Catastrophe modelling: deriving the 1-in-200 year mortality shock for a South African insurer’s capital requirements under Solvency Assessment and Management

This paper investigates catastrophe risk for South African life insurers by considering the additional deaths that could arise from a 1-in-200 year mortality shock. Existing South African academic research on catastrophic risk has mostly focused on property losses and the resulting impact on property insurance companies. Life catastrophe risks have not been extensively modelled in a South African context. Local research would be beneficial in terms of quantifying these catastrophic risks for South African life insurers, and would assist firms when assessing their own catastrophe mortality solvency requirements under the new Solvency Assessment and Management (SAM) regime by providing a summary of data relating to various past catastrophes. In this paper we model a wide range of catastrophes to assess such mortality risk faced by life insurance companies in South Africa. An extensive exercise was undertaken to obtain data for a wide range of catastrophes and these data were used to derive severity and frequency distributions for each type of catastrophe. Data relating to global events were used to supplement South African data where local data were sparse. Data sources included official government statistics, industry reports and historical news reports. Since, by nature, catastrophic events are rare, little data are available for certain types of catastrophe. This means there is a large degree of uncertainty underlying some of the estimates. Simulation techniques were used to derive estimated distributions for the potential number of deaths for particular catastrophic events. The calculated overall shock for the national population was 2.6 deaths per thousand, which was lower than the SAM Pillar 1 shock of 3.2 deaths per thousand for the same population. It has been found that a worldwide pandemic is by far the main risk in terms of number of deaths in a catastrophe and, given that this is the most significant component of catastrophe risk, prior research on this risk in an South African context is summarised and revisited.

context. Local research would be beneficial in terms of quantifying these catastrophic risks for South African life insurers, and would assist firms when assessing their own catastrophe mortality solvency requirements under the new Solvency Assessment and Management (SAM) regime by providing a summary of data relating to various past catastrophes.
In this paper we model a wide range of catastrophes to assess such mortality risk faced by life insurance companies in South Africa. An extensive exercise was undertaken to obtain data for a wide range of catastrophes and these data were used to derive severity and frequency distributions for each type of catastrophe. Data relating to global events were used to supplement South African data where local data were sparse. Data sources included official government statistics, industry reports and historical news reports. Since, by nature, catastrophic events are rare, little data are available for certain types of catastrophe. This means there is a large degree of uncertainty underlying some of the estimates. Simulation techniques were used to derive estimated distributions for the potential number of deaths for particular catastrophic events. The calculated overall shock for the national population was 2.6 deaths per thousand, which was lower than the SAM Pillar 1 shock of 3.2 deaths per thousand for the same population.
It has been found that a worldwide pandemic is by far the main risk in terms of number of deaths in a catastrophe and, given that this is the most significant component of catastrophe risk, prior research on this risk in an South African context is summarised and revisited. INTRODUCTION

1.1
The Solvency II Directive (Council of the European Parliament, 2009) is a principlesbased regulatory regime which will apply to insurers in all 27 European Union (EU) member states and is set to be implemented from 1 January 2016. The United Kingdom's Financial Services Authority (FSA) 1 describes Solvency II as "[setting] out new, stronger EU-wide requirements on capital adequacy and risk management for insurers, with the aim of increasing protection for policyholders. The strengthened regime aims to reduce the possibility of consumer loss or market disruption in insurance". 2 The Solvency Capital Requirement (SCR) is the minimum capital requirement to avoid regulatory intervention, while the lower Minimum Capital Requirement (MCR) is the absolute minimum required level. The Solvency II Directive (Council of the European Parliament, op. cit.: 51-52) states that all quantifiable risks should be included in the calculation of the SCR, and the capital requirement for each risk module calculated as the 99.5% (1-in-200 year) Value-at-Risk of basic own funds. 3 Different classes of risk are divided into modules, which are then further divided into sub-modules. Article 104 of the Directive sets out life catastrophe risk as a compulsory sub-module of the life underwriting risk module.

1.2
South Africa's Financial Services Board (FSB) has embarked on establishing a riskbased supervisory regime for insurers in South Africa that, while taking local circumstances into account, is also aligned with Solvency II and meets the EU's requirements for third country equivalence. 4 This regime (Solvency Assessment and Management (SAM)) is set to be implemented in South Africa from 1 January 2016. 1 The FSA is now the Prudential Regulation Authority (PRA) in this context. 2 Background to Solvency II. www.fsa.gov.uk/ about/what/solvency/background, retrieved 24 February 2013. 3 Basic own funds is defined as the difference between assets and liabilities. The liabilities should not include the risk margin of technical provisions and should not include subordinated liabilities (EIOPA, 2012: 117). 4 Solvency Assessment and Management (SAM) Roadmap (2010). www.fsb.co.za/Departments/ insurance/Documents/FSBSAMRoadmap.pdf, retrieved 17 July 2014.

1.3
When calculating the SCR for each of the risk modules, companies have a choice: to use the Standard Formula as set out in the FSB's Technical Specifications 5 and subsequent Final Position Papers, or to develop a full or partial internal model. Internal models are more appropriate when a company believes that a model tailored to their specific exposures would demonstrate a better measure of their risk (Buckham, Wahl & Rose, 2011: 74). This internal model would then enable a more accurate calculation of the capital required to cover those risks. Both partial and full internal models are subject to tight standards and scrutiny by the regulator, and are subject to an approval process by the insurer's regulator (for example the PRA or FSB) before they may be implemented (Council of the European Parliament, op. cit.: 26). For a more accurate reflection of risk, an insurer may seek to develop an internal model for the life catastrophe shock. 1.4 The model behind this research aims to derive an appropriate mortality shock for the Standard Formula life catastrophe (CAT) risk sub-module in a South African context. The shock is defined as the additional deaths per 1000 policyholders (relative to expected), as a result of a 1-in-200 year catastrophic event. The resultant change in basic own funds from this shock gives the 99.5% Value-at-Risk (VaR), and hence the capital requirement for this sub-module. The SCR for the life catastrophe sub-module is defined as:

LifeCAT = ΔBOF | life CAT shock
where: ΔBOF = change in the value of basic own funds, 6 and life CAT shock = instantaneous increase of x per thousand to the mortality rates which are used in the calculation of technical provisions to reflect the mortality experience in the following 12 months where x reflects the number of deaths as a result of the 1-in-200 life catastrophe shock The above framework is as laid out in the Technical Specifications documents (FSB, 2013: SCR 7.7).

1.5
The aim of this research is to find the number of deaths in South Africa resulting from a 1-in-200-year catastrophe event, this figure being converted to deaths per 1000 in the mortality shock. An insurer would then use this information to determine the capital charge for this sub-module. They would do this by looking at their spread of sums assured and determining the expected increase in mortality benefits payable due to the shock. The actual calculation of capital charges is beyond the scope of this paper.

1.6
The European Institute and Occupational Pensions Authority's (EIOPA) Technical Specifications (2012: 194) suggest a life catastrophe mortality shock of 1.5 per thousand in the Standard Formula for EU insurers. This is supported by an epidemiological model which showed that the 1-in-200 year influenza pandemic stress for most developed countries is between 1.0 and 1.5 per mille for insured lives (Swiss Re, unpublished). The same study's shock for South Africa was heavier, at around 2.5 per thousand.

1.7
The FSB's Technical Specifications (FSB, 2013) suggest a catastrophe mortality shock that is a function of the underlying mortality rate. The rationale is that HIV-positive persons are likely to be more adversely affected by a pandemic than HIV-negative persons. The instantaneous increase in mortality due to a catastrophe shock is given by the following formula: 7 Mort CAT Shock = 12 * min [max (0.2 * MortRate + 0.105; 0.125); 0.3]/ 1000 MortRate is the exposure weighted average underlying mortality rate per mille per month.

1.8
The above formula produces a shock that varies between 1.5 and 3.6 per mille. One of the aims of this study was to investigate the reasonability of the standard formula shock.

1.9
The main aim of this study was to identify and document catastrophe data from various sources for insurers wishing to derive their own catastrophe risk model as part of an internal (or partially-internal) model. 8 However, insurers utilising the standard SAM Pillar 1 formula need to assess its validity with respect to their own liabilities. Even if insurers choose not to derive an internal (or partially-internal) model, the data and methods in this paper should provide a useful source and starting point for economic capital calculations.
1.10 The SA QIS3 results indicate that the life catastrophe risk (mortality and morbidity combined) is the fifth largest of the life underwriting risks for life insurers in general, accounting for 13.4% of the total life underwriting risk capital requirement (FSB, 2015). We expect that for insurers focusing on the funeral market this risk will be even more significant, given that the SAM Pillar 1 formula is dependent on the underlying mortality rate.
1.11 The general approach adopted has been to fit distributions to past events. This gives rise to two general shortcomings. Firstly, no consideration is given to event types that have not occurred (at least somewhere in the world) before, thus future risk is underestimated in this regard. Secondly, historical data based on the last 100 or 200 years are highly unlikely to be sufficiently credible in the tail of the distribution. This gives rise to considerable uncertainty 7 FSB Position Paper (v 5) FINAL.pdf (2015). www.fsb.co.za/Departments/insurance/Documents/ Position%20Paper%2062%20(v%205)%20FINAL.pdf, retrieved 15 October 2015. 8 FSB: Internal model approval process press release. ftp://ftp.fsb.co.za/public/media/ pressrelease21042011.pdf, retrieved 18 August 2013.
in the results which is further compounded by the questionable relevance of past data when estimating future risks.
1.12 The research and model results are based on the impact of catastrophes on the national population and thus assume that the risk profile and geographic spread of an insurer's policyholders are similar to the general population. The reason for this approach is that there is very limited data, even on a national scale, for modelling purposes. This might make the results less relevant for insurers with life insurance policyholders concentrated in specific regions, in the event of localised catastrophes affecting their target market. However, even for these insurers, a countrywide pandemic might affect their policyholders in a similar way to the national population. The information and data provided in this paper may be useful for such insurers to recalculate a mortality catastrophe shock appropriate to their circumstances. The study also does not model impacts per socio-economic group; the appropriateness of this is briefly considered in section 3.6.
1.13 War risk (including civil war) has not been included in the study. Wars that have led to significant South African deaths in the last 100 years include the second Anglo-Boer War, 9 World War 1, 10 World War 2 11 and the Angola/Namibia war. 12 It is very difficult to use past information for assessing this risk due to changes in political and social factors that contribute to the risk of war, and changes in the methods and weapons used in warfare. The creation of supra-national organisations (such as the United Nations) to promote dialogue is one factor that could be expected to reduce the risk of such large-scale conflicts impacting South Africa in the future. The exclusion of this risk from our study may be a significant omission given that most South African insurers do not have war exclusions, although active participation in combat is likely to be excluded. Assessing war risk requires a method that gives suitable weight to current political and social factors. As this requires a different approach to the risks modelled in this study, further research is required for assessing war risk.
1.14 As with war risk, terrorism risk has not been analysed in this study and this could be a significant risk, but is unfortunately difficult to quantify. While South Africa has not experienced such attacks in the recent past, the risk of extremist groups operating in other African countries may in future pose a threat to South Africa. South Africa has been placed on terrorism alert in recent years, for example following the Kenyan Westgate shopping centre attack in September 2013. This risk is of particular concern to insurers with geographic concentration of risk, and is considered the second most important key risk to life (group life) writers, after pandemics. 13 Further research is required for assessing terrorism risk. 1.15 The model assumes that the risk of an influenza pandemic far outweighs, in terms of potential deaths, other pandemic risks and hence does not explicitly allow for other pandemics. The recent Ebola outbreak in central Africa highlights this limitation, but may ultimately lend weight to the validity of the assumption (at the time of writing, there had been no Ebola cases reported in South Africa from the outbreak).
1.16 In aggregating the various types of mortality catastrophe risks to derive an overall shock, this study assumed that catastrophe events were statistically independent of one another. It would, however, be reasonable to expect positive correlation between some events, for example, natural events triggering industrial and/or nuclear accidents (such as the Japanese tsunami of 2011, which affected the Fukushima nuclear power plant).

2.1
The FSB's Technical Specifications (FSB, 2013: SCR 7.7) describe catastrophe risk as follows: Catastrophe risk stems from extreme or irregular events whose effects are not sufficiently captured in the other life underwriting risk sub-modules. Examples could be a pandemic event or a nuclear explosion.
It goes on to exactly define the life CAT shock (defined earlier), which refines this catastrophe definition to look at instantaneous increases in mortality. The life catastrophe shock can be interpreted as a rare event leading to a sudden accumulation of deaths. Here 'rare' means that the event type itself (or an observed severity level) has not occurred often enough so that its effects are captured in underlying mortality data used for calculating reserves.

2.2
The HIV/AIDS pandemic, although a catastrophe to a particular human life, does not match the criteria for the mortality catastrophe shock. The reasoning is that AIDS deaths have been occurring over a long period and that the disease is now established. A certain number of additional deaths each year are therefore expected and can be anticipated. It would be reasonable to consider whether an allowance should be made for a strain of disease (currently unknown) with similar characteristics to HIV/AIDS developing in the future. However, unless this new strain causes multiple early deaths, the life catastrophe shock is not the correct risk sub-module to allow for this risk: the life mortality risk module is more appropriate for this risk as it should allow for any long-term changes in mortality rates resulting from widespread disease and its treatment.

2.3
The SAM Pillar 1 correlation between the life catastrophe and life mortality (and disability) sub-modules is a (fairly weak) positive correlation of 0.25. This correlation could be interpreted as a catastrophe-type event causing an immediate accumulation of deaths, but then also a permanent increase in underlying mortality rates. This correlation is therefore used when the various shocks for the sub-modules need to be aggregated to form the life underwriting risk module (see Figure D.1 in Appendix D for a visual overview of how the risk modules relate to each other).

2.4
A nuclear disaster is a good example of this: those near the plant would suffer severe radiation sickness and are expected to die soon after exposure (catastrophe shock), while the cohort of individuals exposed to lower doses of radiation may suffer a permanent long-term increase in mortality rates (cancer risk). The short-term effects qualify as a life catastrophe risk, whereas the longer-term after-effects should be allowed for in the other life underwriting risk sub-modules.

2.5
In light of the above definition, and after consideration of many catastrophe types, the risks that were modelled included natural hazards (such as floods, earthquakes and tornadoes), man-made disasters (including industrial, energy and transportation accidents) and pandemic diseases. These event types, together with war and terrorist attacks, appear to be the standard mass casualty events modelled in the industry (see for example RMS 14 and Milliman). 15 Terrorism risk is relatively new but, in some countries, a potentially significant source of catastrophe risk; for example "9/11" was one of the single costliest life insurance events in history, with an estimated $1.5 billion (current dollar terms) in life insurance claims (Insurance Information Institute). 16 For reasons discussed in Section 1, war and terrorism risk have been excluded from the model, and should be considered in future research.

2.6
Kraut & Richter (unpublished) state that perils causing extreme levels of mortality are generally low-frequency, high-severity events, and that the characteristics of these perils can differ significantly from each other or from usual risks. Hence catastrophic risks fall into the lower right or 'tail area' of a typical loss distribution. See Figure D.2 in Appendix D as an example. Banks (2005) shares the low-frequency/high-severity view, stating that catastrophic risk is hard to measure due to its relative infrequency. He goes on to state that catastrophes can either be sudden or prolonged. 17 Table 1  number of observations we have, so that long "return periods pose a great challenge to modelling for most companies". 18 For this reason, Diers suggests using empirical data from a time period reaching as far back as possible. However, due consideration should be given to whether such old data are still relevant. 3.

DATA & METHODOLOGY
The catastrophes considered were those for which past data and information existed that could be reasonably used as the basis for assessing the current risk in South Africa. These were floods, earthquakes, tornadoes and pandemics (natural catastrophes), as well as industrial and mining, road and rail, commercial airliner and nuclear accidents (man-made events). Assessing war and terrorist-related risks requires a different approach that gives appropriate weight to current political and socio-economic factors. These risks have been excluded from this study and require further research.

3.1
Data 3.1.1 For event types that have the potential to be a South African life catastrophe risk, a search for reliable and complete data was made in an attempt to build a comprehensive database of relevant past events. In order to increase the statistical significance of results, or simply to have enough points to sensibly fit a distribution, data were not necessarily restricted to recent events. For example, in order to obtain three (severe) influenza pandemic data points, one needs to go back 100 years. Contrast this with road accidents, where many data points can be accumulated from the last 10 or so years. However, for certain risks, older data become less relevant due to fundamental changes in underlying conditions. For example, 18 Return period is defined as "the expected length of time between recurrences of two natural catastrophe events" (Diers, op. cit.). This is the inverse of the frequency. For example, in throwing a dice, we expect a 1 with frequency 1/6. The return period is hence (1/6) -1 = 6 (throws). medical advances have altered flu pandemic risk, and better air travel safety has altered the risk of fatalities from airliner accidents, which is discussed in section 3.10. 3.1.2 As far as possible official records were used to build the dataset-such as Caelum: a history of notable South African weather events by the South African Weather Service (Viljoen, 1991), or statistics provided by well-respected independent organisations such as the World Health Organization (WHO). For smaller or more localised catastrophes, newspaper articles were sometimes the only available data source. In this case an attempt was made to verify each data point from two independent news sources. Details of the data collected for the various catastrophes can be found in Appendix B.

3.2
General Methodology 3.2.1 An annual frequency was estimated for each event type, defined as (number of events over period of investigation) / (number of years investigated). 19 This is the maximum likelihood estimator for Poisson and Bernoulli mean parameters. Since an attempt was made to keep the model as simple as possible, a Bernoulli distribution was used where appropriate. This assumes a maximum of one event per annum, which is sensible for non-repetitive event types, for example, a nuclear reactor meltdown or very low-frequency events such as an airliner crash. 20 For repetitive event types where more than one occurrence per annum is possible (such as road accidents, floods, mining accidents, etc.), the Poisson distribution was the natural choice for modelling the number of events per annum.
3.2.2 For each catastrophe type, the following method was used: the historical data points were assumed to be observations of independent and identically distributed random variables from an unknown distribution, and a probability density function (pdf) was fitted to each. This simplifying assumption might not always be valid. For example, improvements in medical technology or other advances may have the effect of lowering death rates resulting from catastrophe events, while greater population density might increase death rates as a pandemic spreads more easily. The resulting severity distribution then represents the random variable of the number of deaths from a certain event type, given that an event of that type has occurred. A Microsoft Excel add-on (EasyFitXL) was used to fit over 60 different distributions, with the best-fit parameters chosen using the method of maximum likelihood (i.e. maximising the log likelihood). The program performs three goodness-of-fit tests for each distribution: The Kolmogorov-Smirnov, Anderson-Darling and Chi-square tests.

3.2.3
In terms of fit, there was usually a clear best choice: a distribution which performed the best on all three statistical goodness-of-fit tests. However, for the purposes of this investigation, a good fit in the extremities or tail of the distribution is of most concern. Hence, when comparing distributions, particular attention was given to observations in the upper right corner of the QQ-plot. 21 Of the better-fitting distributions suggested by EasyFit, the distribution with the best fit in this tail area was chosen, even if overall it was not the best fitting distribution. Despite this approach, the tails of some of the chosen distributions may still not be sufficiently long, given some extreme observations in the data. It is, however, difficult to know how much weight to assign to single outlier tail observations at the expense of down-weighting data between the tails and worsening the overall fit.
3.2.4 A worst-case scenario or cap on the possible number of deaths for each event type was investigated and, where a cap has been used the reasoning and derivation behind each figure is provided. Without a cap (where relevant), the model could return values that are out of the realms of possibility. For example, it is not possible for an earthquake in Cape Town to kill a greater number of people than the actual population, so a cap equal to the population was used to keep the model results sensible.
3.2.5 For some of the catastrophe types (pandemic, earthquake, airline, and nuclear events), a slightly different method was used-either due to lack of data to fit a severity distribution or a better method being available. Where this is the case, an additional note on the method has been given.

3.2.6
Over the course of one year, the random variable representing the number of deaths (South African population deaths) from a certain catastrophe (CAT) type, i, can be written as: a compound random variable, where: N i = random variable representing the number of CAT events of type i over the year. N i = 0,1,2, … where if N i = 0 then Y i is defined to be zero X ij = total number of deaths from the j th event of type i X i1, X i 2 ,… are independent and identically distributed random variables, from a certain probability distribution which can be different for each i N i and X i j are independent for j = 1,2, … Suppose we have m catastrophe types included in our model. Then, the total number of deaths over one year from CAT type events can be represented by the random variable Z-the convolution/summation of these compound random variables , 1, 2,..., In summary form this can be written as: In the model, the N i 's are all assumed to be either Bernoulli or Poisson random variables. The maximum likelihood estimator for the parameter for these distributions is the sample 21 A QQ-plot is a plot of the empirical quantiles of the observed data against the corresponding quantiles from the assumed underlying distribution and provides a graphical representation of the goodness of fit.
mean. This parameter was investigated separately for each CAT type. For each of the X i 's, the distribution was estimated by fitting a probability density function to historical death data from CAT type i.

3.2.7
The above random variable Z is then simulated 500 000 times (by independently simulating the N i 's and X i 's above). An empirical distribution is thus derived, and from this the 99.5th percentile or 1-in-200 year death toll from a catastrophe event(s) is derived. Simulation is used because it is not feasible to derive this distribution analytically. This figure can be interpreted as an estimate of the total number of population deaths occurring in South Africa, due to a 1-in-200 year catastrophic event(s). Assuming these deaths are distributed randomly (uniformly) over the population, not being any more or less likely to affect an insured life from a specific company, 22 we divide the result by 52.98 million (the South African population estimate at mid-year 2013, Statistics South Africa) 23 and convert this to get the additional deaths per 1000 members of the population.
3.2.8 In aggregating the various types of mortality catastrophe risks to derive an overall shock, this study assumed that catastrophe events were independent. There may be positive correlation between some events, for example, earthquakes and industrial and/or nuclear accidents. This aspect should be further researched.

3.3
Floods 3.3.1 Globally, floods are the most widely experienced natural disaster causing property damage, economic disruption, and loss of life (Montz & Tobin, 2010). Multiple deaths from the flooding of rivers, during and after heavy rains, are not uncommon in South Africa. This is evidenced by 48 flood events in the last 57 years causing five or more deaths each. The Department of Provincial and Local Government (DPLG)'s National Disaster Annual Report 2006/07 states that, of all natural hazards in South Africa, floods have caused 66% of observed deaths. 24 3.3.2 The distinction between riverine and flash flooding is important in assessing potential loss of life. The Flood Awareness document by the National Disaster Management Centre (DPLG) 25 defines riverine flooding as the natural, seasonal flooding of a river, such as occurs with the river Nile. Hence it is largely predictable and dwellings are not built in the flood plain. For this type of flooding, probabilities of exceeding prior high water levels are of interest in the field of extreme value theory. This is in contrast to flash floods which occur when "an excessive amount of rain falls during a short period of time, or when large amounts of water are released from a dam or blockage in a river" (DPLG). 26  unpredictable and highly localised flash floods are the cause of high levels of death and destruction. It is believed that urbanisation contributes to a flash flooding hazard: instead of water infiltrating the ground, the water flows over and around impervious land surfaces and concrete structures, increasing human exposure to flash flood hazards and the potential for damage and injuries (Coles, 2010). Various factors influence the likelihood and extent of a flood. Grobler (unpublished) provides a holistic overview of these factors.
3.3.3 KwaZulu-Natal and the Eastern Cape are the provinces most frequently affected by flash flooding. In particular, De Villiers and Maharaj (1994) describe the 1987 KwaZulu-Natal flood as being amongst the most devastating to have occurred in South Africa, resulting in nearly 400 deaths. This was the result of 400-600 mm of rain falling over five days in the Mdloti catchment area, immediately following a wetter-than-usual two weeks in terms of average rainfall. Another notable disaster was the 1981 Laingsburg flood. Large parts of the small Karoo town were destroyed when the banks of the Buffalo River burst. With more than twice the annual expected rainfall falling over just one weekend, the volume of water in the Buffalo River (which flows through the town) was simply too high. Over 100 lives were lost 27 in this disaster. 3.3.4 All the data used for modelling were local and included each major flood event dating back to 1956. The South African Weather Service's publication Caelum (Viljoen, 1991) provided most of the historical flood data up to 1989, and newspaper articles were used for more recent data due to an absence of alternative data sources. 3.3.5 The data show that more than one flood causing multiple deaths can occur in a single year in South Africa. A Poisson distribution was thus chosen for the frequency distribution. The method of maximum likelihood gives the Poisson parameter λ = 0.83. This means that, in the model, 0.83 floods are expected per annum. There was insufficient statistical evidence to reject the fitted model, with the Chi-square goodness-of-fit test indicating a p-value of 0.267.
3.3.6 A three-parameter lognormal distribution fitted the historical death data the best for the severity distribution, with a p-value of 0.8289 on the Kolmogorov-Smirnov goodness-of-fit test. See Appendix C, Table C.1.

Earthquakes
Earthquakes involve the travel of elastic, or seismic, waves of energy through the Earth's rigid crust. They result from the sudden liberation of accumulated stress and strain along Fault lines, which are planar discontinuities in the crust. Around the world, more than 3,000 seismic events occur each year, but few of them are damaging or lethal. However, when major earthquakes occur in highly populated areas, they can cause major destruction and death tolls in the thousands.

3.4.1
In terms of loss of life, the risk is substantial: the 7.5 magnitude (M) 28 earthquake that hit China in 1976 resulted in 255 000 deaths. In Swiss RE's 2013 Sigma 29 report over half of the 40 worst (in terms of loss of life) catastrophes from 1970 to 2013 were earthquakes. The potential death toll from a future earthquake disaster in a city such as Tehran, with three geological fault lines running through the urban centre, has been estimated at between 400 000 and 3.4 million people (Alexander, op. cit.). From this brief introduction it might appear that seismic events should count for a large part of any company's life catastrophe SCR. However, past events are concentrated in certain areas, known to be on or near geological fault lines.
3.4.2 Research undertaken by Kijko and Visser for Aon Benfield 30 suggests that Cape Town and Durban are exposed to the highest risk of an event (as these locations have experienced the most significant seismic events in South African history). A recent study by Kijko, Smit & Van De Coolwijk (2015) provides an estimated assessment of the seismic hazard and risk (potential losses) to infrastructure due to a strong seismic event in the Cape Town area, and concludes that "seismic hazard is a justifiable concern in South Africa. In particular, seismic hazard in Cape Town must be taken into serious account as a potential threat to its citizens and to infrastructure." 3.4.3 Various studies identify the Cape Town area as an earthquake cluster area; see for example Singh, Kijko & Durrheim (2009). They do, however, also state that no earthquakes have been recorded in the area since instrumental recording began in 1972. The area is considered a risk due to the fault line that runs approximately eight kilometres offshore of Milnerton, and then cuts almost directly through the Cape Flats. In 1809, an earthquake estimated at M = 6.3 occurred on this fault, just 10 km from the present Cape Town central business district (CBD). Aon Benfield 31 describes the effect on the Cape Town CBD of a worst-case scenario 6.87 M earthquake as 'ruinous'.
3.4.4 Several small earthquakes have been recorded in Gauteng, specifically in the mining regions, with a few leading to loss of life in the mines. Singh, Kijko & Durrheim (op. cit.) state that while it is difficult to distinguish between natural seismic activity and the tremors or blasts from gold and other mining activity, most seismicity originates in the gold-mining districts of the Witwatersrand basin. The most recent incident at the time of finalising this paper was the earthquake on 5 August 2014 with its epicentre near Orkney, a gold-mining town 177 km south-west of Johannesburg. This event measured M = 5.5 on the Richter scale according to the Council for Geoscience.

3.4.5
Aon Benfield 32 believe that tectonic and mining-related events are largely uncorrelated. They point out that the reduction in mining activity in the Gauteng area due to depletion of reserves is decreasing the risk of mining-related seismicity.
3.4.6 Singh , Kijko & Durrheim (op. cit.) provide a summary of all seismic events in South Africa with M ≥ 5 since 1809, which shows no recorded events in Johannesburg. While there have been significant earthquakes (of M ≥ 5) in other mining regions, including Carletonville (West Rand), Klerksdorp (North West province) and the Free State, property damage and loss of life were mostly limited to these regions. The Carletonville earthquake (M = 4.7) of 1992 caused some property damage but no loss of life in Johannesburg. The Johannesburg area has therefore been excluded from our model.
3.4.7 Aon Benfield 33 believe that for an earthquake (5 ≤ M < 6) to cause damage in Durban, the epicentre needs to be less than 45 km away. They estimate the return period for this type of event to be 735 years, and the return period for an event (6 ≤ M < 7) to be about 5 000 years.
3.4.8 Notable South African events include the earthquake that occurred in 1809-referred to in paragraph 3.4.3-on what is now known as the Milnerton Fault. The magnitude has been estimated to be between 6 and 7, which would make it one of the largest earthquakes to have occurred in South African history. The greatest structural damage occurred near Milnerton itself. There was not much infrastructure built there at that time, and eyewitnesses reported the after-effects of the earthquake as fissures along the ground (Hartnady, 2003). In 1969 an M = 6.3 earthquake in Ceres caused more than R500 m in insured damage 34 in today's terms (Grobler, op. cit.). This event resulted in 12 lives lost and many buildings of historical significance damaged in the town of Tulbagh.
3.4.9 Earthquake data (since 1809) summarised by Singh, Kijko & Durrheim (op. cit.) have been used to obtain a frequency estimate for M ≥ 5 earthquakes in the Cape Town region. Swiss RE's annual Sigma reports from 2004 to 2012 were used to gather data on the number of deaths experienced as a result of earthquakes worldwide. The earthquake death counts were segmented into 5 ≤ M < 6, 6 ≤ M < 7 and M ≥ 7, since these were the frequencies estimated for Cape Town (see below).
3.4.10 Singh, Kijko & Durrheim (op. cit.) state that the most striking feature of the data they have collected is that no earthquake greater than magnitude 6.3 has occurred anywhere in South Africa since the 1969 Tulbagh earthquake. They argue that this may either be due to crustal pressure being relieved since the 1969 event, or simply that South Africa is on a stable continental region, with a long return period (low frequency) for earthquakes of this magnitude. Data summarised by Singh, Kijko & Durrheim (op. cit.) show 63 seismic events with intensity M ≥ 5 since 1809 in South Africa, with five of those occurring around the Cape area. Based on this past data one could expect an earthquake of magnitude greater than 5 in the Cape area roughly once in every 41 years (corresponding to an annual frequency 32 Ibid. 33 Ibid. 34 R200 m quoted at 1996 price level, assuming 6% inflation year on year, gives R539 m. of 0.02451). The same data show that there was one event in the Cape with intensity M ≥ 6 since 1809 (corresponding to an annual frequency of 0.004878). Grobler (op. cit.) reports the South African Council of Geoscience as estimating that Cape Town can expect an earthquake of M ≥ 7 once every 500 years (annual frequency 0.002). Frequency estimates for Durban are taken from Aon Benfield. 35 3.4.11 One approach to modelling earthquake fatalities would be to use existing general insurance damage models and then try to link the rand amount of damage to the number of deaths. In low GDP countries, insurance penetration is not high, and buildings are not built according to stringent standards to be able to resist the impact of earthquakes. Earthquake death counts are subsequently very high in these countries, but insured losses low (Gutiérrez et al., 2005) when compared to an earthquake in a developed country. While buildings in a developed country are usually built to a good seismic standard, they would still be damaged by a high intensity earthquake, resulting in large insurance losses. However, they would not be expected to suffer a full collapse, thereby decreasing a potential death count. While the South African Bureau of Standards (SABS) has issued minimum building standards 36 to be implemented in areas of high seismic risk (including the mining belt covering Gauteng, North West province and the Free State, as well as the greater Cape Town region), Davies & Kijko (2003) could not establish the extent of adherence to these requirements. Since too few earthquakes causing loss of life in South Africa have occurred, a distinct South African death-to-damage ratio could not be estimated and the proposed method was abandoned. 3.4.12 The approach when modelling the severity of an event was to use recent earthquakes from around the globe as data points. This enables fitting distributions to death counts from earthquakes of different intensities, where few earthquakes resulting in casualties have occurred in South Africa. Drawing inferences from contingent data can influence the quality of a model, according to Banks (op. cit.), but is one of the few available options when direct data are lacking. For each intensity range (5 ≤ M < 6, 6 ≤ M < 7 and M ≥ 7) of interest, a separate severity probability density function was fitted, using death tolls from past global earthquakes as data points. Although the numbers vary widely (depending, for example, on location of epicentre, size and density of population, building structure codes enforced), the simplified model adopted did not attempt to allow explicitly for the location of epicentre and other factors.
-For the 5 ≤ M < 6 earthquake data (average death count ~23), a Wakeby distribution best fitted the data, with a p-value of 0.1358 on the Kolmogorov-Smirnov test. -For the 6 ≤ M < 7 earthquake data (average death count ~1208), a Pareto 2 distribution best fitted the data, with a p-value of 0.40785 on the Kolmogorov-Smirnov test. -For the M ≥ 7 earthquake data (average death count ~20 784), a Frechet distribution best fitted the data, with a p-value of 0.43223 on the Kolmogorov-Smirnov test.
3.4.13 Gutiérrez et al. (op. cit.) analysed 300 past earthquakes that had resulted in deaths. They consider a high mortality earthquake to be one that results in the death of 15% 35 Aon Benfield, supra. 36 SABS 0160 1989(as amended 1990, 1991and 1993 of the population within 50 km of the epicentre. If one assumed the worst possible epicentre, a 50 km radius can cover much of greater Cape Town or Durban. Using the 2011 census estimates for the city population sizes, this gives a cap of 561 004 deaths for Cape Town (15% of 3.74 million) and similarly 516 354 deaths for Durban. For a given year, the magnitude of the single most severe earthquake (if any) in each centre is considered. It is assumed that if M < 5, then no deaths will result. As discussed above, for Cape Town P(M ≥ 5) = 0.02451 and so P(M < 5) = 0.97549 . We also have the points P(M ≥ 6) = 0.004878 and P(M ≥ 7) = 0.002. The model then returns, for Cape Town: -No fatal event, with probability P(M < 5) = 0.97549 -A 5 ≤ M < 6 earthquake with probability P(M ≥ 5) -P(M ≥ 6) = 0.019632 -A 6 ≤ M < 7 earthquake with probability P(M ≥ 6) -P(M ≥ 7) = 0.002878 -A M ≥ 7 earthquake with probability P(M ≥ 7) = 0.002 The corresponding assumptions for Durban are: -No fatal event, with probability P(M < 5) = 0.99844; -A 5 ≤ M < 6 earthquake with probability P(M ≥ 5) -P(M ≥ 6) = 0.00136; -A 6 ≤ M < 7 earthquake with probability P(M ≥ 6) -P(M ≥ 7) = 0.0002; -A M ≥ 7 earthquake with probability P(M ≥ 7) = 0.
Given a 5 ≤ M < 6, 6 ≤ M < 7 or M ≥ 7 earthquake in each of Cape Town and Durban, a death count from the respective historical severity distribution was thus drawn.

Tornadoes
A tornado is a violently rotating column of air in contact with the ground. It usually forms under a cumulonimbus (thunderstorm) cloud and is visible as a condensation funnel or by the dust and other debris incorporated into the rotation. About 1500 tornadoes are recorded annually around the middle latitudes of Earth, and they typically cause 100 to 300 deaths.
- Schmidlin (2010) 3.5.1 Goliger et al. (1997) includes a database of past South African tornadoes and resultant casualties and damages. It is clear from this work that tornadoes are present in South Africa, with 47 known past events resulting in human casualty. Historically, South African tornadoes have occurred in the late afternoon in the summer months. Worldwide, the occurrence of tornadoes typically coincides with the annual peak in thunderstorm frequency, as this is the period with greatest atmospheric instability (Schmidlin, op. cit.). In the South African context, while tornadoes may result in irregular incidents with a few deaths, the historical evidence suggests that they do not pose a life catastrophe risk, especially when compared to other possible catastrophes. The 1952 Albertynsville (a township near Johannesburg) tornado killed 24 people and injured more than 600, destroying 500 houses completely (Goliger et al., op. cit.).
3.5.2 Severity data from worldwide tornadoes would not be relevant in determining possible South African deaths. Unlike, for instance, industrial accidents, this hazard is very specific to a geographic location, being more severe among the mid-latitudes where the death toll is notably higher (Goliger et al., op. cit.). For this reason, South African-only data are used, despite being quite limited. The simulations do not make up a large part of the final life catastrophe shock, so the following frequency and severity estimates are not critical.
3.5.3 A tornado leading to at least five deaths has occurred on average once every ten years in South Africa. A Bernoulli random variable with parameter 0.10 was thus used to simulate the number of tornado events per annum. 3.5.4 The deadliest tornadoes in recent decades have occurred in Bangladesh; in particular, on 29 April 1989 a tornado struck and killed 1300 people. Casualties arise from tornadoes as a result of high winds, flying debris and the collapse of buildings, Schmidlin (op. cit.) noting that weak structures offer little protection. This could be a reason for the most severe South African incident having occurred in the Albertynsville township. In terms of local tornado severity, the log-logistic distribution fitted the data the best, with a p-value of 0.96808 on the Kolmogorov-Smirnov test.

3.6
Influenza Pandemics 3.6.1 Lloyd's paper 'Pandemic: potential insurance impacts' 37 notes that much of the recent industry focus has been on an influenza pandemic. The WHO states "experts at WHO and elsewhere believe that the world is now closer to another influenza pandemic than at any time since 1968" (unpublished a), referring to the world as being in an 'interpandemic' phase, which stresses the belief that the next pandemic is inevitable. Catastrophist Gordon Woo (2011: 43) states that of all possible emerging infectious diseases, "influenza stands out as the persistent historical and future human threat". This is due, he says, to the fact that the influenza virus is not eradicable. 3.6.2 As mentioned in section 1, EIOPA ultimately settled on a mortality catastrophe shock in the Standard Formula that is in line with the 1-in-200 year influenza pandemic scenario modelled by Swiss Re (op. cit.). This would suggest that pandemics are the leading life catastrophe risk, or at least are regarded as such by the regulators. RMS 38 modelled life catastrophe events and found infectious diseases to be the main driver behind their modelled life catastrophe shock. The reason they give is that the "global footprint" of a pandemic leads to a significantly larger susceptible population, compared to a more localised event such as an earthquake. Kraut & Richter (op. cit.) share this view, suggesting that, whilst terrorism or natural catastrophes depend heavily on proximity to urban areas and coastlines/ earthquake zones respectively, pandemic risk will affect a book of lives more homogeneously in terms of location.
3.6.3 Influenza is a virus that attacks the upper respiratory tract. There are three types of influenza (A, B and C), of which only two (A and B) cause widespread disease in humans. Whereas Type B is only found in humans, Type A is also carried by other mammals and birds ("avian influenza"). Subtypes of Type A that are present in birds have the potential to cross over to humans when there is close contact between humans and infected birds, for example, in poultry markets in developing countries. The possibility of a new strain being introduced to the human population as a result of such contact is cause for concern in terms of a global pandemic (WHO, unpublished a). The main reservoirs of Type A influenza are the vast flocks of birds in China, which are in close contact with large human populations (Woo, 2011: 43). 3.6.4 The WHO (unpublished a) gives a generic description of how a pandemic may evolve. In summary, influenza viruses evolve easily and unpredictably, with influenza from one species being able to trade genetic information with influenza from another, in a process known as re-assortment. It is when genes between human and animal influenza are exchanged that a lethal virus can be created (Woo, 2011). In this way, a new hybrid virus is produced, against which humans have no immunity (as it is brand new), and for which no vaccines are available. This can result in an unusually severe disease, infecting large numbers of people. Such a pandemic could conceivably encircle the globe within three months (WHO, unpublished a). 3.6.5 The European Centre for Disease Control and Prevention (ECDC) (unpublished b) says that "by the time it is realised a pandemic has started, the virus is far too widely distributed to be constrained". They go on to say that there is no way of knowing when the next pandemic will occur, and that "influenza viruses are inherently unpredictable". Gunderman and Brown (2007) describe four requirements that need to be met for the next full-blown influenza pandemic to occur: 1. A new strain of influenza must emerge. 2. This disease must be spread to the human population, usually a transmission from birds to human beings. 3. The disease must be readily and sustainably transmitted from human to human. 4. The disease must be capable of causing serious health effects in human beings, witnessed by a high case mortality rate.
3.6.6 1918 (H1N1 SpaNiSH Flu) 3.6.6.1 This influenza pandemic, referred to commonly as the "Spanish Flu", is often used as a benchmark or worst-case scenario when measuring pandemic risk (RMS; 39 Lloyd's 40 ), and is described as "the single most devastating infectious disease outbreak ever recorded" (WHO, unpublished a).
3.6.6.2 This unusually severe strain of Type A virus occurred just after World War I, and killed more people than the war itself (Woo, 2011: 43). Estimates of the death toll vary considerably, but most fall in the range of 30-50 million within the first 12 months of the pandemic. For example, the WHO (unpublished a) has the death toll at 40 million, whereas 39 Ibid. 40 Lloyd's Emerging Risks Team Report, supra. Johnson & Mueller (2002: 115) suggest "of the order of 50 million", but add that "even this vast figure may be substantially lower than the real toll, perhaps as much as 100 percent understated".
3.6.6.3 Johnson & Mueller (op. cit.) estimate excess mortality per thousand lives as being between 2.5 and 5.0 for the global population, but with a large variation between individual countries. Their estimate for the USA is 6.5 (Swiss Re, op. cit.) puts the USA figure at 5.3, whereas South Africa was one of the worst hit countries with an estimated mortality rate of 44 per thousand (approximately 300 000 deaths).
3.6.6.4 Whereas it is usually older people and infants that are most at risk of developing complications and dying from influenza (Boslaugh, 2008), the Spanish Flu was unusual in that at least half of the resulting deaths were of young adults. This is usually attributed to the "cytokine storm" effect (see, for example, Swiss Re, op. cit.: 20), an overly aggressive response to the virus from the body's immune system, which can itself lead to respiratory problems; and which appears to be more likely in younger, otherwise healthy, individuals.

1957 (H2N2 aSiaN Flu)
This Type A virus originated in China. It arose as a mutation between avian and seasonal human viruses (Woo, 2011). It spread through Asia and eventually reached the United States. Death toll estimates again vary but most are around two million (Woo, 2011: 43). It was a milder virus than that of 1918 and the world was better equipped to cope, with most excess deaths confined to infants and the elderly (WHO, unpublished a). Swiss Re (op. cit.: 28) estimated the excess mortality per thousand lives in the USA to be approximately 0.4.

1968 (H3N2 HoNg KoNg Flu)
This strain began in Asia, and eventually spread to the United States (via troops returning from Vietnam) and Europe (WHO, unpublished a). The virus descended from H2N2 by antigenic shift, causing up to one million deaths worldwide (Boslaugh, op. cit.). Symptoms were milder and mortality lower than the 1957 Asian Flu (again with highest mortality in the elderly), with the disease spreading slowly in most countries (WHO, unpublished a). The excess mortality per thousand lives in the USA was approximately 0.2 (Swiss Re, op. cit.: 28).
3.6.9 1997-preSeNt (H5N1) 3.6.9.1 This ongoing strain may well be the next pandemic. The WHO considers H5N1 avian influenza a public health concern, going so far as to say it is the strain most likely to cause a pandemic. First affecting humans in 1997 in Hong Kong, it has gradually extended its reach from Asia to Europe and Africa, having become "deeply embedded" in poultry in some countries (ECDC, unpublished b). There is direct human contact with these birds, hence the ECDC (unpublished a) stating there is a "constant risk of humans being infected and the virus adapting to them".
3.6.9.2 Boslaugh (op. cit.) writes in the Encyclopaedia of Epidemiology that H5N1 is not yet capable of causing a pandemic because it is not transmitted efficiently between humans, one of the prerequisites of a pandemic. "The small number of human cases, despite tens of millions of poultry infected, over vast geographical areas, for more than two years, support this conclusion." (WHO, unpublished a). However, H5N1 has had a high case mortality rate, at over 60%, for those few who have been infected (Lloyd's). 41 It has been described by the ECDC (unpublished a) as being a severe disease with high mortality-a lot higher than is usually the case when animal influenzas infect humans.
3.6.9.3 At present, having already made the inter-species jump (albeit with low rates of human infection), it has met three of the four necessary factors to become a pandemic. WHO (unpublished c) says that H5N1 does have the potential to mutate into a form more transmissible between humans, which would have it fulfilling the last of the four requirements, and so develop into a full blown pandemic. The hope is that if it were to change to become more contagious, the virulence would be reduced in the process.
3.6.10 SwiSS re Model 3.6.10.1 The model developed by Swiss Re (op. cit.) appears to be the most respected and widely-referenced model for possible influenza pandemics. It is a complex epidemiological model that can simulate the progression of a pandemic with a given lethality and contagiousness, allowing for demographic characteristics and possible interventions (both pharmaceutical and non-pharmaceutical).
3.6.10.2 One advantage of the Swiss Re approach over many of the other attempts to model influenza pandemics is that, instead of considering just two or three chosen scenarios, thousands of different scenarios can be simulated by randomly drawing the lethality and contagiousness parameters from statistical distributions. These distributions have been chosen by calibrating the model to historical pandemics, taking into account the changes in demographics, medicine and government preparedness over time. By running large numbers of simulations, it was possible to attach probabilities to pandemics of differing severity.
3.6.10.3 The model divides the global population into 37 territories (countries or groupings of countries) and into 5-year age bands, as a result of which the different effects of a pandemic across the age spectrum and between different countries can be modelled. The modelled excess mortality (for the general population, but age-weighted to represent a typical insurance portfolio) at the 1-in-200 year probability level ranged from 1.0 to 1.5 per thousand for developed countries and 1.5 to 4.0 per thousand for developing countries (approximately 2.5 for South Africa).

3.6.11
The Committee of European Insurance and Occupational Pensions Supervisors (CEIOPS) consultation paper no. 49 (unpublished a) provided the draft advice for implementing the standard formula for the life underwriting risk. This paper referenced the Swiss Re model in support of the 1.5 per thousand mortality shock that had been used for QIS4, but then went on to propose an increase in the shock to 2.5 per thousand, citing (unpublished a: 36): -Potential weaknesses in the Swiss Re model, i.e. "not adequately allowing for the probability of flu jumping across species such as from birds to humans, not allow ing for non-influenza pandemics (e.g. AIDS, drug-resistant TB, Ebola virus/MRSA/SARS) or other causes of mortality catastrophe such as terrorism or physical catastrophes such as earthquakes." -Concerns that "due to sparse historical data on pandemics, there is a significant degree of uncertainty around the calibration of any pandemic model". -The fact that "the 1918 flu pandemic, which is the most significant mortality catastrophe for which data is available, gave rise to death levels of above 5 per mille".

3.6.12
In responses to the draft paper (CEIOPS, unpublished b), many companies objected to the proposed increase, largely on the basis that the reference to the 1918 pandemic, seemingly without any consideration for how the world had changed since then, was of questionable relevance. Swiss Re themselves refuted the criticisms of their model and disagreed with the suggestion that 2.5 per thousand was a better estimate of a 1-in-200 year mortality shock. In the end, the final advice document (CEIOPS, unpublished c) reverted to 1.5, but the concerns raised were kept in the document. 3.6.13 The annual pandemic frequency assumed for our model is 1/30, which is the same as that used by Swiss Re (based on the fact that 10 to 13 epidemics have been recorded over the last 300 years). Woo (2011: 43) notes that epidemiologists "look to history for guidance on the frequency of influenza pandemics, which is approximately every 30 years on average".
3.6.14 It was assumed that the pandemic severity follows the lognormal distribution (which was the type of distribution chosen for the lethality input parameter in the Swiss Re model, although their modelled outputs would not have followed any parametric distribution). The parameter was then chosen so that the 1-in-200 year shock would be of similar magnitude to that modelled by Swiss Re for South Africa (i.e. 2.5 per thousand). It should be emphasised, therefore, that the output of the model is obtained with reference to the Swiss Re paper and is not an independent verification of the Swiss Re result.
3.6.15 While the simplified "frequency and severity" approach does produce a similarly shaped distribution of results to the Swiss Re model, the lognormal assumption does not fully replicate the more complex model. For example, when the parameter is chosen to give a similar 1-in-200 year result, the 1-in-400 year mortality shock is approximately 3.7 for this model compared to 4.5 for the Swiss Re model.
3.6.16 otHer ModelS: outSide oF SoutH aFrica 3.6.16.1 The models discussed below typically consider a very limited number of scenarios, without attaching probabilities to these scenarios. While this may be helpful to establish what a "most-likely scenario" or "worst-case scenario" pandemic might look like, neither of those are necessarily of much use in deciding what a 1-in-200 year scenario would look like-other than to provide some upper and lower bounds.
3.6.16.2 RMS 42 investigates the likely capital requirements for a UK insurer under Solvency II. The catastrophe mortality rate arising from infectious diseases was calculated to be 0.9 per thousand for a typical insurer. Sensitivity analysis based on varying company characteristics "within plausible ranges", resulted in the figure ranging from 0.5 to 1.5 per thousand.
3.6.16.3 The Society of Actuaries (Toole, unpublished) investigated the potential effects of an influenza pandemic on US insurers. They considered a moderate scenario (comparable to 1957) and a severe scenario (comparable to 1918). The excess deaths in the general population were taken to be 0.7 per thousand and 6.5 per thousand, respectively, which were the observed historical rates. It was estimated that the excess deaths for the insured population would be 0.4 and 5.0, respectively, per thousand.
3.6.16.4 Moody's 43 also considered a moderate ("1957/1968-like") scenario and a severe ("1918-like") scenario, but they allowed for the fact that "a virulent 1918-type influenza would not be as deadly (today) as it was in 1918". The estimated excess deaths for US insurers were 0.5 and 2.0, respectively, per thousand. Standard & Poor's 44 also modelled two scenarios, coming up with estimates of 0.625 and 1.5 for the excess mortality per thousand.
3.6.17 otHer ModelS: SoutH aFrica 3.6.17.1 Three papers consider the potential impact of an avian flu pandemic in this country, using a multiple-state Markov chain approach.
3.6.17.2 Stipp et al. (unpublished) split the population into 5-year age categories as well as by gender, province, AIDS status and rural/urban status for modelling purposes. They modelled a mild scenario, a base (severe) scenario, an alternative scenario (the base scenario adjusted to allow for the fact that there is a finite limit on the number of general ward and ICU hospital beds in the country) and a worst-case scenario (in which the mortality by age was assumed to follow a similar pattern to the 1918 pandemic, with significant deaths at younger ages). The excess mortality rates (per thousand) estimated for the different scenarios were: Mild: 1. industry in the form of excess claims (for each of individual life, group life and funeral cover policies). Two main scenarios were modelled (one equivalent to Asian influenza and one equivalent to Spanish influenza), with the effect of HIV and of mortality improvements since the time of those pandemics each being quantified under a small number of different assumption sets. The excess mortality (per thousand) under the moderate (Asian) scenario was modelled to be: Base: 1.0 With HIV: 1.0-1.1 With mortality improvements: 0.7-0.9 The excess mortality (per thousand) under the severe (Spanish) scenario was modelled to be: Base: 8.6 With HIV: 9.2-10.1 With mortality improvements: 6.7-7.6 3.6.18 Experts are unable to predict with any degree of certainty how severe the next pandemic might be, which leads Broekhoven et al. (unpublished) to the conclusion that the only possibility is to consider 'what-if ' scenarios. Historical pandemics are then obvious choices for starting points, as illustrated by the models discussed above, but pandemics have been characterised by a widely varying number of deaths (Dawood, Iuliano & Reed, 2012). 3.6.19 The ECDC (unpublished b) state that it is impossible to predict the number of people that might be infected by the next pandemic, but assume a 30% population infection rate in their pandemic severity index. Infectiousness (which affects the number made ill) and lethality (or virulence) together determine the number of pandemic deaths, and for a severe pandemic the virus needs to be both fast spreading and highly lethal.
3.6.20 Different countries might well be affected differently. Dawood, Iuliano & Reed (op. cit.) say that regional or country differences could be due to differences in access to and quality of healthcare, presence of malnutrition or underlying medical conditions, age profile of the population and the use or availability of vaccines. They further state that estimates from previous pandemics indicate that mortality rates vary significantly between countries, quoting a study showing that excess seasonal influenza mortality (for those 65 and older) is at least three times higher in South Africa than in the USA.
3.6.21 There are certain factors 45 that would make a modern repeat of the 1918 pandemic less severe: RMS 46 suggests a healthier and better informed population, with modern treatments more readily available, as mitigating factors. However, other modern developments could make a current pandemic more severe. International travel is faster and populations more dense, especially in cities, which could hasten the spread of an emerging virus. RMS 47 concluded that mortality rates would be lower than in 1918. Broekhoven et al. (op. cit.) estimate the probability of a pandemic of 1918's severity being less than 1-in-400 years. Moody's 48 state that "some experts would argue that the influenza of 1918 is the worst pandemic in terms of virulence over the past 500 years, making it a 1-in-500-year 45 See Lloyd's Emerging Risks Team Report, supra, for a more comprehensive list of factors, p 8. 46 Mortality-driven risks: Calculating capital requirements for Solvency II (White Paper), supra. 47 RMS (2013). Managing influenza pandemic risk. https://support.rms.com/ /Publications/Influenza_ Pandemic_Risk.pdf, retrieved 10 February 2013 48 Bird Flu Risk for U.S. Life Insurers, supra. event". Swiss Re (op. cit.) go even further, suggesting that "the annual likelihood of an event resulting in a general population mortality rate equivalent to 1918 is about 1 in 3000". 3.6.22 The SAM Pillar 1 catastrophe shock allows for excess mortality varying from 1.5 per thousand to 3.6 per thousand, depending on the underlying mortality of the insured lives. This raises the question of the appropriateness of assuming that a pandemic can have such different effects on different sub-populations in the same country. Most pandemic models allow for different excess death rates for different age groups. To the extent that it is those age groups with a higher underlying mortality rate, for example, new-borns and the elderly, that will be worst affected by a pandemic, it is sensible to suggest that the shock should increase as underlying mortality increases.
3.6.23 Both of the South African models mentioned in section 3.6.17 make explicit allowance for either HIV-positive or AIDS-sick status, on the assumption that the excess mortality as a result of a flu pandemic will be higher for this sub-population than for the general population. Research suggests that seasonal flu death rates are significantly higher for those suffering from AIDS (Lin & Nichol, 2001).
3.6.24 It is argued by Swiss Re (op. cit.) and Toole (op. cit.) that the excess mortality for the insured population (of a given age) is likely to be lower than that for the general population, as a result of the selection effect of underwriting (healthier lives, with fewer chronic illnesses) and the socio-economic effect (those who take out insurance are likely to have a higher standard of living, perhaps with better nutrition, access to information and access to medical care). The same arguments could presumably be applied to different types of insurance policies, since the level of underwriting and the average living standard of policy holders would vary between individual life, group life and funeral cover policies. 3.6.25 As a result of the cytokine storm effect, the excess mortality arising from the 1918 pandemic did not follow the usual "U-shape" (with most of the deaths being at very young or older ages) but rather a "W-shape" with the additional spike arising from significant deaths in the 20-30-year-old bracket. It has been noted that one of "the most disturbing aspects of the 1918 pandemic" was that it "showed an affinity for young, healthy lungs". (Toole, op. cit.: 17) If this were to be true of a future severe pandemic, it could mean that the pandemic hits those with lower underlying mortality even harder than the rest of the population. The Swiss Re model (op. cit.: 65) bears this out in that for the 1-in-400 year scenario the age bracket with the heaviest mortality is the 25-29 year old bracket.

3.7
Industrial 3.7.1 Many people working in a concentrated area, often under dangerous conditions, can lead to a large number of deaths from the same incident or peril, for example the April 2013 collapse of a garment factory in Bangladesh caused over 1000 deaths, hence the inclusion of industrial accidents as a possible life catastrophe risk. Note that the large accumulation of risk for an insurer providing group life cover to the workers in a single factory is not fully captured by the methodology adopted in this paper.

3.7.2
The world in general is seeing a declining number of deaths from industrial accidents. A report from the Organisation for Economic Co-Operation and Development (OECD) (2013) lists three main reasons: medical advances offering better treatment to those involved in an accident; secondly, a change in industry mix from secondary industry to the tertiary sector; thirdly, automation of processes-making intervention by humans in otherwise dangerous activities unnecessary. 3.7.3 Woo (2011: 49) recognises this progressive improvement in industrial safety standards, but says there is still opportunity for catastrophes, even in the most advanced nations. Woo cites human error as one of the most significant contributors to industrial risk. He believes there are latent factors which are conducive to an accident, such as lax corporate culture, organisational processes or risk management procedures-stating that most investigations of past accidents reveal that had one of these latent factors not existed, the accident being investigated may well not have occurred.
3.7.4 According to the International Labour Organisation (ILO), South Africa's occupational fatality rate is about 20 per 100 000 people per annum. 49 Assuming 8 million employed, this equates to 1600 people. Whilst this is a large number, it is not as a result of a single event and thus cannot be considered a catastrophe using our definition. Recall that we are looking at large accidents, resulting in many deaths, rather than the aggregate deaths from a large number of independent events. There have not been many large industrial accidents in South Africa to date. However, the potential for disaster is evident from worldwide data. 3.7.5 To complement direct data from South Africa, mining and industrial accidents from Swiss RE's Sigma reports 50 from 2004 to 2013 have been included. The data obtained for industrial accidents were under the 'major fires and explosions' section. A good indicator of the completeness of the report is that Sigma included the Paarl printing fire accident in 2009, which resulted in only nine deaths. 3.7.6 The high frequency and severity of accidents in countries such as China, Brazil and India may lead one to think that using data from these countries is not relevant to South Africa. However, Baskin (2007) produced a table showing that South Africa had the highest industrial fatality rate per 100 000 employees compared to any of the BRIC countries. Thus, any industrial death data from China, India, Brazil or Russia may be considered relevant for estimating accident severity.
3.7.7 There have been 172 large industrial accidents around the world over the last 10 years. Five of these occurred in South Africa, which gives a frequency estimate of around 0.5 accidents per annum.
3.7.8 A study done by Hamalainen, Takala & Saarela (2006) shows that all the key emerging markets have high occupational fatality (and accident) rates compared to more developed economies. They state that this is due to a combination of reasons: a lot of work still being undertaken in construction and resources (particularly high-risk sectors); weak 49 International Labour Organisation (2005 The National Disaster Management Council (NDMC) 51 states that South Africa's deep-level gold mines are among the most dangerous work environments in the world, with the death toll this century being estimated between 69 000 and 100 000. They list rock falls (the gold is reached by blasting), methane gas explosions and fire as the main death hazards. 3.8.2 Mining accidents have been separated as an event type on their own because mining is such a large industry in South Africa that the frequency of mining accidents alone is still relatively high. Also, an insurer will know whether or not they have exposure to people working in mines (for instance by a group life arrangement). This would determine whether simulated mining deaths should contribute at all toward the life catastrophe shock. 3.8.3 Historically, the largest industrial disasters in South Africa have occurred in the mining sector. In particular, the Coalbrook accident in 1960, due to a partial mine collapse and methane explosion, took 437 lives ( Van der Merwe, 2006). However, this event is not included as a data point, due to improved mining safety standards (NDMC), 52 and improvements in technology over time. There has been a movement toward improved mine safety and an increased sense of corporate responsibility, with the government having set out new mining safety regulations (DME). 53 3.8.4 The Sigma reports show only two mining events leading to multiple deaths in South Africa from 2003 to 2012. Further investigation was deemed necessary, as this figure appeared to be too low. Two more events resulting in five or more deaths were found over the period of interest (2003)(2004)(2005)(2006)(2007)(2008)(2009)(2010)(2011)(2012), bringing the total events to four over 10 years. 54 The authors suspect that there may have been more mining incidents; but mining companies would presumably not wish to encourage news reporting of deaths and national statistics are also not readily available. For instance, the website of the South African Department of Minerals and Resources has an Accident Statistics section, but the page has been 'under construction' for at least two years at the time of writing.
3.8.5 Swiss RE's annual Sigma reports were used to list all mining accidents globally since 2003. The vast majority of these occurred in China, and the largest peril was gas explosions (at least half of the events). Note that the death counts from these global mining accidents are only used to fit a distribution to the number of deaths occurring in a typical mining accident (not for the frequency estimate). This gives a better idea as to the shape of the curve, especially the tail of interest, than would a fit to the scarce South African data. A four-parameter Burr distribution fitted the data the best, with a p-value of 0.21 on the Kolmogorov-Smirnov test.

3.9
Road and Rail 3.9.1 Even though South Africa experiences close to 14 000 road deaths annually, 55 this in itself is not a catastrophe in a SAM context. Catastrophe risk arises from single events that lead to multiple deaths. For example, in the last 15 years there was one accident with 51 deaths. This leads one to consider what the 1-in-200 year scenario might look like. Consider a full capacity train with multiple carriages (up to 800 passengers) hitting a large bus (up to 100 passengers) on a crossing and derailing-an event such as this is within the realm of possibility.
3.9.2 Notable past events in South Africa include a commuter train with 800 passengers derailing near Durban on 9 March 1994. Reports on the death toll vary between 47 and 63 people. Notable bus accidents include the bus which was driven into a reservoir in Bethlehem on 1 May 2003, resulting in 51 deaths by drowning (Swiss RE: Sigma, 2004), 56 and the bus that drove over a bridge into the Westdene Dam on 27 March 1985 causing 42 children to drown. 57 3.9.3 An extensive search was carried out for the most severe South African transport accidents. Unfortunately, whilst Arrive Alive 58 or other organisations keeping national statistics report total mortality figures on South African roads for a given year, the data are not broken down into separate events, so these figures are not helpful. Instead, events were investigated one by one, with newspaper articles being the main source. Where possible, Sigma reports were used to verify the death data. There were sufficient South African events to use local-only data to estimate frequency and severity of road deaths and rail deaths, respectively. Road and rail accidents were investigated as separate events. The severity densities will show that they represent different distributions. Historically, severe rail accidents have occurred less frequently.
3.9.4 On average, there were two reported road events per annum since 1997 with five or more deaths. This may appear low; note, however, that the average deaths per accident from these events was close to 17, which may indicate that only very severe accidents tend to be reported in newspaper articles.
3.9.5 Historically, a severe rail event has occurred on average every four years since 1994. A Poisson parameter of 0.25 was used.
3.9.6 A generalised Pareto distribution best fitted the road severity data, with a p-value of 0.89 on the Kolmogorov-Smirnov test.

3.9.7
A Cauchy distribution best fitted the rail severity data, with a p-value of 0.98 on the Kolmogorov-Smirnov test.

Commercial Airliners
3.10.1 A commercial airliner crashing with many insured lives on board would certainly put stress on an insurer's reserves. A full-scale crash is at the back of many people's minds when travelling by air, perhaps because an airliner crash is such a dramatic event, attracting a great deal of media attention, and not quickly forgotten by the public. This part of the research investigates historical frequencies and potential severities for a commercial airliner crash to determine how much of a life catastrophe risk this poses for a life insurer.
3.10.2 Past South African events include the 1987 flight SAA 295 Helderberg crash. The flight took off from Taiwan but, due to multiple mechanical failures, it crashed into the Indian Ocean just before reaching Mauritius, with the loss of 159 lives. There is still ongoing controversy about the 'true' circumstances of the loss (Young, 2007).
3.10.3 This paper considers relatively recent airline data. Although more data are gained by using a longer period, results become less relevant in light of modern air travel safety conditions. For example, the Boeing Statistical Summary of Commercial Jet Airplane Accidents Worldwide Operations   59 shows a phenomenal improvement in airline safety (in terms of accident rates). The 1960 fatality rate was around 35 fatal accidents per million departures compared to the 2010 rate of around 1 only. It is also generally agreed that the 1950s and 1960s were "not the best period for flight safety when taken in a worldwide context" (Young, op. cit.).
3.10.4 Boeing lists their fatal accident rate for scheduled commercial passenger operations departures (averaged over 2002-2011 and 174.2 million departures) as 0.34 fatal accidents per 1 million departures (i.e. 60 fatal accidents). These figures were based on government reports. However, deaths from terrorist activity were excluded (for example, the events of 11 September 2001). Including the lives lost in the four "9/11" plane crashes increases the fatal accident rate to approximately 0.367 fatal accidents per 1 million departures. This figure was used as a baseline estimate for accidents involving planes departing from or landing in a South African location. Since this report is interested in loss of South African lives, the problem then is to estimate the number of departures from South African airports each year. The major drivers of this figure are OR Tambo, Cape Town International and King Shaka (KS) airports, with the remaining smaller airports' total movements roughly equalling KS. Combined, these airports experience an estimated 200 000 commercial departures per year. 60 This leads to a rough estimate of a frequency of fatal accidents per annum departing from a South African airport as 0.367*(200 000/1 000 000) = 0.0735 or one fatal accident approximately every 14 years. 59 www.boeing.com/resources/boeingdotcom/company/about_bca/pdf/statsum.pdf, retrieved 21 July 2013. 60 Airports Company of South Africa. 2013. Archives. www.acsa.co.za/home.asp?pid=100, retrieved 9 August 2013.

3.10.5
Assuming SAA's recent accident frequency history is a better representation of risk in South Africa, an estimate of SAA's fatal accident frequency was made. SAA has, in its 73-year history, suffered 22 serious accidents, 11 of which were 'total hull loss' (Young, op. cit.). In light of the aforementioned safety improvements, only the period since 1968 (the date of the last major crash prior to the 1987 Helderberg incident) was used as the exposure period. A crude estimate based on this 45-year period (1968-2013) is 0.044 incidents per annum or one every 22.5 years. 3.10.6 The estimated frequency based on Boeing's experience is more credible due to greater exposure, and hence the estimate of 0.0735 accidents per year was used. A Bernoulli distribution with parameter 0.0735 was chosen to simulate whether or not an airline incident occurred. 3.10.7 To estimate severity, the types of airliner in the South African Airways (SAA) current fleet were investigated. The seating capacity of each airliner was of most interest when estimating potential casualties should an accident occur. Drawing an airliner capacity at random in the model's simulations from this fleet assumes that SAA's fleet is a good proxy for all flights departing domestically and internationally from South African airports.
3.10.8 Whilst the number of seats on board an airliner is a good indication of the maximum number of casualties, the actual number of casualties is likely to be lower. The US Department of Transportation 61 provides the mean occupancy rate for US flights as 82.52%. Assuming this figure for South Africa, the model then assumes a normal distribution centred around this figure (limited to between 0 and 100%), with an assumed 10% standard deviation. However, not everyone dies in a crash that leads to fatalities. 37% of accidents take place on final descent and landing, 62 so one can envisage a landing gone wrong causing a high number of fatalities but not killing everyone on board. In fact, the Aviation Safety Network 63 did analysis on previous hull loss crash data and found a fatality rate of 76.1% of those on board. In addition, deaths outside the plane are also considered. Corresponding to Boeing's 4 547 on-board fatalities from 2002-2011, there were 214 (~5%) external fatalities. Each onboard death toll simulated is thus increased by 5% to allow for this. The resulting (simulated) severity distribution displays a bimodal distribution of death counts for all accidents. The two peaks are due to the composition of SAA's fleet; one can almost draw a line between 'small' or 'large' airliner. The normal curve around these two peaks is as a result of the assumed normal occupancy distribution. 3.10.9 The model used is based on SAA's fleet, and the annual number of departures from South African airports. In summary, for a given year, the model: -simulates whether an event occurred or not, using the previously derived frequency; 61 Bureau of Transportation Statistics: Load factor (passenger-miles as a proportion of available seatmiles in percent (%) -given an event, randomly chooses an airliner from the SAA fleet to determine the number of seats; -draws an occupancy rate from the assumed normal distribution (capped at 100%), with mean 82.52%; -assumes a fatality rate of 76.1% of those on board (Aviation Safety Network 64 ); -adds on 5% of that number as external fatalities; and -returns the total number of deaths (or zero if no event occurred).

Nuclear Accidents
3.11.1 Africa's only nuclear power plant, Koeberg, lies around 26 kilometres north of the Cape Town CBD. The city has been expanding rapidly, so that close to 300 000 people are expected to live within a 16-kilometre radius of Koeberg by 2015 (Rontiris & Crous, unpublished).
3.11.2 Nuclear reactors operate at extremely high temperatures, and in an attempt to regulate the power output, or in the event of an emergency shutdown, a large volume of water is needed to cool down the reactor. If this water is not available, it can lead to core damage or meltdown. The following events are seen as the most likely causes or triggers of loss of coolant (see for example USNRC 65 ; Cohen, 1990): loss of electric power, burst pipes, seismic events or human error.
3.11.3 For Koeberg in particular, a threat to the station is loss of sea water cooling, so the addition of a large backup water cooling tower is being considered (Koeberg Public Safety Information Forum). 66 Another threat is seismic activity. Several small earthquakes have been recorded from the Milnerton fault, the most recent being in May 2009. Koeberg has been built to withstand a nuclear event of 7 Richter-around 9 M. 67 Aon Benfield 68 estimate the upper limit earthquake for this area as 6.87 M. Cohen (op. cit.) provides a summary: "All of these accident scenarios lead to a loss of water. The chain reaction cannot go on without water, so it is shut down, but one must still worry about heat from radioactivity causing the fuel to melt. This can only be prevented if water cooling is very rapidly restored to the reactor core (where the fuel is located)." 3.11.4 Nuclear reactors are sealed inside a very robust structure known as the containment-more than a metre wide of cement reinforced by thick steel rods. Cohen (op. cit.) describes the dual functionality of the containment. Firstly, it protects against external forces, such as an airplane flying into it or an explosive device detonated against it; secondly, in the case of a meltdown the function of the containment is to hold or 'contain' the radioactive material. An accident would involve the containment being breached (an unlikely scenario, see 3.11.9 below) rather than a more publicly feared 'mushroom explosion'. Technology today is such that an explosion is next to impossible with current safety standards; for example, the modifications to Koeberg over the last 10 years have reduced the Core Damage Frequency (the likelihood of the core being damaged in an accident) by a factor of about ten. 69 The worst-case feasible scenario is what is known as a core meltdown, resulting in the release of radioactive material: "A very serious emergency at Koeberg could, at worst, result in a release of radioactive material. This radioactive material would be blown downwind from the station and dispersed" (Eskom Emergency Plan 70 ).
3.11.5 Deaths are more likely to result from radiation poisoning rather than from an explosion. The Department of Minerals and Energy (DME) 71 classifies radiation exposure risks into three time periods: the early phase, where radioactive cloud is the risk; the intermediate phase-deposited radioactivity; and the late phase-radioactivity in food and water. This research only considers deaths in the early phase, which would contribute to a mortality shock over one year. In their severe accident analysis report for US nuclear power plants, the USNRC 72 also differentiates between the number of early fatalities "expected to occur within one year of the accident and the latent cancer fatalities expected to occur over the lifetime of the exposed individuals."

cHerNobyl
A city in Ukraine, Chernobyl, is the site of one of the world's worst nuclear disasters. On 26 April 1986, two explosions at the plant led to the core experiencing a partial meltdown. The disaster was the result of unauthorised tests being run while the plant's cooling system was inoperative. The meltdown emitted large amounts of radioactivity into the atmosphere, and trace amounts were picked up as far afield as Western Europe and North America. According to The Hutchinson Encyclopaedia (2013), the only immediate deaths were the 31 workers at the plant itself, dying of acute radiation poisoning. However, it is estimated that an additional 20 000 to 40 000 cancer deaths will be attributable to this disaster within about 60 years from 1986.

tHree Mile iSlaNd
Three Mile Island was the site of a nuclear power plant near Harrisburg, Pennsylvania in the United States. In March 1979, a "series of mechanical problems, human errors and poor decisions" led to a partial meltdown (Chambers Dictionary of World History, 2005 was no threat to the containment (Cohen, op. cit.), but the event still released dangerous radioactivity. Nobody was immediately killed, but the event cast a shadow on the use of nuclear energy as an alternative power source.

FuKuSHiMa
On 11 March 2011, a magnitude 9 earthquake occurred off the coast of Japan. This led to a tsunami, which subsequently flooded the Fukushima nuclear power plant with seawater. Equipment failure led to loss of coolant, and partial nuclear meltdown in three of the six reactors, leading to a release of radioactivity. The accident caused no immediate deaths, and even the most concentrated areas received very low doses of radiation, so very few cancer deaths are expected as a result (WHO, unpublished b). 3.11.9 The United States Nuclear Regulatory Commission (USNRC) 73 has general guidelines for core damage frequencies allowable for various degrees of damage. According to the USNRC, the "large early release frequency (LERF)" is a good surrogate for early fatality risk. Their maximum allowable annual frequency is 10 -5 , or once every 100 000 years. In his book The Nuclear Energy Option (1990), physicist Bernard L. Cohen neatly summarised two ends of the spectrum of frequency estimates. First, a pro-nuclear estimate of the probability of core damage by the USNRC called the "Reactor Safety Study" (RSS). Here they estimate a reactor meltdown may be expected around once every 20 000 years of reactor operation. Second, an anti-nuclear group called the Union of Concerned Scientists (UCS) responded with an estimate of one meltdown every 2 000 years, a tenfold increase in frequency. An exposure analysis based on available information shows that the worldwide experience base of nuclear energy was approximately 10 000 in-service reactoryears in 2003/4 (Encyclopaedia of Energy, 2004). With approximately 440 nuclear power plants in the world, this figure will have risen to approximately 14 000 in-service reactor years by 2014. The three historical worldwide core damage events over this exposure number yield an estimated frequency of 1/4666 accidents per in-service reactor year. This frequency will be used in the model.
3.11.10 A meltdown or core damage does not necessarily imply disaster. The containment vessel of thick concrete with supporting steel would still need to be breached, and is expected to maintain its integrity for a long time-so in most cases the fatalities should be zero (Cohen, op. cit.). Eskom has a warning and evacuation plan to reduce human exposure to radiation, should a nuclear event take place. Eskom notes that the population within a 5 km radius is the most at risk, but "it is highly unlikely that the entire area within the 16 km radius surrounding Koeberg will be affected by a release of radioactive material during a general emergency. The radioactive material would travel downwind from the power station". 74 To mitigate the effects of a disaster and allow swift evacuation, systems are in place to control 73 Quantitative guidelines from the framework for risk informing (2002, 10 CHR part 50 the population density around Koeberg. For example, no development that would lead to a population increase is permitted in the 5 km radius zone, and this zone must be capable of being evacuated within four hours; whilst development in the 5-16 km zone is permitted, provided compliance with the 16-hour evacuation plan can be shown (Jones et al., unpublished).
3.11.11 For the possible outcomes of a core meltdown, the reactor safety study estimates given by Cohen (op. cit.) were used. Hence, it was assumed that in 1 out of 5 meltdowns there would be over 1000 immediate deaths, in 1 out of 100 there would be over 10 000 deaths and 1 in 100 000 meltdowns there would be approximately 50 000 deaths. This assumes that the population density around Koeberg is in line with the average US nuclear site investigated in the RSS study. The modelled result was not particularly sensitive to nuclear frequency or severity parameters used in the model, and this point was not investigated further.
3.11.12 A worst-case scenario is based on the projected 300 000 lives within the 16 km zone, and assuming 50 000 of these are within the 5 km radius. A worst case scenario (actual breaching of containment/successful terrorist operation) would result in 75% fatality of the 5 km zone and 25% fatality of the 16 km zone, giving 100 000 (immediate) deaths.

MODEL RESULTS AND SENSITIVITY TESTING 4.1
The Overall Shock 4.1.1 The model shows that an overall 1-in-200 year life catastrophe mortality shock for the South African general population is 2.59 additional deaths per thousand people.  The model results show that a pandemic poses the largest life catastrophe risk to a life insurer, with the pandemic shock on its own being 98% of the total shock. Consequently, the sensitivity of the total life CAT mortality shock will be largely driven by the sensitivity of the pandemic shock. 4.1.4 The 2.555 per thousand figure for pandemics, while appearing low relative to some of the worst-case scenario projections, exceeds that of the European Standard Formula (1.5 per thousand). This is not necessarily unexpected, given that there are differences in access to healthcare, HIV prevalence and government preparedness between South Africa and the EU countries. In light of the above, this risk is the most important in terms of further work and research, the result being highly sensitive to the choice of distribution and the assumed annual likelihood of a future pandemic.

FrequeNcy eStiMateS
A doubling of the frequency of all types of catastrophe other than pandemic was carried out. This resulted in almost no change to the final shock: it increased by around 0.8% (i.e. 0.02 per mille). While there could be large parameter errors in the frequencies estimated (due to using limited data to estimate the 1-in-200-year tail probabilities), the overall result is dominated by pandemic risk.

Severity eStiMateS
The model was then tested for sensitivity to the severity estimates for other catastrophe types. Here, the severity for all catastrophes other than pandemics was doubled by multiplying each death figure drawn from the appropriate distribution by two. Again, the life CAT shock showed almost no change, increasing by around 1% (i.e. 0.03 per mille). Table 4 summarises the results of multiple scenarios used to determine the sensitivity of the overall shock to the assumptions underlying the pandemic section. While the above sensitivities were based on a doubling of parameters, it must be emphasised that the level of parameter uncertainty is very high, and that the estimates may well be out by multiples in the tail. Apart from scarcity of data in the tail, there is the additional uncertainty of applying past data to future projections-if the underlying risk changes over time, historical data are of little relevance.

SUMMARY
5.1 SAM requires the study of effects of various shocks on a South African insurer's business. This research calculated a life catastrophe shock for a South African insurer with an insured population with similar risk profile and geographic spread as the national population, the shock being defined as the additional deaths per thousand people due to an extreme event. The application of this excess mortality estimate to determine a company's solvency capital requirement is beyond the scope of this paper.

5.2
A number of potential catastrophe events were investigated. For the event types deemed relevant to South Africa, the annual frequency of occurrence and the potential death counts per occurrence were estimated. These estimates were derived from historical data, using both South African-specific and, in some cases, global data.

5.3
Once these estimates for the frequencies and severities had been derived, potential outcomes for future years were simulated using Monte Carlo techniques. Identifying the 1-in-200 year shock involved determining the 99.5th percentile of these possible outcomes.

6.1
The model produced a life catastrophe mortality shock of 2.6 additional deaths per thousand lives. For an insurer with an insured population similar to the national population and experiencing a mortality rate similar to the national mortality rate (of 9.8 per mille 75 per annum), the SAM Pillar 1 shock is 3.22 per mille, which is higher than the rate suggested above. A limitation of this study has been the exclusion of certain risks (in particular, war and terrorism) resulting in a potential understatement of the overall catastrophe risk.

6.2
There may be justification for a mortality shock (in particular for pandemic risk) that is dependent on the socio-economic profile of the insured population and this should be investigated further.

6.3
The results show that pandemic risk is by far the biggest risk. Inclusion of some of the risks not considered, for example, war and terrorism, would increase the weight given to non-pandemic risks.
75 Statistics South Africa 2011 deaths as a proportion of the 2011 census population.

6.4
Underlying Assumptions and Limitations 6.4.1 MaiN aSSuMptioNS -Insured lives are exposed to the same non-pandemic catastrophes as the general population, hence they are not more or less likely to be affected. (Insured lives may be more exposed to certain risks, for example, airliner, earthquake, nuclear and terrorism risks, while being less exposed to others, for example, flooding. Even in the insured population the risks are unlikely to be the same across all sums insured.) -The Swiss Re (op. cit.) model is the most suitable source for quantifying pandemic risk.
-Catastrophe events are independent from each other.
-The severity of industrial accidents, mining accidents and earthquake events in South Africa (given that one of these events has occurred), is from the same distribution as the severity observed worldwide.

liMitatioNS
-The scarcity of data for catastrophe-type events, which, by their nature are rare, limits the credibility of the analysis. -Other countries' catastrophe data, which has been used for some of the event types, may be of questionable relevance for South Africa. -The effect of all other catastrophes is swamped by the pandemic result, which is itself reliant on the suitability of the Swiss Re (op. cit.) model. -The exclusion of certain risks (in particular, war and terrorism).

6.4.3
Users of the model should note how sensitive the result is to the choice of pandemic severity. All the other catastrophe events could be ignored and the result would not be materially affected. 6.4.4 This attempt at deriving the life catastrophe mortality shock is not particularly sophisticated. It treats observed past events as being single realisations from their respective, and assumed independent, distributions, and then considers the tail of this combined distribution. Banks (op. cit.: 68) emphasises that "catastrophe modelling is not an attempt to predict when a disaster might occur, but a process that allows users to create a meaningful distribution of future events so that associated expected and extreme loss patterns can be developed."

RECOMMENDATIONS FOR FURTHER RESEARCH
The approach that was used to model catastrophes is limited in a number of ways. The aim of this section is to recommend areas for further research to address these shortcomings and to investigate alternative methods for modelling catastrophe deaths.

Scenario-based Approach
This may be the most appropriate approach for hypothesised catastrophes which have not yet occurred. It involves constructing possible catastrophe scenarios, and estimating the potential loss of life and the proportion of those lives covered by the specific insurer for each scenario. The probability for each event occurring would have to be estimated. This method is not as reliant on data as the distribution-fitting approach and involves a degree of subjective judgement.

Generalising Catastrophes
Under this method, catastrophes are generalised into one class, with no distinction between event types. This is similar to a model developed by Ekheden and Hössjer (2014), who used the Peaks Over Threshold model. The frequency of a 'catastrophe event' is estimated, and a single severity curve for number of casualties is fitted from the pooled historical data.

Permanent Total Disabilities
Taking permanent total disabilities (PTDs) into account could give a better estimate of the loss from an event, as a PTD often results in an accelerated death benefit. When modelling deaths, PTDs can be modelled as a proportion of deaths occurring, for example Alexander (op. cit.) reports specialists in earthquake injury as using a ratio of one death per three significant injuries.

Segmenting Death Data by Income Groups
This could give a better estimate of whether the deaths were insured and, if so, the likely size of the sum assured. For example, the majority of historical South African flood deaths have been residents of informal settlements, whereas an airliner disaster is likely to affect a wealthier sub-section of the population. Given the same death count for the two catastrophe types, an insurer is likely to have more and larger claims arising from the airliner crash.

Group Life Policies
Modelling group life and individual policies separately could give more accurate results. Group life policies can lead to an accumulation of risk in a specific area or industry, which could materially increase the importance of some of the catastrophe types considered, for example, an industrial accident. If terrorism were to be modelled, these group life policies pose the largest risk. This is due to the concentration of lives, usually in high-value target areas in urban city centres.

War and Terrorism (incl. Nuclear and Biological Risks)
This should be included in further research. Terrorism may be one of the most difficult life catastrophe event types to quantify, due to the added human element. The method should give consideration to the current political climate as well as socio-economic and other relevant trends. Industry practice has been to rank potential targets by the terrorists' "expected utility" (Woo, 2002). Utility may be influenced by the symbolic value of the target, economic damage or number of casualties.

Heatwaves
The inclusion of heat waves as a mass mortality event could also be warranted. There are several international examples through history, the most memorable being the 2003 European heat wave. Some sources have 70 000 deaths attributed to that event (see, for example, Robine et al. (2008) for further information).

Other Risks
Other risks that should be assessed include shipping disasters, arena/stadium-type disasters, meteorological catastrophes as well as some allowance for completely new and unanticipated types of catastrophes.

7.9
Correlation between Catastrophes This paper assumed independence between catastrophes. However, one could expect some positive correlation between events. For example, an earthquake giving rise to a tsunami that causes both mass floods and further accidents (as occurred in Fukushima in March 2011, when a tsunami disabled the cooling systems of nuclear reactors). The effects of such correlations could be investigated in further research.