Solvency II – Does BPM hold the key to painless compliance?

Solvency II has forced insurance companies to relook at the business in a holistic manner – an end-to-end value chain consisting of internal and external business processes comprising of risk, finance, policy admin through to sales and distribution. No longer can executives afford to think of their functions as ‘islands’. There is an urgent need to stitch the disconnected systems, processes and stakeholders in a single ‘eco-system’.


Insurers since long have been having a flirtatious relationship with Business Process Management (BPM) tools. I guess, the time is ripe for BPM tools to shine and rescue the insurance companies from their plight.

So, how can BPM help insurance companies meet their Solvency II compliance?

Solvency II, in a nutshell, is about creating transparent processes across the organisation, which would help executives to get a pan-enterprise view of risk. The three pillars are built around identification, quantification and reporting of the risk to the regulators. In order to achieve this, insurers are building/revising their risk management frameworks. A Risk Management Framework (RMF) in a nutshell is an integrated view of risk management including consistent processes for analysing, evaluating, mitigating and communicating risks. RMF will enable an insurer to bring together a risk-based procedure, governance structure and integrated methodologies where the relationships between processes, risks, controls and regulations are made more visible.

BPM tools can help companies meet this challenge effectively. The formal processes, once approved by the regulators can be built using BPM and deployed in the organisation. Workflows are best placed to build governance structures to manage risks with built in triggers to escalate to appropriate roles in the organisation, should the need arise. Reporting (Pillar 3) can be delivered with greater certainty using the dashboards.

Solvency II is not ‘one-off’ compliance. CEIOPS expects insurance organisation to embed a culture of risk within the organisation, using Internal/Standard Model and Use tests to validate their risk management frameworks and constantly improvise the results for better quantification of risks. Building a ‘one-off’ compliance for Solvency II would entail repeated enhancements to the systems and processes. As against this, BPM tools provide the flexibility to dynamically change the processes with minimal costs and minimal down-time.

Documentation is another area of concern for insurers and regulators. CEIOPS has published guidance on this topic and insurance companies are expected to maintain comprehensive documentation on the processes with detailed explanation. While companies have been exploring Sharepoint and similar tools for this, I strongly recommend using the document management capabilities in BPM for this purpose. The document management capabilities in a BPM tools provides for scenarios where documents need to be accessed by a large group of people who need to collaborate on them. Another point in favour of BPM!

Many insurance companies have successfully deployed BPM in some functions (or majority of functions) in their organisation. It is the perfect time to extend the deployment to cover critical areas which would also help them comply to Solvency II.

Have you analysed the business implications of Solvency II?

In a recently published report by Morgan Stanley and Oliver Wyman, the impact on Solvency II on an insurance organisation becomes increasingly clear.

 

The report uses their proprietary QIS5 model to analyse the impact of Solvency II on four fictitious companies – a life company, a non-life, a composite and a reinsurer. The key findings were:

 

The solvency ratios for the non-life oriented insurers show sharp declines under QIS 5;
Reinsurers are likely to see a major decline in reported solvency ratio, but demand for reinsurance should increase;

• For life, the major impact is for participating (with-profit) policies;
• The majority of the industry's capital requirement would come from a combination of market risk and participating contracts;
• Diversification benefits will also be a key driver of the Solvency II capital requirements; and
• European insurers may become competitively challenged in markets with "non-Solvency II equivalent" regimes.

 

Being one of the largest regulatory programme till date, it is important to view Solvency II as a major catalyst for changing the traditional business models on insurance companies. An industry beset by declining investment returns, inefficient processes and legacy IT systems, need major overall in the way they do business in the future. The report rightly points out that the pace of strategic change will dramatically improve in the Solvency II world with the transparency brought about by the regulation. However at the same time, there exists a risk of the European insurers’ competitive advantage threatened by their ‘non-Solvency II’ competitors across the Atlantic!

 

Managing Solvency II Programme: There’s more to it than a RAID!

Solvency II is by far the largest finance change programme undertaken by insurers in recent years. And, probably the most complex till date. But the complexity does not end there. Given the nature of change involved in delivering Solvency II and the timelines, the Solvency II Programme Director finds himself at loggerheads with other Business As Usual (BAU) projects and finance projects managers. An organisation cannot afford to wait for Solvency II to deliver compliance before it can initiate other changes – most changes need to happen simultaneously! And often, the deliverables are at cross purposes to each other.


The finance teams of UK insurers are grappling with some key changes in their current operating model – IFRS, MCEV proposed changes around reporting; implementation of TAS standards for actuarial reporting to name a few. These changes are directly impacting the deliverables of Solvency II workstream. Unless the proposed changes by the respective teams are discussed and agreed, insurance companies will waste significant time doubling the deliverables at the best case, or undoing previous deliverables at the worst.

The Solvency II programme suffers from an inherent weakness of not being able to define the exact deliverables for each of their work stream, as the requirements are still emerging. Two weeks ago, CEIOPS has delivered another set of documentation which are currently being analysed for impact by the actuaries. This ambiguity is of no great help to either the Solvency II Programme Director or the other finance change directors! The BAU functionaries have to perform their day-to-day role and they cannot wait indefinitely for Solvency II.

So how does one go about efficiently managing the change portfolio within finance?

My experience suggests developing an Impact Management Framework for this purpose. The framework is a simple tool to identify the current the future ‘conflicts’, map the conflicts and the overlapping areas, broker a possible mitigation plan and continually assess the tool and update it to the conclusion of the impact / dependency.


Impact Management Framework for Solvency II

Given the nature of Solvency II deliverables, it is potentially impacted by, and, in turn could impact a number of BAU functions/projects in an organisation. The proposed framework is a methodology to identify and manage the impacts. The framework is shown in a diagram below.

The framework consists of five steps:

Step 1: Identify

Identify a list of all current and future projects in the organisation. A good starting point is the Change Board or Portfolio Governance function which has a most up-to-date list of the projects. It is useful to validate the list with key functions such as IT, Business Change to ensure that the list is complete. The change function also has a list of future projects which have been approved.

Step 2: Investigate

Typically the starting list will be fairly long. It is not unusual to have more than 100 projects on the initial list. Use a first filter to eliminate those projects which has no potential impact on Solvency II. For example, system upgrades, site enhancements, version upgrades, changes in client facing documentations, changes impacting distributor commissions. Having put the list through the initial filter will give you a manageable list to begin.

Step 3: Assess

For the shortlisted project, investigate the scope of the project, the products/processes/systems impacted to assess if they have interdependence with Solvency II. This is the second filter. During this stage, I do an initial investigation, followed by a quick conversation with the Project Lead to validate my understanding.

At the end of Step 2, you will have a definite list of projects which have potential interdependence on Solvency II.

Step 4: Plan

During this stage, identify the exact areas of overlap between the two projects. The areas could be one of more of the following:

1. Impacting product valuations

2. Impacting financial reporting

3. Impacting financial processes

4. Modifying risk categories

5. Modelling changes

6. Changes to finance data mart

The list above is not exhaustive. You will need to modify the above list based on the functional organisation and the prevalent project life cycle in your organisation.

For the external projects (i.e., those other than solvency II), identify the areas of overlap, their delivery time line and the resource utilisation. The delivery timeline needs to be compared with that of the relevant work packet of Solvency II programme. The comparison should result in a mitigation plan with defined activities at pre-defined time to ensure that the interdependencies are tracked. Given the evolving requirements of Solvency II, a typical mitigation plan can be to reassess the interdependence. For those work packets within Solvency II where the requirements are clear, a mitigation plan can be picking up relevant deliverables of external project and including it within Solvency II deliveries.

Step 5: Mitigation

This step refers to activities in the future where Solvency II work packet manager and the external project manager need to re-assess the identified interdependencies. The mitigation plan should be included in the main Solvency II programme Project Plan to ensure their monitoring.

I have found it a good practice to be in regular contact with the change board to ensure that new projects are brought to my attention immediately. It is a relatively simple task to communicate the potential dependencies early in an external project’s plan, than doing so at a later date.

The list of dependencies does not end here. Solvency II programme need to be cognizant about the forthcoming papers from the European Regulator, resource availability among a host of potential dependencies. I will cover them in a later blog.

Significant implications for actuaries in Solvency II Regime

New Regime Of Solvency Regulation Will Impact Insurers And Actuaries

Boston, MA – Changes to solvency regulation in Europe and the United States will have key implications for insurers and actuaries, attendees of the Casualty Actuarial Society (CAS) annual meeting heard during the opening general session of the meeting.


Session moderator Cara Blank, Actuary, Massachusetts Division of Insurance, led off the session by noting that the discussions of solvency regulation have become more heated, particularly in the last 18 months. In addition to Europe and the U.S., a number of regulatory efforts and solvency proposals are underway in jurisdictions such as Australia, Canada, and Switzerland.

Kathryn Morgan, of the UK’s Financial Services Authority (FSA), gave an overview of Solvency II, the new risk-based solvency regime in Europe that takes effect November 1, 2012.

Ms. Morgan noted that Solvency II is a fundamental review of the solvency and risk management standards for European insurers that aims to strengthen prudential regulation of the insurance sector and to improve policyholder protection.

“The idea is that the system of regulation will be absolutely the same for all insurance companies across the EU,” she said.

Ms. Morgan observed that actuaries are at the heart of Solvency II, and it has significant implications for them. This is because the actuarial function is part of the new solvency regime. However, as Solvency II is a wide-ranging regime, actuaries will need to work as part of a multi-functional team.

She noted that actuaries will help fulfill the emphasis on technical provisions under Solvency II and that actuaries are also required to give an opinion on underwriting policy.

She explained that the European body of actuaries, known as the Groupe Consultatif, is working with industry and regulators on the technical and professional standards that could apply to actuarial work.

Building internal models is an area of focus. Under Solvency II, companies may build internal models to measure their risks and capital requirements, but the models have to meet a use test and significant governance requirements.

“European regulators have tried to learn from the lessons of the financial crisis. We want to make sure that models are as useful as possible so each firm knows what the shortcomings are,” she said.



Ramon Calderon, Director for the Center for Insurance Policy & Research, NAIC, observed that while U.S. regulators welcome Solvency II for Europe, the new regime still raises questions.

“We’re all in the same boat. We seek prudent regulation and a competitive marketplace. But there are still open questions about Solvency II,” he said.

Calderon explained that some features of Solvency II have yet to be tested. “There is a lot of caution about the reliance on models and about how far we can go in group supervision,” he said.

By comparison, the U.S. solvency framework has been tested under fire. “It is a multi-jurisdictional system. There is a supervisory culture in place,” Calderon said.

With the exception of certain specialized monoline insurers, the U.S. insurance industry largely survived the economic crisis of 2008/2009. “This was because the underlying nature of the insurance business, the U.S. solvency framework, and fundamental risk management systems worked well together,” Calderon noted.

However, Calderon cautioned that U.S. regulators cannot afford to become complacent. As a result, the National Association of Insurance Commissioners (NAIC) adopted the Solvency Modernization Initiative in June 2008 that will identify potential changes to the solvency framework in the U.S.

According to Calderon, the U.S. is also active in international venues and taking leadership roles in International Association of Insurance Supervisors (IAIS) committees on solvency issues.

U.S. insurance regulators need to be engaged in the IAIS process, as they will be judged by the IAIS standards that are adopted, he added.

The Casualty Actuarial Society fulfills its mission to advance actuarial science through a focus on research and education. Among its 5,100 members are experts in property/casualty insurance, reinsurance, finance, risk management, and enterprise risk management.

Solvency II: Data – The Hidden Culprit?

In my previous blog, I have commented on the inadequate preparation for the implementation of Solvency 2. I had also commented on the possible challenges that a company’s Information Systems can pose on the implementation. Perhaps the most serious challenge to implementation would come from data. It has happened before – there are plenty of case studies on the Net about how inadequate and inconsistent data has led to project failures and inordinate delays. More recently, Banks faced severe challenges during implementation of Basel II as they underestimated their data issues.

 

Insurance companies have large volumes of data. Being one of the earliest adopter of IT in their businesses, companies have accumulated large quantities of data across their IT systems. However, the sheer volume of data has often proved to be a bane. As their IT estate have grown tactically, the data residing in those systems are inconsistent, duplicate and orphans. Traditionally most reporting have been standard, being generated out of a tactical process. The data users within insurance companies have learnt to receive data in ‘piecemeal’, use indigenous techniques for purification and de-duplication, before using them for their purpose. However, this approach will not see them through the new regulation.

 

Insurance companies have taken efforts in the past to cleanse their business of this problem. However, in the absence of a strategic approach, each new effort has led to creation of yet another ‘definitive’ source of data. At the enterprise level, this has added another source of (duplicate) data.

 

Solvency II: The focus on data management

 

The Supervisory Review Process under Pillar 2 regulates how ORSA (Own Risk and Solvency Assessment) is achieved. To do so, it places increased scrutiny on

•  Controls around gathering and storage of risk data
• Evidence that risk assessments are based on accurate, complete and appropriate historical data
• Evidence of consistency and accuracy between data used for capital calculation and that being used for reporting across the organisation.

 During Basel II implementation, most banks failed to demonstrate data governance from its creation, through its journey across various functional repositories to the point when it became available for analysis. Banks failed to estimate the scale of data quality problem and the efforts required to fix them. Consequently, many had to adopt tactical fixes which are being fixed up till today. Another result of this underestimation was that banks had to hold a higher level of capital to compensate for increased uncertainty arising out of unresolved data issues.

 

 To avoid this pitfall, insurance companies should adopt a data management framework comprising of three key components – data architecture, data governance and data quality. By tackling the data on these three fronts, insurance companies would be able to get their data in the shape needed for compliance of solvency II as well as harnessing capital efficiencies from the regulation.

 

 

Solvency II – Data architecture

 

Under Solvency II, there will be an increased demand for historical data to support capital calculation. A ‘piecemeal’ approach to data sourcing will not be a viable option, given the volume of data requirement and increased scrutiny by the regulator on how data is being sourced. Based on the experiences of Basel II, a robust, well documented data architecture will be a key enabler for compliance.

 

I have highlighted how insurance companies have unsuccessfully attempted to create an enterprise data. With the benefit of this experience, perhaps a balanced approach to data architecture will be a do-able option. Companies should centralise the acquisition, preparation and storage of historical data, but decentralise the development of data stores for analysis and reporting. Centralising the management and sourcing of all reference data implies that data is validated within the architecture and any anomalies can be remedied as close to the source as possible. A master source of data will avoid any inconsistencies in reporting when data is sourced from functional data stores maintained by the user departments.

 

  

Solvency II – Data Quality Management

 

The effectiveness of insurance company’s internal models cannot be guaranteed unless the quality and accuracy of the input data is ensured. Insurance companies, traditionally, suffer from serious data quality issues – incomplete validation, out-of-date reference data, missing fields, orphan records, inaccurate mappings rules and tables etc. All such issues may lead to delays in updating the models, requirement to maintain provision for uncertainty, improper calculations and greater efforts. The greatest challenge with in data management is that it cannot be handled at individual department’s level. Data is a corporate asset and hence it needs to be treated accordingly.

 

 The experience of Basel II has suggested that data quality management can take considerable efforts. Given the quality of data in insurance companies, it is wise to start this exercise immediately.

  

 

Solvency II – Data Governance

 

Pillar 2 requirements requires heavy scrutiny of the data sourcing process. In the new regime it will not be sufficient to demonstrate that those involved in capital calculation have a good understanding of data. Companies, on the other hand will have to demonstrate a similar level of rigour across the organisation. Keeping this in mind, enforcing good data governance across data management and analysis process will ensure that the data platforms would stand up to the regulatory scrutiny and pave way for wider data-based decision making.

 

 Data governance must also be extended to analytical processes. Traditionally, most risk calculations happened out of macro-enabled spreadsheets residing in analysts’ PCs. These calculation tools need to be ‘stress-tested’ for robustness. The calculation methodologies too, need to be stress-tested and documented for scrutiny by the regulators.

  

Unlike previous rule-based regulations, Solvency II seeks to inculcate a cultural change in insurance companies. Companies need to embed a risk based approach in day-to-day decision making. Being compliance to Solvency II is not just a ‘tick-in-the-box’. The business implications of compliance to this regulation extends far beyond that. For those who get it right, there are larger rewards in store – companywide data architecture, stronger governance, lower operating costs, being some of them. A key success criteria for harnessing the benefits is to look beyond the obvious, understand the full implications of the regulation across the company and make early advances towards compliance.

Solvency 2 – Is your Information Systems ready for the challenge?

There is a general consensus in the industry that insurers would need to make significant changes in their IT to be able to meet Solvency 2 requirements. Many of the Solvency 2 implementation requirements involve technology processes, systems and internal modelling functions. Data - a key ingredient – for compliance sits in disparate systems. Having discussed the current challenges being faced by the insurers, I have tried to highlight the challenges that Solvency 2 poses in data management, modelling, governance and alignment of IT with risk management and control functions.


Solvency 2 implementation involves information systems and technology in multiple ways across the three pillars.


Pillar 1 Challenges

Pillar 1 raises challenges for information systems and IT support. Solvency 2 influences many existing IT applications and requires additional functionalities to be developed. The impact assessment of Solvency 2 should focus on application architecture and functional as well as non functional requirements. It is important to ensure appropriateness, completeness and quality of data to be used in the calculation of risk capital, technical provisions and internal models. This involves robust data management capability and controls.

Insurers need to prepare documentation standards and evidence for all supporting systems. Information Systems is a part of operational risk under Solvency II. Hence, appropriate risk indicators for Information Systems should be taken in account for their quantification.



Pillar 2 Challenges

Pillar 2 raises challenges on IT governance, outsourcing and internal audit. An appropriate IT risk and control framework must be implemented as part of overall risk management framework and embedded in IT governance. All outsourced processes – system development or maintenance – must comply to Solvency 2 requirements. An effective internal audit function need to be in place to ensure that companies Information Systems are covered.



Pillar 3 Challenges

Pillar 3 raises challenges on the systems that support compliance. Companies will have to provide information on IT governance as a part of supervisory reports. Systems need to be enhanced, or new systems put in place for development and production of Solvency 2 reports.


The QIS 2 & 3 reports have identified have already revealed data-related challenges with regard to calculation of risk capital and internal models. It also mentioned the issues related to capture of data for calculation of operational risk.


The way forward

Let’s not forget the banks who had to undergo similar challenges around their information systems during their implementation of Basel II. During the implementation of Basel II, the following areas were found to be lacking:

• Integration
• Insufficient alignment of IT risk management and controls
• The role of IT and dependencies were not clearly identified
• Definition of IT risks – incidents and losses – were not readily available

Insurance companies would benefit from their experience and avoid failures and unnecessary costs. Below are some areas that require immediate attention:

• Companies need to focus on a thorough analysis of their data and IT applications. This will help increase consistency and reduce duplication of efforts and drive down cost of implementation.

• Identification of interface issues, data harmonisation and standardisation need to take place. This will lead to significant simplification of dataflow issues with respect to Solvency 2.

• Identify inconsistent or missing documentation

• Assess your systems’ capabilities to store high volume of data and their retrieval to ensure sufficient availability and access of data related to Solvency 2

• Companies need to take significant steps to prepare for the capture, storage and access of historic data required for the capital calculation

• Extra attention is required to design and prepare for the required reports


Most companies tend to adopt a ‘siloed’ approach to implementation of regulatory programmes. They tend to address individual technology issues as the project progresses. Instead they should adopt a comprehensive approach to avoid inconsistencies and duplications.

By now there is sufficient clarity on the requirements. There is no point in waiting for all the requirements to be finalised before initiating any change programme. The Solvency 2 team within the insurance companies should include IT risks, IT related dependencies and constraints into account when developing capital calculations, and risk management initiatives.

In a recent study Celent estimates the cost of Solvency 2 implementation to be about €900 million for the European Insurance Industry. Given the state of IT within an insurance enterprise, I believe the actual can be much higher than this. But the larger issue is – having spent the money, can you be sure that your Information System is ready for the challenge?

Solvency 2 - Are you adequately prepared for it?

Enough is known about the shape of final Solvency 2 requirements for insurers to being work. However in my view the industry has not yet realised the extent of work required to be done duing the next two years. Any further delays now will be costly in the future. This is particularly true for firms that want to use internal models.

A recent survey conducted by Deloitte indicated that most companies are very much in the planning phase for Solvency 2. Some other observations coming out of this survey indicates the following:

1. Stakeholder Engagement: Majority of the companies still do not have adequate board and manegerial engagement. Without sufficient board and manegerial engagement there is a risk that the new regime would not be fully embedded within the organisation and some opportunities may be lost.
For companies who have not done this, it is important that the board and managerial team are fully briefed and engaged on the regulatory requirement. Internal stakeholders need to be identified and assigned clear roles and responsibilities.

2. Strategic Intent: A clear and well thought-out strategy can enable an organisation to equip itself with a competitive edge. An organisation implementing Solvency 2 can also benefit from potential synergies with other programmes (e.g. IFRS II). The survey indicated over 60% of the companies are yet to determine their implementation approach for Solvency II.

Companies need to assess the wider impact of Solvency 2 (e.g. how can the regulations be used to improve business performance). They also need to explore potential synergies arising out of their existing programmes and future regulations.

3. Preparedness: It is heartening to know that gap analysis is underway in most companies. However, the next stages are yet to be defined. One-fifth of the respondents had an internal team in place with full responsibility for preparing for Solvency 2 requirements. Many companies are expecting to bring external resources to help them implement the requirements.

To ensure preparations are complete in time companies should have a clear vision for the 'end state'. They need to review priorities within their change portfolio and shift priorities, if required. Finally, for a programme of this magnitude, it is important that they have an appropriate programme governance in place.

4. Integrating Solvency II requirements within the business: This is an area where many firms need to undertake more work. Unlike previous regulations (except perhaps TCF) Solvency II should be seen as an enabler for better business performance. Most companies have not aligned their risk decisions to strategic objectives. The risk appetite is largely focussed on capital requirements with little regard to earning visibility. For many companies there is a need to ensure that risk based decision making is adopted as a culture within the organisation.

To ensure that Solvency II requirements are embedded, companies need to assess the ‘cultural dimension’ of the regulation and design an adequate change programme for it.

5. Implementation: Till date companies have predominantly focussed their attention on the requirements of Pillar 1 at the expense of Pillar 2 & 3. While most of the companies have programme initiation, gap analysis and implementation planning on their agenda for the next six months, some key areas are still neglected (e.g. Management Information). Quality information will play a key role in gaining strategic and operational advantage and need to be considered early on.

For companies contemplating implementation, they need to plan for the requirements of Pillar 2 & 3 concurrently. Companies also need to consider their management information needs as a part of their holistic approach.


Solvency II is not expected to be in force till October 2012. However, insurance companies do not have the luxury of time on their hands. The experience of implementing Basel II regulations in Banking suggest that insurance companies need to initiate change programme now in order to avoid last minute surprises. Substantial changes are required across the enterprise and most companies are very much in the planning stage for Solvency II. The next 6 – 12 months call for significant investment of efforts to make that happen.