Taking the Three Lines of Defense to the Next Level

How the Adoption of a First Line Risk Champion Model can Help Insurers’ ERM be More Proactive and Independent

By Sam Radwan, Roger Xu and Beth Zhang

Risk Management, April 2023

Background and Challenges of the Three Lines of Defense

The challenge with establishing the three lines of defense was the key hurdle of clearly separating the first line ERM activities from the second line. Companies have primarily resorted to having full-time second-line employees embedded within each function of the first line. While this model has its merits, several challenges arise: Firstly, this individual is not truly involved in the day-to-day activities of the first line and remains an observer. In other words, he or she is not truly a first line risk guard, and in reality is still a second line person. Secondly, it may get too expensive, especially in an organization that is distributed, nationally or globally, or has a complex agency/distribution channel. Thirdly, it is a challenge for this individual to become truly proactive, as once again they are simply observers, but more importantly, may be considered as “policeman” by their peers in the first line. This could potentially shield them from gaining the full experience of the day-to-day activities that the first line is conducting and, therefore, may not be able to fully comprehend the risk implications.

Establish a “Risk Champion”

An emerging model that some companies are adopting to address this issue is what is called a risk champion. This would be an individual who would still have a full-time job working in the first line, be it an underwriter, accountant, actuary, etc. However, this individual is willing to volunteer at least one or two hours of his or her time every week to work with the second line. The role would be to report on all the activities in his or her department monthly, and sometimes even weekly to reconfirm the processes that are in an “all clear mode” along with the ones that require attention from the ERM process.

Keep it Simple

Asking a busy underwriter or a salesperson to take on a second job can be challenging. Therefore, it is important to make the process as simple as possible, and provide that individual with all the support necessary. It is important to limit the role simply to identifying the risk and not be required to take any actions individually. Secondly, it is important for both lines to clearly document all the processes that the risk champion needs to report on and provide a very simple red/amber/green type checklist for this individual to report on frequently.

Invest in Training and Recruiting

Training the risk champion in this role takes on great importance in terms of helping him or her understand what to look for and how to avoid any distractions/disruptions to the front line productivity. At the same time, the risk champion should not come across as a policeman, and is simply there to support his/her first line colleagues in ensuring their processes never run into issues. The risk champion would need to be compensated for this extra task, however. It’s important to see that the compensation is more symbolic in nature, and that this individual is primarily doing this to help support the company culture of building a solid ERM framework. That’s why recruitment is important when identifying these individuals. Ideally, these individuals would volunteer for this role as a way to demonstrate their commitment.

Be Patient and Disciplined

On average, a large percentage of any potential red flags raised by the risk champion will end up being false alarms. This should be considered a normal course of doing business as good risk champions naturally don’t want anything to fall through the cracks. It is important not to discourage such an attempt toward diligence, and to take every single issue raised seriously. Furthermore, continuous communication and feedback between the risk champion and the second line will continue to help improve this process. Finally, establishing a formal communication process through a frequent and formal risk committee meeting, between the second line and the risk champions is at the heart of making this process be as effective as possible. Such risk committee meetings are trending toward becoming more frequent. For example, some companies started by conducting them quarterly, but have quickly moved to monthly and even weekly meetings.

Test and Learn

Implementing such a model, especially with a nationwide insurer having a highly scattered, distribution channel can be very daunting and complex. Furthermore, if it’s not properly implemented it can be quickly labeled as a burdensome and disruptive effort for the business overall. It is important to start small to quickly optimize the process, and then start rolling it out from headquarters to regions, branches all the way down to every customer facing, and finally, backoffice process. A key first step is to establish a rigorous list of all the processes, conducted across the enterprise, followed by designing the process of recruitment, training, and risk committee meeting agenda/format.

Conclusion

The industry seems to agree that the trend toward facing more complex and frequent risk exposures will only increase in the future. Companies can no longer afford to address such exposures “after the fact.” Being proactive, in terms of identifying the risk before it happens is probably the most difficult task facing an insurer’s ERM. Adopting a proactive risk champion model that is fully embedded in the day-to-day activities of all enterprise functions is but one step in that direction.

Statements of fact and opinions expressed herein are those of the individual authors and are not necessarily those of the Society of Actuaries, the newsletter editors, or the respective authors’ employers.

Sam Radwan, Roger Xu, and Beth Zhang are members of Enhance International, LLC a global consultancy that focuses on strategic issues in the insurance, asset management and healthcare spaces. They can be contacted at info@enhance-international.com.