Implementing ERM (Part 2)

Well, when we talk about risk mitigation and control, this is a section where it can be very easy to get deep into the weeds.

So I'll actually keep this pretty short, knowing that there's lots of resources out there specific to all kinds of risks and how to model them and how to do this process.

You want to keep your risk exposures within your concentration limits that are set proactively.

It's often a simple red, yellow, green control metric that works pretty well.

And if you do it consistently, then senior management and the board and outside regulators and rating agencies, people like that, get used to what you're doing and you gain credibility through that.

Some examples would be market hedges, reinsurance, a cash flow matching program that you can do internally.

For operational risks, you can add physical and cybersecurity backup facilities and the work-from-home option.

Models can help.

The example I have here is one that I ran across.

A company I worked for had sold 20-year endowment life insurance policies.

And when we built the model, computers weren't all that fast, so we rolled those policies up with other whole life policies.

So we were initially surprised at the cash outflows when these things started to endow as the cash outflows, as the policies were only sold for a few years.

So we really didn't have any experience on the current staff who had been involved with when these products were sold.

So it ended up taking my boss about a week to figure it out.

It was actually kind of buried deep in the model.

But it's important to think that there's going to be surprises like that anytime that you model things and roll things together, that you don't have all the history of when the model was built or when the products were sold.