Financial Services Commission Stress Testing Guidelines for Insurance Companies

IC48/03(ii) Stress Testing Guidelines Published by the Financial Services Commission, April 2009 (Adopted from the IAIS Guidance Paper – October 2003) 1 Financial Services Commission Stress Testing –Insurance Companies GUIDELINES

1. Introduction Stress tests are a necessary tool in assisting an insurer to manage its risks and maintain adequate financial resources to deal with those risks. Stress tests can be used to identify and quantify the impact of different stress scenarios on an insurer’s expected future financial position, in the broad sense. Stress tests are a tool for examining what might happen in a particular stress scenario, however, it should be noted that they not predict outcomes.
2. Objectives of Stress Testing The business of insurance is based on dealing with uncertainty; therefore, an insurance company needs to consider a wide range of possible outcomes that may affect its current and expected future financial position. Stress tests are a necessary risk management tool to ascertain whether insurance companies are financially flexible to absorb possible losses that could occur under various scenarios. All the effects of stress testing, both direct and indirect, on both sides of the balance sheet should be taken into account. It is expected that prudent, well-managed insurers would undertake stress testing as a matter of good corporate governance, which should result in better internal controls, governance and risk management. To be truly effective, stress tests should be considered as a fundamental element in an insurance company’s overall risk management framework, rather than being viewed simply as a helpful tool for capital allocation purposes or as a way to monitor performance. The use of such tests should not be seen as a regulatory burden. Stress testing should contribute to the understanding that the board and management has of the risks facing the insurer. To accomplish this, the board and management must understand the assumptions underlying the stress testing, as well as the results. Also, stress tests can help an insurer to develop and assess alternative strategies for mitigating its risks. Specifically, such tests should be appropriate to the insurer’s own risk profile. For example, stress tests should reflect the fact that each insurance company does not underwrite the same classes of risks, accept the same level of risks, have the same distribution systems, employ the same reinsurance arrangements, have the same distribution of assets by investment type/grade or have the same operational systems and controls.

IC48/03(ii) Stress Testing Guidelines Published by the Financial Services Commission, April 2009 (Adopted from the IAIS Guidance Paper – October 2003) 2 The stress testing should address significant adverse threats to the future financial condition of the insurer, rather than just mildly uncomfortable possibilities, so as to truly test the insurer’s exposure and the sufficiency of its technical provisions and capital. To better inform the board and management of the insurer’s exposure to risks, it is useful to determine how adverse a risk must be for it to impair the insurer’s financial position. The insurer should use stress testing for strategic planning and for contingency planning. 3. Scope of Coverage Stress testing includes both sensitivity testing and scenario testing. Both approaches are to be undertaken by insurers to provide a better understanding of the vulnerabilities that they face under atypical conditions. They are based on the analysis of the impact of unlikely, but not impossible, adverse scenarios. The stresses may be of a financial, operational or legal nature or may involve liquidity or be related to any other risk that might have an economic impact on the insurer. Specifically, a sensitivity test estimates the impact of one or more moves in a particular risk factor, or a small number of closely linked risk factors, on the future financial condition of the insurer. A scenario test, by comparison, is a more complicated type of test which contains simultaneous moves in a number of risk factors and is often linked to explicit changes in the view of the world. Scenario tests often examine the impact of catastrophic events on an insurer’s financial condition, particularly in a defined geographical area, or simultaneous movements in a number of risk categories affecting all of the insurer’s business lines or trading operations, for example, underwriting volumes, equity prices and interest rate movements. There are two basic types of scenarios:  Historical, and  hypothetical Historical scenarios reflect changes in risk factors that occurred in specific historical episodes. Hypothetical scenarios use a structure of shocks that is thought to be plausible, but has not yet occurred. Each type of scenario has its benefits as depending on the risk both approaches could be of value and should thus be used. A large part of an insurer’s financial management is based on an understanding of expected outcomes and the normal variations around these outcomes. An analysis of the financial effects of typical or extreme scenarios is needed to gain a comprehensive view of the risk assumed, for example, measuring the potential impact of a stock market collapse or the insurer’s equity portfolio.

IC48/03(ii) Stress Testing Guidelines Published by the Financial Services Commission, April 2009 (Adopted from the IAIS Guidance Paper – October 2003) 3 4. Required Expertise Each insurer should have access to the expertise and technology required to design and perform stress tests. This may involve a specialised risk management unit, actuarial personnel or external consultants. Various individuals within the insurer, such as risk managers, finance personnel, actuaries and business line managers, should be involved in designing the stress tests. It may also be useful to consider other views, for example, those of the FSC, external consultants, the accounting and actuarial professions, the reinsurance industry and rating agencies. Those involved in designing the stress tests should have:  a mix of expertise, which includes actuarial, accounting, economic, legal and financial expertise;  a thorough understanding of the business of the insurer;  the ability to identify risks that could potentially have a material adverse impact on the insurer’s financial position;  the ability to undertake an analysis of how much of an impact these risks could reasonably have; and  understanding of the various models that can be used. Those carrying out the testing must have the ability to analyse and effectively communicate the results. Regardless of the level of expertise of those involved in designing the stress tests, a level of independence should exist to ensure that an adequate set of tests has been designed that is appropriate to the risk profile of the insurer. The decisions about the factors to be considered and the tests undertaken should be made, if possible, by those who are not involved in the corresponding business decisions. For a small insurer, it may be difficult to fully separate the decisions on stress testing from those involved in business operations. In turn, insurers would be expected to be able to understand the results of the stress testing and to determine whether any aspect of their operations should be changed, given this knowledge.

IC48/03(ii) Stress Testing Guidelines Published by the Financial Services Commission, April 2009 (Adopted from the IAIS Guidance Paper – October 2003) 4 5. Designing Stress Tests It is appropriate that each insurer design its stress tests considering its own risk profile and the complexity of its business. It is likely that this will lead to variation among insurers as to the extent and nature of the tests performed. There is benefit in considering stress scenarios even for risks that cannot be easily quantified or modelled, for example, court rulings, dealing with claims practices, reputational risk and changes in tax laws among others. The FSC may require some level of standardised tests in order to obtain a measure of consistency and for baseline monitoring purposes. These tests, however, should neither inhibit an insurer from undertaking its own thorough review of the inherent risks in its business, nor discourage an insurer from adopting an effective, comprehensive, risk-based approach to business management. Various considerations are likely to determine the nature and extent of tests required. They include the insurer’s:  solvency position  lines of business and distribution systems  current position within the market  current position within the group  investment policy  business plan  general economic conditions. For example, an insurer with a low solvency position should conduct more extensive or more frequent stress tests. An insurer within a larger corporate group should test the effects of possible changes resulting in constraints to accessing additional capital. The insurer should consider what events are material, having regard to their impact and likelihood or plausibility. This, in part, will be a function of the insurer’s size, complexity, solvency position and the nature of its operations and will depend on the insurer’s risk tolerance.

IC48/03(ii) Stress Testing Guidelines Published by the Financial Services Commission, April 2009 (Adopted from the IAIS Guidance Paper – October 2003) 5 The insurer should be able to withstand circumstances that are reasonably foreseeable, albeit unlikely, including events for which it is providing specific coverage. In terms of specific elements, the following factors could be used as a guide to what insurers might consider when developing their stress tests. It should be noted that this is not intended to be an exhaustive list, especially as prescribed minima cannot cover all the specific risks within an insurer. Professional associations, such as the actuarial association, may also provide guidance on factors to be considered in developing stress tests. Insurance Risk Insurance risk relates to the risk that an inappropriate underwriting strategy is adopted (for example, an in a inappropriate pooling of risks and adverse selection), that the chosen strategy is inadequately implemented or that unexpected losses arise even when appropriate strategy is adequately implemented. Insurance risks specifically focus upon the impact of the underwriting and claims functions on an insurer’s premiums and technical provisions. Insurance risks may be categorised as underwriting risk, catastrophe risk, or the risk of deterioration of technical provisions. Market Risk Market risk is concerned primarily with the adverse movement in the value of an insurer’s assets and liabilities. For insurers, it is the extent to which an adverse movement in the value of the assets as a consequence of market movements, such as interest rates, foreign exchange rates, equity prices among others, is not offset by a corresponding movement in the value of the liabilities. Factors to consider include, but are not limited to:  the possibility of a severe economic or market downturn leading to interest rate movements that adversely affect the insurer’s financial position;  the impact of price shifts in asset classes on the entire portfolio;  inadequate valuation of assets;  the direct impact on the portfolio of currency devaluation, as well as the effect on related markets and currencies;  the extent of any mismatch of assets and liabilities, including reinvestment risk;  the impact on the portfolio value of a dramatic change in the spread between a market index of interest rates and the risk free interest rate;

IC48/03(ii) Stress Testing Guidelines Published by the Financial Services Commission, April 2009 (Adopted from the IAIS Guidance Paper – October 2003) 6  the extent to which market moves could have non-linear effects on values, for example, derivatives; and  the effect of credit rating downgrades on the value of assets. Credit Risk Credit risk relates to the probability that a counterparty will fail to perform its obligation. These counterparties may include debtors, borrowers, brokers, policyholders, reinsurers and guarantors. Credit risk may also be assumed through guarantees and other financial instruments such as derivatives and securitisation. Factors to consider include, but are not limited to:  the collapse of a reinsurer or several reinsurers on the insurer’s reinsurance programme and the subsequent impact this may have on outstanding reinsurance and IBNR recoveries;  a deterioration in the credit worthiness of the insurer’s reinsurers, intermediaries or other counterparties;  the degree of concentration of business with reinsurers of particular rating grades;  the degree of credit risk concentration, for example, over exposure to a single counterparty;  deterioration in the extent and quality of collateral;  greater losses from bad debts than anticipated; and  defaults by parties in respect of whom guarantees have been given by the insurer, whether under insurance contracts or otherwise. Liquidity Risk Liquidity risk relates to the probability that an insurer will be unable to realise assets to fund its obligations as and when they fall due. Understanding whether an insurer’s cash flow is sufficient to meet its commitments to policyholders and other creditors is fundamental. Factors to consider include, but are not limited to:  any mismatch between expected asset and liability cash flow;  the inability to sell assets quickly;  the extent to which the insurer’s assets have been pledged;

IC48/03(ii) Stress Testing Guidelines Published by the Financial Services Commission, April 2009 (Adopted from the IAIS Guidance Paper – October 2003) 7  the cash flow positions generally of the insurer and its ability to withstand sharp, unexpected outflows of funds through payments of claims, or an unexpected drop in the inflow of premiums; and  the possible need to reduce large asset positions at different levels of market liquidity and the related potential costs and timing constraints. Operational Risk Operational risk is the risk arising from failure of systems and internal procedures and control leading to financial loss. The insurer should be able to at least demonstrate that operational risks have been considered and that appropriate plans and procedures exist to deal adequately with adverse scenarios. Operational risks may be very difficult to identify and measure. Factors to consider include, but are limited to:  the adequacy of an insurer’s business continuity management plans;  the adequacy of an insurer’s disaster recovery planning;  the possibility of fraudulent activity occurring that may impact the financial condition or operational situation of the insurer;  the reputational risks to the insurer may be exposed;  the marketing and distribution risks to which the insurer may be exposed;  the technological risks to which the insurer may be exposed;  the possibility of political interference, for example, legislative changes such as changes in taxation laws;  the impact of legal risks, for example, the risk that policy wording may be interpreted more broadly than intended;  the possible impact of any outsourcing difficulties, for example, third party providers failing to perform in accordance with their contractual obligations; and  the failure of general personnel management controls, for example, the impact of an underwriter exceeding authority limits. Group Risk The membership in a group can be a potential source of strength to the insurer, but it can also pose risks, particularly as a result of contagion. Factors to consider include, but are not limited to:

IC48/03(ii) Stress Testing Guidelines Published by the Financial Services Commission, April 2009 (Adopted from the IAIS Guidance Paper – October 2003) 8  the impact on the insurer if financial support is no longer being guaranteed by the parent company or the insurer is unable to access additional capital;  the effect on the insurer of an impaired parent or affiliate within the group;  the effect on the insurer of the inability to sell or close a subsidiary in difficulties in a timely manner;  the potential diversion of the time of management to group issues;  the implicit support of group companies through the reallocation of group overheads towards the insurance entity;  the pressure on the insurer to financially support other group members;  the pressure on the insurer to comply with group requirements rather than the firm’s own strategies;  the effect on the insurer of a high degree of dependence on group resources; and  the effect on the insurer of a downgrade in the rating of the group or any other reputational issues. Systemic Risk The failure or downgrading of one or more significant insurer in a market could result in marketing or reputational risk for other insurers. The failure or downgrading of other financial institutions, such as banks, could also affect an insurer’s operation. 6. Frequency of Stress Testing Stress tests should be conducted at least annually. In addition they should be conducted to capture new material developments and evolving portfolio characteristics. While it is normally appropriate to perform stress testing at least annually, more frequent testing may be appropriate for an insurer with a high risk profile, or when market conditions are changing rapidly. Stress tests should examine the effects and impact that different time horizons will have on business plans, strategic risks and future operating requirements. The time horizon needs to be long enough for the effects of the stress to be fully evident, for management to act and for the results to emerge. General Insurers

IC48/03(ii) Stress Testing Guidelines Published by the Financial Services Commission, April 2009 (Adopted from the IAIS Guidance Paper – October 2003) 9 should have a time horizon of no less than 3 years and the life insurers’ time horizon should be no less than 5 years. 7. Modelling Techniques Used In Stress Testing Various modelling techniques are used in stress testing. The use of a particular risk model will depend on the insurer’s circumstances and approach to risk assessment and risk management. Common methods used are based on static or dynamic modelling and deterministic or stochastic approaches. In its basic form, static modelling implies that the analysis of the insurer’s financial position is at a fixed point in time, whereas dynamic modelling takes into account developments over a certain time period. Deterministic models examine the financial impact if a certain scenario occurs, whereas stochastic models also take into account the probability of various scenarios occurring. A simple example of a static deterministic stress test is where an insurer, in determining its appropriate capital level, examines the effects of loss ratios on its balance sheet. The loss ratio is the risk variable, and the impact on net assets is the resultant exposure. Such tests do not take into account the actual probabilities of the different loss ratios occurring. Stochastic models are more advanced techniques. They are based on probabilities that predict how key financial parameters interact with each other over time, and generate a distribution of outcomes based on simulations of those parameters in the future. One of the advantages of stochastic modelling is that it provides an indication of the range and the likelihood of different financial outcomes occurring. This is useful in achieving a particular level of confidence in the solvency level, e.g., a 0.5% risk of ruin. Stochastic models are useful, and at times essential, where the insurance contracts contain both embedded options and financial guarantees. In these circumstances, it is likely that stochastic modelling will be needed for financial statement purposes as well as for stress testing. The reliability of the models used should be regularly validated. 8. Complexity of Scenarios and Interactions among Risks The complexity of stress tests should be driven by the circumstances of each insurer. Straightforward tests, with simple assumptions that cover the major risks, may be more useful than complex modelling that is difficult to understand or to validate. However, it would be expected that a prudent, well-managed insurer would regularly examine the quality and content of such tests, and seek to improve the methodology over time.

IC48/03(ii) Stress Testing Guidelines Published by the Financial Services Commission, April 2009 (Adopted from the IAIS Guidance Paper – October 2003) 10 Risks are seldom totally independent or totally related. The insurer should examine the correlations among various risks to assess the effects they may have on the stress testing models and assumptions used. It is important that the extent of correlation that is assumed to apply in the future is not understated. There is evidence that in adverse situations, previously low levels of correlation can increase. Determining interdependency requires judgment, as there may be no historical data that throws meaningful light on new social and economic conditions. The correlation and the interdependency among risks should be regularly evaluated. While the frequency of such evaluation should normally be fixed in advance, it may need to be done more frequently in times of crisis. The correlation analyses are required to ensure that the interrelationship of risks is taken into account. For example, if an insurer was affected by a major catastrophe, other parties on which it is dependent may also have been affected, such as:  reinsurers on which the insurer is reliant to meet claims  intermediaries which generate future business  other service providers, who may be unable to meet their contractual obligations or provide a full service One stress may lead to another (e.g., cause and effect chains) and thus one may have to look at multiple risks. There are normally consequent effects, often in less-measurable risks, which should be taken into account when determining scenarios. An example is a regulatory requirement to augment, rather than just replenish, capital depleted by the stress conditions. These interactions may not occur immediately, but may evolve over time. Determining the extent of dependencies that exist can be complex. A degree of prudence and pragmatism will be required when making judgment. This is particularly the case when determining tail-dependencies. 9. Modelling Management Actions Stress testing should generally consider the extent and effectiveness of options available to management in reacting to emerging risks. It is possible for a stress test to show a possibility of failure if no management action is assumed, but then be able to demonstrate that, with appropriate and timely management action, it is possible for an insurer to maintain a satisfactory financial condition.

IC48/03(ii) Stress Testing Guidelines Published by the Financial Services Commission, April 2009 (Adopted from the IAIS Guidance Paper – October 2003) 11 There are many areas within an insurer’s business that do not lend themselves easily to quantitative modelling, especially those that depend on the competence of, and actions taken by, an insurer’s board and management. The role of senior management is to develop and implement risk management policies, procedures and practices that translate the board’s goals, objectives and risk limits into prudent operating standards. Determining whether this role will be properly fulfilled, however, requires judgement when performing stress testing. Also difficult to quantify are:  whether management decisions or actions are based on sound and prudent information or analysis  issues surrounding staff recruitment  whether too much reliance is being placed upon key persons Such considerations should form part of an insurer’s overall risk management policies and procedures and, where possible, realistic estimates should be made of how quickly and how effectively the insurer will react to change. The speed assumed in modelling corrective action should consistent with the management culture, past experience and the existence of robust procedures for the identification of risk events so that management is able to respond in a timely manner. When incorporating management actions into the stress testing, the following procedures should be followed:  the impact of the stress event should be quantified and reported, without incorporating any management actions  careful consideration should be given to the time it would take for management to recognise and respond to the problems, given the terms and conditions of policies and practices to be adjusted, and the extent and effectiveness of options open to management to act in response to the stress event  the type and timing of the management actions should be incorporated in the stress test projection, and then be quantified and reported. 10. Limitations of Stress Tests As a concept, stress testing is relatively straightforward. However, the application of this technique in practice is more complicated. Some of the difficulties are:

IC48/03(ii) Stress Testing Guidelines Published by the Financial Services Commission, April 2009 (Adopted from the IAIS Guidance Paper – October 2003) 12  determining what risk factors to stress  establishing how such factors should be stressed  establishing what range of values should be used  determining the time horizon that such tests should consider  meaningfully analysing the results and making informed judgments. Another factor that insurers need to consider is that stress tests usually require good information systems and compatibility across business units, to properly analyse the interrelationships of risks. Internal communication flows among an insurer’s business units are therefore important, particularly if there is not a dedicated resource area to undertake stress tests. The extent to which parameters and variables are reliable should be reflected in the interpretation of results and resulting recommendations. Reviews should occur regularly to ensure that they remain relevant to the changing risk profile of the insurer and external market conditions. 12. Reporting to Board and Management A written report should be prepared that summarises the stress testing performed. This report should contain the following information:  a description of the stress testing methodology and the key assumptions used in the stress testing models;  the results of the base case, for example, using the same assumptions as the insurer’s business plan;  the assumptions used in the stress testing scenarios and the interactions built into the models;  the results of the stress testing, before and management actions;  the extent to which data limitations affect the conclusions of the analysis;  the nature and timing of any management actions assumed in the models to mitigate the results of the adverse stress testing scenarios; and  the results of the stress testing, including management actions.

IC48/03(ii) Stress Testing Guidelines Published by the Financial Services Commission, April 2009 (Adopted from the IAIS Guidance Paper – October 2003) 13 An interpretive report is more desirable than a purely statistical report. In addition to a written report, an oral presentation that permits questions and discussions is desirable. It is essential that the assumptions and results be presented in a manner that can be understood by an insurer’s board and management in order to facilitate action. A report to the board and management should be prepared at least annually, unless stress testing is being performed more frequently. The timing of the report may depend on the urgency of the matters reported and on the desirability of integrating stress testing into the insurer’s financial planning cycle. In some cases, a change in the insurer’s circumstances since the last regular stress testing investigation may be so significant that to delay further testing and reporting to the time of the next regular report would be imprudent. In such a case, stress testing should be undertaken, and results reported, on an interim basis.