Risk Management
-
A system of effective risk management and control is critical to the safety and soundness of the operations of insurers. The Board and senior management of an insurer must develop, implement and maintain a sound and prudent Risk Management Strategy that identifies the insurer’s policies and procedures, processes and controls that comprise the insurer’s risk management and control systems. These systems should be appropriate to the size, business mix and complexity of the insurer’s operations and address all material risks, financial and non-financial, likely to be faced by the insurer.
-
The Board is charged with the responsibility to instil a strong risk control culture throughout the insurer, so that material risks and potential problems that emerge can be identified, managed and promptly resolved in the normal course of business operations.
-
No matter how well designed and operated, risk management and control systems will be subject to some inherent limitations. Nonetheless, risk management and control systems should provide the Board (and APRA) with a reasonable assurance that an insurer’s business is appropriately controlled and that its risks are being prudently and soundly managed.
-
At a minimum, the risk management and control systems must include:
(a) a comprehensive written Risk Management Strategy approved by the Board (or in the case of foreign insurers, approved by an appropriate senior officer from outside Australia with requisite Board delegation);
(b) sound risk management policies and procedures to identify, manage, monitor and report on the key risks of the insurer; and
(c) clearly defined managerial responsibilities and controls.
- These elements will be considered by APRA when evaluating insurers’ risk management and control systems.
Risk Management Strategy (RMS)
-
Each insurer is required to maintain at all times a written RMS, approved by the Board (or in the case of foreign insurers, a senior officer from outside Australia with requisite Board delegation).[51] The RMS should be appropriate to the size, business mix and complexity of operations of the insurer and must define and document the insurer’s objectives and strategy for risk management and internal control.
-
An insurer’s RMS must be submitted to APRA within 14 days of its being approved by the Board.
-
Each insurer must review its RMS regularly (at least annually) to ensure it provides an adequate framework to monitor the operating circumstances that may impact on the insurer’s risk profile. The RMS must be reviewed (and if necessary, amended) where there is material change to the operations of an insurer. An updated, Board approved, copy must be provided to APRA within 14 days after Board approval.
-
An insurer must substantially adhere to its RMS at all times and must advise APRA if it intends to undertake activities in a manner that represents a material deviation from its RMS. Any such activities should first be approved by the Board. Should the RMS then require amendment, a revised RMS must be approved by the Board and submitted to APRA within 14 days of Board approval.
-
The RMS must cover both the Australian and, where relevant, the overseas operations of the insurer. Further detail on the content of the RMS is contained in Guidance Note GGN 220.2 Risk Management Systems.
Processes for Risk Identification and Assessment
-
An effective risk management system identifies, manages, monitors and continually assesses the material risks that could adversely affect the operations of an insurer.
-
Whilst the risk management systems of an insurer must address all material risks, APRA considers that at a minimum the following categories must be addressed in an insurer’s risk management systems: balance sheet and market risk (including investment risk, insurance risk, product design and pricing risk, underwriting and liability risk, liquidity risk, risk arising from claims management and derivatives risk); credit risk; and operational risk (including legal and reputational risks).
-
In addition, an insurer’s risk management systems should also take into account the potential risks arising out of the insurer’s reinsurance arrangements. That is, there must be a clear link between the insurer’s Reinsurance Management Strategy (as required by GPS 230) and the insurer’s risk management systems.
Control Activities
-
Control activities are the policies and procedures that help ensure Board and senior management directives are carried out. In this way, action can be taken to adequately address risks faced by the insurer. Control activities should be reflective of the size and operations of the insurer.
-
Control activities would normally include: reviews by Board and senior management; activity controls for each division or department; physical controls; the establishment of underwriting limits and checking compliance with limits; a system of approvals and authorisations; verifications and reconciliations; and segregation of duties. Guidance Note GGN 220.2 sets out some further examples.
Information and Communication
-
Pertinent information should be identified, captured and communicated in a form and timeframe that will enable the responsibilities of the insurer to be met. An insurer’s information systems must be capable of producing financial, operational and compliance data, and of dealing with external market information about events and conditions that are relevant to decision making. Internal information systems must be secure and supported by adequate contingency arrangements.
-
Effective communication should occur throughout the insurer to ensure that all staff fully understand and adhere to policies and procedures affecting their duties and responsibilities and that other relevant information is reaching the appropriate personnel.
Processes for Monitoring Risks
-
The overall effectiveness of the insurer’s risk management and control systems must be monitored. Depending on the size and complexity of operations of an insurer, risk management systems may be monitored on an ongoing or periodic basis. At a minimum, there must be periodic internal audits with results being reported promptly to the Board or the Board Audit Committee and to senior management.
-
Where deficiencies are identified as part of the monitoring process or internal audit, these must be reported in a timely manner to the appropriate management and addressed. Material deficiencies must be reported to the Board or the Board Audit Committee and senior management. For this purpose, a material deficiency can result not only from a single deficiency, but from a number of small deficiencies that, when considered together, amount to a material deficiency.