I85PREP
⌘ K
IFoA SP9 study materials
IFoA SP9 study resources

IFoA SP9: Enterprise risk management framework and governance

IFoA SP9 · Work through your exam, one topic at a time.

All guide sections

Enterprise risk management framework and governance

What the exam tests

This domain examines whether you can explain how an ERM framework is designed, governed and made to operate. SP9 questions often present a board or insurer scenario and ask you to critique the framework, identify governance gaps and recommend improvements.

Core rules and concepts

  • A framework is more than a risk register: it connects governance and culture, strategy and objective-setting, performance, review and revision, and information, communication and monitoring (COSO ERM 2017). ISO 31000 separates principles, framework and process.
  • The board is ultimately responsible for risk; it delegates to a risk committee and management. The CRO should have stature, access and independence from profit centres.
  • The three lines model: the first line owns and manages risk; the second provides oversight, challenge and frameworks; internal audit gives independent assurance. The risk function should not own business risks.
  • Key governance documents include the risk policy, risk appetite statement, delegated authorities, committee terms of reference and escalation triggers.
  • The ORSA is a board-owned, forward-looking assessment linking risk profile, appetite and capital to strategy; it is not a compliance document produced by the actuarial team alone.

Worked example

An insurer's CRO reports to the CFO, the risk committee meets twice a year and the risk register is maintained solely by the risk function. The board approves the business plan without seeing a risk assessment. Reasoning: reporting to the CFO compromises independence; twice-yearly meetings may be insufficient for challenge; the register's ownership sits outside the business, so front-line ownership is absent; strategy and risk are disconnected. Fixes: CRO access to the board, more frequent risk committee, risk owners in business units, and an explicit risk section in the business plan.

Traps

Describing framework components without applying them to the scenario; confusing the risk function with the risk owner; treating ORSA as a regulatory form; recommending 'more training' instead of structural governance changes.