Prudential Standard GPS 220

Risk Management for General Insurers

Objective and Key Requirements of this StandardThis Prudential Standard aims to ensure that an insurer is well managed, has access to appropriate independent expertise and has systems for identifying, managing and monitoring risks that may reduce the ability of the insurer to meet its obligations to policyholders.The prime responsibility for the sound and prudent management of an insurer rests with the Board and senior management of that insurer. The Board and senior management should institute effective internal governance within the insurer and ensure that appropriate systems and controls are in place to address the risks arising from the insurer’s business activities.The key requirements of this Prudential Standard are:Persons occupying key positions within the insurer must have the degree of probity and competence commensurate with their responsibilities. These key positions include directors and senior managers of the insurer, as well as the insurer’s Approved Auditor and Approved Actuary (see below). At a minimum, each insurer should have policies and procedures in place to address the criteria for fitness and propriety contained in this Standard. APRA may remove persons from key positions where they no longer meet the criteria for fitness and propriety.Each insurer must obtain APRA’s approval for its appointment of an auditor (an Approved Auditor) and, unless exempted by APRA, an actuary (an Approved Actuary). The Approved Auditor and Approved Actuary are required to perform the duties specified in APRA’s Prudential Standards and the Insurance Act 1973. Reflecting the importance of these duties (which include ‘whistle-blowing’ obligations), holders of these positions are generally expected to have appropriate formal qualifications and be a member of a suitable professional body, have a minimum level of experience in the general insurance industry, and be Australian residents.Given the responsibilities of the Board of an insurer, it is essential that a shareholder (or a group of associated shareholders) of an insurer is not in a position to exercise undue or disproportionate control or influence over that insurer’s Board, policies or operations. To that end, this Standard sets out various requirements as to the Board’s composition, including a minimum of 5 directors, a non-executive Chair, and a majority of non-executive directors. At least 2 directors must be Australian residents.A system of effective risk management and control is critical to the safety and soundness of the operations of an insurer. The Board and senior management of an insurer must develop, implement and maintain a sound and prudent Risk Management Strategy (RMS) that identifies the insurer’s policies and procedures, processes and controls that comprise the insurer’s risk management and control systems. These systems should be appropriate to the size, business mix and complexity of the insurer’s operations and address all material risks, financial and non-financial, likely to be faced by the insurer. The insurer’s RMS must be documented, approved by the Board, updated as necessary, and provided to APRA.Annually, an insurer must provide APRA with a Board Declaration signed by 2 directors. The purpose of the Board Declaration is to ensure the Board undertakes a regular, informed assessment of all key risks. The Board Declaration is to certify that strategies have been put in place to monitor those risks. Broadly, the Board is required to confirm that the insurer has systems in place to ensure compliance with legislative and prudential requirements, and that the Board has satisfied itself as to the adequacy of, and compliance with, the insurer’s risk management and reinsurance arrangements.Details on these requirements are contained below, and in Guidance Notes GGN 220.1, GGN 220.2, GGN 220.3, GGN 220.4 and GGN 220.5, which form part of this Standard. Additional requirements relating to role of the Approved Actuary are set out in GPS 210 Liability Valuation.

Prudential Standard

This Prudential Standard, made under section 32 of the Insurance Act 1973 (the Act), applies to all general insurers authorised under the Act.

Governance

Fitness and Propriety

Insurers must ensure that persons occupying key positions within the insurer have the degree of probity and competence commensurate with their responsibilities.
For this purpose, insurers should have in place policies and procedures to address fitness and propriety. These policies and procedures should at a minimum address the criteria for fitness and propriety that APRA uses to assess fitness and propriety set out in paragraph 6.
For locally-incorporated insurers, persons occupying key positions means:

(a) directors;

(b) senior managers;[31]

(d) the insurer’s actuary appointed under the Act and approved by APRA (Approved Actuary),[33] where relevant.

For foreign-incorporated insurers operating in Australia as branches (foreign insurers), persons occupying key positions means:

(a) senior managers of the Australian operations;

(b) the foreign insurer’s agent in Australia appointed under the Act;[34]

(d) the foreign insurer’s Approved Actuary, where relevant.

The criteria for fitness and propriety[35] are as follows:

(a) the person has not been convicted of an offence against or arising out of the Act or the Financial Sector (Collection of Data) Act 2001;

(b) the person has not been convicted of an offence against or arising out of a law in force in Australia, or the law of a foreign country, if the offence concerns dishonest conduct or conduct relating to a financial sector company within the meaning of the Financial Sector (Shareholdings) Act 1998;

(c) the person has never been bankrupt, has not applied to take the benefit of a law for the relief of bankrupt or insolvent debtors, or has not compounded with his or her creditors;

(d) the person has no actual or potential conflicts of interest that are likely to influence their ability to carry out their role and functions with appropriate probity and competence;

(e) the person has adequate experience and demonstrated competence and integrity in the conduct of business duties;[36]

(f) the person is not of bad repute within the business and financial community;

(g) in the case of an Approved Auditor:

(i) the person is not a director or employee of the insurer or of a related body corporate within the meaning of section 50 of the Corporations Act 2001; and

(ii) the person is registered as an auditor under the Corporations Act 2001; and

(h) in the case of an Approved Actuary, the person is not the Chief Executive or a director of the insurer, or of a related body corporate within the meaning of section 50 of the Corporations Act 2001 (except where that related body corporate is a subsidiary of the insurer).

A person may not act as a director, a senior manager or an agent in Australia if that person is a disqualified person.[37] The disqualification criteria are set out in the Act.[38]

Eligibility Criteria for Approved Auditors and Approved Actuaries

In addition to the general requirements of fitness and propriety outlined in paragraph 6, APRA can only approve the appointment of an Approved Auditor and Approved Actuary if the person concerned meets the following eligibility criteria:[39]

(a) the person has appropriate formal qualifications and is a member of a suitable professional body;

(b) the person has a minimum of 5 years’ experience in the general insurance industry; and

APRA may approve individuals, on a case-by-case basis, who do not meet the eligibility criteria in paragraph 8 if the insurer can demonstrate to the reasonable satisfaction of APRA that exceptional circumstances exist as to why the person should be approved as an Approved Auditor or Approved Actuary.
Reflecting the importance of the positions, and in order to demonstrate independence and avoid potential conflicts of interest, a person is not eligible to be appointed as both an Approved Auditor and Approved Actuary to the same insurer.
Further detail in relation to these eligibility criteria and the particulars required for an application are set out in Guidance Note GGN 220.1 Governance.
APRA may direct that an insurer remove a person occupying a key position (other than an Approved Auditor or Approved Actuary)[40] where APRA finds that the person:

(a) is a disqualified person under the Act;[41] or

(b) does not meet one or more of the criteria for fitness and propriety.

APRA may revoke the approval of a person’s appointment as an Approved Auditor or Approved Actuary,[42] and disqualify a person from holding an appointment as an Approved Auditor or Approved Actuary,[43] where APRA finds that the person:

(a) has failed to perform adequately and properly the functions and duties of such an appointment; or

(b) otherwise does not meet one or more of the criteria for fitness and propriety; or

Individuals affected by a decision made by APRA referred to in paragraphs 12-13 may request that APRA review that decision. If APRA confirms or varies the decision, or fails to do either within 21 days, the person affected may then make an application to the Administrative Appeals Tribunal. The appeal process is set out in Part VI of the Act.

Roles and Obligations of Key Positions

(i) Boards

The Board has ultimate responsibility for the safety and soundness of an insurer. Accordingly, the Board should have responsibility for approving and reviewing business strategies and significant policies of the insurer. The Board must use its best endeavours to identify and understand the major risks faced by the insurer. The Board must ensure that an appropriate, adequate and effective system of risk management and internal control is established and maintained, and must use its best endeavours to ensure that senior management monitors the effectiveness of the risk management and control system.
Given the Board’s responsibilities, it is essential that a shareholder (or a group of associated shareholders) of an insurer is not in a position to exercise undue or disproportionate control or influence over that insurer’s Board, policies or operations.
As a guide, holdings under 15 per cent of an insurer’s voting shares should have representation of no more than one on a Board of six or less and no more than two on a Board of seven or more. Where shareholdings over 15 per cent have been approved under the Financial Sector (Shareholdings) Act 1998, the shareholder’s Board representation can be higher, but should remain broadly proportionate to the shareholding concerned.
In addition, at all times, the Board of a locally-incorporated insurer must have:

(a) a minimum of five directors;

(b) a non-executive Chair; and

At least two directors of the insurer must be Australian residents, one of whom must be a non-executive. Further detail, including guidance for foreign-owned locally-incorporated insurers, is set out in Guidance Note GGN 220.1.

Insurers must provide APRA with details of all newly appointed directors, including their name, principal business associations and curriculum vitae, within 14 days of their appointment. In addition, insurers must provide APRA with an updated annual statement listing all of its directors (including details of any changes to business associations) no later than at the time which the insurer lodges its yearly statutory accounts.
The Board of a locally incorporated insurer must establish appropriate Board Committees, including at a minimum a Board Audit Committee. The Board Audit Committee must be made up of a majority of non-executive directors and its function shall be to monitor compliance with the Board’s policies, as well as prudential and statutory requirements. The Chair of the Board must not also be the Chair of the Audit Committee. Where the insurer is part of a larger corporate group, APRA may allow the insurer to use the Group Audit Committee as a Board Audit Committee where it is demonstrated that the Group Audit Committee can effectively address the needs of the insurer (provided the Group Audit Committee has a majority of directors who are non-executives of the insurer). Further detail in respect of Board Audit Committees is set out in Guidance Note GGN 220.1.

(ii) Senior Management

Senior managers comprise persons employed by an insurer who exercise senior management responsibilities. Senior management responsibilities[44] means having primary responsibility for one or more of the following:

(a) high level decision making;

(b) implementing strategies and policies approved by the Board;

(d) monitoring the appropriateness, adequacy and effectiveness of the risk management system.

Insurers must provide APRA with a list of senior management positions and the responsibilities of those positions. Details of the individuals who occupy these positions, including their name and curriculum vitae, must also be submitted within 14 days of their appointment. In addition, insurers must provide APRA with an updated annual statement listing all senior management positions, and names of persons occupying those positions, no later than at the time which the insurer lodges its yearly statutory accounts.

(iii) Senior Officer from Outside Australia (Foreign Insurers)

As in the case of locally incorporated insurers, the ultimate responsibility for the safety and soundness of a foreign insurer resides with its Board. However, for practical purposes, APRA will allow a foreign insurers’ Risk Management Strategy (refer paragraphs 40-44) and Reinsurance Management Strategy (see GPS 230 Reinsurance Arrangements) and the Board Declaration (refer paragraphs 54-55) to be approved by a senior officer outside Australia with delegated authority from the Board. The senior officer must have responsibility for overseeing the Australian branch operation.
At the time of nominating a senior officer from outside Australia, foreign insurers must provide APRA with details of that person, including their name and curriculum vitae. These details must be resubmitted to APRA within 14 days when there is any change in the senior officer from outside Australia. The foreign insurer must ensure that the designated senior officer meets the standards of fitness and proprietary set out in this Standard.

(iv) Approved Auditor

The Approved Auditor must audit the annual accounts of an insurer as required under the Act.[45] The Approved Auditor must provide a certificate to the insurer, and that certificate must be submitted by the insurer to APRA together with the yearly statutory accounts. The certificate must fulfil the requirements set out in Guidance Note GGN 220.1.
The Act requires that an insurer must make arrangements to enable the Approved Auditor to undertake his/her functions.[46] These arrangements would normally include ensuring that the Approved Auditor is fully informed of APRA’s prudential requirements for the insurer (such as conditions on authorisation, variations to prudential standards, determinations and exemptions), as well as any other information that APRA has provided to the insurer that may assist the Approved Auditor in performing his/her duties.
In addition, the insurer must ensure that its Approved Auditor has access to all relevant data and people which the Approved Auditor reasonably believes is necessary to fulfil his/her obligations under the Act, Insurance Regulations 1974, Prudential Standards and the Financial Sector (Collection of Data) Act 2001 and Reporting Standards.
An Approved Auditor may also be required to undertake other functions specified by APRA in consultation with the insurer. Accordingly, APRA may, in consultation with an insurer, request a specific review of a particular aspect of the insurer’s operations or risk management system. The cost of specific reviews will be borne by the insurer.
The specific reviews will be conducted along the lines of an “Engagement to Perform Agreed-Upon Procedures” (refer Auditing Standard 904).[47] The report of such reviews must be submitted to APRA and the insurer simultaneously, within 3 months after the review is commissioned.

(v) Approved Actuary

The Approved Actuary must prepare a report in accordance with GPS 210 Liability Valuation and provide this report to the insurer’s Board. The insurer must submit this report to APRA at the same time as it submits its yearly statutory accounts. An Approved Actuary may also be required to provide other information to APRA on request.[48]
The Act requires that an insurer must make arrangements to enable the Approved Actuary to undertake his/her functions.[49] These arrangements will normally include ensuring that the Approved Actuary is fully informed of APRA’s prudential requirements for the insurer (such as conditions on authorisation, variations to Prudential Standards, determinations and exemptions), as well as any other information that APRA has provided to the insurer that may assist the Approved Actuary in performing his/her duties.
In addition, the insurer must ensure that its Approved Actuary has access to all relevant data and people which the Approved Actuary reasonably believes is necessary to fulfil his/her obligations under the Act, Insurance Regulations 1974 and Prudential Standards.

Non-routine Reporting by Approved Auditors and Approved Actuaries

Approved Auditors and Approved Actuaries are required to make non-routine reports in certain circumstances. This might be where APRA requests specific information, or where the information available to the Approved Auditor or Approved Actuary is of material interest to APRA.[50] Additional detail on the nature of non-routine reporting is set out in Guidance Note GGN 220.1.

Meetings with Approved Auditors and Approved Actuaries

Liaison with an insurer’s Approved Auditor or Approved Actuary will normally be conducted under trilateral arrangements involving APRA, the insurer, and its Approved Auditor or Approved Actuary. Any one of these three parties can initiate meetings or discussions when considered necessary. Notwithstanding the trilateral relationship, APRA and an insurer’s Approved Auditor or Approved Actuary may meet on a bilateral basis where either party deems this to be necessary.

Risk Management

A system of effective risk management and control is critical to the safety and soundness of the operations of insurers. The Board and senior management of an insurer must develop, implement and maintain a sound and prudent Risk Management Strategy that identifies the insurer’s policies and procedures, processes and controls that comprise the insurer’s risk management and control systems. These systems should be appropriate to the size, business mix and complexity of the insurer’s operations and address all material risks, financial and non-financial, likely to be faced by the insurer.
The Board is charged with the responsibility to instil a strong risk control culture throughout the insurer, so that material risks and potential problems that emerge can be identified, managed and promptly resolved in the normal course of business operations.
No matter how well designed and operated, risk management and control systems will be subject to some inherent limitations. Nonetheless, risk management and control systems should provide the Board (and APRA) with a reasonable assurance that an insurer’s business is appropriately controlled and that its risks are being prudently and soundly managed.
At a minimum, the risk management and control systems must include:

(a) a comprehensive written Risk Management Strategy approved by the Board (or in the case of foreign insurers, approved by an appropriate senior officer from outside Australia with requisite Board delegation);

(b) sound risk management policies and procedures to identify, manage, monitor and report on the key risks of the insurer; and

These elements will be considered by APRA when evaluating insurers’ risk management and control systems.

Risk Management Strategy (RMS)

Each insurer is required to maintain at all times a written RMS, approved by the Board (or in the case of foreign insurers, a senior officer from outside Australia with requisite Board delegation).[51] The RMS should be appropriate to the size, business mix and complexity of operations of the insurer and must define and document the insurer’s objectives and strategy for risk management and internal control.
An insurer’s RMS must be submitted to APRA within 14 days of its being approved by the Board.
Each insurer must review its RMS regularly (at least annually) to ensure it provides an adequate framework to monitor the operating circumstances that may impact on the insurer’s risk profile. The RMS must be reviewed (and if necessary, amended) where there is material change to the operations of an insurer. An updated, Board approved, copy must be provided to APRA within 14 days after Board approval.
An insurer must substantially adhere to its RMS at all times and must advise APRA if it intends to undertake activities in a manner that represents a material deviation from its RMS. Any such activities should first be approved by the Board. Should the RMS then require amendment, a revised RMS must be approved by the Board and submitted to APRA within 14 days of Board approval.
The RMS must cover both the Australian and, where relevant, the overseas operations of the insurer. Further detail on the content of the RMS is contained in Guidance Note GGN 220.2 Risk Management Systems.

Processes for Risk Identification and Assessment

An effective risk management system identifies, manages, monitors and continually assesses the material risks that could adversely affect the operations of an insurer.
Whilst the risk management systems of an insurer must address all material risks, APRA considers that at a minimum the following categories must be addressed in an insurer’s risk management systems: balance sheet and market risk (including investment risk, insurance risk, product design and pricing risk, underwriting and liability risk, liquidity risk, risk arising from claims management and derivatives risk); credit risk; and operational risk (including legal and reputational risks).
In addition, an insurer’s risk management systems should also take into account the potential risks arising out of the insurer’s reinsurance arrangements. That is, there must be a clear link between the insurer’s Reinsurance Management Strategy (as required by GPS 230) and the insurer’s risk management systems.

Control Activities

Control activities are the policies and procedures that help ensure Board and senior management directives are carried out. In this way, action can be taken to adequately address risks faced by the insurer. Control activities should be reflective of the size and operations of the insurer.
Control activities would normally include: reviews by Board and senior management; activity controls for each division or department; physical controls; the establishment of underwriting limits and checking compliance with limits; a system of approvals and authorisations; verifications and reconciliations; and segregation of duties. Guidance Note GGN 220.2 sets out some further examples.

Information and Communication

Pertinent information should be identified, captured and communicated in a form and timeframe that will enable the responsibilities of the insurer to be met. An insurer’s information systems must be capable of producing financial, operational and compliance data, and of dealing with external market information about events and conditions that are relevant to decision making. Internal information systems must be secure and supported by adequate contingency arrangements.
Effective communication should occur throughout the insurer to ensure that all staff fully understand and adhere to policies and procedures affecting their duties and responsibilities and that other relevant information is reaching the appropriate personnel.

Processes for Monitoring Risks

The overall effectiveness of the insurer’s risk management and control systems must be monitored. Depending on the size and complexity of operations of an insurer, risk management systems may be monitored on an ongoing or periodic basis. At a minimum, there must be periodic internal audits with results being reported promptly to the Board or the Board Audit Committee and to senior management.
Where deficiencies are identified as part of the monitoring process or internal audit, these must be reported in a timely manner to the appropriate management and addressed. Material deficiencies must be reported to the Board or the Board Audit Committee and senior management. For this purpose, a material deficiency can result not only from a single deficiency, but from a number of small deficiencies that, when considered together, amount to a material deficiency.

Board Declaration

An insurer must provide APRA with a Board Declaration signed by 2 directors, or in the case of a foreign insurer, by a senior officer from outside Australia delegated the requisite authority from the Board, at the same time it lodges its yearly statutory accounts.
The purpose of the Board Declaration is to ensure the Board undertakes a regular informed assessment of all key risks. The Board Declaration is to certify that strategies have been put in place to monitor those risks. Broadly, the Board is required to confirm that the insurer has systems in place to ensure compliance with legislative and prudential requirements, and that the Board has satisfied itself as to the adequacy of, and compliance with, the insurer’s risk management and reinsurance arrangements. Details of the Board Declaration are set out in Guidance Note GGN 220.2.

Business Plan

A business plan is an important management and control tool that enables a company to communicate its strategic direction and objectives, identify opportunities in the market place, forecast results and establish benchmarks. A sound business plan also needs to consider the impact of differing assumptions or scenarios on the insurer’s financial position.
Each insurer must at all times maintain a business plan approved by the Board that is revised in response to developments in the insurer’s operational environment. This plan must be submitted to APRA annually (as well as whenever material changes to the plan are made).

Other Reporting Requirements - Insurance Business Outside Australia

Where an insurer conducts insurance business outside Australia, it must notify APRA in writing if its right to conduct that business ceases, or if the insurer’s right to conduct insurance business has been limited or otherwise materially affected under a law of the jurisdiction in which the business is being conducted. Notification must be provided within 14 days of the event occurring.

Prudential Standard GPS 220Prudential Standard GPS 220

Get a plain-English read of Prudential Standard GPS 220