1. A Portfolio Approach to Enterprise Risk Management Bruce B. Thomas November 11, 2002

2. 2 About Conning Research & Consulting 90 year history of Insurance Industry Research  Closely “connected” to industry thought leaders and practitioners  Produces strategic studies, industry insights and industry commentary  Industry standard models including Property-Casualty Insurance industry, Life insurance industry and Property- Casualty reserving Provides proprietary, confidential research and insights to institutional investors Conning Research Conning Consulting

3. 3 Redefining ERM ERM is a coordinated process for managing risk ERM is a coordinated process for managing risk  Throughout business units and departments  Across organizational, operational, and financial dimensions  Over time

4. 4 Rationale for ERM Identify risk issues early Identify risk issues early  Mitigate threats and capture opportunities Coordinate risk management efforts Coordinate risk management efforts  Conserve resources (capital and operational efficiencies) Implement best practices Implement best practices  For well-known risk issues

5. 5 Benefits of Risk and Management Risk is a byproduct of change and value Risk is a byproduct of change and value Absent risk, we can not advance our interests Absent risk, we can not advance our interests Risk management is about preparing for change Risk management is about preparing for change  Minimizing bad outcomes  Enhancing good outcomes

6. 6 Is Risk Increasing? Value Value  More people and property, better lifestyles, higher concentrations of people and goods External change External change  Technology, demographics, preferences, competition, legal and regulatory, natural hazards, markets, relations with suppliers and distributors, etc. Internal change Internal change  Management and employee turnover, strategic shifts, system implementations, organizational structures, crisis, product and service initiatives, etc. More value x more change = more risk

7. 7 Top 10 Risk/Management Issues People think risk is bad People think risk is bad Managers have different understandings of risk Managers have different understandings of risk Managers disagree about how much they can influence risk Managers disagree about how much they can influence risk Responsibility for risk management is unclear Responsibility for risk management is unclear Functional approaches do not work for important issues Functional approaches do not work for important issues Managers have different perceptions of value Managers have different perceptions of value Incentives are inconsistent with risk management strategy Incentives are inconsistent with risk management strategy Risk management is inconsistent with business objectives Risk management is inconsistent with business objectives Lack of relevant and timely information Lack of relevant and timely information Information is not shared Information is not shared

8. 8 A Portfolio Approach Involves creating a general understanding of: Involves creating a general understanding of:  A company’s resources  The business environments in which it operates  How value is created and stored  The key risk issues underlying its value propositions  How its business models are alike and dissimilar  Every important business dimension

9. 9 The Relationship Between Risk and Value Value Internal Environment Risk The relationship between the internal and external environments produces value, which in turn gives rise to risk. External Environment

10. 10 Value Value is created via: Value is created via:  Relationships  Knowledge, expertise, and technology  Scale efficiencies Value is stored: Value is stored:  Tangibly in financial and physical assets  Intangibly in relationships, knowledge, expertise, and technology

11. 11 Risk Identification Identification Understanding these relationships permits us to identify sources of potential risk. Value External Environment Internal Environment Risk

12. 12 Risk Identification Experienced-based approach Experienced-based approach  Is dependent on personal experience  Search for bad outcomes and try to identify risk drivers Environmental approach Environmental approach  Seeks to understand the business in the context of its environment  What is changing and how will it affect the business?

13. 13 The Business Environment External Indirect External Direct THE ORGANIZATION CUSTOMERS MARKETS DEMOGRAPHICS POLITICS TECHNOLOGY COMPETITORS REGULATORS SUPPLIERS CUSTOMER PREFERENCES LEGAL PHYSICAL ENVIRONMENT Internal DISTRIBUTORS

14. 14 Risk Assessment and Monitoring Value External Environment Internal Environment Risk Identification Assessment Data Analysis Management Monitoring

15. 15 Gathering and Analyzing Important Data

16. 16 Gathering and Analyzing Important Data

17. 17 Risk Management Initiatives Value External Environment Internal Environment Risk Identification Assessment Data Analysis Management Monitoring

18. 18 Realigning the Internal Environment Legal and Ownership Structure Governance and Organizational Structure OperationalFinancial Mission, Vision & Values Employment Practices and Compensation Structure EmployeesDebt and Equity Holders

19. 19 A Portfolio Approach Value External Environment Internal Environment Risk Identification Assessment Data Analysis Management Monitoring

20. 20 Risk Management Cannot be Static Most companies are only prepared for risks that have already impacted firm value. Most companies are only prepared for risks that have already impacted firm value. Insurers must: Insurers must:  Augment their experienced-based approaches with environmental models.  Change their focus from assets and liabilities to emerging issues that will create assets and liabilities –Develop strategies to mitigate potential losses –Identify new ways to create value