Risk of Disruption
Putting an operational risk charge into risk-based capital December 2017/January 2018The risk of losses from operational mistakes and disruptions, long considered a significant risk in the banking industry, has become an emerging concern for the insurance industry and its regulators, particularly in light of the increasing number of cyber breaches revealing sensitive consumer data held by insurers. Insurers are increasingly including operational risk in their risk mitigation programs and their internal capital models. An operational risk charge is included in the regulatory capital requirements of Solvency II, Bermuda, Canada, Australia, Japan, Singapore and other advanced regulatory regimes, and is expected to soon be explicitly included in U.S. risked-based capital (RBC).
What’s in Operational Risk?
The National Association of Insurance Commissioners (NAIC) and Solvency II define operational risk as “the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events.” This definition, which was developed by the Basel Committee on Banking Supervision, is considered to be sufficiently broad to apply to the insurance industry.
It’s worth noting that this definition does not include strategic risk, which is the risk that management pursues business strategies that produce adverse results. It also doesn’t include reputational risk, which is the risk that an insurer loses market share due to bad publicity.
Legal risk, which is the risk of an insurer facing major lawsuits, is included in operational risk. Obviously, there are situations that can result both in legal risk and in reputational or strategic risk, so the lines between what does and doesn’t constitute operational risk are not always clear.
Operational Risk Charges in the United States
Life RBC has always had a charge for “business risk” that implicitly includes operational risk. Property and casualty (P&C) RBC and health RBC don’t have a charge for operational risk per se, but they do have a charge for excessive growth, which is recognized as a cause of both operational risk and underwriting risk.
Efforts are well underway, through the NAIC’s Operational Risk Subgroup (Subgroup), to formally introduce an operational risk charge into U.S. RBC. This charge, which would equal 3 percent of an insurer’s Company Action Level RBC, is anticipated to go into effect with the 2018 RBC reports that companies will file in March 2019. Hence an insurer with an RBC of $100 million would, after including the operational risk charge, see that amount rise to $103 million.
How Others Derive Operational Risk Charges
Solvency II allows insurers to either model their capital needs for operational risk or use a standard formula. The standard formula computes a provisional operational risk charge based on a percentage of premium writings and another provisional charge based on a percentage of reserves, with the larger provisional charge being used.
Bermuda applies a factor to an insurer’s required capital. The factor varies from 1 percent to 10 percent, depending on the regulator’s assessment of the insurer’s quality of management and operations. It’s worth noting that this method is not feasible for U.S. RBC, which needs to be based solely on accounting items and be free of judgment in order to avoid litigation over the authority of regulatory intervention.
Canada’s charge is the sum of two components: One is based on business volume and the other is based on the required capital for credit, insurance and market risks, and for ceded business. Australia and Singapore use proxy methods similar to Solvency II, while Japan uses a factor applied to required capital.
Need for an Operational Risk Database
One of the difficulties that all regulatory regimes have faced in developing a statistically based operational risk charge is a shortage of operational loss and risk data from insurers. The only operational risk databases for insurers the Subgroup is aware of are from two European-based consortiums: ORIC and ORX. ORIC, which has been in existence since 2005, has the most extensive database. ORX, whose focus historically has been on operational risk in the banking industry, has recently expanded its scope to include insurance. While both of these consortiums include some U.S. insurers, their membership and databases are derived primarily from European insurers and are therefore considered to be inappropriate for use in deriving an operational risk charge for the United States.
One option under consideration is the establishment of a voluntary operational risk consortium of U.S. insurers. Insurers that join this consortium would comingle their operational risk data with that of the other consortium members and would, along with regulators, have access to the aggregated data. The NAIC or a qualified third party could administer this consortium. Once a sufficient volume of operational risk data has accumulated in the consortium’s database, the data could be used to refine the methodology and factors used to derive the basic operational risk charge in RBC.
It’s worth noting that U.S. regulators have been gaining some insight into insurers’ operational risk exposures and mitigation efforts through their review of insurers’ Own Risk and Solvency Assessments (ORSAs), although how such qualitative knowledge could be used in the design and refinement of an operational risk charge is not clear.
Operational Risk Embedded in Other Risk Charges
Another challenge the Subgroup has faced in developing an operational risk charge is the fact that much of an insurer’s operational risk is embedded in other risk charges currently in RBC, particularly in the underwriting risk charges of P&C and health RBC. Examples of embedded operational risks include fraudulent claims, flaws in pricing and reserving models, and failures to follow investment guidelines.
Due to the difficulties in isolating and removing embedded operational risks, the operational risk charge developed by the Subgroup is intended to account for all operational risks that are not embedded in other risks. Examples of unembedded operational risks include cyber risk, contractual performance risk, political risk and outsourcing risk.
Methods Examined
In determining the methodology to be used in deriving the charge, the Subgroup considered methods currently used in other countries for deriving regulatory capital charges for operational risk. Two methodologies that are commonly used include a “proxy” method, which applies factors to measures of business volume (such as premiums and reserves), and an “add-on” method, which applies a factor to total required regulatory capital.
The proxy method assumes an insurer’s operational risk is proportional to the volume of its writings or unpaid liabilities, while the add-on method assumes that an insurer’s operational risk is proportional to its overall risks. Neither method fully satisfies its assumptions since an insurer’s operational risk is not strictly proportional to either its business volume or its regulatory capital.
The Subgroup tested both methodologies to see what their effects on the industry and on individual insurers would have been had those methods been in place the last few years. Its tests found that the add-on method produced less volatility in RBC levels from year to year, on both an industry and an individual company basis, than did the proxy method. The Subgroup’s tests also revealed that the add-on method was more effective at identifying soon-to-be troubled companies. For these reasons, the Subgroup chose to use an add-on methodology.
While embedded operational risks partake in the diversification credits of the risks in which they’re embedded, the Subgroup does not consider operational risk itself to be independent of other types of risk. It therefore put the operational risk charge outside of the square root in RBC’s covariance formulas where it will not be subject to a diversification credit. The operational risk charges of Solvency II, Canada, Bermuda, Australia, Singapore and Japan, as well as the business risk charge (C4a) in life RBC, are also not subject to diversification credit.
Growth Risk
Growth risk is the risk that an insurer’s volume of business grows more rapidly than it can prudently handle, resulting in deterioration in services to policyholders, claimants and beneficiaries, or in deterioration of underwriting results, particularly when growth results from loosening underwriting standards or entering new markets without adequate research. Growth risk therefore has elements of both underwriting risk and operational risk. Solvency II, Canada and Australia have charges for excessive growth, as do P&C and health RBC. P&C RBC accounts for excessive growth within its loss reserve and premium risk charges, R4 and R5. Health RBC accounts for it within its business risk charge, H4.
The Subgroup has examined both the P&C and the health growth risk charges. It has found that the P&C growth risk charge appears to be performing adequately and as originally intended. The formula for the health growth risk charge is more complex and has not been adapted to reflect the Affordable Care Act’s impact on market growth. Therefore, the Subgroup may recommend that the existing health growth risk methodology be examined for potential revision.
Life RBC has never included a growth risk charge. The Subgroup is investigating whether there is merit in introducing a growth risk charge into life RBC, particularly in light of the distortions in premium growth created by irregular single premium deposits, pension risk transfers and other circumstances unique to life insurers.
Business Risk Charge for Life Insurers
Of the three types of RBC (life, health and P&C), life is the only one with a specific risk charge that’s closely related to operational risk. Labeled as the “C4a” component of life RBC’s business risk charge, it’s based on direct written premium and serves as a proxy for a life insurer’s liability for guaranty fund assessments.
These C4a business risk charges average between 6 percent and 7 percent of industrywide Life Company Action Level RBC, although some insurers that file life RBC report little or no C4a charges. If one assumes that at least half of “business risk” is operational risk, then this provides further justification for using a 3 percent factor.
Since most life insurers are already being charged for operational risk through their C4a charge, the Subgroup decided to introduce a “C4a offset” and waive the operational risk charge for life insurers whose C4a charge exceeds 3 percent of their Company Action Level RBC. The operational risk charge for those life insurers whose C4a charge is less than 3 percent of their Company Action Level RBC will be equal to the amount that their C4a charge falls short of that 3 percent benchmark.
Double-Counting Issues
One of the concerns raised by insurers and other interested parties is that because the basic operational risk charge is based on an insurer’s RBC, it will “double-count” any operational risk already contained in RBC. This would include embedded operational risk, growth risk charges (if any) and, for life insurers, the C4a charges of their subsidiaries.
The Subgroup and various interested parties recognize that a double-counting of embedded operational risk is unavoidable with the add-on method. Furthermore, given the immaterial impact of growth risk charges on overall RBC results and the complexity of removing their embedded diversification credits, the Subgroup decided not to extract growth risk from RBC when calculating the operational risk charge.
The Subgroup has eliminated a source of double-counting of affiliate operational risk by excluding subsidiaries’ operational risk charges from the parent’s C0, R0 and H0 affiliated risk charges. A remaining issue is whether a residual double-counting of affiliate risk occurs when the 3 percent operational risk factor is applied to the parent insurer’s net affiliate risk charges.
Adjustments for Life Insurers with Subsidiaries
Prompted by the Subgroup’s deliberations, the American Academy of Actuaries (the Academy) launched a Life Operational Risk Work Group to examine operational risk issues related to life insurers. One of the work group’s concerns was the differing effect of the C4a offset on a life insurer’s operational risk charges when its business is written through subsidiaries.
The Academy’s work group is focused on eliminating this difference for life RBC filers. Proposed solutions include allowing the parent insurer to take credit for its subsidiaries’ C4a charges, and excluding part of the C0 affiliated risk charge when deriving the parent’s operational risk charge. Other interested parties have proposed methods to address this issue for all types of parent insurers.
The Subgroup is currently deliberating among these methods, including the question of whether a holding company structure increases the operational risk of business written, and is exposing these methodologies for comment from interested parties.
Next Steps
The Subgroup, in collaboration with the Academy’s work group and other interested parties, will attempt to resolve the affiliate double-counting issue by early 2018.
Two issues will then remain for the Subgroup to resolve. One is whether and how to implement a growth risk charge for life insurers. The other is the creation and eventual use of a database of the operational losses and risk indicators of U.S. insurers.