The Solvency II Law and Delegated Regulation 2015/35 require the insurance company to develop an effective risk management system.

3.2.1. Specific role of the board of directors in the risk management system

The board of directors of the insurance company has the final responsibility for the effectiveness of the risk management system, for establishing the risk appetite and general risk tolerance limits of the company and for approving the main strategies and policies for risk management. 

3.2.2. Role of the management committee

The management committee is responsible for the implementation of the risk management system.  In accordance with the Delegated Regulation, the management committee and the persons responsible for control functions must take into account the information reported as part of the risk management system in their decision-making process.

3.2.3. Role of the risk management function

Please refer to point 5.2. below.

3.4.1. Areas covered by risk management

Delegated Regulation 2015/35 stipulates that the risk management system must cover the following areas:

(a) Entering into underwriting obligations and forming reserves:

1. measures to be taken by the insurance company to estimate and control the risk of loss or of adverse change in the value of insurance obligations, due to inadequate pricing and provisioning assumptions;
2. the sufficiency and quality of data to be considered in the underwriting and reserving processes, as set out in Delegated Regulation 2015/35, and their consistency with the standards of sufficiency and quality;
3. the adequacy of the claims management procedures, including the extent to which they cover the overall cycle of claims.

(b) Asset-liability management:

1. the structural mismatch between assets and liabilities and in particular the duration mismatch of those assets and liabilities;
2. any dependency between risks of different assets and liability classes;
3. any dependency between risks of different insurance obligations;
4. any off-balance-sheet exposures of the undertaking;
5. the effect of relevant risk-mitigation techniques on asset-liability management;

(c) Investment risk management:

1. action to be taken by the insurance company to ensure that the investments comply with the ‘prudent person’ principle;
2. actions to be taken by the insurance company to ensure that its investment takes into account the nature of the company’s business, its approved risk tolerance limits, its solvency position and its long-term risk exposure;
3. the insurance company’s own internal assessment of the credit risk of investment counterparties, including where the counterparties are central governments;
4. where the insurance company uses derivatives or any other financial instrument with similar characteristics or effects, the objectives of — and the strategy underlying — their use and the way in which they facilitate efficient portfolio management or contribute to a reduction of risks, as well as procedures to assess the risk of such instruments and the principles of risk management to be applied to them;
5. where appropriate in order to ensure effective risk management, internal quantitative limits on assets and exposures, including off-balance-sheet exposures.

(d) Liquidity risk management

1. action to be taken by the insurance company to take into account both short- and long-term liquidity risk;
2. the appropriateness of the composition of the assets in terms of their nature, maturity and liquidity in order to meet the company’s obligations as they fall due;
3. a plan to deal with changes in expected cash inflows and outflows;

(e) Concentration risk management:

action to be taken by the insurance company to identify relevant sources of concentration risk to ensure that the risk concentrations remain within established limits and actions to analyse possible risk contagion between concentrated exposures;

(f)  Operational risk management:

action to be taken by the insurance company to assign clear responsibilities to regularly identify, document and monitor relevant operational risk exposures;

(g) Reinsurance and other insurance risk-mitigation techniques:

1. actions to be taken by the insurance company to ensure the selection of suitable reinsurance and other risk-mitigation techniques;
2. action to be taken by the insurance company to assess which types of risk-mitigation techniques are appropriate according to the nature of the risks assumed and the company’s capability to manage and control the risks associated with those techniques;
3. the insurance company’s own assessment of the credit risk inherent to the risk-mitigation techniques.

Delegated Regulation 2015/35 also stipulates the following:

1. the expected profit included in future premiums shall be calculated as the difference between the technical provisions, with a risk margin calculated in accordance with the Solvency II Law, and a calculation of the technical provisions, without a risk margin under the assumption that the premiums relating to existing insurance and reinsurance contracts that are expected to be received in the future are not received for any reason other than the insured event having occurred, regardless of the legal or contractual rights of the policy-holder to discontinue the policy.
2. the calculation of the expected profit included in future premiums shall be carried out separately for the homogenous risk groups used in the calculation of technical provisions, provided that the insurance and reinsurance obligations are also homogenous in relation to the expected profit included in the future premiums.
3. Loss-making policies may only be offset against profit-making policies in a homogenous risk group.

3.4.2. Risk management in companies providing loans and/or mortgage insurance

1. Insurance and reinsurance companies that provide loans shall have written policies to ensure all of the following points:
   
   1. lending is based on sound and clearly defined criteria and the process for approving, amending, renewing and refinancing loans is clearly established;
   2. companies have internal methods that enable them to assess the credit risk of exposures to individual borrowers and at portfolio level;
   3. that the ongoing administration and monitoring of loan portfolios, including for identifying and managing non-performing loans and for making adequate value adjustments, is operated through effective systems;
   4. the diversification of loan portfolios is adequate given the company’s target markets and overall investment strategy.
2. Insurance companies that engage in mortgage insurance or reinsurance shall base their underwriting on sound and clearly defined criteria and comply with the requirements set out in point 1 a), b) and c).

3.6.1. Policy relating to the management of the underwriting risk and reserve risk

In its risk management policy, the insurance company shall at least include the following as regards the underwriting risk and the reserve risk:

1. the different types of insurance activities that the company exercises and the characteristics thereof, such as the type of insurance risk that the company is prepared to take on;
2. how the adequacy of premium income to cover the expected claims and costs is guaranteed;
3. identification of the risks arising from the company’s insurance obligations, including the options included and guaranteed surrender value included in its products;
4. how the company takes account of investment limitations in the process of developing a new insurance product and calculating premiums.
5. how the company takes account of the reinsurance or other risk-mitigation techniques in the process of developing a new insurance product and calculating premiums.

3.6.2. Policy relating to the management of the operational risk

In its risk management policy, the insurance company shall at least include the following as regards operational risk:

1. identification of the operational risks to which the company is or could be exposed and the assessment of how those risks can be mitigated;
2. activities and internal processes for the management of operational risk, including the IT system to support those activities and internal processes;
3. risk tolerance limits for the company’s main operational risk areas.

The company shall have processes for identifying, analysing and reporting operational risks. To this end, the company shall operate a process for registering and monitoring incidents with an operational risk component.

The company shall develop and analyse a suitable number of stress scenarios for managing operational risks. These stress scenarios shall at least be based on the following approaches:

1. failure of a key process or departure of key staff or failure of a key system;
2. occurrence of unforeseen external events.

3.6.3. Reinsurance and other risk-mitigation techniques - risk management policy

In its risk management policy, the insurance company shall at least include the following as regards reinsurance and other risk-mitigation techniques:

1. identification of the level of risk transfer that is appropriate given the risk limits established for the company and the types of reinsurance policies that are the most suitable given the risk profile of the company;
2. principles for the selection of counterparties concerned by such risk-mitigation techniques and procedures for assessing and monitoring the financial solidity and diversification of the reinsurance counterparties;
3. the procedures for assessing an effective risk transfer and the manner in which account is taken of the basis risk;
4. liquidity management to remedy every timing mismatch between the payment of claims and compensation under reinsurance.

3.6.4. Strategic risk and reputational risk

The company shall manage, supervise and report on the following situations:

1. actual or potential exposure to reputational and strategic risks and the mutual relationship between these risks and other material risks;
2. important issues that influence its reputation in view of the expectations of interested parties and market sensitivity.

3.6.5. Policy relating to asset-liability management

In its risk management policy, the insurance company shall at least include the following as regards asset-liability management:

1. a description of the procedure for establishing and assessing the various forms of mismatch between assets and liabilities, especially as regards conditions and currencies;
2. a description of the risk-mitigation techniques used and the expected effect of relevant risk-mitigating techniques on asset-liability management;
3. a description of the mismatches permitted by the company;
4. a description of the method that forms the basis of the stress and scenario tests and the frequency with which these tests must be carried out.

3.6.6. Policy relating to investment risk management

In its risk management policy, the insurance company shall at least include the following as regards investment risks:

1. the level of security, quality, liquidity, return and availability the company is aiming for, for the asset portfolio as a whole, and the way in which the company intends to achieve this;
2. its quantitative limits with respect to assets and exposures, including exposures not included in the balance sheet, which must be established to help the company be sure of reaching the desired level of security, quality, liquidity, return and availability for the portfolio;
3. the level of availability that the company is aiming for, for the asset portfolio as a whole, and how the company intends to achieve this;
4. accounting for the situation on the financial markets;
5. the terms under which the company can provide assets as security and lend out assets;
6. the relationship between the market risk and other risks in unfavourable scenarios;
7. procedure for adequate marking to market and verification of investment assets;
8. procedures for monitoring returns on investment and, insofar as necessary, reviews of this policy;
9. how it is ensured that the assets are selected in the interest of policy-holders and beneficiaries.

3.6.7. Policy relating to the management of the liquidity risk

In its risk management policy, the insurance company shall at least include the following as regards liquidity risks:

1. the procedure for establishing the level of mismatch between incoming and outgoing cash flows as regards both assets and liabilities, including the expected cash flows by virtue of direct insurance and reinsurance policies, such as claims, early exit or surrender;
2. how total liquidity needs are taken into account for the short- and medium term, including an appropriate liquidity buffer to cover liquidity shortages;
3. how the level of monitoring of liquid assets is taken into account, including quantification of the potential costs and financial losses arising from forced sales;
4. the establishment of alternative financing instruments and the costs thereof;
5. how the effect on the liquidity position of expected new activity is taken into account.