Enterprise risk management and governance
This domain tests how a general insurer identifies, measures, manages and governs risk across the business, including risk appetite, controls, board oversight and conduct.
Core concepts
- Risk appetite and tolerance: appetite is the willingness to accept risk; tolerance is the acceptable deviation from appetite. Limits and triggers make this operational.
- Three lines of defence: business units own risk; risk and compliance oversee; internal audit provides independent assurance.
- Governance: board and risk committee oversight, clear delegated authorities, ORSA, emerging-risk scanning, outsourcing and model risk management.
- Conduct and culture: Consumer Duty, conflicts of interest, whistleblowing and fair treatment are ERM issues, not just compliance.
Worked example
A risk register scores a new cyber product as likelihood 4 and impact 5, giving a score of 20. The board's appetite is a maximum score of 15. Mitigation-strict sublimits, a reinsurance layer and an incident-response requirement-reduces impact to 3, giving 12. The risk can be accepted with monitoring. Without mitigation, it breaches appetite and requires escalation or refusal.
Traps that cost marks
Confusing appetite with tolerance; treating ERM as a document rather than decisions; ignoring conduct and culture; and failing to assign an owner, trigger and escalation route.
Exam tip
Answer ERM questions with the cycle: identify → assess → control → monitor → report → escalate.