A Portfolio Approach to Enterprise Risk Management

1. A Portfolio Approach to Enterprise Risk Management Bruce B. Thomas November 11, 2002

2. Conning Consulting About Conning Research & Consulting • 90 year history of Insurance Industry Research • Closely “connected” to industry thought leaders and practitioners • Produces strategic studies, industry insights and industry commentary • Industry standard models including Property-Casualty Insurance industry, Life insurance industry and Property-Casualty reserving • Provides proprietary, confidential research and insights to institutional investors Conning Research

3. Redefining ERM • ERM is a coordinated process for managing risk • Throughout business units and departments • Across organizational, operational, and financial dimensions • Over time

4. Rationale for ERM • Identify risk issues early • Mitigate threats and capture opportunities • Coordinate risk management efforts • Conserve resources (capital and operational efficiencies) • Implement best practices • For well-known risk issues

5. Benefits of Risk and Management • Risk is a byproduct of change and value • Absent risk, we can not advance our interests • Risk management is about preparing for change • Minimizing bad outcomes • Enhancing good outcomes

6. Is Risk Increasing? More value x more change = more risk • Value • More people and property, better lifestyles, higher concentrations of people and goods • External change • Technology, demographics, preferences, competition, legal and regulatory, natural hazards, markets, relations with suppliers and distributors, etc. • Internal change • Management and employee turnover, strategic shifts, system implementations, organizational structures, crisis, product and service initiatives, etc.

7. Top 10 Risk/Management Issues • People think risk is bad • Managers have different understandings of risk • Managers disagree about how much they can influence risk • Responsibility for risk management is unclear • Functional approaches do not work for important issues • Managers have different perceptions of value • Incentives are inconsistent with risk management strategy • Risk management is inconsistent with business objectives • Lack of relevant and timely information • Information is not shared

8. A Portfolio Approach • Involves creating a general understanding of: • A company’s resources • The business environments in which it operates • How value is created and stored • The key risk issues underlying its value propositions • How its business models are alike and dissimilar • Every important business dimension

9. The Relationship Between Risk and Value Value External Environment Internal Environment Risk The relationship between the internal and external environments produces value, which in turn gives rise to risk.

10. Value • Value is created via: • Relationships • Knowledge, expertise, and technology • Scale efficiencies • Value is stored: • Tangibly in financial and physical assets • Intangibly in relationships, knowledge, expertise, and technology

11. Risk Identification Value External Environment Internal Environment Risk Identification Understanding these relationships permits us to identify sources of potential risk.

12. Risk Identification • Experienced-based approach • Is dependent on personal experience • Search for bad outcomes and try to identify risk drivers • Environmental approach • Seeks to understand the business in the context of its environment • What is changing and how will it affect the business?

13. The Business Environment External Indirect POLITICS LEGAL External Direct CUSTOMERS CUSTOMER PREFERENCES MARKETS REGULATORS Internal THE ORGANIZATION COMPETITORS DEMOGRAPHICS SUPPLIERS DISTRIBUTORS PHYSICAL ENVIRONMENT TECHNOLOGY

14. Risk Assessment and Monitoring Value Internal Environment External Environment Risk Identification Data Analysis Assessment Management Monitoring

15. Gathering and Analyzing Important Data

16. Gathering and Analyzing Important Data

17. Risk Management Initiatives Value External Environment Internal Environment Risk Identification Data Analysis Assessment Management Monitoring

18. Realigning the Internal Environment Mission, Vision & Values Operational Financial Employees Debt and Equity Holders Employment Practices and Compensation Structure Governance and Organizational Structure Legal and Ownership Structure

19. A Portfolio Approach Value Internal Environment External Environment Risk Identification Data Analysis Assessment Management Monitoring

20. Risk Management Cannot be Static • Most companies are only prepared for risks that have already impacted firm value. • Insurers must: • Augment their experienced-based approaches with environmental models. • Change their focus from assets and liabilities to emerging issues that will create assets and liabilities • Develop strategies to mitigate potential losses • Identify new ways to create value