  
Solvency
ii and Operational Risk
from the Solvency ii
Association, the largest Association of Solvency ii Professionals
in the world
Consultation Paper No. 53
Draft CEIOPS’ Advice for Level 2 Implementing Measures on Solvency
II:
Article 109 1 (g) SCR
standard formula - Operational Risk
1. Introduction
1. In its letter of 19 July 2007, the European Commission
requested CEIOPS to provide final, fully consulted advice on
Level 2 implementing measures by
October 2009 and recommended CEIOPS to develop
Level 3 guidance on certain areas to foster supervisory
convergence.
On 12 June 2009 the European Commission sent a letter
with further guidance regarding the Solvency II project, including
the list of implementing measures and timetable until
implementation.
2. This Paper aims at providing advice with
regard operational risk, as required in Article 109(1),
letter (f), of the Solvency II Level 1 text1 (herein “Level 1
text”).
3. References in this advice to ‘undertakings’ embrace both
insurance and reinsurance undertakings, unless otherwise
explicitly mentioned.
4. For the purpose of this advice, reference
to technical provisions is to be understood as technical
provisions excluding the risk margin, to avoid circularity issues.
2. Extract from Level 1 Text
2.1 Legal basis for implementing
measure
2.1. The legal basis for the advice presented in this paper is
primarily found in Article 109 (1)(ga) of the Level 1 text, which
states:
Article 109 – Implementing measures
1. In order to ensure that the same treatment is applied to all
insurance and reinsurance undertakings calculating the Solvency
Capital Requirement on the basis of the standard formula, or to
take account of market developments, the
Commission shall adopt implementing measures laying down the
following: [..]
(ga)
the methods and parameters to be used
when assessing the capital requirement for operational risk set out in Article 106,
including the percentage referred to in paragraph 3 of Article
106;
2.2. Article 101 of the Level 1 text mentions in paragraph 4 a
list of risks, including under letter (f) ‘operational risk’.
Article 101 - Calculation of the Solvency Capital Requirement
1. The Solvency Capital Requirement shall be calculated in
accordance with paragraphs 2 to 5 [..]
4. The Solvency Capital Requirement shall
cover at least the following risks: [..]
(f) operational risk.
Operational risk as referred to in point (f) of the first
subparagraph shall include legal risks, and exclude risks arising
from strategic decisions, as well as reputation risks.
2.3. More precisely, the Level 1 text
considers 'operational risk' as one of three main elements of the
solvency capital requirement (hereafter, SCR).
Article 103 - Structure of the
standard formula
The Solvency Capital Requirement calculated on the basis of the
standard formula shall be the sum of the following items:
(a) the Basic Solvency Capital Requirement, as laid down in
Article 104;
(b) the capital requirement for operational
risk, as laid down in Article 106;
(c) the adjustment for the loss-absorbing capacity of technical
provisions and deferred taxes, as laid down in Article 107.
2.4. As mentioned in Article 103(b), Article
106 is dedicated to the specific regulation of operational risk:
Article 106. Capital requirement for
operational risk
1. The capital requirement for operational risk
shall reflect
operational risks to the extent they are not already reflected in
the risk
modules referred to in Article 104.
That requirement shall be calibrated in accordance
with Article 101(3).
2. With respect to life insurance contracts where the investment
risk is borne by the policyholders, the calculation of the capital
requirement for operational risk shall take account of the amount
of annual expenses incurred in respect of those insurance
obligations.
3. With respect to insurance and reinsurance operations other than
those referred to in paragraph 2, the calculation of the capital
requirement for operational risk shall take account of the volume
of those operations, in terms of earned premiums and technical
provisions which are held in respect of those insurance and
reinsurance obligations.
In this case,
the capital requirement for operational
risks shall not exceed 30% of the Basic Solvency Capital
Requirement
relating to those insurance and reinsurance operations.
2.2 Other relevant Articles for providing background to the advice
2.5. The Level 1 text also mentions operational risk in the
following provisions:
Article 13 – Definitions
(27) Operational risk means the risk of loss arising from
inadequate or failed internal processes, or from personnel and
systems, or from external events;
Article 48 – Outsourcing
2. Outsourcing of critical or important operational functions or
activities shall not be undertaken in such a way as to lead to any
of the following: [..]
(b) increasing unduly the operational risk;
3. Advice
3.1 Explanatory text
3.1.1 QIS4 feedback
3.1. The QIS4 report, included a summary of industry feedback:
The standard formula tested in QIS4 was similar to the QIS3
approach.
Views diverged between
respondents whether the operational risk charge in the standard
formula is adequately designed.
In general,
non-life
insurers and the smaller undertakings had a more positive opinion
of the operational risk capital charge in QIS4 in comparison to
life and larger undertakings and groups.
Many respondents noted that there are further improvements needed
in the standard formula.
3.2. The main issues mentioned by those respondents are:
The correlation of 100% with other risks
This correlation,
thoroughly debated during the EU inter-institutional procedure for
the Directive approval, has been settled in Article 103 of the
Level 1 text.
Cap of 30 per cent is too high
According to QIS 4
results, the operational risk charge was, on average, around 6% of
the SCR (lowest average of 2% and highest average of 9.5%) and in
only 8 Member States did some undertakings register values higher
than 30% of the SCR
Lack of risk sensitivity to the wide spectrum of operational
risks
In this respect, it
seems necessary to keep in mind that the design of the operational
risk module in the SCR
standard formula needs to maintain an
appropriate balance between simplicity and accuracy.
Some respondents noted that the objectives of the operational
risk charge can only be properly tackled through internal models
and Pillar 2 measures, as
operational risk has a wide range of
qualitative measures which cannot be taken into account reliably
in the standard formula.
The Level 1 text is clear that operational risk must be taken into
account in the SCR standard formula.
The responses to the qualitative questions indicated that there
is a wide range of operational risk management systems in place,
with some participants indicating that they have sophisticated
techniques to quantify capital requirements for operational risk,
while others have yet to start collecting and categorizing
operational risk losses.
3.3. Regarding the design of the operational risk module in the
SCR standard formula, the QIS4 report mentions (pp. 227 - 237)
- 47% of the respondents felt that the operational risk charge is
adequately designed, while 53% of respondents thought it was
not adequately designed;…
In relation to the
formula, respondents stated that:
- The standard formula is too simplistic,
since it is not risk
sensitive, and rewards low pricing and reserving; …
-
The formula does not take into account the quality of the
operational risk management processes of each undertaking, nor
does it encourage the
development of good risk management
practices; …
- The formula does not reflect the wide spectrum of operational
risks that can materialise within an undertaking.
The main suggestions to remedy the perceived deficiencies in the
standard formula were:
- The operational risk charge should be calculated as a percentage
of the BSCR or the SCR;
- The operational risk charge should be more sensitive to
operational risks management;
- The operational risk charge should be based on the
entity-specific operational risk sources and the quality of the
operational risk management process and the internal control
framework;
-
Diversification benefits and risk
mitigation techniques should be considered.
3.4. Furthermore the CEIOPS QIS4 report states that
“The
operational risk capital charge from the internal model tends to
be higher than the standard formula with a median ratio of 133%
and an inter quartile range of 100% to 233%.
13 of the 16 countries
that provided details stated that the median of the ratios was at
least 100%.”
This statement implies
that, compared to internal model results, the QIS4 standard
formula charge for operational risk is not high enough.
3.1.2 Scope of the operational risk
module
3.5. The operational risk module of the SCR standard formula in
this advice does not differ significantly from the QIS4 proposal
since it was based on volume measures generally available, and at
the same time more closely aligned with the drivers of the main
operational risks.
3.6. According to Table 8 of the QIS4 report (page 31) more than
99% of non life insurers and 93.6% of life insurers were able to
calculate the operational risk SCR.
This demonstrates that
the QIS4 approach is workable.
3.7. CEIOPS has considered other options proposed for the
calculation but has disregarded them.
In particular, CEIOPS
considers that the Basic SCR is not a sufficiently reliable volume
measure of the operational risk, and that
a minimum level of granularity would be desirable in the design of
the formula.
3.8. However to take into account QIS4 stakeholders’ feedback as
well as the CEIOPS “Lessons learned from the current financial
crisis”, the
following changes have been
introduced:
• The calibration of the standard formula for the calculation of
the SCR has been revised to be more consistent with the assessment
obtained from internal models.
Details of such analysis
can be found in section 3.1.3.
• Where (re)insurance undertakings take potential future
management actions into account in the calculation of the
technical provisions and these actions lead to a decrease in the
technical provisions, the undertaking is required to have the
systems and processes in place to implement these management
actions.
This necessarily leads
to an increase in operational risk.
This has been taken into
account by increasing the calibration for life technical
provisions where management actions are taken into consideration
by 0.1%, as explained in 3.32.
• The BSCR cap has been revised, as explained in 3.33.
• The formula has become more risk sensitive
to changes in the
size of the undertaking.
The formula
will attempt
to capture the increased risk in operational risk as a result of
increased business activity.
• A zero floor for all technical provisions has been explicitly
introduced to avoid an undue reduction of the operational risk SCR.
• The formula has been revised to reflect the risk of failure or
unfair behaviour (i.e. conflict of interests) of a financial
investment manager when a relevant part of the undertaking’s
financial investments are externally managed.
This also covers the
risks of depositaries.
• Health obligations are split between obligations pursued on a
similar technical basis to that of life insurance (SLT Health) and
those that are not (non SLT Health).
This split shall be
consistent with the split within the health module. For further
information please refer to CP-50/09
SCR Health Underwriting.
• Finally, CEIOPS has also considered the option to introduce a
‘ladder factor’ as an attempt to reflect the degree of progress of
each undertaking in the management of its operational risks.
The discount would have
been applied to the Operational Risk capital charge, allowing to
transform qualitative criteria into a quantitative amount in the
calculation of the SCR standard formula.
After careful
consideration, CEIOPS agreed that this ladder factor should not be
included in the standard formula.
Undertakings wishing to
take this further may use a partial internal model.
3.9. Furthermore, due the complexity and nature of operational
risk, the proposed formula tries to reflect an average profile,
since more accurate designs would make the formula difficult to
apply on a standard basis.
3.1.3. Calibration
3.10. The CEIOPS QIS4 report states that “The operational risk
capital charge from the internal model tends to be higher than the
standard formula with a median ratio of 133% and an inter quartile
range of 100% to 233%.
13 of the 16 countries that provided details stated
that the median of the ratios was at least 100%.”
3.11. Factors should be chosen so that the standard formula
operational risk charge is broadly in line with the undiversified
operational risk from a firm’s internal model.
This is because currently we do not know what
allowance, if any, might be made for diversification within an
approved
internal model.
3.12. In addition the diversification benefit recognized by
undertakings in their QIS4 models may be higher than what might be
in an approved model subject to supervisory challenge (this has
been the case in recent banking history where internal model
numbers submitted for QIS exercises were often lower than those
approved).
3.13. It is also apparent from our analysis that
applying a
standard formula to many firms will inevitably lead to some firms
holding more capital than what their internal model suggests and
others not holding enough.
This was recognised in the CEIOPS QIS4 report where
some respondents noted that “operational risk has a wide range of
qualitative measures which cannot be taken into account reliably
in the standard formula.”
It therefore seems sensible
to have an operational
risk charge in the standard formula that is likely to meet the
99.5% VaR criterion for most undertakings, and to allow those
undertakings for whom the standard formula is not appropriate to
apply for a partial internal model.
3.14. The CEIOPS report also states that “Only 25% of respondents
believed that the data used in their internal model for
operational risk is sufficiently accurate, complete and
appropriate.
Operational risk data used is collected annually and
is entity specific”.
Where there is insufficient data to estimate the
capital charge accurately, it is possible that many undertakings
may underestimate the risk in their models, especially given that
the QIS4 results were not subject to regulatory challenge.
3.15. Analysis from the Chief Risk Officers (CRO) Forum QIS4
benchmarking study dated 30 October 2008 shows diversified
internal model operational risk results to be a similar percentage
of total capital required as the standard formula operational risk
results.
3.16. As noted above, the QIS4 requirements for operational risk
in the standard approach are significantly lower than the
pre-diversification allowance in internal models.
In contrast to many internal models, though, the
standard approach does not allow for diversification between the
operational risk capital requirements and the remaining capital
requirements.
The net result is that the parameters in the QIS4
standard formula are broadly equivalent to those set by firms for
their internal
model operational risk charge after applying their diversification
assumptions (with the exception of health business).
3.17. The CRO Forum results have not been subject to supervisory
challenge so the firms in the analysis could have allowed for too
much diversification rather than too little.
It is not yet clear how much diversification benefit
will be allowed for internal models.
In line with the banking experience, internal model
numbers may increase due to supervisory challenge.
In addition, to encourage internal model development
and to address the issue of the standard formula not providing
incentives to manage operational risk, the undiversified standard
formula charge should be higher than the diversified internal
model charge and not the same.
3.18. Therefore the CRO Forum results help to support the view
that the standard formula operational risk parameters have not
been set high enough to meet a 99.5% VaR criterion for most
undertakings.
3.19. In producing a revised standard formula charge
CEIOPS has aimed at setting the operational risk charge at a level
of 99.5% VaR as required by the Level 1 text.
3.20. As
there is no explicit way of measuring operational risk at
the tail of the distribution, CEIOPS has used the responses from
the internal model operational risk charges as a benchmark for
where firms believe their 99.5% VaR for operational risk lies.
3.21. To further improve our analysis, CEIOPS has also used a
report from the CRO Forum and information from the current UK
regulatory regime to assist in the analysis.
3.22. The analysis was based on 5 EU countries and 32 entities in
total.
3.23. The following data was collected:
1. Internal models operational pre-diversification charge in
relation to non-life technical provisions (Table 1 below).
2. Internal models operational pre-diversification charge in
relation to non-life earned premiums (Table 2 below).
3. Internal models operational pre-diversification charge in
relation to life technical provisions excluding unit-linked
business (Table 3 below).
4. Internal models operational pre-diversification charge in
relation to life earned premiums excluding unit-linked business
(Table 4 below).
3.24. The following analysis was carried out:
• Production of summary statistics for each of the data subsets
above.
•
A charge was selected based on the 60 percentile of the prediversification charge of the internal models.
3.25. The overall conclusion of this analysis is that operational
risk in the standard formula was under-calibrated.
3.26. The revised factors rounded to the first decimal are
presented below:
3.27. For unit-linked business, CEIOPS has
assumed that the characteristics are similar to those of other
life products.
Therefore the QIS4 parameter will evolve in line with
the life parameter.
3.28. Finally, explicit allowance has been made for operational
risks associated with future management actions.
This has been done by increasing the calibration for
life technical provisions where management actions are taken into
consideration by 0.1 percentage point, resulting in a 1.0% charge.
3.29. CEIOPS also gives advice on the 30 per cent cap of Basic SCR
restricting the capital charge of operational risk.
CEIOPS is
aware that the Article 106(3) of the Level 1 text sets out a 30
per cent cap.
However since Article 109 (g) requires the adoption of
implementing measures in respect of such percentage, CEIOPS
considers that the legal interpretation of both provisions jointly
considered allows to reassess such limit as part of the level 2
implementing measures.
CEIOPS advises to increase the cap limit to 60 per
cent for the following reason.
CEIOPS considers that the BSCR is
not a good indicator of operational risk.
For instance,
undertakings
may have a very low BSCR because they have made
comprehensive use of risk mitigation techniques.
However
reinsurance arrangements or hedging
instruments do not necessarely reduce operational risk.
They may even increase it because they may give rise
to additional internal processes that can fail.
In order to avoid an underestimation of the
operational risk in these and similar cases, the cap should be
suficiently high.
3.30. Thus the final set of calibrated factors are as follows:
3.31. To validate the above analysis CEIOPS further considered:
If we assume that the allowance for diversification credit between
operational risk and other risks in models may be around 50%, then
the size of the diversified component for operational risk would
be around one half of the size of the undiversified component.
This undiversified component should in principle meet
the 99.5% VaR criterion.
Thus a proxy could be to simply double the parameters
for operational risk in the standard approach SCR for life and
non-life undertakings.
3.32. Based on the CRO Forum results, this would then seem to make
the operational risk charge in the standard formula, on average,
closer to the operational risk charge produced from an
undiversified internal model, and hence to meet a 99.5% VaR
criterion.
The factors below are consistent with the final
calibrated factors presented in 3.30.
3.1.4 Operational risks linked to external services on financial
investments
3.33. CEIOPS introduces this element as a consequence of the
failures in this area occurred during the current crisis.
Nevertheless, it is considered that actions adopted at
different levels will likely have a positive impact in the
prevention of similar situations in the future.
For this reason, this risk has been calibrated
considering that only one failure is under the targeted confidence
level (in reference to the external manager or depositary of
financial investments presenting the highest exposure).
Furthermore, such a failure has been considered
with
the lowest probability (0.5 per cent according the confidence
level targeted in Article 101(3) of the Level 1 text).
3.1.5. Calculation
3.34. The inputs for this module are:
TPlife = Total
life insurance technical provisions (gross of reinsurance),
with a floor equal to zero.
Undertakings shall distinguish between those TP where
management actions are or are not taken into consideration and
shall
use appropriately in the formulas provided.
This would also include life like obligations of
non-life contracts such as annuities).
TPSLT Health =
Technical provisions corresponding to health
insurance (gross of reinsurance)
that correspond to Health SLT
with a floor equal to zero.
[CEIOPS
suggests to calculate the Health underwriting capital requirement
as a combination of the capital requirements for the 2 following
submodules:
• For health insurance obligations pursued on a similar technical
basis to that of life insurance (SLT Health)
• For health insurance obligations not pursued on a similar
technical basis to that of life insurance (Non-SLT Health).]
Undertakings shall distinguish between those TP where
management actions are or are not taken into consideration and
shall use appropriately in the formulas provided.
TPlife-ul = Total life insurance
technical provisions for
unit-linked business (gross of reinsurance), with a floor equal to
zero.
Undertakings shall distinguish between those TP where
management actions are or are not taken into consideration and
shall use appropriately in the formulas provided.
TPnl = Total
non-life insurance technical provisions (gross of
reinsurance), with a floor equal to zero.
TPNon SLT Health = Technical provisions corresponding to
health
insurance that correspond to Health non SLT (gross of
reinsurance), with a floor equal to zero.
Earnlife =
Total earned
life premium (gross of reinsurance)
EarnSLT Health = Total earned premiums corresponding
to
health
insurance that correspond to Health SLT (gross of reinsurance).
Earnlife-ul = Total earned
life premium for unit-linked business (gross of reinsurance)
Earnnl = Total earned
non-life premium (gross of reinsurance)
EarnNon SLT Health =
Total earned premiums corresponding to
health insurance that
correspond to Health non SLT (gross of reinsurance).
All the aforementioned inputs should be available for the last
economic period and the previous one, in order to calculate their
last annual variations.
Expul = Amount of
annual expenses (gross of reinsurance)
incurred in respect of
unit-linked business
Investop_risk = Amount of the highest amount of financial
investments deposited or externally managed with a single third
party
BSCR = Basic SCR
Read
more about:
Solvency ii and Operational Risk: Fourth Quantitative Impact Study
Consultation Paper No. 53. Draft CEIOPS’ Advice for Level 2
Implementing Measures on Solvency II:
Article 109 1 (g) SCR standard formula - Operational Risk
Return to Index
|
