The risk management system is designed and operated at all levels of the insurer to allow for the identification, assessment, monitoring, mitigation and reporting of all risks of the insurer in a timely manner. It takes into account the probability, potential impact and time horizon of risks.

• take into account the insurer’s overall business strategy and business activities (including any business activities which have been outsourced);
• provide that the insurer’s risk appetite, expressed in a risk appetite statement, be aligned with the insurer’s business strategy and embedded in its day-to-day activities;
• provide relevant objectives, key principles and proper allocation of responsibilities for dealing with risk across the business areas and business units of the insurer;
• provide explanations of the methodologies, key assumptions and limitations of risk management; for groups this would include the rationale as to the risk appetite for different individual insurance legal entities within the group;
• provide a documented process defining the Board approval required for any deviations from the risk management strategy or the risk appetite and for settling any major interpretation issues that may arise;
• define and categorise material risks (by type) to which the insurer is exposed, at both insurance legal entity and group level where applicable, and the levels of acceptable risk limits for each type of these risk;
• include documented policies that describe how categories of risks are managed and the specific obligations of employees and the insurer in dealing with risk, including risk escalation and risk mitigation tools;
• provide suitable processes and tools (including stress testing and, where appropriate, models) for identifying, assessing, monitoring and reporting on risks. Such processes should also cover contingency planning;
• provide for regular reviews of the risk management system (and its components) to help ensure that necessary modifications and improvements are identified and made in a timely manner; and
• appropriately address other matters related to risk management for solvency purposes set out in ICP

The risk management system should cover at least the following risks: underwriting and reserving, asset-liability management, investments, liquidity, concentration, operational and conduct, as well as reinsurance and other risk mitigation techniques.

The risk management system should be aligned with the insurer’s risk culture and embedded into the various business areas and units with the aim of having the appropriate risk management practices and procedures embedded in the key operations and structures.

The risk management system should take into account all reasonably foreseeable and relevant material risks to which the insurer is exposed, both at the insurer and the individual business unit levels. This includes current and emerging risks.

Insurers should assess material risks both qualitatively and, where appropriate, quantitatively. Appropriate consideration should be given to a sufficiently wide range of outcomes, as well as to the appropriate tools and techniques to be used. The interdependencies of risks should also be analysed and taken into account in the assessments.

The insurer’s risk assessment should be documented including detailed descriptions and explanations of the risks covered, the approaches used, and the key judgements and assumptions made.

Insurers should have in place adequate processes, controls and systems to assess the risks of new products and carry out a risk assessment before entering into new business lines and products. Significant new or changed activities and products that may increase an existing risk or create a new type of exposure should be approved by Senior Management and/or by the Board.

The risk management system should include processes and tools for monitoring risk, such as early warnings or triggers that allow timely consideration of, and adequate response to, material risks.

The risk management system should include strategies and tools to mitigate against material risks. In most cases an insurer will control or reduce the risk to an acceptable level. Another response to risk is to transfer the risk to a third party. If risks are not acceptable within the risk appetite and it is not possible to control, limit or transfer the risk, the insurer should cease or change the activity which creates the risk.

Risks, the overall assessment of risks and the related action plans should be reported to the Board and/or to Senior Management, as appropriate, using qualitative and quantitative indicators and effective action plans. The insurer’s documented risk escalation process should allow for reporting on risk issues within established reporting cycles and outside of them for matters of particular urgency.

The Board should have appropriate ways to carry out its responsibilities for risk oversight. The risk management policy should therefore cover the content, form and frequency of reporting that it expects on risk from Senior Management and each of the control functions. Any proposed activity that would go beyond the Board-approved risk appetite should be subject to appropriate review and require Board approval.

The insurer’s risk management policy should be written in a way to help employees understand their responsibilities regarding risk management. It should also reflect how the risk management system relates to the insurer’s overall corporate governance framework and its corporate culture. Regular internal communications and training within the insurer on the risk management policy and risk appetite may help in this regard.

For insurance groups, a risk management policy addresses the way in which the group manages risks that are material at the insurance group level, including risks that arise from the insurance group being part of a wider group. For an insurance legal entity that is part of a group, the risk management policy of that entity should address management of risks material at the entity level as well as additional risk it faces as a result of its membership in a group, which can encompass the widest group of which the insurance legal entity is a member and not only the entity’s insurance group. Within an insurance group, the head of the group and the legal entities should ensure appropriate coordination and consistency between the head of the group and the legal entities when setting the risk management policy.

Both the Board and Senior Management should be attentive to the need to modify the risk management system in light of changes in the insurer’s risk profile as well as other new internal or external events and/or circumstances. The risk management system should include mechanisms to incorporate new risks and new information related to risk already identified on a regular basis. The risk management system should also be responsive to the changing interests and reasonable expectations of policyholders and other stakeholders.