Enterprise Risk Management at Nationwide

Enterprise Risk Management Enterprise Risk Management at Nationwide September 18, 2008 Al Schulman, Vice President-Enterprise Risk Management

The Nationwide View Nationwide Vision Requirements • Risk classification • Identification and assessment • Risk appetite / limits Significant Risks… • Metrics • Reporting • Training and communications …are clearly understood,… • Clear roles and authority • Tools • Controls / transfer / financing …proactively managed… • Standard language • Reporting • Independent assurance and oversight …and consistently monitored by Nationwide…. … in the context of achieving our business objectives and strategy… • Link to strategy / planning • Risk-adjusted performance metrics

Nationwide ERM Framework • Risk Governance • Planning • Execution • Evaluation • Infrastructure, Communication & External Environment

Nationwide ERM Framework GOVERNANCE • Risk Governance & Culture • Risk Policies • Roles & Authorities Framework Feedback PLAN Legal, Regulatory, & Compliance EVALUATE Operational • Strategic Planning • Capital Allocation • Risk Capacity, Appetite & Limits • Risk Adjusted Performance • Capital Adequacy • Risk Modeling Insurance Strategic Market Credit Identify Measure Analyze Manage Monitor EXECUTE Objectives Aggregation Infrastructure Communication External Environment • ERM Tools • Common Language • Risk Classification Framework • Internal Risk Management Partnerships • Training & Communications • Rating Agencies & Regulators • Competitors & Best Practices • Customers • Counterparties

Risk Governance Guiding Principles • Business areas retain accountability for managing their own risks • Enterprise perspective • Proactive rather than reactive • Independent assurance (e.g., Independent Audit) • Clearly assigned responsible / accountable parties • Transparency of accountability, communication, decision making, and information flows • Regular re-evaluation to ensure appropriate evolution

Core Framework Components The three components of the framework are Risk Capacity, Appetite, and Limits, all of which are logically aligned to achieve a common long-term goal: maximization of economic value subject to risk tolerances. Capacity • Capacity represents the maximum amount of risk that can be supported by the company, expressed as an aggregate capital dollar amount • Risk Capacity is determined considering the following: • Available capital • Ability to raise capital (access to capital markets) • Earnings strength and stability, including planned growth in capital over time Appetite • Amount of risk that management and the Board are willing to take, given available risk capacity, our risk preferences, and our strategic business objectives • Risk Appetite serves as an overall guide to resource and capital allocation • Business strategy should be aligned with risk appetite Limits • Allocation of Appetite to individual risk types, business units, and additional dimensionality (or combinations thereof) based upon capital requirements relative to potential returns and risk concentrations • Serve to effectively control our significant risks within the context of our overall risk appetite • Should be expressed in specific metrics appropriate for a given risk • Should reflect enterprise Risk Preferences and align to support strategic plans and capital allocation • Should be set at a level which may be periodically tested (i.e., limits should be established at levels that may be exceeded at times)

Risk Capacity, Appetite, and Limits Framework: Conceptual Model • Nationwide’s risk Capacity, Appetite, and Limits framework expresses tolerance for losses: • for three different loss magnitudes (severity) • considering likelihood over both a one and three year horizon (probability) • reflecting both rating agency and economic measures of risk and capital Capital Volatility Severe Downgrade Insolvency “Gradually leaking hull” “Hole in the side of the ship” “Ship sinks” What is the acceptable probability of… …having capital adequacy decline over three years? …dropping below a minimum acceptable rating level in a single year? …becoming insolvent in a single year? Examples of risk events: • High inflation environment (multi-year) • High trade combined ratio + high growth environment • Large catastrophe • Severe equity market decline • Large catastrophe • Severe operational / continuity event Severity Severity Severity - Loss Magnitude +

Risk Capacity, Appetite, and Limits Framework: Appetite Quantification and Dashboard A dashboard is utilized to reflect a chosen risk appetite and exposure levels relative to the chosen appetite. The example below is illustrative. Capital Volatility Severe Downgrade Insolvency Model Economic Rating Agency Rating Agency Economic Rating Agency Horizon Multi-year Multi-year Single year Single year Static Loss Severity Required loss severity ($) periodically calculated for each dimension considering capital and risk profile. Capital Required for Ratings Targets Tolerance X% <X% X-Y% >Y% <X% X-Y% >Y% Modeled Probability AA- AA3 A+ Z% Z% Z% ≤X% Within Tolerance Warning Level Appetite Violation

Risk Capacity, Appetite, and Limits Framework: CAL Risk Modeling Tools Nationwide’s CAL framework calculations use two principal risk modeling tools: Enterprise Required Economic Capital (REC) model Dynamic Financial Analysis (DFA) model • Tool for measuring economic capital adequacy • 1 year view of risk • “Extreme Tail” focused • REC used in determining Risk Adjusted Return on Capital (RAROC) • Statutory, GAAP, and economic views • Multi-year view of risk • More centrally focused • Robust stochastic economic simulation capabilities • Enables more “complete” view of risk (central vs. tail, 1 year vs. 4, Economic vs. Statutory vs. GAAP, etc.) • Periodic calibration exercises to test models, assumptions, sensitivity, etc.

Nationwide Risk Management Cycle Identify Measure Analyze Manage Monitor There are five elements of best practice risk management execution What risks exist? How much is at risk? What do we want to do with the risk? Do something about it Did the management strategy work? • Identify potential risk events • Investigate emerging risks • Classify risk events • Gather actual loss data • Document Contributing Factors, Controls and Key Risk Indicators • Consider possible impacts • Uncover possible gaps • Etc. • Measure direct exposure • Consult experts • Benchmark industry performance • Run potential loss models • Measure actual impact • Perform scenario analysis • Gather anecdotal facts regarding risk exposure • Etc. • Compare to risk preferences • Look at aggregate measures • Prioritize against other risks • Create strategies and recommendations for risk management actions (terminate, treat, tolerate, transfer) • Get feedback and appropriate approvals from risk owners and oversight committees • Etc. • Implement recommended actions • Execute projects • Improve / add internal controls • Change policies and procedures • Make investments • Sell assets • Acquire hedges • Acquire reinsurance • Do nothing • Etc. • Ensure actions took place • Compare current results with previous results • Compare current results with expected results • Generate and distribute reports • Etc. Data Information Action

Risk Diversification SolvencyStandard EL Economic Capital Credit Market Product Strategic Legal & Reg. Operational 1. Characterize the risk distributions Correlations, Dependencies 2. Combine distributions 3. Measure required capital 4. Attribute capital to products and business units

RAROC Overview Total Return Required Economic Capital (REC) RAROC = How much capital is needed to protect us to a given solvency standard (AA)? How much are we earning on the capital that we have committed to our businesses? CAPITAL PRODUCTIVITY CAPITAL ADEQUACY Compare RAROC with Hurdle Rate (Cost of Capital) Compare Required Economic Capital with Available Economic Capital • Risk Adjusted Return on Capital - Economic view of capital adequacy and risk adjusted returns

Enterprise Capital and RAROC Applications • Applications • Capital adequacy • Including future Rating Agency capital adequacy determination • Performance measurement & Incentive compensation • Strategic planning & Capital allocation • Product Structure & Pricing • Risk Transfer • Expense Allocation

ERM Tool – Ops Risk Information Architecture ERM Common Information Architecture • Common Dimensional Hierarchies (Classification and Aggregation) • Common Metrics Definitions • Common Reporting • Common Workflow • Shared Risk and Control Data • Shared Mitigation Activity Data • Shared Internal and External Loss Data Compliance HR Privacy Internal Audits IT Security / Continuity Management

Strategic Asset Allocation Process

Total P&C Efficient Frontier

Asset/Liability Interaction • Think of liabilities as negative assets • Expected duration based on historical payout patterns • Actual duration includes systematic and idiosyncratic volatility • Inflation sensitivity • Residual volatility • Claims practices • Mix of coverages/perils • Litigation practices • Impact on efficient frontier driven by several characteristics • Inflation sensitivity and responsiveness • Payout pattern (expected duration) • Volatility of duration

Inflation and Economic Value Avail. Econ. Capital (end year 4) Average inflation (years 1-4) In low inflation environments erosion of AEC is driven by catastrophe risk Nationwide is able to increase premia to keep up with inflation changes Nationwide not able to reset premia significantly enough to protect AEC in high inflation or inflation changing regimes

Asset/Liability Management – Inflation Modeling • Investment portfolio optimization requires a defined view of inflation sensitivity and responsiveness with respect to reserves and new business • Generally, losses have a low correlation with inflation, but a high sensitivity to inflation • Key questions: • Inflation Modeling • What is expected inflation over the model horizon? • What is inflation volatility over the model horizon? • Liability modeling • How sensitive are your reserves to inflation? New losses? If less than fully sensitive, why? • How does expected inflation change when actual inflation occurs? • How quickly does pricing react to a change in expected inflation?

US Inflation History US CPI and CORE CPI inflation 2

Enterprise Risk Management – Role of Actuaries • ERM provides actuaries with an opportunity to use their understanding of the business and its risks to increase their strategic role within the organization • Data provider • Limited – Reserves, ultimate losses • Expanded – Payout patterns, volatility assumptions, correlations • Subject matter expert • Risk model developer/owner • Risk management partner • If the actuarial profession doesn’t step up to the challenge of ERM, others will. Who understands the business better than you?

Enterprise Risk Management at Nationwide