107th Mid-Atlantic Mutual Advantage Convention Enterprise Risk Management Framework For Small to Mid-Sized Property & Casualty Insurance Companies Presented by Joseph F. Morris CPA, MBA President & CEO, American European Insurance Group, Inc.

Why Companies Have Not Implemented ERM?  It’s not required  I’ve been managing risks my entire career; form over substance  I see no benefits  I view ERM as adding time and expense  ERM is operating by committee  Why do I need to involve the Board?; It’s management’s responsibility to manage risks  My company is too small; ERM is only for large companies  I understand the theory, but how do you put it into practice? 2

Learning Goals  Recent Regulatory Developments  Expectations of Rating Agencies  Enterprise Risk Management Framework  Definition and Benefits  Creating a Risk-Aware Culture  Determining Key Risk Factors 3

ERM – Regulatory Developments  2013 Annual Registration Statement Includes: –“the insurer’s board of directors oversees corporate governance and internal controls and that the insurer’s officers or senior management have approved, implemented and continue to maintain and monitor corporate governance and internal control procedures.”  2014 Form F (Enterprise Risk Management Report)  2015 Own Risk Solvency Assessment (ORSA)  2016 Corporate Governance Annual Filing (Proposed) 4

A.M. Best: ERM in the Rating Evaluation Process Business Profile Operating Performance Balance Sheet Strength Enterprise Risk Management is the common thread that links balance sheet strength, operating performance, and business profile Source: A. M. Best Company 5

A.M. Best ERM Expectations  All insurers need to establish an ERM framework  ERM capabilities should be proportionate to risk profile of insurer  Insurers need to establish firm-wide risk tolerance metrics  Insurers need to have their own view of capital adequacy  A low risk profile and high ERM capability will produce a ratings “lift”  Leading insurers are utilizing stochastic-based capital modeling to better support risk-reward decisions Source: A. M. Best Company 6

Enterprise Risk Management Framework

What is an ERM Framework? Enterprise Risk Management Framework A disciplined process to systematically identify measure and manage various types of risk Establish Risk-Aware Culture Identify Measure Manage & Mitigate Risks Measure Enterprise Risk and Risk Correlation Source: A. M. Best Company 8

Benefits of Enterprise Risk Management Framework  Maximize value to the organization’s various stakeholders  Manage exposure to earnings and capital volatility  Ensures future capital levels exceed regulatory and rating agency required capital levels  Create a risk-aware culture that encourages risk-taking  Develop consistent metrics to measure risk and to establish risk tolerance levels  Assign roles and responsibilities to board, Sr. management and others  Maintain excellent rating from rating agencies 9

Enterprise Risk Management Risk-Aware Culture

ERM – Risk Aware Culture ERM Tone Established by Board of Directors and Senior Management  ERM roles and responsibilities clearly defined  Define risk profile, risk appetite and risk tolerance parameters  Mission, Strategic Planning and ERM documents shared with all employees  Executive compensation includes ERM objectives / results  Financial results and risk management initiatives reviewed with employees 11 ERM Tone Established by Board of Directors and Senior Management

ERM Terminology What is Risk Profile? A narrative description of the parameters for executing the company’s business strategy 12

ERM Terminology What is Risk Appetite? The boundary level of uncertainty a company is willing to assume given the corresponding reward associated with the risk 13

Risk Profile and Risk Appetite Examples  External Environment Regulatory Legal/Judicial Economic Industry Competition  Capital Management Financial Ratings Access to Capital Debt and Holding Company Structure Capital Adequacy  Balance Sheet Loss Reserves Investment Portfolio 14  Written Premium Profile Line of Business, Geographic, Product, Class of Business, Agency Concentration Limits of Liability Coverage  Reinsurance Profile Reinsurance Credit Quality CAT Exposure Per Risk Retentions  Operational Profile Underwriting & Claim Practices IT Performance, Data Quality & Business Continuity and Recovery

ERM Terminology What is Risk Tolerance Level? The financial metrics that establish thresholds for levels of risk that the company is willing to accept in order to accomplish its strategic objectives. 15

Risk Tolerance Level Examples Enterprise-Wide Risk tolerance Levels  Economic Capital Model: Probability of Ruin at 99.5% VaR, One- Year Out  Best Capital Adequacy Ratio, One Year Out to Achieve/Maintain A- Rating  NAIC Risk Based Capital Greater Than 300  Net Written Premium to Surplus ratio of Less than 1.5 to1  No Greater Than a 10% Loss of Capital From all Risk Factors in Any One Year  Holding Company Debt to Total Capitalization Ratio 16

Risk Tolerance Level Examples Individual Risk Tolerance Levels  Net of Reinsurance Underwriting per Risk Retention Equal to 5% or Less of Capital (net of tax).  Loss and LAE Reserves Set at or Above Mid-Point of Actuarial Range of Estimates  No Greater than a 5% Loss of Capital in Any One Year Due to a 100 Basis Change in Interest Rates 17

Identification, Measuring and Monitoring Key Risk Factors

Primary Causes of Financial Impairment 19

Key Risk Factor Categories - Definitions  Credit - exposure from all potential creditors including agents, reinsurers, bond issuers and insureds  Market – exposure to liquidity events, asset/liability mismatches and risks in investment portfolios due to changes in interest rates, equity prices and exchange rates Underwriting – exposure from underwriting insurance products including: product development, regulation, loss reserves, pricing metrics and catastrophic events Operational – exposure to management change, business interruption, fraud, data capture and security, claim handling and employee retention and other operating activities Strategic – exposure to economic downturn, industry competition, rating agencies and availability of capital 20

Categories of Key Risk Factors CreditMarket  Bond Issuer Default/Downgrade  Agency/policyholder credit risk  Reinsurer default  Sovereign  Currency  Liquidity events  Asset / Liability Matching  Interest Rate Risk  Common Stock Market Price  Reinvestment UnderwritingOperational  Product Development  Regulatory  Catastrophic Event  Loss Reserve  Loss Experience  Pricing  Data Capture/Data Security  Agency Automation  Management Change/Employee Turnover  Fraud/Financial Controls  Claim Handling  Delegation of Underwriting Authority  Financial Reporting Strategic  A. M. Best Downgrade  Industry Competition  Economic Downturn  Reputational  Capital Availability  Competitor technology Advances 21

Frequent Probable Often Occasional Possible Remote < 1%1 – 5%5 – 10%10 – 15%15 – 20%>20% Low Severity of Event (% of Surplus) High Low Probability High ERM Key Risk Factors – Heat Map 22

ERM – #1 Risk Factor: Pricing Dashboard Description of Risk: The Company may not price its policies adequately in order to produce acceptable loss ratios. Oversight: ERM Committee Board Committee Frequency of Oversight: Quarterly Risk Owner: VP - Underwriting Risk Tolerance Level: (1) Achieve a 6.2% renewal rate level increase over expiring. (2) New and renewal policies written with average RMF of.85. Risk Score: (1)June 30, 2013 – 7.2% (2)June 30, renewals;.80 new business Monitoring or Control Activity: 1.All ISO filed manual rate changes are reviewed & analyzed by actuary and discussed at rate committee before adoption. 2.Underwriters are given pricing goals at beginning of year and required to document every file with explanations for use of discretionary pricing credits. 3.Underwriting quality assurance process in place to review 25 policies per underwriter per quarter. Date and Result of Testing Monitoring or Control Activity: 1.Tested successfully on May 15, Goals discussed with each underwriter by January 10, Results of all UQAP completed quarterly and an overall summary distributed to management – completed on July 31, Control Effectiveness: 1.Medium 2.Medium 3.High Severity of Event (Low 1 to High 6) 4 Frequency of Event (Low 1 to High 6) 5 Issues for Remediation: The Company does not have the capability to produce pricing reports indicating renewal rate level change and RMF charged for new and renewal policies. An IT project has been created to address this remediation issue. Status – – June 30, 2013 All monitoring controls are operating effectively. Producing pricing reports is a key issue to ensure that this risk is being properly mitigated and managed at the individual underwriter level and on an aggregate book of business basis. Change from Last Quarter Status – September 30, 2013Change from Last Quarter Status – December 31, 2013Change from Last Quarter Status – March 30, 2014Change from Last Quarter 23

Is Your Company Capable of Managing Key Risks? 24 Industry Operating PracticesBest Operating Practices Pricing - No price monitoring reports New business and renewal price monitoring reports track manual and discretionary price changes Loss Reserves - Calendar Year Loss Ratio/Loss Reserve Adequacy Reviewed Annually by Outside Actuary Accident Year Loss Ratios/ Loss Reserve Adequacy Reviewed Quarterly Internally and Annually by Outside Actuary CAT Management - Determined annually by reinsurance broker Property Values Managed Monthly in Concentrated Territories Claims Best Practices - No written claims best practices and no claim audit process Written Claims Best Practices and Claim Files Audited Monthly Investment Portfolio - Risk Metrics not calculated Investment Manager Monitors Risk Metrics of Investment Portfolio and Meets with Board Investment Committee Quarterly Financial Forecasts – one-year budgets are created for operating statements only Three-Year Financial Forecasts prepared including operating statements, balance sheets and RBC and BCAR ratios

Enterprise Risk Management Framework Integrate ERM Process into Standard Operating Practices of Company 25 Risk IdentificationRisk Measurement Risk Controls, Monitoring Activities & Reporting Business Strategies & Operating Practices Financial Goals & Capital Management Risk-Aware Culture Risk Profile Risk Tolerance Roles/Responsibilities ERM Process

26

Joseph F. Morris, CPA, MBA, has over thirty-four years of insurance industry experience. Prior to founding P&C Insurance Company Strategies, LLC, Mr. Morris was President of Stonecreek Specialty Underwriters, LLC. Previously, Mr. Morris was President and CEO of James River Insurance Company from 2008 until 2010 after serving as President and CEO of The Philadelphia Contributionship, the oldest insurance company in the United States. Mr. Morris also held several positions with United America Indemnity, Ltd. (UAI) including President, President & CEO Penn-America, UAI’s excess & surplus lines subsidiary, and SVP and CFO of Penn-America. Mr. Morris began his insurance career at Reliance Insurance Company where, over a twenty-one year career, he held a number of financial and operating positions. Mr. Morris has been a member of the Board of Directors of The Insurance Society of Philadelphia since 1989 and was its Chairperson in Joseph F. Morris, CPA, MBA Bio 27

Disclaimer of Warranties The content of the presentation materials has been prepared by P&C Insurance Company Strategies, LLC (PCIC Strategies) “as is”, for informational purposes only and without warranties of any kind, either express or implied. PCIC Strategies disclaims all warranties including but not limited to warranties of title, implied warranties of merchantability, fitness for a particular purpose, compatibility, security, accuracy, reliability or infringement. 28