It s Imperative: A Data Governance Primer for Solvency II and Beyond WHITE PAPER

It s Imperative: A Data Governance Primer for Solvency II and Beyond WHITE PAPER

SAS White Paper Table of Contents Introduction.... 1 When Technology Is Not Enough.... 3 Framing the Governance Program... 4 Road Map to Solvency and Compliance... 5 Conclusion.... 9 Lisa Loftis is a customer relationship management (CRM) and business intelligence (BI) expert with 25 years experience in assisting organizations to adopt a customer focus. Loftis has worked with numerous large organizations in North America, South America, Europe and the United Kingdom on all aspects of successful BI and CRM. She specializes in combining the technology necessary to support true CRM and BI business strategies with the organizational structures, executive leadership and cultural factors required to migrate an organization toward effective implementation of the enterprise strategies. Loftis has a strong background in the application of CRM and BI principles and cross-functional business strategies in the banking, investment, insurance, telecommunications, retail, utilities, entertainment, manufacturing and distribution and automotive roadside assistance industries. She speaks frequently at national and international conferences and has co-authored the book Building the Customer-Centric Enterprise (John Wiley & Sons, 2001). Loftis can be reached at lisa.loftis@sas.com.

It s Imperative: A Data Governance Primer for Solvency II and Beyond Introduction It s easy to see why people such as Kathleen Dugan focus on data. The quality of data used in an insurer s risk models is prominently featured in the impending Solvency II regulation, with no fewer than five of its articles referring specifically to proof of data quality: Article 48: Insurance and reinsurance undertakings shall provide for an effective actuarial function to assess the sufficiency and quality of the data used in the calculation of technical provisions. Article 82: Member States shall ensure that insurance and reinsurance undertakings have internal processes and procedures in place to ensure the appropriateness, completeness and accuracy of the data used in the calculation of their technical provisions. Article 104: When granting supervisory approval [for the Solvency Capital Requirement calculation], supervisory authorities shall verify the completeness, accuracy and appropriateness of the data used. Article 121 (part 3): Data used for the internal model shall be accurate, complete and appropriate. Article 124: The model validation process shall include an assessment of the accuracy, completeness and appropriateness of the data used by the internal model. Solvency II is the most sweeping regulatory change that people now working in the insurance industry have ever experienced and the key to compliance will be high quality data, which is essential for appropriate risk modeling. Kathleen Dugan EMEA Product Manager, Northern Trust Those three words accuracy, completeness and appropriateness paint a promising picture for data that organizations bet their futures on. Unfortunately, ensuring that data fits these attributes is more difficult than it seems, and not every company succeeds. The Financial Services Authority (FSA), industry regulator in the UK, gives insurers a poor prognosis: Firms should pay particular attention to the requirement for data as experience under the FSA s existing regime has indicated that the current quality of data in many UK firms may fall short of both existing and Solvency II requirements. 1 1 Financial Services Authority, Insurance Risk Management, The Path to Solvency II, DP08/04 1

SAS White Paper Consider these quotes from executives at a prominent UK insurer, gleaned while the company was evaluating its data governance abilities: There is a strong desire in many areas across the organization for more granular analysis than is easily possible today within our operational performance reporting. - Risk The organization needs to get to standard definitions, standard reporting, and standard access points for common data that is used for different purposes because this data feeds Solvency II, all of the business plans, extracts for reporting all way to top and externally as well. We are not there yet. - Actuarial The single biggest challenge we face to meeting our objectives is data related. Because we can t see all the data we need in one place, our fraud detection efforts focus only on the products at higher risk for fraudulent activity we cannot mine all products in this way. - Financial Crimes It is clear that to satisfy the supervisory provisions within Solvency II, insurers will have to overcome the issues described above and get better at managing their data. Achieving this is well within the realm of possibility; however, it will require a broad-based approach to data governance that is missing at many companies. This paper highlights a data governance framework that will position insurers to not only meet the accurate, complete and appropriate provisions of Solvency II, but start reaping benefits from highquality data across all aspects of their businesses. 2

It s Imperative: A Data Governance Primer for Solvency II and Beyond When Technology Is Not Enough Data quality problems can be multi-faceted, reaching from the front line to the board room, involving multiple technologies and touching many business processes. Effective solutions for these problems must be equally versatile, flowing across the organization to impact people, processes and technology as needed. Take an insurer whose percentage of pension contribution products rolling over to annuities at customer retirement has experienced a sharp decline. This issue affected both the solvency models (annuity funds influence investment management and, indirectly, capital requirement) and company profitability. The organization recognized the importance of data quality and invested in state-ofthe-art quality profiling technology. It also set up a quality improvement (QI) team and associated that team with its data warehouse. Data profiling by the QI team revealed that the age of retirement field (which is used by marketing to trigger annuity awareness campaigns several years before a customer s target retirement date) had widespread quality problems, ranging from missing numbers to antiquated values. Moreover, all the customers from a particular independent financial advisor (IFA) seemed to be planning to retire at age 63. Solution brainstorming by the QI team and marketing yielded a four-step course of action: 1. Change the pension origination system to make age of retirement a required field. 2. Train the call center staff supporting the direct customer base to periodically inquire about any changes to this information when the customer calls for service. 3. Train the IFA groups on the importance of this field and request that they include collection and update of this information in their annual customer review meetings. 4. Implement continued quality monitoring on this field and communicate accordingly to all groups if the quality does not improve. By all accounts, the group has come up with a thorough and thoughtful solution. However, if the insurer does not have the appropriate data governance framework in place, getting some of the suggestions implemented could be difficult. The team can and should monitor the quality of this field. They can do so by establishing a benchmark metric for age of retirement, incorporating the field into an automated data quality profiling and reporting environment, flagging variances in quality (both positive and negative) and reporting on these variances to the business stakeholders. It is only when attempting to implement the other three aspects of the solution that they may experience insurmountable organizational issues. 3

SAS White Paper Modifying the policy origination system requires budget and resources that the team does not control. If, as in many organizations, the request for IT spending is already substantially higher than the budget, even the IT director may not be able to influence existing priorities enough to get this request included. Enhancing client conversations at the IFA level comes with its own set of difficulties. The intermediaries sales director faces an uncertain IFA landscape due to impending Retail Delivery Review legislation, and may be unwilling to approach IFAs with additional changes until the fallout from this legislation is understood. Changing service protocols in the call center involves the director of operations, who is already dealing with the need to accomplish more with less as cost-cutting measures have affected headcount. An additional complication is the fact that none of these groups will gain substantial direct benefit from the proposed changes. Framing the Governance Program Advancing a solution like the one described above requires a holistic approach an approach the insurer s QI team is not positioned to facilitate, even with the support of marketing. This team, as well as the technology it uses to profile and report on data quality, is an important part of a data governance program; however, it is not the only component. Comprehensive governance must reach across the organization. It must touch all internal and external IT systems, establishing decision-making mechanisms that transcend organization silos. It must also enable accountability for data quality at the enterprise level. Figure 1 illustrates a comprehensive framework for data governance that includes all the components needed to achieve such a holistic approach. Corporate Drivers Strategic Priorities: Voice of the Customer; Compliance Mandates, Mergers and Acquisitions Business Drivers: At-Risk Projects: Data Quality Improvement; Operational Efficiencies Figure 1: Data governance framework Business Framework Process and Policy Data Governance Charter Guiding Principles Decision- Making Bodies Decision Rights Data Stewardship Roles and Tasks Data Management Data Requirement Data Architecture Metadata Management Data Quality Security and Data Access Administration Rights Data Governance Execution Process People: Council, Stakeholders, Meeting Agendas Process: Metrics Definition, Workflow, Council Bylaws Mechanisms: Stewardship Dashboards, Workflow Automation, Data Profiling Tools Copyright 2012, SAS Institute, Inc. 4

It s Imperative: A Data Governance Primer for Solvency II and Beyond The top half of the framework deals with the more strategic aspects of governance, including the corporate drivers and strategies that point to the need for data governance; the information quality, sharing and access policies that form data governance; and the people who will participate in the design, development, approval and enforcement of these policies. The lower half of the framework focuses on the tactical execution of the governance policies, including both the day-to-day processes required to proactively manage data and the technology required to execute those processes. As with most frameworks, all components are necessary to achieve longterm data governance goals. Cherrypicking components for immediate implementation may solve short-term problems, but will not position organizations for effective long-term data governance or data quality. Road Map to Solvency and Compliance Positioning our insurer against this framework illustrates the missing components of data governance. It also highlights the steps all organizations should take to position themselves relative to the accurate, complete and appropriate requirements of Solvency II: Corporate drivers and company strategic objectives play an important role in data governance programs because they provide the mechanism by which governance teams can focus their actions on high-value issues. Solvency II is a corporate driver, one that organizations can use to procure funding for data governance, identify key stakeholders (those with the most to gain or lose) and select the initial focus areas for the governance program. In the case of our insurer, Solvency II is the perfect launch point for expansion of the existing QI team (a standalone group focusing only on the data warehouse) into a more extensive data governance organization. By selecting the data most relevant to Solvency II (i.e., most relevant to the risk model), profiling it, mapping it to all the systems in which it resides today and identifying inconsistencies in data definition, quality problems and areas of duplication, the quality team has a clear starting point for a data governance program. The information gleaned from this analysis can dictate everything from which business stakeholders to recruit onto a governance council to what technology must be purchased or built to ensure compliance. Business framework and process and policy become the operating model for data governance. This is where participants from both business and IT are recruited, decision-making bodies are identified, roles and responsibilities established and policies that will guide the organization developed. This is also the area where our insurer s focus was too narrow. Building a team to profile data going into the data warehouse provided them with a sound mechanism for identifying quality issues, but failure to establish the formal operating model for data governance left them scrambling to find business support and funding for each problem that surfaced. 5

SAS White Paper Using Solvency II as the driver for a data governance program and focusing initial program activity on the data needed for solvency risk modeling highlights several key business stakeholders that should be recruited for formal participation on a governance council. These include, at minimum, senior-level representatives from the risk, actuarial, finance and Solvency II business units, IT, foreign business unit managers and managers of products considered at most risk from a capital efficiency perspective. Each of these functional areas uses the aforementioned data, and each has a vested interest in the Solvency II solution. They all are motivated to participate in defining, implementing and enforcing data governance policies around this initiative. Additional consideration should be given to business owners for IT systems that originate the data most relevant to the models. Individuals who deal with external sales and service channels, such as the intermediaries sales director in our example, also should be considered. The motivation for these stakeholders to participate is less obvious; one would not typically equate a sales channel with Solvency II; however, as evidenced by our insurance example, these individuals may be called upon to make changes in their organization or systems as a result of the Solvency II governance activities and thus should play at least an ancillary role. Note that while many insurers have formed business units specifically focused on Solvency II, without the formal participation of the other groups we have highlighted, Solvency II groups are likely to find themselves in the same boat as the QI team in our example able to come up with sound solutions to quality problems, but unable to drive the solutions through the business. The decision-making mechanisms employed by data governance stakeholders are key to the effort s success. A formal governance program must include identification of decision-making bodies and specific participants, and a clear delineation of roles and responsibilities for each participant in the program. Figure 2 illustrates a RACI chart of decision rights for a data governance program. Figure 2: RACI chart for data governance Governance Activity QI Team IT Data Mgmt Business SME DG Office DG Council Arbitrate conflict, advise on strategy, fun I I I A C R Communicate DG to organization I R A R I Develop DG policies and practices C I C R C C Ensure IT projects follow DG and DM practices R C I C I C Prioritize DG activity I I I A R R Ensure conformance with data security and privacy I R I C I Delegate data changes, research and definitions to I A R I right business subject matter experts Define, and scope data quality improvement projects R C R A I I Define quality metrics, monitor quality and profile R C/R R A C I new sources Perform root cause analysis for data quality problems R C R A C I and develop recommended solution Maintain metadata repository C R C A I Develop/change metadata content I R R A I Train users on data definitions, formats and meanings I R C Apply, maintain, and enforce data models, definitions, I R C A I and naming standards EXCOM Legend: R = Responsible A = Accountable C = Consulted I = Informed Copyright 2012, SAS Institute, Inc. 6

It s Imperative: A Data Governance Primer for Solvency II and Beyond A RACI chart developed for our insurer may have specified that the QI team and business subject matter experts would be responsible for conducting root cause analysis and developing the recommended solution. Meanwhile, other more senior business stakeholders would need to ensure that the final decision represented the needs of the entire organization rather than just individual business units. In our example, the issue might have been escalated to the Executive Committee (EXCOM) for final approval and funds procurement. A governance framework like that portrayed in Figure 1 ensures that decisionmaking and escalation for each issue is clearly defined and consistently applied across all problems that may surface. Once they are identified, decision-making bodies should have a hand in developing and approving the data policies that will be implemented to help ensure the completeness, accuracy and appropriateness required for Solvency II. These policies should address questions such as: Who can update information details (and who owns the data required for Solvency II)? How is inaccurate information corrected? How are conflicting needs addressed (e.g., across Actuarial and Finance)? How are changes identified and validated? How is privacy enforced? What is acceptable quality (e.g., for Solvency II) and who is responsible for monitoring and maintaining it? Who can see information? Who is responsible for assigning data and calculation definitions (particularly those used in Solvency II and also in other areas of the business)? How are data issues quantified and prioritized? Data management focuses on tactical actions that are used to carry out policies set at the strategic level. While the Solvency II regulations only call for periodic recertification of the risk model, the supervisors will want proof that quality enforcement is integrated into day-to-day business operations. The automated data profiling and quality reporting processes (and associated technologies) employed by our insurer are a good start; however, compliance with Solvency II will require a significant extension to these activities. 7

SAS White Paper In our example, quality monitoring is conducted as data flows into the data warehouse. Solvency II companies also may want to consider employing these processes on their master data management systems, on external data as it flows into the organization, and possibly on the source systems themselves. As insurers map their relevant Solvency II data from source through risk model, decisions should be made about the optimum positioning for quality profiling and remediation activity. Metadata is another area of the framework that can have an impact on Solvency II compliance. The proliferation of departmental data marts and spreadsheets used in the reporting and business decisionmaking of many organizations underscores a deep-rooted problem: the lack of consistency in data definitions, calculations and transformations across the organization. It s not enough to focus on the quality of data flowing into the risk models. If that same data also flows into other applications, such as financial reporting applications, it s possible that conflicting performance metrics will result. Reconciliation processes can highlight these issues, but robust and accessible metadata on all relevant Solvency II data will also be required. This metadata should include definition, source, history and lineage as well as cleansing, transformations and relevant business rules. Conceptual technology architecture is also an area that organizations will want to address. The multiple spreadsheets and data marts that cause issues in data consistency are symptoms of a larger problem: the lack of unified conceptual technology architecture. Such architecture provides a blueprint for system development and illustrates how data should flow throughout the organization. While most insurers preparing for Solvency II agree that a centralized data store such as a data warehouse is the optimum source for data to both risk models and financial and performance reporting applications, most are not there today. In many organizations, despite the existence of a data warehouse, the actuarial systems still get their data directly from source applications. This is not strictly a data governance issue, but longer-term plans to migrate to all risk analysis and reporting to the data warehouse will affect data governance programs and vice versa. It behooves the data governance council and stakeholders to coordinate closely with business intelligence team members and develop joint plans for this migration. 8

It s Imperative: A Data Governance Primer for Solvency II and Beyond Conclusion There is no question that Solvency II will bring sweeping change to the insurance industry. Companies must not only prove that they have adequate risk management practices and risk models, but must also provide evidence that the data used in those models is accurate, complete and appropriate. Failure to meet these criteria could force insurers to use (or effectively misuse) an industry standard formula for assessing minimum capital levels rather than using their own risk models. And that could be costly indeed. Lloyd s of London Finance Director Luke Savage estimates that its own capital requirement could rise by 10 billion pounds if it implements Solvency II using the standard formula set out under the rules of the regulations. Savage indicates that this would force Lloyd s to require an additional 2.1 billion pounds of profit per year to maintain its average return on capital for the last five years. To avoid this, Lloyd s is deploying more than 10 percent of its workforce to prepare for the regulation and to use of its own formulas and risk models. 2 Learn more To learn more about making better decisions with better data visit: sas.com/software/data-management/ data-quality-category The good news is that organizations like Lloyd s can take action to get ready for its supervisors. Assessing information sources and existing data quality capabilities; acquiring comprehensive data quality, profiling and reporting technology; and identifying relevant Solvency II data and business rules are all significant steps in the right direction. A critical additional step is needed: the implementation of a rigorous governance program that enables proactive integration of data quality and governance activities into day-to-day business operations. Organizations that follow the road map set out by the data governance framework described in this paper can be assured that they have laid the groundwork for delivering the proof that the regulators are now demanding. 2 Lloyd s of London Eyes Spiralling Solvency II Costs, Myles Neligan, June 30, 2011, Reuters.com 9

About SAS SAS is the leader in business analytics software and services, and the largest independent vendor in the business intelligence market. Through innovative solutions, SAS helps customers at more than 60,000 sites improve performance and deliver value by making better decisions faster. Since 1976 SAS has been giving customers around the world THE POWER TO KNOW. SAS Institute Inc. World Headquarters +1 919 677 8000 To contact your local SAS office, please visit: www.sas.com/offices SAS and all other SAS Institute Inc. product or service names are registered trademarks or trademarks of SAS Institute Inc. in the USA and other countries. indicates USA registration. Other brand and product names are trademarks of their respective companies. Copyright 2012, SAS Institute Inc. All rights reserved. 105965_S96864_0912