Solvency ii and Operational Risk
from the Solvency ii Association, the largest Association
of Solvency ii Professionals in the world
Operational risk was a neglected area
in the insurance and reinsurance industry
that becomes
a major concern after the Solvency ii Directive of the European
Union.
Make no mistake, although operational risk is one of the major
threats to the solvency of insurers and reinsurers, and it is a
separate risk category under Solvency II, it is not well
understood.
Claim fraud, employee theft, claim
fabrication client privacy issues, bad faith, system
interruptions, are only a few operational risks that must be
quantified under Solvency II.
A really important problem
is the poor quality of data for the calculations.
Although there is a solution, to supplement internal loss data
with external loss data from consortia such as ORX and ORIC, this
creates some other difficult problems: To ensure reliability,
consistency and good aggregation. The solution can be worse than
the problem.
From the paper
"Analysing Operational losses in insurance, Evidence on the need
for scaling from the ORIC database (Report from the Association of
British Insurers Research Department, paper 16 of 2009) we read:
"Among the main conclusions of our empirical analysis are the
following:
• The size of the insurer is strongly associated
with the severity and number of its operational losses.
More specifically, loss amounts are positively correlated with the
number of full-time employees whereas the number of loss events in
a given quarter is more sensitive to premium income.
• Increasing
the number of full-time employees by 1% results in an increase of
about 0.8% in the predicted loss amount, holding all other
variables constant.
The standardised loss amount
per event, which according to our estimates is around £27,000, can
increase to nearly £300,000 in firms with high number of full-time
employees.
• For a standard deviation rise in premium
income, roughly £3.7bn, the projected number of operational losses
per quarter increases by 24 per cent, holding other variables
constant.
• Insurers at the lower end of the distribution
of premium income are predicted to experience more than nine
losses only 4 out of 100 times, whereas insurers in the upper end
of the distribution would experience more than nine losses 12 out
of 100 times.
• The business functions Customer
Service/Policy Administration and Claims are strongly associated
with smaller losses, other things being equal. Business functions
can often predict the variability in observed operational losses
better than business lines.
• While the goodness-of-fit of
our scaling models is often higher than the results reported by
similar studies in the banking sector, a great deal of the
variability in observed losses remains unexplained by our models.
• For scaling the frequency of operational losses, the
negative binomial regression model was preferred to the commonly
used Poisson regression model."
From the European Parliament legislative
resolution of 22 April 2009 on the amended proposal for a directive of
the European Parliament and of the Council on the taking-up and
pursuit of the business of Insurance and Reinsurance (recast)
Operational risk means the risk of loss arising
from inadequate or failed internal processes, or from personnel and
systems, or from external events;
Article 43
Risk management
1. Insurance
and reinsurance undertakings shall have in place an effective risk
management system comprising strategies, processes and reporting
procedures necessary to identify, measure, monitor, manage and report,
on a continuous basis the risks, on an individual and aggregated
level, to which they are or could be exposed, and their
interdependencies.
That risk management system shall be
effective and well integrated into the organisational structure and in
the decision making processes of the insurance or reinsurance
undertaking with proper consideration of the persons who effectively
run the undertaking or have other key functions.
2. The risk
management system shall cover the risks to be included in the
calculation of the Solvency Capital Requirement as set out in Article
101(4) as well as the risks which are not or not fully included in the
calculation thereof.
It shall cover at least the following
areas:
(a) underwriting and reserving;
(b) asset –
liability management;
(c) investment, in particular derivatives
and similar commitments;
(d) liquidity and concentration risk
management;
(da) operational risk management;
(e)
reinsurance and other risk mitigation techniques.
The written
policy on risk management referred to in Article 41(3) shall comprise
policies relating to points (a) to (e) of the second subparagraph of
this paragraph.
Article 48
Outsourcing
1. Member States shall ensure that, when insurance and reinsurance
undertakings outsource functions or any insurance or reinsurance
activities, the undertakings remain fully responsible for discharging
all of their obligations under this Directive.
2. Outsourcing of critical or important operational functions or
activities shall not be undertaken in such a way as to lead to any of
the following:
(a) impairing materially the quality of the governance system of the
undertaking concerned;
(b) increasing unduly the operational risk;
(c) impairing the ability of the supervisory authorities to monitor
the compliance of the undertaking with its obligations;
(d) undermining continuous and satisfactory service to policyholders.
3. Insurance and reinsurance undertakings shall, in a timely manner,
notify the supervisory authorities prior to the outsourcing of
critical or important functions or activities as well as of any
subsequent material developments with respect to those activities.
Article 101
Calculation of the Solvency Capital Requirement
1. The Solvency Capital Requirement shall be calculated in accordance
with paragraphs 2 to 5:
2 The Solvency Capital Requirement shall be calculated on the
presumption that the undertaking will carry on its business as a going
concern.
3. The Solvency Capital Requirement shall be calibrated so as to
ensure that all quantifiable risks to which an insurance or
reinsurance undertaking is exposed are taken into account. It shall
cover existing business, as well as the new business expected to be
written over the next twelve months. With respect to existing
business, it shall cover unexpected losses only.
It shall correspond to the Value-at-Risk of the
basic own funds of an insurance or reinsurance undertaking subject to
a confidence level of 99,5 % over a
one-year period.
4. The Solvency Capital Requirement shall cover at least the following
risks:
(a) non-life underwriting risk;
(b) life underwriting risk;
(c) health underwriting risk;
(d) market risk;
(e) credit risk;
(f) operational risk.
Operational risk as referred to in point (f) of the first subparagraph
shall include legal risks, and exclude risks arising from strategic
decisions, as well as reputation risks.
5. When calculating the Solvency Capital Requirement, insurance and
reinsurance undertakings shall take account of the effect of risk
mitigation techniques, provided that credit risk and other risks
arising from the use of such techniques are properly reflected in the
Solvency Capital Requirement.
Article 103
Structure of the standard formula
The Solvency Capital Requirement calculated on the basis of the
standard formula shall be the sum of the following items:
(a) the Basic Solvency Capital Requirement, as laid down in Article
104;
(b)
the capital requirement for operational risk,
as laid down in Article 106;
(c) the adjustment for the loss-absorbing capacity of technical
provisions and deferred taxes, as laid down in Article 107.
Article 104
Design of the Basic Solvency Capital Requirement
1. The Basic Solvency Capital Requirement
shall comprise individual risk modules, which are aggregated in
accordance with point 1 of Annex IV.
It shall consist of at least the following risk
modules:
(a) non-life underwriting risk;
(b) life underwriting risk;
(c) health underwriting risk;
(d) market risk,
(e) counterparty default risk.
2. For the purposes of points (a), (b) and (c) of paragraph 1,
insurance or reinsurance operations shall be allocated to the
underwriting risk module that best reflects the technical nature of
the underlying risks.
3. The correlation coefficients for the aggregation of the risk
modules referred to in paragraph 1, as well as the calibration of the
capital requirements for each risk module, shall result in an overall
Solvency Capital Requirement which complies with the principles set
out in Article 101.
4. Each of the risk modules referred to in paragraph 1 shall be
calibrated using a Value-at-Risk measure, with a 99.5% confidence
level, over a one year period.
Where appropriate, diversification effects shall be taken into account
in the design of each risk module.
5. The same design and specifications for the risk modules shall be
used for all insurance and reinsurance undertakings, both with respect
to the Basic Solvency Capital Requirement and to any simplified
calculations as laid down in Article 108.
6. With regard to risks arising from catastrophes, geographical
specifications may, where appropriate, be used for the calculation of
the life, non-life and health underwriting risk modules.
7. Subject to approval by the supervisory authorities, insurance and
reinsurance undertakings may, within the design of the standard
formula, replace a subset of its parameters by parameters specific to
the undertaking concerned when calculating the life, non-life and
health underwriting risk modules.
Such parameters shall be calibrated on the basis of the internal data
of the undertaking concerned, or of data which is directly relevant
for the operations of that undertaking using standardised methods.
When granting supervisory approval, supervisory authorities shall
verify the completeness, accuracy and appropriateness of the data
used.
Article 106
Capital requirement for operational risk
1.
The capital requirement for operational risk shall reflect operational
risks to the extent they are not already reflected in the risk modules
referred to in Article 104.
That requirement shall be calibrated in accordance with Article
101(3).
2. With respect to life insurance contracts where the investment risk
is borne by the policyholders,
the calculation of the capital requirement for operational risk
shall take account of the amount of annual expenses incurred in
respect of those insurance obligations.
3. With respect to insurance and reinsurance operations other than
those referred to in paragraph 2, the calculation of the
capital requirement for operational risk
shall take account of the volume of those operations, in terms of
earned premiums and technical provisions which are held in respect of
those insurance and reinsurance obligations.
In this case,
the capital requirement for operational risks shall not exceed 30% of
the Basic Solvency Capital Requirement relating to those insurance and
reinsurance operations.
Article 109
Implementing measures
1. In order to ensure that the same treatment is applied to all
insurance and reinsurance undertakings calculating the Solvency
Capital Requirement on the basis of the standard formula, or to take
account of market developments, the Commission shall adopt
implementing measures laying down the following:
(-a) a standard formula in accordance with the provisions of Articles
101 and 103 to 108;
(a) any sub-modules necessary or covering more precisely the risks
which fall under the respective risk modules referred to in Article
104 as well as any subsequent updates;
(b) the methods, assumptions and standard parameters to be used, when
calculating each of the risk modules or sub-modules of the Basic
Solvency Capital Requirement laid down in Articles 104 and 105, the
symmetric adjustment mechanism and the appropriate period of time,
expressed in the number of months, as referred to in Articles 105a and
305b, as well as the appropriate approach for integrating the method
referred to in Article 305b related to the use of this method in the
Solvency Capital Requirement as calculated in accordance with the
standard formula;
(c) the correlation parameters, including, if necessary, those set out
in Annex IV, and the procedures for the updating of those parameters;
(d) where insurance and reinsurance undertakings use risk mitigation
techniques, the methods and assumptions to be used to assess the
changes in the risk profile of the undertaking concerned and adjust
the calculation of the Solvency Capital Requirement;
(e) the qualitative criteria that the risk mitigation techniques
referred to in point (d) must meet in order to ensure that the risk
has been effectively transferred to a third party;
(f) the methods and parameters to be used when assessing the
capital requirement for operational risk
set out in Article 106, including the percentage referred to in
paragraph 3 of Article 106;
(fa) the methods and adjustments to be used to reflect the reduced
scope for risk diversification of insurers related to ring-fenced
funds;
(g) the method to be used when calculating the adjustment for the
loss-absorbing capacity of technical provisions, as laid down in
Article 107;
(h) the subset of standard parameters in the life, non-life and health
underwriting risk modules that may be replaced by undertaking-specific
parameters as set out in Article 104(7);
(i) the standardised methods to be used by the insurance or
reinsurance undertaking to calculate the undertaking-specific
parameters referred to in point (h), and any criteria with respect to
the completeness, accuracy, and appropriateness of the data used that
must be met before supervisory approval is given;
(j) the simplified calculations provided for specific sub-modules and
risk modules, as well as the criteria that insurance and reinsurance
undertakings, including captive insurance and reinsurance
undertakings, shall be required to meet in order to be entitled to use
each of these simplifications, as set out in Article 108;
(ja) the approach to be used with respect to related undertakings
within the meaning of Article 210 in the calculation of the Solvency
Capital Requirement, in particular the calculation of the equity risk
sub-module referred to in Article 105(5), taking into account the
likely reduction in the volatility of the value of those related
undertakings arising from the strategic nature of those investments
and the influence exercised by the participating undertaking on those
related undertakings.
Those measures designed to amend non-essential elements of this
Directive, by supplementing it, shall be adopted in accordance with
the regulatory procedure with scrutiny referred to in Article 304(3).
2. The Commission may adopt implementing measures laying down
quantitative limits and asset eligibility criteria in order to address
risks which are not adequately covered by a sub-module. Such
implementing measures shall apply to assets covering technical
provisions, excluding assets held in respect of life insurance
contracts where the investment risk is borne by the policyholders.
Those measures shall be reviewed by the Commission in the light of
developments in the standard formula and financial markets.
Article 110
General provisions for the approval of full and partial internal
models
1. Member States shall ensure that insurance or reinsurance
undertakings may calculate the Solvency Capital Requirement using a
full or partial internal model as approved by the supervisory
authorities.
2. Insurance and reinsurance undertakings may use partial internal
models for the calculation of one or more of the following:
(a) one or more risk modules, or sub-modules, of the Basic Solvency
Capital Requirement, as set out in Articles 104 and 105;
(b) the
capital requirement for operational risk
as laid down in Article 106;
(c) the adjustment referred to in Article 107.
In addition, partial modelling may be applied to the whole business of
insurance and reinsurance undertakings, or only to one or more major
business units.
3. In any application for approval, insurance and reinsurance
undertakings shall submit, as a minimum, documentary evidence that the
internal model meets the requirements set out in Articles 118 to 123.
Where the application for that approval relates to a partial internal
model, the requirements set out in Articles 118 to 123 shall be
adapted to take account of the limited scope of the application of the
model.
4. The supervisory authorities shall decide on the application within
six months from the receipt of the complete application.
5. Supervisory authorities shall give approval to the application only
if they are satisfied that the systems of the insurance or reinsurance
undertaking for identifying, measuring, monitoring, managing and
reporting risk are adequate and in particular, that the internal model
complies with the requirements referred to in paragraph 3.
6. Any decision by the supervisory authorities to reject the
application for the use of an internal model shall be accompanied by
the reasons therefore.
7. After having received approval from supervisory authorities to use
an internal model, insurance and reinsurance undertakings may, by a
decision stating the reasons, be required to provide supervisory
authorities with an estimate of the Solvency Capital Requirement
determined in accordance with the standard formula, as set out in
Subsection 2.
Article 123
Documentation standards
Insurance and reinsurance
undertakings
shall document the design and operational details
of their internal model.
The documentation shall demonstrate compliance with Articles 118 to
122.
The documentation shall provide a detailed outline of the theory,
assumptions, and mathematical and empirical basis underlying the
internal model.
The documentation shall indicate any circumstances under which the
internal model does not work effectively.
Insurance and reinsurance undertakings shall document all major
changes to their internal model, as set out in Article 113.
Solvency ii and Operational Risk
Fourth Quantitative Impact Study: Operational risk
questionnaire
a) Does your operational risk
management system capture the operational risk events and near
misses in day-to-day management in practice?
b) Does your
operational risk management system capture the interrelations
between the various risks identified?
c) "Does your
undertaking quantify and keep a record of the operational risk
events and near misses(1)(2) that have occurred?
(1) A near
miss is a risk event that has occurred but has not resulted in a
loss.
(2) For near misses quantify the potential loss – if
possible."
d) What are the methods used to quantify the
operational risk events and near misses that have occurred?
e) Does your undertaking categorise the operational risk
events and near misses?
If yes, in what categories?
f)
What methods do you use to quantify operational risk, both in
respect of the size of possible events and their likelihood?
g) How far back do the records go on operational risk events
that have occurred?
h) How far back do the records go on
near misses that have occurred?
"Irrespective of whether
an operational risk framework is in place, all (re)insurance
undertakings do have operational risk information in various
departments. Please answer the following questions regarding the
operational risk events and near misses that have occurred in the
last five years."
i) How many operational risk events and
near misses has your undertaking registered?
j) Describe
them, explain what kind of mitigation techniques were in place at
the time of the event, and quantify their impact.
k) Has
your undertaking introduced new mitigation techniques after
analysing the above described events? Which ones?
In case
participants do not have an individual categorisation, the
following categories may be used in describing these events,
unless participants decide on other levels of categorisation more
specific to insurance; in this case, participants should provide
the whole range of categories used, even if no information has
been gathered regarding some of them.
Categorisation of
Operational risk events based on the categories proposed by The
Operational Risk Insurance Consortium (ORIC):
-
Intentional misconduct (internal fraud);
- Unauthorised
activities by external parties (external fraud);
-
Employment practices and workplace safety;
- Clients,
product and business practices;
- External events that
cause damage to physical assets;
- Business disruption and
system failures;
- Business process risks.
In case
participants have not quantified the impact of their operational
risk events, they should use the following classes:
- No
effect;
- Negligible effect;
- Negative effect but
no major impact on the day-to-day business;
- Negative
effect and potential major impact on the day-to-day business;
- Negative effect and major impact on the day-to-day business.
l) Taking into account all aspects of your operational
risk management system including any mitigation techniques
employed, do you think the operational risk capital charge of the
standard formula, as calculated in QIS4, is appropriately designed
and calibrated? If not, why?
Solvency ii and Operational Risk: Fourth Quantitative Impact Study
Consultation Paper No. 53. Draft CEIOPS’ Advice for Level 2
Implementing Measures on Solvency II:
Article 109 1 (g) SCR standard formula - Operational Risk
|
