Enterprise Risk Management in the Insurance Industry

1. Enterprise Risk Management in the Insurance Industry July 30, 2003 Value Growth Return Consistency Capital

2. What is Enterprise Risk Management and why is it important to the insurance industry? Agenda • Key findings of the ERM benchmarking survey • Results of related interviews and other intelligence • Strategic implications

3. Why We Did it Many believe ERM holds great promise Approach to help companies achieve financial and strategic objectives But it is unclear whether: Senior managers see the value of ERM Companies are realizing the value What We Hoped to Accomplish Determine current state of ERM in insurance industry Judge relevance of ERM to broader business issues Identify current management practices Assess satisfaction with current processes, tools and techniques ERM benchmarking study

4. We surveyed and interviewed leading insurance executives around the world • Surveyed 66 insurance industry chief financial officers, chief actuaries and chief risk officers in major markets worldwide • Geography: 60% North America, 40% rest of world • Company structure: stock, mutual, other • Type of operations: life insurance, property/casualty insurance, mutual funds, banking • Company size: $25 million to $10 billion in direct written premiums • Supplemented with in-depth interviews/company visits

5. Nearly all respondents share a basic understanding of ERM • Rigorous approach to assessing and addressing risks from all sources that: • Threaten strategic and financial objectives, or • Represent an opportunity for competitive advantage Definition of ERM • Enhance enterprise value by: • Improving capital efficiency • Supporting strategic decision-making • Building investor confidence Objective of ERM

6. Here are our key findings in a nutshell • Executives believe ERM is critical to helping them deal with their key business issues • They are not satisfied with current tools, techniques and processes to implement ERM — especially for dealing with operational risks • They want a more robust conceptual and methodological framework that: • Encompasses all relevant risks — both financial and operational • Integrates both financial and operational strategies to manage those risks

7. Detailed Findings

8. “Top Ten Issues Facing Insurers Today” 1. Earnings growth 2. Revenue growth 3. Return on capital 4. Expense control 5. Competition 6. Capital management and allocation 7. Earnings consistency 8. Pricing adequacy 9. Asset/liability management 10. M&A activity

9. Earnings growth Revenue growth Return on capital Expense control Competition Capital management/allocation Earnings consistency Pricing adequacy Asset/liability management M&A activity Respondents believe that ERM will help them address their top ten business issues Will ERM help address the top ten issues? % of Respondents Selecting “Yes”

10. Companies are trying to manage their most important financial and operational risks Are you actively managing important risks? Technology Interest rate Distribution channel Reputation/rating Expenses Products People/intellectual capital Asset market value Liquidity Credit Reinvestment Political/regulatory Liability Catastrophe Capital markets Currency % of Respondents Actively Managing

11. Assessment/measurement Respondents are generally satisfied with the tools they are using to manage financial risks... How satisfied are you with your current tools to manage risk? Interest rate Credit Reinvestment Asset market value Liability Liquidity Currency Capital markets Mitigation Retention/transfer

12. Assessment/measurement …But they are less satisfied with the tools they are using to manage operational risks How satisfied are you with your current tools to manage risk? Reputation/rating Products Political/regulatory Expenses Technology Catastrophe Distribution channel People/intellectual capital Mitigation Retention/transfer

13. Other key findings • Very few companies have a chief risk officer (CRO), although the position is much more prevalent outside of North America • Companies recognize the importance of integrating risk into their company’s strategic, operational and financial planning, but not all do so because of: • Tools • Organizational turf • Processes • Time • Most companies include operational risk in the internal audit plan, but far fewer include financial risk Continued . . .

14. Other key findings • Less than half of respondents are factoring interactions among risk sources into their: • Assessment/measurement • Determination of diversification benefit • Mitigation/financing strategies • There is a high level of dissatisfaction with respect to: • Stochastically modeling the important risks • Including operational risk in determining economic capital • Prioritizing disparate risks using a common metric • Optimizing financial and operational strategies in light of risk/reward requirements • Coordinating all these activities within a coherent framework

15. Strategic Implications

16. We see several strategic implications of the study results • Insurers face great uncertainty that challenges consistent high performance • Investors, regulators and rating agencies are demanding consistent performance, especially earnings • Insurers do not believe they have the tools to manage the risks that create the uncertainty — particularly operational risks • Insurers need an industry-specific ERM

17. The study suggests an insurance-specific ERM conceptual framework ERM is a process to optimize the dynamic relationship between risk and value throughout the insurance enterprise Enterprise Value is Driven By: • Providing appropriate level, structure and allocation of capital • Growing earnings and increasing return on capital • Improving consistency of earnings ERM Comprises: • The development, implementation and monitoring of financial and operational strategies that treat the assessment, measurement, mitigation and financing of financial and operational risks for the purpose of increasing enterprise value

18. Increase Value Holistically manage all risks Investigate both financial and operational strategies Understand both internal and external environments M&A Expansion/Diversification Economicconditions Capital Structure Financial Risk Technology Social/LegalTrends Culture Investment Strategy Internal Controls Political/Regulatory Climate Distribution Pricing Incentive Programs Natural Catastrophes Risk Appetite Hiring/Training Product Mix Customer Behavior People Customer Service Dynamic Hedging Competition Processes Market Strategy Operational Risk Reinsurance Investor Expectations Technology Distribution This framework can also be illustrated graphically Return Growth Consistency Capital Exploit natural hedges and portfolio effects

19. The framework must recognize the unique nature of insurance operations • ERM for insurers and ERM for other financial services companies have some similarities — and some fundamental differences • Single-period value-at-risk approaches are not sufficient for insurance enterprises • Statistical approaches do not capture causal relationships • Structural simulation models are needed to anticipate the complex interrelationships among risks in dynamic environments

20. The right framework can yield the results that insurers want but say they aren’t getting The Right ERM Framework Can Help Insurers: • Determine necessary capital level and structure, efficient deployment of capital and improved return on capital • Properly allocate capital to business segments, supporting performance tracking • Ensure that owners receive proper compensation for risks they assume • Determine the optimal risk financing strategy And It Can Provide: • Stability in earnings • Improved information

21. In summary... • Insurance executives believe ERM is critical to helping them deal with their top business issues • They are not satisfied with the current tools, techniques and processes they are using to implement ERM • They want a more robust conceptual framework and methodology that is unique to their industry • Analysis of survey results and interviews suggests what that framework would look like — and that it would deliver on the promise of ERM for insurers