September 2011

Greetings!

The September edition of Insurance Perspectives discusses a range of topics that continue to move along the regulatory continuum to impact the industry as a whole. These include increased expectations and requirements relating to risk management for insurers and the PCAOB’s concept release on audit firm rotation. In addition, we highlight upcoming Invotex speaking engagements at industry conferences.

As always, we welcome your feedback and invite you to share Insurance Perspectives with your colleagues and business acquaintances. If you do not currently receive our newsletter via e-mail, please subscribe at the left.

Tom Finnell, Les Schott and Jim Stangroom
Managing Directors, Insurance Services

In this Issue

1. Risk Management and ORSA – Comments Flood In
2. PCAOB Issues Concept Release on Mandatory Audit Firm Rotation
3. New York Sets Risk Management Expectations for All NY-Domiciled Insurers
4. Upcoming Invotex Speaking Engagements

Risk Management and ORSA – Comments Flood In
by Tom Finnell

The NAIC’s efforts to move forward quickly with a proposed requirement for an “Own Risk and Solvency Assessment,” or “ORSA,” has reached an ironic crossroad. The NAIC and its members want ORSA, and the industry supports that, but there remains little clarity or consensus as to what an ORSA really is, what regulators would do with it or how it would be used in the grand regulatory scheme of things.

It is perhaps the lack of clarity as to purpose that best explains how a five-page concept paper that was brought forward early this year by the NAIC has morphed into a 10-page draft manual that, in turn, has now resulted in 130 pages of comments from industry trade groups and others. Invotex has combed through those letters to cull a list of current insights on the key issues presented. We then offer our own views about ORSA , the way forward and potential implications to regulators and to the industry.

Our “Top 10” list of industry comments about the NAIC’s proposed ORSA manual is as follows:

1. Be clear about what ORSA is and what it is not. It is an insurer’s own internal process that benefits managerial decision making, not a regulatory report, filing or other description of that process. Nor is ORSA the same as enterprise risk management (ERM); however, it is part of ERM. And the importance of “own” cannot be overemphasized; the company should do what it thinks is appropriate for its ORSA, unbridled by prescriptive regulatory requirements. That includes whether the insurer chooses to perform its ORSA on a legal entity or group basis.
2. Regulators should have access to and be informed about an insurer’s ORSA process. However, the insurer should have discretion as to the form, content, timing and frequency of that access so that the information conveyed is as much as possible a natural byproduct of their ORSA process.
3. Expect variations in approaches from one insurer to the next. Because ORSA is a company-specific process, it will inherently vary from one company or group to another. Variation is a good thing; it means insurers are considering their unique business, operations and financial and risk profiles. Don’t prescribe otherwise.
4. Slow down. The schedule put forth by the NAIC’s Group Solvency Working Group is too ambitious, perhaps driven in large measure by pressure from international influences, e.g., the International Association of Insurance Supervisor’s Insurance Core Principle (ICP) 16 and the next Financial Sector Assessment Program (FSAP) review of the U.S. insurance sector which is looming on the horizon. However, we won’t reach that horizon until 2015, and the guidance in ICP 16 is intended to be aspirational rather than mandatory at this time. Take time to get it right. Perhaps start with a pilot program, learn and amend, and go from there.
5. Don’t create a new regulatory initiative. ORSA fits well within the existing Risk-Focused Framework, and the risk-focused examination and financial analyses processes and resources are in place. With some additional guidance and training, they can be the access to ORSA that regulators seek. Moreover, with access by examiners in the field, they can ask questions real-time for a better understanding of the ORSA process that is in place at a particular company.
6. Be flexible as to risk measurement. Economic capital is a relatively new concept with different views about how it should be determined. Also, it is not a concept that currently exists within the state-based regime of regulation in the U.S. It is part of Solvency II in Europe where it dovetails with other requirements pertaining to capital levels – but we don’t have that in the U.S., nor is Solvency II itself yet required in Europe. Allow U.S. insurers ample flexibility as they implement the measures they think are most appropriate in their situations.
7. Provide insurers some regulatory relief if they meet your expectations. If an insurer has an ORSA process in place, makes it and information about it accessible to its domestic state insurance department and receives a favorable review, then cut the insurer some slack. For example, lighten up on the frequency or the extent of the financial examination process.
8. Regulators, coordinate thyselves. Regulators need to review an insurer’s ORSA in a coordinated way that eliminates duplicative reviews by multiple states or by other countries. The lead state regulator needs to step up to lead that effort. And eliminate state-by-state variations in ORSA requirements.
9. Decide how ORSA-based information will be used. Regulators should consider and reach consensus as to what they would do with information about an insurer’s ORSA. How would it be used? What actions might result? What implications might that have? Only with such information can it be determined if the proposed manual is on target or not.
10. Confidentiality is critical. Make sure that what happens in Las Vegas Insurance Company’s ORSA stays in Las Vegas Insurance Company (and with the state).

While the foregoing “Top 10” list may appear foreboding, the working group and industry representatives are actually in sync on most of these issues. The dialogue has been informative and constructive. The problem is that the draft document in its current form has yet to be reconciled and updated to match the tenor of that dialogue.

Our view is that the working group is proceeding well and in a carefully measured manner that not only considers, but also appreciates, the input of the industry. This will take longer than the published schedule suggests. We doubt that industry will have its way on every point, but the body language in meetings suggests that the working group empathizes with many of these points and that the next version will be better and much closer to the mark.

As to potential implications of ORSA down the road, we offer up the following:

• For regulators: Resources will likely become an issue, and training alone probably can’t be the only answer. The people that insurers are engaging in their ERM and ORSA processes have special skills, credentials, training and experience, and what they deal with is often very complex. Some states do have specialized resources on staff who can talk the talk with risk managers in industry, but more will be needed.
  
  Another issue for regulators is that financial examinations have largely moved away from the testing of balances to the assessment of risk and the testing of controls that mitigate risk. ORSA is a further extension of that trend that helps regulators understand prospective risks and how prepared an insurer is to handle those risks if and when they manifest themselves. But it is information for which regulators may lack the expertise to do anything other than to accept at face value. For example, an insurer’s calculation of economic capital is not something that is easily subjected to independent testing. That will take some getting used to.
  
  
• For the industry: Although the battle may yet be won to keep the ORSA requirement non-prescriptive, once information starts flowing, someone on the regulatory side of the fence may look across that information as it pertains to a number of insurers and begin to ponder which risk management practices are better or best? That, in turn, will beget further thought about making those better/best practices more prevalent throughout the industry – perhaps by prescription. So allowing more flexibility through the language in the proposed ORSA manual may provide comfort to some today, but at some point down the road the notion of additional requirements may rise again. And whether that occurs as part of another NAIC model, statute or regulation or is handled behind the scenes as part of an exam or review process on a company-by-company basis, many insurers will likely feel the pressure to raise the bar with regard to their ERM efforts.

The working group has a busy schedule of calls beginning in October leading up to the NAIC’s Fall National Meeting in early November outside of Washington DC. We’ll stay in tuned and keep our readers informed as the ORSA draft manual continues its path to the goal line.

For more information, contact Tom Finnell.

Back to top.

PCAOB Issues Concept Release on Mandatory Audit Firm Rotation
by Jim Stangroom

The Public Company Accounting Oversight Board (PCAOB) issued a Concept Release on August 16, 2011 soliciting public comment on the pros and cons of mandatory audit firm rotation and whether such a practice would enhance auditor independence. As part of its continuous public accounting firm inspection process, the PCAOB has identified numerous instances where auditors apparently approached at least some aspect of an audit with a lack of independence, objectivity and professional skepticism. As a result, the PCAOB is considering whether a fundamental shift is needed to change the way auditors view their client relationships. This marks the PCAOB’s second Concept Release within the past few months; an earlier Concept Release issued in June 2011 described possible changes to the standard auditor’s opinion language and was the subject of an article in the July edition of Insurance Perspectives.

Public accounting firms are again expressing resistance to the notion of mandatory audit firm rotation by pointing to the potential for increased costs to companies, greater disruption of management time and diminished audit quality. For example, insurance companies and others in specialized industries are best served by accounting firms with specialized knowledge of those industries; mandatory rotation could lessen the incentive for public accounting firms to train, develop and retain such industry specialists.

Over the past eight years, the PCAOB has inspected more than 2,800 audit firm engagements and analyzed hundreds of cases deemed by the PCAOB to be audit failures. The Concept Release acknowledges that not all audit failures are caused by a lack of objectivity or professional skepticism; some could be caused by a lack of technical competence or experience. The Release goes on to describe the general nature of various inspection findings where a lack of objectivity and professional skepticism may be a root cause. The Release cites examples where, in the PCAOB’s view, auditors placed too much reliance on management’s representations or showed a bias towards accepting management’s perspective and did not sufficiently challenge management.

A PCAOB press release attributed Chairman James R. Doty as stating that any serious discussion of auditor independence, skepticism and objectivity “…must take into account the fundamental conflict of the audit client paying the auditor." He further stated that audit firm rotation and term limits should be considered because “…they may reduce the pressure auditors face to develop and protect long-term client relationships to the detriment of investors and our capital markets." The release indicates that the average auditor tenure for the largest 100 public companies is 28 years and for the largest 500 companies is 21 years. With these facts in mind, the PCAOB is requesting comment on the advantages and disadvantages of terms of 10 years or more.

The Concept Release spends several pages pointing out that the issue of mandatory audit firm rotation has been discussed by U.S and European regulators since the 1970s. The Release concludes by stating that the time has come to again explore mandatory auditor rotation and asking for public comments on eight general issues and 21 specific questions. The issues and questions raised in the Release include:

• Whether audit firm rotation would enhance auditor independence, objectivity and professional skepticism.
• Whether the current model whereby the auditor is paid by its client causes inherent conflicts that are not adequately mitigated by existing regulations and professional standards.
• What effect a rotation requirement would have on audit costs.
• How auditor effectiveness may vary over a firm’s tenure and how to determine an appropriate term length.
• Whether rotation should apply to all SEC registrants or to only the largest subset.
• Whether rotation would cause some smaller audit firms to exit the public company audit market and limit a company’s choice of auditor.
• What effect rotation might have on the capacity of firms to assign qualified staff to new engagements.

The PCAOB has requested comments on the Concept Release by December 14, 2011 and will hold a public “roundtable” meeting in March 2012 to discuss the topics of auditor independence and mandatory firm rotation. As often occurs, once something is adopted by the PCAOB or SEC, it trickles down to private companies. For example, SOX for public companies evolved into the Annual Financial Reporting Model Regulation for insurance companies. Therefore, we encourage all insurance company finance and accounting professionals to stay abreast of the PCAOB deliberations on the issues of auditor independence and mandatory firm rotation.

For more information, contact Jim Stangroom.

Back to top.

New York Sets Risk Management Expectations for All NY-Domiciled Insurers
by Tom Finnell

While the NAIC is still working on its proposal that larger insurers have an Own Risk and Self Assessment (ORSA) process in place, the New York Insurance Department has proposed that all of its domestic insurers go a step further and have a formal risk management function in place of which ORSA would be just one component. The proposal is in the form of a draft circular letter released in late July which states that, “an effective ERM function should be able to identify, measure, aggregate, and manage risk exposures within predetermined tolerance levels, across all activities of the insurer or group of insurers.”

According to Tim Nauheimer, Chief Risk Management Specialist for the New York Insurance Department’s Capital Markets Bureau, industry comments about the draft circular letter are currently being reviewed with the hope of issuing a final letter near the end of the month. Mr. Nauheimer said that the Department’s goal for the circular letter is to outline its expectations of domestic insurers and their evolving ERM practices and to do so in a manner that would be consistent with the ORSA initiative currently underway at the NAIC.

The proposal indicates that as part of its ERM reviews the Department will look for the following to be in place at an insurer:

• An objective ERM function.
• Qualified and competent leadership and staff within the ERM unit.
• The ability to provide ongoing assessments of the insurer’s risk profile.
• Proportionality, i.e., an ERM function that is appropriate for the nature, scale and complexity of the risks undertaken by the insurer.
• A written risk policy covering the risk/reward framework, risk tolerance levels and risk limits.
• The identification and quantification of risk under a sufficiently wide range of outcomes using techniques that are appropriate to the nature, scale and complexity of the risks the insurer bears and adequate for capital management and solvency purposes.
• Adequate supporting documentation with detailed descriptions and explanations of risks identified, the measurement approaches used, key assumptions made and outcomes of any plausible adverse scenarios that were run.
• Scenario and stress testing providing the immediate and prospective impacts.
• The incorporation of risk tolerance levels and limits in the insurer’s policies and procedures, business strategy and day-today strategic decision-making processes.
• Risk and capital management processes in place to monitor the level of financial resources relative to its economic capital and the regulatory capital requirements.
• The use of investment policy, asset-liability management policy, effective controls on internal models, longer term continuity analysis and feedback loops to constantly update and improve ERM.
• With respect to an ORSA, the proposal indicates that insurers should “begin to contemplate” performing an ORSA as part of its ERM on a regular basis and to share the results of the assessment with senior management and its board of directors.
• Consideration of group risks, including reputational risk, that may arise by virtue of being part of a holding company, consolidated enterprise, conglomerate or other group.

The draft Circular Letter indicates that an insurer’s risk management process would be reviewed as part of the risk-focused examination process or as part of a stand-alone effort. In that regard, the New York Insurance Department is perhaps unique as compared to other state insurance departments because of the specialized resources in its Capital Markets Bureau with prior work experience in investment banking, derivatives usage and related disciplines.

For more information, contact Tom Finnell.

Back to top.

Upcoming Speaking Engagements

Back to top.