Tailoring internal models

Swiss Re’s Pablo Koch Medina, Frank Krieter and Stephan Schreckenberg highlight the key features and main limitations of internal risk models for insurers

Internal risk models for insurance¹ companies have been the focus of increased attention lately. Now, driven partly by developments in the banking industry², insurance regulators and rating agencies have started thinking aloud about the possibility of assessing the capital adequacy of an individual company by allowing it to use its own internal risk models. This article focuses on the main features internal risk models should have, and on explaining what their limitations are.

Internal models should meet at least two requirements. First, they should focus on the economic impact of risk - and not necessarily on its impact on accounting figures - since no accounting convention can hide the true economics for an indefinite period of time. Second, internal models should rely on the use of internal expert knowledge about the company's own business book - after all, it is the materialisation of the specific risks on a company's own books, and not necessarily some industry average, that has the potential to impair its ability to pay claims.

We start by elaborating on why capital adequacy is crucial not only for policyholders - and supervisors and rating agencies on their behalf - but also for insurance companies. We then outline the elements of a comprehensive internal risk modelling approach and conclude by addressing the limits of what internal models can do for a company.

Risk-bearing capital
Through their underwriting and investment activities, insurance companies gain exposure to insurance, credit and financial market risks. An essential prerequisite for underwriting insurance risk is to have adequate risk-bearing capital, that is, economic net worth (essentially the difference between the market value of its assets and the present value of its liabilities), which acts as a buffer against unexpected losses. The need for risk-bearing capital, which is provided by shareholders³, stems mainly from the concerns that policyholders (and supervisory bodies on their behalf) have with respect to the claims-paying ability of the company they insure with. Risk-bearing capital is essential for the 'production' of insurance coverage that, in the case of traditional insurance, boils down to:

• pooling sufficiently independent and balanced risks in a portfolio, thus bringing down the (relative) volatility of the aggregate claims to a manageable level;
  
• investing premiums in financial assets to generate the cashflows necessary to pay future expected claims; and
  
• holding risk-bearing capital to absorb negative deviations from the expected course of events that may arise despite pooling efforts.

Holding capital has a cost: shareholders demand adequate compensation for putting their capital at the insurance company's disposal. Part of the required return is generated by the financial assets the capital is invested in. We call this the base cost of capital. But since this capital is used to support insurance business, shareholders require an additional return that we term frictional capital costs. This return must be generated from the proceeds resulting from the sale of insurance policies.⁴ Thus, when assessing the profitability of insurance activities, the cost of holding capital must be factored in.

Insurers sell insurance because they are able to charge premiums above the cost of producing the coverage, that is, beyond what is needed to meet expected claims and expenses and to cover the cost of holding capital. In fact, shareholders provide risk capital precisely in order to enable insurance companies to generate profits from the sale of insurance policies that exceed the amount required to meet the cost of holding that capital. The profit in excess of the cost of holding capital is called economic profit.

The market capitalisation of healthy insurance companies is higher than their economic net worth. The difference between market capitalisation and economic net worth is called franchise value, that is, the value investors attach to the insurer's ability to generate economic profits from future business, which is often equated with the value of the insurer's client relationships and human capital.

Franchise value can be used to explain why policyholder sensitivity to the insurer's continuing ability to pay their claims also provides a powerful incentive for insurers to want to hold more rather than less capital. In fact, whenever an insurance company experiences financial distress, its shareholders stand to lose significant amounts of franchise value - if the company experiences financial distress, potential clients will stay away and shareholders may lose all or part of it. Hence, in order to protect their franchise value, insurers have an incentive to hold more rather than less capital.

Franchise value can also be used to explain why insurers do not hold arbitrarily large amounts of capital, as this will translate into higher capital costs and hence higher production costs. A higher capital base will force an insurer to raise premiums so that it can generate the same economic profits. But there is a limit to the price policyholders will pay for added security.

When determining the optimal amount of capital to hold, an insurer will need to strike a balance between adequate security and enforceable premiums so the franchise value is maximised. Formally stating this optimisation problem - let alone solving it - is fairly complex, and to get around this requires some practical concessions. These consist of assuming that the optimal level of capital is achieved for a given level of security, and specifying how this level of security translates into a given amount of capital. The following sections outline how internal models can be used to assess the amount of capital required to guarantee a certain level of financial strength.

Internal risk models
Internal risk models can give a precise meaning to the phrase 'holding a given amount of capital to maintain a given level of security'. They are therefore important from a capital adequacy perspective. Moreover, internal risk models should also allow the termination of the contribution to total risk of the various businesses pursued by an insurer. Without this feature, they would be of little use in managing risks and determining the performance of the various lines of business or profit centres.

For practical reasons, risks are usually grouped into categories, mostly according to how they are managed. One widely used classification distinguishes between insurance underwriting, credit, financial market and operational risks.

Underwriting, credit and financial market risks can all affect the economic value of both assets and liabilities. For example, as mentioned above, the economic value of insurance liabilities is roughly equal to the present value of future payments and is thus exposed to interest rate risk. Conversely, interest rate risk also affects the market value of the bonds the insurer holds in its investment portfolio. At the same time, these bonds are exposed to the risk that the issuer defaults on its obligations, that is, there is a credit risk exposure. However, bonds are not the only source of credit risk. Indeed, an insurer may insure credit risk, so that a credit risk exposure can also be observed on the liability side. Finally, an insurer may be exposed to insurance risk on the liability side - for instance to natural catastrophe or casualty risk - and may also become exposed to catastrophe risk on the asset side if it chooses to invest in cat bonds linked, for example, to earthquake risk or if it holds securities issued by companies also exposed to insurance risk. Therefore one source of risk can possibly affect several different positions on the economic balance sheet. In fact, there may also be interdependencies among the various sources of risk, thus necessitating an integrated approach to risk modelling.

Operational risk - 'the risk of loss resulting from inadequate or failed internal processes, people, and systems or from external events'⁵ - does not directly affect the value of either assets or liabilities, but has often been the ultimate cause of company failures. While the importance of operational risk is widely recognised⁶, it is usually excluded from integrated risk approaches because it is extremely difficult to quantify. But whether it is explicitly quantified or not, the company's capital also acts as a protection against op-risk related losses.

Integrated economic approach
Any economic approach to capital adequacy must focus on the impact of risk on economic net worth over the relevant period, that is, on the impact of risk on the economic profit and loss statement⁷ for the period in question. Any integrated approach must recognise that economic losses to the company are ultimately determined by the combined effect of financial market movements, the factual materialisation of the various insurance risks, and the actual defaults or changes in credit quality of companies to which there is a credit exposure. Note that while only a single period is considered, the risks of future cashflows are also captured, since the economic profit and loss account includes changes in their present value - albeit only those changes that depend on the information that becomes available within the observation period.

Consequently, the combined effect of all relevant individual risk exposures and their dependencies need to be modelled and quantified. This is the only way to give precise meaning to diversification and accumulation effects. For example, the impact of adding a new risk into the existing portfolio - when making an acquisition, say - can be assessed only in the context of the entire portfolio.

Indeed, adding a risk exposure independent of the rest of the portfolio reduces the relative variability of losses of the overall exposure, thus better diversifying the portfolio. For instance, an exposure to earthquakes in California will typically diversify with an exposure to earthquakes in Japan. Conversely, if the risk exposure being added shows a positive dependency with a risk already present in the portfolio - so that losses will tend to occur at the same time - the result will be risk accumulation. A case in point is credit risk, which shows a strong degree of dependency with financial market risk.

Risk factors and portfolio mappings
Modelling the impact of risk on the company's economic profit and loss can be viewed as consisting of four subordinated tasks. The first task is to identify the various risk factors to which the company is exposed and select a subset - considered sufficiently representative - to be modelled. In a second step, stochastic models are constructed for the selected risk factors. Since for practical reasons it is not always possible to select a set of independent risk factors, the third step deals with modelling the dependencies among the different risk factors. The final task entails specifying so-called portfolio mappings that describe how realisations of these risk factors translate into profits or losses through their impact on specific positions in the insurer's portfolio. This approach aims at separating the cause of risk from the company's exposure to it, and thus facilitates a systematic analysis of the impact of changes in the composition of the portfolio.

The broad risk categories may contain a multitude of individual risk factors, depending on the specific risks a particular insurer is exposed to but also on the relevance attached to them. For instance, underwriting risk factors may include natural perils (for example, windstorms in Germany, earthquakes in California), casualty (for example, product recall) or mortality, while financial market risk factors may include various equity indexes, foreign exchange rates, interest rates, etc.

The above four tasks require much idealisation in the modelling process. To construct an appropriate model, its intended use must be borne in mind at all times. When integrating various risks and positions, it must be ensured that the model is:

• complete, that is, that all the relevant elements have been included. This may also entail considering risks representative of situations that have not been encountered before and thus cannot yet be named precisely (for example, one could consider classes of latent risks - for example, asbestos in its time - of which only the order of magnitude but not the exact manifestation is conceivable);
  
• consistent regarding the individual risk assessments, that is, that the various relevant elements are treated comparably (otherwise the calculated relative contributions would fail to be comparable and hence of rather limited value for steering purposes); and
  
• forward looking, that is, that it addresses the true riskiness rather than merely those aspects captured by statistics based on observations of the recent past.

Risk factor modelling is not easy. Though tempting, the true riskiness of a given risk factor generally cannot be captured merely by drawing information from past experience, ie by way of statistical inference. Rather, statistical information needs to be complemented by what we call threat scenarios. These consist of an expert assessment of what might possibly occur and with which frequency, thus capturing extremely rare types of events whose occurrence cannot be inferred from available data. Clearly, it is neither possible nor desirable to have an exhaustive list of threat scenarios describing every possible event. Instead, the selected threat scenarios must be regarded as being representative of 'the sort of thing that could happen'.

The clear separation of risk factors on the one hand and their impact on the insurer's book on the other enable us to focus on modelling interdependencies among risk factors. This is more intuitive and reliable than directly modelling dependencies among sub-portfolios. With this approach, accumulation and diversification effects are captured in a systematic fashion.

An operational internal model of capital adequacy
Once the risk factors and their dependencies have been modelled and portfolio maps specified, the probability distribution of the company's economic profit and loss can be derived. This distribution contains all the ex-ante information on how the random behaviour of the insurer's business book and investment portfolio affect economic net worth - at least, in as far as it is captured by the underlying model.

The entire probability distribution can be condensed into a single figure via a summary risk measure that can be translated into an amount of required capital. This is illustrated in the following paragraphs using the shortfall measure.⁸

For a given portfolio, the 1% shortfall measures potential negative deviations of the economic profit and loss from its expected value over a one-year horizon. It does so by determining the average of rare economic losses that can occur - rare being with a frequency of less than once in a hundred years. Overall shortfall denotes the 1% shortfall of the overall portfolio. When applying 1% shortfall to a sub-portfolio, we use the term stand-alone shortfall.

Since the economic profit and loss depends on all risks to which the insurer is exposed, shortfall will crucially depend on the overall - or aggregate - portfolio composition, including all insurance and investment portfolios. In particular, shortfall captures diversification effects: for any split of the overall portfolio into sub-portfolios, the sum of the stand-alone shortfalls is greater than or equal to overall shortfall.

Shortfall as a summary measure enables us to postulate the amount of capital required to ensure a desired level of security. In the model described above, required capital is defined as being equal to the 1% shortfall of the overall portfolio. If the insurer holds capital over an amount greater than or equal to the 1% shortfall of its overall portfolio, it will be able to absorb the average once-in-a-hundred-year loss. This is how the desired level of security is formulated within this model.⁹

To establish the adequacy of an insurer's capitalisation, required capital is compared with available capital, that is, with economic net worth.

Risk contributions
The contribution of a particular sub-portfolio to the overall capital requirement is relevant - for example, for risk-steering purposes - when measuring risk-adjusted performance of profit centres and when assessing the impact of an acquisition on the risk of the purchasing company.

Calculating the contribution of a sub-portfolio to overall capital requirement is fairly straightforward. Note first that each aggregate economic loss is the sum of the economic losses of the individual sub-portfolios and that overall shortfall is defined as the average rare aggregate economic loss. We can therefore determine the contribution of a given sub-portfolio to overall shortfall by looking at the amounts the sub-portfolio concerned contributes to a rare aggregate economic loss and building their average.

Note that a sub-portfolio does not need to contribute to rare aggregate economic losses with its own largest individual losses. The occurrence of a large individual loss for a particular sub-portfolio may be counterbalanced by small losses from other sub-portfolios, so that the resulting aggregate loss does not qualify as 'rare' in the context of the whole portfolio. It follows that, for a given sub-portfolio, the stand-alone shortfall - which relates to rare losses for that particular sub-portfolio only - is always greater than or equal to its contribution to overall shortfall - which looks at the losses in the context of the overall portfolio. This is called diversification. But it does not imply that an individual portfolio is less risky when considered in the context of the overall portfolio, merely that there may be balancing or compensating effects within the overall portfolio. While a loss in a sub-portfolio above its stand-alone shortfall should be rare, this need not be the case for a loss above its contribution to overall shortfall.

The elements of an operational integrated risk model

We can now summarise the elements of an operational integrated risk model that may be used both for capital adequacy and for risk-steering purposes. These elements comprise:

• a collection of models for all individual risk factors and their interdependencies;
  
• a collection of models to capture how risk factors affect the economic profit and loss statements of the various sub-portfolios;
  
• a procedure to calculate required capital on an overall level; and
  
• a procedure to calculate the contributions of the various risk portfolios to total risk.

Such models must be carefully and continuously maintained to ensure timely incorporation both of new exposures and of the most recent knowledge about risk factors and their dependencies. This in turn helps one take advantage of the insights gained during the modelling work.

The limits of a risk model
A quantitative risk model, however comprehensive, cannot be a surrogate for management decisions and common sense. An important prerequisite for seriously monitoring capital adequacy, and for making the most efficient use of available capital, is risk transparency. Achieving it requires both a state-of-the-art risk-measuring framework as described above and adequate processes for identifying, measuring and reporting risk exposures. These processes, which among other things determine the reliability of risk information, need to be well established within the organisation, and include the collection of exposure data and the incorporation of new types of exposure into the integrated risk model.

The organisational structure of an insurance company should support a sensible culture for dealing with risk. Ideally, a clear separation of the roles of the risk owner, the risk taker and the risk manager/controller functions should be established. Moreover, top-level committees should take an active interest in strategic risk management issues and ensure that a system of limits for risk-taking activities is in place. Finally, a risk-adjusted performance measurement system will create the right incentives for disciplined risk taking.

Properly established, internal risk models will continue to gain popularity within the insurance industry, regardless of whether regulators and rating agencies ultimately allow them to be used to determine the financial strength of companies. There are two main reasons for this. First, internal risk models build on the insurer's own portfolio - the only reliable basis for ensuring a true risk assessment - second, they are crucial for accurate measurement of risk-adjusted performance measurement.

Pablo Koch Medina is head of quantitative risk management methods at Swiss Re. Frank Krieter and Stephan Schreckenberg are senior risk analysts, also at Swiss Re

Footnotes:

1 We are using the term insurance to include both insurance and reinsurance
2 That is, Basel II
3 Although our arguments also apply to other legal forms, we focus here on shareholding companies
4 For an overview of the role of capital costs in insurance, consult J Hancock, P Huber and P Koch, Value creation in the insurance industry, in Risk Management and Insurance Review, 2001, 4(2), pages 1-9
5 As has been defined by the Bank for International Settlements, the International Swaps and Derivatives Association, British Bankers' Association and RMA
6 Quantification of operational risk is currently the subject of intensive research
7 Usually there are two main sources of differences between accounting profit-and-loss statements and their truly economic counterparts. First, total investment returns and not only investment income and realised gains are considered. Second, changes in the economic value of liabilities and not changes in technical reserves are recorded
8 The shortfall measure serves as an illustration. Other examples of risk measures could also be considered
9 Here we have simplified the argument. An insurer should hold more capital than that indicated by the 1% shortfall. There are at least two reasons for this. First, the company aims to continue operations after an adverse event, so that capital in excess of 1% shortfall should be held. Also, the insurer's portfolio generally includes liabilities with a maturity of sometimes considerably more than just one year. However, it is not economically feasible to hold such capital amounts that virtually ensure that all future obligations can be honoured at all future times; policyholders would not be willing to pay for this degree of security. Nevertheless, to truly address the policyholder's concern with security, holding additional capital can provide financing flexibility after a major adverse event so that capital strength can be restored at a reasonable cost

Shortfall measure

The uncertainty of the profit and loss for a given portfolio can be visualised by a series of 50 equally probable possible realisations. For capital adequacy purposes, the types of loss that risk-bearing capital should be able to absorb need to be defined. A rare loss is defined as one that occurs with a probability of less than a pre-specified threshold, for example, 10%. In this example, the green line, which represents the 10% quantile, separates five rare losses (shown in red) from the less extreme events. Many approaches to capital adequacy take the quantile as a measure of required capital. According to this approach, the company in our example will be able to survive losses up to the quantile if it holds this amount of capital. However, the quantile contains no information on the severity of the rare losses. The shortfall measure - in our case, the 10% shortfall - takes into account this factor, which is defined as the average of all rare losses. In practical applications, it is customary to use the 1% shortfall instead of the 10% shortfall. The discussion of shortfall given here is intuitive and no attempt has been made to provide an exhaustive study.