Articles - 360° View of Risk

 Steve Wilson, CRO at Zurich Financial Services, talks us thorugh a 360 degree view of Risk with Ivan Clarke of IPS

 Q: Steve, over the time I’ve known you, you’ve held a number of positions in both the actuarial function and as a general manager. Could you give our readers an insight into your career track?

 A: Well, the vast majority of my experience is in P&C – I spent several years in London, initially as a consultant and then as the actuary for a small primary insurer. I joined Zurich in 1993 and was based in the UK until 2004. In that time I worked both as an actuary and as a general manager, running part of our small business book. I moved to Switzerland to take up the position of Group Chief Actuary, and then stayed in Switzerland to head up Specialty product lines for Zurich globally, which was a great opportunity to take a role with the objective of driving profitable growth over different geographies.

 Q: And you’re now Chief Risk Officer for Zurich’s P&C business globally – can you give an outline of what the CRO role involves?

 A: This is a new role based on two major changes within Zurich. First, we restructured the Risk function to be more oriented around the “business” – i.e. the management structure. Second, we integrated the global management of the General Insurance business.

 This new CRO role requires both actuarial skills and broader business experience as the way Zurich looks at risk is to take a “360 degree” view. This means looking at all risk types, from technical insurance risk through to business, strategic and operational risk such as data security, reputation, regulatory and so on.

 Q: And as CRO what are your key responsibilities?

 A: Well, first, I should explain Zurich’s approach to risk management. We adopted the concept of Enterprise Risk Management some years ago and “ERM” is well embedded within Zurich’s businesses. The principle aims are to promptly identify, measure, manage, report and monitor risks that affect the achievement of strategic, operational and financial objectives. This includes adjusting the risk profile in line with the Group’s stated risk tolerance.

 So the overarching objective for my role is to deliver that mandate.

 
 Q: So, for you at Zurich is ERM a management tool or a governance process?

 A: Actually, Ivan, it is both. We believe that management needs to manage its own risks. We call that the “first line of defence”. Good business management is an important principle, in whatever business you are in, and it requires that you understand the risks and take appropriate mitigating actions.

 Risk management is the “second line of defence” and our job is to review the way management looks at risks, to provide them with guidance on how to assess risk using various tools and to challenge managers to demonstrate they have the appropriate understanding and controls in place. Take a look at the chart which outlines our governance model.

 Q: So, your approach to Enterprise Risk Management includes reviewing risk related to business activity beyond the traditional underwriting and financial areas?

 A: Yes it does. And in fact, we also use our experience to support our large customer segment. We developed a process known as Total Risk Profiling, that can be used in any situation. Internally, our business leaders use it for annual strategic risk reviews, our managers use it for assessing risk in major projects and we also use a version of the methodology to help customers manage their risk. Take a look at this link to see the tool we use with our customers: http://www.screencast.com/t/Wvno7sQryC

 
 Q: You’ve mentioned reputation and brand – are they included in your risk management work as this seems a little bit like marketing to me?

 A: Absolutely they are – taking a 360 degree view of risk means that we look at anything that can cause harm to our organisation. In today’s environment, it is important to recognize the value of your organisation’s standing with customers and other stakeholders. Of course, social media amplifies your company’s actions – so getting it right has never been more important.

 It’s a more difficult to apply mathematical models to something like reputational risk but broader risk management disciplines are appropriate. A lot of risk management is just common sense. And, in any case, I remember from my days in London in the 90’s, there was often push back to the GI actuaries in some lines of business because the data were limited. But it’s exactly when data are limited, that you need strong discipline.

 Q. What about the more technical aspect of Risk, such as formulas or mathematical models?

 A: Well, Ivan, Zurich has some brilliant minds looking at how we model risk of all types. For example, we’re exploring how we can use credit default swaps to assess how the market views our solvency ratio. A kind of market-consistent – or actually – market implied solvency ratio.

 Q. And why do you need that – isn’t your conventional calculation enough?

 A: Well, sure, we’re very happy with how we calculate our solvency ratio and with what it tells us about our risk profile, but as a risk officer it’s important to understand how others view your risk profile. Many economists and investors put significant weight in how markets view risk – just like how the bond markets imply future inflation. Personally, I think markets tend to over and underestimate risk, but it is useful to take a reading from them.

 
 Q. Turning to the recent crisis and the role of regulators – what would your view be here?

 A: First, its worth saying that its not just regulators but other stakeholders such as rating agencies, investors and accounting bodies who are now placing emphasis on the importance of sound risk management, so a good ERM system is important from several perspectives.

 And this certainly isn’t new, but only now are the significant changes in the insurance industry coming into effect with new regimes, such as the Swiss Solvency Test and Solvency II. The big change is that these regimes emphasize a risk-based and economic approach, and so require comprehensive quantitative and qualitative assessments. Hence, we’re seeing actuaries moving into the risk management field because of these trends.

 
 Q. So what do you think the future holds for Risk?

 A: I think there are a three trends to watch out for.

 First, as the managements (and external stakeholders such as analysts) become more familiar with the risk based approach to solvency, we will increasingly move to more risk based performance analysis. That is, moving away from the accounting measures which generally don’t have an economic or risk-based dimension. After all, just about any investment decision requires the investor to contemplate the risk-return balance, and so the tool-kit of today’s risk manager is likely to be used more broadly in this way.

 Second, CEOs and business leaders are looking for more insight in business planning and management and increasingly expect a focus on potential business challenges in the period ahead and not just on extreme events.

 To do this, insurers need to change the way they look at risk. Rather than analyzing simply by risk type (such as market, credit, and operational risk), the risk management model should be able to look through different lenses, depending on the risk. This will facilitate a better understanding of aggregate exposures across the enterprise and hence enable de-risking as necessary. These lenses can be the management structure (e.g. for risks within a customer segment or a certain business activity which spans the organisation), geography (because some risk types are strongly related to the environment in which the business activities are being conducted) or product/line of business (because exposure to the same product or asset class often exists across multiple geographies). The CRO should play an important role in identifying trends that may elude local management teams or functional leaders.

 Third, there’s a growing school of thought that capital based solvency systems in financial services are not necessarily getting at the core issues of risk management. In this respect, insurers are actually in pretty good shape as we are really quite sophisticated in analysing the risks we take on. For example, our pricing models are generally very sophisticated. But if we look at the recent financial crisis, we can see that it was in part driven by lack of transparency in the transfer of financial risk. In other words, the mortgage based derivative instruments created an effect a little reminiscent of London’s LMX spiral from the late 80’s / early 90’s. So, I’d see the third trend being insurance risk managers and actuaries lending their skills in up-front risk assessment to the banks.

 
 Q. Sounds like there’s several areas where actuaries can add value?

 A: Absolutely. As I say, the role of the CRO is evolving. If we look back for a moment, we see the industry didn’t have risk officers for most of its history – and managed to do just fine! But there have been long standing responsibilities for actuaries, usually in the areas of valuation or reserving. Some of the statutory responsibilities of actuaries have been quite broad (such as the UK appointed actuary, or the Swiss “Responsible” Actuary) and these are somewhat proto-types for risk-based governance.

 Now with the enormous complexities of both the insurance risk world and the financial assets and instruments that insurers have on their balance sheets, not to mention broader risks such as in data management and reputation, it is a time when the skills of the actuary are ideal for both advising the business on strong risk management and developing powerful governance frameworks.