Have you recently seen one of the many discussions about Enterprise Risk Management and wondered what it is? Do you wonder how this topic applies to actuarial science?

From the CAS Committee on Enterprise Risk Management, Enterprise Risk Management (ERM) is defined as "the discipline by which an organization in any industry assesses, controls, exploits, finances, and monitors risks from all sources for the purpose of increasing the organization's short- and long-term value to its stakeholders."

As taken from the CAS Overview of Enterprise Risk Management, there are several key points to consider, based on this definition:

• ERM is a discipline. It becomes part of the culture and is key to top-down corporate decisions.
• ERM applies to all industries (it is not unique to insurance). In fact, ERM became quite prevalent in the banking industry back in the late '90s.
• ERM purposes to consider risk for value creation and not just risk-mitigation. Entities that are better equipped to understand certain risks can bear more of these risks to create both short- and long-term value.
• ERM should consider all sources of risk.
• ERM involves all stakeholders in its process (from shareholders and debtholders to employees, officers, customers, and the community).

Donald F. Mango, CAS Board of Directors and the CAS ERM Program Committee

I recently sat down with Donald F. Mango (Fellow of the CAS and member of the CAS Board of Directors and the CAS ERM Program Committee) to discuss ERM and its application in current actuarial science.

Why do you think actuaries are leading candidates for practicing ERM?
DM: Actuaries are risk analytics professionals already. Their traditional roles are essential parts of ERM for insurers. They have a reserved regulatory reporting role subject to organizational tension and conflict, which appears to be similar to risk management roles in other industries. They have a strong professional society with ethical standards and discipline.

Is ERM mainly intended for operational risk, or are there other uses for it?
DM: Operational risk is the risk due to failures in processes, systems, people, or (natural) hazards. This is just one band in the ERM spectrum. Some other major bands include market (fluctuation in market value of held assets), credit (failure of a counterparty to deliver on a promised payment), strategic (interaction effects resulting from multiple participants in competition), and underwriting (all the risks associated with underwriting an insurance portfolio).

What types of data are needed/helpful for ERM work?
DM: The core elements of traditional actuarial work-exposures, perils, frequency, severity, and aggregation-are also essential to ERM work. In fact, best practice in operational risk modeling is gravitating towards an actuarial model. The same data elements are needed: loss histories, exposure measures, and correlation estimates. The end product is the same as well-cost forecasting models.

Many of the discussions relating to ERM focus on security and derivative analysis. Why should security and derivative analysis concern a P&C actuary?
DM: Insurance contracts are derivatives-long-dated, illiquid, over-the-counter derivatives-on untraded underlying elements (for example, you cannot look up whether or not you had an accident on a Bloomberg terminal). That places insurance pricing and valuation at one end of a complete spectrum. Alongside it are other illiquid securities: real estate, private equity, hedge funds, and exotic options. At the other end are standardized, liquid, exchange-traded securities-publicly traded equity, debt, and standardized derivatives. So the pricing and valuation techniques are probably variations on a single, unified theory of risk. Actuaries have to do their part by learning the language, theory, and methods of the financial mathematicians. But both sides acknowledge the need to converge. Note: Derivative security pricing is a topic covered on CAS Exam 8: Investments and Financial Analysis.

How is ERM different than normal actuarial and insurance practices?
DM: It's not! "Normal" actuarial practices are integral parts of ERM for insurers. Arguably the largest risks facing an insurer are: (1.) do we have enough set aside to cover promises we've already made?, (2.) how much should we be charging for new promises?, and (3.) can we survive if something really bad happens? These are valuation, pricing, and capital adequacy, all areas where actuaries play a leading role.

Where do you think ERM can have the most impact to a P&C actuary?
DM: (ERM can show P&C actuaries) where their work fits into the big picture of sound management of their companies.

How prevalent is ERM in most life insurance companies? P&C insurance companies?
DM: To varying degrees in all companies. Life insurers have valuation, asset-liability management or ALM, market risk and credit risk functions. P&C insurers all have underwriting letters of authority, catastrophe management, reserving, etc. Most do not have a comprehensive ERM framework or "risk office" within the company yet.

Where do you see ERM in five years?
DM: I would hope we are well on the road towards having a true risk analytics profession that serves all industries, with a solid academic base and regulatory recognition. The actuarial profession is a good model for how a risk profession can serve such a vital role within an industry. [Note: The Society of Actuaries Board of Govenors has recently approved a new ASA-level designation for Enterprise Risk Management.]