OPERATIONAL RISK: THE CASE FOR BALLOONING BASEL II TO THE INSURANCE INDUSTRY

G L O B A L A S S O C I AT I O N O F R I S K P R O F E S S I O N A L S

INSURANCE RISK d with the DEMO VERSION of CAD-KAS PDF-Editor (http://www.cadkas.com).

Operational Risk:

Making a Case for Ballooning Basel II to the Insurance Industry As of today, insurance companies do not have to comply with Basel II and are therefore not required to calculate a capital charge for operational risk. But large insurers and major international banks (which have to comply with the capital accord) face similar operational risk exposures. Using the insurance firm AIG as an example, Michel Rochette argues for an expansion of Basel II and questions whether insurers are doing enough to adequately measure and manage operational risk in comparison to banks. lthough Basel II was conceived primarily for banks, it would make sense to extend the operational risk component of the global capital accord to insurance companies. Unfortunately, insurers do not have to comply with Basel II. Therefore, unlike banks, they do not have to adhere to the accord’s requirements for measuring operational risk capital.

Outside of the insurance industry, operational failures

A

have resulted in big losses over the past few years, forcing regulators, rating agencies and investors to focus more of their attention on the evolving discipline of operational risk.

But operational risk exposures are far from unique to banks.

Insurers, in fact, have to contend with a variety of operational incidents on a regular basis, including events related to the products and services they market; external and internal fraud; losses related to mistakes; and errors from internal processes that support claims and underwriting

d with the DEMO VERSION of CAD-KAS PDF-Editor (http://www.cadkas.com).

40

GLOBAL ASSOCIATION OF RISK PROFESSIONALS

S E P T E M B E R / O C TO B E R 0 5 I S S U E 2 6

G L O B A L A S S O C I AT I O N O F R I S K P R O F E S S I O N A L S

INSURANCE RISK

d with the DEMO VERSION of CAD-KAS PDF-Editor (http://www.cadkas.com).

d with the

functions. What’s more, insurers are subject to external events beyond their control (like terrorism) and also face legal liabilities such as class-action lawsuits.

Fortunately, there is a possible solution for ameliorating this widespread operational risk: expanding Basel II to the insurance industry. The capital accord, scheduled to launch in early 2007, will require banks and other financial institutions complying with its rules to calculate a charge for operational risk for the very first time; the idea, in part, is to force banks to better align their capital with their risks.

Lamentably, in addition to the current lack of strict rules governing operational risk in the insurance industry, many insurers simply refuse to dedicate the resources necessary to measure and manage operational risk; this problem becomes particularly evident when one examines the resources the average large insurer allocates to other types of risk.

AIG: An Interesting Example

capital calculation.

Measuring Up to Banks The Basel Committee on Banking Supervision defines operational risk as follows: “the risk of direct and indirect loss from inadequate or failed internal processes, people and systems or from external events.” This definition includes legal risk but excludes strategic and reputational risk.

Large international banks are now using Basel II definitions for operational, credit and market risk to calculate the capital that they need to allocate to these different risk sectors. Like banks, insurers must contend with all of the aforementioned risks — but must also measure and manage risks tied to their underwriting businesses.

Many of AIG’s business units could be easily mapped to the eight lines of business identified in Basel II. Moreover, though AIG is an international insurer, its assets are comparable to the assets of large banks.

Citigroup, Bank of America and JPMorgan Chase are among the major US financial institutions that are comparable to AIG — in terms of the diversity of their business lines and products, their size and their international reach.

To advance the argument for expanding Basel II to the insurance industry, let’s take a quick look at the assets and capital requirements of these banks.

Just as they have impacted banks, operational losses have happened and are happening in the insurance community.

Since there is no question that these types of incidents will happen in the future, operational risk management must be factored into the costs of doing business in the insurance industry.

Today, it is likely that no other insurer knows more about operaDEMO tional VERSION of CAD-KAS PDF-Editor (http://www.cadkas.com). risk and its ramifications than AIG. In the remainder of this article, we’ll examine the operational risk techniques used by AIG in comparison to the tools and strategies employed by a few well-known international banks.

If you want to assess operational risk exposure and the capital required for a large and diversified insurance company, AIG provides a very good case study. Detailed information about AIG’s operational losses can be found in the company’s recent 10K filing with the Securities and The table above tells us that a bank that uses the Exchange Commission, as well as in the company’s own advanced measurement approach for operational risk financial statements. would have a lower economic capital requirement than a bank that uses the basic indicator approach; this interesting Most of the operational risk incidents reported in the fact seems to indicate that regulators recognize the effecSEC filings were large and could be classified as unextiveness of the risk controls within banks that use the pected. In lay terms, an unexpected incident is an inciadvanced measurement approach. dent where the probability of occurrence is low but the Similar calculations were performed for AIG, and the potential operational and financial impact is major. Since results are summarized in the table on pg. 43. What do we firms want to hedge against this type of loss, unexpected learn when we analyze regulator capital, economic capital incidents play a big role in a company’s operational risk

S E P T E M B E R / O C TO B E R 0 5 I S S U E 2 6

GLOBAL ASSOCIATION OF RISK PROFESSIONALS

41

G L O B A L A S S O C I AT I O N O F R I S K P R O F E S S I O N A L S

INSURANCE RISK と⌰〰愣〰の⌰〰朣〰づ⌰〰搣〰〠⌰〰眣〰ど⌰〰琣〰と⌰〰‣〰ぴ⌰〰栣〰づ⌰〰‣〰い⌰〰䔣〰き⌰〰伣〰〠⌰〰嘣〰ぅ⌰〰刣〰こ⌰〰䤣〰く⌰〰丣 d with the DEMO VERSION of CAD-KAS PDF-Editor (http://www.cadkas.com).

and Basel II operational risk measurement approaches for banks versus AIG? Well, for one thing, AIG, unlike the banks, would need more economic capital for operational risk if it were to use the advanced measurement approach; this probably reflects the fact that the risk control environment at the banks is more effective than the same environment at AIG. The tables also tell us that AIG’s operational risk economic capital/total assets ratio would be slightly higher (0.675% versus 0.47%) than that of the banks.

the operational incidents that have recently swept through AIG. The table below summarizes the financial and strategic impact of recent operational failures experienced by the insurer.

The incidents cited in this table have already led to a reduction in business submitted by AIG’s independent distributors and could lead to further problems in the future.

This is part of the reason why it is so important for the insurance industry to adopt Basel II. The current regulatory framework in the US doesn’t oblige insurance firms to be as proactive as banks in measuring and reporting operational risk capital. However, if one uses $100 billion in assets as the minimum level at which financial institutions should assess and manage operational risk, about 10 major insurers should currently be obliged to have a minimum capital level (à la Basel II) that protects firms and investors against the potential fallout of major operational risk incidents.

A recent study by the Wharton School of Economics revealed that operational risk incidents have a larger market-value impact on insurance companies than on other financial

In the US, the existing regulatory framework for insurers is the result of a riskbased capital formula developed by the National Association of Insurance と⌰〰愣〰の⌰〰朣〰づ⌰〰搣〰〠⌰〰眣〰ど⌰〰琣〰と⌰〰‣〰ぴ⌰〰栣〰づ⌰〰‣〰い⌰〰䔣〰き⌰〰伣〰〠⌰〰嘣〰ぅ⌰〰刣〰こ⌰〰䤣〰く⌰〰丣 d with the DEMO Commissioners VERSION of CAD-KAS PDF-Editor (http://www.cadkas.com).

(NAIC). The NAIC’s rules contain specific capital requirements for business risk. Operational and strategic incidents are among the types of “business” risk covered by these requirements.

In the case of AIG, the capital required to cover the insurer’s business risk would be roughly $561 million — or about 10% of the economic capital AIG would be required to allocate to operational risk under Basel II. This certainly seems to indicate that the capital required for operational risk under the NAIC’s regulatory framework for insurers is very insufficient. institutions, due in part to the longer-term nature of the insurance business. So it’s vital for the insurance industry to Operational Incidents: adopt regulations that require larger insurers, like AIG, to Strategic and Reputational Impact set aside the necessary capital and to implement effective The need for stricter regulations governing operational risk systems and strategies for managing operational risk. ■ in the insurance industry can also be seen when we ponder

✎ MICHEL ROCHETTE is an operational risk advisor at Enterprise Risk Advisory,an erm research, advisory and training firm. Michel Rochette, can be reached at michel.rochette@enterprise-risk-advisory.com The opinions expressed in this article are solely those of the author and do not necessarily reflect the views of GARP.

S E P T E M B E R / O C TO B E R 0 5 I S S U E 2 6

GLOBAL ASSOCIATION OF RISK PROFESSIONALS

43