Principles fordoing business at
Lloyd’s

Summary of revisions
July 2024

Contents

New changes for July 2024
1. Culture Principle – revision of sub-principles andintroduction of new levels of maturity

Previously published changes – December 2023
2. Underwriting Profitability – sub-principle 8 – revisions towording relating to sustainability
3. Legacy Reinsurance Underwriting Profitability –introduction of new Principle for RITC syndicates
4. Catastrophe Exposure (Nat Cat and Non Nat Cat) –revision of sub-principle structure
5. Operational Resilience – revision of sub-principles andintroduction of new levels of maturity© Lloyd’s 2024

2Classification: Confidential

Culture© Lloyd’s 2024

Principle 13: Culture
Update – July 2024
Summary of the change:
Since 2022, the Culture Principle has required managing agents to meet a single
Foundational level of maturity. This has now been revised, with the introduction of fourlevels of maturity in the Maturity Matrix guidance. This is set out below.
The wording of the Principle has undergone a minor revision.
Further detail on the changes is available on the Culture Principle page on Lloyds.com,
including the materiality metric for determining expected maturity.
Principle wording: Managing agents should be diverse,creating an and create an
inclusive and high-performance culture.
CULTURE
Demonstrate leadership focus on fostering an inclusive and high-performance culture at all

1 levels.

StrategyFoundational
•

•

•

•

Intermediate

Culture is considered •a priority for the Boardand senior leadershipand is proactively
communicated acrossthe business to show •intent.
The desiredorganisational culture
is defined (e.g. incultural values /principles) to provide
clarity of theorganisation’s identityand vision.
•
The Board and seniorleadership understandand input into thepriorities required to•achieve the desired
culture.
There is minimum
annual reporting on
culture to the Boardand senior leadershipto drive responsibility
and ownership.

Established

A Culture Strategy•
has been defined withan action plan tosupport developmentof the desired culture.
A Diversity andInclusion (D&I)
Strategy has beendeveloped to drive
focused, evidencebased impact andchange (can be partof a broader culture•
strategy).
Progress is reviewed
annually by Boardand senior leadershipto assess impact.
Employees acrosslevels and businessareas (not justLeadership and HR)
input into theorganisation’s culture
strategy and actions,involving theorganisation indeveloping
organisational culture.

Advanced•
There is strategic
business-wide
leadership andgovernance of culture,
diversity and inclusion(e.g. culture council,
D&I advisory group)
to increase reach andownership across theorganisation (topdown, bottom up andacross).
The D&I Strategy
considersintersectionality andbelonging to better
understand uniqueexperiences andopportunities thatenable talent to thrive.

Classification: Confidential

Cultural variances
between teams,
functions, businessareas etc. aresupported,
recognising there may
be cultures withincultures, but there is acollective cultural
direction being
worked towards. Any
pockets that don’talign to the culture
ambitions are
addressed.

Blue text = new for Foundational
4

CULTURE

1 Demonstrate leadership focus on fostering an inclusive and high-performance culture at alllevels.

Engagement

LeadershipFoundational

Intermediate

Established• There is visible• Leadership capability
support for an
is developed that isinclusive and highaligned to the desired
performance culture
culture and includes
from the Board andinclusive leadership.
senior leadership• Leadershipevidenced by leading
accountability forby example and roleculture, diversity andmodelling behaviours.
inclusion is linked to• A leadershipcompensation.
behavioural
framework or
expectations are inplace, measured andreferred to in decision
making.
• There is leadershipaccountability forculture, diversity andinclusion throughperformance metrics.

•• There are intentional
efforts towards an
inclusive culture that
leads to tangible
impact.

• No guidance at
Established.

• No guidance atIntermediate.

•

Advanced

Inclusive leadership•development extends
to anyone with people
management
responsibility
Leaders and•managers proactively
sponsor talent(including underrepresented talent) todevelop and progresse.g. createconnections,advocate, provide
visibility.

Senior leadersdevelop the next levelof leaders to drive an
inclusive, highperformance culture
The firm uses its
scale and reach to
advocate for and leadinitiatives that
positively change
market-wide culture,
diversity andinclusion, amplifying
impact and results.

• No guidance at
Advanced.

Blue text = new for Foundational

5Classification: Confidential

CULTURE

2 Foster inclusive behaviour, with zero tolerance for inappropriate behaviour

Learning

Policies

Foundational

Intermediate• Appropriate policies to •set behaviour
expectations areevidenced andenforced (e.g.
Grievance, Bullying
and Harassment,
Drugs and Alcohol).
• Behaviour
expectations areclearly communicated •to employees (e.g.
code of conduct,
employee handbook).

Established

Adherence to• No guidance at
behavioural standards
Established.
(including values andD&I expectations) are
included in material
supplier / third party
contracts (e.g.
vendors, partners,
recruitment
providers).
Behavioural related
policies, processes,
procedures and tools
are reviewed andanalysed toincorporate employee
feedback andenhancements.

• D&I training is• Inclusive behaviour•
mandatory for all
training is mandatory
employees to ensure
for all employees andfundamental
includes broader
understanding
education (e.g. lived
includingexperiences). Training
discrimination andis acted upon andharassment.
leads to severity of• Training on inclusive
behavioural incidents
behaviours is
reducing over time.
available.
• Leaders and• Employees feelmanagers arerespected, understoodrequired to undertakeand supported by their
inclusive leadershipcolleagues andand behaviour
leaders.
training.

Advanced• No guidance at
Advanced.

Professional and role- • No guidance at
specific learning
Advanced.
reinforces inclusive
behaviour
expectations.

Blue text = new for Foundational

6
Classification: Confidential

CULTURE

2 Foster inclusive behaviour, with zero tolerance for inappropriate behaviour

Performance

PracticesFoundational

Intermediate• Disciplinary, grievance •and investigation
processes areadhered to at all times
and operated in a waythat provides timely
and fair outcomes that
support inclusive
behaviour.
•• Appropriate due
diligence is carried out
on new hires, andhiring and recruitment
decisions align tobehaviouralexpectations.
• Leaders role model•
the behaviour
expectations anddemonstrate a ‘zero
tolerance’ approach toinappropriate
behaviour.
• Employees haveconfidence thatleaders will address
inappropriate
behaviour in theirorganisation, no
matter how small.
• Methodology forsupporting employeeswith behaviour related
incidents can bedemonstrated, taking
seriously all concerns
raised in an
appropriate manner.
• Performance isassessed based on
behaviour
expectations andbusiness results andthis is linked tocompensation.
• Positive behaviour isrecognised and there
are consequenceswhere behavioural
breaches occur.

Established

Advanced

Formal or informal• Culture is•
feedback mechanisms
proactively
help to identify andreviewed acrossanalyse trends in inclusive
business areas,or non-inclusive behaviour
functions and teams
so that root causes can beto identify
understood andopportunities or•addressed.
areas of concern.
There is proactive• Employee relations
inclusive behaviour within
are proactively
and across teams rather
used to advise andthan simply reacting
support on ways toretrospectively to
improve behaviour
grievances. E.g.
and the working•
colleagues proactively
environment, notsharing learning.
just in punitive
Employees feelsituations.
empowered toappropriately address andresolve behaviour that is
not inclusive.

• A behavioural frameworkhas been defined to alignbehaviours with values,
Culture Strategy and D&I
Strategy.
• There are consequences
for non-inclusive
behaviour as well as
rewards for inclusive
behaviour which is tied to
culture related employee
objectives / KPIs in orderto drive accountability.

• No guidance at
Established.

Classification: Confidential

Teachable moments
are shared fromrelevant situations
and experiences tofacilitate learning andtransparency.
Inclusive behaviour
leads to challenging
of the status quo andchanging
perceptions about
behaviour across themarket.
Teams constructively
check and challenge
each other to be
inclusive e.g. through360° feedback, andproactively identify
instances where
behaviour can
improve. They also
amplify positive
examples for othercolleagues andteams to learn from.

• No guidance at
Advanced.

Blue text = new for Foundational
7

CULTURE
Foster psychological safety to encourage speaking up, access diverse perspectives and focus on

3 continuous improvement

Policies, Practices and Tools

Foundational

Intermediate

Established• Policies and• Employee training•
processes for
related to effective
speaking up are incommunication,
place (e.g. Grievance,
speaking up andWhistleblowing,
fostering
Health and Safety)
psychological safety
and employees aresupports inclusive
trained where
behaviour.
appropriate.
• Employees are• Appropriate tools are
involved in continuous
available toimprovement of
employees to report
processes, practices
issues andand performance.
communicate any
concerns. Employees
demonstrateawareness of andconfidence in them.
• There are formal orinformal channels andways for people toshare and contribute
ideas and feedback
e.g. via employee
surveys, employee
forums.

Tools for employees
to report issues aremonitored for usage
and patterns,
identifying any
potential adverse
experiences for
demographic groups.

Advanced• No guidance at
Advanced.

Blue text = new for Foundational

8
Classification: Confidential

CULTURE
Foster psychological safety to encourage speaking up, access diverse perspectives and focus on

3 continuous improvement

Culture and Engagement

Foundational

Intermediate• Speaking up is•
positioned as afoundation of a healthy
culture, where
employees are
comfortable to put
forward ideas, learn,ask questions andchallenge, not justreport inappropriate•
behaviour.
• Employees areencouraged and safe
to express
disagreement orchallenge opinions
without fear ofnegative
consequences.
• Whether informal orformal, there is aculture of action toaddress concerns andfeedback raised by
employees. Concerns
are taken seriously,building trust in doingso.
• There is dialogue
between leaders andemployees and rigour
around listening andacting on employee
feedback and ideas.

Established

There is a healthy•
culture aroundmistakes, andemployees areencouraged to usethem as opportunities
for learning for how to
do things differently /better.
Leaders andmanagers encourage
curiosity andinterpersonal risktaking by modelling
this behaviour (e.g. by
acknowledging theirown gaps, admitting
mistakes, asking forhelp) and celebrating
it in others toencourage
contributions andengagement acrossemployees.

Advanced

A variety of people,• Diversity of thevoices and views
Leadership Team(broader than
(Executive and Nonprotected
Executive Directors)
characteristics – e.g.
includes varied
tenures, departments,
industry backgrounds,
backgrounds etc.) are
breadth of experience,
actively sourced andskillsets andengaged in the
demographics todevelopment ofenrich boardroom / Cproducts and services
suite discussions,in order to innovate
solutioning, decisions
through inclusion.
and execution.
• Leaders andmanagers create ways
(formal and informal)
to bring diversity ofthought into teams
and businessdecision-making.
Collaboration acrossteams is encouraged
to mitigate the risks ofgroup think and drive
continuous
improvement.

Blue text = new for Foundational

9Classification: Confidential

CULTURE
Ensure diverse representation in their workforce and leadership levels, reflecting society. Be

4 inclusive in hiring and retention and contribute to the market being a destination of choice for

Recruitment

Diversity

talentFoundational

Intermediate

Established• Diversity of theworkforce and inleadership ismonitored, with firmspecific goals set
where there is underrepresentation.
• The managing agent
can demonstrateprogress towards
Lloyd’s Gender andEthnicity targets andtheir own goals.

• Firm-specific D&I
goals or targets are
set and monitored,
considering broader
demographics andinclusion. Indicatorsshow improvement
towards them.
• Market-competitive
policies and practices
that consider diverse
needs are in place,e.g. parental leave,
flexible working.

•• Steps are taken to
attract diverse andunder-represented
talent (e.g.
consideration of
Lloyd’s talent pools).
• Policies, processes
and practices are inplace which support
inclusive hiring for all
roles (e.g. debiased
selection process).

• Recruitment partners •undertake diversity
monitoring and apply
inclusive recruitment
practices (e.g. AA•
accessibility standard
websites, reducing
barriers to entry,
proactive use ofcommunity
engagement).
• Hiring managers aretrained in inclusive
hiring practices andapply this in their role.
• Action is taken to
attract underrepresented talent andleads to diverse hires
and placements.

Advanced

D&I requirements are • Time, effort andincluded in material
resources aresupplier / third party
invested into initiatives
contracts.
that have social
impact. This is
strategically aligned tosustainability goals.
• Action is taken to
broaden access to
suppliers toopportunities aligned
to the Culture and D&I
Strategy.

Recruiters have D&I
related KPIs andinclusive recruitment
accreditation.
There is a proactive
employer branding
strategy to broaden
awareness and reachof talent pools.

• There is a culture-add
approach torecruitment, seeking
candidates thatenhance the culture
rather than ‘fit’ thecurrent culture to
support growth.
• There is a scaled
approach to talentsourcing, leveraging
direct channels andengaging at volume
with different schools,
universities, partners /third parties etc.

Blue text = new for Foundational

10
Classification: Confidential

CULTURE
Ensure diverse representation in their workforce and leadership levels, reflecting society. Be

4 inclusive in hiring and retention and contribute to the market being a destination of choice fortalentOutreach

Talent and Succession

Foundational

Intermediate

Established• There is proactive• The employee•
talent management oflifecycle is reviewed
diverse talent throughthrough a diversity
the business e.g.
and inclusion lens anddevelopment roles
insights are built intoand programmes,
talent management
mentoring.
and monitored,• Succession planningleading to retention of •is carried out totalent.
identify future leaders, • Diversity of the talentconsidering
pool is understood andbehaviours, skills andthere is action todiversity.
develop and diversify
the talent pipeline (e.g.
development
programmes) to•address underrepresentation anddisproportionate
outcomes.
• Pay gaps aremeasured and•monitored tounderstand andaddress any
challenges (250+
employees).

• No guidance atFoundational• There is participationin outreachprogrammes (ownfirm, with partners ormarket-wide) toincrease access todiverse talent.

Advanced

Processes to de-bias •outcomes throughout
the employee lifecycle
can be evidenced(performance,
promotion,
development, reward). •Proactive talentmanagement
considers outcomes at •function-level or in
specific roles andleads to proportionality
in development andprogression.
Leaders takeaccountability toprogress and retain
diverse talent (e.g. via
sponsorshipprogrammes).
Lived experience ofdiverse talent isunderstood byleadership andmanagers and as aresult, flight risks are
identified.

At all levels there isworkforce
representationreflective of society
with understanding of
the customer base.
Turnover of diverse
talent is proactively
avoided.
Targets are set for pay
parity at all levels
across multiple
demographics and are
actively worked
towards. There istransparency at Board
level.

• Leaders contribute• The managing agent
industry thought
convenes, shapes
leadership to drive
thinking and / or leads
awareness, education
initiatives to foster aand engagement.
diverse, inclusive andhigh-performance
culture, and takes aleading role in marketwide / cross-industry
outreach initiatives
that change
perceptions of themarket and industry
and make it adestination of choicefor talent.

11
Classification: Confidential

CULTURE
Understand their employee population, use data and insights to inform action to create an

5 inclusive employee experience

Culture and Engagement

Data and Analysis

Foundational

Intermediate• Diversity data is• A broad range ofcollected including
diversity data is
Gender and Ethnicity
collected (where local
at a minimum (whererequirements allow)
local requirements
and analysed,
allow), with steps
includingtaken to collectintersectional
broader diversity data.
dimensions to inform• Disclosure of diversity
proactive action,
data is increasing.
positively enhance• Diversity data is
experiences andanalysed toreduce any negative
understand trends
indications.
• A variety of qualitativeand quantitative
feedback sources areused to understandand improve theemployee experience.
• Culture, diversity andinclusion data is
discussed at Board
and ExCo at least
annually and action istaken to continuously
improve.

Established•

Advanced

Employee experience •data shows minimal
variance for diverse
groups and acrossdifferent levels of theorganisation.

• There is transparency • The employee• D&I informs decision •on insights from theexperience ismaking and impacts
Culture Survey andreviewed through adesign of newother employee
D&I lens, and action /initiatives, products
feedback as well as
adjustments are taken
and/or services tocommunication of
to address any
enable and drive
resulting actions.
concerns or gaps (e.g.
accessibility to all.
• Employee Network
reasonable• Culture efforts areGroups (either within
adjustments, flexible
connected regionally /the firm or wider
working).
globally (asindustry) and• Senior leaders play aappropriate) to
employee forums arerole in Employee
support cohesion,
encouraged andNetwork Groups,
connection andpromoted to facilitate
either within the firm
collaboration.
connection building.
or wider industry.

No guidance at
Advanced.

There is an alumni
network to foster
positive relationships
and sentiment in themarket.

Blue text = new for Foundational

12Classification: Confidential

CULTURE
Understand their employee population, use data and insights to inform action to create an

Policies, Practices and Tools

External Accreditation

5 inclusive employee experience
Foundational

Intermediate

Established

Advanced• No guidance atFoundational.

• No guidance atIntermediate.

• External assurance•
can be evidenced
through D&I Audits orrecognised
Accreditation such as
Clear Assured Bronze/ Silver level, Investors
in Diversity or National
Equality Standard.

• Appropriate support
for employee
wellbeing is available
and communicated toall.
• There aremechanisms to checkthat employees havethe tools and support
they need to work
effectively andcomfortably.

• Identifying,• No guidance atunderstanding andEstablished.
acting on root issues
and causes that
undermine wellbeing
occurs (e.g. workload,
job design, resource
levels).
• There is anunderstanding of thebarriers employees
face and action plansto address.

At least one higher
level accreditation
has been achieved(e.g. Clear Assured
Gold/Platinum level,
Masters in Diversity
or other approved
accreditation).

• No guidance at
Advanced.

Blue text = new for Foundational

13
Classification: ConfidentialUnderwriting
Profitability© Lloyd’s 2024

Principle 1: Underwriting Profitability
Updates for 2024
Summary of the change: The wording in sub-principle 8 of the Underwriting Profitability
Principle has been revised. To reduce ambiguity, we have amended references to ESG toeither “sustainability” or more specifically to “environmental and social risks”. This aligns
with our recently published Insuring the transition roadmap consultation.
Amended content in blue text.
UNDERWRITING PROFITABILITY
Have processes in place to support decision making in relation to ESG integration integrating

8 sustainability into underwriting.
Foundational
•

•

•

•

Board approved•
Sustainability ESG
Strategy covers
approach tosustainable
underwriting.
Sustainability ESG
Strategy focuses on
the most material
areas of sustainable
underwriting
operations and how
Sustainability ESG•
can be integrated into
these areas.
Underwriting
Governance
Framework is alignedwith broader
Sustainability ESG
governance.
Data requirements
needed to aid
decision making havebeen identified andefforts are underway
to gather thenecessary data tounderstand, monitor
and report onenvironmental andsocial ESG
exposures.

Intermediate
Board approved•
Sustainability ESG
Strategy andapproach tosustainable
underwriting iscascadedthroughout the
managing agent
through•sustainability ESG
targets.
Analysis ofexisting portfolios
carried out to•identify incumbent
exposures/client
relationships that
may not be
supportable going
forward based on
syndicates’
Sustainability ESG
Strategy.

Established
Board approved
Sustainability ESG
strategy fully
embedded andaligned with overall
underwriting strategy,
annual business plan
process and risk
appetites.
Additional qualitative
Sustainability ESG
considerations areincluded as part ofbusiness planning.
Full awareness ofwhich exposures inexisting portfolio are
not aligned withsyndicates’
sustainable
insurances
framework; either
elected to non-renew
or are working with
the insured andsupporting theirtransition.

Advanced
•

•

•
•

•

•
•

Additional focus on
Sustainability ESG andproduct innovation
through new business.
Written guidance isprovided articulating
Sustainability ESG
approach alongside any
delegated authority.
Protocol for examining
data through establishedsystems.
Granularity of data used
is appropriate for theneeds and businessprofile.
Pricing underwriting
systems in place toreview whether
assumptions / data areappropriate from asustainability
perspective.
Policyholder engagement
strategy established.
Work underway todevelop credible
transition plans with
policyholders which posethe most material
environmental and social
ESG risks based on
syndicates’ Sustainability
ESG strategy.
15

Classification: ConfidentialLegacy
Reinsurance
Underwriting
Profitability© Lloyd’s 2024

Principle 1: Legacy Reinsurance
Underwriting Profitability
Updates for 2024 – RITC syndicates only
Summary of the change: As part of Lloyd's wider oversight enhancements for the legacy
reinsurance market, we have introduced an adapted Legacy Reinsurance Underwriting
Profitability Principle. This will enable us to assess capability across strategy, pricing,ongoing performance including expense management, and governance. We
communicated this change to relevant syndicates in market workshops during 2023. This
will apply to RITC syndicates only and should be attested to in March 2024 as part of the
Principles Board Attestation.
The full Principle and guidance can be found in the main Principles document.
Managing agents should ensure their strategy for underwriting legacy reinsurance
transactions is clear and that pricing assumptions are sufficiently robust, to ensure thesustainable run-off of acquired liabilities.
To support this, managing agents should ensure their syndicates:​1

Have a clear and robust medium to long term business strategy with clearly definedand understood underwriting risk appetite, giving consideration to existing legacy
reinsurance transactions on the balance sheet

2

Develop and execute legacy business plans which align with their business strategy

3

Not applicable

4Manage and control expenses in order to ensure they are appropriate for the businesswritten5

Not applicable

6

Have an effective pricing framework in place in order to set sustainable pricing for legacytransactions that will ensure the discharge of assumed liabilities within the assets
received with, and generated by, the assumed portfolio

7

Have robust governance processes in place to support legacy underwriting decision
making, with underwriting assumptions clearly articulated and understood by stakeholders
supported by proactive involvement and sufficient challenge by the wider functions

8

Not applicable17

Sub-principle numbering follows the Underwriting Profitability Principle

Classification: ConfidentialLegacy Reinsurance Underwriting Profitability
Managing agents should ensure their strategy for underwriting legacy reinsurance transactions isclear and that pricing assumptions are sufficiently robust, to ensure the sustainable run-off of acquired
liabilities.
LEGACY REINSURANCE UNDERWRITING PROFITABILITY
Have a clear and robust medium to long term business strategy with clearly defined and

1 understood underwriting risk appetite, giving consideration to existing legacy reinsurance

Risk Appetite

Strategytransactions on the balance sheet
Foundational

Established

Advanced•

Underwriting strategy is set
collaboratively withengagement and feedback
loops between the relevant
stakeholders•

Underwriting strategy outlines
a forward-looking plan
concerning the key elementsthat identify a target contract•

Regular horizon scanningtowards emerging risks is
considered and reflected within
the underwriting strategy•

The board has defined
underwriting risk appetitestatements. These are linked
to and contained within the
syndicate business plan•

Performance assessment for •senior management considers
adherence to risk appetite

Underwriting strategy isforward looking, allowing agile
management of the due
diligence process employed inunderwriting•

Risk appetite statements
reflect market level feedback
from Lloyd's and regulatory
concerns

18

Classification: Confidential

LEGACY REINSURANCE UNDERWRITING PROFITABILITY

Business Planning

2

Develop and execute legacy business plans which align with their business strategy.
Foundational

Established

Advanced•

Business plan aligns withthe syndicate's medium tolong term underwriting
strategy and risk appetite•

Monitoring allows
for identification of both
positive and adverse
variation to plan••

Business plan is kept
under review, with KPIs
monitored and reported tothe board at an appropriate
frequency••

Timely actions are taken
to address variances tobusiness plan, and root
cause analysis conducted
to fully
understand underlying
drivers

Suite of KPIs are kept
under review toconsider if
any changes are
required to the metrics
themselves or
any additions toensure early detectionof issues•

Regular review ofbusiness plan and
KPIs
incorporates latest
analysis fromother functions andpromotes consistency•

The underlying drivers are
fed back into the due
diligence process for future
underwriting

Thematic findings are
drawn out fromunderwriting operational
KPI monitoring. These
are fed back into the due
diligence process for
future underwriting withtraining in place toaddress gaps

19
Classification: Confidential

LEGACY REINSURANCE UNDERWRITING PROFITABILITY

Expense Management

4

Manage and control expenses in order to ensure they are appropriate for the business written.
Foundational

Established

Advanced•

Medium to long term
strategy in place tocontrol overall
net operating expense•

Monthly data and MI inplace to track position
against expected andaction taken to remediate
where required••

Internal expense policy
in place withappropriate thresholds
and referral points•

Forward looking
identification of potential
expenses necessary tosupportstrategic decision
making. Proactive action
taken tomanage expenses overmedium to longer term•

All aspects ofoperational expenditure
are understood andconsidered as part ofthe syndicate's
underwriting strategy•

Quarterly data and MI inplace to track position
against expected andaction taken to remediate
where required•

Administration expenses
are proportionate and areforecast in line withplanned underwriting
strategy

Real time tracking inplace to assess the
position of operating
expensesagainst expected withproactive measures
adopted toaddress actual andforecast variance

20
Classification: Confidential

LEGACY REINSURANCE UNDERWRITING PROFITABILITY

Pricing

6

Have an effective pricing framework in place in order to set sustainable pricing for legacytransactions that will ensure the discharge of assumed liabilities within the assets received
with, and generated by, the assumed portfolio
Foundational

Established

Advanced•

Experience based
pricing approach is used

•

•

•

Pricing policy andprocedure havebeen reviewed
and approved by theboard and are fully
documented

Resourcing allows formore in-depth analysis
feeding into the pricing
process, withforward looking views
feeding into assumptions•

The view of risk
is incorporated
into pricing at syndicate
level, such as
the impact of concentrati
on risk of the target
portfolio on the existing
portfolio. This is done on
a forward-looking basis•

Pricing decisions
and rationales
are captured
and analysed on an
ongoing basis foradjustments based on
the outturn of
the acquired business•

Pricing policy andprocedure arereviewed regularly
to ensure that they are up
to date with the current
experience of the
syndicate•

The parameters
employed in thedue diligence process
for underwriting
are consistent with, andsupport,the syndicate’s businessplan•

Resourcing is adequate
to conduct due diligence
to a standard that resultsin viable pricing of all
the transactions being
pursued by the syndicate

No
incremental guidance, Ll
oyd's will consult tofurther develop our view

21
Classification: Confidential

LEGACY REINSURANCE UNDERWRITING PROFITABILITY

Governance

7

Have robust governance processes in place to support legacy underwriting decision making,with underwriting assumptions clearly articulated and understood by stakeholders supported
by proactive involvement and sufficient challenge by the wider functions.
Foundational

Established

Advanced

•

•

•

•

•

•

Underwriting
governance framework isin place with reporting lines
and committee framework
definedNo binding bid is
made unless approved by
the appropriate
committee which includes
Independent Nonexecutive Directors
to ensure that it
is consistent with theinternal rate of return set
out in the syndicate’s
business plan
Any bid put before
the appropriate committee
is sufficiently detailed
to allow thatcommittee’s participants toensure that theassumptions used arein line with thesyndicate’s businessplan and reasonable
market expectations
A process is in place
to document whether
due diligence has
followed the approved
process and that document
is available to thetransaction approving
committee

The senior
management
have established aculture ofaccountability at alllevels of the
syndicate,including clear risk
control expectations
and a no blame
culture for reporting
underwriting issues

The board andsenior management
actively promote challenge
to underwriting including
the parameters andassumptions used

22
Classification: Confidential

Catastrophe
Exposure© Lloyd’s 2024

Principle 2: Catastrophe Exposure
Updates for 2024
Summary of the change: The structure of the Catastrophe Exposure Principle (applies to
Nat Cat and Non Nat Cat) has been revised to align the information required frommanaging agents directly with Lloyd’s review approach. For 2024, we have converted the
10 previous “components” of the 5 sub-principles into a new set of 10 sub-principles(applies equally to Nat Cat and Non-Nat Cat). The sub-principle wordings have beenrevised for clarity but there is no change to the Principle wording or underlying guidance.
Previous Sub-Principles

Previous
Components

New sub-principles for 2024

1) Manage catastrophe
exposure in line with agreed
cat risk appetites​

Risk Appetite

1) Manage catastrophe exposure in line with
their agreed risk appetites and tolerances.

Data andTools

2) Employ appropriate tools to support
effective and efficient exposure data capture,
management and use.

Exposure
Monitoring andReporting3) Adopt a robust risk-based framework for
exposure quantification and monitoring, tosupport downstream decision making

Resourcing

4) Have the teams and expertise in place tomeet the business needs, including strategic
projects, regular deliverables and researchand development

Modelmethodology5) Define and maintain an appropriate catview of risk methodology

Model
Validation

6) Implement appropriate risk-based validationof the cat view of risk

Modelcompleteness4) Representation ofcatastrophe risk, in the internal
model, is complete, reflects all
possible sources of loss and isused effectively by wider
business functions​​

7) Maintain a materially complete
representation of cat in the syndicate view ofrisk

Model Change

8) Adopt a robust risk-based framework for
managing changes to cat view of risk andexposure management methodologies

Model use andcapitalmodelling9) Maintain consistent understanding, use andcontinual development of cat view of risk
outputs5) Have robust governanceand oversight of risk
aggregations​​

Governanceand oversight10) Have robust governance and oversight of24risk aggregations

2) Employ data standards, risk
quantification tools, controls,
expertise, andreporting frameworks which
are appropriate to their risk
profile​3) Adequately justify andvalidate methodology andassumptions, including
expert judgements​

Classification: Confidential

Operational
Resilience© Lloyd’s 2024

Principle 12: Operational Resilience
Updates for 2024
Summary of the change: The Operational Resilience Principle has been revised, with theintroduction of four levels of expected maturity (previously all managing agents expectedmaturity was Foundational) and revised sub-principle wording and guidance.
Principle (unchanged):Managing agents should maintain robust and resilient operations, embedding cyber
resilience and effective third-party risk management.

Previous Sub-Principles

New sub-principles for 2024

1) Prioritise resilience of the most important
services; embedding appropriate
governance for operational resilience into
their businesses and prioritising recovery of
Important Business Services within
identified and tested impact tolerances.

1) Operate a robust operational resilience
framework

2) Invest in their operational resilience,
including their control environments, so thatthe risk of a future event causing harm tocustomers or threatening the managing
agent’s viability is mitigated2) Maintain oversight of operational
resilience through appropriate governanceprocesses and ​risk and control
environments

3) Embed cyber resilience into operations:Managing agents must protect theirinformation systems, processes, people
and data from external or internal
compromise to prevent harm to customers,
loss of data, contagion and/or reputational
damage to the wider Lloyd’s market.

3) Maintain appropriate cyber resilience

Given the extensive updates to the guidance within the maturity matrix and the additionof new levels of expected maturity, a comparison or mapping is not provided. However,the following slides contain the previous guidance for comparison against the revised
Principles document

26

Classification: Confidential

Previous version

Principle 12: Operational Resilience
Managing agents should maintain robust and resilient operations, embedding cyber resilience andeffective third-party risk management​.

OPERATIONAL RESILIENCE

1 Prioritise resilience of the most important services; embedding appropriate governancefor operational resilience into their businesses and prioritising recovery of Important Business
Services within identified and tested impact tolerances.
Foundational
•

•

•

•
•

•

EstablishedManaging agents can evidence a•roadmap for embedding
operational resilience into thebusiness within regulatory
timelines•
A system of governance andreporting to the board is in place tomonitor managing agents’operational resilience.
•
Self-assessment documented for
all Important Business Services ofthe business, and approved byboard by 31 Mar 2022 andannually thereafter or when there
is a material change to an
Important Business Service.
Severe but plausible scenarios
identified, recovery plans andworkarounds are in place
Managing agents can evidence anapproach for mapping that gives
the business a reasonable level ofconfidence that all criticalresources are identified
Managing agents have developed
policy and processes for managing
risks associated with key suppliers
and outsource providers, andconsider substitution

Advanced

Identified Important Business •Services and tested that they
can recover within impact
tolerances
Scenario libraries consider
contagion in testing theimpact on multiple Important
Business Services
Managing agents canevidence an approach formapping that gives thebusiness a granular level ofdetail that all criticalresources are identified

No incremental guidance

27

Classification: Confidential

Previous version
Principles

2 Invest in their operational resilience, including their control environments, so that the risk of afuture event causing harm to customers or threatening the managing agent’s viability is
mitigated.
Foundational••

EstablishedManaging agents learn lessons•
from incidents and tests.
Managing agents prioritise lessons
learned in their investment plans.

••

AdvancedManaging agents can•evidence prioritisation of theirchange programmes toembed operational resilienceby design within their
Important Business Services
Participate in market wide
scenario exercises and invest
in vulnerabilities
Managing agents evidence a
wider range of testing
approaches embedded into
their businesses to identify
vulnerabilities

No incremental guidance

28
Classification: Confidential

Previous version
Principles

3 Embed cyber resilience into operations: Managing agents must protect their information

systems, processes, people and data from external or internal compromise to prevent harm tocustomers, loss of data, contagion and/or reputational damage to the wider Lloyd’s market.

Cyber Information Systems & Reporting•

Data Protection and GovernanceFoundational

•

•

•

•

•

•
•

EstablishedEstablish and implement an•approach to safeguarding
the availability, integrity andconfidentiality of information
which considers the nature of theinformation in question
Notwithstanding any requirement
to report a Cyber Incident tocomply with any law or
regulation, Material Cyberincidents must be reported
to Lloyd's via their designatedAccount Manager as soon as
they become aware of the same
Following reporting, managing
agents shall engage inconstructive discussions
with their designatedAccount Manager and take such
steps as are reasonable both tomitigate the effects of
the Cyber Incident and to reducethe chances of its reoccurrence.

No incremental
guidance

Notwithstanding any regulatory•
requirement to report a Personal
Data Breach, Personal Data
Breaches must be reported to
Lloyd’s via the designatedAccount Manager as soon as
they become aware of the same
and within 72 hours at the latest.
Engage in constructive
discussions with the Lloyd’s
Account Manager on Personal
Data Breaches and takereasonable steps to mitigate
effects and reduce chances of areoccurrence.
Director in place withaccountability for oversight of thedata governance framework with
an appropriate data governancepolicy in place.
Clear roles and responsibilities
are in place for data
management.
Appropriate policies andprocedures in place to allow
timely recording and productionof data to ensure data returns areappropriate, accurate, complete
and submitted on time.

No incremental
guidance

Advanced

•

•

•

•

Information systems should
be fully documented and set out
which information is to be shared,by whom, and when.
Documentation allows
for information to flow up and down
hierarchy levels as well as
horizontally between different
business units where appropriate.
Demonstrate there is clear
understanding of how all
information systems are linked,
with controls addressing data
integrity issues.
There is clarity and transparency
over staff access to
information systems for providing
input from and to their areas of
responsibility. In addition, there isclarity on who the relevant
personnel are that need to havepassive access to the system as toretrieve data for the proper
discharge of their duties.

No incremental guidance

Maturity Matrix
Classification: Confidential

29

Previous version
Principles

3 Embed cyber resilience into operations: Managing agents must protect their information

Cyber Governance & Identification

systems, processes, people and data from external or internal compromise to prevent harm tocustomers, loss of data, contagion and/or reputational damage to the wider Lloyd’s market.
Foundational

Established

Advanced

•

•

•

•

•

•

•

•

Establish and maintain acybersecurity strategy andframework tailored to specificcyber risks and appropriately
informed by international,
national and industry
standards and guidelines
Ensure that the board isaccountable for the
cybersecurity strategy,
endorses the cybersecurity
framework and sets thetolerance for cyber risk
Conduct regular reviews ofcyber resiliencecapability to highlight any
material gaps and/or areas for
improvement
Identify key services,
processes and underlying
systems (networks,
applications anddata) including third-party
dependencies, prioritise inorder of importance andassess respective cyber risks.
Taking a risk-based approachin identifying those services,
processes and underlying
systems (networks,
applications and data) thatare critical
Assessment of the current
internal and external threats,
followed by determination of
the likelihood and impact of acyber compromise or data
breach on those criticalservices, andthen development of a set ofholistic controls in a
proportionate and costeffective way.

No incremental guidance

•

•

•

•
•

•

Deep dives on specificcybersecurity related topics(e.g. undertaken by risk/
second-line functions inconjunction with operational/
first-line departments toimprove general awareness &understanding of cyber acrossthe business)
Conduct regular reviews, atleast annually, of thecybersecurity framework
against industry standards tohighlight any material
gaps/areas for improvement
and to use the output toformulate the IT strategic plan
Assurance activities are visibly
joined up across the three linesof defence
A good level of awareness andunderstanding of the work
being undertaken across theother lines of defence
An understanding of the cyberskills/resourcing within theother lines of defence.
Comprehensive program ofoversight by the third line ofdefence, including:
IT audits to oversee areas withheightened cyber risk;
specific proportion of IT audit
resource dedicated toundertaking cyber security
related reviews or,alternatively, a dedicated teamof external support/experts
Representation at forums
responsible for oversight ofcyber.

30
Classification: Confidential

Previous version
Principles

3 Embed cyber resilience into operations: Managing agents must protect their information

systems, processes, people and data from external or internal compromise to prevent harm tocustomers, loss of data, contagion and/or reputational damage to the wider Lloyd’s market.

Cyber Protection

Foundational
•

•

•

•

Established•Obtain Cyber Essentials
accreditation on an annual
basis to reduce the operationalrisk of common cyber-attacks
Implement regulatory
mandatory cyber security anddata protection training, atleast annually, for all staff andhave a cyber security and dataprotection awarenessprogramme in place
Ensure appropriate security
testing takes place on all new
systems and any findings are
remediated in line with the risk
appetiteHave other appropriate technic
al and non-technical controls inplace to protect key services,
processes and underlying
systems

No incremental guidance

Advanced••

Obtain Cyber Essentials Plusaccreditation which offers ahigher level of assurance
through the external testing of
the cyber security approach.
Findings from such security
testing are remediated in linewith risk appetite and resolved
before the ‘Go-Live’ of thesystem in question.
Comprehensive technical andnon-technical controls are inplace to protect their all
services, processes, systems
and data. These could include
but are not limited to:• Robust identity,
authentication and accessmanagement controls toensure that privilege accessto systems are more tightly
controlled, principles ofleast privilege andsegregation of duties
are applied and multi-factor
authentication is deployed• Security requirements areembedded into businessprocess and system design• Vulnerability management
controls to identify andremediate vulnerability insystems and applications.

31
Classification: Confidential

Previous version
Principles

3 Embed cyber resilience into operations: Managing agents must protect their information

Foundational

Established

Advanced

Cyber third-party management•

Policy and processes in place
for managing cyber risks
associated with key suppliers,
outsource providers,coverholders and TPAs.

•

No incremental guidance•Documented process for
managing the cyber resiliencerisks associated with all
external suppliers which isincorporated into the broader
procurement led suppliermanagement process
and involves inputs frominformation security, dataprotection and business
continuity teams/functions at
key stages. Typical activities
could include:• Categorising third parties
and suppliers in order ofimportance or risk profile,for example: providers of
key business services,
processors of sensitive data
• Agreeing security
arrangements with third
parties and suppliers andassessing their security
capabilities, using a riskbased approach• Assessing changes to theinformation risk profile, that
may result from theonboarding of a new third
parties or suppliers.

Cyber detection

systems, processes, people and data from external or internal compromise to prevent harm tocustomers, loss of data, contagion and/or reputational damage to the wider Lloyd’s market.

•

Appropriate controls to identify •the occurrence of acybersecurity event in a timely
manner (e.g. throughidentifying anomalies andevents, implementing security
continuous monitoring anddetection processes).
Monitoring is performed on
both incoming (e.g. web, email
or USB) traffic and out-goingchannels to ensure the risk ofa successful attack
is minimised.

No incremental guidance•

The ability to detect anintrusion early and take adefence-in-depth approach byinstituting multi-layered
detection controls covering
people, processes, andtechnology, with each layer
serving as a safety net forpreceding layers.
Monitoring and detection
capabilities in place to facilitate
its incident response process
and support informationcollection for the forensic
investigation process.

•

•

32
Classification: Confidential

Previous version
Principles

3 Embed cyber resilience into operations: Managing agents must protect their information

systems, processes, people and data from external or internal compromise to prevent harm tocustomers, loss of data, contagion and/or reputational damage to the wider Lloyd’s market.

Cyber response and recovery

Foundational••

Cyber information sharing

•

•

•

Established
Response and communication • No incremental guidanceplans for use in the event of a
Cyber Incident, with these plans
subject to review andimprovement as appropriate
Plans and procedures in place
to recover froma Cyber Incident, with suchrecovery arrangements
designed to enable that
operations are safely resumed
with a minimum of disruptions
to policyholders andbusiness operations
Test and exercise response andrecovery plans and proceduresat appropriate intervals.

Advanced• No incremental guidance

Engage in the timely sharing of •reliable, actionablecybersecurity information(which could
include threats, vulnerabilities,
incident
response, recovery and lessons
learnt)with internal andexternal stakeholders
Attacks and threat intelligence
are used to broaden
understanding of the cyberthreat within the business.

•

No incremental guidance•

Active members of the LMA
CISO Community andpotentially have a seat at the
CISO committee.
Intelligence from threats,
incidents and breaches is
actively shared with Lloyd's andacross the population of othermanaging agents (in a secureway) potentially via the LMA
CISO Community.

33
Classification: Confidential