Get a plain-English read of Risk management framework
Turn the raw legal text into a practical explanation grounded in Insurance (prudential standard) determination No. 8 of 2008 - Prudential Standard GPS 220 - Risk Management.
An insurer must at all times have a risk management framework to manage the risks arising from its business.
The insurer’s risk management framework must provide a reasonable assurance that the insurer’s risks are being prudently and soundly managed, having regard to such factors as the size, business mix and complexity of the insurer's operations.
For the purposes of this Prudential Standard:
(a) the risk management framework is the totality of systems, structures, processes and people within the insurer that identify, assess, mitigate and monitor all internal and external sources of risk that could have a material impact on an insurer’s operations; and
(b) a reference to the insurer’s operations is a reference to its operations in Australia and overseas through a branch.
An insurer’s risk management framework must, at a minimum, include:
(a) a written Risk Management Strategy (RMS) that complies with this Prudential Standard, is approved by the Board[2] and in regard to which the Board is satisfied that:
(i) it describes the key elements of the risk management framework (including the risk appetite, policies, procedures, management responsibilities and controls referred to in paragraphs 9(b) and (c) and the other matters that this Prudential Standard requires to be included in an RMS);
(ii) the risk management framework described in the RMS is appropriate and provides reasonable assurance that the insurer's risks are being prudently and soundly managed having regard to such factors as the size, business mix and complexity of the insurer's operations; and
(iii) it describes the review referred to in paragraph 11;
(b) risk management policies and procedures to identify, assess, monitor, report on and mitigate all material risks, financial and non-financial, likely to be faced by the insurer having regard to such factors as the size, business mix and complexity of the insurer’s operations, and a review process to ensure that the risk management framework remains effective; and
(c) clearly defined managerial responsibilities and controls.
The material risks referred to in paragraph 9(b) above must, at a minimum, include:
(a) balance sheet and market risk;
(b) credit risk;
(c) operational risk (requirements for outsourcing and business continuity management are contained in Prudential Standard GPS 231 Outsourcing and Prudential Standard GPS 222 Business Continuity Management);
(e) risks arising out of reinsurance arrangements – there must be a clear link between the insurer’s risk management framework and the insurer’s Reinsurance Management Strategy;
(f) concentration risk – including risk type, counterparty, geographical, and industry concentration risks which may arise as a result of any of the above-listed risk categories; and
(g) strategic and tactical risks that arise out of the insurer’s Business Plan.
The insurer must ensure that its risk management framework is subject to effective and comprehensive review by operationally independent, appropriately trained and competent staff (including external consultants) and that the frequency and scope of this review is appropriate having regard to such factors as the size, business mix, complexity of the insurer's operations and the extent of any change to its business profile or its risk appetite. The review must include:
(a) a review of the risk management function (or role);
For the purposes of paragraph 11, a person is deemed not to be operationally independent if the person has played, or is playing, a significant role in the development or implementation of the risk management framework.
Risk management function
An insurer must have a risk management function (or role) within the insurer that:
(a) is appropriate to the nature, scale and diversity of its operations;
(b) is sufficiently resourced; and
(c) has the necessary authority to conduct its activities in an effective and independent manner.
An insurer that is part of an insurance group may rely on the risk management function (or role) of the insurance group instead of having its own risk management function (or role) provided that the risk management function (or role) satisfies the criteria in paragraphs 13(a) to (c) in respect of the insurer.
The risk management function (or role) is responsible for assisting the Board, any Board committee and senior management in developing and maintaining the risk management framework.
Business Plan
An insurer must at all times maintain a Business Plan (including a description of the insurer’s approach to capital management) approved by the Board:
a) prior to its adoption; and
b) at any time it is revised during its operational cycle.
Paragraph 15 does not apply to a run-off insurer provided that the run-off insurer maintains at all times a run-off plan[4] (including a description of the run-off insurer’s approach to capital management) according to this Prudential Standard.
The insurer’s Business Plan must be a three-year rolling plan and be reviewed at least annually (or as close to annually as is practicable).
An insurer must submit to APRA:
(a) a Business Plan after each annual review; and
(b) any revised Business Plan within 10 business days of Board approval.
Where the risk management framework covers an insurer’s insurance group as a whole and APRA has not made a determination under paragraph 32, the insurer may submit to APRA a Business Plan in respect of the insurance group where:
(a) the Business Plan covers that insurance group; and
(b) it is practical to produce a single over-arching Business Plan covering that insurance group.
An insurance group Business Plan must consider and deal with the matters typically covered by a Business Plan in respect of each insurer within the insurance group.
Where APRA has made a determination under paragraph 32 or where APRA is of the view that the insurance group Business Plan does not adequately address the risk management framework of each insurer, or is of the view that a different form of Business Plan is desirable to ensure that the requirements of this Prudential Standard are met, APRA may, in writing, do either or both of the following:
(a) require one or more insurers within the insurance group to prepare and submit to APRA a separate Business Plan;
(b) require the preparation and submission to APRA of a Business Plan for a different insurance group within the corporate group,
within a reasonable time specified by APRA.
Run-off plan
Subject to paragraphs 59 and 60 of Prudential Standard GPS 310 Audit and Actuarial Reporting and Valuation (GPS 310), a run-off insurer must at all times maintain a run-off plan (including a description of the insurer’s approach to capital management) unless otherwise agreed to by APRA.
The run-off plan must be approved by the Board:
(a) prior to its adoption; and
(b) at any time it is amended during its operational cycle.
The insurer’s run-off plan must be a three-year rolling plan and the insurer must review it at least annually (or as close to annually as is practicable). Under GPS 310, the Appointed Actuary of the insurer must also review the run-off plan according to the requirements of GPS 310.
The insurer must submit to APRA:
(a) a run-off plan after each annual review; and
(b) any amended run-off plan within 10 business days of Board approval.
APRA may, in writing, specify that a run-off plan be:
(a) a rolling plan of more or less than three years; and
(b) reviewed less frequently than as required in paragraph 23
if, having regard to the particular circumstances of the insurer, APRA considers it unnecessary for the purposes of the prudential supervision of the insurer.
An insurer that is both a Category C insurer and a run-off insurer must prepare a run-off plan in respect of the Australian branch operation but with consideration given to the ability of the insurer to transfer assets into Australia in order to ensure that the requirements in Prudential Standard GPS 110 Capital Adequacy are met.
A run-off plan must include the matters listed at Attachment A.
Risk Management Strategy
The RMS is a high level, strategic document intended to describe the key elements of an insurer’s risk management framework set out in paragraph 9(a)(i).
The insurer must review its RMS at least annually (or as close to annually as is practicable) to ensure that it accurately documents the insurer’s risk management framework.
Where there are material changes to the operations of an insurer, it must review and amend its risk management framework and, if appropriate, its RMS to take account of the changes. Such RMS must be approved by the Board and submitted to APRA within 10 business days of Board approval.
An insurer may submit to APRA an RMS in respect of its insurance group where the risk management framework covers that insurance group and it is practical to produce a single over-arching RMS covering that insurance group. An insurance group RMS must consider and deal with the risk management framework of each insurer within the insurance group as required by this Prudential Standard.
Where APRA is of the view that the insurance group RMS does not adequately address the risk management framework of each insurer, or is of the view that a different form of RMS is desirable to ensure that the requirements of this Prudential Standard are met, APRA may, in writing, do either or both of the following:
(a) require one or more insurers within the insurance group to prepare and submit to APRA a separate RMS;
(b) require the preparation and submission to APRA of an RMS for a different insurance group within the corporate group;
within a reasonable time specified by APRA.
An insurer must not intentionally deviate in a material way from its RMS except where this deviation has been approved by the Board and notified to APRA prior to the deviation occurring.
Where there are institutional, operational or other developments relating to the insurer’s operations that materially affect the risk profile of the insurer, the insurer must notify APRA as soon as practicable after the event has happened and amend its risk management framework and, if appropriate, the RMS to take account of the change.
An insurer’s RMS must, at a minimum:
(a) outline the risk governance relationship between the Board, Board committees and senior management;
(b) describe the processes for identifying and assessing risks;
(c) describe the process for establishing mitigation and control mechanisms for individual risks;
(d) describe the process for monitoring and reporting risk issues (including communication and escalation mechanisms);
(e) describe the approach to ensuring relevant staff have an awareness of risk issues and instilling an appropriate risk culture, including the level of accessibility of the RMS;
(f) identify those persons and their positions in the insurer (or insurance group) or groups of persons with managerial responsibility for the risk management framework, and set out their roles and responsibilities;
(g) describe the process by which the risk management framework (including the RMS) is reviewed, and outline the broad coverage for these reviews;
(h) provide an overview of the mechanisms in place for monitoring and ensuring continual compliance with the Minimum Capital Requirement (MCR);
(i) provide an overview of the processes and controls in place for ensuring compliance with all other prudential requirements;
(j) if the insurer is part of an Australian or global corporate group, or is a Category C insurer:
(i) include a summary of the group policy objectives and strategies;
(ii) state whether the local RMS is derived wholly or partially from the group risk management arrangements;
(iii) summarise the linkages and significant differences between the local RMS and group risk management arrangements including relevant local business and other conditions;
(iv) outline the process for monitoring by, or reporting to, the parent entity or head office. A summary of the key procedures, the frequency of reporting, and the approach to reviews must be provided;
(v) where any element of an insurer’s risk management framework is controlled by another entity in the group, or by head office, describe how this arrangement works; and
(vi) where an insurer:
(A) is part of a global insurance group where the head office or ultimate holding company is outside of Australia; or
(B) is a Category C insurer,
include a summary of the home regulator’s supervisory arrangements regarding risk management; and
(k) cover both the Australian operations and the risks arising from the overseas operations of the insurer that could impact on the Australian operations of the insurer.