Actuarial Notes

Risk Management

Study guide: Exam DISC-RM

Risk management is, in the words of ISO 31000, the "coordinated activities to direct and control an organization with regard to risk", and its purpose is to create and protect value. Everyone practices it informally, by locking a door or paying an insurance premium; an organization practices it as a management discipline, through a risk manager or chief risk officer, a stated policy and a repeating process. The environment it works in has moved from buying insurance for pure loss exposures toward enterprise risk management, which treats every source of risk, with its upside as well as its downside, as one portfolio.

  • Who manages risk: In a sole proprietorship or small company the owner performs the risk management function. Larger organizations have a risk manager, and those practicing ERM a chief risk officer on the executive team. The authority of each is set by a policy statement from top management: a risk manager may decide routine matters, such as which small losses to retain, and only recommend larger ones.
  • The traditional role: Risk management grew out of corporate insurance buying. The risk manager was responsible for specific pure risks, mainly by buying insurance and running loss control to keep employees and property safe, and typically reported to the treasurer.
  • More, and more complicated, risks: The CAS's 2003 overview of ERM names the forces behind the move to a broader view. Hazard risks such as fire and product liability have long been managed, but financial risks grew in importance, new risks such as foreign exchange came with globalization, and high-profile failures of control (Barings Bank, Enron) and of understanding a business (Long Term Capital Management) raised awareness of operational and strategic risks.
  • External pressures: Regulators, rating agencies, stock exchanges, institutional investors and corporate governance bodies came to insist that senior management take responsibility for managing risk across the whole enterprise. Firms evaluated by credit rating organizations are expected to show their ERM activities, and shareholders of public companies want stable, predictable earnings.
  • A portfolio point of view: Following modern portfolio theory, the risk of the whole organization is not the simple sum of its parts, and risks that offset each other are natural hedges. Managing risks in separate silos can therefore be inefficient or even counterproductive.
  • Quantification and shared practice: Catastrophe modeling, which spread after Hurricane Andrew in 1992, and value at risk in banking made it easier to quantify risks, though operational and strategic risks remain hard to measure (Risk Measure). ERM tools and processes are shared across industries and countries, not confined to insurance.
  • Risk as opportunity: Organizations once took a defensive posture, seeing risk as something to minimize or avoid. Many now also keep or pursue risks they have a special ability to manage, so risk management can create value as well as protect it (Risk Management Objectives).
  • The frameworks: ISO 31000 (2018) sets principles, a framework and a process. COSO's 2017 framework, Enterprise Risk Management: Integrating with Strategy and Performance, organizes ERM into five components supported by twenty principles. The CAS defines ERM as the discipline by which an organization assesses, controls, exploits, finances and monitors risks from all sources to increase its value to its stakeholders.
  • The parts of the subject: Risks are classified by type (Risk Taxonomies) and measured (Risk Measure). The process identifies them (Risk Identification), assesses them (Risk Assessment), treats them (Risk Treatment, Risk Control, Risk Transfer) and monitors the results, and business continuity management, with its business continuity plan, and organizational resilience prepare the organization for disruption.

Which Force Is at Work? For each development at a mid-sized manufacturer, name the force behind the move from insurance buying to enterprise risk management that it reflects:

  1. The rating agency that rates its bonds now asks for a description of how the board oversees the company's major risks.

  2. Its two divisions each planned to hedge the same currency, one exposure long and one short, until the new chief risk officer combined them.

  3. It begins using vendor catastrophe models to estimate its plants' earthquake exposure.

  4. It decides to keep its workers compensation risk, which it understands well, and to bid for contracts its competitors avoid because of their safety demands.

Answer

  • 1. External pressures: Outside parties, here a rating agency, insist that senior management take responsibility for enterprise-wide risk.
  • 2. A portfolio point of view: The divisions' exposures offset, so separate hedges cost money without reducing the company's net risk.
  • 3. Quantification: Catastrophe modeling made a rare, severe risk measurable.
  • 4. Risk as opportunity: The company keeps a risk it can manage better than others and uses that ability for competitive advantage.

The Same Company, Two Approaches A food distributor's risk manager reports to the treasurer and is responsible for buying property, auto and liability insurance and for the safety program. The board asks what would change under enterprise risk management. Describe the difference.

Answer Under the traditional approach the risk manager handles hazard risks, the pure loss exposures that insurance and loss control address. Fuel prices, customer concentration, a failure of the routing software and the loss of a major contract are managed, if at all, by other departments separately. Under ERM a chief risk officer on the executive team oversees all these risks together: hazard, financial, operational and strategic. The company can then see that a fuel price spike and a slowdown in demand may hit at the same time, that some risks offset each other, and that some, such as expanding into a market it knows well, are worth taking. Insurance remains one of the tools, but it is no longer the whole of the program.

How it appears on the exam

  • DISC-RM: The introduction to risk management opens with the risk management environment. Questions ask how the risk manager's role has changed, which forces drove the move to ERM, or how a traditional program differs from an enterprise-wide one.
  • Linked objectives: The rest of the introduction covers objectives and benefits, basic risk measures, classifications of risk and the process for managing risk, and the later sections take each step of the process in turn.

Exam traps

  • Risk management is not insurance buying: Insurance is one technique among many. An answer that equates managing a risk with insuring it describes the traditional role the course contrasts with ERM.
  • Not only downside: ERM considers risks that can produce gains as well as losses, and may choose to exploit a risk. Answers that treat every risk as something to minimize miss this.
  • Portfolio, not sum: The organization's risk depends on how its risks interact, so the total can be less (offsetting risks) or more (correlated risks) than the parts suggest.