The actuary in risk management (ERM): ARSI, RCS and stress testing

Overview of the specialty

Enterprise risk management (ERM) treats the institution as a portfolio of interacting risks. An earthquake simultaneously hits property reserves, the price of equities held in the portfolio and the ability of reinsurers to pay; a recession raises lapse rates in life insurance and default rates among borrowers. Measuring each risk in isolation underestimates some things and double counts others.

The actuary is a natural fit for this field because actuarial training begins where others end: loss distributions, heavy tails, dependence between variables and the valuation of long-term obligations. The question the actuary answers is concrete: how much capital the institution has, how much it needs to survive an adverse year with high probability, and which business decisions move that relationship.

In Mexico the insurance framework has been Solvency II style since the LISF (Insurance and Surety Institutions Law) took effect in 2015. Article 69 requires institutions to have an enterprise risk management system run by a dedicated function, covering the risks in the solvency capital requirement and any other risk the institution identifies, and to carry out a periodic own risk and solvency self-assessment. The CUSF (Single Insurance and Surety Circular) calls it the ARSI (Autoevaluación de Riesgos y Solvencia Institucionales), the equivalent of the European ORSA.

Outside insurance, banks, Afores and brokerage firms maintain enterprise risk management units required by the CNBV (National Banking and Securities Commission) and CONSAR (National Retirement Savings Commission), and nonfinancial corporations adopt ERM for exchange rate, commodity, continuity and cybersecurity risk. The theoretical basis of solvency is covered in solvency and in ruin theory.

Key functions

Appetite, tolerance and limits

Proposes the risk appetite statement to the board: how much capital to put at risk, what solvency ratio to maintain and which risks to avoid. Translates it into operating limits by risk, line of business and counterparty, and monitors their usage.

Regulatory and economic capital

Calculates the RCS monthly with the CNSF standard formula or an internal model, along with the institution's own economic capital that better reflects its profile. Explains the differences between the two, which the ARSI must analyze.

ARSI and Dynamic Solvency Test

Pulls together the annual self-assessment: compliance with policies, overall solvency needs under the business plan, deviation of the risk profile from the RCS assumptions and corrective measures. Coordinates the PSD, which projects solvency under adverse scenarios.

Stress tests and scenarios

Designs sensitivity, historical, hypothetical and reverse scenarios (which event would bring solvency down to the minimum). Quantifies the effect on own funds and on the RCS and proposes management actions.

Operational risk

Builds the loss event database, runs risk and control self-assessments, defines key risk indicators and models low-frequency, high-severity losses, including cyberattacks and third-party failures.

Board reporting and risk culture

Presents, at least quarterly, overall exposure and exposure by risk type, limit compliance and stress test results. Takes part in product, reinsurance and investment decisions as the second line of defense.

Techniques, models and formulas

ERM takes the tools of risk theory and applies them across the whole institution. The hard part is not calculating a VaR, but doing so with realistic distributions, aggregating risks with plausible dependence and turning the result into decisions.

VaR and TVaR

VaR is a quantile of the loss distribution; TVaR is the average loss beyond that quantile. TVaR is subadditive and captures the severity of the tail, which is why it is preferred for economic capital; the Mexican RCS is calibrated at 99.5% over one year.

Aggregation with correlations and copulas

The standard formula aggregates requirements with a square root formula and a correlation matrix. Internal models simulate with copulas (Gaussian, t or Clayton) that capture tail dependence, where risks move together.

Stress tests and reverse stress tests

Beyond forward-looking scenarios, the reverse stress test starts from the unacceptable outcome and searches for the combinations of events that produce it. It reveals concentrations that statistical models hide.

Operational risk modeling

The loss distribution approach (LDA) combines Poisson or negative binomial frequency with heavy-tailed severities, supplemented by expert scenarios when internal data are scarce.

Ruin theory and capital

The Cramér-Lundberg model links initial capital, safety loading and the probability of ruin. It builds intuition about the trade-off between capital, price and retention, which ERM formalizes over a one-year horizon.

Aggregation of capital requirements

\[RC = \sqrt{\sum_{i}\sum_{j} \rho_{ij}\, RC_i\, RC_j}\]

RC_i is the capital for risk i measured on a standalone basis and ρ_ij is the correlation between risks; if all correlations equal 1 there is no diversification benefit.

Value at risk

\[\mathrm{VaR}_{\alpha}(L) = \inf\{\ell : P(L \le \ell) \ge \alpha\}\]

L is the loss over the horizon and α the confidence level; for a normal distribution with mean μ and standard deviation σ, VaR_99.5% = μ + 2.5758σ.

Tail value at risk

\[\mathrm{TVaR}_{\alpha}(L) = \frac{1}{1-\alpha}\int_{\alpha}^{1} \mathrm{VaR}_{u}(L)\, du\]

It averages the quantiles above α; for the normal, TVaR_99.5% = μ + 2.8919σ, 12% more than the VaR at the same level when μ = 0.

Regulatory framework in Mexico

LISF · Art. 69

Requires a corporate governance system that includes enterprise risk management run by a dedicated function, and a periodic self-assessment that reviews compliance with policies, overall solvency needs based on the Dynamic Solvency Test, compliance with investment, reserve and capital rules, and the extent to which the risk profile departs from the RCS assumptions.

CNSF · CUSF Chapter 3.2

The risk management function must make the ARSI available to the board during the first half of the year following the year assessed, review its model assumptions at least annually and report to the board, at least quarterly, overall exposure and exposure by risk type, limit compliance and the results of sensitivity and stress tests.

LISF · Arts. 232 to 237 · CUSF Title 6

The RCS is calculated monthly with the standard formula or an internal model and covers unexpected losses at a 99.5% confidence level over one year. It includes technical underwriting risk, market, mismatch, liquidity, credit (including reinsurers and intermediaries), concentration and operational risk.

LISF · Arts. 245 and 246 · CUSF Chapter 7.2

The Dynamic Solvency Test is performed at least annually and is part of the ARSI. It considers a base scenario plus feasible adverse, integrated and statutory scenarios, with a minimum projection of five years in life and two in property and casualty and in accident and health, and it is signed by an actuary registered with the CNSF.

CUSF Chapter 24.2 · Disclosure

The Solvency and Financial Condition Report makes public the risk profile, the RCS, own funds and the corporate governance system, which exposes the work of the risk function to the market.

CNBV and CONSAR

In banking, brokerage and Afores, regulation requires enterprise risk management units independent of the business areas, with board-approved limits and measurement of market, credit, liquidity and operational risk.

Case study: risk appetite, stress testing and management actions

An insurer measures its capital in millions of pesos: underwriting 420, market 310 and counterparty 90, with correlations of 0.25 between underwriting and the other two and 0.50 between market and counterparty. It adds a simplified operational risk charge of 8% of diversified capital (an illustrative assumption). It has eligible own funds of 1,150. The board approved an appetite of a 150% solvency ratio, a tolerance of 130% that triggers action, and the regulatory minimum of 100%.

Aggregation: the simple sum is 820, but with correlations diversified capital is 626.50, a diversification benefit of 23.6%. Adding operational risk (626.50 × 0.08 = 50.12) brings the requirement to 676.62.
Current position: 1,150 / 676.62 = 170.0%, within appetite.
Feasible adverse scenario (equity market drop, rate rise with mismatch, and adverse claims experience): own funds fall by 300 and the requirement rises 5%. Result: 850 / 710.45 = 119.6%, below the 130% tolerance.
Action 1, a 30% quota share on underwriting: underwriting capital falls to 294, diversified capital to 526.63 and the stressed requirement to 597.20. Stressed ratio: 850 / 597.20 = 142.3%.
Action 2, in addition, reduce equities to bring market capital down to 250: diversified capital 479.08 and stressed requirement 543.27. Stressed ratio: 850 / 543.27 = 156.5%, within appetite even in the adverse scenario (before the cost of reinsurance, which a full analysis must deduct from own funds).

Lesson: The current solvency ratio is not enough: appetite is tested in the adverse scenario. The actuary's value lies in quantifying which lever, reinsurance or investments, restores solvency at the lowest cost, and in taking that decision to the board before the scenario happens.

Where they work and how they grow

Analyst (0 to 3 years)

Calculates the monthly RCS, prepares limit usage reports, feeds the operational loss event database and runs sensitivity scenarios defined by the team.

Specialist (3 to 7 years)

Designs stress scenarios, builds economic capital and aggregation models, coordinates chapters of the ARSI and takes part in the Dynamic Solvency Test.

Risk manager (7 to 12 years)

Owns a risk type or the entire capital framework, presents to the risk committee, validates models from other areas and negotiates limits with the business lines.

Head of risk or CRO (more than 12 years)

Answers to the board for the enterprise risk management system and the ARSI, proposes the risk appetite and has a voice in strategy, reinsurance and investments.

Typical employers in Mexico

Insurers and reinsurers (enterprise risk management functions)
Banks, brokerage firms and Afores (risk units)
Risk consultancies and audit firms
Regulators: CNSF, CNBV, CONSAR and Banco de México
Credit rating agencies
Nonfinancial corporations with an ERM function
Catastrophe risk modeling firms

Common job titles

Risk analystCapital and solvency actuaryOperational risk specialistEconomic capital modelerEnterprise risk management managerModel validatorActuary responsible for the PSDChief risk officer (CRO)

Skills and tools

Technical

Risk theory and loss distributionsRisk measures and copula theoryMonte Carlo simulationReserve valuation and economic balance sheetOperational risk modelingModel governance and validation

Tools

Python or R for simulationSQL and loss event databasesExcel and VBAEconomic scenario modeling toolsRisk dashboards in Power BI or Tableau

Personal

Independent judgmentCommunicating with boards and committeesStrategic business visionAbility to say no, with argumentsCross-functional work with every area

Credentials and training

CERA

Chartered Enterprise Risk Analyst: a global ERM credential awarded by actuarial associations that are signatories to the CERA Global Association agreement, including the SOA and the CAS.

SOA, Corporate Finance and ERM practice area

FSA track focused on economic capital, corporate finance and enterprise risk management.

FRM (GARP)

A financial risk credential widely recognized in banking and markets, complementary for market and credit risk.

CNSF registration to sign the PSD

The LISF requires the Dynamic Solvency Test to be signed by an actuary holding a cédula profesional and a current certification from the specialty's professional college, or accreditation by the CNSF, registered under Chapter 30.4 of the CUSF; see certification.

Trends reshaping the field

Climate risk

Supervisors are asking for physical and transition climate scenarios to be built into stress tests. For Mexico, with its exposure to hurricanes and earthquakes, the link to catastrophe risk is direct.

Cyber risk and operational resilience

Operational risk is shifting from process errors to cyberattacks and failures of technology vendors. Demand is growing for quantified scenarios of disruption and third-party dependence.

Model governance and artificial intelligence

The use of machine learning models in underwriting, pricing and reserving creates model risk, and the risk function must validate and document them and monitor them for bias and drift.

Capital as a decision input

The most mature institutions allocate capital to products and channels and measure risk-adjusted profitability, so that ERM stops being a compliance report and becomes part of pricing and strategy.

Frequently asked questions

What is the difference between the ARSI and the Dynamic Solvency Test?

The ARSI is the comprehensive self-assessment of the risk management system and of solvency needs; the PSD (Dynamic Solvency Test) is a quantitative projection of own funds and the RCS under scenarios. The CUSF provides that the PSD is part of the ARSI.

Why does the RCS use 99.5%?

It means the institution has the resources to absorb the losses of an adverse year expected to occur once every 200 years. It is the same calibration as Solvency II, which inspired the Mexican framework.

Is ERM only for financial institutions?

No. Energy, manufacturing and retail companies use ERM for exchange rate, commodity, business continuity and cybersecurity risk, even without a regulatory capital requirement.

What profile does a risk function look for?

A solid grounding in probability and statistics, programming for simulation, knowledge of the institution's balance sheet and, above all, the ability to communicate technical results to executives and board members.