107th Mid-Atlantic Mutual Advantage Convention Enterprise Risk Management Framework

1. 107th Mid-Atlantic Mutual Advantage Convention Enterprise Risk Management Framework For Small to Mid-Sized Property & Casualty Insurance Companies Presented by Joseph F. Morris CPA, MBA President & CEO, American European Insurance Group, Inc.

2. Why Companies Have Not Implemented ERM? • It’s not required • I’ve been managing risks my entire career; form over substance • I see no benefits • I view ERM as adding time and expense • ERM is operating by committee • Why do I need to involve the Board?; It’s management’s responsibility to manage risks • My company is too small; ERM is only for large companies • I understand the theory, but how do you put it into practice?

3. Learning Goals • Recent Regulatory Developments • Expectations of Rating Agencies • Enterprise Risk Management Framework • Definition and Benefits • Creating a Risk-Aware Culture • Determining Key Risk Factors

4. ERM – Regulatory Developments • 2013 Annual Registration Statement Includes: • “the insurer’s board of directors oversees corporate governance and internal controls and that the insurer’s officers or senior management have approved, implemented and continue to maintain and monitor corporate governance and internal control procedures.” • 2014 Form F (Enterprise Risk Management Report) • 2015 Own Risk Solvency Assessment (ORSA) • 2016 Corporate Governance Annual Filing (Proposed)

5. A.M. Best: ERM in the Rating Evaluation Process Enterprise Risk Management is the common thread that links balance sheet strength, operating performance, and business profile Source: A. M. Best Company

6. A.M. Best ERM Expectations • All insurers need to establish an ERM framework • ERM capabilities should be proportionate to risk profile of insurer • Insurers need to establish firm-wide risk tolerance metrics • Insurers need to have their own view of capital adequacy • A low risk profile and high ERM capability will produce a ratings “lift” • Leading insurers are utilizing stochastic-based capital modeling to better support risk-reward decisions Source: A. M. Best Company

7. Enterprise Risk Management Framework

8. What is an ERM Framework? Enterprise Risk Management Framework Measure Enterprise Risk and Risk Correlation Identify Measure Manage & Mitigate Risks Establish Risk-Aware Culture A disciplined process to systematically identify measure and manage various types of risk Source: A. M. Best Company

9. Benefits of Enterprise Risk Management Framework • Maximize value to the organization’s various stakeholders • Manage exposure to earnings and capital volatility • Ensures future capital levels exceed regulatory and rating agency required capital levels • Create a risk-aware culture that encourages risk-taking • Develop consistent metrics to measure risk and to establish risk tolerance levels • Assign roles and responsibilities to board, Sr. management and others • Maintain excellent rating from rating agencies

10. Enterprise Risk Management Risk-Aware Culture

11. ERM – Risk Aware Culture ERM Tone Established by Board of Directors and Senior Management • ERM roles and responsibilities clearly defined • Define risk profile, risk appetite and risk tolerance parameters • Mission, Strategic Planning and ERM documents shared with all employees • Executive compensation includes ERM objectives / results • Financial results and risk management initiatives reviewed with employees ERM Tone Established by Board of Directors and Senior Management

12. ERM Terminology What is Risk Profile? A narrative description of the parameters for executing the company’s business strategy

13. ERM Terminology What is Risk Appetite? The boundary level of uncertainty a company is willing to assume given the corresponding reward associated with the risk

14. Risk Profile and Risk Appetite Examples • Written Premium Profile • Line of Business, Geographic, Product, Class of Business, Agency Concentration • Limits of Liability • Coverage • Reinsurance Profile • Reinsurance Credit Quality • CAT Exposure • Per Risk Retentions • Operational Profile • Underwriting & Claim Practices • IT Performance, Data Quality & Business Continuity and Recovery • External Environment • Regulatory • Legal/Judicial • Economic • Industry Competition • Capital Management • Financial Ratings • Access to Capital • Debt and Holding Company Structure • Capital Adequacy • Balance Sheet • Loss Reserves • Investment Portfolio

15. ERM Terminology What is Risk Tolerance Level? The financial metrics that establish thresholds for levels of risk that the company is willing to accept in order to accomplish its strategic objectives.

16. Risk Tolerance Level Examples Enterprise-Wide Risk tolerance Levels • Economic Capital Model: Probability of Ruin at 99.5% VaR, One-Year Out • Best Capital Adequacy Ratio, One Year Out to Achieve/Maintain A- Rating • NAIC Risk Based Capital Greater Than 300 • Net Written Premium to Surplus ratio of Less than 1.5 to1 • No Greater Than a 10% Loss of Capital From all Risk Factors in Any One Year • Holding Company Debt to Total Capitalization Ratio

17. Risk Tolerance Level Examples Individual Risk Tolerance Levels • Net of Reinsurance Underwriting per Risk Retention Equal to 5% or Less of Capital (net of tax). • Loss and LAE Reserves Set at or Above Mid-Point of Actuarial Range of Estimates • No Greater than a 5% Loss of Capital in Any One Year Due to a 100 Basis Change in Interest Rates

18. Identification,Measuring and Monitoring Key Risk Factors

19. Primary Causes of Financial Impairment

20. Key Risk Factor Categories - Definitions • Credit - exposure from all potential creditors including agents, reinsurers, bond issuers and insureds • Market – exposure to liquidity events, asset/liability mismatches and risks in investment portfolios due to changes in interest rates, equity prices and exchange rates • Underwriting – exposure from underwriting insurance products including: product development, regulation, loss reserves, pricing metrics and catastrophic events • Operational – exposure to management change, business interruption, fraud, data capture and security, claim handling and employee retention and other operating activities • Strategic – exposure to economic downturn, industry competition, rating agencies and availability of capital

21. Categories of Key Risk Factors

22. ERM Key Risk Factors – Heat Map 8 10 4 5 11 2 6 Low Probability High 1 9 7 3 12 Low Severity of Event (% of Surplus) High

23. ERM – #1 Risk Factor: Pricing Dashboard

24. Is Your Company Capable of Managing Key Risks?

25. Enterprise Risk Management Framework Risk-Aware Culture Risk Profile Risk Tolerance Roles/Responsibilities ERM Process Integrate ERM Process into Standard Operating Practices of Company

27. Joseph F. Morris, CPA, MBA Bio Joseph F. Morris, CPA, MBA, has over thirty-four years of insurance industry experience. Prior to founding P&C Insurance Company Strategies, LLC, Mr. Morris was President of Stonecreek Specialty Underwriters, LLC. Previously, Mr. Morris was President and CEO of James River Insurance Company from 2008 until 2010 after serving as President and CEO of The Philadelphia Contributionship, the oldest insurance company in the United States. Mr. Morris also held several positions with United America Indemnity, Ltd. (UAI) including President, President & CEO Penn-America, UAI’s excess & surplus lines subsidiary, and SVP and CFO of Penn-America. Mr. Morris began his insurance career at Reliance Insurance Company where, over a twenty-one year career, he held a number of financial and operating positions. Mr. Morris has been a member of the Board of Directors of The Insurance Society of Philadelphia since 1989 and was its Chairperson in 1997-1999.

28. Disclaimer of Warranties The content of the presentation materials has been prepared by P&C Insurance Company Strategies, LLC (PCIC Strategies) “as is”, for informational purposes only and without warranties of any kind, either express or implied. PCIC Strategies disclaims all warranties including but not limited to warranties of title, implied warranties of merchantability, fitness for a particular purpose, compatibility, security, accuracy, reliability or infringement.