The role of the risk function in business planning

Risk experts discuss how they influence strategy and business planning in the first of a two-part roundtable held by InsuranceERM and QRM

Christopher: What's your schedule for business planning? And how does the risk function get involved?

Finn: Business plans are continuously evolving, but for risk, the planning process ramps up around September and runs up to Christmas ahead of the year-end disclosures process. Risk inputting early in the process is helpful given the various stakeholders that need to be managed. It's important that the plan (and risk's review of it) considers not only the next 12-36 months, but also the next 10 years.

Ruth: Sometimes it's difficult to know when planning starts and stops. In our case, there's a bit of a rolling cycle: a formal plan gets approved, a budget gets approved for the year, then probably around the mid-year we bring together thoughts for the next plan.

We're an operating company, so some of our requirements are fed down from the group. We think about what that would mean, and create a high-level three-year plan with details for the first year.

Risk management would be involved on all stages: in that first stage, reminding people of risk tolerances, risk appetites, etc. We time the ORSA [own risk and solvency assessment] process so we get the ORSA around year-end. At the beginning of the year, the year-one budget is signed off once you have all the information from stress testing. From the stress testing, we get another view of risk appetite.

Robert: If you have a Lloyd's syndicate, it can be a complication, as you'll have that part of the business begin its planning around the March-April time, in order to submit to Lloyd's by late September. The other part of the business really only starts in late September once everybody's been freed up from Lloyd's. So it's an ongoing year-round process.

"Part of our job as risk managers is to hold a mirror up to reality"

For risk management, highlighting risk appetite and risk tolerance is absolutely crucial at the outset of the planning.

There are two other areas where it has been tough for risk to participate in, but it's becoming more accepted. First are the difficult conversations around non-performing parts of the business. The business doesn't like to be reminded where it's failing, but part of our job as risk managers is to hold a mirror up to reality.

The other aspect is holding people to account for reality: I'm sure we've all been in organisations where there's a standard roll forward, an operational expense fee of 10% on every policy or every product line. But not all product lines are the same, so is it right that we should be subsidising one product line with another? Getting into that level of understanding of the business is quite difficult from a data perspective. But I think it's behove on risk management to be the people driving that, because otherwise the business planning process can just become a little bit of a tick-box exercise.

Socrates: As a life reinsurer, it's all about the morbidity and mortality exposure. Planning all starts with a risk appetite and limit statement that gets approved by the board. It's a tightly managed process that culminates in the ORSA. As the risk person in the room, I need to ensure all these moving parts come together at the right time.

We need to get the ORSA approved before the end of the year, so in the summer we are working with finance and valuation teams on stress and scenario testing (SST). The crux of our world from a risk standpoint is ensuring that we produce a quality ORSA.

Giles: We do SST at different points during the year, both regulatory and internal. That feeds into our risk framework which informs our risk appetite, and that becomes an input into the business planning process.

"Lots of the comments in the business plan from us are about managing the operational side"

Our draft business plan to the board had about six risk management slides in it: our draft view included different options around what the board might like to do from a new business perspective, and then risk would comment on each of those options.

We take our understanding of risk appetites and SST, look at the numbers in the business plan, and question if there is enough headroom above our risk appetite metrics, particularly for key metrics like solvency and liquidity. We also bring in horizon scanning: what do we know about what's coming down the track? If we're seeing much larger environmental stresses than we've seen before, maybe we need to be carrying bigger buffers?

We also focus on the operational side. We have a growing business so maintaining appropriate business systems, people and capability is very important. Lots of the comments in the business plan from us are about managing that, to make sure we don't crystallise any operational risks.

"One of the worst things we can say to our colleagues in the business is: 'I told you so'."

Ruth: It sounds like you've really got risk management embedded in the business. Do others here have views on how we best work with our businesses to avoid that Cassandra moment, where our stress testing analyses show where there might be pinch-points but these might not be areas that the business is prioritising as part of their strategy. Ultimately, as risk managers, one of the worst things we can say to our colleagues in the business is: 'I told you so'.

Giles: You have to leverage the little things when they do crystallise and say: 'Look, fortunately this hasn't broken us, but it could have done. Therefore it's very important that we take this seriously.' We escalate issues to our risk committee and board for discussion to demonstrate their importance, and to send the messages back down that they are important.

Robert: One of the critical elements of risk management is closing the loop. It's not always about the future. Sometimes it's about asking: 'What happened last year? What did we do last year? What did we say we were going to do last year?'

Maybe we said we're going to do eight projects, but we got four done, and we have the same amount of people and this year we want to do 12? Sometimes it's just as simple as that: replaying the numbers back to the business and saying: 'Do you want to rethink that?'

Giles: It's also about substituting for the strengths and weaknesses of your Executive Committee (ExCo). Quite a lot are focused on the financial and performance risks rather than operations. So I see our job in risk management is also to give a voice to the chief operating officer.

Charles: How is the planning/forecasting function performed within your organisation and who is in charge of it?

Finn: Plans have to be owned by the first line. Within Aviva, the planning process ultimately sits in finance but they will require impacts from all our business units and functions to understand what is being committed to in terms of growth in products, volumes, etc. Finance then need to check that this is consistent with overall external commitments.

Financial analysis is key to the whole planning process. Risk needs to slot into that. We have risk functions within all our business units and at Group level, so when risk are reviewing the plan, it requires good communication across all teams.

Giles: Our plan and our model used for planning is owned by finance. The inputs into that plan will come from the chief strategy officer who sits on the ExCo and reports to the CEO. Finance will perform the model runs and come up with the various different options. Then risk will opine on the outputs from a second line perspective.

Charles: Some of these metrics are finance-focused and other metrics are risk and capital-focused. How do you blend new volumes and income with the risk metrics?

Robert: For me, it's not about taking the plan and turning it into risk numbers. It's about all of the steps that you take before you get to that finance plan. Before you talk to anyone in finance, I want to know from the reserving actuaries what was the technical adequacy on the rates that we're expecting for next year's books. What does that rate entail? How much of that rate is actually inflation? How much is pure market hardening? Are they taking into account the market cycle? All of these questions need to be addressed at the absolute outset.

These questions go into determining the numbers that go to financial planning and analysis, then go into the financial plan and then come up with that one number. You know at the end of it you're going to have two management overrides: an addition to the top line and a deduction from the operational expense. If you're waiting until you get to the finance plan, I don't think you're going to have an awful lot of impact in the business, because everything is baked in by the time it gets to finance.

Charles: That process you describe seems to have multiple interdependencies before it comes up to the top. So what happens if management says: 'I want to look at five or six different scenarios?' Do you have to go back through that process and talk to each one of those individuals to get their updates based on the new scenario?

Robert: There are two parts of scenario analysis. What I would look at is the granular scenarios: so when we're building out those plans, I'm talking to product and divisional heads about what each scenario looks like. Then there's the big macroeconomic scenario planning, for example, taking the balance sheet and doing a yield curve shift. Those two types of scenarios come at different times in the process.

Giles: Our draft business plan has got quite a few scenarios. Those scenarios have to be realistic, but they don't necessarily have to be all worked up with their full assumptions. We know the risk factors should all look okay because they're not able to go outside those parameters in the business planning process. You put all the options through and you have a debate with the board.

The main thing they're looking at is how much capital is being invested versus returns. We have some competing metrics in life insurance: own funds, EV and IFRS. So, you have to decide on what return you want out of each of those three.

The board debates with management about which scenario or where between these scenarios they'd like to calibrate their appetite. Management talks about the risks associated with those, then we land on a position and do all the detailed work required to support that business plan.

That goes back down to all the departments, who say what they are going to do to meet the targets. On the basis of that, we are able to get a lot more detail for the final business plan. We would also run risk scenarios on the final plan, looking at the various things that can affect the business over the year or the five-year period.

Part two of this roundtable – discussing how firms manage competing metrics, practical stress and scenario testing, optimising strategies and what's missing from the planning process – is available here.