Risk Management Systems
- Risk management and control is the process of identifying, monitoring, controlling and reporting all internal and external sources of risk that could have a material impact on an insurer’s operations. This includes both the financial and non-financial (or operational) risks associated with conducting business.
- APRA follows a systems-based approach in supervising risk management of insurers. This approach recognises primary responsibility for risk management rests with the Board and senior management of an insurer, and focuses on the quality of the processes and controls adopted by that insurer. While the Board retains the primary responsibility for risk management and control, it may, of course, also seek the advice of its Approved Auditor, Approved Actuary or other relevant expert in relation to the appropriateness, adequacy and effectiveness of its risk management and control systems.
- APRA recognises that the scope of risk management systems will vary among insurers depending on the size, business mix and complexity of their operations.
Risk Management Strategy (RMS)
- The RMS must document, in detail, the strategy adopted for managing risk. The RMS should define and document the insurer’s objectives and strategy for risk management and control and should identify the individuals responsible for approval, and ongoing oversight, of the risk management framework. The RMS should identify the insurer’s broad risk management and control systems (including at a minimum the systems in place to address balance sheet and market risk, credit risk, operation risks and risks arising out of reinsurance arrangements), in particular its policies and procedures including:
(a) processes for the identification and assessment of risks;
(b) control processes and mechanisms;
(c) management information systems and communication processes; and
(d) processes for monitoring risk.
-
The RMS must include provisions to review these systems regularly (at least annually) to take account of changes in an insurer’s business profile and other available information. In addition, where there are institutional or other developments relating to the insurer’s operations in Australia that materially affect the risk profile of the insurer, the insurer should first consult APRA. Examples of such developments include proposals relating to the establishment of subsidiaries, major modifications to, or the re-organisation of, the functions of the insurer, any changes in the operations of the insurer or the Group to which the insurer is a part, and any other activities that involve new risks, for example new business lines or new off-balance sheet exposures. Any such developments would need to be incorporated into the insurer’s RMS.
-
Foreign insurers should identify in their RMS where responsibility resides for monitoring the risk profile of their operations. Where control mechanisms for risk are in place, and these include reporting to home office or are the responsibility of home office, the RMS should also identify these mechanisms and detail the reporting arrangements.
-
If the insurer in Australia is part of a global insurance group or operates as a foreign insurer, APRA expects the RMS to include information on the global risk management policy. This may include policy objectives and strategies in respect of risk management, but would particularly include the reporting arrangements between Australian and overseas operations, the monitoring of Australian operations by the overseas parent or home office and the home regulator’s supervisory arrangements regarding risk management. Where elements of the RMS are controlled by an overseas office, these should be identified and detailed.
-
If the insurer in Australia is part of an Australian insurance group, APRA expects the RMS to include information on the group’s risk management policy. This may include policy objectives and strategies in respect of risk management, but would particularly include the reporting arrangements between the insurer’s operations and the monitoring of operations by the parent of the group. Where elements of the RMS are controlled by another company in the group, for instance the parent, these should be identified and detailed.
-
As part of its normal supervisory activities, APRA will review the appropriateness, adequacy and effectiveness of an insurer’s RMS having regard to the size, business mix and complexity of the insurer’s operations, covering both domestic and (where relevant) overseas activities.
Processes for Risk Identification and Assessment
-
An insurer must have in place processes to identify and assess the range of risks that could adversely affect the operations of the insurer.
-
Whilst the risk management systems of an insurer should address all material risks, APRA considers that, at a minimum, an insurer must have risk management systems to address:
(a) balance sheet and market risk (see Guidance Note GGN 220.3);
(b) credit quality risk (see Guidance Note GGN 220.4);
(c) operational risk (see Guidance Note GGN 220.5); and
(d) risks arising out of reinsurance arrangements (see GPS 230 Reinsurance Arrangements).
- There are a number of techniques available to insurers to enable the assessment and quantification of risks and their impact on the insurer’s operations, including, for example, stress testing and scenario analysis. Where appropriate, an insurer should consider using such techniques.
Control Activities
-
An insurer should have appropriate control mechanisms in place to ensure that the policies and procedures established for risk management are adhered to at all times.
-
Control mechanisms would normally include:
(a) clearly defined management responsibilities;
(b) adequate segregation of duties;
(c) a risk committee or audit function to establish and maintain the control processes;
(d) a system of approvals, limits, authorisations and reporting lines;
(e) policies to document the insurer’s procedural controls;
(f) activity controls for each division or department;
(g) verifications of activities such as underwriting, pricing and claims management, and reconciliations;
(h) reviews by Board, senior management and internal audit; and
(i) physical controls.
Information and Communication
-
As part of an insurer’s risk management and control systems, comprehensive management information systems should be established, maintained and utilised to assist in the management, communication and reporting of risk issues and outcomes.
-
An effective and comprehensive management information system needs to ensure that relevant, accurate and timely information is reported to appropriate persons, so to enable the insurer to identify, quantify, assess and monitor business activities, exposure to risk, financial position and performance. The information system should also allow the insurer to monitor the effectiveness of, and compliance with, its control mechanisms and report any exceptions that arise.
-
Management information systems need to be reviewed regularly to assess the current relevance of information generated and the adequacy, quality and accuracy of the system’s performance over time.
Processes for Monitoring Risk
-
An insurer’s risk management and control systems should be monitored to assess the quality of the systems’ performance. This can be accomplished through ongoing monitoring activities, separate evaluations or a combination of the two. The advantage of ongoing monitoring is that deficiencies in the systems can be detected and corrected quickly. Alternatively, separate evaluations enable the insurer to periodically assess the effectiveness of a system. Separate evaluation involves a more comprehensive analysis and allows an insurer to assess the quality of the system as a whole as opposed to a case-by-case approach to ongoing monitoring.
-
Within any quality assessment, there should be clearly defined roles for both internal and external audits. At a minimum, there must be periodic internal audits (with a clear methodology in place to determine the frequency of review for major business or activities or risk sources), with results being reported to the Board or the Board Audit Committee and to senior management.
-
Any deficiencies identified as part of the monitoring process or internal audit must be reported to those persons responsible in order that they can be addressed. Material deficiencies must be reported to the Board and senior management. A material deficiency can result not only from a single deficiency, but from a number of small deficiencies that, when considered together, amount to a material deficiency.
Board Declaration
- The Board is required to confirm that the insurer has systems in place to ensure compliance with legislative and prudential requirements, and that the Board has satisfied itself as to the adequacy of, and compliance with, the insurer’s risk management and reinsurance arrangements. Specifically, each insurer must provide APRA with a Board Declaration, at the same time it lodges its yearly statutory accounts, that, for the last financial year:
(a) the insurer has systems in place to ensure compliance with the Insurance Act 1973, Insurance Regulations 1974, Prudential Standards, authorisation conditions and directions;
(b) the Board and senior management have identified the key risks facing the insurer and have a Risk Management Strategy in place to manage and monitor those risks;
(c) the insurer has in place a Reinsurance Management Strategy for selecting and monitoring reinsurance programs;
(d) the insurer has substantially complied with its Risk Management Strategy and Reinsurance Management Strategy and that they are operating effectively in practice, having regard to the risks they are designed to control; and
(e) copies of its Risk Management Strategy and Reinsurance Management Strategy provided to APRA are accurate and current.
-
Should the Board wish to qualify the Board Declaration, the qualified Board Declaration must include a description of any material deviation from its obligations, and steps taken to remedy those breaches.
-
Key risks facing an insurer include all matters capable of influencing the risk profile of an insurer, taking into account the size, business mix and complexity of an insurer’s operations. Where appropriate, an insurer may address key risks by setting and requiring adherence to a series of prudential limits and timely reporting processes.
-
An insurer is not required to have the Board Declaration audited since the Board should have considered the advice of independent experts in making the Board Declaration.