Introduction
An ERM framework should fit the organization that uses it. A small insurer with a narrow product range and direct executive oversight may not need the same committees, reporting layers, or documentation as a large group operating across multiple markets. But a smaller framework is not automatically a sounder one. If tailoring removes the links between objectives, risks, accountable owners, decisions, and oversight, the result may be a collection of risk activities rather than enterprise risk management.
The design question is therefore not “How much framework can be removed?” It is “What is the simplest arrangement that still supports the organization’s objectives, recognizes its material risks, assigns responsibility, informs decisions, and provides appropriate oversight?” This tutorial presents a practical way to answer that question, aligned with the CAS Exam 9 (Risk Management for Actuaries) syllabus.
What Organizational Context Changes
Four contextual dimensions are especially useful when considering framework design. They should be assessed together: a small organization can have complex exposures, and a large organization can have a relatively concentrated business model.
- Size and capacity: Consider the number of employees, business units, locations, and available risk-management resources. A limited staff may call for shared roles or simpler documentation, but it does not eliminate the need to assign responsibility.
- Complexity: Consider the variety and interaction of products, processes, legal entities, distribution channels, systems, and external relationships. More complexity generally increases the need for consistent definitions, coordination, and escalation.
- Strategy and risk profile: Consider what the organization is trying to accomplish and which uncertainties could materially affect those objectives. Framework emphasis should reflect the actual business model and material exposures, rather than a generic list copied from another organization.
- Existing practices: Consider which established processes already provide useful risk information or control. Examples include underwriting reviews, investment limits, incident reporting, and business planning. These can be incorporated into ERM if their responsibilities and outputs connect to enterprise oversight and decisions.
The earlier material on ERM frameworks distinguishes framework principles from the particular arrangements used to apply them. For tailoring, that distinction matters: a principle such as clear accountability can be implemented through a formal committee in one organization and a documented executive review in another. The form can differ; the accountability must remain clear.
A Practical Fit Assessment
A sound assessment starts by identifying the organization’s material characteristics and then asking what each characteristic implies for the framework. It should not begin by choosing a fashionable structure and forcing the organization into it. The sequence below is a diagnostic aid, not a universal scoring formula.
Record the business model, scale, organizational structure, important external relationships, and existing management practices. Include features that create complexity even if the organization is small.
Ask where coordination, specialized expertise, independent challenge, or more frequent reporting is needed. Link each demand to a characteristic or material exposure rather than to size alone.
Set roles, review forums, documentation, and reporting at a scale the organization can sustain. Use existing processes where they provide reliable inputs, and specify how those inputs reach enterprise oversight.
Check that objectives inform risk identification; significant risks have owners; assessments can inform decisions; responses are monitored; and material information reaches appropriate governance. Revise any design that leaves a broken link.
This assessment avoids two opposite errors. An oversized design can create duplicate reporting, unclear responsibility, and processes that staff cannot maintain. An undersized design can leave risks fragmented among departments, with no consistent way to elevate issues or consider consequences beyond the department that first sees them.
Worked Example: A Small, Concentrated Insurer
A hypothetical mutual insurer has 42 employees, one principal office, and two related personal-lines products sold through a small agent network. The chief executive currently chairs a monthly operations meeting. Underwriting exceptions and service complaints are recorded, but there is no common enterprise risk report. Determine a proportionate framework design and identify what cannot be left out.
Method. Assess capacity, complexity, strategy and current practices separately, then test whether the proposed design preserves the essential framework connections.
Capacity and complexity. The workforce and product range are limited, so a collection of specialized committees would likely be difficult to staff and could duplicate the existing operations meeting. However, the agent network creates an external relationship to monitor, and two products still require their material risks to be considered consistently.
Existing practices. The monthly meeting can be used as a management review forum. Underwriting exceptions and complaints are useful inputs, but they are not a complete enterprise view: they need consistent definitions, assigned owners, and a means of identifying issues that could affect broader objectives.
Proportionate design. Retain one executive-level review rather than creating multiple standing committees. Assign named owners for the principal risk areas, define a common process for raising material issues, and prepare a concise periodic summary that includes exceptions, complaints, emerging concerns, and actions requiring oversight. Record decisions and follow-up responsibilities.
Essential-connection test. The design connects business objectives to risk information through the review, assigns responsibility through named owners, and makes follow-up visible through recorded actions. If agent-related concerns are not captured or significant issues cannot be escalated between meetings, the design is incomplete despite the organization’s small size.
Common mistake avoided. “Small insurer” does not mean “no enterprise reporting.” The appropriate simplification is fewer forums and concise documentation, not eliminating shared risk definitions, ownership, escalation, or follow-up.
Reuse Existing Practices Without Creating Silos
Existing practices can make an ERM framework more practical, but only if their relationship to enterprise oversight is explicit. A department’s process may be effective for its own purpose while still failing to communicate information needed elsewhere. For example, a technology incident log might be well maintained, but its value to ERM depends on whether significant incidents are assessed for wider business effects, assigned for action, and reported at the appropriate level.
A useful test for each existing process is to ask four questions:
- What risk information does the process produce, and what is its scope?
- Who owns the information and checks its quality?
- What criteria cause an issue to be escalated or considered alongside other risks?
- How do resulting decisions, actions, and status updates reach the people responsible for oversight?
A “yes” to the existence of a process is not by itself evidence that the process is integrated. The link to enterprise consideration must be demonstrated. Conversely, integration does not require every department to use identical tools. A local process can remain specialized if its outputs are understandable, sufficiently consistent, and connected to the organization’s broader review.
Worked Example: Reusing Separate Department Processes
A hypothetical regional insurer has three business units. Each unit maintains its own risk register and quarterly review. The registers name owners and proposed actions, but use different severity labels. The executive committee receives a summary showing the number of open items in each unit. Decide what should be retained and what must change to make the arrangement fit for enterprise oversight.
Method. Trace how information moves from local identification to enterprise consideration, then distinguish useful specialization from a missing connection.
Retain local registers and reviews. Each unit is close to its own processes and can identify issues in detail. Requiring one central register to replace all local work could reduce useful operational ownership and create unnecessary administration.
Resolve the inconsistent labels. Different severity labels prevent reliable comparison. For instance, one unit’s “high” may mean a different level of concern from another unit’s “high.” Establish shared definitions or a documented translation that enables the executive committee to interpret the summaries consistently.
Improve the enterprise summary. Counts of open items alone do not show which matters could affect objectives, require a decision, or have implications across units. The summary should identify material issues, accountable owners, relevant actions, and items requiring escalation. It should preserve enough context to avoid treating unlike issues as equivalent merely because they share a label.
Test and conclude. Local identification and ownership are present, but comparability and meaningful escalation are weak. Keep the local processes, standardize the information needed for enterprise consideration, and define how cross-unit or material issues reach the executive committee. This is tailoring through integration, not centralization for its own sake.
Common mistake avoided. Replacing every local register with a single central form may appear to create consistency, but it can erase useful detail without ensuring better decisions. The correction is to standardize the essential connections and information, not necessarily every local activity.
Strategy and Complexity Should Shape Emphasis
A framework should reflect the organization’s actual objectives and exposures. If an insurer is changing its distribution model, for example, the framework may need clearer ownership and reporting for risks associated with the new channel. If it is entering a new market, legal, operational, and reputational considerations may deserve more attention than they received under the former business model. This does not mean the framework is a strategy-setting process; it means that risk oversight should not be designed as if the organization’s objectives and activities were static.
Complexity also affects how much aggregation and coordination the design needs. Multiple entities or business units can create inconsistent assumptions, duplicated controls, and risks that cross organizational boundaries. A framework can address these challenges through shared definitions and escalation expectations without requiring identical local procedures everywhere. The right balance depends on whether local variation improves the work or makes important information incomparable.
Size should therefore be treated as a constraint on the form and operating burden of a framework, not as a measure of how much risk management is necessary. A small organization with a rapidly changing business model may need frequent executive attention. A larger organization with well-established processes may use some existing forums, provided that roles and reporting links are clear.
Worked Example: Testing Whether a Framework Is Truly Enterprise-Wide
A hypothetical insurer has five material risk areas in its framework: underwriting, investment, technology, compliance, and third-party service. Each area has an assigned owner, and all five submit quarterly updates. The design review counts these as five of five areas covered and concludes that integration is 100%. Further examination shows that the updates use different formats, no one reconciles issues affecting multiple areas, and the board receives only a list of owners. Assess the conclusion and recommend a proportionate correction.
Method. Separate coverage of named areas from evidence that information connects to oversight and decisions.
Compute the stated coverage measure. There are five named areas and five have owners, so the count-based measure is \(5/5=1\), or 100%. This calculation is arithmetically correct, but it measures only whether each area has an owner.
Check the claim of integration. Updates are not comparable, cross-area issues are not reconciled, and the board receives no decision-relevant risk information beyond owners’ names. Therefore the evidence does not support a conclusion that the framework is integrated. The 100% figure is not an integration measure; it is a coverage count.
Correct the design proportionately. Keep the five risk owners and quarterly updates. Define a small common set of reporting fields, identify who reviews issues that cross areas, and specify which material matters or decisions must be escalated. The board need not receive every operational detail, but it should receive an intelligible view of significant issues and oversight needs.
Check the correction. Each area still has an owner, reporting has a consistent minimum structure, cross-area issues have a review route, and material information can reach the board. The correction strengthens the missing connections without imposing a new committee structure.
Common mistake avoided. Do not calculate “integration” as the percentage of risk areas listed or assigned. Coverage is necessary, but it does not prove that information can be compared, escalated, or used in oversight.
Designing for Fit Without Losing the Framework
A practical framework-design review should explain why each major arrangement exists. A committee, report, or control is not justified merely because another insurer uses it. Equally, an arrangement should not be removed solely because it is formal or resource-intensive. Ask what function it performs, whether that function is needed in this organization, and whether a simpler arrangement can perform it reliably.
| Design question | Evidence of appropriate tailoring | Warning sign |
|---|---|---|
| Does governance fit the organization? | Roles and escalation routes match the structure and capacity. | Important issues have no clear owner or recipient. |
| Does the framework reflect complexity? | Cross-unit or external dependencies can be recognized and raised. | Local processes hide issues that affect other areas. |
| Does it reflect objectives and exposures? | Reporting emphasizes material uncertainties relevant to the business. | A generic checklist substitutes for the organization’s actual risk profile. |
| Are existing practices used effectively? | Useful information reaches enterprise review in an interpretable form. | Separate processes exist but their outputs are not connected. |
| Is the design sustainable? | Documentation and meetings are proportionate and responsibilities are understood. | Duplicated reporting consumes capacity without improving oversight. |
The strongest designs are neither maximal nor minimal. They are proportionate, explainable, and connected. Their arrangements can change as the organization changes, but essential responsibility and information pathways remain visible.
Check Your Understanding
For each hypothetical situation, decide what should be tailored and what essential connection must remain.
- A small insurer uses one monthly executive meeting and has no separate risk committee. It records material issues but does not assign follow-up owners. What is the main design gap? (Answer: The meeting may be proportionate, but material issues need clear accountable owners and tracked follow-up.)
- Three units have separate risk reviews and use different labels for severity. What is a proportionate first correction: eliminate local reviews or establish comparable reporting definitions? (Answer: Establish shared definitions or a documented translation for enterprise reporting while retaining useful local reviews.)
- A growing insurer lists four material risk areas and assigns an owner to each. It claims its framework is fully integrated on that basis. Why is the claim insufficient? (Answer: Four of four areas having owners shows complete ownership coverage, not that assessment, escalation, cross-area coordination, and oversight are connected.)
- An insurer adds a new digital sales channel but has limited staff for additional committees. What should guide its framework adjustment? (Answer: Assess the new channel’s material risks and responsibilities, incorporate relevant information into existing reviews where feasible, and preserve clear ownership and escalation.)
- A large group requires identical risk tools in every entity, although local legal and operational processes differ. What is the key tailoring issue? (Answer: Standardize the information and connections needed for enterprise oversight, but allow local procedures to differ where that variation is useful and does not prevent comparability or escalation.)