APAC insurance risk officers confront these 3 top concerns head-on

Discover how 2 insurance leaders tackle conduct risk, cybersecurity, and business model evolution.

With diversity presenting itself in every market in the Asia Pacific (APAC) region today, insurance Chief Risk Officers (CROs) are seeing three top challenges: conduct risk, cybersecurity, and business model change.

Of these, conduct risk is considered to be the most significant threat by 54% of Asia-Pacific CROs — compared to 19% globally — influenced by the region’s regulatory environment, according to a survey by EY and the Institute of International Finance (IIF).

Experts such as Tze Ping Chng, EY Asia-Pacific Consulting Insurance Sector leader, and Bernhard Kotanko, senior partner at McKinsey & Co., separately told Insurance Asia why these concerns persist and how to effectively manage them.

EY’s Chng attributed this heightened concern to the rapid growth and expansion strategies prevalent in the region.

“Asia is one of the fastest-growing regions globally, which naturally leads to a strong focus on new business generation,” Chng told the magazine. “With this growth comes the challenge of maintaining ethical sales practices and ensuring compliance with regulatory frameworks.”

Tze Ping Chng, Insurance Sector leader at EY Asia-Pacific Consulting.

Conduct-related regulations in markets like Australia, Hong Kong, Malaysia, and Singapore drive the focus on conduct risk in the region.

For example, the influx of Mainland Chinese Visitors (MCV) in Hong Kong raises questions about firm licensing, conduct, and sales payments. Similar regulatory tightening is happening across Asia, including China.

Chng recalled how a significant portion of sales occurs through bank insurance channels, citing a particular occurrence in Vietnam.

“About a year ago in Vietnam, an incident impacted the entire bank insurance market, leading to many policy lapses and terminations,” he said. “As the Chief Risk Officer of an insurance company in Asia focused on growth, I need to ensure proper controls and governance structures for generating new sales. This issue has raised more concerns here (in APAC) compared to our peers in the Americas or EMEA (Europe, the Middle East, and Africa),” Chng said.

Meanwhile, McKinsey’s Kotanko attributed the conduct-risk fear to the unique characteristics of the insurance market in Asia, where distribution is predominantly agency-led.

“There are tens of thousands of agents, and each one is an individual entrepreneur. This comes with a lot of operational risk considerations to ensure they act in the full interest of the customer and comply with all processes,” he told Insurance Asia.

Bernhard Kotanko, senior partner at McKinsey & Co.

The fast-paced innovation in investment structures and the underlying risks also contribute to this heightened awareness. 

CROs must ensure that customers fully understand and appreciate the products, adding another layer of complexity to risk management.

“Financial risks are almost clearer and more transparent to measure and model. In contrast, conduct risk is less transparent and more challenging to control,” Kotanko said.

Cyber security

Whilst conduct risk emerges as the main concern in the region, cybersecurity remains a global priority issue.

And since APAC insurers are ahead in AI adoption, it is notable that 38% use automation and advanced analytics for fraud detection, risk assessment, and reporting. Such is the region’s proactive stance to boost cybersecurity by adding layers of complexity to cyber threats.

“Asia is essentially a collection of individual markets with individual systems and regulations, making it more complex than monolithic markets like the European Union or the United States," Kotanko observed.

This fragmentation necessitates a robust and adaptable approach to cybersecurity, reflecting the professionalism of CROs in the region.

Kotanko highlighted three main areas where AI is making a significant impact:

• Summarisation and personalisation: AI enhances customer service and administrative efficiency by extracting and summarising information from various sources.
• Quality of advice: AI augments advisory functions, improving the quality and personalisation of advice provided to customers.
• Technological efficiency: AI optimises coding and other technological processes, contributing to overall productivity.

Despite these advancements, Kotanko noted that most insurers are still in the early stages of AI adoption, focusing on proof of concept and experimentation rather than industrialised impact.

Chng warned that the sophistication of cyber-attacks is escalating, necessitating advanced defences. He also underscored the importance of data quality and privacy, particularly in the context of AI and machine learning.

“Companies need to focus on data management, ensuring compliance with local data privacy regulations while leveraging AI technologies,” Chng advised.

Business model transformation

The survey also indicates that 46% of APAC CROs are prioritising business model transformation. Chng emphasised that this urgency stems from multiple drivers, including regulatory changes and evolving customer expectations.

“We are in a very exciting region with a lot of growth opportunities, but this also brings challenges that require continuous adaptation and transformation,” he said.

Key regulatory changes, such as the implementation of IFRS 17, have necessitated significant adjustments in financial reporting standards. Chng described IFRS 17 as the most substantial change in over two decades, impacting profit recording and capital management practices.

Also, the introduction of new capital regimes, like the Risk-Based Capital (RBC) framework in Hong Kong, has profound implications for insurers' investment strategies and product offerings.

McKinsey’s Kotanko identified four key drivers behind this urgency:

•  Regulatory changes: New solvency regimes and IFRS 17 are transforming how business is measured, necessitating changes in business models.
• Market volatility: Increased volatility demands higher productivity and rapid digital transformation, which come with associated risks.
• Cross-border connectivity: Enhanced connectivity within the region introduces new types of risks, particularly as insurers integrate life insurance with wealth management and health insurance.
• Talent dynamics: The evolving talent market, with its increased attrition and shifting expectations, is transforming business operations, including the adaptation to remote working models.

Emerging risks and future outlook

CROs globally expect geopolitical and environmental risks to dominate in the next three years. Chng expounded on how the survey revealed concerns from across the region, including China, Korea, and Japan.

Recent geopolitical tensions, such as North Korea's missile launches, exemplify the unpredictable nature of these risks.

Environmental risks, driven by extreme weather events and natural disasters, pose another significant challenge. Chng cited the recent landslide in Papua New Guinea and the Singapore Airlines incident as stark reminders of the growing frequency and severity of such events.

As the insurance sector navigates these multifaceted challenges, the role of the CRO becomes increasingly pivotal. The CRO’s role is demanding, balancing growth ambitions with risk management to ensure sustainable and ethical operations.

Effective risk management requires everyone in the organisation to be responsible for non-financial risks like operational, data, conduct, and cyber risks, ensuring insurers can navigate the complexities of the modern risk landscape.

Looking ahead, Kotanko emphasised the importance of holistic risk management. “Insurance is about taking risks. The best risk managers are those who understand how to take risks smartly,” he said.

“The biggest incidents have happened in new and unknown territories, often in the smallest part of the company. Therefore, the best risk managers make a real effort to look around the corner, anticipate, think in scenarios, and have the courage to explore the unknown rather than just manage the known risks. Typically, the known risks are very well managed. It's the unknown risks where the best risk managers need to focus,” he added.