1. Enterprise Risk Management in the Insurance Industry July 30, 2003 Value Growth Return Consistenc y Capital

2. What is Enterprise Risk Management and why is it important to the insurance industry? Agenda Key findings of the ERM benchmarking survey Results of related interviews and other intelligence Strategic implications

3. ERM benchmarking study Why We Did it Many believe ERM holds great promise Approach to help companies achieve financial and strategic objectives But it is unclear whether: Senior managers see the value of ERM Companies are realizing the value What We Hoped to Accomplish Determine current state of ERM in insurance industry Judge relevance of ERM to broader business issues Identify current management practices Assess satisfaction with current processes, tools and techniques

4. We surveyed and interviewed leading insurance executives around the world Surveyed 66 insurance industry chief financial officers, chief actuaries and chief risk officers in major markets worldwide Geography: 60% North America, 40% rest of world Company structure: stock, mutual, other Type of operations: life insurance, property/casualty insurance, mutual funds, banking Company size: $25 million to $10 billion in direct written premiums Supplemented with in-depth interviews/company visits

5. Nearly all respondents share a basic understanding of ERM Rigorous approach to assessing and addressing risks from all sources that: Threaten strategic and financial objectives, or Represent an opportunity for competitive advantage Definition of ERM Definition Enhance enterprise value by: Improving capital efficiency Supporting strategic decision-making Building investor confidence Objective of ERM Objective

6. Here are our key findings in a nutshell Executives believe ERM is critical to helping them deal with their key business issues They are not satisfied with current tools, techniques and processes to implement ERM — especially for dealing with operational risks They want a more robust conceptual and methodological framework that: Encompasses all relevant risks — both financial and operational Integrates both financial and operational strategies to manage those risks

7. Detailed Findings

8. “Top Ten Issues Facing Insurers Today” 1.Earnings growth 2.Revenue growth 3.Return on capital 4.Expense control 5.Competition 6.Capital management and allocation 7.Earnings consistency 8.Pricing adequacy 9.Asset/liability management 10.M&A activity

9. Respondents believe that ERM will help them address their top ten business issues % of Respondents Selecting “Yes” Earnings growth Revenue growth Return on capital Expense control Competition Pricing adequacy Earnings consistency Capital management/allocation Asset/liability management M&A activity Will ERM help address the top ten issues?

10. Companies are trying to manage their most important financial and operational risks % of Respondents Actively Managing Technology Are you actively managing important risks? Interest rate Distribution channel Reputation/rating Expenses Products People/intellectual capital Asset market value Liquidity Credit Reinvestment Political/regulatory Liability Catastrophe Capital markets Currency

11. Respondents are generally satisfied with the tools they are using to manage financial risks... Interest rate How satisfied are you with your current tools to manage risk? Credit Reinvestment Asset market value Liability Liquidity Currency Capital markets MitigationRetention/transferAssessment/measurement

12. …But they are less satisfied with the tools they are using to manage operational risks Reputation/rating Products Political/regulatory Expenses Technology Catastrophe Distribution channel People/intellectual capital MitigationRetention/transferAssessment/measurement How satisfied are you with your current tools to manage risk?

13. Other key findings Very few companies have a chief risk officer (CRO), although the position is much more prevalent outside of North America Companies recognize the importance of integrating risk into their company’s strategic, operational and financial planning, but not all do so because of: Tools Organizational turf Processes Time Most companies include operational risk in the internal audit plan, but far fewer include financial risk Continued...

14. Other key findings Less than half of respondents are factoring interactions among risk sources into their: Assessment/measurement Determination of diversification benefit Mitigation/financing strategies There is a high level of dissatisfaction with respect to: Stochastically modeling the important risks Including operational risk in determining economic capital Prioritizing disparate risks using a common metric Optimizing financial and operational strategies in light of risk/reward requirements Coordinating all these activities within a coherent framework

15. Strategic Implications

16. We see several strategic implications of the study results Insurers face great uncertainty that challenges consistent high performance Investors, regulators and rating agencies are demanding consistent performance, especially earnings Insurers do not believe they have the tools to manage the risks that create the uncertainty — particularly operational risks Insurers need an industry-specific ERM

17. The study suggests an insurance-specific ERM conceptual framework ERM is a process to optimize the dynamic relationship between risk and value throughout the insurance enterprise ERM Comprises: The development, implementation and monitoring of financial and operational strategies that treat the assessment, measurement, mitigation and financing of financial and operational risks for the purpose of increasing enterprise value Enterprise Value is Driven By: Providing appropriate level, structure and allocation of capital Growing earnings and increasing return on capital Improving consistency of earnings

18. This framework can also be illustrated graphically Increase Value Holistically manage all risks Holistically manage all risks Reinsurance Capital Structure Product Mix Investment Strategy Incentive Programs Technology Internal Controls Distribution M&A Customer Service Market Strategy Hiring/Training Investigate both financial and operational strategies Pricing Dynamic Hedging Growth Return Consistency Capital Technology Expansion/ Diversificatio n People Culture Distribution Processes Risk Appetite Understand both internal and external environments Investor Expectations Economic conditions Customer Behavior Social/Legal Trends Political/Regulatory Climate Competition Natural Catastrophes Financial Risk Operational Risk Exploit natural hedges and portfolio effects Exploit natural hedges and portfolio effects

19. The framework must recognize the unique nature of insurance operations ERM for insurers and ERM for other financial services companies have some similarities — and some fundamental differences Single-period value-at-risk approaches are not sufficient for insurance enterprises Statistical approaches do not capture causal relationships Structural simulation models are needed to anticipate the complex interrelationships among risks in dynamic environments

20. The right framework can yield the results that insurers want but say they aren’t getting The Right ERM Framework Can Help Insurers: Determine necessary capital level and structure, efficient deployment of capital and improved return on capital Properly allocate capital to business segments, supporting performance tracking Ensure that owners receive proper compensation for risks they assume Determine the optimal risk financing strategy And It Can Provide: Stability in earnings Improved information

21. In summary... Insurance executives believe ERM is critical to helping them deal with their top business issues They are not satisfied with the current tools, techniques and processes they are using to implement ERM They want a more robust conceptual framework and methodology that is unique to their industry Analysis of survey results and interviews suggests what that framework would look like — and that it would deliver on the promise of ERM for insurers