Miss S. D. Elliott, F.I.A. (the Chair): I welcome our two authors, Mr George Orros and Mr John Smith, and all of you who have come to participate in this event.

Mr George Orros qualified as an actuary in 1973. He then acquired several other professional and academic qualifications, partly in order to move from the “back” room to the “front” room of the insurance and financial services world. Having spent many years in the healthcare insurance arena as Actuary to BUPA, he moved into actuarial and management consultancy with a global firm. In the early 1990s he founded a specialist consultancy firm in the health and care insurance, innovation and risk management space, initially in London and then in the Channel Islands. This summer he has taken on a leadership role with a global risk management and advisory firm.

Mr John Smith is Group Chief Actuary at BUPA, where he has worked for a little over four years, and is preoccupied with the actuarial, risk, capital and finance challenges of Solvency II, but also supports BUPA's strategic and organisational development interests. Prior to joining BUPA, Mr Smith worked in the UK life branch of Munich Reinsurance in London, and before that worked in the United States, first as an associate actuary with Milliman and then as an assistant actuary with Nationwide Insurance. He is a member of the Society of Actuaries in the US. He holds graduate degrees in mathematics and in epidemiology, and has completed additional coursework in population health.

Following the traditional format of a sessional research meeting, Mr Orros is going to provide the highlights of the paper and then I am going to provide my opening comments as to what I feel are the key messages coming out from the paper. Then we will open up the floor for discussion and finally Mr Smith and myself will close the session.

Mr G. C. Orros, F.I.A. (introducing the paper): The paper is wide ranging. It is not a technical paper and is almost devoid of mathematics. One of the key messages is that ERM for health insurance should essentially be about people and teamwork. It is about fully embedding ERM principles into the corporate culture and to encourage the stakeholders, which includes the employees, to develop their ERM for health insurance DNA and to have the confidence to believe that “we are all risk managers here.” It is not a “one person thing”; it is about teams and teamwork.

Health insurance, as we have described it, has both a long-term and a short-term dimension. If you mismatch these two aspects, either strategically or in day-to-day decision-making processes, that can and probably will lead to a wide range of difficulties.

For example, under the Solvency II regulatory requirements for business, which is for a one-year value at risk calculation based on a 1-in-200-year event, that may be a necessary success criterion but it will certainly not be a sufficient criterion for the long-term viability of the health insurance undertaking, given all the long-term aspects that are relevant for people purchasing healthcare insurance products. Rather, you have to look at it from the point of view that healthcare insurance is not like other short-term personal insurances. For example, motor insurance or travel insurance focuses on events in the policy year (or the month if it is renewed monthly) whereas health insurance focuses beyond the first period because people do not purchase health insurance products just to have the cover for only 12 months. They are looking, it is hoped, to stay for a very long time – maybe for decades, maybe for a lifetime.

So what really matters to achieve profitability, given the high acquisition costs associated with certain personal health insurance, is having excellent customer service and high retention levels, partly in order to encourage people not to go somewhere else. By and large, they buy health insurance when they are fit and healthy, expecting that, sometime later when they are not so fit and healthy, the health insurance company will still be there and ready to provide a service. This also comes back to some of the regulatory points about capital, and the aspiration that the insured will not be discriminated against, that they will be treated fairly, and that they can trust that the health insurance company has integrity and transparency and it is really there to look after them many years after they made their initial health insurance purchase.

So, this business should really be about trust and reputation, rather than just what the lowest price is for the next 12 months. That is a somewhat different situation from somebody buying personal motor insurance, travel insurance or accident insurance, where there will be different considerations. These different considerations should result in a different way of thinking, if there is going to be a reasonable chance of succeeding to have a profitable health insurance operation.

The second point is the health insurance company needs to be resilient whatever the future holds and to have a roadmap as to how to achieve that, given the very complex nature of the business.

In order to do that, the business model needs to be clear, not just the model of the health insurance company but of its partners and its suppliers, because, as far as the public is concerned, what matters is the whole operation – the “brand.” It may be that failure to meet customer expectations is caused by a supplier and not by the health insurance company on their own, but that still damages the customer and he/she will still associate the “brand” with that failure. So the business model should be more like “supply chain management”, rather than just about selling cheap personal lines insurance.

This is where ERM comes in, because the business should be looked at holistically with all the business decision levers applying to all the product and service aspects that might go well or badly.

Coming on to enterprise risk, a definition is:

“ERM is a systematic process, embedded in the company's system of internal controls (spanning all business activity) to satisfy policies affected by its board of directors aimed at fulfilling its business objectives and safeguarding both the shareholder's investment and the company's assets. The purpose of the process is to manage and effectively control risk appropriately (without stifling entrepreneurial endeavour) within the company's overall risk appetite. The process reflects the nature of risk, which does not respect artificial departmental boundaries, and manages the interdependencies between the risks. Additionally, the process is accomplished through regular reviews, which are modified when necessary to reflect a continually evolving business environment.”

Therefore ERM is not about “departmental silos”, it is about the “whole thing”.

Figures 21 and 22 in the paper show some of the common internal and external sources of risk. This particular version of the external sources of risk was constructed about five years ago. There have been many other external risks since that affect a complex business model like health insurance. For example, the global financial crisis and current Eurozone crises with the collapse of some currencies have severely affected all insurance companies. These events may affect supply relationships and people's trust in currency over the next 20 to 50 years in which they hope to retain their health cover.

“Medical inflation” and the external effects of that, particularly now with the cutbacks in public services and the likely shift between the public and the private sectors, will lead to offloading some healthcare risk from the state to insurance companies. How is that going to be factored in? What about climate change and how that may affect risk over the next 20 to 50 years? This might be relevant when considering future treatments. What about all the “green” issues in terms of energy usage and other factors? Health insurance is long-term, maybe 20 to 50 years. These things matter when trying to think through what needs to be done to enable the health insurance company to survive and prosper over that length of time.

The world is constantly changing, particularly in the health and care field. Decisions taken now might be regretted in 5 to 10 years from now, in terms of how the business model was set, guarantees given, renewal of health insurance policies, medical advances; and to what extent the company is tied into any of these. It could be argued that the company has to be aware of what is happening in the outside world in order to have any resilience and robustness in the health insurance undertaking.

More recently, with the “age of austerity” in the UK becoming a major theme, healthcare insurance spend in the UK, currently at about 4% of the total health, is being affected. It is necessary to look at the business processes behind changes and the stresses within those in order to be able to manage the business. Part of that involves considering what are the value chains within the business, both for the insurance operation but also the suppliers and the supply chain management behind that. If the heath insurance business model is to be understood, it is necessary to think about managing the “risk,”, reducing the volatility, or improving the resilience, and how these fit together.

Figure 10 in the paper sets out a typical value chain for a health insurer and the following diagram helps summarise the various things to think about and do well in order to establish and maintain a profitable business.

Diagram 1

Modern Risk Management in Health Insurance

Healthcare provision is even more complex, as illustrated by Figure 31 in the paper. That figure shows how things fit together and what the role is of the insurance piece within this bigger picture – perhaps 96% of the total is not health insurance. The business process flows shown there may well affect what happens in the health insurance piece.

Risk management and ERM are not new in the healthcare provision sector. Increasingly, more and more risk management is being carried out on the health provision side, particularly in terms of clinical governance.

Figures 15, 16 and 30 in the paper show a common layout for a “risk heat map”. This form of map helps identify the relative importance of risks. Those risks positioned in the “red” or “extreme danger” zone mean that the business cannot tolerate those events. There are some events in the “green” zone that are really not significant and you should wonder why you are spending management time on these within the insurance operation, when instead they could be outsourced somewhere else.

You have to look at the “before” and “after” situations on the risk heat map. Firstly, what was the situation before you took the business plan action? Secondly, what is the inherent residual risk after taking the planned remedial action? That is, what you think is achieved by having taken those actions?

Management spend time worrying about anything that is positioned in the “amber” zone or the “red” zones. You have to have very good reasons why, given the inherent residual risk, you should tolerate risks in the “amber” or “red” zones that appear to be uncontrollable.

On a more holistic basis, it is not just about downside risks. The counterpoint of risk control is opportunity management. There may also be an upside. The process to identify risks can also identify opportunities that should be taken up. So one can try to position the opportunities as well as the risks, in order to plan the business and to survive and prosper.

The Risk and Opportunity Management Framework is summarised in Figure 6 in the paper and replicated here for convenience.

There are many underlying elements described in the diagram. ERM can and should provide a holistic view of the enterprise. ERM can and should be an iterative process with many feedback loops that are interactive. The arrows show the process. You can see there is no point in continuing from, say, “analysis” to “identification” unless you are happy that the initial “analysis” made some sense. Otherwise, you are building spurious models and actions. If you do not trust stage two from stage one, then you had better go back and do it again. When you get to the end of the process of risk management, you are making decisions in real time. If you do not have confidence in the underlying models or the underlying analysis that gave those models, then you are never going to implement it and then the exercise is totally pointless.

Diagram 2

Risk and Opportunity Management Framework

Having gone through the process and come out the other end with a sensible ERM framework for dealing with risk management issues that come up, there results in effect a “real time” risk dashboard.

Figure 23 of the paper shows real time risks for a health insurance company as dashboards. If you are in charge, either the CRO or the CEO, and the health insurance company has fully implemented Solvency II then you will need to ask:

If you think about it that way, then it is common sense. You have to have confidence that the risk dashboard and the dials actually mean something, that means the underlying model must mean something, and you are going to rely on it.

Moving on through the paper, we talk about Solvency II. There are many technicalities as to what the current situation is, and many diagrams based on the current thinking on Solvency II. One observation made towards the end of the paper is that the solvency regime has a specific aim. It is looking at the health insurance company on a 1-year basis for a potential 1 in 200 year risk event, and trying to ensure that on that basis the company is going to survive.

However, on the health insurance side, this may be inconsistent with how the business model really works, and stress testing over a longer period of time may be necessary. Also, there is the issue about the customers and their risk appetites, and the risk appetite of the health insurance operator hopefully trying to survive more than one year. That is going to have an impact on how you run your business model and how much capital you hold, and everything else.

What comes out of this is the realisation that although quantitative risk modelling is a necessary condition for financial survival and for regulatory approval, it is not, and never can be, a sufficient success criterion. The qualitative risk modelling aspects, which include corporate governance and all the people issues, are fundamental.

The other point to make is that past observation may be very misleading. To take a well used example, consider the turkey's experience prior to Thanksgiving Day in the USA. For a thousand days, these nice humans look after it, feeding it and making it comfortable, yet the thousand observations do not mean very much if you look at the whole picture. We also, like the turkey, might only have a small window in our universe. It may be totally misleading because we only see the bit that we can through the lens that we are given.

The theory of the black swan is basically saying that the world is full of discontinuities, that there is not such a thing as equilibrium and we move from one discontinuity to the next. Then we post-rationalise the past events that are unexplainable. You have to be prepared: you have to expect the worst and have some resilience so that whatever the world throws at you, you will be a survivor.

Our paper concludes with the words of Lao-Tzu, who 2,600 years ago knew all about ERM and the importance of people and team work. It is only in recent years that the health insurance world, and other financial services institutions, have woken up to these pearls of wisdom. Let me quote:

Miss S. D. Elliott, F.I.A. (the opener and the Chair): The phrases that struck me when reading the paper were “unknown unknowns”, “known unknowns” and “known knowns”. This is a great way to describe what we are trying to do in this field.

There are lots of opportunities for healthcare actuaries, especially with the advent of Solvency II and the developments which are going on, given the complexity of health insurance risk. The paper states that to date non-actuaries have populated the field of risk management and enterprise risk management. It is a discipline that we can get really involved in.

The paper discusses healthcare management, focussing on the quantitative as well as the qualitative. It talks about ERM framework models, COSO, which model seems the most appropriate. It is about constantly identifying risks and monitoring the most important ones. There is no sense in monitoring the ones on the bottom left-hand corner of the risk heat maps, which are too easy to do and maybe we should outsource them as Mr Orros suggests.

Then there is the culture of the organisation. The aim is not just getting the model in place but ensuring this works across the organisation.

There are two points I wish to add as an ex-reinsurer. First, analysis is the foundation. There is no sense in having that first step wrong as the rest will fall apart. In particular, before that stage, the data for analysis needs to be credible, as it is unhelpful to shift towards very complex modelling solutions when you do not have the appropriate data.

Second, we need to identify the combinations of multiple risks. This is key to healthcare given that we have both internal and external sources of risk. In healthcare we have the NHS and what could happen there, what could happen in a pandemic, and things like that. I do not think that there is any other product that is more involved with different internal and external sources of risk.

Catastrophic risks also need careful consideration. Mr Smith and I were on a CAT risk task force for CEIOPS and Solvency II. This was interesting because putting CAT risks together in non-life businesses is very complicated. There were so many things to think about. At times we were having difficulty coming up with what CAT risk there could be for healthcare, but we eventually came down to a simplified CAT risk model, as the NHS A&E picks up emergencies in the UK.

The ERM frameworks for dealing with “expecting the unexpected” are discussed in section 2.24 of the paper. Mr Orros mentions the Black Swan logic in section 2.26. I thought that was quite interesting.

In section 3 of the paper, treating practical examples of risk and opportunity, the authors consider under 3.4 the risk matrix, R-W-W, that is asking the questions, “Is it real? Can we win? Is it worth doing?” That is a good theme to consider. I note that this extended to consider a holistic approach looking at the quantitative and qualitative aspects.

The innovation portfolio was helpful, covering product development and adding new features to products, whether to manage risk or add new product features to help the market position. Showing how you can move from risk control to opportunity management is a very positive message and shows the process is not all about the negative side but also where the opportunity is.

In section 5 the authors address Solvency II for healthcare insurance, promoting capital and risk awareness, which has been a big challenge for the industry, not just in the UK but across the EU. We have tried to harmonise insurance regulation across the EU. However, we realised fairly late that it was not going to be easy to harmonise the products, as they vary from country to country, and different products have the same name in different countries.

At least as the Actuarial Profession we have been able to help with the consultations and encourage risk management, transparency and market efficiency. The issues are about risk-based capital and the overall risk management of the business portfolio.

There was much debate about the names and the categorisation of the whole healthcare module. The authors summarised it very nicely, covering SLT and non-SLT in paragraph 5.2.4.

At one point the new regulations were going to treat healthcare all under life, and then some healthcare under life, some under non-life and some under the catastrophe risk element. We negotiated a separate healthcare module.

For non-SLT, the authors summarise the transition of the premium and reserve factors for the non-SLT component for the PMI and how that has developed over time. There may be some questions you might have for the authors as to how that has moved over time, and the ups and downs that it has had. I am sure it is going to continue.

The biggest message of the paper is in one of the concluding remarks, which may cause some debate. The ERM frameworks are much more complex for healthcare than for life and for non-life, that being due to the internal and external risk factors, combining with quantitative and qualitative, and also introducing the public sector into it.

Those are my initial thoughts and I now to open it to the floor for further discussion.

Mr R. H. Plumb, F.I.A.: I am now an academic at Cass Business School. I lecture on health insurance but also life and pensions. I am going to deal with four points in a very good paper.

The first point relates to subsection 2.13 (paragraphs 2.13.1 to 2.13.10). This treats analysis and getting the right information and it has been referred to by both speakers this evening.

Years ago, before even perhaps the phrase ERM was invented, I had this task in a different business life – in essence to try to get hold of some of the problems faced by my employer at that time. I could be used because I had worked with most people and had their confidence to be able to be told their real secrets, the real bits of dirty washing. Some of problems I could guess. One or two I got near by the guesses and, as they trusted me, out came the whole story.

I am very concerned about whether actuaries generally have that type of training to get at all the information. The Actuarial Profession is extremely good, once it has got the information, in analysing it. I seriously wonder whether this task should be undertaken by a multidisciplinary team: an actuary who has the mathematical expertise, analytical and everything else, coupled with somebody who is suave, who can actually gain the trust of people, ask the right questions and get the complete answers.

Actuarial investigations are like my late father's interrogation. He was a senior police officer and, while I was used to his style of questioning, everybody else who came into the family found it extremely difficult to deal with. I suspect that might be the case with actuaries in the early years of doing this.

I would welcome the views of the authors and welcome views from other people. It is dangerous for actuaries in the early years to go on their own rather than as part of a team.

Mr Orros (responding): The point throughout the paper is that you are building foundations, and, if the data is inappropriate when you get to the analysis stage, there is no real point carrying on. More importantly, when you get to the next stage – trying to identify risks and put these into a risk register – you may find that there are questions raised over the initial work that was done. The only solution then is to go back and to redo it and to put in the extra work, because what you are really building is the trust and integrity of the whole system. Unless the model represents the real world, it is a pointless exercise and is of no benefit to anybody.

Mr Plumb: I will move on to my second point.

In paragraphs 5.3.5 to 5.3.7 of the paper presents an analysis of BUPA, an insurance company that has declared some of its experience. In recent times, authors have tended to produce papers and analysis not using their own data. Some of the great actuaries from the past used to say, “I am aware of an office” and then produce their office data and say, “Well, we have found so and so”. Long may this type of approach continue.

I would urge people to quote their company's data, with some qualification if necessary. By doing so, and bringing that to the table, I have found in my business experience that I learnt far more than I gave away. I may have given information but I learnt far more in the process.

May I pass on to my third point. There was a remarkable landing on the Hudson River in New York very recently by a skilled pilot. That was down to sheer experience on the back of years of flying. We have got to be careful if we are flying on four engines that we do fly on four and not on two. We are at the beginning of the process and need to be careful as to what we try and do. It is not appropriate to build a model claiming to be an absolutely super model to start with. Current models should be treated as an indication of where we might go to.

Mr Orros (responding): I would like to address where we are by commenting on the risk dashboard. This needs to be simple enough so that you understand it and/or avoid redundancy. If you read a lot of management writings from the famous companies, particularly about General Electric maybe 20 or 30 years ago, there would be reams and reams of business plans and reports and glossy presentations, and all the rest of corporate planning. And then they threw it all away and said, “What we want is simple storyboards that can explain your proposals and your requests for investment on about one or two sides of paper, preferably using pictures. And, if you cannot have a storyboard using visuals and pictures explaining why the investment really is a good idea, then we are not even going to look at it because we would be blinded by having your 200 page business plan report. Furthermore, if you cannot express the business investment proposal in very simple terms, perhaps via a simple risk dashboard that is sufficient but is not distracting, then you are in no position to manage the organisation or to be in charge of risk.”

So the question is: what is going to help you to sleep at night? What do you want shown on one sheet of paper that you are going to look at every day that is going to help you to say, “I have looked at enough to actually make decisions. I do not want to see a 200 page report. I want to see a few pictures on a storyboard and/or risk dashboard and everything has to mean something.”

Dr D. J. Hughes, F.I.A.: I thank the authors for this very helpful paper. I showed it to a non-actuary who works in insurance, and he commented that he never knew actuaries wrote such useful, clear and helpful papers.

There was a phrase mentioned in the authors’ introduction of the paper this evening that struck home with me: “We are all risk managers now”. This is very useful to bear in mind in discussing all sorts of scenarios.

You emphasised working in teams. There is one very important role in a typical health insurer that should certainly be involved in the team because they have been doing this for years, and that is the underwriter. Underwriters have said as much in this hall. I hope their time has come. An underwriter probably hits the ground running as far as these sorts of issues are concerned.

Section 6 of the paper made me pause. It seems to hint that health insurance may not be long-term, but it nevertheless has horizons which extend beyond the short-term. There is something for us all to think about here. A phrase that comes to my mind is “policyholders’ reasonable expectations”. What are their reasonable expectations with regard to a product which might not be wholly short-term? Another phrase, “treating customers fairly”, has not come up yet.

There are many circumstances where promises have been gradually extended. Insurers have gradually been assumed or asked to offer or promise just that little bit of extra reassurance going forward, which has often led to problems. It may be possible to offer some sort of longer term health insurance, but I am sure it will be very expensive. This is not just a question for insurance companies, but also for those who sit on regulatory or advisory committees. The authors say in paragraph 6.3 of the paper that perhaps the supervisor would seem to be indifferent about this aspect. I probably have not understood what was meant here, but it seems to me odd that the supervisor might be indifferent to the extent of the forward horizon of a contract which is perhaps not purely short-term. Perhaps I can invite you to develop that theme.

Mr J. Smith, F.I.A. (responding): The second and third points are closely related.

There could be conflict about what “indifferent” means, because it seems, if the supervisor is focusing on the short-term, this tail risk in the short-term (by the strict definition of what is on the balance sheet), is a 12 month contract, and they are saying, “Gosh! That brand! Long-term loyalty, we appreciate it, but it is not on the balance sheet.” So it is not really exposing this customer to risk but is the heart of doing business, affecting business decisions and the value chains, supply chain, distribution. It is essential; it is at the heart of the matter, but I could see them not necessarily getting it.

Solvency II might not be as robust as we want it. It has to be “not one size fits all” but flexible enough to accommodate all businesses. If you have health insurance which is not quite fish or fowl – it has features of long-term and short-term business – it does call into question many fundamental things that would be taken for granted as supervisors try to get a handle on all of this and manage general insurers, non-life insurers and life insurers. “Indifferent” is probably in the sense that “we are ticking that box on the tail, and I really do not understand the stuff about the long-term nature of it”. So I am not trying to say that they just do not care; I am sure they care, and in due course will understand the nature of the liabilities.

The Chair: On the same point, the supervisors have also got to contend with actual true long-term health products as well as more protection products and not get confused.

Mr Smith (responding): The supervisors will get to know what it means and what is most valued. What are the key decisions that management takes in health insurance? What are those disaster scenarios? What do they really look like for the testing regime that just came into effect in December and is anticipated in Solvency II?

We can think about reverse stress: what is it that will lead to a health insurer failing? The answer would describe in detail what would go wrong or what combinations of things.

If the supervisors really pursue that, and encourage firms to do that and get into the detail then the management, including the non-executives, would not be indifferent. If they truly believe in this stress test, it is going to pick up the limitations on the short-term focus that the SCR has been calibrated to, including the CAT module. The CAT module has a 12 month focus as well, even though most catastrophes for a health insurer probably unfold over a longer period of time. It depends on how they approach it. It might take several years before the spirit of that and what it means gets into the dialogue between the supervisors and the management boards in a meaningful way from an ERM perspective.

The Chair: The other unanswered question is about working in teams, especially with underwriters. I know that the answer again is going to vary between a short-term writer and a long-term writer. Long-term we tend to have been involving underwriters because of the medical aspects of the product.

But any comments from the authors or the floor about involving underwriters in ERM?

Mr Orros (responding): If you can have a team of professionals that respect each other, albeit with different backgrounds and different professional experiences, it can only add value. It does not matter if it is an underwriter, a doctor, a nurse or the government administrator. Healthcare is a very complex subject. The more you can understand where everyone is coming from, and everyone's business models, and that of the supply chain, the better the decisions that the health insurer is going to be in a position to make. If underwriters have something to say that others are not saying, then they ought to be listened to.

Miss E. A. Howell, F.I.A.: I read the book about black swans and wonder if you have built things like dashboards that look at the risks that you are managing on a day-to-day basis, do you end up missing out on the black swans which are not easy to put on the dashboard? How do you actually envisage a black swan? The whole book seems to be very much about unknown unknowns, so how do you actually guess what the next unknown unknown is because, by definition, it is unknown?

Mr Orros (responding): The important thing is to appreciate that, in the real world, discontinuities do happen. Therefore, if you are going to serve the public as a health insurance company, they expect you to be there for the next 20, 50 years, or even 70 years, whatever the future throws at you. You certainly do not want to put all your eggs in one basket. You will want to be a survivor.

That means making small bets on many different things. If you look at other industries and how they do this, there are a many good examples. If you are in oil, mining, or other exploration or energy industries, they do get disasters and you can learn from those disasters to say, “What would you have done had this happened to you?”

For example, there was the BP Deep Water Horizon incident most recently. As the press stated, that incident was badly managed, at least in terms of how the company management dealt with the emerging ecological disaster. I understand that some other energy groups around the world, as soon as the BP disaster happened, spent the next three months or so with large research teams analysing exactly what happened, what was the process, what was the sequence, what would they have done in exactly the same circumstances, and how comfortable are they that had it been them they would not have made the same mistakes. I understand that they believe that they would have survived. Some boards of energy groups came away saying, “We are satisfied that if it was us, we would have done things differently and would not have got into that situation.”

In summary, you have to have a crisis team which is able to respond whatever you throw at them. That means training, stress testing, having workshops and management retreats to throw unexpected events and seeing how you cope with them as a team.

There has been much work in the area. Many major companies do this as a matter of routine to prepare themselves for the worst. The more that can be stress tested in different scenarios, the better.

I have chaired some groups that have looked at company failures. It is always a combination of events that cause failures. It is never pandemics or frequency of claims. It is generally bad management or bad reaction to reputation loss. It may take you 50 years to build up a reputation. You can lose it in a few days quite easily.

You can learn from those situations. You need to go through case studies of imagining that you were that company: “here is the news, please react”. Let us see how you behave. It is hoped that you learn from the process.

Just one anecdote: the most famous case of a company that lost its reputation in about five minutes was Ratner's, the jewellers, where the chairman was cracking jokes in an after-dinner speech and made two jokes about Ratner's products, but it cost the company about £500 million in about five minutes. Even though it was just two jokes at an after-dinner speech, the company disappeared. You can very easily lose reputation and it is very hard to rebuild it afterwards.

You need to learn from these situations and play them through in real case studies and say, “Please react; please behave as if it was you”, and, it is to be hoped, when it does happens to you, you will have learnt from that case study.

Miss Howell: I agree with all of that. I would be interested to know what your thoughts are about planning in advance. Learning from hindsight is a little bit of the black swan example. People can rationalise after the event, believing, with hindsight, they would have known what to do.

But we should not always just be trying to think with hindsight. It needs to be something a little bit more forward looking than that, surely.

Mr Orros (responding): As I said before, that is why the board should have non-executives on it with diverse experiences and, it is to be hoped, between the board's experience, there will be enough different backgrounds, and strong characters, so that you think of more situations than otherwise.

People invest in the wrong things. What you think is risk management in terms of protection, when you look at the losses after the event, are never what you expected them to be. If you read Professor Taleb's book on the black swans, he did consulting work for a casino in Atlantic City where they had spent several hundred million dollars over a ten-year period trying to protect the casino from losses, and they had invested hundreds of millions in terms of CCTV, checking the background of the croupiers, all sorts of stress testing on that, expecting the losses to come from internal corruption, basically from insiders.

What he found was that the investments they had made in security to protect themselves against losses accounted for less than one in 1000 of the actual losses which took place over 10 years. What happened was they had three or four major losses, none of which they had predicted.

The unexpected happens and you just have to be wise enough and diverse enough to look at all the examples and say to yourself, “Let us learn from what happened to that competitor of ours.”

Mr A. J. M. Labram (student): A lot of what we have discussed here about the unexpected does not seem to be within the ERM framework. You cannot plan for them. Isn't it a waste to spend a lot of time running through scenarios trying to find out how you would prevent these unpreventable situations?

The other question I have is that the other risk of running through a lot of scenarios is you get paralysed by all the extreme tail risks that could conceivably crop up.

I am reminded of “medical student syndrome”, where the medical student reads a huge textbook full of every known disease and suddenly concludes that he has at least half of them and panics. Is there a risk of companies overdoing the risk management, particularly on the tail events?

Mr Smith (responding): The paralysis response I can see coming more and more as people develop ERM. That was close to the point we discussed earlier. All this risk is going to make us more prudent, if we just can get our heads round it and think about it the right way. The other side of your question is: is it actually going to make us believe that we understand things better than we do?

I guess that is what effective ERM does. It allows you to put together what you think is your best guess and how you manage the slight swings around that best estimate versus these real things which you should anticipate or understand to allow you to build a more responsive culture. That is the trick about being a good risk officer: you to see more dynamically how to manage what your overall exposure is, even if you cannot fully understand it. Over time it would allow you to survive more shocks that you just cannot anticipate, or big ones, or combinations of those.

Mr Orros (responding): Bear in mind that an organisation is only as strong as its weakest link. Therefore it is hard enough to get things right in a very volatile world. It is easy to get things wrong if you have not got good corporate governance and/or proper systems and controls, or if you do not understand your business models, or do not know what your value chains are. If do not know how your suppliers think and behave and what their models are, you are in no position to think about risk.

We can think of it like Maslow's hygiene factors. If you can get the basic factors, the basic principles right, then you need not worry about those. Then you can worry about growing your health insurance operation rather than worrying about systems failing, fraud, inaccurate reports coming through, or the wrong data coming through. You have enough to worry about without worrying about the hygiene factors. The hygiene factors you can get right. Everything else is much more difficult.

The Chair closing: The key theme throughout is ERM in health insurance is all about people and teamwork across all the stakeholders.

We are all risk managers and the real-time risk dashboard should help to reduce the clutter so that significant events are not missed, except when the black swan is flying by (with a co-pilot to pick up the consequences).

Teams of professionals who respect and understand what each other does is key. Being able to prepare for the unexpected was considered. This is a point which Miss Howell raised.

We have just mentioned paralysis by analysis. If we set about having multi-disciplinary teams it is to be hoped that that will stop the actuary from going in circles and going down areas where it is just getting too negative.

I should just like to reiterate some things from my opening remarks about the ERM frameworks being more complex for health insurance than for life or for non-life. The authors have clearly demonstrated this, both in the paper and in the discussion. There are a number of internal and external influences that we need to deal with. They can be quite complex.

The qualitative analysis of ERM for health insurers is very, very important, not just the numbers; and the qualitative element can add to the discussion about the amount of capital that is needed, especially when we are bringing the public sector into it as who knows what they are going to do?

Mr Smith (author closing): I was surprised how much of our discussion was on pure risk management and the specifics about health insurance. What I am going to do is to draw out a few of the health insurance issues that reflect back on some of the risk management issues and ERM issues touched on.

We have touched on this long-term versus short-term issue. There is no one risk appetite out there or no one risk horizon. There are competing risk perspectives and risk appetite horizons. What the customer wants and seeks might be different from what the regulator wants, what shareholders want or what the government wants. How you coexist with all of this and deal with the pressures within them is intrinsic in health insurance.

It can find its way into the industry in terms of organisational thinking in ways that you might not anticipate. If the consultancies are showing up and saying, “I have this return on capital snake oil” is that what you need? Only that one-year return on capital metric? Is that good enough or is that emphasising the one-year time horizon too much?

Health insurers will be forced to think more about how to set all this up rather than just necessarily buying it in. A lot of the material and thinking have been on the life side adapted toward the health side. Health insurance is not motor insurance or life insurance but it has features of both.

It would be nice if we could come up with a way of dealing with medical inflation so that we can create long-term health insurance contracts that allow us to manage these risks over long term. Those markets have not yet been viable. Therefore, we have focused on the short-term perspective in terms of legal substance and capital, even though the customer is looking for brand and loyalty and long-term protection.

Health actuaries will be forced to call into question many assumptions and methods. The more they do that, the more they will get into the essence of ERM.

Brand and franchise value are not on the balance sheet. They tend to be the essence of what, as health insurers, we are focusing on. It is not about the fat tail – the assumption-heavy fat tail – or the big black swan. It is more about operations and how we think about what is happening to the people in the insurance pool and the distribution of it and also the supply of services.

We tend not to think about clinical risk and the governance of clinical risk, but in some ways that is the essence of what health insurers have to do. Clinical risk management, medical management, the disease management aspects and what that means to your brand is already important but it is going to be more so. Any good framework for health insurance would pick that up – not just the volatility about the claims coming from cardiac events, hip replacements, or other procedures – but who should be in your system or in your provider network. If you do not pick up the right people and you do not manage that well and something goes wrong, that can really affect your brand. It can affect your ability to distribute your product; it can have dire consequences and have domino effects on how you are trying to manage other strategic opportunities or business development effort.

Health insurers are forced to think a lot more like retailers in terms of supply chains and the intrinsic risks, and less in terms of those distributions and a big capital model. It does not mean that they are entirely irrelevant; but if they were managing that franchise and brand, which is not on the balance sheet, then we have to think differently about what is happening more broadly with the ERM as it is coming through on the Solvency II side.

Health insurance is complex so it is important that we get an organisational memory – a rich connectivity between people, with mutual respect, being able to ask the right questions throughout the system and getting people to communicate the right information without getting so cluttered with noise that they get quite paralysed.

That is a particular problem because health insurance is probably the most complex form of insurance on the product side. There are lots of providers, there are trends, and there are any number of pricing points to pick up to make that small margin that the industry tends to get.

It is balancing all that complexity in a holistic way that is meaningful and focused on the enterprise mission that is going to stand in future.

Healthcare is contextual. It is a social, political, macro-economic provision and is increasingly globalised with outsourcing services to India, for example, with people looking at X-rays, and what have you.

If 96% of all healthcare spending in the UK is coming through the NHS, and they are just about to overhaul it in some way, a shock to that 96% is going to show up somewhere in that insurance 4%. That could be a big change. This could be happening simultaneously with other changes. Perhaps, because of the money printing that is going on, which may not lead to inflation but in the context of the macro factor feeding in and increasing the risk, could suddenly lead to increases in premiums of 25% at the same time as a shift in demand because of the NHS overhaul, and maybe because the Competition Commission has decided to do something clever resulting in major shocks to the system. These scenarios are intrinsic to health insurance.

The development of these risk frameworks in Solvency II is not entirely devoid of contextual thinking. They tend to look at systems and insurance entities on a very silo or entity basis. Health insurance does not work that way. Thinking about things in that broader context is going to be far more critical to that.

As actuaries we have to question ourselves and our tunnel vision on all of this. So, in actuarial practice, how do we think about understanding what risk management is, the right way to ask questions to really know what we do not know, what we do know and how to deal with those potential black swans?

Teasing all of this out involves questioning such things as what hidden assumptions we are making about nice stable trends and nice stable loss ratios. Those are some assumptions that we probably have now that have grown out of recent history. But Solvency II, if it were freely followed in spirit, would really call that into question. It is going to take a lot of work for actuaries to do that. That feeds into thinking about the Pillar II dimensions.

What Solvency II means for health insurance is, at heart, far more concentrated in Pillar II. It does not mean that Pillar I and Pillar III do not exist. There would be more calls on health actuaries to fulfil that Pillar II role, given all this complexity, and given the nature of the enterprise. It is hard to imagine life and general insurance actuaries having quite that type of exposure to step up and embrace ERM in quite the same way in many topics we have touched on.

Solvency II is necessary but not sufficient. Health insurance is more than about volatility of the loss ratios and fitting that to a normal distribution; it is about this complex system and supply and demand, major social and external factors that need to be balanced as we continue into the future. Those are the main points from the paper from my perspective.

The Chair: It leaves me to thank the authors for an excellent paper: thank you to John and to George. I found it quite refreshing to have a paper that you could get through quite easily without lots of formulae. The messages coming out were excellent with the Solvency II section at the end summarising it all.

Also, thank you to all of you who have participated this evening.