Bartlett Actuarial Group will be running a series of articles in the next few newsletters on Enterprise Risk Management.(ERM) This introductory article is the first in the series.

Brian Johnosn, the author of our first artilce, taught a class sponsored by the Delaware Department of Insurance on ERM at the University of Delaware in April 2012.

Enterprise Risk Management An Introduction

by Brian Johnson, ACAS, MAAA, ARM      

I've heard a lot of discussion lately around Enterprise Risk Management (ERM). Essentially, ERM is a concerted and deliberate strategy for identifying, controlling, and financing all of an organization's sources of risk. The reason it seems to be such a hot topic of conversation recently is that more and more people are starting to realize that there are numerous risks faced by an organization for which traditional insurance is not commonly purchased. These risks can drastically affect the consistency and utilization of an organization's stream of revenue. An example might be a firm that collects highly sensitive information about its clients, such as social security numbers, financial information, or credit card numbers. If that information were to become available or be stolen by an outside party, the organization could face considerable expense in rectifying the data breach and compensating victims of that breach.

 These types of risk can be sufficiently, and quite successfully, addressed within an alternative risk transfer mechanism. Since most organizations, for all intents and purposes, are self-insuring these risks, the practical first step in establishing a captive program to cover these risks is to discuss and explore the enterprise risks faced by a particular entity.

The next step, once the risks have been identified, is to determine a price to cover these risks. A reasonable initial approach to pricing these coverages is to look at the traditional insurance industry's price for similar coverage. This, of course, becomes difficult when examining a coverage that is not readily available in the traditional insurance industry. This is where the actuary can be of assistance. Through discussion with the potential insured's management about the details of the organization's business, the actuary can get an idea of the economics of the insured's business and the potential severity of a loss. From there the actuary can construct a mathematical model of the loss process, considering both the expected frequency of particular losses and the expected severity of those losses when they occur.

Generally these types of risks are low frequency / high severity, meaning they don't happen very often but when they do, they're big. So the per occurrence limits to be provided by the captive are key. It can be safely assumed that whatever the per occurrence limit provided by the captive, when a loss occurs, it will be a full limits loss.  This assumption essentially reduces the pricing calculation to an estimate of frequency. If, for example, the captive will be providing a $1,000,000 per occurrence limit, the expected loss per year will be $1,000,000 times the frequency of loss per year, which can be estimated based on reasonable assumptions about the nature of the insured's business and an overall assessment of the insured's industry.

Once a price for the coverage has been determined, the actuary can assist the insured and other consultants involved (legal, captive management, etc.) in establishing a captive program to cover the enterprise risks that have been identified by completing a full feasibility study to be submitted with the application for licensure to the selected captive domicile.

I've seen a lot of discussion lately around Enterprise Risk Management (ERM). Essentially, ERM is a concerted and deliberate strategy for identifying, controlling, and financing all of an organization's sources of risk. The reason it seems to be such a hot topic of conversation recently is that more and more people are starting to realize that there are numerous risks faced by an organization for which traditional insurance is not commonly purchased. These risks can drastically affect the consistency and utilization of an organization's stream of revenue. An example might be a firm that collects highly sensitive information about its clients, such as social security numbers, financial information, or credit card numbers. If that information were to become available or be stolen by an outside party, the organization could face considerable expense in rectifying the data breach and compensating victims of that breach.  

If you would like more information on Enterprise Risk Managament, please feel free to contact Brian at brianj@bartlettactuarialgroup.com