Enterprise risk management and governance for general insurers
ERM and governance questions ask how the Board knows which risks it has taken, and what happens when the risk profile moves.
Framework
- Risk taxonomy: insurance, market, credit, liquidity, operational, conduct, group, strategic and emerging (including climate and cyber).
- Risk appetite statement with quantitative tolerances and qualitative standards, cascaded into underwriting, investment and reserving limits with named owners.
- Three lines of defence: the business owns risk, risk and compliance oversee, internal audit gives independent assurance, with the Board and risk committee above.
- ORSA: the firm's own assessment of capital needs over the business plan and of the live risk profile against appetite; refreshed after material change, not only annually.
- Regulatory expectations: model risk management, climate risk, operational resilience with impact tolerances, outsourcing, and the Senior Managers and Certification Regime.
Worked example
A catastrophe-exposed property book breaches its modelled 1-in-200 appetite after a reinsurance programme change. The response is not simply to buy more cover: document the breach, quantify the position net of reinsurance, test whether ORSA assumptions still hold, consider capital, pricing and an appetite revision, and report to the Board with a remediation plan and date. Marks come from the sequence - identify, quantify, escalate, decide, monitor.
Traps
Treating ORSA as a capital number rather than a process; listing risks without appetite, owner or tolerance; describing governance as an organisation chart rather than evidence that risk is controlled.