Enterprise Risk Management

1. Enterprise Risk Management Assurity Life Insurance Company KCAC Seminar Kansas City, MO June 24, 2009

2. Assurity Life Insurance Company Background • Mutual Holding Company structure • Merger of 3 companies: Woodmen Accident and Life, Security Financial Life and Lincoln Direct Life • $2.2 billion in assets • $233 million in Surplus and AVR • Conservative investment portfolio • Focus on protection-based products • No Variable Life or Variable Annuity business • No secondary guarantees • No specific Risk Management Process concerns, but management was concerned that the processes in place to manage risk were not being communicated well enough to stakeholders

3. Assurity’s ERM Process Goals • To understand and manage the risks being taken • Strengthen a risk awareness culture throughout the organization • Actively set appropriate “tone at the top” • Better communication both within the company and with external parties regarding Assurity’s risk profile • Establish clear risk ownership/accountability • Maintain the long-term view

4. Assurity’s ERM Process • Risk identification • Risk assessment • Risk limits/triggers • Risk management and mitigation • Risk monitoring/Key Risk Indicators (KRI’s) • Risk reporting • Learn and adjust

5. Development of Assurity Life risk and opportunity map, monitoring, and reporting tool… • Capture all key risks/opportunities • Develop a common language/understanding of risk classifications and definitions • Show cause and effect relationships • Integrate risk management, corporate governance, balanced scorecard • Paperless and scalable • Top risks assessed and monitored • Top down and bottom up risk assessment

8. Risk Decomposition

9. Risk Management

10. The Risk Intelligent Enterprise Maturity Model How capable is your company today? How capable does it need to be? Every industry, company and division is probably at a different stage of development. Where should they be and how do they get there? Built into decision-making Conformance with enterprise risk management processes is incentivized Intelligent risk taking Sustainable “Risk management is everyone’s job” Integrated response to adverse events Performance linked metrics Rapid escalation Cultural transformation underway Bottom-up Proactive Tone set at the top Policies, procedures, risk authorities defined and communicated Business function Primarily qualitative Reactive Reaction to adverse events by specialists Discrete roles established for small set of risks Typically finance, insurance, compliance Ad-hoc/chaotic; depends primarily on individual heroics, capabilities and verbal wisdom 1. Tribal & Heroic 2. Specialist Silos 3. Top-Down 4. Systematic 5. Risk Intelligent Rewarded Risk Un-Rewarded Risk Source: Deloitte

11. Some thoughts on developing a successful risk-taking organization… • Know your appetite for risk and foster a culture that is in tune with it. • Maintain a healthy dose of skepticism. • Don’t oversimplify risk – recognize that risk has many dimensions. • Avoid “model fixation.” • Start preparing when times are good (and stable) for bad and risky times. • Pick the right people. • Make sure the incentives for taking risk are set correctly. • Preserve your options.