Risk management priorities post-Solvency II

Insurers may have implemented Solvency II but the work of the risk function is far from complete. As well as testing Solvency II systems properly, other issues such as Brexit have risen up the agenda, as chief risk officers discuss in part one of this InsuranceERM/BearingPoint roundtable

Chris Cundy: Is your Solvency II work complete?

Michael Hosking: We have gone through the steepest part of the change curve. However, some of these processes and frameworks need to be properly tested and an active hurricane season might be a way of testing whether they are fit for purpose. Will model change policies be practical? And will risk profile changes work through from capital requirements and capital adequacy reporting through to the regulators? 

Another obvious example is the reporting requirements. There is a lot of manual work still being done on Solvency II reporting and the financial reporting cycle; refinements and efficiencies need to be made here. 

Greg Shepherd: I agree: while the work is done in terms of the architecture and the construction, there is a certain amount of modification and refinement needed. 

Mark Chaplin: Solvency II is pretty much business as usual, but the world keeps changing, so we will continue to look at aspects as challenges arise. There is still a little bit to do on reporting.

Chris Cundy: Is there still work to do on validation processes?

Michael Hosking: It takes a lot of work to understand the best way to manage the process from business planning to capital planning and then to the validation and ORSA work. Most firms have probably gone through five or six annual validation cycles, and in recent years refinements have focused on risk and ORSA planning, which includes the validation and documentation. 

Boards have struggled with the amount of documentation received on a quarterly basis, so actively reviewing the documentation framework is vital, to ensure it is appropriate and not overloading the board agenda.

Greg Shepherd: In the first few years we went through a massive exercise of having to test everything multiple times. Now, you can focus on the key areas or areas where the business is changing significantly. You can streamline the process and engage with the board on the most important things that are going to generate interest. 

The key areas we are looking at now are things like increasing or decreasing natural catastrophe exposure, changes in the reinsurance programme, and flexing the investment mix. You can simultaneously achieve model validation and provide some useful information to the board. 

Mark Chaplin: Typically you revisit more frequently and spend more time on the risks that form the big part of the SCR, but you need to guard against the lesser risks to which your exposure may be increasing, and the potential that you start optimising against the model rather than reality. You need to tie validation to business planning processes and invest more time in calibrating and validating the part of the model that corresponds to where you're planning to take more risk.

Chris Cundy: Does everything get looked at annually? 

Mark Chaplin: There is an annual model change process, so typically things do not get looked at more frequently than annually, unless there is something that would be a substantial shift. However, the less material risks are on a longer time cycle than that, either three years or five years. 

Greg Shepherd: We have a set of standard tests where we check whether the capital is moving in line with underlying changes in the business. Then, we do a number of thematic deep dives, looking at different aspects that are more topical, according to what is happening in the business.

Communication 

Chris Cundy: Are you still spending time explaining Solvency II to the board?

Greg Shepherd: Obviously when new people join the board, they have to go through an education process. Understanding of the practicalities, particularly on how model change operates, continues to develop over time.

Michael Hosking: There are still questions around technical aspects – like the Solvency II balance sheet and contract boundaries, or risk profile changes and the impact on the risk margin. These are difficult concepts for people to relate to. But on the whole, the questions are getting fewer and better.

Supervisors' focus

Chris Cundy: What areas are supervisors turning their attention to, now Solvency II is mostly implemented?

Mark Chaplin: They are returning to the regular cycle of prudential supervision: deeper dives in particular areas, a focus on evolving the framework and improving their understanding of the business. I also think the regulator has slimmed down their teams.

Greg Shepherd: With Brexit, the PRA has quite a lot to do. Also, annual model change applications present quite a heavy workload. But we have seen some activity in other areas – things like market-turning events and cyber – which is obviously a good thing as these are risk management focused.

Michael Hosking: The focus is now on underwriting, pricing and reserving practices, which is sensible given the soft market. There is also a focus on the fundamental business models of insurers.

Having said that, Solvency II is so over-arching that a lot of the components are essentially just refinements or enhancements in elements of the Solvency II framework. For example, the remuneration requirements, the Senior Insurance Managers' Regime, and the cyber risk framework updates.

Brexit planning

Chris Cundy: As a risk function, what have you been doing to help your firm respond to Brexit? 

Mark Chaplin: Overall, Brexit has no significant operational impact on Aviva as our European subsidiaries are incorporated and regulated locally and principally trade in their local market. 

Our risk function led the preparation activity and leads the programme of activity to implement our Brexit solutions. We did all the preparatory work in terms of scenario planning, the no-regrets actions we would take in advance of the referendum, and an idea of the course we would take post referendum.

Now, we are de-branching our Irish businesses, establishing Irish entities and securing authorisations and Part VII transfers, as well as looking at other related risks that may be relevant – data transfers into and out of the EU, for example. 

Chris Cundy: Will your plans continue regardless of the outcome of the Brexit negotiations?

Mark Chaplin: We would love for there to be a more appropriate transition arrangement. We branched the Irish business for a reason – it is more efficient that way – so we would have liked to avoid changing that. 

However, if you work backwards from when Brexit will happen, and think about all the authorisations we need in that time, we cannot wait for the outcome of the negotiations. Obviously, if things change, then we will look at it again, but I remain sceptical that we will get sufficient clarity over the outcome in the timescale that would allow us to pursue a different course.

Michael Hosking: Whether you are an early or late mover, you are going to have to take some level of risk, because things will not have settled down by the time you need to get applications in for new structures.

Greg Shepherd: We are applying to establish an insurance company in Germany using Brexit as an opportunity to make a strategic play into Europe. Obviously, there is an overhead in establishing the entity, and it increases complexity, but we see it as an opportunity.

Implications of Brexit

Chris Cundy: Following Brexit, would you welcome a more relaxed interpretation of Solvency II? What changes do you think the UK should be pushing for?

Mark Chaplin: There are some things that need to change, the most critical being the risk margin. We would also welcome more flexibility on matching adjustment eligibility and a reduced reporting burden. However, whether or not we will see a divergence from Solvency II in the UK is hard to predict without knowing the shape that Brexit might take.

Michael Hosking: The UK regulators drove a lot of the requirements in Solvency II so it would be odd for them to retract from the core concepts. But if they could change anything, it should be the application, as opposed to the rules and requirements: Solvency II should adapt more to the risk profile of the company.

Greg Shepherd: In light of the enormous investment by the industry over a period of years, I would not support a massive revision. However, some focus on individual areas would be welcome.

Risk culture

Chris Cundy: The risk culture of insurers has received a lot of attention in recent years. Is work continuing in that area? 

Mark Chaplin: Culture generally is receiving a lot of attention. Aviva has set its stall out as being a 321-year-old disruptor; that requires a change in the way you think and behave in the business. Associated with that, from a risk perspective, is more distributed decision-making and more agile operations. We are seeking to have the positive attributes of a fintech company, despite having 30,000 employees.

Particularly with the distributed decision-making, you need to weave in a strong element of risk-aware culture. But it is broader than just saying it is a risk culture. It is a customer-focused culture. 

Greg Shepherd: Having a good culture throughout the organisation can be more challenging in a geographically diverse business. Measuring risk culture is not that easy, but we produced a report on risk culture to our risk committee earlier this year.

Michael Hosking: We complete regular risk culture reviews. These generally address whether people are comfortable in their role? Do they understand what processes are most important? Do they understand what developments and which enhancements are most important?

It is important to understand if people understand their role and responsibilities, if communication channels are open, and if there are any gaps in the control framework. The output tends to be a qualitative report as opposed to a quantitative dashboard. 

Part two of this roundtable can be read here