Distinguishing between the two types of initiatives, he said that insurers' efforts to develop formal ERM processes have at their core a desire to enhance shareholder value. In contrast, while many companies are rapidly developing internal capital models as well, "very few have incorporated the results of those models into the way they actually make decisions in their firms," he said, noting that many firms built their models simply to have discussions with rating agencies or because regulators require them.

Mr. Goldfarb said that Standard & Poor's announcement of plans to introduce ERM criteria helped insurers justify the increasing amount of resources they were already devoting to formal ERM processes. Sarbanes-Oxley required firms to make big investments in documenting their internal controls, "and a lot of firms were looking to leverage those investments" by putting ERM processes in place also, he said.

With ERM, insurers are not only striving to comply with external requirements, they're using S&P's framework "as a benchmark" for their activities, he noted. Nearly all chief risk officers and executives state clearly "that their goal is to enhance shareholder value. None feel pressure to limit what they're doing to what S&P or others say they want to see."

S&P, meanwhile, is "very respectful of the fact that every insurer is likely to approach risk management differently," he said. "They're not expecting one-size-fits-all implementation." He added that the S&P framework fits nicely with what firms were already doing.

The three biggest areas of activity are adopting a risk management culture, articulating a risk appetite and using risk measurements to drive corporate decisions. "Ironically, those are the three things S&P lists among their top priorities," he said.

With respect to economic capital models, Mr. Goldfarb and others pointed out that European regulators are demanding that firms build their own internal capital models. So, U.S. firms with European operations were already developing such models before rating agencies said they would review them, Mr. Goldfarb said.

Moving past the use of models to comply with regulatory mandates or to have discussions with rating agencies remains a next step for many insurers, he said. "Building the model isn't sufficient [and] no single model [is] going to address all their risk management needs. They are going to need to adapt the models in different ways to help guide decisions."

Mr. Goldfarb noted that in building their agency models, rating agencies have as their primary objective the goal of assessing insurers' abilities to satisfy policyholders. Insurance company management teams, however, have other objectives. For example, he noted that while rating agency models are appropriately focused on "current policyholders," there are situations where current policyholders are paid, but the companies are too weak to stay in business and write more policies.

Referring to situations following Hurricane Katrina, he said some companies had to raise new capital from new investors--which was harmful to existing shareholders--or they had to stop writing new business.

Still, while Mr. Goldfarb believes there are some real benefits to be derived just from the act of building a model, he's not convinced that every insurer needs one. "I can identify firms that have excellent risk management processes on almost all the dimensions S&P has identified and then some, but they don't have an economic capital model," he said. He noted that insurers can do a lot to be aware of risks--set limits and have controls in place--without a model.

"Adequately reflecting risk in the pricing of...policies and making well-informed decisions about which risks to retain and which to transfer [to reinsurers] are two key tools insurers have to manage risks," he said, adding that a lot could be done "on a more isolated basis without having to incorporate very complex models of the entire firm and all of its risks."

William Wilt, an analyst for Morgan Stanley in New York, shared similar observations on the question of whether economic capital models help outsiders assess the quality of risk management.

"I'm not sure that you need a model to do that," said Mr. Wilt, a former ratings analyst for Moody's, who worked on the New York rating agency's risk-adjusted capital model. "In fact, it's certainly possible that a model could be gamed once [it's] well understood."

Mr. Wilt said he would place as much importance "on an analysis of internal controls, procedures, reports and surprise data requests," such as asking a company to provide all its investments in certain industry codes along with the directors & officers liability insurance limits exposed in those same industries.

Both Mr. Wilt and Mr. Goldfarb referred to the lessons that unsophisticated users of catastrophe models have learned over the last few years. In some cases, the efforts of rating agencies to move firms well down the path of ERM is moving them too far toward "management by model," Mr. Goldfarb said.

On the other hand, "our clients find the process of building models and thinking about risk incredibly helpful, regardless of how much reliance they put on final numbers," he said.

The models also provide a basis for powerful internal discussions, he said. "When the heads of business units come together, they have a common framework to discuss where most of the risk in the firm is coming from and the impacts of different risk management strategies," he said.

As for the differences in the models being built and tinkered with by rating firms, Mr. Goldfarb responded that all the models "require simplification at some stage." While each of the rating agencies has a desire to make its model "seem like a major leap forward and very different," he added, "there are no fundamental differences" in the key risks the models attempt to measure.

He noted that the biggest differences will be how results are interpreted, not the physical models--referring to the way each firm maps results to different rating levels.

He added that the models differ somewhat in how much and where they chose to simplify model inputs. In Fitch's model, for example, "they've gone out of their way to try to allow the model to pick up as many company-specific characteristics as possible," while others attempt to rely more heavily on public information.