Expert Commentary

ERM and September 11

Would the insurance industry have been in a better position today if ERM were more widely practiced before September 11? Jerry Miccolis says "Yes" and tells how ERM is used to test the aggregate effects of various scenarios and then to develop plans to mitigate those effects.

Enterprise Risk Management
November 2001

The world suffered a terrible—some have said "unimaginable"—loss on September 11: thousands of lives lost in a span of minutes; thousands of families devastated by death and injury; monumental icons of the public and private sectors severely damaged or destroyed; entire enterprises in multiple sectors crippled or felled. There are virtually no natural or man-made catastrophes in peacetime or in war to which we can compare these events. And the waves of uncertainty and anxiety propagated by these tragedies continue to roll through our personal and public lives, and through the economy.

Those waves broke immediately over the insurance industry. In the face of such loss and destruction, individuals and businesses turned to their insurers in the hope and expectation of some recovery, some compensation for the loss. Even before insurers calculated the full extent of the losses1, it was clear that they were so extensive, so sweeping, so all-encompassing that this industry, too, was among those critically stricken by the terror, its foundations shaken.

It also became clear, to those not already aware, how dependent worldwide commerce is on a financially stable insurance industry. While this industry will survive the current calamity, some individual insurers will not, and the industry as whole has come face-to-face with the reality that it, like the airlines—though in a much different way—will need support from the public sector in order to ensure its ongoing viability.

Over the past several weeks since that terrible day, more than one of our insurance industry clients has wondered aloud if the industry couldn't have been better prepared against this "unimaginable" act. More pointedly and poignantly, some have wanted to know if it would have helped at all before the event to have fully implemented the kind of enterprise-wide approach to risk management that many companies have espoused and begun to develop. Or would enterprise risk management (ERM), too, have been unequal to the task of dealing with something so unthinkable as this?

What we've said to them is that no system on its own will assure that human beings think of everything. And certainly no system can predict a particular kind of event—whether a "perfect storm" or terrorists hijacking and flying jet airliners into three buildings on a suicide mission with such destructive force and consequences. Nonetheless, the systematic, disciplined, and integrated way of thinking about risk that is at the heart of ERM would, quite likely, have enabled insurers to be better prepared to manage the unthinkable when it did occur.

In particular, we've said to our insurer clients that for extraordinary catastrophic events such as September 11, ERM could be especially effective in five areas:

  • Exposure management
  • Extreme event risk planning
  • Disaster response
  • Capital management
  • Stakeholder relations

Exposure Management

ERM's effectiveness in exposure management is grounded in its ability to enable insurers to identify "cross-silo" effects in advance and mitigate them. For historical reasons, the industry tends to think and manage in "silos." What a disaster such as the terrorist attack of September 11 reveals is that these silos can be simultaneously shaken by a common event, creating the "cross-silo" effect.

The attacks affected not only so many human lives but also so many different parts of our society and economy. For insurers, the breadth of the devastation meant that at the same instant, nearly every insurance line the industry offers suffered catastrophic loss—from workers compensation, to property, to liability, to life and health. Moreover, the exposure affected both primary and reinsurance sectors, and not only underwriting but also investment operations as equity values likewise suffered substantial losses.

The effect, particularly for multi-line carriers, was profound because of the interdependencies among the risks—interdependencies that insurers don't normally think about or account for. On September 11, the cross-silo effect nearly undermined the entire insurance system. Less severe events can also have outsized impact to insurers to the extent that these events penetrate across silos.

As we've tried to demonstrate throughout this series of articles, one of the strengths of ERM is precisely the ability to think systematically about these cross-silo effects. The structural simulation-based ERM modeling techniques that we've reported on enable insurers to develop "what-if" scenarios that uncover the interdependencies among their various business and financial strategies. While this scenario-building would not predict a particular event, it makes it possible for insurers to test the aggregate effects of various scenarios—across lines, across subsidiaries, across underwriting and investment sides of the house—and then to develop plans to mitigate those effects.

In a sense, then, asking what would be different today for the industry if companies had routinely practiced ERM is akin to asking, "What would have been different had insurance companies routinely practiced catastrophe modeling in advance of Hurricane Andrew?" We now know the answer to that question: companies would have known potential magnitudes and, importantly, concentrations of effects, and would have been in a position to do something about them. Indeed, some companies that had unwittingly "doubled down," through their multiple subsidiaries' simultaneous exposures to the same events, would perhaps have done something earlier and less drastic than selling certain subsidiaries under unfavorable post-event conditions.

Extreme Event Risk Planning

While ERM deals with events across a wide range of potential magnitudes, it offers additional benefits in the proper preparation for truly "extreme events"—those that have extraordinary, broad, catastrophic effects and that are exceptionally unlikely but that can bring multiple companies, even the entire industry, down. They are to "ordinary" catastrophes what, say, Noah's Biblical flood would be to the Johnstown flood. They are more severe even than September 11.

Because the impact of such extreme events is so immense, their effects cannot be mitigated in the usual ways, such as through exposure management. And, because they are so rare, it is grossly inefficient to pre-fund them—an insurer's capital would have to sleep for centuries in that case. But the scenario-building discipline of enterprise risk management does provide a means for insurers to think about these extreme events and consider alternatives for managing them. ERM forces the question: "What do we do if they do occur?"

In the present terrible case, if insurers—either individually or on behalf of their industry—had worked through such absolutely worst-case scenarios, they would have thought about potential solutions to backstop the industry should its capital ever become exhausted. That kind of advance thinking would very likely have strengthened the industry's stance in the current public policy debate. Negotiations over government guarantees, including the level at which the government should reasonably be involved, would be based on a well-informed, persuasive point of view because the case would have been formulated in advance of actual crisis conditions.

Disaster Response

The scenario-building and modeling capabilities of ERM also make it possible for companies to respond to crises much more efficiently and effectively. That is the case for both operational and financial responses.

On the operational side, ERM goes beyond standard emergency preparations such as backup computer and communication systems, by enabling companies to anticipate, and plan for, the impact on such "human systems" as customer service if a large contingent of claims administrators is suddenly diverted to address a single catastrophe. Some companies have already taken advantage of ERM's capability to link catastrophe event modeling with operational planning in this way.

For example, a Category 3 storm is due to hit the East Coast of the United States. These companies model the storm and, knowing its intensity and likely landfall, determine how many company people will be required, what skills and infrastructure support they will need, and the area to best stage people before the storm actually hits.

On the financial side, ERM-based structural simulation modeling allows insurers to quickly evaluate alternative financial responses to a disaster, whether the event creates a short-term emergency that requires an immediate infusion of capital or whether it creates a short-term opportunity, such as capital restructuring. In the first case, the ERM models will allow insurers to promptly determine how much capital they actually need. In the second case, the models can guide rapid decisions on issues such as share repurchase opportunities.

In both cases, what is important is the preexisting ability to model the effects of simultaneous and complex interrelationships among such elements as underwriting results, cash flows, asset values, and the company's own stock value so that the company is ready when quick decisions need to be made. Also, at the present moment, companies need to make hard decisions about their reinsurance coverage. ERM-empowered companies would have done this "homework" in advance as, clearly, shrinkage in reinsurance capacity would have been a plausible scenario in any thoughtful ERM exercise, even before September 11.

Capital Management

As briefly touched upon above, ERM models help determine the proper amount of capital needed to run an insurance enterprise. That is, ERM analysis helps companies achieve the right balance between having sufficient capital to meet policyholder security requirements on the one hand and achieving the capital efficiency that owners demand on the other hand.

Beyond determining overall capital adequacy, these ERM models also are effective in allocating total capital to business units in a manner that reflects the relative contribution of each unit to enterprise-wide risk. This is a critical component in establishing proper financial performance criteria, such as return on risk-adjusted capital, that help management decide which businesses are creating, or destroying, enterprise value.

With capital now a much more precious commodity in the insurance industry than it was just a short time ago, these capital adequacy and capital allocation activities have taken on added urgency. Those companies that have been practicing ERM-informed capital management find themselves at a distinct competitive advantage.

Stakeholder Relations

ERM also serves to improve communications and relationships with key stakeholders. While that is true of all stakeholders—from employees to customers to vendors—it is most especially true for insurers' three key financial and "adjudicating" stakeholders: regulators, rating agencies, and investment analysts.

First, if you both have a disciplined ERM process in place and communicate that fact to these stakeholders, they will be reassured that you are well prepared for a disaster. Second, in the event of a disaster, the ERM process will have shown you already what your total exposure is likely to be and what controls you can put in place to manage the exposure, so that you can rapidly, and accurately, answer the inevitable questions on those areas from these interested parties. You will have removed a source of a great deal of uncertainty for them, uncertainty that influences which companies they place on their "watch lists."


The answer to the question our insurance company clients have asked—whether the industry would have been in a better position today if ERM were more widely practiced before September 11—appears clearly to be, "Yes." And it is certainly the case that, going forward, stakeholders will insist on the more rigorous exposure management, scenario testing, response preparation, and capital management that ERM encompasses.

Clearly, September 11 has made much more real and immediate the need for serious risk management. Whatever stage of ERM implementation an insurance company may be in, even if only in the early investigation stage, management would be well advised to accelerate those activities without delay.

ERM does help us all think about and plan for the unthinkable, even while we hope and pray that those plans never need to be implemented.

1Insured losses will likely exceed $35 billion and could top $55 billion when all business interruption and third-party liability claims are settled (see the white paper September 11, 2001: Implications for the Insurance Industry, available on the Tillinghast-Towers website at

Opinions expressed in Expert Commentary articles are those of the author and are not necessarily held by the author's employer or IRMI. Expert Commentary articles and other IRMI Online content do not purport to provide legal, accounting, or other professional advice or opinion. If such advice is needed, consult with your attorney, accountant, or other qualified adviser.

Like This Article?

IRMI Update

Dive into thought-provoking industry commentary every other week, including links to free articles from industry experts. Discover practical risk management tips, insight on important case law and be the first to receive important news regarding IRMI products and events.

Learn More