The Risk Management System, the Risk Culture and the Duties of the Insurers’ Directors

Abstract

The risk management system and the risk culture pertain to the organisation of the insurance undertaking and face the risk, which is a multifaceted concept challenging such an organisation. This chapter analyses the perimeter of the risk management system to identify the risks that fall within this system and the persons who, within the insurance undertaking, are responsible for ensuring an effective risk management system to the supervisory authority. The chapter also investigates how corporate bodies can assess the head of the risk management function and the risk management system can incorporate risk culture. Lastly, the chapter illustrates concrete actions the persons with the ultimate responsibility of the risk management system can perform to comply with the task to promote, implement and monitor the risk culture.

1 Introduction

Solvency II, which is considered as one of the most sophisticated insurance regulatory regimes is built around the principles of market consistency which aim is to instil strong risk management, governance and internal control systems within the insurance industry. It proposed to remedy the shortcomings of Solvency I by introducing a sweeping regulatory reform for insurance companies.¹

Although Solvency II is mostly known for its risk-based capital requirement calculation, one of the most important elements in this regime is the heavy reliance on robust risk management practices.² Thus, an underlying objective for Solvency II is to improve the system of governance within an organisation. As stated in Recital No. 29 of Solvency II, ‘some risks may only be properly addressed through governance requirements rather than through the quantitative requirements reflected in the Solvency Capital Requirement. An effective system of governance is therefore essential for the adequate management of the insurance undertaking and the regulatory system’.

This approach is common to the EU regulation on financial services³ and denotes the willingness of regulators to dominate uncertainty by organising market uncertainty into recognisable categories of quantifiable risks.⁴ However, the risk management regulation may facilitate misperceptions about what risk management can and cannot do.⁵ The push towards a quantitative risk assessment based on statutory schemes and a fixed pattern to catch it could prevent a true risk culture based on a ‘thinking outside of the box’ approach.⁶ The risk management needs to move from mere calculation to a broader range of activities, including scenario-thinking, war-gaming, playing the devil’s advocate.⁷

Solvency II requires insurance undertakings to set up a risk management system and, therefore, enforces risk management to be embedded in the day-to-day activities of insurance undertakings. However, so far, several insurance undertakings have been focusing on improving risk measurement frameworks, rather than taking the opportunity to implement a real cultural change based on an intelligent understanding of the actual risks they are facing.⁸ Addressing risks proactively requires that insurance undertakings are aware of the current risk culture within the organisation, the industry and the direct and indirect effect of the wider environment surrounding the industry. It requires an understanding of risk and the tools available to address these risks. Moreover, it requires that directors are fully aware and kept abreast of assumptions about models used to measure and report risks, are involved in and understand the Own Risk Self-Assessment (ORSA), the need for a Risk Register and are involved in the design of and understand the stress tests and reverse stress tests implemented.

However, one should be aware of the concept of risk.⁹ Risk classification in insurance markets is the avenue through which insurance undertakings try to be efficient and compete in insurance contracts.¹⁰ Solvency II requests insurers to adopt a forward-looking approach for risks including those of underwriting but not limited to these risks. The intent is to take an enterprise risk-management approach towards capital standards that will provide an integrated solvency framework that covers all significant risk categories and their interdependencies.¹¹ Every risk management process should be custom made, reflecting the firm’s profit goal, existing risk portfolio and risk appetite.¹² Risk is a multifaceted concept, and its identification requires complex approaches that are often misunderstood. The consequence is that decisions are based on limited perception rather than the full value and meaning of what risk is, as a result, the way it is being tackled is incorrect.

Since risk management is concerned with what might happen in the future risk managers are also concerned with creating scenarios by using models to generate: (i) ‘stress tests’; this involves evaluating the impact of extreme, but plausible, scenarios that are not considered by value at risk (VaR) or expected shortfall (ES) models and (ii) ‘reverse stress tests’¹³—also known as a ‘pre-mortem’,¹⁴ this is a managerial strategy in which a project team imagines that a project or organisation has failed, and then works backwards to determine what potentially could lead to the failure of the project or organisation. However, these tests are as good as the directors or their advisors. They depend on their experience, skills and knowledge. Therefore, authorising or recruiting the wrong persons can mean that the risk key indicators (red flags) are set and calibrated incorrectly.

Furthermore, Solvency II pushes insurance undertakings to promote a risk culture alongside the setting up of the risk management function. Weaknesses in risk culture are often considered a root cause of the global financial crisis, headline risk and compliance events.¹⁵ A sound risk culture consistently supports appropriate risk awareness, behaviours and judgements about risk-taking within a strong risk governance framework.¹⁶ Thus, risk culture and risk management can be considered as the two sides of the same coin—the risk governance—and the improvement of the risk culture does not affect the performance of financial institutions.¹⁷ However, risk culture can be implemented in different ways. A cognitive risk culture, which focuses on improving the understanding of risk and resolving the problems by addressing their root cause,¹⁸ stands in contrast to compliance-based and defensive risk cultures. The risk culture could be implemented only to demonstrate to the authorities that their request is being fulfiled, or to promote professionally sub-optimal or even wrong decisions for the sake of preventing lawsuits and blame.¹⁹

However, risk culture goes also beyond the regulators.²⁰ In the current economic environment, companies are looking for opportunities to differentiate themselves from their peers particularly in the area of risk management.²¹ Determining and documenting the risk culture, appetite, tolerance and strategy provide credible evidence, which can be used to inform regulators, clients, rating agencies and other stakeholders.²² By promoting a common language, and structure in which to discuss risk culture and risk management across the undertaking,²³ one can envisage an environment where reporting, communicating and monitoring risk culture is a key part of public disclosures and advertising.²⁴ However, some organisations still currently lack this focus and consistency.²⁵

2 Aim and Research Questions

The introductory remarks outlined the relevance of the risk management system within the governance of the insurance undertakings. A risk culture must be embedded in the governance together with risk management practices. Both the risk management system and the risk culture pertain to the organisation of the company and face the risk. The risk is a multifaceted concept, which challenges the organisation of the insurance undertaking. These remarks allow us to define the aim of this chapter and, ultimately, the research questions.

The preliminary issue concerns the perimeter of the risk management system. The analysis aims to identify the risks that fall within this system and the persons who, within the insurance undertaking, are responsible for ensuring an effective risk management system to the supervisory authority. The risk management system includes the risk management function, but it does not end with the latter. Several people within the company might be deemed responsible by the supervisory authority and/or determine the ultimate responsibility of whoever appointed them as well as of the undertaking. The board of directors is responsible for managing the business (in all its respects) under corporate law. One should understand to what extent individuals bear ultimate responsibility for the functioning of the risk management system, including the head of the risk management function. Thus, corporate bodies including staff working within the company fall into the scope of the analysis. While external auditors are outside the scope.

Based on the result of this analysis, our second research question relates to how corporate bodies can assess the performances of the head of the risk management function. Solvency II provides for a list of risks and a questionnaire and is in a sense, at the standardised approach/model level, prescriptive in the methodologies to be used to monitor and quantify the risks, although companies are expected to add-on other risks that the company may face (Pillar II). It is however more flexible when if the undertaking is using an internal model, which can only be used if the undertaking has proven capacity and experience and it is allowed by the regulator. We aim to understand if these lists, questionnaire and models are exhaustive. How can one understand ex-ante if methodologies adopted by the head of the risk management function are adequate?

Understanding risk should be part of the corporate culture. Risk culture defines how a company’s management and employees understand risk and manage it to maximise rewards.²⁶ If the risk management function is part of the risk management system, the risk culture should concern all the operational units that are exposed to the risk considered under the risk management system. Thus, risk culture is a component of the risk management system.²⁷ Such a culture needs to be promoted, implemented and monitored,²⁸ and persons are responsible for these processes.²⁹ With this analysis, we will therefore investigate the third research question, that is, the concrete actions that can be performed by the persons with the ultimate responsibility of the risk management system to comply with the above task.³⁰

Based on the above, the next section aims to answer the first research questions and, therefore, will investigate both the perimeter of the risk management system and the legal foundations of the duties imposed on the persons who are responsible for that system to the supervisory authority. In the following two sections we will recommend and suggest solutions to address the other two research questions.

3 The Perimeter of the Risk Management System and the Persons Who Are Responsible for Its Functioning

Solvency II sets forth that the ‘administrative, management or supervisory body’ (AMSB) of the insurance (or reinsurance) undertaking has the ultimate responsibility for the compliance, by the undertaking concerned, with the laws, regulations and administrative provisions adopted according to Solvency II.³¹ Also, Solvency II requires all insurance (and reinsurance) undertakings to have in place an effective system of governance that provides for sound and prudent management of the business.³² That system must include among other things compliance with the requirements to have in place an effective risk management system comprising strategies, processes and reporting procedures necessary to identify, measure, monitor, manage and report, continuously the risks, at an individual and at an aggregated level, to which they are or could be exposed, and their interdependencies.³³

The introduction of rules and principles addressed to the corporate bodies of insurance undertakings must consider the absence of a uniform structure of corporate governance in the EU. Solvency II reflects this lack of harmonisation using the generic term ‘administrative, management or supervisory body’ (AMSB) when sets forth rules involving corporate bodies.³⁴ Although the board structure is a matter of national law, the term AMSB covers both the unitary (one-tier) board structure and the dualistic (two-tier) board structure, which are the recurring board structures in the Member States and regulated by their respective national laws. Where no specific body is specified in national law, the regulatory framework issued under Solvency II provides that the term AMSB means the management body.³⁵

The AMSB has the ultimate responsibility of the system of governance comprising the risk management system. Thus, AMSB is responsible for the proper functioning of the risk management system. Consequently, European legislation requires national regulations to identify a corporate body within the AMSB, which is responsible for the system of governance, including the risk management system. Furthermore, the responsibility towards the supervisory authority is established for the whole corporate body as identified by national rules.³⁶ Thus, it should not be possible to distinguish between the responsibility of the executive and non-executive directors within the management body. European legislation seems to establish their joint responsibility towards the supervisory authority for the compliance to Solvency II, including the system of governance/risk management system. This, regardless of what may be provided by national corporate laws.

Being part of the system of governance, the risk management system pursues the same purpose as the first, which is to ensure sound and prudent management of the business.

The meaning of sound and prudent management of the business should be understood, having in mind that the main objective of insurance and reinsurance regulation and supervision in the European Union is the adequate protection of policyholders and beneficiaries.³⁷ Financial stability and fair and stable markets are other objectives of insurance and reinsurance regulation, and supervision that should also be considered but should not undermine the main objective.³⁸ Therefore, adequate protection of policyholders has not only a ‘passive’ meaning consisting of pursuing management of the insurance undertaking that ensures its solvency.

Such protection also has functional significance as clearly expressed by the Directive 2016/97 on insurance distribution (IDD). This Directive sets forth that when carrying out insurance distribution, insurance distributors always act honestly, fairly and professionally in accordance with the best interests of their customers.³⁹ This principle does not refer only to business conduct but also involves the manufacturing of insurance products.⁴⁰ The IDD sets forth product oversight and governance requirements (POG) under which manufacturers must maintain, operate and review a process for the approval of each insurance product to ensure that insurance products meet the needs of the target market.⁴¹ Thus, the sound and prudent management of the business requires insurers not only to ensure their solvency, but also to design products matching the interests and needs of their target market, and to distribute such products to the relevant target market.

Solvency II provides that the risk-management system must cover the risks to be included in the calculation of the Solvency Capital Requirement, as well as the risks which are not or not fully included in the calculation thereof.⁴² Some risks may only be properly addressed through governance requirements rather than through the quantitative requirements reflected in the Solvency Capital Requirement. An effective system of governance is therefore essential for the adequate management of the insurance undertaking and the regulatory system.⁴³ Thus, Solvency II requires insurance undertakings to have in place an effective risk-management system to identify, measure, monitor, manage and report, continuously, the risks to which they are or could be exposed, and their interdependencies.⁴⁴ The IDD complements this provision. The set of rules on POG requests undertakings to manage the risks inherent in poorly designed or improperly distributed products by avoiding the manufacturing and offering of worthless products to customers, and imposing remedial actions in case it happens.⁴⁵ POG meets the goal of increasing customer protection by aligning the approach to products with the approach to capital requirements as introduced under Solvency II.⁴⁶

In conclusion, the system of governance comprising the risk management system should be able to address all risks of insurance undertakings, that is, those related to the solvency and the risks inherent to the quality of products and their distribution. The list of risks provided by Solvency II must be complemented with those related to the manufacturing and distribution of the insurance products as arising under the IDD and implementing national laws.⁴⁷

The risk management system must be effective and well-integrated into the organisational structure and in the decision-making processes of the insurance undertaking with proper consideration of the persons who effectively run the undertaking or have other key functions.⁴⁸ These persons are the members of the AMSB, taking into account national law, as well as members of the senior management.⁴⁹ EIOPA clarified that the AMSB is other than the senior management, which includes persons employed by the undertaking who are responsible for high-level decision making and for implementing the strategies devised and the policies approved by the AMSB.⁵⁰

The AMSB appoints the senior management including the head of the risk management function after a positive fit and proper assessment and is responsible for evaluating reports on risk exposures submitted from the head of the risk management function. Reports and activities will include both the risks to be included in the calculation of the Solvency Capital Requirement as well as the risks which are not or not fully included in the calculation thereof including those related to the manufacturing and distribution of products. These statements introduce the first list of issues outlined earlier concerning how the AMSB can (i) assess the fitness and properness requirements of the head of the risk management function and (ii) understand ex-ante if methodologies and questionnaires adopted by the head of the risk management function are adequate.

Furthermore, the risk management function is a (key) component of the risk management system as a control function but does not incorporate the whole system which also refers to the business units.

Solvency II does not specifically recognise the ‘three lines of defence’ model as developed by the Institute of Internal Auditors (IIA) and based on the framework for evaluating internal controls elaborated by COSO.⁵¹ According to the latest version elaborated by the IIA,⁵² this model consists of the first line provided by front line staff and operational management, i.e. those providing products/services to clients, where the business units have to anticipate and manage risks at the operating level. The monitoring of risk is the second line, which is provided by the functions of risk management and compliance. These functions provide the oversight and the tools, systems and advice necessary to support the first line in identifying, managing and monitoring risks. Because of the specific nature of insurance, where the liabilities side of the balance sheet is more important, the actuarial function is added to this line.⁵³ The third line is provided by the internal audit function. This function provides an independent review that the risk management, internal control and actuarial function framework is working as designed.

The three lines model has been challenged promoting four lines of defence, five lines of defence or the integrated lines of defence.⁵⁴ An analysis of criticism and a discussion on the most efficient defence model for insurance undertakings is outside the scope of this essay.

Nonetheless, the legal framework introduced under Solvency II sets forth the insurance undertakings must establish information systems that produce complete, reliable, clear, consistent, timely and relevant information concerning the business activities, the commitments assumed and the risks to which the undertaking is exposed,⁵⁵ and ensure that all personnel is aware of the procedures for the proper carrying out of their responsibilities.⁵⁶ To that end, the risk management function includes the tasks of assisting the AMSB (and other functions in the effective operation of the risk management system)⁵⁷ and monitoring the risk management system and the general risk profile of the undertaking as a whole.⁵⁸ The AMSB has the ultimate responsibility for ensuring the effectiveness of the risk management system.⁵⁹ Such responsibility means ensuring that there is a coordinated and integrated approach to the risk management system and a common ‘risk language’ with the right tone from the top.⁶⁰ Business units are, therefore, the first line of defence within the risk management system introduced under Solvency II. These units are embedded in the risk management system being requested to deal with the risks inherent to their functions. The risk management function must support the business units by providing them with the tools that are pertinent to the management of these risks.

Since the ultimate responsibility of the risk management system lies on the AMSB, the latter should not rely solely on the support provided by the risk management function to the business units. The AMSB must play an active role in promoting and monitoring the implementation of risk culture across the company. This statement is in line with the Insurance Core Principles (ICPs) issued by the International Association of Insurance Supervisors (IAIS). The ICP 8 refers to Risk Management and Internal Controls and provides that the risk management function must be capable of assisting the insurer to promote and sustain a sound risk culture (see Standard 8.1.). The reference to the capability of ‘assisting’ the insurer should exclude that the risk function has the specific task and the related liability to promote the risk culture. This conclusion opens up the other research question consisting of how the AMSB can assess the performances of the head of the risk management function.

4 Identifying Risk and Managing It

A starting point for addressing risk should be the understanding of what is considered as a risk in the context of the undertaking and the direct and indirect effects over its objectives. Risk is a multifaceted concept, and its identification requires complex approaches that are often misunderstood. The consequence is, that decisions are based on limited perception rather than the full value and meaning of what risk is, as a result, the way it is being tackled is incorrect. Moreover, individuals do not embrace the full multifaceted nature of risk.⁶¹ Regulators impose on directors and individuals, norms and checklists, overuse, or misinterpret the value of models, simulations and templates; thereby reducing responsibility and capability for innovative decision-making. At the same time, the wider use of technology and rules reduces the critical thinking of directors and individuals. We advance the automation process by building robots that follow protocols and forget about the part of risk assessment that cannot be programmed. Therefore, before the risk management process can start, one needs to define, understand and communicate the objective, then determine the risks that can affect this objective and identify the controls in place. Regulations and respective guidelines to define this process but forget to address the meaning and context of risk.⁶² The framework introduced under Solvency II mentions that we need to address, Market Risk, Settlement Risk, Liquidity Risk, Credit Risk, Interest Rate Risk, Model Risk and any other Business Risk, etc.,⁶³ and it does go into great detail on how to address these risks and their definition but there is no mention of the definition of risk itself. That is, when risk is a risk or risk is not a risk.⁶⁴

Although there are various definitions of risk, the best working definition is that of ‘uncertainty that matters because it can affect one or more objectives’.⁶⁵ This can be simplified into two ingredients ‘Uncertainty’ and ‘Materiality’.⁶⁶ This should be the main guideline provided by regulators to AMSB.⁶⁷ In fact, in risk management, we look at three forms of knowledge and non-knowledge associated with risk, which need to be understood. Known (K) risk, the Unknown (u) risk and the unknowable (U) risk. The first type of risk (K) can be measured, and any disruption forecasted and may be established from prior experience, are understood and appreciated. These events are normally a result of incompetence. The second type (u) are the most commonly encountered situations, but the extent and full implications remain unclear due to the lack of judgment. These events may be quantifiable, but the time of occurrence is unknown. They are events where the location, timing and extent of the event are difficult to quantify. The third type of risk (U) are events that are difficult, if not impossible, to model due to lack of knowledge in hand. To manage unknowable risks, companies should ensure business processes remain flexible, ensuring variable costs, and diversifying across products and markets whenever possible. This type of uncertainty is quantifiable by using simulators that make what is implicit explicit, but there is no availability of data.⁶⁸

Regulations are there to guide and trigger thinking. However, the thinking needs to be done at the level of the undertaking; where it is expected that the personnel and the directors are well equipped with knowledge and experience that enables them to determine objectives and risk-taking that are in line with the appetite and tolerance of the stakeholders/shareholders and that this is communicated appropriately down, up and across the undertaking. Regulators must not do the mistake of micro-managing undertakings by imposing authorisation judgements on who is appropriate or authorised for specific positions, and what and how to address risk. This responsibility should remain the onus of the AMSB.⁶⁹

As noted above regulations require that an insurance undertaking has a risk management function and employs a risk manager or risk team to carry out the day-to-day responsibility of this function on behalf of the directors. Regulations offer a framework through Solvency II and the respective ORSA to address risk in an insurance undertaking, but this is far from solving the problem of ensuring that this responsibility is carried out appropriately. The risk manager is a regulator-approved/authorised position and in some cases can also fall under the responsibility of a Risk Committee, but the ultimate responsibility is always that of the AMSB. Therefore, the determination of whether the function and the personnel are appropriate is that of the AMSB. However, there is no clear-cut answer to this question, and many a time the reliance is based on the suggestions of advisors built from their understanding of what the regulator would accept as a person’s qualifications and experience. Besides, unless on the AMSB there is someone who understands the need for risk management, the function becomes perfunctory and bottom-up, with little feedback and challenge, or on the other hand, it can take the opposite scenario of challenging the wrong things.

The problem is that risk management is not considered as a profession in its own right, and education, experience, associations, institutes and standards are vast. The only common requirement in the case of insurance undertakings is Solvency II and the guidelines and rules that form around it. Regulatory authorisation requirements⁷⁰ do not distinguish between qualifications that are focussed mainly on monitoring or setting up policies and procedures, those that are focussed on measurement and statistical models, those that are focussed on monitoring, and those that are focussed on management. That is, a Director who takes on any type of corporate position such as Risk Manager, Internal Auditor, Compliance Officer, MLRO, Valuation Officer, Portfolio Manager, or sits on some committees, needs to obtain authorisation from the regulator—one needs to prepare a Personal Questionnaire and then obtain authorisation by the regulator. This is a requirement of the licence application and ongoing procedure.⁷¹

A complete risk manager should have all these skills; that is, (1) understanding models and their assumptions, (2) ability to document procedures, standards and policies to ensure they are within the appetite of the undertaking’s stakeholders (3) ability to communicate up and down and across the undertaking, (4) ability to understand and advise on risks and (5) ability to lead and manage proactively to ensure continuity.⁷²

To ensure this, the AMSB needs to have a wide-angle scan of these needs and before recruiting ensure that the risk function has players that can offer these assurances or put in a structure that can ensure this is happening within the risk management function. Risk management is not about one person or more taking up that position but about the whole team of employees working together to achieve the objectives. It is about communication and acceptance of objectives and the determination or ‘buy-in’ of everyone to achieve them.

Unfortunately, the absence of this profession and the potential lack of people with this skillset in some Member States leads directors to look at other professions to fill this profession, such as economists, lawyers and accountants who might have taken a short course and a few years of on-the-job training. Even with training, most of the time, their mind-set is either on models and model building or financial or policymaking but lack the management skills and the ability to innovate.⁷³

It is important to note this since it explains why the mistake is being done—people with the wrong skillsets are asking and teaching people to have the wrong skillsets. That is, to replicate themselves. That is, ‘what goes in goes out’. One is addressing a new area with the eyes of an old skill/profession, which to such an extent is reactive. If these professions are to understand and address the problem they need to open up to the wider context and think outside their comfort zone or else we will continue to face the same issues we face today—may be a more modern version of the same problems. Similar cases with similar governance issues causing failure or large losses but using more modern techniques.⁷⁴

It should also be noted that the lack of adequate professionalism in risk management is not a matter inherent only to the responsibility of the AMSB towards the supervisory authority of the Member State in which the insurer is based. In the case of cross-border operations, the lack of professionalism of the risk manager could jeopardise compliance with the obligations undertaken by the insurer towards policyholders in the host Member State.

We believe that ultimately, risk management is about character and culture and the AMSB can only fully understand, determine and recognise the fitness and properness of a risk management function if common explicit standards are determining the skillsets of the risk manager by embedding this into a profession. Regulations only talk about the function of the risk manager but forget the skillset or are—as noted above—incorrectly filling this gap with the wrong skillsets.⁷⁵ Skillsets that look only at education and forget the other necessary characteristics necessary to reach objectives such as an aligned appetite and tolerance and a common culture. Maybe, this is also, because authorisation/approval, is determined by persons who do not have enough knowledge of what this skillset should be. However, the AMSB does not define and understand what risk is and base their knowledge on regulators, who give them a recipe of what to look out for—so they do not use their minds to think but satisfice and do what they are told. However, the regulator himself/herself does not know how to determine risk because s/he does not have the correct skillset to do so and there is no one singled out profession, which can be identifiable in law as a risk profession, similarly to other professions.⁷⁶

It is not surprising that most persons working in a risk function do not know how to define risk, let alone how to manage it.⁷⁷ Defining the role of the Risk Manager in law as a separate focussed profession would strengthen the profession, by standardising the training and knowledge requirements, the required responsibilities, and thereby the skillset required, putting them on the same level as other professions even in the eyes of the regulators.

Regulations should be there to reach objectives without hiccups—however if the objectives are incorrect because they are addressing different objectives. Lawyers have one perception of what is risk and what are the objectives, Accountants have another, Economists have another, and they are the people addressing the requirements and drafting regulations—these people are all reactive by nature. Therefore, where is the Risk Managers’ skillset in all this, where is the proactivity?⁷⁸ You do not address a risk after it happens, because if you know about it because it happened before, you can manage it, and therefore as noted above it is not a risk. For example, the underwriter takes risks he understands a calculated risk to make a profit. The other party who does not want can manage it.⁷⁹

However, Solvency II is driving changes in insurance undertakings, that is, from the AMSB through to wider organisation. For directors, and particularly non-executive directors, this means getting closer to the business. Has the industry (regulators and educators) understood that what was good a few years ago is now day irrelevant? The directors must be simultaneously entrepreneurial and drive the business forward while keeping it under prudent control. Apart from the education, character, experience and charisma of the individual member, one needs to determine how these fit in as a team and this cannot be something determined by regulations or micro-managed by the regulator.⁸⁰

Solvency II makes it clear that the AMSB is not able to delegate its responsibilities, and individual directors⁸¹ must be able to explain the decisions taken by the undertaking. The corollary of their position is that the existence and requirement of having a risk management function demands the board to have risk expertise; therefore, requiring expertise at the board level in every area or function within the undertaking.

These obligations are creating tension and challenges within undertakings, putting a lot of stress on the directors. Therefore, in our opinion, there is a need for a risk management profession and for expanding the directors’ skillset. This should compile all standards and frame the understanding of their expected function and skillset as already mentioned above.⁸² Without this, the AMSB is at the mercy of the regulators and the knowledge, character and experience of the person leading the risk management function. Whether s/he is fit and proper or not is another question.

5 Importance of Performing and Communicating a Risk Culture Diagnostic

Inappropriate risky behaviour beyond the appetite of stakeholders can destroy the reputation, value and the undertaking.⁸³ This is why processes and oversight structures to control the level of variability from this appetite is so important. However, unfortunately, regulations and directors forget or ignore the attitudes and behaviour of decision-makers and the reasons why they make specific decisions. Shaping the risk culture, maybe through policies, procedures, standards, and communications ensure that business risks such as reputation and strategy are managed appropriately.⁸⁴ Both are important since reputation and following an inappropriate strategy can destroy an undertaking. Regulations do focus on the risk management function on this risk and do point out that these risks need to be addressed appropriately and processes and policies documented and structured appropriately. Regulators, to a certain extent, do micromanage this during onsite visits.⁸⁵

If the AMSB makes risk culture diagnostics a priority, then there is quicker buy-in throughout the undertaking. There needs to be soliciting of views from employees with a message that management believes in the empowerment of all members and that this is a priority. Objectives should be clear and the focus of all. Communication of the risk culture should be a priority on the leadership agenda, and lack of awareness, indifference or disregard for this should not be tolerated.

Humans are very sensitive to signals arising from how an organisation reacts and behaves. If ignoring limits, failure to complete risk reports, or disregard for processes is tolerated and not identified, monitored and corrected, then the undertaking risks perpetuating a cavalier attitude to risk and control throughout the undertaking.⁸⁶

In some cases, it has been difficult to engage with the AMSB on risk management as the focus is often on the technical details around risk measurement. However, the results of the diagnostic should be visual and qualitative, making it easily communicated and, hence, encouraging engagement. That is, to ensure that risk management is not lost in translation and that uncertainties are documented, communicated and addressed efficiently and in line with the appetite set at the strategy stage.⁸⁷ Benchmarking also provides the context of the results of similar undertakings. The better-informed one is about what others are doing, the better one is at designing a gap analysis for decision-making.⁸⁸

All results, findings and discussions need to be analysed at various levels, depending on data capture, and used to identify ‘red flags’ needing remedial action whether this is by business unit or function. Tools used for reporting and addressing risk should be user-friendly and enable personnel to engage in understanding risk culture in their part of the undertaking and encourage constructive dialogue on improvement. However, for this to hold, employees must feel secure to answer truthfully and this is best achieved if this is coming from the top and communicated well.⁸⁹

Solvency II, if interpreted well, does promote all this. However, many undertakings are still not recognising the need to improve governance, as this is a change in mentality and may relate to an overhaul of the system of governance, the need to invest, and a change in mentality. Therefore, sometimes even because of the lack of proportionate in the approach and the enforcement of the requirements, Solvency II is seen as a perfunctory function and not as a competitive edge.

Relying on processes and formalised controls will not be enough to give the confidence that an organisation is capable of state-of-the-art risk management. There will always be ways to circumvent the models, systems and controls as we see from some of the cases found in the literature, such as those of Long Term Capital Management, Barings Bank, Societé General and many others.⁹⁰ It is, therefore, necessary for the AMSB to encourage a strong risk culture where employees are risk-aware, understand the consequences of their decisions, and are confident to raise objections when necessary. Unfortunately, there is no hard and fast rule or fixed methodology to ensure this and the AMSB has the task of putting in measurable and realistic objectives with the help of the risk manager, which recognise uncertainties and ensuring that these are addressed responsibly and with integrity.

That is:

• Objectives must be stated, and achievements measured.

• Information related to the achievement of objectives should accurately present the facts.

• The objectives should be updated regularly, ongoing and sustainable.

• Uncertainty about the future should address both dangers and rewards.

• Being wrong should be acceptable but must be communicated and addressed thoughtfully and rigorously.

• Mandatory and voluntary promises must be maintained, measured, monitored and ensured.⁹¹

Risk culture is not static and should be actively challenged to encourage continuous improvement. This cycle must be continuously improving by allowing management to benchmark against other undertakings, track own performance over time and provide results at a sufficiently granular level so that remedial action can be applied. Although change does not happen overnight, Solvency II is an opportunity to improve the risk culture within insurance undertakings. However, to do that, insurers need to grasp this opportunity and understand that risk management system is not only one person, but it is a system, that is the result of many other functions working together to reach common objectives with the least hiccups in a sustainable manner⁹² (vide Fig. 1).

Fig. 1

The risk management system (Source: Authors’ own compilation)

Moreover, one needs to consider the starting point of the undertaking and proportionality when determining the action to be taken to deciding on how to ensure a culture change.⁹³ This since, although, the above list is generalisable, not all actions may be applicable, and some circumstances might require a different address.⁹⁴

6 Conclusion

Solvency II does provide methodologies, guidelines, and suggestions to measure, monitor, and manage risks. However, these can misguide directors into believing that these are exhaustive, and following these requirements will ensure that we are immune from trouble or danger of loss. As noted above, this is not the case. Far from it, the AMSB needs to understand the risk their undertaking is facing and impose ex-ante adequate and proportional methodologies to mitigate unwanted risks and monitor those risks that they are willing to take.

To do this, the AMSB must understand the culture of the undertaking and its personnel to determine the adequacy to meet objectives. Adequacy in terms of character, education and experience. That is the fitness and properness of the team. Although this task is sometimes delegated to the Human Resource Manager, the AMSB has to have a full view of the delegated task.⁹⁵

Another important task should be that of ensuring that all policies and procedures are documented and reviewed periodically and in line with the strategy of the undertaking. Everything needs to focus on the objectives and appetite and tolerance of the stakeholders and within the mandatory regulatory parameters.

Once these are complete, the communication lines should be addressed to ensure that any risk, variance from the appetite, and tolerance are communicated to the AMSB in a time and through the set communication channels depending on the importance/materiality as decided by the AMSB. Any noise suppressing this communication, such as internal politics should be tackled immediately and stopped.

This shows the importance of having a governance structure with internal controls that are proportional to the size and responsibility of the undertaking, based on the licensable activity it is providing. Although the chosen persons are important and their experience and qualifications are important factors in ensuring the adequacy of the governance structure to meet objectives set, it is the way they fit together and their buy-in to the project and objective to ensure the appropriate communication, integrity, responsibility and sustainability of the set objectives of the undertaking.⁹⁶

The makeup of the AMSB might well need to change with at least one person with risk management and knowledge of internal controls. However, such senior people are in short supply, and it is doubtful there are many of them in some Member States, where Risk officers with knowledge and experience on financial modelling, regulations and internal controls within the insurance industry, is less developed and the number of suitably qualified senior staff is low. As noted, this lack of professionalism in one Member State risks spreading to other States in the case of cross-border activity of the insurer concerned.

The solution for having an appropriate and effective AMSB is not something that can be developed overnight just by implementing regulations, but one needs to take a deeper look at the environment and the developments required to arrive at such. Education plays an important part in all this, and regulation needs to push in that direction to ensure that this is brought in line with the new needs; coupled with driving, providing and setting of a European professional status (embedded in the law) for these new skillsets. Moreover, national regulators need to be put in a position to apply the principle of proportionality without fear. Until this is achieved, directors, risk managers and regulators will continue to doubt whether what they are doing is enough and in line with requirements, and fear and confusion will continue to reign.