Allstate: An ERM Case Study
Allstate: An ERM Case Study
by Michael E. Bond, Jeanne M. Hollister and J. David Deanm
After a complex journey, Allstate enhanced its process for managing risk and found ways to better exploit risk opportunities.
We implemented ERM at Allstate because it provides senior management with an excellent set of processes and tools to obtain a deeper understanding of our various businesses and associated risk profiles...which in turn lead to making better decisions for the benefit of all stakeholders (shareholders, debt holders, rating agencies, customers, employees, and other related groups). In other words, the ERM discipline drives improved decision making leading to improved financial performance, which in turn drives increased shareholder value.
ERM has had an impact on our strategy, capital management actions (such as share repurchases and shareholder dividends), asset allocation/duration targets, risk limits, risk concentration in certain areas, use of reinsurance, extreme/emerging event preparedness and a variety of tactical actions.
Larry P. Moews, FSA, MAAA
Vice President and Corporate Risk Officer
Allstate Insurance Company
In 2000, The Allstate Corporation started on an exciting and uncharted new course: to become an early insurance industry adopter of enterprize risk management (ERM). It has been a complex journey that has helped provide a deeper insight into the company's underlying risk profile, enhanced the way Allstate manages risk in several significant ways and helped generate actions to better exploit risk opportunities.
The company's initial effort began some years earlier at the direction of then–CFO, Tom Wilson, who established new capital allocation and valuation models for use in the finance function. Later, as Wilson moved into an operating role, John Carl joined Allstate as CFO and asked his staff what the company's risk–adjusted returns were. A series of conversations resulted in a decision to explore developing a more quantitatively rigorous approach to measuring risk, similar to what was practiced in the oil and gas industry.
In response, a core group of Allstate's corporate finance staff developed a stochastic economic capital (EC) model to evaluate the amount of capital the company needed to cover line–of–business and enterprise losses at specific risk tolerance levels. However, the benefits of this effort were not well understood by many people outside of the finance function, so the results of the EC model weren't widely used to inform decisions made at the operating level throughout the organization.
In response, the finance team turned its attention to developing an ERM framework that would help combine the benefits of EC modeling with operational decision making. This combination of stochastic modeling and operational governance was a novel approach in the industry at the time.
Over time, Allstate has worked to align its analytics with corporate governance and decision–making activities. Today, there is a rigorous company–wide process to quantify, mitigate and exploit risks, and then use this information to make strategic decisions regarding overall capital needs and capital allocation among its businesses. Dan Hale, Allstate's current CFO, has been an enthusiastic supporter of ERM, recognizing its huge potential by establishing an Enterprise Risk Council (ERC), Allstate's first corporate risk officer (CRO) and a separate ERM division.
There are several advantages to Allstate's ERM approach. First, it allows the company to set a quantitatively based risk/reward threshold across its businesses so that management can better understand the totality of its risks, their interrelationships and their financial implications for the company. Second, it allows management to evaluate how lines of business compare to each other vis–à–vis capital consumption and whether the returns are commensurate with the risks inherent in those businesses. And finally, it provides Allstate with solid new measurements to inform business decision making. Although company executives say there is a lot of work to do, Allstate has already distinguished itself as a successful early adopter of ERM. And while the road to success wasn't always smooth or direct, Allstate has already reaped some significant rewards as a result of its ERM activities.
A successful ERM function will help managers make risk– and capital–related decisions, such as reinsurance purchasing, asset/liability management, risk limit setting and monitoring, and capital allocation and pricing. ERM is not all or nothing–companies can benefit from a practical, "get the basics right" process that starts small, focuses on key issues first and consistently builds value.
Developing an ERM Framework
Not everyone at Allstate saw the advantages of ERM–or even of an EC approach–when the concept was first broached. In 2002, Allstate brought in an outside consultant, Tillinghast, to help the team work through this process. The first step was to develop an Allstate–specific risk framework based on executive interviews and research conducted by the team (see Table 1). The next step was to identify and prioritize Allstate's risks across the organization. A combination of publicly disclosed documents and internal documents was used to develop a list of the company's risks. Once the list was finalized, Allstate's leadership established a collective view on the corporation's overall risk tolerance and the likelihood and relative impact of each of these risks in relation to that overall tolerance. This was an important step in the ERM process because it compelled the management team to reach a common view of the company's primary risks. Doing so required a new level of understanding of the risks, the likelihood of their occurrence and the impact they could have–together or individually–on the company's risk tolerance level. (Risk tolerances can change share price, likelihood of impairment, statutory surplus, GAAP capital, operating income or other measures.)
the top risks were identified, management had to come to a consensus on a risk limit for the quantifiable risks. This led to interesting discussions among risk "owners" and management regarding the potential rewards associated with each risk, the company's willingness to invest in certain risks and certain businesses, and the interaction among various risks. In many ways, this process was key to the development of an ERM mind–set and culture among company leaders, and they began to look at risk more holistically rather than on a risk–by–risk, business–unit–by–business–unit basis.
At the same time, the company worked through the issue of how best to organize around ERM. The role of a new CRO was defined, and discussions were held about the appropriate reporting relationship for that role. The ERC was then created in 2003, comprising the president and COO, the CFO, the chief investment officer and the president of Allstate Financial. The ECR is joined by the CRO, as well as members of the strategic business units that manage the company's top risks. The ERC meets to assess risk across the enterprise. ERC meetings have evolved from more frequent, 90–minute meetings to longer, quarterly meetings that allow time to dig more deeply into complex issues. The ECR's specific responsibilities include aligning risk appetites and strategy; linking enterprise growth, risk and strategy; establishing key enterprise and individual unit risk limits; establishing consistent measures of risk; advising on economic capital and capital allocation; and educating the board of directors on matters pertaining to ERM.
To quantify its risks and to facilitate discussion of them, Allstate developed multi–variate stochastic modeling tools and created interactive visuals to demonstrate the cause–and effect relationship of various risks. The interactive visuals provided a compelling demonstration for Allstate's leadership team to see the effects of changes to Allstate's risk profile (see Table 2).
In 2004, the company "officially went live" with ERM and committed to this quantitative approach to risk management. Allstate appointed a CRO who oversees both ERM and Six Sigma. Allstate believes that Six Sigma is an excellent set of tools to help reduce defects in processes and to help develop future leaders, thereby reducing the level of operational risk. The two processes share a common analytical and quantitative skill set and provide a comprehensive view of both bottom–up process control and top–down enterprise risk. Today, the ERC holds discussions about the amount of risk various areas of business are willing to take on (e.g., catastrophes, interest rate, equity and mortality) and the accompanying risk/reward tradeoffs. This information is used to help set a capital plan for the businesses and then develop a corporate financial plan. Perhaps most important, Allstate's senior leaders can now more effectively function as stewards of the entire portfolio of risks across the enterprise, rather than as owners of the particular risks managed within their respective functional areas.
From Internal Governance to Rating Agency Discussions
Because Allstate has developed its own sophisticated internal risk models and has integrated them into a comprehensive risk framework to drive the company, it has been able to build a solid argument for using its own metrics–rather than relying solely on rating agency and RBC metrics–to determine overall capital needs as well as capital allocations and levels within the various businesses. While Allstate remains very mindful of the rating agencies' capital formulas, EC has now been incorporated into the capital management dialogue with the rating agencies. Allstate initially held a series of discussions and demonstrated its EC and ERM analytics with rating agencies in the summer of 2005. Then, in late August, Hurricane Katrina hit the Gulf States, where Allstate had significant exposure. Because Allstate had been in discussions with the rating agencies before Katrina and was able to demonstrate the outcomes of its modeling, the groundwork had been laid for frank discussions about the company's capital management options following Katrina, Rita and Wilma. As a result of these discussions and strong underlying performance, even in the face of substantial losses, Allstate was able to demonstrate an effective post–hurricane capital management strategy and maintain its ratings.
Risk Mitigation to Value Creation
Much of Allstate's initial ERM work was for Allstate Protection, its property/casualty business, but there was activity in other areas as well. Allstate Financial, the life, savings and retirement business, had invested in its own ERM efforts, primarily through ALM modeling of annuities, life insurance and other products. In addition, Allstate was doing sophisticated modeling of assets on the investment side. For example, in 2005, the Allstate Investment Group partnered with the ERM team to execute strategic asset allocation through dynamic modeling of assets and liabilities.
Also in 2006, the company furthered its work on the top risks by asking risk owners and senior management to develop a list of 100 activities that could result in value creation through their enhanced risk knowledge and experience in the business. The company created a Risk Opportunity Forum, whose members are now in the process of analyzing the suggestions to determine which have the greatest potential. This will take strategic risk exploitation to another level of cohesion and integration.
In addition, the company has plans to repeat its risk assessment survey every two years to ensure that the right risks continue to be highlighted. And finally, Allstate is in the process of upgrading its original models, using more sophisticated software. This change will ensure that the software can keep up with the growing size and complexity of the models, and that finance takes advantage of tools available to help facilitate organizational learning and decision making.
The End of the Beginning
After four–plus years of dedication to the ERM process and framework, Allstate is nearing the end of the beginning. Or as CFO Dan Hale says, "We've only scratched the surface" of ERM's potential.
Allstate's experience suggests that ERM is a process that develops over time and changes as a company's goals and risks change. Quantification of enterprise risk, comparison of assets and liabilities within and across businesses and an understanding of the business's natural hedges are the keys that, ultimately, allow a company to further reassess its business strategy and capital needs.
Once the company developed a way for business leaders to understand and use the models, they started to appreciate the models' capabilities and to ask more of them. Allstate's leaders were able to better understand how they could best fulfill their external obligations, such as debt payments and shareholder dividend payments, with a quantifiable degree of confidence. They were able to develop more complex risk mitigation solutions and to take calculated risks as long as the company was properly rewarded with an acceptable level of volatility.
Allstate's continued success with ERM requires that senior management embrace ERM and commit the time, rigor and resources necessary to the task. Allstate has identified seven elements that are critical to ERM success:
- ERM owners must demonstrate the long–term value of ERM to management and other key constituents even if all the elements are not built out.
- The ERM team must have:
- a thorough understanding of the organization's strategic needs
- access to relevant data
- a talented staff with the requisite skills.
- The organization itself must have strong underlying processes and systems.
- Management must create transparency and alignment for ERM and continually strengthen support for the process.
- Risk/return thinking must be embraced and leveraged at all management levels.
- A holistic view of the business and operating risk portfolio must be reinforced.
- The company must continually ask itself whether it is being adequately compensated for its risks and whether its risks are within its overall risk threshold.
Michael E. Bond, is a director of ERM for The Allstate Insurance Company in Northbrook, Illinois. He can be reached at 847.402.5228 or mbond@allstate.com.
Jeanne M. Hollister is a consultant with Towers Perrin in Hartford and the North American Property/Casualty Insurance Practice Leader for the firm's Tillinghast business. She can be contacted at 860.843.7055 or jeanne. hollister@towersperrin.com.
J. David Dean is a senior consultant with Towers Perrin in Atlanta. He can be reached at 404.365.1705 or david.dean@towersperrin.com.
This article was originally published in Tillinghast's Emphasis (2006/3) magazine. Reprinted by permission of Towers Perrin.
A Conversation with Tom Wilson, CEO and President, The Allstate Corporation
Tillinghast Moderator: What were Allstate's expectations when ERM was first introduced?
Tom Wilson: At the outset, we didn't even call it ERM. The insurance business allocates capital against risks every day, one policy at a time. The typical practice is to allocate capital "in bulk" within an individual line of business. Other industries, like manufacturing, use different economic models to calculate expected returns on investment. We recognized that we needed to have a comparable process for the insurance business, with a set of common analytic constructs that people could understand and use in their decision making. We saw an opportunity to use more sophisticated analytics to look at risks individually and across businesses simultaneously, so that we could answer questions such as: How much capital do we need to write a personal auto policy? What is the trade–off between writing an auto policy in one state versus the other? How about in comparison to writing homeowners? Or in comparison to increasing risk in our investment portfolio? We knew that, to answer these questions, we needed to better leverage and expand the way we manage, analyze and utilize our data, so that's what we set out to do.
From the start we were mindful that risk analytics can easily lead to risk reduction exclusively. Using the tools we've developed for ERM, we can increase exposures to risk where we see benefit and opportunity and economic return.
Moderator: How does Allstate's ERM process create value?
Tom Wilson: It has helped us optimally structure our investment portfolio. We do sound asset/liability modeling now, but I believe there are opportunities for us to identify ways of intelligently taking on more risk. Most insurance companies are good at managing risks inside the shape of a normal distribution of outcomes. The differentiator is how well they manage risk for low–frequency, high–severity events. One example worth mentioning: Though we don't insure for earthquakes in California, ERM helped us identify tail risks associated with fire following earthquake exposure. We were able to take measures to protect against this type of event through a combination of reinsurance and rating/policy changes, and our analysis also led to insights that had a bearing on our underwriting criteria for insuring property in California.
Moderator: What are the most important lessons that the organization has learned in implementing ERM?
Tom Wilson: Good question. First, you need to have good people who have the analytical skills and wherewithal to do this. You should also be prepared for bad data when you start. It's just a fact that it will take time to clean up the data to get it ready for ERM analysis. You also need to be patient when looking at the model, especially with low–probability risks, and put the analysis in context of what you know.
Moderator: If you had the opportunity to start with a blank slate in establishing ERM for Allstate, how would you go about doing it?
Tom Wilson: If we were to start over, we would do two things. First, we would start building a data warehouse at the same time that we started building the model. You may not know what data is going to go into that warehouse or if that data will be utilized, but you will need data to perform ERM, so it's easier and faster to start the warehouse right away. Second, we would spend more time creating demand for ERM among the business units. You need to educate people about the benefits–show them how this will help the organization, and ultimately them, in doing their job better. And you need to change the incentives and measures you use in evaluating people so that it is consistent with how ERM is being utilized.
Moderator: Some people are skeptical about the value of ERM. What would you say to them?
Tom Wilson: You should no sooner get into your car blindfolded and start to drive than you should take risks running your insurance business without using an ERM approach.