Our Changing Future - ICA

1. Our Changing Future - ICA Peter McDade Neil Meldrum David Stevenson All views are those of the authors and do not necessarily represent the views of their employers

2. Agenda David Stevenson • Background to ICA • Main challenges • ICG Process • Operational Risk • Using the ICA • Possible future developments • What does it all mean for actuaries? Peter McDade Neil Meldrum

3. ICA and ICG • The Individual Capital Assessment (ICA) is a firm’s own assessment of its capital requirements, given its risk exposures • Self-assessment introduced with effect from 31.12.2004 (GENPRU 2.1.6) • Individual Capital Guidance (ICG) is any guidance provided by the FSA on the amount or nature of capital resources to be held by the firm under SUP 9.3 (eg. as a result of review of the ICA) • ICG is not published (private between firm and FSA)

4. ICAS - Motivation • To provide firms with an incentive to improve risk management • Past weaknesses eg. provision for guarantees • Limited engagement with operational risk • Reinforce responsibililty of senior management to manage capital resources of the firm in line with its risk • No longer acceptable to rely on compliance with regulatory minimum requirements • Firms should consider their own risk exposures and form their own views on the amount and quality of capital they should hold • To help inform FSA’s own view of overall capital adequacy of firm • Together with wider supervisory view, helps in providing Individual Capital Guidance Sarah Wilson speech to ABI ICAS conference 06.03.2007 (paraphrased)

5. ICA • Internal risk based capital assessment • Considers all major risks explicitly • Market • Credit • Insurance (mortality/longevity, morbidity, persistency, expense) • Liquidity • Group • Operational • Can allow for exercise of Management Actions • Responsibility of Board (advised by Actuarial Function Holder) • Responsibility to notify FSA if ICA has fallen, or is expected to fall, below ICG (SUP App 2.7)

6. FSA Regulations • No detailed rules • Three main ICAS principles + high level guidance on their implementation (INSPRU 7.1) • Supplemented by Guidance on ICAS produced by ABI & other trade bodies • BAS Guidance (GN46/GN47) • Indication of FSA’s approach to “Principles Based Regulation” ?

7. ICA – Key challenges • Absence of detailed rules • Deciding what approach to follow • Model calibration • Data limitations • Risk aggregation/correlations/non-linearity • Subjectiveness/application of judgement • Engaging senior management • ICG Process

8. What approach to follow? • Instantaneous stress, simulations of t=1 balance sheet or run off? • Measurement – Value at Risk or Tail VaR ? • Confidence level/time horizon • Aggregation of risk (correlation matrix, copulas…) • ICG set using Value at Risk approach at 99.5% confidence level over 1 year time horizon

9. What approach to follow? • Most companies built on existing RBS or Economic Capital models • Capital requirements for individual risks determined by applying instantaneous shocks to „economic balance sheets“ (VaR approach) • Analogous to RCM stress for RBS • Shocks calibrated to be equivalent to a 0.5th percentile event over a one year time horizon • Allowance made for management actions taken to mitigate impact • Overall capital requirement calculated by applying correlation matrix to individual capital reqs • Capital = [ i,j KiKj ]1/2 (i,j are correlations between risk factors, Ki capital reqs)

10. Build-up of ICA - illustration Operational risk Diversi- fication Insurance risk Mgt actions Credit risk ICA Market risk Longevity/Mortality Morbidity Persistency Expense Liquidity risk & Group Risk typically zero or v.small

11. Choice of model • Investment risks – normal, lognormal, percentile from from ESG output, Jarrow-Lando-Turnbull for credit spreads,etc ... • Is model tractable? • How well does model fit historic data? • Insurance risk • Analysis of A/E may help in setting mis-estimation stress • Trend risk more difficult (eg. future mortality improvements % of Long cohort with floor, internal cause of death models) • Operational risk – new territory for many insurers

12. Data limitations • Lack of data – trying to calibrate a “1 in 200 year event”!! • Relevance of data • Most acute for non-investment risks • Example - pandemic event (Avian flu H5N1) • How relevant are past pandemics? • 1918/19 Spanish Flu (40m deaths) • 1957/58 Asian Flu (2m deaths) • 1968/1969 Hong Kong Flu (1m deaths) • What could 1 in 200 year event look like? • Re-assortment of H5N1 genes could result in extremely virulent strain capable of transmission between humans • Greater infection rates due to urbanisation, increase in travel • Availability of antiviral drugs, medical advances • Improved monitoring, transmission containment measures • Different impact on different age groups? • Need to apply judgement

13. Model calibration • Even where data exists, how relevant is it? • Example – choice of time period for investment data • Should periods like World Wars be excluded? • Should we include periods of high UK inflation? • Shorter period => more volatile stresses & more volatile ICA result, but more relevant to current market conditions • Longer period => more stable stresses & ICA result, but possibly less relevance to current market conditions • Question of philosophy/judgement

14. Inconsistency of data • Example – Correlation between Equity Returns and Fixed Interest Returns • Positive for most of 20th Century • Including during 1929 Wall Street Crash, 1973/74 Middle East Oil Crisis, 1987 “Black Monday”, 1997/1998 Russian debt/LTCM crisis, 1990s recession in Japan • Negative in period following bursting of dotcom bubble in 2001/2002 • What is an appropriate “stressed correlation” assumption?

15. Risk aggregation/correlations • Diversification benefit often very large item on ICA balance sheet • Most companies use correlation matrix approach • Judgement in setting „stressed“ correlations • Correlation matrix approach doesn‘t pick up non-linear interactions between risks • Non-linearity could lead to understatement (or overstatement) of ICA • Need to investigate & make adjustments if appropriate

16. Non-linearity • Scenario testing approach • Combined market scenarios calibrated to 99.5%/one year confidence level using results of individual market stresses • „Medium bang“ approach • Calculates adjustment factor by comparing result of • Running individual stresses at lower confidence level (eg. 93%), and • Combined scenario where all happen simultaneously • „Killer scenario“ • Similar to „medium bang“ but prob of stresses weighted towards most significant risk exposures

17. Engaging senior management • Time constraints • Initial „education“ overhead • Ongoing commitment to review & exercise judgement • Provides a common language for management of risk across business

18. ICG Process Internal Planning Submission Request Initial Review FSA Initial View Meeting With FSA Written Questions Indication To Firm FSA Panel ICG issued

19. ICG Process – How was it for you? • More resource intensive than expected • Open discussions • Drip-feed of follow-up questions • FSA views evolved during process • Outcome no surprise

20. ICG • First round now almost complete & second round begun • ICG provided to • 53 life companies (95% of market by liabilities) • 102 general insurers (97% of market by net premium income) • Average ICG (ICG issued in 2006 + Jan 2007) • General insurers – 110% of ICA • Life insurers – 114% of ICA (range: 100% to 170% + “a few outliers”) Sarah Wilson speech to ABI ICAS conference 06.03.2007

21. ICG • Main reasons for ICG “add-ons” • Life • Aggregation (diversification, stressed correlations & non-linearity) • Operational risk • General • Operational risk • Lack of evidence to support choice of assumptions Sarah Wilson speech to ABI ICAS conference 06.03.2007

24. Asking the impossible?

25. Quantifying Operational Risk • Op Risk = risk of loss from inadequate or failed internal processes, people and systems, or from external events • Who cares? • Could adopt simple factor-based approach (eg x% of assets) • Motivation for more advanced approach: • Internal • Better understanding of risk • Effectiveness of controls • Incentivise risk management as controls lead to lower capital • External • FSA • Emerging best practice • Ratings agencies?

26. Can’t get there from here? Capital requirement = x% * Assets How to get from this ...to this? 99.5% 0.5% Capital requirement

27. Main stages of the journey • Design a new process • Identify the key risks • Collect data (actual loss data & ‘expert testimony’) • Create loss distributions • Build & use a Monte Carlo model • Identify required capital at 99.5th percentile

28. Data – the key issue • Data is scanty even for market risks • Much less available for OR • Internal loss data – inadequate by definition • External loss data – useful, but not enough • Expert judgement – subjective but vital to plug gaps • Use everything available, but biggest challenge is to harness the expert knowledge in the company.

29. Key risk identification Failure to set strategic direction Low morale High staff turnover Staff shortage Poor complaints handling • Filtering process trying to identify the most significant risks • Focus on loss events not strategic risks • For risk management purposes the whole chain of causality is important. • For the modelling we focused on the “immediate prior cause” (eg poor complaints handling) • This is where the financial loss actually occurs • More concrete and therefore easier for people to come up with numbers • Identified collection of front line risks eg • Business interruption • Poor complaints handling • Legal risk • Fraud • Pandemic Flu

30. Scenario workshops • Series of workshops set up involving risk owners / experts in each field • Tasked with creating loss distributions for each of the front line risks • Facilitation challenge – strike balance between • Motivation (this affects actual capital & perhaps S&P rating) • Terror (this affects actual capital/rating!!) • Asking the impossible? • at least 3 points on a loss distribution for each risk: most likely, severe, extreme events • need both impact and probability for each point • use experience of actual losses & existing controls • brainstorming, no wrong answers, ‘what if’ analysis • knowledge, enthusiasm, creativity

31. Example of a loss distribution

32. Monte Carlo modelling - best way to combine the loss distributions • Inputs to model: • Loss distributions • Correlation assumptions • Each simulation produces an aggregate loss across all risks • Run 10,000 simulations • Now have aggregate loss distribution • Capital requirement = 99.5th percentile loss Note – can allow for correlations between risks

33. Useful to have drill down facility – can examine component loss events for any simulation • Management challenge - is this scenario plausible?

34. Embedding • Such a process should become a core part of risk management • Rapid development in recent months – will want to go round loop again this year to ensure robust • Management review of data & modelling results: • Challenge / feedback / refinements • Not an exact science – a means to an end • Improving understanding of the key risk drivers • Help to formulate & articulate risk appetite • Connecting up operational and financial areas of the business • Eg value of good insurance policies => no changes should be made without considering capital implications. • Improved collaboration across functions. • Helping you to understand: • for some risks holding capital is unavoidable • for others better solution is strengthen controls • tradeoffs between the cost of improving controls and the savings in capital [cf cost/benefit of hedging market risk]

35. Journey will continue Can always improve on the modelling, but the data is a bigger challenge Not impossible! Scope for creativity Are we there yet?

36. Final Destination Reached?

37. Using the ICA (“Embedding”) • ICA is more than just a number, it’s about good risk management. • ICA is “superior” to the old Pillar 1 calculations as it measures the capital required based on the risks inherent in a company’s business. • But the measurement of risk is only one part of a strong risk management structure. • The first wave of reviews largely focused on the measurement of risk……

38. Using the ICA (“Embedding”) • …. However, the second wave of reviews will be different. “……we are looking at how best to add real value to the next round of reviews of ICAs……...scope for added value from taking a more qualitative approach – challenging firms on how they are using their ICA in practice to make better business decisions and improve risk and general governance”. Sarah Wilson, Director Retail Firms Division FSA (6th March 2007) • So the bar is being raised by the FSA.

39. What have companies done so far? • Strategic Decisions • Review of risk appetite • Information gleaned from ICA used to develop hedging strategies. • Revised reinsurance arrangements. • De-risking asset mix. • Operational decisions • Using in capital projection plans. • Some companies have sought to embed economic capital into pricing. • Used in the determination of investment policy

40. Regulations and Guidance • FSA launched its new ICA Principles during 2006. • Objective was to give greater clarity over FSA’s expectations and help deliver consistent capital guidance across the industry. • 3 sub-principles (rules), which can be summarised as: • Assessment must reflect the firm’s actual risk profile. • Comparability to a 99.5% / 1 year probability that the value of the firm’s assets will exceed the value of their liabilities. • Model methodology: documenting the firm’s reasoning and judgement underlying the ICA assessment. • The ABI also launched its “A Guide to the ICA Process for Insurers”, which aimed to provide advice to companies on how to interpret guidance.

41. Possible Future Developments • ICA is still in its relative infancy and emerging best practice will continue to develop. • Methodology and assumption changes are becoming less of a priority • Short term challenges include • (Refining) Projections of the ICA • Developing robust analysis of change • Enhancing operational risk methodology • Developing scenarios • More attention is planned to be given by the industry to improving integration and use of the ICA in the business

42. Possible Future Developments • Future developments are likely to be influenced by Solvency II, as UK Insurers are likely to want to go down the “internal model” route. • To have internal model approved for solvency II, there are three tests to be passed. They are: • Statistical Quality Test • Calibration Test • Use Test • FSA to suggested to date that the hurdle to be passed for these is much higher than the UK industry has had to achieve so far under the ICAS regime.

43. Final Destination Reached? • Still work to be done in embedding ICA by the industry • Work required by industry to get internal model approval for Solvency II • So the journey not yet complete.

44. What does this mean for actuaries? • ICA is principles based not rules based. • Requires a lot more judgement which have to be justified to Board (ultimate ownership). • Quantifying the risk requires detailed modelling, but also understanding of the weaknesses of the model. • Need knowledgeof all the business • Cannot be a “one department” number. Need to listen to the business to ensure that the risks are considered. • Need to explain what the number means in business terms – how does this number relate to risk in the business. • Therefore, actuaries are very well placed for ICA/Solvency II with skills and knowledge we can bring to the table. • This provides interest work and enhances marketability. • Opportunities in Europe as they address Solvency II ? • However, no room for complacency – other skilled professionals in the risk assessment field.

45. Question Time.