ICP 8: Risk Management and Internal Controls Conor

Case of HIH – areas of deficiency (1) Ray Williams – dominant CEO with much discretion
no limits on CEO’s authority (investments, donations etc.)

Powerless Board
Lack of critical analysis or challenge of Williams as CEO
No major involvement in the process of determining the scope of information presented to the Board

Lack of strategy, Board of Directors did not understand business or strategy
No real discussions of the strategy by the Board
No involvement when entering or retreating from overseas 4 *case based on the report of the HIH Royal Commission (www.hihroyalcom.gov.au)<br>

Case of HIH – areas of deficiency (2) Other Senior Management without accountability
Performance review was not tied to remuneration process

Reckless underwriting and fictitious financial reporting

Very dependant on consulting actuary when setting the amount of reserve

External auditor with conflicts of interest, lack of actuarial knowledge to monitor the sufficiency of reserves 5 HIH Royal Commission (2003, xvii)<br>

Case of HIH – areas of deficiency (3) “Why was there such serious under-reserving and why were the risks not properly priced? The answer here is that HIH was mismanaged. The factors contributing to the mismanagement of the group ... are many, varied, and complex. … They are epitomized by a lack of attention to detail, a lack of accountability for performance, and a lack of integrity in the company’s internal processes and systems.” 6 HIH Royal Commission (2003, xvii)<br>

Case of HIH
Effective risk management – why it matters
ICP 8
Conclusions 7<br>

Effective Risk Management – Why it matters Many financial losses occurred due to lack of proper risk governance, risk management and internal controls.

Examples of weaknesses:
Lack of adequate management oversight and accountability,
Failure to develop a strong control culture
Inadequate recognition and assessment of risks
Absence or failure of key control structures and activities
Inadequate communication of information between different levels of management, especially the upward communication of problems
Inadequate or ineffective audit programs and monitoring activities 8<br>

Case of HIH
Effective risk management – why it matters
ICP 8
Conclusions 9<br>

ICP 8: Risk Management and Internal Controls General Observations:
The Supervisor sets requirements.
The ultimate responsibility lies with the Board and Senior Management 10 The Supervisor requires an insurer to have, as part of its overall corporate governance framework, effective systems of risk management and internal controls, including effective functions for risk management, compliance, actuarial matters and internal audit.<br>

ICP 7 on Risk management and internal controls ICP 7 requires to a corporate governance framework

Board of Directors’ responsibilities should include:
Set strategies
Define the roles of key functions.
Oversee risk management and internal controls.
Ensure reliable financial reporting
Ensure adequate governance 11<br>

Typical structure of the systems of risk management and internal controls Strategies – setting out the approach of the insurer for dealing with specific areas of risk and legal and regulatory obligations.

Policies – defining the procedures and other requirements that members of the Board and employees need to follow.

Processes – for the implementation of the insurer’s strategies and policies.

Controls – to ensure that such strategies, policies and processes are in fact in place, are being observed and are attaining their intended objectives. 12<br>

ICP 8: Controls 13<br>

Control functions - requirements Led by a person with seniority and expertise.
The key control functions directly report to the Board
Adequate resources, experience, skills and knowledge.
In case of outsourcing: to retain at least the same degree of oversight. 14<br>

Case of HIH
Effective risk management – why it matters
ICP 8
Conclusions 15<br>

Conclusions Effective risk management and internal controls are an integral part of corporate governance.

The Board is ultimately responsible for ensuring effective systems of risk management and internal controls are established and implemented.

As part of the effective risk management system, the control functions need necessary authority, independence and resources.

The supervisor plays an important role by:
establishing the requirements regarding risk management
proactively assessing whether the applicable requirements are being met. 16<br>

What is the IAIS doing? 5 Year Partnership with the International Actuarial Association (IAA) and Access to Insurance Initiative (A2ii) to support supervisory capacity building – signed in November 2017

Assessment of ICPs 4, 5, 7 and 8 planned to launch in 2018

Updating core curriculum (with inclusion of new modules for actuarial topics)

On-going support for regional trainings / seminars 17<br>

Contact information Conor Donaldson
Head of Implementation
International Association of Insurance Supervisors
Centralbahnplatz 2 c/o BIS

tel:    +41 61 280 8602
mobile: +41 76 350 8602
Skype: conordonaldson
e-mail: conor.donaldson@bis.org 18<br>