The following article on risk management by Lloyd's Chairman Lord Levene appeared in the Financial Times on Tuesday, October 17.
Every business takes risks, and in today’s world those risks simply must be well managed to ensure success. Everyone involved, from the coal face to the board room, has to understand the risks they face, know their limits, and be prepared in case things go wrong.
But risk management is not simply about preparing for the worst. It’s also about realising your full potential. With a clear understanding of the risks they face, businesses can maximise their performance and drive forward their competitive advantage.
Yet research carried out by Lloyd’s last year showed that not enough is being done on this by businesses across the world. This has to change. Lloyd’s is the world’s leading, specialist insurance market, and as such, risk-taking lies at the heart of what our underwriters do. We therefore see risk management as a key priority, enabling us to take on the world’s toughest risks, and I want to share just some of the work that we are doing on this crucial area.
Effective risk management ensures that a good understanding of risk is backed up by the right appetite, capacity, and controls. In today’s increasingly risky world, and particularly in the insurance industry, I just don’t see how any business can survive without it. It separates those who are educated, careful risk takers, from those who are simply gamblers.
It gives insurers the means to optimise their portfolios of both written and emerging risks, such as climate change. It can be a real boost to the amount of capital they need to cover a risk, and a great way to increase their all important rating, as the rating agencies start to factor it into their assessments of firms. This year, Standard & Poor's started evaluating the Enterprise Risk Management (ERM) practices of insurance companies as part of their overall rating assessment, and others are likely to follow.
But despite its importance, and its benefits, not every firm is doing what it should be. Last year, Lloyd’s teamed up with the Economist Intelligence Unit and carried out some extensive research on risk management, speaking to more than 100 business leaders throughout the world. Encouragingly, the research found that the amount of time spent on risk management in the board room had risen four-fold in just three years. But it also found that:
- over half of companies had at least one ‘near miss’;
- one in three companies suffered significant damage as a result of failure to manage risk; and
- although company boards were assessing a wider range of risks in the light of corporate scandals and regulatory intervention, they were ignoring other headline risks such as terrorism and the weather. In fact, despite last year’s terrorist attacks, less than half of companies reassessed their risk management strategies. For natural hazards, it was less than a quarter.
This all presents a clear message – improvements have been made, but businesses need to do more to understand the risks they face and put risk management at the top of their agenda.
At Lloyd’s, with over 60 businesses covering risks of various shapes and sizes, a good risk management framework is essential. So what levels of risk management do we expect from the businesses that trade here?
The answer lies in a clear set of minimum standards and guidance for the market that we published earlier this year. The standards set out the minimum level to which each Lloyd’s firm is expected to perform, and set a benchmark for them to meet or exceed. They cover three aspects of the market’s operations – risk management, underwriting, and claims.
The risk management standards look to ensure that the market has sound systems in place to manage risk. They cover all aspects of risk management - risk governance, the processes used, and the implications for capital setting.
For example, through those standards, we make clear that we want firms to have a good risk management policy in place - independently checked and challenged - for each risk category. We want accountable ‘risk owners’ in each firm who monitor specific risks for changes in impact or likelihood. We want sufficiently detailed and appropriate information shared with all levels of management, from business unit heads to the board, and we want risk management directly linked to the business planning process.
But as well as being thorough, it’s important to note that the minimum standards are just that - minimum expectations. They set a performance floor, not a ceiling. Lloyd’s will require all firms to meet the standards at the very least, but we also encourage them to go further and perform at the highest levels possible. Consistently good performance against the benchmark will be recognised through capital requirements. After all, if two firms write the same mix of business, you would expect the one with weaker risk management to need more capital.
The standards for claims and underwriting are equally thorough, ensuring a certain level of performance across the market. This is not a case of ‘micro management’. We are making performance expectations clearer, and acting as a business partner, providing support and help when and where needed. It is for each firm to decide how they meet the standards.
Another good example of risk management at Lloyd’s is our Realistic Disaster Scenarios (RDS), where we stress-test the market for large loss events like hurricanes or earthquakes. These have proved an extremely useful tool in monitoring aggregate risk across the market and ensuring that it isn’t over exposed. In recent years, we have done a lot to further develop and improve them, making them more realistic and more in tune with the world around us.
The value of doing this has been clear. In 2005, we introduced an RDS for a $60bn hurricane hitting the Gulf of Mexico. Some thought that was too big a number, but Hurricane Katrina proved that such a catastrophe was quite possible. It is clear that, without this RDS, the market’s ability to come through last year’s record storms with only a small loss would have been in jeopardy.
So this year, we have increased the scope of the RDS once again, asking the market to model for a $100bn hurricane. There is no point testing the market’s ability to withstand a disaster unless you truly stretch it.
But it isn’t all just about hurricanes in the US. We have scenarios covering a range of different risks throughout the world, including two ships colliding in Alaska, two planes colliding above a major city, and a Japanese earthquake. As insurers, it is our job to fear the worst, and to prepare for it.
As I have said, risk-taking lies at the very heart of Lloyd’s, but so does risk management. In today’s world, you cannot have one without the other. As well as mitigating risk, it helps our businesses to perform to their full potential. With a good risk management framework in place, risk need not be risky.
