OPERATIONAL RISK: THE CASE FOR BALLOONING BASEL II TO THE INSURANCE INDUSTRY

GLOBAL ASSOCIATION OF RISK PROFESSIONALS40 SEPTEMBER/OCTOBER 05 I SSUE 26

Although Basel II was conceived primarily forbanks, it would make sense to extend the oper-ational risk component of the global capitalaccord to insurance companies. Unfortunately,insurers do not have to comply with Basel II.Therefore, unlike banks, they do not have to

adhere to the accord’s requirements for measuring opera-tional risk capital.

Outside of the insurance industry, operational failures

have resulted in big losses over the past few years, forcingregulators, rating agencies and investors to focus more oftheir attention on the evolving discipline of operational risk.But operational risk exposures are far from unique to banks.

Insurers, in fact, have to contend with a variety of opera-tional incidents on a regular basis, including events relatedto the products and services they market; external andinternal fraud; losses related to mistakes; and errors frominternal processes that support claims and underwriting

As of today, insurance companies do not have to comply with Basel II and are therefore not required to calculate a capital charge foroperational risk. But large insurers and major international banks (which have to comply with the capital accord) face similar opera-tional risk exposures. Using the insurance firm AIG as an example, Michel Rochette argues for an expansion of Basel II and ques-tions whether insurers are doing enough to adequately measure and manage operational risk in comparison to banks.

Operational Risk:Making a Case for Ballooning Basel II to the Insurance Industry

GLOB AL ASSOCIAT ION OF R I SK PROFESS IONALS

I N S U R A N C E R I S K

Changed with the DEMO VERSION of CAD-KAS PDF-Editor (http://www.cadkas.com).







GLOBAL ASSOCIATION OF RISK PROFESSIONALS 41SEPTEMBER/OCTOBER 05 I SSUE 26

functions. What’s more, insurers are subject to externalevents beyond their control (like terrorism) and also facelegal liabilities such as class-action lawsuits.

Fortunately, there is a possible solution for ameliorat-ing this widespread operational risk: expanding Basel IIto the insurance industry. The capital accord, scheduledto launch in early 2007, will require banks and otherfinancial institutions complying with its rules to calculatea charge for operational risk for the very first time; theidea, in part, is to force banks to better align their capitalwith their risks.

Lamentably, in addition to the current lack of strictrules governing operational risk in the insurance indus-try, many insurers simply refuse to dedicate the resourcesnecessary to measure and manage operational risk; thisproblem becomes particularly evident when one exam-ines the resources the average large insurer allocates toother types of risk.

AIG: An Interesting ExampleJust as they have impacted banks, operational losses havehappened and are happening in the insurance community.Since there is no question that these types of incidents willhappen in the future, operational risk management mustbe factored into the costs of doing business in the insur-ance industry.

Today, it is likely that no otherinsurer knows more about opera-tional risk and its ramifications thanAIG. In the remainder of this article,we’ll examine the operational risktechniques used by AIG in compari-son to the tools and strategiesemployed by a few well-known inter-national banks.

If you want to assess operationalrisk exposure and the capitalrequired for a large and diversifiedinsurance company, AIG provides avery good case study. Detailedinformation about AIG’s opera-tional losses can be found in thecompany’s recent 10K filing with the Securities andExchange Commission, as well as in the company’s ownfinancial statements.

Most of the operational risk incidents reported in theSEC filings were large and could be classified as unex-pected. In lay terms, an unexpected incident is an inci-dent where the probability of occurrence is low but thepotential operational and financial impact is major. Sincefirms want to hedge against this type of loss, unexpectedincidents play a big role in a company’s operational risk

capital calculation.

Measuring Up to BanksThe Basel Committee on Banking Supervision defines oper-ational risk as follows: “the risk of direct and indirect lossfrom inadequate or failed internal processes, people andsystems or from external events.” This definition includeslegal risk but excludes strategic and reputational risk.

Large international banks are now using Basel II defini-tions for operational, credit and market risk to calculatethe capital that they need to allocate to these different risksectors. Like banks, insurers must contend with all of theaforementioned risks — but must also measure and man-age risks tied to their underwriting businesses.

Many of AIG’s business units could be easily mapped tothe eight lines of business identified in Basel II. Moreover,though AIG is an international insurer, its assets are com-parable to the assets of large banks.

Citigroup, Bank of America and JPMorgan Chase areamong the major US financial institutions that are compa-rable to AIG — in terms of the diversity of their businesslines and products, their size and their international reach.

To advance the argument for expanding Basel II to theinsurance industry, let’s take a quick look at the assets andcapital requirements of these banks.

The table above tells us that a bank that uses theadvanced measurement approach for operational riskwould have a lower economic capital requirement than abank that uses the basic indicator approach; this interestingfact seems to indicate that regulators recognize the effec-tiveness of the risk controls within banks that use theadvanced measurement approach.

Similar calculations were performed for AIG, and theresults are summarized in the table on pg. 43. What do welearn when we analyze regulator capital, economic capital









GLOBAL ASSOCIATION OF RISK PROFESSIONALS 43SEPTEMBER/OCTOBER 05 I SSUE 26

and Basel II operational risk measurement approaches forbanks versus AIG?

Well, for one thing, AIG, unlike the banks, would needmore economic capital for operational risk if it were to usethe advanced measurement approach; this probably reflectsthe fact that the risk control environment at the banks ismore effective than the same environment at AIG. Thetables also tell us that AIG’s operational risk economic cap-ital/total assets ratio would be slightly higher (0.675% ver-sus 0.47%) than that of the banks.

In the US, the existing regulatory frame-work for insurers is the result of a risk-based capital formula developed by theNational Association of InsuranceCommissioners (NAIC). The NAIC’s rulescontain specific capital requirements forbusiness risk. Operational and strategicincidents are among the types of “busi-ness” risk covered by these requirements.

In the case of AIG, the capital requiredto cover the insurer’s business risk wouldbe roughly $561 million — or about 10%of the economic capital AIG would berequired to allocate to operational riskunder Basel II. This certainly seems to indi-cate that the capital required for opera-tional risk under the NAIC’s regulatoryframework for insurers is very insufficient.

Operational Incidents: Strategic and Reputational ImpactThe need for stricter regulations governing operational riskin the insurance industry can also be seen when we ponder

the operational incidents that have recently swept throughAIG. The table below summarizes the financial and strate-gic impact of recent operational failures experienced by theinsurer.

The incidents cited in this table have already led to areduction in business submitted by AIG’s independent dis-tributors and could lead to further problems in the future.This is part of the reason why it is so important for theinsurance industry to adopt Basel II.

The current regulatory framework in the US doesn’toblige insurance firms to be as proactive asbanks in measuring and reporting operationalrisk capital. However, if one uses $100 billion inassets as the minimum level at which financialinstitutions should assess and manage opera-tional risk, about 10 major insurers should cur-rently be obliged to have a minimum capitallevel (à la Basel II) that protects firms andinvestors against the potential fallout of majoroperational risk incidents.

A recent study by the Wharton School ofEconomics revealed that operational risk inci-dents have a larger market-value impact oninsurance companies than on other financial

institutions, due in part to the longer-term nature of theinsurance business. So it’s vital for the insurance industry toadopt regulations that require larger insurers, like AIG, toset aside the necessary capital and to implement effectivesystems and strategies for managing operational risk. ■


✎ MICHEL ROCHETTE is an operational risk advisor at Enterprise Risk Advisory,an erm research, advisory and training firm. Michel Rochette,can be reached at [email protected]

The opinions expressed in this article are solely those of the author and do not necessarily reflect the views of GARP.

⌰〰䌣〰と⌰〰愣〰の⌰〰朣〰づ⌰〰搣〰〠⌰〰眣〰ど⌰〰琣〰と⌰〰‣〰ぴ⌰〰栣〰づ⌰〰‣〰い⌰〰䔣〰き⌰〰伣〰〠⌰〰嘣〰ぅ⌰〰刣〰こ⌰〰䤣〰く⌰〰丣〰〠⌰〰漣〰て⌰〰‣〰ぃ⌰〰䄣〰い⌰〰ⴣ〰か⌰〰䄣〰こ⌰〰‣〰ぐ⌰〰䐣〰う⌰〰ⴣ〰ぅ⌰〰搣〰ど⌰〰琣〰は⌰〰爣〰〠⌰〰⠣〰と⌰〰琣〰ぴ⌰〰瀣〰〺⌰〰⼣〰〯⌰〰眣〰ぷ⌰〰眣〰〮⌰〰挣〰ち⌰〰搣〰に⌰〰愣〰び⌰〰⸣〰っ⌰〰漣〰ね⌰〰⤣〰〮






Documents

OPERATIONAL RISK: THE CASE FOR BALLOONING BASEL II TO THE INSURANCE INDUSTRY