Over the past decade, insurers have steadily increased their focus on enterprise risk management (ERM), allocating more resources to build these functions and embed risk-management principles into their strategic decision making. Nevertheless, the industry has concurrently experienced relatively benign conditions--including a slowly and steadily improving U.S. economy and--more importantly for property and casualty (P/C) insurers--a void in major natural catastrophes. Absent a major shock to test the improvements in ERM practices, it was difficult for S&P Global Ratings to assess the effectiveness of these programs and their ability to preserve long-term viability and drive performance in a stressed environment. However, the named storms in 2017 provided a test not only to the resiliency of capital (alternative and traditional), but to the effectiveness of ERM. Although devastating in nature--especially as certain regions still have a long road ahead for recovery--these events present an opportunity to assess insurers' ERM programs and controls, and how they perform during a time of stress.

ERM is a supporting pillar of our rating analysis, and partially shapes our view on how management allocates capital, monitors aggregations, prices and reserves the business, develops and controls tolerances (both underwriting and investment), and creates a structure to plan for the unexpected. Our assessments include very strong, strong, adequate with strong risk controls, adequate, and weak.

Assessing The Effectiveness Of ERM Controls

Actual losses versus market-implied losses

To assess how insurers in our rated universe held up through the events of 2017, we attempted to calibrate the outperformance/underperformance of actual loss relative to market-share loss expectations by primary insurers based on our assessment of ERM. We pulled premium figures for insurers for catastrophe-exposed lines of business in regions that were affected by the 2017 events to derive an estimated market share of total 2017 catastrophes. We then took the actual losses that the insurers experienced and compared these to expected figures by ERM assessment bands. Although we recognize that the market-based approach may not be granular enough to drill down on the exact areas affected by these events, this bias affects all insurers and in fact, those with better underwriting and aggregation controls would still be reflected in the results. Although there is only a slight delta between very strong/strong ERM and adequate with strong risk controls, there is a significant difference between those that we assess as adequate (see chart 1). We would expect insurers with adequate ERM programs to post results similar to industry expectations, whereas we should see better results for those with stronger programs.

Chart 1

The slight delta between our very strong/strong and adequate with strong risk controls categories implies not much differentiation between the categories, but this is still consistent with our expectations. With this analysis, we are only capturing the strengths of an insurer's ability to manage catastrophe and underwriting risk controls, which we tend to view favorably for P/C companies with strong risk controls. Given our view of the strength of these controls, similar results are to be expected. These metrics are still subject to loss creep as claims are still being sorted through, but we believe directionally there will be little to no change and in fact those with a stronger ERM program would be able to address claims more efficiently and reduce exposure to adverse development.

Stock Performance During Storm Season

Another factor we monitored was the market's implied reaction to these catastrophe events. We measured this by tracking the stock performance throughout the storm season and comparing it to the returns of the S&P 500. We chose to use an equally weighted index for the returns of each ERM band and limited the analysis to writers exposed to the storm events that were not affected by any merger and acquisition activity, so as not to skew the results. Primary writers for which we identified ERM programs as strong or adequate with strong risk controls were oversold at certain noticeable news points, but recovered and ended up outperforming primary writers for which we assessed the ERM program as adequate from Aug. 15 to Feb. 28 (see chart 2).

Chart 2

However, for reinsurers the story is much grimmer. Many reinsurers never fully rebounded because of greater exposure to Florida and Caribbean natural catastrophe risk and headwinds the industry continues to face. The resilience alternative capital demonstrated through its first major natural catastrophe test and the lack of rate increases for renewals--even for affected coverages—also hurt the reinsurers.

The reasons for greater market recovery for the stronger ERM programs were mainly market confidence in the risk-management program, timeliness of updates, and transparency about exposure and expected losses to the market. For the less-sophisticated programs, resources, quality of data, and timing seemed to lag and be less robust, creating more uncertainty as to the extent of the impact from these events. Stronger ERM programs show lower levels of volatility, which gives the markets more confidence in recovery efforts and insurers' ability to take advantage of displacement in pricing after an event.

Effect Of ERM On Long-Term Stock Performance

Although 2017 gave us a few distinct examples to assess the strength of an ERM program, to understand its long-term value, we continue to look at the relationship between ERM assessments and stock prices, which we use as a proxy for company performance. There is an inverse relationship between our ERM assessments and the average level of stock-price volatility, which again highlights our view that strong ERM practices stabilize earnings given their preparedness and ability to whether adversity to their businesses (see chart 3).

Chart 3

ERM is made up of a family of processes and practices whose purposes are to measure and manage risk, thereby limiting volatility of results. Companies with more-robust ERM programs consistently gauge and communicate their risk profiles to investors and other stakeholders better than their peers with less-robust programs. Such companies also seem better able to manage their risks within stated tolerance levels. Therefore, companies with stronger ERM programs are in a better position to manage capital needs and earnings volatility than are those with less-robust programs.

ERM 2018 And Beyond

2017 provided a litmus test for whether past efforts to improve the resiliency of ERM programs provided the anticipated value, but it also opened eyes as to risks and needs ahead. Although programs held strong during the 2017 events, if Hurricane Irma were to have had a slightly different storm track, the industry would more than likely be singing a slightly different tune. Furthermore, as the California wildfires highlighted, as the industry runs to compile data, build more models, and implement them, sometimes the results of these tools do not always reflect what actually could happen. Thus, as insurers continue to make technological advances, become more reliant on data-driven results, and innovate new products for the evolving risk landscape, an ERM program takes on greater importance as the industry navigates risk management with innovation.