1. Actuarial Review of Emerging Risks
Example: Cyber Risk
Ryan Purdy, FCAS, MAAA
Merlinos & Associates
July 2017

2. AGENDA General Process of quantifying emerging risks.
Cyber Risk as an Example.
Thoughts on how emerging risks could impact financial exams.

3. AGENDA General Process of quantifying emerging risks.
Cyber Risk as an Example.
Thoughts on how emerging risks could impact financial exams.

4. Information Gathering
STAGES OF REVIEW
Information Gathering
Assessment of Risks
Risk Quantification
Reevaluation
This seemed like the easiest way to illustrate the broad point. Important to note that the information gathering is an ongoing process that involves keeping current with (cyber) news from many different sources. Especially in a market that is rapidly changing, like cyber, this process may not be so perfectly cyclical. In particular, may be many iterations of stages 2 & 3 (assessment of market & risk quantification)

5. Information Gathering
STAGES OF REVIEW
Information Gathering
Assessment of Risks
Risk Quantification
Reevaluation
This seemed like the easiest way to illustrate the broad point. Important to note that the information gathering is an ongoing process that involves keeping current with (cyber) news from many different sources. Especially in a market that is rapidly changing, like cyber, this process may not be so perfectly cyclical. In particular, may be many iterations of stages 2 & 3 (assessment of market & risk quantification)

6. INFORMATION GATHERING Develop Qualitative and Quantitative Understanding of the Exposures
General
Cyber Specific
News/Current Events
Case Studies in the News: Target, Blue Cross Blue Shield, Samsung, Wannacry Ransomware
Industry Sources Related to Risk
Studies by Ponemon
Industry Sources Related to Risk Transfer
Review of Cyber Insurance Manuals
Networking
Discussions with Cyber Security Personnel
RESOURCES
Not in a specific order here… all research areas that can be reviewed simultaneously.

7. Information Gathering
STAGES OF REVIEW
Information Gathering
Assessment of Risks
Risk Quantification
Reevaluation
This seemed like the easiest way to illustrate the broad point. Important to note that the information gathering is an ongoing process that involves keeping current with (cyber) news from many different sources. Especially in a market that is rapidly changing, like cyber, this process may not be so perfectly cyclical. In particular, may be many iterations of stages 2 & 3 (assessment of market & risk quantification)

8. ASSESSMENT OF RISKS Loss Opportunity General: -Financial risk
-Operational risk
-Reputational risk
- Etc
Cyber Specific:
-Risk of Loss of Insurance Company Data or Business Interruption
-Liability if Personal Information Released
-Reputational risk of a hack
-Risk of charging incorrect premiums for cyber coverage
-Regulatory fines
Opportunity
- Are there new opportunities to buy or sell this risk?
-What coverages do our insureds need that are not currently in the market?
-How do we price those coverages to benefit policyholders and create profit?
- Can we arbitrage current pricing to sell risk to our advantage?

9. Information Gathering
STAGES OF REVIEW
Information Gathering
Assessment of Risks
Risk Quantification
Reevaluation
This seemed like the easiest way to illustrate the broad point. Important to note that the information gathering is an ongoing process that involves keeping current with (cyber) news from many different sources. Especially in a market that is rapidly changing, like cyber, this process may not be so perfectly cyclical. In particular, may be many iterations of stages 2 & 3 (assessment of market & risk quantification)

10. RISK QUANTIFICATION General Cyber Specific
Estimate Frequency and Severity for Proposed Coverage and Limits
Review current studies on frequency and severity. Is the past indicative of the future in cyber? How should data be adjusted?
Risk Appetite and Tolerance
-Proposed limits and reinsurance
-Mix of business and surplus?
-If cyber coverage is not offered, how many insureds may move to other insurers?
Tail/Catastrophic Scenarios
-Global ransomware epidemic
-Largest net limits for policyholder or insured -Tail scenario of the payments the insurer may make in one year
Controls – Can the Risk be Mitigated?
-Underwriting practices/ review of policyholder IT security and protocols reviewed
-Controls on insurer’s own IT systems

11. Information Gathering
STAGES OF REVIEW
Information Gathering
Assessment of Risks
Risk Quantification
Reevaluation
This seemed like the easiest way to illustrate the broad point. Important to note that the information gathering is an ongoing process that involves keeping current with (cyber) news from many different sources. Especially in a market that is rapidly changing, like cyber, this process may not be so perfectly cyclical. In particular, may be many iterations of stages 2 & 3 (assessment of market & risk quantification)

12. REEVALUATION General Cyber Specific
Evaluation of Actual vs Expected Results
-Impact of ransomware attacks in past year on policyholders or insurer
-Actual business interruption of policyholder or insurer
-Actual regulatory fees
Incorporation of New Data in Pricing/Underwriting/Reserving/Insurer Internal Protocols
-Should the insurer be asking different questions during underwriting? Base evaluation based on data and consultation with specialists
-How profitable is the current book of business?
Be aware of changing environment
-In cyber especially, important to keep current on the most recent types of threats
Note: Much cyber coverage is offered on a claims made basis based on the date of discovery of an incident. Just FYI

13. AGENDA General Process of quantifying emerging risks.
Cyber Risk as an Example.
Thoughts on how emerging risks could impact financial exams.

14. FINANCIAL EXAMS Understanding the Company and Inherent Risk (Phases 1&2)
Are policies covering emerging risk areas offered to insureds:
Review coverages and limits provided and industries for an idea of the inherent risk involved
Is reinsurance used to limit risk?
Is the Company subject to the emerging risk, consider:
Does the emerging risk potentially affect a critical risk category?
Is the company themselves using insurance properly?

15. FINANCIAL EXAMS Controls (Phase 3)
For insurance provided to insureds:
Documented underwriting controls
Documented controls about immediate actions when notified of a claim
Controls on how coverage is vetted and established upon receipt of a claim
Trusted partners in risk mitigation and claims valuation
For insured’s own risk:
Documented risk assessment and action plan
Outside expert testing of controls.
Not a comprehensive list, but some important points to consider. Regulators may be particularly interested. From speaking with various experts, we have heard frequently that some companies do not have any of these controls in place. Further, of those that do have controls in place, even fewer have tested these controls. Internal testing is good, outside testing even better.

16. FINANCIAL EXAMS Substantive Testing (Phase 5)
For insurance provided to insureds:
Review of insurer’s pricing and reserving workpapers
Review of actual performance vs business plan
Review of procedures in place to reevaluate pricing and reserving based on actual experience
For insurer’s own risk:
Review insurer’s response and/or cost related to actual incidents
Actuarial involvement may be warranted to review workpapers and/or review reserves.

17. Thank you! Actuarial Review of Emerging Risks 1717
Ryan Purdy, FCAS, MAAA
Merlinos & Associates