Insurers can draw on their Solvency II experience to integrate climate risk and resilience

After a period of dipping its toes into the regulatory waters of climate risk management, PRA CEO Sam Woods’ 1 July letter to UK insurance CEOs was a sign of it wading in with both feet.

The essence of his letter is summed up in one sentence: “Firms should have fully embedded their approaches to managing climate-related financial risks by the end of 2021.”

For some companies, the letter will simply have reset or confirmed the timing of and priorities for action already taking place. For others, it may have landed with a proverbial thud.

Insurers have been here before

Either way, while the risks involved with climate may be different, UK insurers have faced a comparable challenge before, and in the not too distant past – Solvency II (as have banks to some extent with the Basel Framework). Perhaps the main parallel is the requirement to quantify the practically unquantifiable – in this case the future financial impacts to the sustainability of a business that individuals and businesses, as well as countries, rely on for financial protection – with all the uncertainties this involves.

Taking a similar top down, bottom up risk management approach on climate is, we believe, a way for insurers to get where they need to be in the PRA’s eyes and also create the level of internal proactiveness that will avoid regulatory requirements turning in to a ‘cliff edge’.

Looking at what is required, while we don’t want to second guess exactly what the PRA expects, the section of the letter dealing with observations on progress against Supervisory Statement 3/19 (SS 3/19) so far gives some pretty strong clues as to what’s on the regulatory horizon.

“We have reviewed a large number of firms’ SS3/19 implementation plans. We have found that most firms are making good progress in developing approaches to identify, assess, manage, report and disclose climate-related financial risks and have started to embed them in associated governance and control structures. Best practice continues to evolve and will do so for a number of years.”

Taking these elements in sequence, we start to see the underlying risk management parallels with Solvency II.

Identify – Shorter and longer-term climate risks will depend on the rate of global temperature change. While a 1.5°C increase above pre-industrial levels remains an ambition for many, the 2015 Paris Agreement (signed by 146 countries) is largely predicated on restricting climate change to a 2°C increase.

Using the climate change scenarios developed by the IPCC (Inter-governmental Panel on Climate Change), companies can start to identify the physical, transition and liability risks to which they may be exposed – be they operational (as in weather threats to premises, for example, or in underwriting), reputational (perhaps from insuring certain industries) or investment-related (e.g. threats to infrastructure and climate-driven equity movements) – and enter and monitor them in their risk registers as they would have done for factors arising from Solvency II requirements.

Assess – As with Solvency II, workshops and stress testing will play a key role, not only in assessing the materiality of, and applying appropriate proportionality to, the climate risks identified from scenario analysis but also in evaluating opportunities. As part of taking responsibility for, and an active part, in the transition to a low carbon economy, an essential step is to quantify how companies will be affected by, and can affect, the climate change trajectory.

In this respect though, cat models alone won’t be sufficient when attempting to project climate risks perhaps five, 10 or 20 years forward. Also new sources of data will come in to play.

As a point of reference, many insurers found themselves in a similar situation with cyber risk – especially silent cyber (unintentional cyber coverage in other policies). Typically, the challenges of capturing relevant risk attributes in the entity databases required a lot of extra resource to add attributes to data models and to populate them with credible assumptions and estimates of relative exposure. And like cyber, climate risk assessment needs to consider the views of all stakeholders to gain a consistent view of risk and incorporate it into risk appetites.

Taking into account also the duration of climate risks and the diversity of physical, transition and liability risks, insurers will need to apply a wide range of analytics tools to tackle these questions of quantification.

Manage – Even before EIOPA (the European Insurance and Occupational Pensions Authority) announced its own consultation in October 2020 on the specific inclusion of climate risks in the Solvency II Own Risk Solvency Assessment (ORSA), the PRA letter’s reference to the need to embed management of climate risks echoed the Solvency II requirements. The board level training to instil understanding of risks and the strategy reviews and development that were part of most insurers’ Solvency II preparations will need to take place, recognising that the added complexities of external macro-economic, consumer, investor and ratings influences in climate risk will be constant variables to be taken into account.

Our overwhelming experience from working with insurers on Solvency II was that the tone set by senior management was a crucial factor in the success and efficiency of preparations. In relation to climate, there’s are added dimensions. One is the timeframes involved and the potential evolution of regulation as regulators around the world continue to become more joined up. Then, there’s the potential external reputational damage of being seen as behind the curve on climate. Another is the growing body of evidence of the role of good corporate citizenship in attracting and retaining talent.

Report and disclose – Through all its communication to date on climate risk, the PRA has made it apparent it wants to set a high bar on financial disclosure. This will require companies to have the systems and data to deliver the analytics and metrics that will support internal and external reporting.

As for how or what to disclose though, the PRA has not stipulated. However, the movement behind making the currently voluntary Taskforce for Climate-related Financial Disclosures (TCFD) methods mandatory is growing, including in the UK from the Financial Conduct Authority and the Green Finance Institute. More than 1400 companies around the world, with a combined market value in the trillions, have already signed up. (Note: on 9 November, the UK joint regulator and government Taskforce for Climate-related Financial Disclosures (TCFD) published an interim report and accompanying roadmap signalling the intention to make TCFD-aligned disclosures mandatory across the economy by 2025, with a significant portion of mandatory requirements in place by 2023)¹.

The TCFD framework covers four core areas – Governance; Strategy; Risk management; and Metrics and targets. Beyond pure disclosure though, TCFD is another opportunity to really get a handle on climate risks and their links to operational management, business performance and reputation.

A number of studies and reports have investigated the implications of TCFD for UK plc. Few, if any to date to our knowledge, have sought to understand companies’ readiness and intentions to report on TCFD.

In October 2020, Willis Towers Watson published its first summary report of an ongoing pulse survey examining these questions.

Governance and control – All insurers have already had to name a senior person within the company responsible for climate. As part of the process of more firmly embedding climate risk management, this ownership of climate risks will need to permeate throughout the organisation as part of the function of wider analysis, metrics and reporting. The PRA seems unlikely to punish those insurers that show they are taking positive steps in this direction but will want to see the evidence of progress by its end-2021 deadline. The EIOPA consultation note also stresses the governance and control aspects of climate risk.

Regulatory stepping stone

For companies that have been holding back and perhaps scanning the regulatory lie of the land on climate, this doesn’t leave a lot of time, particularly with the added complications of remote collaborative working during the COVID-19 outbreak.

While the PRA deadline and the EIOPA consultation (along with the developing climate policy landscape) may therefore help drive action in the near term, it’s also worth considering the bigger picture beyond regulation. We’re rapidly moving towards an economy that places greater emphasis on green finance and recovery and that values organisations (both emotionally and financially) that support them. Down the line, there could be the very real possibility of capital charges on insuring certain industries, while climate change will inevitably have wide-ranging impacts on how we all live and work.

As the recent PRA letter states, “climate change represents a material finance risk to regulated firms and the financial system.” The degree of assumed materiality may well depend on factors such as variable exposure and scale over time in different lines of business, but as an illustration of that statement being more than words, EIOPA’s recent intervention on the ORSA has the potential to be quite penal on companies using the Standard Formula to calculate their SCR (Solvency Capital Requirement) or on those that don’t reflect climate risks sufficiently rigorously in their internal model.

Insurers that take steps now to better understand the risks and plan for changes to their mid- to long-term strategies will be better placed to deal with them and avoid having to play catch up with the rapidly evolving regulatory environment as our collective knowledge of climate impacts grows. And if insurers can gain from the pain of having gone through preparing for Solvency II to do so – all the better surely.

¹See - https://www.gov.uk/government/publications/uk-joint-regulator-and-government-tcfd-taskforce-interim-report-and-roadmap