According to a new report from rating agency AM Best, a vast majority of insurers understand the importance of enterprise risk management (ERM), with more than 90% of rated insurers possessing frameworks assessed at appropriate or better.
But, the agency also states that given the escalation of risks in the US economy, rising severity and frequency of weather events, as well as the growing impacts of social inflation, ERM processes are not “static” and need to “evolve along with an insurance company’s risk profile.”
ERM is one of the key pillars within Best’s insurance rating process, along with balance sheet strength, operating performance and business profile.
The ERM analysis is based on an overall understanding of an insurer’s risk management framework and risk management capability relative to its risk profile.
Best views management of an organization’s exposure to potential earnings and capital volatility, as well as the maximization of value to the organization’s various stakeholders, as the fundamental objectives of an ERM program.
In their latest report, Best notes that despite the appropriate or very strong ERM assessment for a significant majority of AM Best-rated entities, many insurers currently lack robust stress testing and reverse stress testing processes. According to the report, approximately 30% have stress testing assessments in the bottom three categories: evolving, nascent or unrecognizable.
Jason Hopper, associate director, industry research and analytics, AM Best, said: “These companies often lack the capability to manage concentration risk effectively. In recent years, companies’ operating results have deteriorated due mainly to weather-related events and an increase in fire losses. Strengthening these ERM frameworks can further enhance understanding and management of risks.”
Moreover, along with stress testing, other components of ERM programs include governance/risk culture, risk management and controls, risk identification/reporting and non-modeled risks and risk appetite/tolerance.
However, Best adds that a weak or non-existent ERM framework can contribute to failures that can occur when insurers do not understand their key risks, which ultimately can lead to a failure to maintain adequate protection against stresses and shocks.
Sridhar Manyem, senior director, industry research and analytics, AM Best, commented: “The failures of Silicon Valley Bank and crypto firm FTX are two recent examples of insufficient risk management.
“Insurers may not be susceptible to a run-on-the-bank scenario, but SVB’s failure provides lessons pertaining to liquidity management and asset-liability risks. Strength and depth of management teams are also essential for an insurance company to execute its strategy, and at FTX, a lack of accountability of executives and board oversight led to poor management decision-making.”
