steps of the risk mapping process.

Revisit

Prioritize Manage

Step 1: IDENTIFY Risks must be identified in order to: • ensure that the full range of significant risks is encompassed within the risk management process, • develop processes to measure exposure to those risks and, • begin to develop a common language for risk management with the company.

Most risks can be classified into one of the following categories: • Market Risks • Credit Risks • Insurance Risks • Operational Risks Starting with a comprehensive but generic list of risks, the company should then aim to select its own list by considering the following criteria:

This step is often undertaken as a brainstorming exercise involving key team members from across the business that not only leads to a comprehensive list being compiled but also aids in building support for the exercise. The final “risk list” should then be checked for consistency with the company’s business plans and intended risk management processes.

• impact on the firm’s financial condition;

Step 2: UNDERSTAND For each of the selected risks from Step 1, it is necessary to develop a broad understanding. This includes determining whether the risk is driven by internal or external events.

• ability to manage separately from other risks.

In some situations, it may prove helpful to actually

• relevance to the company’s activities;

plot the exact sequence of events leading to a loss situation. This could result in the identification of intermediate intervention points where losses can be prevented or limited. Existing risk measurement and control processes should be documented, and if the loss sequence has been plotted, the location of the control process in the sequence can be identified. The final step in understanding the risks is to study recent events related to risks including loss events, successful risk control or mitigation, and near misses both in the wider world and inside the company. Such events should be studied and lessons can be learned and shared.

Step 3: EVALUATE The next step in risk mapping is to evaluate the risks. This involves: • estimating the frequency of loss events, e.g., low, medium, and high; • estimating potential severity of loss events, e.g., low, medium, and high; • considering offsetting factors to limit frequency or severity of losses and understand potential control processes. Figure 2 (on page 3) shows the basic risk evaluation map.

Step 4: PRIORITIZE The evaluations of risk frequency, severity, and con-

RISK EVALUATION PROCESS Risk evaluation is typically done in two steps: • First, the expected frequency of loss events is determined or estimated. • Second, the expected severity of losses is estimated. These assessments should take into account actual company experience, related industry experience, experiences in unrelated industries, trends, and forecasts. The assessment may be performed quantitatively via analysis of loss experience data or via a model. External data can also be used to establish an expectation. However, if data is totally unavailable or is not sufficiently relevant to the company’s situation, then subjective evaluations are needed. In addition, companies use subjective evaluations when they are using risk mapping as their first steps into enterprise-wide risk management. Loss frequency is often summarized into a small number of categories to allow easy comparison and to deemphasize minor differences in risk sizing. These categories can be thought of as “Very Low,” “Low,” “Moderate,” “High,” and “Very High.” The other aspect of risk evaluation is to examine the potential severity of losses if one of the loss events for which the frequency was identified actually occurs. Again, the severity can be developed from company experience, related industry experience, experiences in unrelated industries, trends, and forecasts. Companies also use subjective evaluations for severity when using risk mapping as their primary system for enterprise risk. However, it is common for severity evaluations to migrate more rapidly to a quantitative process, since a loss amount is easier to identify than a loss probability. Initially, risk size might be measured with a “Very Low,” “Low,” “Moderate,” “High,” and “Very High” range, but companies typically begin using number values after one or two annual cycles.

2

Milliman

B E S T P R A C T I C E S F O R L I F E I N S U R A N C E C O M PA N Y R I S K M A N A G E M E N T

trols from Step 3 are then consolidated on to a single report. The risks are ranked according to a combined score incorporating all three assessments. The ranking starts with the risk with the worst combination of frequency, severity, and control scores.

This critical stage involves deciding how to manage the most important and largest risks, considering the risk-return relationship, correlation with other risks, consistency with company strategy, and the organization’s risk tolerance level. It is important to achieve the right balance between the application of the risk management techniques and monitoring the key risk indicators in the business. This

4 1

Low

2

3

Medium

5

High

6

RISK EVALUATION MAP

Severity

Step 5: MANAGE The consolidated evaluations from Step 4 should then automatically indicate the risks that need the most attention. Often, for these most severe risks, a company will decide that a qualitative process is inadequate. Quantitative measures are identified that can be performed on a regular basis and reporting systems are developed for these most important risks to bring the measures to management’s attention on a timely and regular basis. It cannot be stressed enough how important ongoing monitoring and measurement is to the successful management of the business risk.

FIGURE 2

1

2

Low

4

3

5

Medium

6

High

Frequency Annual Reevaluate

should include wherever possible the utilization of information already generated by the business. A key part of managing risk is the introduction of simple processes to limit the exposure to major areas of risk. An example of this is the control processes around the introduction of new products.

Step 6: REVISIT Many companies may feel that it is more cost effective to only implement full risk monitoring and management systems for the largest risks. This is probably true, but unfortunately, the world of risk never stands still. As the compet-

Periodic Attention

itive marketplace changes and the financial markets move, yesterday’s low-risk position may become tomorrow’s high-risk position. The process of identifying, understanding, evaluating, and prioritizing risks must be repeated regularly in order to ensure that the key risks are being appropriately managed. Each period management will review what happened in the recent past and assess whether risk management efforts produced the expected results as well as assessing what changes have taken place in the markets and the world that might change its view of its risks. Then it is ready to start the process again from Step 1.

Immediate Attention

Immediate Action

Conclusion Risk mapping is a costeffective tool to incorporate risk awareness and institute risk management into a company’s management and operational processes. As the process is used management will, over time, become comfortable in its role as risk manager and begin to incorporate risk management into all aspects of its role within the company.

B E S T P R A C T I C E S F O R L I F E I N S U R A N C E C O M PA N Y R I S K M A N A G E M E N T

Milliman

3

B E ST PRACTI CE S FO R LI F E I N S U RAN C E C O M PANY R I S K MANAG E M E NT

ABOUT MILLIMAN For over 50 years, Milliman has been pioneering strategies, solutions and tools worldwide. One of the largest consulting and actuarial firms in the United States, we are recognized leaders who have helped shape significant changes in the markets we serve. Milliman insight reaches

across global boundaries and multiple industries, offering specialized consulting services in life insurance and financial services; property and casualty insurance; employee benefits; and healthcare. Within these, Milliman consultants serve a wide range of current and emerging markets, with highly personalized service and a unique combination of

Milliman Global, an international organization of independent consulting firms serving insurance, employee benefits and healthcare clients worldwide.

Visit our website at: www.milliman.com

MILLIMAN GLOBAL MEMBER FIRM LOCATIONS

MILLIMAN OFFICES ALBANY ATLANTA BERMUDA BOISE BOSTON CHICAGO COLUMBUS DALLAS DENVER GREENSBORO, NC HARTFORD HONG KONG HOUSTON INDIANAPOLIS IRVINE KANSAS CITY LONDON LOS ANGELES MADRID MILAN

actuarial and business expertise. With offices in principal cities worldwide, Milliman combines global experience with local knowledge. We can help you be prepared to operate in new markets, expand beyond your boundaries and understand how your industry is affected by developments around the world. Milliman is also a founding member of

MILWAUKEE MINNEAPOLIS NEW YORK NORWALK, CT OMAHA PHILADELPHIA PHOENIX PORTLAND, ME PORTLAND, OR PRINCETON, NJ ST. LOUIS SALT LAKE CITY SAN DIEGO SAN FRANCISCO SÃO PAULO SEATTLE SEOUL TAMPA TOKYO WASH., D.C.

ARGENTINA AUSTRIA BARBADOS BELGIUM BERMUDA BRAZIL CANADA CHANNEL IS. CHINA COLOMBIA DENMARK FRANCE GERMANY INDIA IRELAND ISLE OF MAN ITALY JAMAICA

JAPAN KOREA MEXICO NETHERLANDS NIGERIA NORWAY PHILIPPINES SPAIN SWEDEN TRINIDAD & TOBAGO UNITED KINGDOM UNITED STATES

Inquiries may be directed to: NAME ADDRESS ADDRESS EMAIL Nothing stated in this document should be treated as an authoritative statement of the law on any particular aspect or in any specific case. Because the articles and commentary prepared by the professionals of our firm are often general in nature, we recommend that readers seek the advice of an actuary or attorney before taking action.

© 2004 Milliman, Inc.

4

Milliman

All Rights Reserved

B E S T P R A C T I C E S F O R L I F E I N S U R A N C E C O M PA N Y R I S K M A N A G E M E N T