IFoA SP9 cheat sheet

COSO ERM (2017) has five components: Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; Information, Communication and Reporting, supported by 20 principles.

ISO 31000:2018 consists of principles, a framework (leadership, commitment, integration, design, implementation, evaluation, improvement) and a process: scope and context, identification, analysis, evaluation, treatment, with communication/consultation and monitoring/review throughout.

Three lines model (IIA 2020): the first line is operational management that owns and manages risk; the second line is risk, compliance and actuarial functions providing independent expertise and challenge; the third line is internal audit providing independent assurance to the governing body.

Board or board risk committee responsibilities include approving risk appetite and the ERM framework, overseeing top and emerging risks, approving the ORSA, and ensuring risk culture and remuneration are consistent with risk-taking.

Governance principles: clear accountabilities, segregation of risk-taking from risk-control, documented policies and delegated authorities, and an independent risk function with direct access to the board.

Group governance must address legal entity versus group oversight, intra-group transactions, double leverage and contagion; the parent board remains accountable for group-wide ERM.

Decision rule: risk function independence is compromised if the CRO reports only to a risk-taking executive with no board or committee access; escalate through the board risk committee.

The ORSA is the firm's own forward-looking assessment of risk and solvency, approved by the board, and must link strategy, risk profile and capital rather than replicate a regulatory formula.

ISO defines risk as the effect of uncertainty on objectives, commonly expressed as the combination of the probability of an event and its consequence; describe each risk as cause, event and consequence to separate drivers from impacts.

Common risk categories: market, credit, liquidity, underwriting, reserving, catastrophe, operational, conduct, strategic, reputational, regulatory/compliance, emerging and group/contagion.

Identification techniques include workshops, interviews, Delphi, SWOT, PESTLE, process and value-chain mapping, bow-tie analysis, scenario analysis, incident and near-miss data, audit findings and horizon scanning.

A risk register typically records: unique ID, cause-event-consequence description, category, accountable owner, gross and residual ratings, controls and their effectiveness, KRIs, appetite linkage and review date.

Inherent risk is the exposure before controls; residual risk is what remains after controls operate; the difference is evidence of control effectiveness and must be reassessed after control changes or incidents.

Likelihood and impact scales must have explicit criteria so risks can be compared, aggregated and reported consistently across business units.

Each risk should have a single accountable owner; the risk owner is not necessarily the person operating the relevant control.

Record interdependencies, concentrations and correlations in the register, because aggregation and dependence assumptions drive portfolio risk and capital.

Value at Risk: P(L > VaR_alpha) = 1 - alpha over a stated horizon; VaR gives no information on the size of losses beyond the threshold and is not subadditive in general.

Tail Value at Risk (expected shortfall): TVaR_alpha = E[L | L > VaR_alpha]; it captures tail severity and is coherent, satisfying monotonicity, subadditivity, positive homogeneity and translation invariance.

Aggregate loss models combine a frequency distribution N, often Poisson, with a severity distribution X, such as lognormal, gamma or Pareto, using Panjer recursion for the (a,b,0) class or Monte Carlo simulation.

Economic capital equals the loss quantile at the chosen confidence and horizon minus expected loss; allocate it to sub-risks using marginal or Euler contributions.

Copulas separate marginal distributions from dependence structure; the Gaussian copula has no tail dependence, whereas t and Archimedean copulas can capture tail dependence.

Stress and scenario testing, including reverse stress testing, complement probabilistic models where data are sparse or dependence breaks down in extreme conditions.

Model risk controls include independent validation, backtesting, sensitivity analysis, documentation, expert-judgement overlays and change control.

Extreme value theory uses peaks-over-threshold with the generalised Pareto distribution, or block maxima with the generalised extreme value distribution, to extrapolate beyond observed data.

Decision rule: never rely on a single risk measure; report VaR, TVaR, stress results and model limitations together.

Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of its strategy; risk capacity is the maximum risk it can bear before constraints bind; appetite must sit below capacity.

Cascade the framework from board appetite statement to risk tolerances, then business or portfolio limits, then desk or individual limits, each with an owner and escalation route.

Limit types: hard limits that must not be breached, soft limits that trigger escalation, and thresholds or tolerances with defined breach, escalation and remediation processes.

Risk-reward metrics include risk-adjusted return on capital, economic value added, risk-adjusted hurdle rates and capital allocation; compare marginal return against marginal risk.

Calibrate appetite using anchors such as regulatory solvency ratio, earnings volatility, liquidity, target credit rating and stakeholder expectations.

Appetite and limits must be forward-looking and stress-tested; limits calibrated only to current benign conditions fail when conditions change.

Zero appetite is realistic only for selected risks such as deliberate regulatory breaches; most risks carry a finite appetite.

Decision rule: a transaction outside approved appetite requires explicit board or committee approval and documented rationale, not a silent exception.

Risk culture is the shared values, attitudes and behaviours that determine how risks are identified, discussed and managed; components include tone at the top, accountability, incentives, challenge, speak-up and learning.

Conduct risk is the risk that business behaviour or the delivery of products and services causes unfair customer outcomes or harms market integrity; it is often a symptom of culture and incentive failure.

Incentive design levers include deferral, malus, clawback and balanced scorecards; short-term bonuses tied only to revenue encourage excessive risk-taking.

Behavioural biases relevant to risk decisions: overconfidence, anchoring, confirmation bias, availability, groupthink, herding, loss aversion, hindsight and recency.

Culture indicators include staff surveys, whistleblowing volumes, near-miss reporting, grievances, attrition, complaints, breaches and audit findings.

The board and senior management own culture; the risk function can measure and challenge it but cannot create it alone.

Psychological safety supports speak-up; fear of blame suppresses risk reporting and allows small issues to become large losses.

Decision rule: when conduct or complaint indicators deteriorate, review incentives and product design before attributing the problem solely to individuals.

Reporting principles: accurate, timely, clear, relevant, comparable and audience-appropriate; materiality is judged by whether information could influence the user's decisions.

A board risk dashboard typically covers top risks, appetite and limit status, KRIs, capital and solvency, emerging risks, incidents and remediation actions.

KRIs should be predictive, objective, linked to a specific risk, owned, and set with green, amber and red thresholds plus defined response plans.

Escalation frameworks define triggers, recipients and timescales; limit breaches are reported to the board risk committee and, where required, to the regulator.

Stakeholders include the board, regulators, policyholders, investors, rating agencies, employees, auditors and the public; each requires different content, frequency and format.

Narrative reporting explains drivers, uncertainty and model limitations; numbers without context can mislead.

Regulatory reporting includes the ORSA summary report, solvency and financial condition report, financial statements and stress-test submissions.

Forward-looking reporting should cover emerging risks, scenario results and reverse stress-test outcomes, not only historical performance.

Decision rule: if a report cannot change or support a decision, it is not material and should be removed or redesigned.

Economic capital covers unexpected loss at a target confidence and horizon; regulatory capital is prescribed by the supervisor; the two can differ materially in level and composition.

Solvency II calibrates the SCR to a one-year value at risk of basic own funds at 99.5% confidence; the MCR is a lower floor; Pillar 1 is quantitative, Pillar 2 covers governance and ORSA, Pillar 3 covers disclosure.

Own funds are tiered by loss absorbency, with unrestricted Tier 1 capital of the highest quality; eligible own funds must satisfy SCR and MCR tiering limits.

Solvency ratio = eligible own funds / SCR; monitor both the ratio and absolute surplus, plus sensitivity to market, credit and insurance shocks.

Capital allocation methods include standalone, incremental or marginal, Euler and Shapley; Euler allocation sums exactly to total diversified capital and reflects marginal contribution.

Diversification benefit = sum of standalone capitals minus total capital; it depends on dependence assumptions and can shrink sharply in stress.

Fungibility is limited by legal entity ring-fencing, regulatory restrictions, collateral arrangements and exchange controls, so group capital may not be available where needed.

Reinsurance and hedging reduce required capital but introduce counterparty credit, basis and liquidity risks; compare net cost against capital relief.

Decision rule: hold capital against the risk actually retained after reinsurance and hedging, not against gross exposure.

Emerging risks are new or evolving, highly uncertain, data-sparse and potentially high impact; they frequently interact with existing risks and can escalate quickly.

Identification tools include horizon scanning, PESTLE, scenario planning, Delphi, wild-card workshops, expert networks and regulatory or academic signals.

Strategic risk arises from strategy choices: competition, disruption, mergers and acquisitions, pricing, distribution, technology, reputation and political or regulatory change.

Climate risk comprises physical risk (acute and chronic), transition risk (policy, technology, market, reputation) and liability risk; assess over short, medium and long horizons using scenarios.

Cyber and AI risks include evolving threats, data and privacy breaches, model risk, concentration in third-party providers and rapid technology obsolescence.

Governance for emerging risk: assign owners despite uncertainty, track early-warning indicators, review at board level and integrate into the ORSA and strategy.

Reverse stress testing and scenario analysis are more useful than precise probability estimates for many emerging risks.

Decision rule: address unknown unknowns through resilience, optionality, diversification and capital buffers rather than false precision in point estimates.

Emerging risks can create strategic opportunity; ERM should inform upside decisions as well as downside protection.

Embedding means ERM changes decisions: strategy, business plans, pricing, product design, investment, mergers and acquisitions, capital allocation and remuneration.

Risk-adjusted decision metrics include RAROC, risk-adjusted hurdle rates, risk-adjusted pricing, expected loss and capital charges.

Risk appetite should gate decisions through stage-gates, investment committees and delegated authorities that reference appetite and limits.

The ORSA links risk profile, strategy and capital; use it to test business plans and major decisions against capital and appetite constraints.

Post-implementation reviews compare actual risk outcomes with expectations and feed lessons back into frameworks, models and limits.

Incentives must reward risk-adjusted performance over appropriate horizons; deferral and clawback support embedding.

Maturity models assess embedding from compliance-driven to risk-informed decision-making; indicators include use of risk information in board packs and decision papers.

Decision rule: if a major decision proceeds without documented risk assessment and appetite sign-off, the ERM framework is not embedded.

COSO ERM (2017) has five components: Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; Information, Communication and Reporting, supported by 20 principles.

ISO 31000:2018 consists of principles, a framework (leadership, commitment, integration, design, implementation, evaluation, improvement) and a process: scope and context, identification, analysis, evaluation, treatment, with communication/consultation and monitoring/review throughout.

Three lines model (IIA 2020): the first line is operational management that owns and manages risk; the second line is risk, compliance and actuarial functions providing independent expertise and challenge; the third line is internal audit providing independent assurance to the governing body.

Board or board risk committee responsibilities include approving risk appetite and the ERM framework, overseeing top and emerging risks, approving the ORSA, and ensuring risk culture and remuneration are consistent with risk-taking.

Governance principles: clear accountabilities, segregation of risk-taking from risk-control, documented policies and delegated authorities, and an independent risk function with direct access to the board.

Group governance must address legal entity versus group oversight, intra-group transactions, double leverage and contagion; the parent board remains accountable for group-wide ERM.

Decision rule: risk function independence is compromised if the CRO reports only to a risk-taking executive with no board or committee access; escalate through the board risk committee.

The ORSA is the firm's own forward-looking assessment of risk and solvency, approved by the board, and must link strategy, risk profile and capital rather than replicate a regulatory formula.

ISO defines risk as the effect of uncertainty on objectives, commonly expressed as the combination of the probability of an event and its consequence; describe each risk as cause, event and consequence to separate drivers from impacts.

Common risk categories: market, credit, liquidity, underwriting, reserving, catastrophe, operational, conduct, strategic, reputational, regulatory/compliance, emerging and group/contagion.

Identification techniques include workshops, interviews, Delphi, SWOT, PESTLE, process and value-chain mapping, bow-tie analysis, scenario analysis, incident and near-miss data, audit findings and horizon scanning.

A risk register typically records: unique ID, cause-event-consequence description, category, accountable owner, gross and residual ratings, controls and their effectiveness, KRIs, appetite linkage and review date.

Inherent risk is the exposure before controls; residual risk is what remains after controls operate; the difference is evidence of control effectiveness and must be reassessed after control changes or incidents.

Likelihood and impact scales must have explicit criteria so risks can be compared, aggregated and reported consistently across business units.

Each risk should have a single accountable owner; the risk owner is not necessarily the person operating the relevant control.

Record interdependencies, concentrations and correlations in the register, because aggregation and dependence assumptions drive portfolio risk and capital.

Value at Risk: P(L > VaR_alpha) = 1 - alpha over a stated horizon; VaR gives no information on the size of losses beyond the threshold and is not subadditive in general.

Tail Value at Risk (expected shortfall): TVaR_alpha = E[L | L > VaR_alpha]; it captures tail severity and is coherent, satisfying monotonicity, subadditivity, positive homogeneity and translation invariance.

Aggregate loss models combine a frequency distribution N, often Poisson, with a severity distribution X, such as lognormal, gamma or Pareto, using Panjer recursion for the (a,b,0) class or Monte Carlo simulation.

Economic capital equals the loss quantile at the chosen confidence and horizon minus expected loss; allocate it to sub-risks using marginal or Euler contributions.

Copulas separate marginal distributions from dependence structure; the Gaussian copula has no tail dependence, whereas t and Archimedean copulas can capture tail dependence.

Stress and scenario testing, including reverse stress testing, complement probabilistic models where data are sparse or dependence breaks down in extreme conditions.

Model risk controls include independent validation, backtesting, sensitivity analysis, documentation, expert-judgement overlays and change control.

Extreme value theory uses peaks-over-threshold with the generalised Pareto distribution, or block maxima with the generalised extreme value distribution, to extrapolate beyond observed data.

Decision rule: never rely on a single risk measure; report VaR, TVaR, stress results and model limitations together.

Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of its strategy; risk capacity is the maximum risk it can bear before constraints bind; appetite must sit below capacity.

Cascade the framework from board appetite statement to risk tolerances, then business or portfolio limits, then desk or individual limits, each with an owner and escalation route.

Limit types: hard limits that must not be breached, soft limits that trigger escalation, and thresholds or tolerances with defined breach, escalation and remediation processes.

Risk-reward metrics include risk-adjusted return on capital, economic value added, risk-adjusted hurdle rates and capital allocation; compare marginal return against marginal risk.

Calibrate appetite using anchors such as regulatory solvency ratio, earnings volatility, liquidity, target credit rating and stakeholder expectations.

Appetite and limits must be forward-looking and stress-tested; limits calibrated only to current benign conditions fail when conditions change.

Zero appetite is realistic only for selected risks such as deliberate regulatory breaches; most risks carry a finite appetite.

Decision rule: a transaction outside approved appetite requires explicit board or committee approval and documented rationale, not a silent exception.

Risk culture is the shared values, attitudes and behaviours that determine how risks are identified, discussed and managed; components include tone at the top, accountability, incentives, challenge, speak-up and learning.

Conduct risk is the risk that business behaviour or the delivery of products and services causes unfair customer outcomes or harms market integrity; it is often a symptom of culture and incentive failure.

Incentive design levers include deferral, malus, clawback and balanced scorecards; short-term bonuses tied only to revenue encourage excessive risk-taking.

Behavioural biases relevant to risk decisions: overconfidence, anchoring, confirmation bias, availability, groupthink, herding, loss aversion, hindsight and recency.

Culture indicators include staff surveys, whistleblowing volumes, near-miss reporting, grievances, attrition, complaints, breaches and audit findings.

The board and senior management own culture; the risk function can measure and challenge it but cannot create it alone.

Psychological safety supports speak-up; fear of blame suppresses risk reporting and allows small issues to become large losses.

Decision rule: when conduct or complaint indicators deteriorate, review incentives and product design before attributing the problem solely to individuals.

Reporting principles: accurate, timely, clear, relevant, comparable and audience-appropriate; materiality is judged by whether information could influence the user's decisions.

A board risk dashboard typically covers top risks, appetite and limit status, KRIs, capital and solvency, emerging risks, incidents and remediation actions.

KRIs should be predictive, objective, linked to a specific risk, owned, and set with green, amber and red thresholds plus defined response plans.

Escalation frameworks define triggers, recipients and timescales; limit breaches are reported to the board risk committee and, where required, to the regulator.

Stakeholders include the board, regulators, policyholders, investors, rating agencies, employees, auditors and the public; each requires different content, frequency and format.

Narrative reporting explains drivers, uncertainty and model limitations; numbers without context can mislead.

Regulatory reporting includes the ORSA summary report, solvency and financial condition report, financial statements and stress-test submissions.

Forward-looking reporting should cover emerging risks, scenario results and reverse stress-test outcomes, not only historical performance.

Decision rule: if a report cannot change or support a decision, it is not material and should be removed or redesigned.

Economic capital covers unexpected loss at a target confidence and horizon; regulatory capital is prescribed by the supervisor; the two can differ materially in level and composition.

Solvency II calibrates the SCR to a one-year value at risk of basic own funds at 99.5% confidence; the MCR is a lower floor; Pillar 1 is quantitative, Pillar 2 covers governance and ORSA, Pillar 3 covers disclosure.

Own funds are tiered by loss absorbency, with unrestricted Tier 1 capital of the highest quality; eligible own funds must satisfy SCR and MCR tiering limits.

Solvency ratio = eligible own funds / SCR; monitor both the ratio and absolute surplus, plus sensitivity to market, credit and insurance shocks.

Capital allocation methods include standalone, incremental or marginal, Euler and Shapley; Euler allocation sums exactly to total diversified capital and reflects marginal contribution.

Diversification benefit = sum of standalone capitals minus total capital; it depends on dependence assumptions and can shrink sharply in stress.

Fungibility is limited by legal entity ring-fencing, regulatory restrictions, collateral arrangements and exchange controls, so group capital may not be available where needed.

Reinsurance and hedging reduce required capital but introduce counterparty credit, basis and liquidity risks; compare net cost against capital relief.

Decision rule: hold capital against the risk actually retained after reinsurance and hedging, not against gross exposure.

Emerging risks are new or evolving, highly uncertain, data-sparse and potentially high impact; they frequently interact with existing risks and can escalate quickly.

Identification tools include horizon scanning, PESTLE, scenario planning, Delphi, wild-card workshops, expert networks and regulatory or academic signals.

Strategic risk arises from strategy choices: competition, disruption, mergers and acquisitions, pricing, distribution, technology, reputation and political or regulatory change.

Climate risk comprises physical risk (acute and chronic), transition risk (policy, technology, market, reputation) and liability risk; assess over short, medium and long horizons using scenarios.

Cyber and AI risks include evolving threats, data and privacy breaches, model risk, concentration in third-party providers and rapid technology obsolescence.

Governance for emerging risk: assign owners despite uncertainty, track early-warning indicators, review at board level and integrate into the ORSA and strategy.

Reverse stress testing and scenario analysis are more useful than precise probability estimates for many emerging risks.

Decision rule: address unknown unknowns through resilience, optionality, diversification and capital buffers rather than false precision in point estimates.

Emerging risks can create strategic opportunity; ERM should inform upside decisions as well as downside protection.

Embedding means ERM changes decisions: strategy, business plans, pricing, product design, investment, mergers and acquisitions, capital allocation and remuneration.

Risk-adjusted decision metrics include RAROC, risk-adjusted hurdle rates, risk-adjusted pricing, expected loss and capital charges.

Risk appetite should gate decisions through stage-gates, investment committees and delegated authorities that reference appetite and limits.

The ORSA links risk profile, strategy and capital; use it to test business plans and major decisions against capital and appetite constraints.

Post-implementation reviews compare actual risk outcomes with expectations and feed lessons back into frameworks, models and limits.

Incentives must reward risk-adjusted performance over appropriate horizons; deferral and clawback support embedding.

Maturity models assess embedding from compliance-driven to risk-informed decision-making; indicators include use of risk information in board packs and decision papers.

Decision rule: if a major decision proceeds without documented risk assessment and appetite sign-off, the ERM framework is not embedded.

COSO ERM (2017) has five components: Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; Information, Communication and Reporting, supported by 20 principles.

ISO 31000:2018 consists of principles, a framework (leadership, commitment, integration, design, implementation, evaluation, improvement) and a process: scope and context, identification, analysis, evaluation, treatment, with communication/consultation and monitoring/review throughout.

Three lines model (IIA 2020): the first line is operational management that owns and manages risk; the second line is risk, compliance and actuarial functions providing independent expertise and challenge; the third line is internal audit providing independent assurance to the governing body.

Board or board risk committee responsibilities include approving risk appetite and the ERM framework, overseeing top and emerging risks, approving the ORSA, and ensuring risk culture and remuneration are consistent with risk-taking.

Governance principles: clear accountabilities, segregation of risk-taking from risk-control, documented policies and delegated authorities, and an independent risk function with direct access to the board.

Group governance must address legal entity versus group oversight, intra-group transactions, double leverage and contagion; the parent board remains accountable for group-wide ERM.

Decision rule: risk function independence is compromised if the CRO reports only to a risk-taking executive with no board or committee access; escalate through the board risk committee.

The ORSA is the firm's own forward-looking assessment of risk and solvency, approved by the board, and must link strategy, risk profile and capital rather than replicate a regulatory formula.

ISO defines risk as the effect of uncertainty on objectives, commonly expressed as the combination of the probability of an event and its consequence; describe each risk as cause, event and consequence to separate drivers from impacts.

Common risk categories: market, credit, liquidity, underwriting, reserving, catastrophe, operational, conduct, strategic, reputational, regulatory/compliance, emerging and group/contagion.

Identification techniques include workshops, interviews, Delphi, SWOT, PESTLE, process and value-chain mapping, bow-tie analysis, scenario analysis, incident and near-miss data, audit findings and horizon scanning.

A risk register typically records: unique ID, cause-event-consequence description, category, accountable owner, gross and residual ratings, controls and their effectiveness, KRIs, appetite linkage and review date.

Inherent risk is the exposure before controls; residual risk is what remains after controls operate; the difference is evidence of control effectiveness and must be reassessed after control changes or incidents.

Likelihood and impact scales must have explicit criteria so risks can be compared, aggregated and reported consistently across business units.

Each risk should have a single accountable owner; the risk owner is not necessarily the person operating the relevant control.

Record interdependencies, concentrations and correlations in the register, because aggregation and dependence assumptions drive portfolio risk and capital.

Value at Risk: P(L > VaR_alpha) = 1 - alpha over a stated horizon; VaR gives no information on the size of losses beyond the threshold and is not subadditive in general.

Tail Value at Risk (expected shortfall): TVaR_alpha = E[L | L > VaR_alpha]; it captures tail severity and is coherent, satisfying monotonicity, subadditivity, positive homogeneity and translation invariance.

Aggregate loss models combine a frequency distribution N, often Poisson, with a severity distribution X, such as lognormal, gamma or Pareto, using Panjer recursion for the (a,b,0) class or Monte Carlo simulation.

Economic capital equals the loss quantile at the chosen confidence and horizon minus expected loss; allocate it to sub-risks using marginal or Euler contributions.

Copulas separate marginal distributions from dependence structure; the Gaussian copula has no tail dependence, whereas t and Archimedean copulas can capture tail dependence.

Stress and scenario testing, including reverse stress testing, complement probabilistic models where data are sparse or dependence breaks down in extreme conditions.

Model risk controls include independent validation, backtesting, sensitivity analysis, documentation, expert-judgement overlays and change control.

Extreme value theory uses peaks-over-threshold with the generalised Pareto distribution, or block maxima with the generalised extreme value distribution, to extrapolate beyond observed data.

Decision rule: never rely on a single risk measure; report VaR, TVaR, stress results and model limitations together.

Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of its strategy; risk capacity is the maximum risk it can bear before constraints bind; appetite must sit below capacity.

Cascade the framework from board appetite statement to risk tolerances, then business or portfolio limits, then desk or individual limits, each with an owner and escalation route.

Limit types: hard limits that must not be breached, soft limits that trigger escalation, and thresholds or tolerances with defined breach, escalation and remediation processes.

Risk-reward metrics include risk-adjusted return on capital, economic value added, risk-adjusted hurdle rates and capital allocation; compare marginal return against marginal risk.

Calibrate appetite using anchors such as regulatory solvency ratio, earnings volatility, liquidity, target credit rating and stakeholder expectations.

Appetite and limits must be forward-looking and stress-tested; limits calibrated only to current benign conditions fail when conditions change.

Zero appetite is realistic only for selected risks such as deliberate regulatory breaches; most risks carry a finite appetite.

Decision rule: a transaction outside approved appetite requires explicit board or committee approval and documented rationale, not a silent exception.

Risk culture is the shared values, attitudes and behaviours that determine how risks are identified, discussed and managed; components include tone at the top, accountability, incentives, challenge, speak-up and learning.

Conduct risk is the risk that business behaviour or the delivery of products and services causes unfair customer outcomes or harms market integrity; it is often a symptom of culture and incentive failure.

Incentive design levers include deferral, malus, clawback and balanced scorecards; short-term bonuses tied only to revenue encourage excessive risk-taking.

Behavioural biases relevant to risk decisions: overconfidence, anchoring, confirmation bias, availability, groupthink, herding, loss aversion, hindsight and recency.

Culture indicators include staff surveys, whistleblowing volumes, near-miss reporting, grievances, attrition, complaints, breaches and audit findings.

The board and senior management own culture; the risk function can measure and challenge it but cannot create it alone.

Psychological safety supports speak-up; fear of blame suppresses risk reporting and allows small issues to become large losses.

Decision rule: when conduct or complaint indicators deteriorate, review incentives and product design before attributing the problem solely to individuals.

Reporting principles: accurate, timely, clear, relevant, comparable and audience-appropriate; materiality is judged by whether information could influence the user's decisions.

A board risk dashboard typically covers top risks, appetite and limit status, KRIs, capital and solvency, emerging risks, incidents and remediation actions.

KRIs should be predictive, objective, linked to a specific risk, owned, and set with green, amber and red thresholds plus defined response plans.

Escalation frameworks define triggers, recipients and timescales; limit breaches are reported to the board risk committee and, where required, to the regulator.

Stakeholders include the board, regulators, policyholders, investors, rating agencies, employees, auditors and the public; each requires different content, frequency and format.

Narrative reporting explains drivers, uncertainty and model limitations; numbers without context can mislead.

Regulatory reporting includes the ORSA summary report, solvency and financial condition report, financial statements and stress-test submissions.

Forward-looking reporting should cover emerging risks, scenario results and reverse stress-test outcomes, not only historical performance.

Decision rule: if a report cannot change or support a decision, it is not material and should be removed or redesigned.

Economic capital covers unexpected loss at a target confidence and horizon; regulatory capital is prescribed by the supervisor; the two can differ materially in level and composition.

Solvency II calibrates the SCR to a one-year value at risk of basic own funds at 99.5% confidence; the MCR is a lower floor; Pillar 1 is quantitative, Pillar 2 covers governance and ORSA, Pillar 3 covers disclosure.

Own funds are tiered by loss absorbency, with unrestricted Tier 1 capital of the highest quality; eligible own funds must satisfy SCR and MCR tiering limits.

Solvency ratio = eligible own funds / SCR; monitor both the ratio and absolute surplus, plus sensitivity to market, credit and insurance shocks.

Capital allocation methods include standalone, incremental or marginal, Euler and Shapley; Euler allocation sums exactly to total diversified capital and reflects marginal contribution.

Diversification benefit = sum of standalone capitals minus total capital; it depends on dependence assumptions and can shrink sharply in stress.

Fungibility is limited by legal entity ring-fencing, regulatory restrictions, collateral arrangements and exchange controls, so group capital may not be available where needed.

Reinsurance and hedging reduce required capital but introduce counterparty credit, basis and liquidity risks; compare net cost against capital relief.

Decision rule: hold capital against the risk actually retained after reinsurance and hedging, not against gross exposure.

Emerging risks are new or evolving, highly uncertain, data-sparse and potentially high impact; they frequently interact with existing risks and can escalate quickly.

Identification tools include horizon scanning, PESTLE, scenario planning, Delphi, wild-card workshops, expert networks and regulatory or academic signals.

Strategic risk arises from strategy choices: competition, disruption, mergers and acquisitions, pricing, distribution, technology, reputation and political or regulatory change.

Climate risk comprises physical risk (acute and chronic), transition risk (policy, technology, market, reputation) and liability risk; assess over short, medium and long horizons using scenarios.

Cyber and AI risks include evolving threats, data and privacy breaches, model risk, concentration in third-party providers and rapid technology obsolescence.

Governance for emerging risk: assign owners despite uncertainty, track early-warning indicators, review at board level and integrate into the ORSA and strategy.

Reverse stress testing and scenario analysis are more useful than precise probability estimates for many emerging risks.

Decision rule: address unknown unknowns through resilience, optionality, diversification and capital buffers rather than false precision in point estimates.

Emerging risks can create strategic opportunity; ERM should inform upside decisions as well as downside protection.

Embedding means ERM changes decisions: strategy, business plans, pricing, product design, investment, mergers and acquisitions, capital allocation and remuneration.

Risk-adjusted decision metrics include RAROC, risk-adjusted hurdle rates, risk-adjusted pricing, expected loss and capital charges.

Risk appetite should gate decisions through stage-gates, investment committees and delegated authorities that reference appetite and limits.

The ORSA links risk profile, strategy and capital; use it to test business plans and major decisions against capital and appetite constraints.

Post-implementation reviews compare actual risk outcomes with expectations and feed lessons back into frameworks, models and limits.

Incentives must reward risk-adjusted performance over appropriate horizons; deferral and clawback support embedding.

Maturity models assess embedding from compliance-driven to risk-informed decision-making; indicators include use of risk information in board packs and decision papers.

Decision rule: if a major decision proceeds without documented risk assessment and appetite sign-off, the ERM framework is not embedded.

COSO ERM (2017) has five components: Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; Information, Communication and Reporting, supported by 20 principles.

ISO 31000:2018 consists of principles, a framework (leadership, commitment, integration, design, implementation, evaluation, improvement) and a process: scope and context, identification, analysis, evaluation, treatment, with communication/consultation and monitoring/review throughout.

Three lines model (IIA 2020): the first line is operational management that owns and manages risk; the second line is risk, compliance and actuarial functions providing independent expertise and challenge; the third line is internal audit providing independent assurance to the governing body.

Board or board risk committee responsibilities include approving risk appetite and the ERM framework, overseeing top and emerging risks, approving the ORSA, and ensuring risk culture and remuneration are consistent with risk-taking.

Governance principles: clear accountabilities, segregation of risk-taking from risk-control, documented policies and delegated authorities, and an independent risk function with direct access to the board.

Group governance must address legal entity versus group oversight, intra-group transactions, double leverage and contagion; the parent board remains accountable for group-wide ERM.

Decision rule: risk function independence is compromised if the CRO reports only to a risk-taking executive with no board or committee access; escalate through the board risk committee.

The ORSA is the firm's own forward-looking assessment of risk and solvency, approved by the board, and must link strategy, risk profile and capital rather than replicate a regulatory formula.

ISO defines risk as the effect of uncertainty on objectives, commonly expressed as the combination of the probability of an event and its consequence; describe each risk as cause, event and consequence to separate drivers from impacts.

Common risk categories: market, credit, liquidity, underwriting, reserving, catastrophe, operational, conduct, strategic, reputational, regulatory/compliance, emerging and group/contagion.

Identification techniques include workshops, interviews, Delphi, SWOT, PESTLE, process and value-chain mapping, bow-tie analysis, scenario analysis, incident and near-miss data, audit findings and horizon scanning.

A risk register typically records: unique ID, cause-event-consequence description, category, accountable owner, gross and residual ratings, controls and their effectiveness, KRIs, appetite linkage and review date.

Inherent risk is the exposure before controls; residual risk is what remains after controls operate; the difference is evidence of control effectiveness and must be reassessed after control changes or incidents.

Likelihood and impact scales must have explicit criteria so risks can be compared, aggregated and reported consistently across business units.

Each risk should have a single accountable owner; the risk owner is not necessarily the person operating the relevant control.

Record interdependencies, concentrations and correlations in the register, because aggregation and dependence assumptions drive portfolio risk and capital.

Value at Risk: P(L > VaR_alpha) = 1 - alpha over a stated horizon; VaR gives no information on the size of losses beyond the threshold and is not subadditive in general.

Tail Value at Risk (expected shortfall): TVaR_alpha = E[L | L > VaR_alpha]; it captures tail severity and is coherent, satisfying monotonicity, subadditivity, positive homogeneity and translation invariance.

Aggregate loss models combine a frequency distribution N, often Poisson, with a severity distribution X, such as lognormal, gamma or Pareto, using Panjer recursion for the (a,b,0) class or Monte Carlo simulation.

Economic capital equals the loss quantile at the chosen confidence and horizon minus expected loss; allocate it to sub-risks using marginal or Euler contributions.

Copulas separate marginal distributions from dependence structure; the Gaussian copula has no tail dependence, whereas t and Archimedean copulas can capture tail dependence.

Stress and scenario testing, including reverse stress testing, complement probabilistic models where data are sparse or dependence breaks down in extreme conditions.

Model risk controls include independent validation, backtesting, sensitivity analysis, documentation, expert-judgement overlays and change control.

Extreme value theory uses peaks-over-threshold with the generalised Pareto distribution, or block maxima with the generalised extreme value distribution, to extrapolate beyond observed data.

Decision rule: never rely on a single risk measure; report VaR, TVaR, stress results and model limitations together.

Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of its strategy; risk capacity is the maximum risk it can bear before constraints bind; appetite must sit below capacity.

Cascade the framework from board appetite statement to risk tolerances, then business or portfolio limits, then desk or individual limits, each with an owner and escalation route.

Limit types: hard limits that must not be breached, soft limits that trigger escalation, and thresholds or tolerances with defined breach, escalation and remediation processes.

Risk-reward metrics include risk-adjusted return on capital, economic value added, risk-adjusted hurdle rates and capital allocation; compare marginal return against marginal risk.

Calibrate appetite using anchors such as regulatory solvency ratio, earnings volatility, liquidity, target credit rating and stakeholder expectations.

Appetite and limits must be forward-looking and stress-tested; limits calibrated only to current benign conditions fail when conditions change.

Zero appetite is realistic only for selected risks such as deliberate regulatory breaches; most risks carry a finite appetite.

Decision rule: a transaction outside approved appetite requires explicit board or committee approval and documented rationale, not a silent exception.

Risk culture is the shared values, attitudes and behaviours that determine how risks are identified, discussed and managed; components include tone at the top, accountability, incentives, challenge, speak-up and learning.

Conduct risk is the risk that business behaviour or the delivery of products and services causes unfair customer outcomes or harms market integrity; it is often a symptom of culture and incentive failure.

Incentive design levers include deferral, malus, clawback and balanced scorecards; short-term bonuses tied only to revenue encourage excessive risk-taking.

Behavioural biases relevant to risk decisions: overconfidence, anchoring, confirmation bias, availability, groupthink, herding, loss aversion, hindsight and recency.

Culture indicators include staff surveys, whistleblowing volumes, near-miss reporting, grievances, attrition, complaints, breaches and audit findings.

The board and senior management own culture; the risk function can measure and challenge it but cannot create it alone.

Psychological safety supports speak-up; fear of blame suppresses risk reporting and allows small issues to become large losses.

Decision rule: when conduct or complaint indicators deteriorate, review incentives and product design before attributing the problem solely to individuals.

Reporting principles: accurate, timely, clear, relevant, comparable and audience-appropriate; materiality is judged by whether information could influence the user's decisions.

A board risk dashboard typically covers top risks, appetite and limit status, KRIs, capital and solvency, emerging risks, incidents and remediation actions.

KRIs should be predictive, objective, linked to a specific risk, owned, and set with green, amber and red thresholds plus defined response plans.

Escalation frameworks define triggers, recipients and timescales; limit breaches are reported to the board risk committee and, where required, to the regulator.

Stakeholders include the board, regulators, policyholders, investors, rating agencies, employees, auditors and the public; each requires different content, frequency and format.

Narrative reporting explains drivers, uncertainty and model limitations; numbers without context can mislead.

Regulatory reporting includes the ORSA summary report, solvency and financial condition report, financial statements and stress-test submissions.

Forward-looking reporting should cover emerging risks, scenario results and reverse stress-test outcomes, not only historical performance.

Decision rule: if a report cannot change or support a decision, it is not material and should be removed or redesigned.

Economic capital covers unexpected loss at a target confidence and horizon; regulatory capital is prescribed by the supervisor; the two can differ materially in level and composition.

Solvency II calibrates the SCR to a one-year value at risk of basic own funds at 99.5% confidence; the MCR is a lower floor; Pillar 1 is quantitative, Pillar 2 covers governance and ORSA, Pillar 3 covers disclosure.

Own funds are tiered by loss absorbency, with unrestricted Tier 1 capital of the highest quality; eligible own funds must satisfy SCR and MCR tiering limits.

Solvency ratio = eligible own funds / SCR; monitor both the ratio and absolute surplus, plus sensitivity to market, credit and insurance shocks.

Capital allocation methods include standalone, incremental or marginal, Euler and Shapley; Euler allocation sums exactly to total diversified capital and reflects marginal contribution.

Diversification benefit = sum of standalone capitals minus total capital; it depends on dependence assumptions and can shrink sharply in stress.

Fungibility is limited by legal entity ring-fencing, regulatory restrictions, collateral arrangements and exchange controls, so group capital may not be available where needed.

Reinsurance and hedging reduce required capital but introduce counterparty credit, basis and liquidity risks; compare net cost against capital relief.

Decision rule: hold capital against the risk actually retained after reinsurance and hedging, not against gross exposure.

Emerging risks are new or evolving, highly uncertain, data-sparse and potentially high impact; they frequently interact with existing risks and can escalate quickly.

Identification tools include horizon scanning, PESTLE, scenario planning, Delphi, wild-card workshops, expert networks and regulatory or academic signals.

Strategic risk arises from strategy choices: competition, disruption, mergers and acquisitions, pricing, distribution, technology, reputation and political or regulatory change.

Climate risk comprises physical risk (acute and chronic), transition risk (policy, technology, market, reputation) and liability risk; assess over short, medium and long horizons using scenarios.

Cyber and AI risks include evolving threats, data and privacy breaches, model risk, concentration in third-party providers and rapid technology obsolescence.

Governance for emerging risk: assign owners despite uncertainty, track early-warning indicators, review at board level and integrate into the ORSA and strategy.

Reverse stress testing and scenario analysis are more useful than precise probability estimates for many emerging risks.

Decision rule: address unknown unknowns through resilience, optionality, diversification and capital buffers rather than false precision in point estimates.

Emerging risks can create strategic opportunity; ERM should inform upside decisions as well as downside protection.

Embedding means ERM changes decisions: strategy, business plans, pricing, product design, investment, mergers and acquisitions, capital allocation and remuneration.

Risk-adjusted decision metrics include RAROC, risk-adjusted hurdle rates, risk-adjusted pricing, expected loss and capital charges.

Risk appetite should gate decisions through stage-gates, investment committees and delegated authorities that reference appetite and limits.

The ORSA links risk profile, strategy and capital; use it to test business plans and major decisions against capital and appetite constraints.

Post-implementation reviews compare actual risk outcomes with expectations and feed lessons back into frameworks, models and limits.

Incentives must reward risk-adjusted performance over appropriate horizons; deferral and clawback support embedding.

Maturity models assess embedding from compliance-driven to risk-informed decision-making; indicators include use of risk information in board packs and decision papers.

Decision rule: if a major decision proceeds without documented risk assessment and appetite sign-off, the ERM framework is not embedded.