Business Management · Issues and challenges in each main practice area

Enterprise Risk Management and Capital Challenges for Actuaries

Updated 11 October 2026 · Fact-checked

Enterprise risk management (ERM) is a joined-up process to identify, measure, manage and monitor all risks across a firm. Capital links to it: economic capital is the amount the firm needs to cover losses at a chosen confidence level, and solvency rules set the minimum regulators require. Answer by linking risks, capital and governance.

Understand Enterprise Risk Management and Capital Challenges

Risk is uncertainty about outcomes that can hurt objectives. Traditional risk management treats risks in silos. The insurance team looks at underwriting, the treasury looks at markets, and operations looks at its own failures. Each team uses its own tools. The firm misses how risks interact and add up.

Enterprise risk management (ERM) looks at all risks together, across the whole firm, and ties them to strategy and risk appetite. It gives a common language, a common process and one view of total risk. A key benefit is that it shows diversification (risks that do not all go wrong together) and concentration (risks that do).

The ERM process usually runs in a cycle: set objectives and risk appetite, identify risks, assess them (likelihood and impact), decide a response (avoid, reduce, transfer, accept), then monitor and report. Typical risk categories for financial firms are insurance (underwriting, reserving, lapse), market, credit, liquidity, operational, and strategic or reputational risk.

Capital is the cushion that absorbs losses. Economic capital is the firm's own estimate of the capital it needs so that the chance of failing over a set period stays within a chosen level. It is often based on a measure such as Value at Risk (VaR) or Tail VaR at a stated confidence level and time horizon. Regulatory capital is the minimum the regulator requires. The two can differ, because the regulator sets a standard formula or rules for all firms, while economic capital reflects the firm's own risk profile.

Solvency regulation protects policyholders by requiring firms to hold assets above liabilities plus a capital requirement. In India, the insurance regulator is IRDAI, which sets solvency requirements and expects insurers to have risk management frameworks and an appointed actuary role. The direction of travel in many markets, including discussion in India, is towards risk-based capital, where required capital depends on the risks actually taken. Check the current IRDAI rules in your study material, as these change.

Risk governance is who owns risk and who checks it. A common model is the three lines of defence: business units own and manage risk, a risk and compliance function oversees it, and internal audit gives independent assurance. The board sets risk appetite and a chief risk officer (CRO) often leads the risk function. Challenges include data quality, model risk, getting senior buy-in, and a culture where risks are hidden rather than raised.

Key rules to remember

Solvency ratio: Solvency ratio = Available capital ÷ Required capital; A ratio of 1 (100%) means capital equals the requirement. Regulators set the minimum level; check the current IRDAI rule.
Surplus over requirement: Excess capital = Available capital − Required capital; Positive means the firm meets the requirement. Available capital is assets less liabilities, after any admissibility rules.
Value at Risk (VaR): P(Loss > VaR) = 1 − α; α is the confidence level, such as 99.5%, over a stated time horizon. VaR is the loss threshold, not the average loss beyond it.
Tail VaR (expected shortfall): TVaR(α) = E[Loss | Loss ≥ VaR(α)]; Average loss in the worst cases. For continuous losses it is at least as large as VaR at the same level.
Economic capital (loss-based view): Economic capital = VaR(α) − Expected loss; One common definition: capital covers unexpected loss, while expected loss is covered by pricing and reserves. State the definition you use.
Risk response options: Avoid | Reduce | Transfer | Accept; Choose by comparing the risk with appetite and the cost of the response.

How to solve Enterprise Risk Management and Capital Challenges questions

Use this method for any ERM or capital question, whether it is a list, a case study or a calculation.

1Read the question and identify the firm type (life insurer, general insurer, bank, pension fund) and what is asked: describe, discuss, calculate or advise.
2List the relevant risks by category: insurance, market, credit, liquidity, operational, strategic. Tie each to the firm in the question.
3Assess each risk: likelihood, impact, and how it interacts with other risks. Mention diversification or concentration.
4Link to capital: say whether the risk needs capital, and whether economic or regulatory capital is meant. State the confidence level and time horizon you assume.
5If there is a calculation, write the formula, substitute the numbers, and give the result with units and a one-line interpretation.
6Propose responses: avoid, reduce, transfer or accept, with the cost or trade-off of each.
7Cover governance: ownership, three lines of defence, board risk appetite, reporting and monitoring.
8Finish with a short conclusion that answers the exact question asked.

Quickest way: Risk, capital, governance in three lines

When to use it: For multiple-choice questions and short written parts when time is tight.

Name the risk category in one phrase and who owns it.
State its capital effect: higher risk means more required capital, unless diversified or reduced.
Add the control: a response option plus a governance check.
For ratios, compute available ÷ required first, then compare with the minimum.
For MCQs, remove options that confuse economic capital (own view) with regulatory capital (rule-based).

Common mistakes in Enterprise Risk Management and Capital Challenges

Describing ERM as just a bigger risk register.
Students focus on identifying risks and forget the integrated, strategy-linked view.
Fix: Always mention common process, risk appetite, aggregation across risks and links to strategy and capital.
Treating economic capital and regulatory capital as the same thing.
Both are called capital and both protect against failure.
Fix: Say economic capital is the firm's own estimate of its risk profile, and regulatory capital is the legal minimum. Explain why they may differ.
Quoting VaR with no confidence level or time horizon.
The number looks complete on its own.
Fix: Always write the level (for example 99.5%) and horizon (for example one year) next to any VaR or capital figure.
Listing only insurance and market risk.
These are the most familiar from earlier subjects.
Fix: Run a checklist: insurance, market, credit, liquidity, operational, strategic and reputational. Pick those that fit the case.
Ignoring governance and culture.
Students treat risk as a modelling topic only.
Fix: Add one point on three lines of defence, board oversight and risk culture. Weak governance can defeat a good model.
Stating that diversification always reduces capital.
Students overstate a useful rule.
Fix: Say it reduces capital when risks are not perfectly correlated. In stress, correlations can rise and the benefit can shrink.

Worked examples

Example 1

An insurer has available capital of ₹840 crore and required capital of ₹600 crore. (a) Find the solvency ratio and the excess capital. (b) The regulator's minimum ratio is 150%. Does the insurer meet it?

Show the solution

Solvency ratio = available ÷ required = 840 ÷ 600.
840 ÷ 600 = 1.4, which is 140%.
Excess capital = 840 − 600 = ₹240 crore.
Compare with the minimum: 140% is below 150%.
To reach 150% the insurer needs available capital of 1.5 × 600 = ₹900 crore, so a shortfall of 900 − 840 = ₹60 crore.

Answer: Solvency ratio is 140% and excess over the requirement is ₹240 crore. It does not meet a 150% minimum, with a shortfall of ₹60 crore of available capital.

Example 2

A general insurer's one-year aggregate loss has an expected value of ₹300 crore. Its 99.5% VaR is ₹720 crore. (a) Find economic capital using the unexpected-loss definition. (b) Explain why the board should also look at Tail VaR.

Show the solution

Economic capital = VaR − expected loss.
Substitute: 720 − 300 = ₹420 crore.
State the basis: 99.5% confidence, one-year horizon, with expected loss covered by premiums and reserves.
VaR only gives the loss level that is exceeded with probability 0.5%. It says nothing about how bad losses are beyond that point.
Tail VaR averages the losses in that worst tail, so it shows the size of extreme losses and tail risk such as catastrophes.
The board can use it to set risk appetite, reinsurance and limits for concentrations.

Answer: Economic capital is ₹420 crore at 99.5% over one year. Tail VaR is useful because it captures the severity of losses beyond VaR, which VaR ignores.

Exam tips

Define terms in one line first (ERM, risk appetite, economic capital). Marks often go for clear definitions.
Use the case details. Name the firm type and its main risks rather than giving a generic list.
Write the confidence level and horizon next to every capital number.
In long answers, structure by risk, capital, response and governance. It is easy for the marker to follow.
Check current IRDAI requirements in your study material before quoting any solvency level, and do not guess figures.

Practice questions from Issues and challenges in each main practice area

Enterprise Risk Management and Capital Challenges in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Enterprise Risk Management and Capital Challenges: frequently asked questions

What is the difference between ERM and traditional risk management?

Traditional risk management handles each risk separately in silos. ERM looks at all risks together across the firm, links them to strategy and risk appetite, and considers how they interact. This gives one view of total risk and capital.

What is economic capital in insurance?

It is the capital a firm estimates it needs so that the chance of failure over a set period stays within a chosen level, such as 99.5% over one year. It reflects the firm's own risk profile. It is different from the regulatory minimum.

What is solvency in insurance?

Solvency means the insurer has enough assets to meet its liabilities and also holds a required margin of capital. Regulators set the rules to protect policyholders. In India, IRDAI sets the solvency requirements.

What is risk-based capital?

It is a system where required capital depends on the size and type of risks a firm actually takes. Riskier business needs more capital. Check current IRDAI rules for how India applies this.

What are the three lines of defence?

The first line is the business, which owns and manages risk. The second line is the risk and compliance function, which oversees and challenges. The third line is internal audit, which gives independent assurance to the board.