MILLIMAN

BEST PRACTICES
for THE RISK MAPPING PROCESS
By David Ingram, FSA, FRM, PRM and Paul Headey, FIA
FIGURE 1
Risk mapping is a tool used by life insurers in the
identification, control, and management of risk. It can
form the first step in an Enterprise Risk Management
Understand
(ERM) process or it can stand alone as the primary
risk management process for companies that have
not yet developed a full ERM system. Figure 1 illus- Identify Evaluate

trates the basic risk mapping cycle.

Risk Mapping
Perhaps the most important fea-
ture of risk mapping is its low- Revisit Prioritize
cost, high-impact introduction to
risk management that builds upon
the existing infrastructure in the Manage
company. It does not require a
large commitment to capital
expenditure and, if done appropri-
ately, will provide a valuable first
step in rolling out risk management across
the company. Step 1: IDENTIFY
Risks must be identified in order to:
Companies considering the risk mapping
approach it should be aware it is not a one • ensure that the full range of significant
shot solution and the results are not carved risks is encompassed within the risk man-
in stone. Rather it is an iterative process agement process,
that refines managements’ understanding of
the exposures that it is managing, and meas- • develop processes to measure exposure to
ures the effectiveness of the mitigation those risks and,
strategies employed in controlling risk. The
following sections outline the steps of the • begin to develop a common language for
risk mapping process. risk management with the company.
 Most risks can be classified
into one of the following
categories:
• Market Risks
• Credit Risks
• Insurance Risks
• Operational Risks
Starting with a comprehen-
sive but generic list of
risks, the company should
then aim to select its own
list by considering the fol-
lowing criteria:
• relevance to the compa-
ny’s activities;
• impact on the firm’s
financial condition;
• ability to manage sepa-
rately from other risks.
This step is often under-
taken as a brainstorming
exercise involving key team
members from across the
business that not only leads
to a comprehensive list
being compiled but also
aids in building support for
the exercise. The final “risk
list” should then be
checked for consistency
with the company’s busi-
ness plans and intended
risk management processes.
Step 2: UNDERSTAND
For each of the selected risks
from Step 1, it is necessary
to develop a broad under-
standing. This includes
determining whether the
risk is driven by internal or
external events.
In some situations, it may
prove helpful to actually
plot the exact sequence of
events leading to a loss
situation. This could
result in the identification
of intermediate interven-
tion points where losses
can be prevented or limit-
ed. Existing risk measure-
ment and control process-
es should be documented,
and if the loss sequence
has been plotted, the
location of the control
process in the sequence
can be identified.
The final step in under-
standing the risks is to
study recent events related
to risks including loss
events, successful risk con-
trol or mitigation, and near
misses both in the wider
world and inside the com-
pany. Such events should
be studied and lessons can
be learned and shared.
Step 3: EVALUATE
The next step in risk map-
ping is to evaluate the
risks. This involves:
• estimating the frequency
of loss events, e.g., low,
medium, and high;
• estimating potential
severity of loss events,
e.g., low, medium, and
high;
• considering offsetting
factors to limit frequency
or severity of losses and
understand potential
control processes.
Figure 2 (on page 3) shows
the basic risk evaluation map.
Step 4: PRIORITIZE
The evaluations of risk fre-
quency, severity, and con-

RISK EVALUATION PROCESS

Risk evaluation is typically done in two steps:

• First, the expected frequency of loss events is determined or estimated.

• Second, the expected severity of losses is estimated.

These assessments should take into account actual company experience, related industry experience,
experiences in unrelated industries, trends, and forecasts. The assessment may be performed quantitatively via
analysis of loss experience data or via a model. External data can also be used to establish an expectation.
However, if data is totally unavailable or is not sufficiently relevant to the company’s situation, then subjective
evaluations are needed. In addition, companies use subjective evaluations when they are using risk mapping as
their first steps into enterprise-wide risk management.

Loss frequency is often summarized into a small number of categories to allow easy comparison and to de-
emphasize minor differences in risk sizing. These categories can be thought of as “Very Low,” “Low,” “Moderate,”
“High,” and “Very High.”

The other aspect of risk evaluation is to examine the potential severity of losses if one of the loss events for which
the frequency was identified actually occurs. Again, the severity can be developed from company experience, related
industry experience, experiences in unrelated industries, trends, and forecasts. Companies also use subjective
evaluations for severity when using risk mapping as their primary system for enterprise risk. However, it is common
for severity evaluations to migrate more rapidly to a quantitative process, since a loss amount is easier to identify
than a loss probability. Initially, risk size might be measured with a “Very Low,” “Low,” “Moderate,” “High,” and “Very
High” range, but companies typically begin using number values after one or two annual cycles.

2 Milliman B E S T P R A C T I C E S F O R L I F E I N S U R A N C E C O M PA N Y R I S K M A N A G E M E N T
trols from Step 3 are then
consolidated on to a single
report. The risks are ranked
according to a combined
score incorporating all
three assessments. The
ranking starts with the risk
with the worst combina-
tion of frequency, severity,
and control scores.
Step 5: MANAGE
The consolidated evalua-
tions from Step 4 should
then automatically indicate
the risks that need the
most attention. Often, for
these most severe risks, a
company will decide that a
qualitative process is inad-
equate. Quantitative meas-
ures are identified that can
be performed on a regular
basis and reporting systems
are developed for these
most important risks to
bring the measures to
management’s attention on
a timely and regular basis.
It cannot be stressed
enough how important
ongoing monitoring and
measurement is to the suc-
cessful management of the
business risk.
This critical stage involves
deciding how to manage
the most important and
largest risks, considering
the risk-return relation-
ship, correlation with
other risks, consistency
with company strategy,
and the organization’s risk
tolerance level. It is impor-
tant to achieve the right
balance between the appli-
cation of the risk manage-
ment techniques and mon-
itoring the key risk indica-
tors in the business. This
RISK EVALUATION MAP
6
High
5
Severity
4
Medium
3
2
Low
1
1 2
Low
Annual Reevaluate
should include wherever
possible the utilization of
information already gener-
ated by the business.
A key part of managing
risk is the introduction of
simple processes to limit
the exposure to major areas
of risk. An example of this
is the control processes
around the introduction of
new products.
Step 6: REVISIT
Many companies may feel
that it is more cost effec-
tive to only implement full
risk monitoring and man-
agement systems for the
largest risks. This is proba-
bly true, but unfortunately,
the world of risk never
stands still. As the compet-
B E S T P R A C T I C E S F O R L I F E I N S U R A N C E C O M PA N Y R I S K M A N A G E M E N T
FIGURE 2
3 4
Medium
Frequency
Periodic Attention
itive marketplace changes
and the financial markets
move, yesterday’s low-risk
position may become
tomorrow’s high-risk posi-
tion. The process of identi-
fying, understanding, eval-
uating, and prioritizing
risks must be repeated reg-
ularly in order to ensure
that the key risks are being
appropriately managed.
Each period management
will review what happened
in the recent past and
assess whether risk man-
agement efforts produced
the expected results as well
as assessing what changes
have taken place in the
markets and the world that
might change its view of
its risks. Then it is ready to
start the process again
from Step 1.
5 6
High
Immediate Attention Immediate Action
Conclusion
Risk mapping is a cost-
effective tool to incorpo-
rate risk awareness and
institute risk management
into a company’s manage-
ment and operational
processes. As the process is
used management will,
over time, become com-
fortable in its role as risk
manager and begin to
incorporate risk manage-
ment into all aspects of its
role within the company.
Milliman 3
 B E ST PRACTI CE S FO R LI F E I N S U RAN C E C O M PANY R I S K MANAG E M E NT

ABOUT MILLIMAN
For over 50 years, Milliman
has been pioneering strate-
gies, solutions and tools
worldwide. One of the
largest consulting and actu-
arial firms in the United
States, we are recognized
leaders who have helped
shape significant changes in
the markets we serve.
Milliman insight reaches
across global boundaries
and multiple industries,
offering specialized consult-
ing services in life insurance
and financial services; prop-
erty and casualty insurance;
employee benefits; and
healthcare. Within these,
Milliman consultants serve a
wide range of current and
emerging markets, with
highly personalized service
and a unique combination of
actuarial and business
expertise. With offices in
principal cities worldwide,
Milliman combines global
experience with local knowl-
edge. We can help you be
prepared to operate in new
markets, expand beyond
your boundaries and under-
stand how your industry is
affected by developments
around the world. Milliman is
also a founding member of
Milliman Global, an interna-
tional organization of inde-
pendent consulting firms
serving insurance, employee
benefits and healthcare
clients worldwide.
Visit our website at:
www.milliman.com

MILLIMAN OFFICES MILLIMAN GLOBAL MEMBER FIRM LOCATIONS

ALBANY MILWAUKEE ARGENTINA JAPAN

ATLANTA MINNEAPOLIS AUSTRIA KOREA
BERMUDA NEW YORK BARBADOS MEXICO
BOISE NORWALK, CT BELGIUM NETHERLANDS
BOSTON OMAHA BERMUDA NIGERIA
CHICAGO PHILADELPHIA BRAZIL NORWAY
COLUMBUS PHOENIX CANADA PHILIPPINES
DALLAS PORTLAND, ME CHANNEL IS. SPAIN
DENVER PORTLAND, OR CHINA SWEDEN
GREENSBORO, NC PRINCETON, NJ COLOMBIA TRINIDAD & TOBAGO
HARTFORD ST. LOUIS DENMARK UNITED KINGDOM
HONG KONG SALT LAKE CITY FRANCE UNITED STATES
HOUSTON SAN DIEGO GERMANY
INDIANAPOLIS SAN FRANCISCO INDIA
IRVINE SÃO PAULO IRELAND
KANSAS CITY SEATTLE ISLE OF MAN
LONDON SEOUL ITALY
LOS ANGELES TAMPA JAMAICA
MADRID TOKYO
MILAN WASH., D.C.

Inquiries may be directed to:

NAME
ADDRESS
ADDRESS
EMAIL

Nothing stated in this document should be treated as an authoritative statement of the law on any particular aspect or in any specific case. Because the arti-
cles and commentary prepared by the professionals of our firm are often general in nature, we recommend that readers seek the advice of an actuary or attor-
ney before taking action.

© 2004 Milliman, Inc. All Rights Reserved

4 Milliman B E S T P R A C T I C E S F O R L I F E I N S U R A N C E C O M PA N Y R I S K M A N A G E M E N T