Background
This article was inspired by McKinsey’s report, “Elevating the risk function in insurance: Building a strategic advantage,” published in November 2024. The article discussed the benchmarking survey they conducted during 2023-24. Some of the results discussed in this report are very similar to our results about the Indian risk function in the insurance sector. Our survey was conducted during 2022-23 for PhD research. This is the first such research conducted in the Indian insurance market. My thoughts are in two ways: one is to highlight similarities in issues found, and the second is that despite the earlier enterprise risk management (ERM) development in Europe, the challenges are similar, where ERM in the Indian insurance market is yet to mature.
The subsequent discussion compares the key areas within the risk management function of insurance companies in Europe and India. These are the existence of skilled resources, issues related to data, whether the risk function is challenging the first line enough, whether the risk-based decision-making is working well, how the relationship of the Chief Risk Officer (CRO) with other stakeholders, how CRO is communicating the risk results in key stakeholders, and the existence of CRO’s veto power. Since these are the common areas we found covered in this article, for our PhD research, we have covered the entire COSO framework to understand the ERM practices within the Indian insurance industry.
Comparison
Skilled Resources
McKinsey’s report highlights talent scarcity, both in attracting and retaining talent. The report stated that companies have difficulty finding talent for data and technology roles, cyber risk, and nonlife underwriting.
McKinsey’s report mentions the talent problem in all areas of risk management (except financial crime). This shortage of skilled personnel in the industry hinders the application of the latest technology. Companies must train their existing teams with specific skills. The challenges of risk management skilled resources remain within the Indian insurance industry. This is primarily driven by the lack of risk management education at the business school level and inadequate risk management training at the Company level. One interview question was asked of Indian respondents about the organisation’s support for risk management education. The response was a lack of incentive from the management to pursue risk management education. Another question was asked to the Indian respondents: whether “Significant time and resources are allocated to risk management training or skills building.” Only 39% of respondents agreed with the question, and 34% remained neutral. The respondents were also asked whether they were trained to utilise risk assessment tools and outputs appropriate for their role in risk assessment. In response to this question, 52% of respondents agreed.
The talent problem remains the same between Indian and European resources. One key possible reason for this problem is inadequate risk management education at the undergraduate and postgraduate levels in core subjects.
Data Issue
McKinsey’s report stated that increasing data, analytics, and data interconnectivity across products and platforms is critical to improving cyber risk preparedness. Data is paramount for the Indian insurance industry in applying insurance and risk analysis, and it is becoming key for the application of artificial intelligence. The Indian risk function was asked whether they quickly got data from the first line for risk analysis. Many respondents reported challenges in getting the data from the first line; therefore, they recommended the establishment of a centralised database to fetch the information directly.
Independent View on the first line
McKinsey’s report stated that the risk team should understand the insurance companies’ key risks, credibly challenge internal policies, procedures, objectives, and performance, and provide the board and executive team with an independent view of the first line’s program, including its testing. One key risk management role is to challenge the first line and provide an independent view to the Board and management. In this regard, the question was asked whether the risk team in the Indian insurance sector challenged the first line enough; 68% agreed, 26% were neutral, and 7% disagreed. This does not clarify enough that risk function challenges the first line enough.
Risk-based decision making
Risk-based decision-making is one of the key elements of enterprise risk management. In this regard, McKinsey’s report stated that 100% of respondents agreed that European insurers have risk teams involved in risk-based decision-making. Among Indian insurers, this is a weaker area, where only 58% of respondents agreed.
Relationship with stakeholders
It is important for the Chief Risk Officer (CRO) to manage the relationship with key stakeholders such as the CEO, CXOs, Board members, and other members. In this regard, 83% of respondents agreed with European insurers, whereas 75% agreed with Indian insurers.
Risk Communication
Another key role of the CRO is communicating the company’s risk position to key stakeholders. European respondents agreed with 33% of this question, while Indian respondents agreed with 65%.
Veto Power
McKinsey’s report discussed the existence of veto power on essential decisions for CROs, and 34% of respondents agreed. In 17% of cases, the company changed the decisions after the challenge from the risk team. The risk function in the Indian insurance sector challenges the business unit, and decisions are also changed, but the exact quantification is not known. The concept of veto to the CRO in the Indian insurance sector is not there.
Involvement in strategic decision-making.
Half of European respondents said the CRO is fully and consistently involved in strategic decision-making, with the right to either veto or escalate a strategic decision—overruled only by the CEO. The impact on the overall risk profile, appetite, and risk strategy is consistently considered in strategic decisions. As stated above, risk-based decision-making is a weaker area in the Indian insurance market, where only 58% of respondents agreed. Another question to facilitate risk-based decision-making was whether the Risk Management Framework has a documented list of key business areas; only 52% of respondents agreed with this question. Listing key decisions within the risk management framework helps develop the culture of risk-based decision-making to make a good start.
Conclusion
There are many similar development requirements for risk function between European and Indian insurers. Even though Solvency-II, a risk-based capital regime in Europe, was developed in 2016, some of these issues were expected to be addressed in those countries. In contrast, the Indian insurance market has yet to adopt a risk-based capital regime. Since development in enterprise risk management (ERM) optimises the capital requirement, thus the development of risk-based capital accelerates the development of ERM. Therefore, the development of ERM in the Indian insurance market is in an early stage.
Skilled resource problems are found in both markets, despite being in the European market, because risk management education is more developed than in the Indian market. On the data issue, Indian respondents highlighted having a centralised database to remove the dependence on the first line. Providing oversight on the first line is one of the key roles of the risk function; it is not very clear to the Indian respondents whether they are challenging enough. Indian risk function is batting on a weak risk-based decision-making wicket. Relationships with stakeholders have a high percentage of agreement among the respondents, whereas Indian CRO’s communication with the stakeholders has a higher percentage of agreement than its European counterpart. The regulator or the Board does not give the veto power to CRO.
Authored By:
Sonjai Kumar, PhD in Risk Management, Certified Fellow of Institute of Risk Management London,
Dr. Purnima Rao, Associate Professor Finance and Risk Management, Chair of Full Time PhD Program, Fortune Institute of International Business, New Delhi
