Actuarial Notes

Operational risk management framework in rating and underwriting of automobile insurance

By Financial Services Regulatory Authority of Ontario · 2022 · AU0137INF

Study guide: Exam 6C

FSRA Information Guidance on sound practices for operational risk management in the rating and underwriting of Ontario automobile insurance. Its stated purpose is to promote just, reasonable and accurate rates and to support fair treatment of consumers in underwriting, adopted in proportion to an insurer's nature, size, complexity and risk profile. As Information Guidance it creates no new compliance obligations; the Financial Services Regulatory Authority of Ontario presents it as a step towards principles-based, outcomes-focused regulation of rates and underwriting. It took effect on 20 September 2022 and is to be reviewed no later than 20 September 2025.

On the syllabus

  • Exam 6C — objective A1; the whole guidance.

Purpose

  • The guidance articulates foundational and sound practices for operational risk management (ORM) in rating and underwriting, to promote just, reasonable and accurate rates and fair treatment of consumers.
  • Strategy for reforming regulation of auto insurance rates and underwriting
    • It builds on FSRA's Standard Filing Guidance and its Rule on Unfair or Deceptive Acts or Practices (UDAP Rule), and is a step towards principles-based and outcomes-focused regulation.
    • FSRA plans to move to Interpretation and Approach Guidance, under which ORM becomes an obligation and adherent insurers gain expedited rate change processes.

Scope

  • The guidance affects insurance companies writing automobile insurance in Ontario.

Rationale and background

  • From consultations and rate filing reviews, FSRA identified gaps: no robust three lines of defence or control over the model lifecycle (e.g. no independent second line for model review or approval); no process to understand the impact of models, including machine learning models, on individual consumers, which may lead to unfair discrimination and UDAPs; and no process to identify, mitigate and report rating or underwriting errors.
  • FSRA expects the framework to help insurers comply with the Insurance Act, the Automobile Insurance Rate Stabilization Act and the UDAP Rule, and to support operational resilience.

Principles

  • FSRA's six Rate Regulation Principles guided the design, with particular emphasis on Consumer Focus.

Operational risk management framework

  • Operational risk defined and other terminology
    • Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.
  • The operational risk management cycle
    • Risk identification, risk assessment (inherent risk before controls, residual risk after), risk prioritization and mitigation, and risk monitoring and reporting — run continuously for existing processes and ad hoc for new products, projects or changes.
  • Operational risk management foundational practices
      1. Defining operational risk appetite for rating and underwriting
      • A succinct, clear risk appetite statement with a measurable component — limits or thresholds, which may also set when events are escalated to senior management and the board.
      1. Clearly defined roles, responsibilities and accountability mechanisms
      • Governance structure
      • Three lines of defence
        • First line of defence
        • Second line of defence
        • Third line of defence
      • The business line owns the risk; an independent second line, such as compliance or risk management, reviews it for reproducibility and soundness; internal audit, as the third line, gives independent assurance to senior management and the board.
      1. Having data governance in place
      • Data quality assessments, identification of data problems and limitations, and a designated owner for each data source (see Data Quality).
      1. Maintenance of the operational risk management framework
      • Training, documentation and periodic reviews.
  • Model risk management
    • Models allow more precise management than traditional operational risks but add risks from their complexity, particularly in machine learning and artificial intelligence; Appendix 1 applies ORM practices to model risk management.

Application to other existing obligations

  • Third-party products and services — insurers, not vendors, hold accountability for consumer outcomes.
  • Protection of personal information — a three lines of defence structure can help insurers meet confidentiality and privacy obligations.

Effective date and future review

  • Effective 20 September 2022; to be reviewed no later than 20 September 2025.

About this guidance

  • As Information Guidance, it describes FSRA's views without creating new compliance obligations for regulated persons.

Appendix 1 Model risk management

  • It covers models used in ratemaking (estimating future costs associated with the transfer of risk), risk classification systems (assigning risks to groups by the expected future cost or benefit of the coverage) and underwriting (deciding whether a risk is written, renewed or cancelled).
  • Applying the operational risk management cycle to managing model risk
    • Risk identification
      • Insurers should have a model inventory giving a comprehensive view of every model in use.
    • Risk assessment
      • Controls should mitigate model risks in inputs (data), processing and computation (model development) and outputs (implementation and monitoring).
    • Risk prioritization and mitigation
    • Risk monitoring and reporting
  • Model risk management foundational practices
      1. Clearly defined model materiality
      • Governance and control at each step of the model lifecycle should be at least commensurate with the model's materiality.
      1. Three lines of defence being applied throughout the model lifecycle
      • The second line comprises independent model review (vetting and validation) and a model risk management function; the lifecycle runs through development, implementation and monitoring/review.
      1. Model approval function
      • A Model Approval Function — a senior accountable person or a committee — approves new or revised models for operational use.
      1. Process to assess model fairness
      • Inputs must not use prohibited variables, modelling should maximize predictive performance subject to a fairness constraint, and outputs should be tracked for fairness.
      • Interpretability and explainability of AI/ML models
        • Interpretability is the ability to understand a model's soundness; explainability is the ability to convey its results and drivers to stakeholders not involved in its development.

Sources