Opinion

---

ERM: Myth vs. Reality
by Shaun Wang

Enterprise risk management (ERM) has become a hot subject among actuaries and risk managers. Theories predict that by taking an integrated (or holistic) approach to major risks facing an enterprise (including financial, strategic, operational, and hazard risks), ERM can reap great benefits in contrast to traditional silo approaches. However, an examination of current ERM practices reveals much misconception about risk and misapplication of financial theories. For healthy development of ERM, we need to separate myth from reality.

The Concept of Risk 

To many educated minds, risk is random or stochastic, and can be described by a probability distribution. This myth is deeply rooted in financial and actuarial textbooks. The probability distribution can be estimated from observable (experience or market) data, with possible adjustments for trending and parameter uncertainty.

In modeling risks, however, more stochastic is not necessarily better. An outsider may observe risk as a random process. An insider, however, may see the same phenomena as trends and directions; in fact, such forward-looking projections can be very valuable for decision-making.

For business risks and strategic risks, a major concern is "not knowing the reality," "lack of information," or "driving in the dark." Information asymmetry is prevalent in various risk transactions. A more dreadful risk is wrong existing structure or state of being, for instance, wrong incentives, poor coordination and communication, and lack of accountability. These risks are worse than random risks and are not readily describable by a probability distribution.

The randomness mentality of risk has an unhealthy influence on the modeling of operational risks. It may be nice to fit a Pareto curve to historical operational loss data, but what does it do for an enterprise? It would be much more helpful to take a hard look at the business processes and incentives that led to past operational losses.

Multiple Perspectives of Risk

ERM does offer valuable big-picture perspectives, especially in balancing various types of risks. For instance, from an ERM perspective, we see an imbalance in traditional actuarial risk modeling that devoted much effort to modeling claim frequency, claim severity, and loss development volatilities, but neglected more important risks such as the underwriting and reserving cycle.

In reality, within an enterprise, various business units (or activities) have their own sets of relevant risks. The ERM big-picture perspective cannot replace local expertise and knowledge.

When it comes to local (product-level) decisions, there is a saying "the devils are in the details."

ERM should not replace existing specializations such as asset risk modeling, credit risk modeling, and the like. In essence, ERM is a new specialization that coordinates the risk-taking activities of various business units, reconciles diverse perspectives, and harmonizes different economic interests and incentives, for the ultimate benefit of the enterprise.

Misapplications of Financial Economics

In the past two decades financial economics has been underpinning the explosive growth of the derivatives markets, which in turn has earned financial economics undisputable authority in the academic world. The basic versions of financial economics assume no frictional costs and information efficiency, and the only relevant risks to investors are systematic risks for the market as a whole. While these assumptions reflect some idealized states and approximate truth in some capital markets, they are far from reality when it comes to running an enterprise. It is exactly because of potentially large disruption costs in a non-ideal world that risk management becomes a necessity.

ERM is concerned with the risks that are most relevant to the enterprise, which may be or may not be the same as the systematic risks to the market as a whole. For example, in the P&C insurance industry, the most dominant risks may well be the notorious underwriting and reserving cycle.

ERM further recognizes that the set of relevant risks to a business unit can be quite different from that for the enterprise as a whole. In contrast, many companies are doing top-down economic capital allocations based on a giant covariance matrix where correlation parameters are guesstimates at best. By so doing, they are unknowingly using the top-down perspective to suppress the perspectives that are most relevant to the individual business units.

The Curse of Blind Risk Diversification

Correlation and diversification have been at the heart of enterprise risk modeling. Many insurance companies have developed analytical models to quantify the diversification benefit between business units. Unfortunately, blind applications of portfolio theory misguided companies to "diversify" into new markets and business lines, and suffered big losses. I would categorize the effects of diversification into the following four different levels:

• "Offset" produces the highest benefits, e.g., long- and short-position in financial assets. An implication is that hedging is the most effective diversification provided the hedging cost is fair.
• "Random drivers" offer good benefits, e.g., natural catastrophe events in various geographic regions. Some specialized property catastrophe writers actively manage their portfolios through geographic and risk peril diversifications.
• Pooling of "expertise intensive" business may yield little or even negative risk diversification. For instance, different sectors (banking and P&C insurance) may be subject to different market dynamics, and require different sets of expertise; it would be very difficult for the management to understand and manage both well.
• For large diversified (complex) conglomerates, there may be legal "drags" due to the deep-pocket effect, and there may be "drags" of reputation spillover; these potential drags are in effect negative diversification benefits.

Based on the theory of risk diversification, many companies on the buy side were able to reduce their insurance cost significantly by seeking integrated risk protections, under the name of alternative risk transfers (ART). On the sell side, however, some companies now abhor the word ART after suffering big losses.

Necessity For Multiple Risk Measures

Recognizing the fact that the set of relevant risks can be different among various business units, ERM necessarily employs multiple risk measures. Solvency measures at the enterprise level (say, 99% VaR or TVaR) should not dictate the pricing risk measures used at the lower unit level (e.g., the Sharpe ratio). It is understandable that companies desire a common yardstick for comparing risk-return performances of various business units. The reality is that most enterprises have both risk-taking functions and service functions. We need to go beyond traditional risk measures so that we can quantify the brand name and customer services, as they are determinants of the franchise value for the enterprise.

Prediction

As a young discipline, ERM forces us to take a fresh look at various old risk concepts. I predict that theoretical breakthroughs will emerge to reflect better the realities of our businesses, and we will see more research products that offer simulated risk dynamics and market environment, allowing for interactions with decisions taken by participants (the company, its competitors, rating agencies, customers, and the like).