ISSUES PAPER
APPROACHES TO GROUP CORPORATE
GOVERNANCE; IMPACT ON CONTROLFUNCTIONSOCTOBER 2014

About the IAISThe International Association of Insurance Supervisors (IAIS) is a voluntary membershiporganisation of insurance supervisors and regulators from more than 200 jurisdictions innearly 140 countries. The mission of the IAIS is to promote effective and globally consistentsupervision of the insurance industry in order to develop and maintain fair, safe and stable
insurance markets for the benefit and protection of policyholders and to contribute to global
financial stability.
Established in 1994, the IAIS is the international standard setting body responsible fordeveloping principles, standards and other supporting material for the supervision of theinsurance sector and assisting in their implementation. The IAIS also provides a forum forMembers to share their experiences and understanding of insurance supervision andinsurance markets. In addition to active participation of its Members, the IAIS benefits from
input in select IAIS activities from Observers representing international institutions,professional associations and insurance and reinsurance companies, as well as consultants
and other professionals.
The IAIS coordinates its work with other international financial policymakers andassociations of supervisors or regulators, and assists in shaping financial systems globally.
In particular, the IAIS is a member of the Financial Stability Board (FSB), founding member
and co-parent of the Joint Forum, along with the Basel Committee on Banking Supervision(BCBS) and the International Organization of Securities Commissions (IOSCO), member of
the Standards Advisory Council of the International Accounting Standards Board (IASB), andpartner in the Access to Insurance Initiative (A2ii). In recognition of its collective expertise,
the IAIS also is routinely called upon by the G20 leaders and other international standard
setting bodies for input on insurance issues as well as on issues related to the regulationand supervision of the global financial sector.

About IAIS Issues Papers
IAIS Issues Papers provide background on particular topics, describe current practices,
actual examples or case studies pertaining to a particular topic and identify related
regulatory and supervisory issues and challenges. Issues Papers are primarily descriptive
and not meant to create expectations on how supervisors should implement the supervisory
material. Issues Papers often form part of the preparatory work for developing standards andmay contain recommendations for future work by the IAIS.

This paper was prepared by the Governance Working Group in consultation with IAIS
Members and Observers.
The publication is available free of charge on the IAIS website (www.iaisweb.org).
© International Association of insurance Supervisors 2014. All rights reserved. Brief excerpts
may be reproduced or translated provided the source is stated.

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 2 of 32

Issues Paper on Approaches to Group Corporate GovernanceContents
Terminology used in the Issues Paper .................................................................................. 4
1.
Introduction .................................................................................................................. 5
1.1. Background and objectives of the Issues Paper .................................................. 5
1.2. Relationship of the Issues Paper with ICPs and ComFrame ................................ 5
2.
The Corporate governance framework, structures and models .................................... 6
2.1. Governance approaches and organizational structures ....................................... 6
2.2. Focus on governance within centralized and decentralized models ..................... 7
2.3. Legal structures and management structures ...................................................... 83.
Key characteristics relevant to good governance in more centralized and more
decentralized groups.................................................................................................... 93.1. Roles and key players within the corporate governance of an entity .................... 93.2. Checks and balances within a group ................................................................. 11
3.3. Key characteristics ............................................................................................ 13
3.4. Industry practice relating to governance models ................................................ 14
Example 1: more decentralized model .................................................................... 14
Example 2: collaborative model – in between centralized and decentralized ........... 14
Example 3: more centralized model ......................................................................... 15
Example 4: more decentralized conglomerate with a more centralized insurer holding
company.................................................................................................................. 15
Example 5: more centralized insurer ....................................................................... 16
Example 6: hybrid mutual group .............................................................................. 16
4.
How challenges to good governance and control within groups can be addressed .... 17
4.1 Challenges in a more centralized and in a more decentralized group ................ 18
4.2. Setting objectives and strategies for achieving those objectives of the group(including setting risk appetite) .......................................................................... 21
4.3. Appropriate allocation of oversight and management responsibilities ................ 23
4.4. Policies and processes at the group and entity level ......................................... 24
4.5. Risk management and compliance .................................................................... 25
4.6. Control Functions – Risk Management, Compliance, Internal Audit, Actuarial ... 27
5.
Supervisory review and cooperation .......................................................................... 28
6.
Conclusions ............................................................................................................... 30

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 3 of 32

Terminology used in the Issues Paper
Generally, capitalized terms used in this Paper are defined terms in the IAIS Glossary.
For convenience some of those terms are included here as well as other more generalterms defined for the purposes of this paper:a) "Board" means the Board of Directors of any entity within the group, and may becomprised of both executive and non-executive members who fulfil the oversightand management roles within the entity; 1b) "ComFrame" means Common Framework for the Supervision of Internationally
Active Insurance Groups;c) "Control Functions" mean properly authorised functions, whether in the form of aperson, unit or department, serving a control or checks and balances function
from a governance standpoint and which carry out specific activities including risk
management, compliance, actuarial matters, and internal audit; 2d) "Entity" means "legal entity";e) "Governance" means "Corporate governance" (systems, such as strategies,
policies, processes and controls, through which an entity is managed andcontrolled); 3f)"Group" means "insurance group"; 4g) "Group level" means that the roles and key players of the group will becentralized somewhere within the group. The term ‘group level’ does notnecessarily mean the legal entity at the level of the head of the group. EspeciallyGroup Control Functions could be placed within an entity anywhere else in thegroup;h) "Group-wide governance" means the governance of the head of the group andthe group-wide application of the group governance framework to all material
activities and entities of the group; 5i)"Group-wide supervisor" means the supervisor(s) responsible for promoting
effective and coordinated supervision of an insurance group including
coordinating the input of insurance legal entity supervisors in undertaking thesupervision of an insurance group on a group-wide basis, as a supplement toinsurance legal entity supervision; 6j)"IAIG" means Internationally Active Insurance Group;k) "Key persons in controls functions" means persons responsible for heading
Control Functions; 7l)"Model" means a more centralized or a more decentralized model; andm) "Senior management" means the individuals or body responsible for managing
the business on a day-to-day basis in accordance with strategies, policies andprocedures set out by the Board. 8
1

See IAIS Glossary and ICP 7, Introductory Guidance 7.0.5 and 7.0.6
See IAIS Glossary.
3
See IAIS Glossary.
4
Definition under review, to be inserted in IAIS Glossary once adopted.
5
Joint Forum Principles for the supervision of financial conglomerates: Explanatory comment 10.3.
6
See IAIS Glossary.
7
See IAIS Glossary.
2

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 4 of 32

1. Introduction
1.1. Background and objectives of the Issues Paper
1. This Issues Paper illustrates the different approaches to governance structures of
insurance groups – whether more centralized or more decentralized – and analyses
the various challenges such structures can present as well as possible practices toaddress these challenges.
2. The need for this paper arose due to the growing awareness of the variety of
approaches to governance adopted within Insurance groups, and the different impact
and demands those approaches can have on Control Functions which form a key
element of the corporate governance framework of the group. Irrespective of thegovernance approach chosen, the sound and prudent management and oversight of agroup through its corporate governance framework is a fundamental requirement thatapplies to any Insurance group.
3. The objectives of this Issues Paper are to create awareness for insurers andsupervisors of the challenges of centralized and decentralized governanceapproaches and possible solutions for these challenges, which should be taken into
account when setting up and assessing the corporate governance framework of an
Insurance group. For that purpose the Issues Paper:a) identifies, to the extent possible, key characteristics relevant to good governancein different models;b) identifies challenges or risks to good governance arising from more centralized ormore decentralized models adopted within an Insurance group, including theimpact a particular model adopted within a group can have on the effectivenessof its Control Functions;c) provides practices to insurers and supervisors which could help to achieve, withindifferent models, the outcomes intended by applicable standards and objectivesof good governance. These suggested practices should be in the context of theaims of an Issues Paper and not be regarded as new standards. 9

1.2. Relationship of the Issues Paper with ICPs and ComFrame
4. The Insurance Core Principles (ICPs) which are most relevant to the subject of theIssues Paper are ICPs 7 and 8. ICP 7 requires insurers to establish and implement a
corporate governance framework with the aim of ensuring sound and prudent
management and oversight of the insurer’s business and to protect the interests ofpolicyholders. ICP 7 standards identify qualitative requirements that should be met (ina proportionate manner 10 ) by an insurer with respect to its corporate governanceframework. The key aspects of these are: policies that set and oversee theimplementation of the strategy and objectives of the insurer; appropriate allocation ofoversight and management responsibilities, including responsibility and accountability
at the group and entity level as relevant; appropriate systems and functions for risk
management and overall internal controls; and clear channels of communication,
including lines of reporting between Boards and Senior Management within a group.

8

See IAIS Glossary.
See explanation of IAIS Issues Paper on page 2.
10
Proportionality is included in the Introductory Guidance to ICP 7 (Guidance 7.0.4).
9

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 5 of 32

The different aspects of the corporate governance framework support and enhance
the ability of the Board of Directors, Senior Management and Key Persons in Control
Functions to fulfil their respective obligations and/or tasks under the corporate
governance framework.
5. ICP 8 focusses on the qualitative elements relating to risk management and internal
control systems and functions. It requires “an insurer to have, as part of its overall
corporate governance framework, effective systems of risk management and internal
controls, including effective functions for risk management, compliance, actuarial
matters and internal audit”. Its guidance provides special considerations for insurers
within groups, such as groups having and implementing group-wide governancepolicies for their subsidiaries. 11
6. In addition to ICPs 7 and 8, other ICPs relevant to approaches to group corporate
governance include ICP 23 12 , which deals with the scope of and supervision ofgroups, and ICP 25, which deals with supervisory cooperation and coordination. 13
7. ComFrame builds upon the ICPs and elaborates on the requirements and guidance
currently set out in the ICPs, which generally apply on both a legal entity and groupwide level, to IAIGs. As sound governance of IAIGs is a key element of ComFrame,
ComFrame expands on the ICP requirements to such groups in a comprehensive
manner, covering both qualitative and quantitative measures that are needed toaddress risks to sound and prudent governance arising within group structures.

2. The Corporate governance framework, structures andmodels2.1. Governance approaches and organizational structures
8. The corporate governance framework is intended to effectively support and enhance
the ability of key players (Board, Senior Management and Control Functions) to
manage the business of the insurance group soundly and prudently. It can beorganized through using varying governance approaches. The elements which
generally determine the way in which the corporate governance framework within an
insurance group is arranged, are:a) the degree of authority or autonomy given to the group level of the insurancegroup and to different entities within the group;b) the allocation of responsibilities and accountabilities of key players within theinsurance group;c) the functions at different levels of the insurance group, and their relationship toeach other and to the group.

9. The governance approaches should be differentiated from the "organizational
structure" 14 of a company or insurance group. The latter is not the subject of thisIssues Paper. Insurance groups can use different organizational structures: one
insurance group may choose to organize itself as stock or shareholder
company, whilst others may choose mutual or other forms of incorporation or
11

See ICP 8, Introductory Guidance 8.0.8.
ICP 23 is undergoing revisions during the drafting of this Issues Paper.
13
There may be other parts of the ICPs which are relevant. Therefore, the parts referred to here should not be
considered as necessarily comprehensive.
14
The term "organizational structure" is used in this Issues Paper to cover the various terms used in the ICPs.
ICP 4, Standard 4.3 uses the terms "corporate or group structure" and ICP 8, Introductory Guidance 8.0.8 uses
"organizational or operational structures" (referred to here as "management structures").
12

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 6 of 32

association. In doing so, insurance groups may choose to have a simple structure (i.e.
only a parent and a subsidiary) or to arrange a very complex structure with a holding
company and many subsidiaries and business lines. Another organizational choice isto adopt a centralized or decentralized structure. The level within insurance groups atwhich governance is organised and by whom decisions are made may differ between
groups depending upon the structures adopted. It is, however, vital for the insurancegroup to have an effective corporate governance framework.

2.2. Focus on governance within centralized and decentralized
models10. This Issues Paper analyses how good governance can be ensured when an
insurance group pursues a more centralized model or a more decentralized model.
For the purposes of this Issues Paper approaches to group governance withininsurance groups are only characterized as being either more centralized (a "topdown" model) or as more decentralized (a "bottom-up" model). In practice few
insurance groups will adopt in their entirety a purely centralized or a purely
decentralized model and will, in practice, follow a hybrid approach somewhere
between the two extremes. Sometimes both more centralized and more decentralized
approaches are used within an insurance group. However, the two extremes provide
a useful basis to illustrate these approaches and to analyse the governancechallenges faced by insurance groups.
11. The assessment of the centralized or decentralized character of the insurance groupis based on judgment of the characteristics of the group. The main characteristic of
the more centralized approach is that there is more comprehensive authority
available to the Board and Senior Management at the group level 15 . It could be
expected that there is more comprehensive direction by the group level of theinsurance group, including centrally set overall business objectives of the insurancegroup; strategies to achieve those objectives and common policies and procedures.
This allows for the development of a common and consistent approach across theinsurance group. Consistency within the insurance group could be further enhanced
by a group risk appetite; a common risk and compliance culture; and centralized
control functions at the group level of the insurance group. 16 A variation of acentralized model is where a group sets its overall objectives and strategies at thegroup level but individual entities are given considerable latitude about how those areput into practice.
12. Within a more decentralized approach greater autonomy and authority will rest with
the Boards and Senior Management at the entity level. It could be expected that there
is more comprehensive direction at entity level, including the setting of businessobjectives of the entity; strategies to achieve those objectives and policies andprocedures at the entity level. This allows for setting appropriate business objectives
and strategies that take full account of the relevant business needs of entities andtherefore would be able to respond quickly to changes in local conditions. Alignment
with the local perspective would be further enhanced by setting the risk appetite, andrisk and compliance culture at the entity level and by having extensive responsibilities
for control functions of entities. Decentralization at the extreme would be wheregroup-wide objectives and strategies are little more than an amalgamation of theobjectives and strategies of the individual entities within the group.
15

The term "group level" means that the roles and key players of the group will be centralized somewhere within
the group. Therefore the term "group level" does not necessarily mean the legal entity at the level of the head of
the group. Especially group control functions could be placed within an entity anywhere else in the group.
16
A centralized approach does not presuppose that the central level of the group has been granted full control
over each entity within the group.
IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 7 of 32

13. However, as noted before in paragraph 10, many varieties between the completely
top-down and bottom-up models exist. The degree of centralization or decentralizationof or within a group will be affected by factors such as the jurisdictions in which theentities are located 17 , the business model of the group, 18 the homogeneity of thegroup, as well as the individual expertise available at the respective levels, particularly
among Board members, Senior Management and Key Persons in Control Functions.
As these factors can be highly variable in practice, it is unlikely that purely centralizedor purely decentralized models would exist in practice. As a consequence, groups
adopt hybrid structures between the spectrum of pure centralization and puredecentralization.
14. Most organizational structures can accommodate both models. For example, aninsurance group using the cooperative or mutual structure could have a centralized or
decentralized approach to its governance. However, when branches are set up within
an insurance group, this will usually be done with the aim to have a more centralized
approach. Branches are legally not separate entities and critical governance andoversight functions of the branch are generally located in the head office. Although in
general the representative of a branch in a host jurisdiction will perform management
functions and/or represents the insurer with regard to the branch’s operations,generally the representative will not have the same legal obligations as those of theBoard Members in terms of governance. 19 Most jurisdictions do not require a branch
to have its own Board because a branch is not a legal entity. 20
15. This Issues Paper is based on the premise that regardless of the particular model aninsurance group adopts, good governance is achievable, provided the challenges orrisks to good governance arising from the particular model used are effectively
addressed. This is in alignment with the ICPs, which provide guidance for insurers
within groups 21, but do not include specific governance requirements relating to thestructure of groups. No specific model is therefore prescribed. ComFrame, like the
ICPs, is not intended to require a specific model of governance within an IAIG. It
explicitly states that "IAIGs do not have purely centralized or decentralized structures
and ComFrame does not favour any particular structure but sets out outcomes to beachieved". 22 ComFrame expects that an IAIG’s governing body will have some degreeof oversight of the group as a whole and will have in place group-wide objectives,
strategies and policies that it will be able to monitor and enforce. How these outcomesare achieved in practice will depend on the approach to governance used by the IAIG.
16. Therefore, this Issues Paper should not be read as advocating any preference for a
specific model. Instead, the analysis undertaken is designed to identify how, within thepossible variables that can prevail in these models, good governance standards canbe effectively achieved. This recognizes that each model has not only benefits, butalso its own challenges and risks.

2.3. Legal structures and management structures
17. This Issues Paper presupposes that an insurance group 23 will be composed of anumber of entities. These will each have a separate legal personality and may takedifferent forms as allowed for by the legal requirements of the jurisdiction(s) in which
they operate. References throughout the paper to governance arrangements
17

E.g. in some jurisdictions, groups have limited authority over subsidiaries.
E.g. insurance only or mixed financial group; life insurance and/or non-life insurance; and geographical spread.
19
See Issues Paper on supervision on cross-border operations through branches, October 2013, para 34.
20
IAIS Issues Paper on supervision of cross-border operations through branches (October 2013), par 33-35.
21
See ICP 7, Introductory Guidance 7.0.3, and ICP 8, Introductory Guidance 8.0.8.
22Cornerstones of ComFrame, section 5.
23
See definition of "group" in section 2.
18

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 8 of 32

(including to the role of Boards and Control Functions) will be to the arrangements
within entities. In many cases insurance groups will consist of both regulated
insurance entities and unregulated entities (such as claims handling and policy
administration companies) and we would expect that the governance arrangements of
the insurance group will extend to these entities. 24 Supervisors will generally focus
their work at the entity level. However, many insurance groups will have somemanagement activities undertaken by business unit/area or line of business. Suchmanagement structures may cut across entity boundaries. It is important that both
insurance groups and their supervisors are aware of the risks that might arise fromany division of authority between entity and business line management and that
insurers ensure that such risks are adequately mitigated. 25

3. Key characteristics relevant to good governance inmore centralized and more decentralized groups
18. This section first describes the role of effective checks and balances in the corporate
governance framework of an individual entity and the key players that perform theseroles. It goes on to describe the application of the model of an individual entity in thecontext of a group, in order to identify some key characteristics for good governanceof groups. Finally this section provides several examples of how groups can beorganised in a more centralized or more decentralized way.

3.1. Roles and key players within the corporate governance of anentity19. Governance refers to systems through which an entity is managed and controlled.
Such systems enable the insurer to be flexible and transparent; to take appropriate
and timely decisions and to ensure that powers are not unduly concentrated. 26 To that
end, the systems provide for checks and balances within an individual entity, which
are achieved by a division of roles. There are four main roles which should beappropriately separated: 27 strategy and direction (setting and implementing ofobjectives and strategies for achieving those objectives, risk appetite and generalpolicy); oversight (supervising Senior Management); day-to-day management(including setting and implementing policies and procedures); and independent
controls (risk management, other control functions and internal audit). It is recognizedthat while there may be various degrees of separation and/or cooperation among the24

Joint Forum Principles for the supervision of financial conglomerates, Principle 10: Supervisors should seek toensure that the financial conglomerate establishes a comprehensive and consistent governance frameworkacross the group that addresses the sound governance of the financial conglomerate, including unregulated
entities, without prejudice to the governance of individual entities in the group.
25
See also ICP 8, Introductory Guidance 8.0.8: Groups may adopt different types of organisational or operational
structures (referred to here as "management structures"), sometimes centralized, and sometimes decentralized.
The supervisor should take the management structure of the group into consideration in evaluating its
governance. Particularly when the management structure differs from the legal entity structure, it is not sufficientto address governance or risk only at the legal entity level. In such a case, it is important that appropriate
governance exists across the group and that risks are being identified, assessed, monitored and managed
appropriately also on a group-wide basis.
26
ICP 7, Introductory Guidance 7.0.2: ‘Corporate governance is often referred to as a system of “checks andbalances”. This recognises that an insurer has to be flexible and responsive to developments affecting its
operations in making timely decisions, while at the same time being transparent and having appropriate systems,
controls and limits to ensure that powers are not unduly concentrated and are used in the best interest of theinsurer as a whole and its stakeholders.’
27
ICP 7, Standard 7.2 and Guidance 7.2.1
IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 9 of 32

different roles, there are certain key principles which underlie effective checks andbalances to promote good governance.
20. Checks and balances are premised on the roles to be performed by different key
players, particularly the Board as a whole, Senior Management, and Key Persons inControl Functions. 28 Within such a structure:a) the role of setting or ultimately approving the strategy and giving direction isallocated to the Board 29;b) the role of oversight of the Senior Management to ensure that they carry out theday-to-day management of the insurer in accordance with the aforementioned
objectives and strategies is also attributed to the Board; 30c) day-to-day management of the business is the role of Senior Management; andd) Control Functions perform the role of independent control. They have a numberof different functions. In the case of the head of risk management, the role is to
identify and then mitigate, remove or otherwise manage the risks to which theinsurer is exposed. In the case of the head of compliance, the role is to monitor
and address any gaps in compliance. In the case of internal audit, the role is toprovide assurance that internal systems and controls operate as intended. Theinternal auditor has the additional responsibility of periodically auditing orreviewing other Control Functions. In the case of the actuary, the role is toprovide assurances relating to the adequacy of provisioning.
21. In the diagram below the different roles and the interaction between those roles in an
individual entity are shown.
Blue arrow: input (e.g. day-to-day management gives input to the Board for the
strategy)
Green arrow: direction (e.g. the Board gives direction to Internal Audit function)
Red arrow: oversight / control (e.g. the Board oversees the day-to-day management
and, the Control Functions provide control over the business).

28

ICP 7, Guidance 7.2.2 and ICP 8, Guidance 8.1.16.
It is understood that local legislation, culture and practices differ with regard to governance of groups.
Accordingly, the analyses and recommendations in the paper may need to be read in the context of local law,culture and procedures. For example, in some jurisdictions, Senior Management traditionally performs functions
that the Board does in other jurisdictions.
30
ICP 7
29

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 10 of 32

Strategy and Direction(Board)Day-to-day
Management (Senior
Management)

Oversight(Board)Independent Control(Control Functions)3.2. Checks and balances within a group
22. Group-wide governance not only involves governance at the group level, but also
applies group-wide to all material activities and entities of the group. 31 A group may
comprise many entities and organise its business through business lines. There canalso be different business sectors within a group and the different entities may havedifferent or even conflicting interests from the group level. This inherent complexity
requires a balance of powers and a balance of interests at each level of the group. 32
The corporate governance framework should ensure that this balance is achieved. To
achieve this aim, the four roles noted above and the division of responsibilities
between the key players will have to be arranged at the group level as well as at theentity level in a manner that does not detract from the effectiveness of the relevantroles. 33
23. Within a simplified centralized model, checks and balances that would need to be built
into the group corporate governance framework would need to reflect the structure set
out in the diagram below.
Blue arrow: input (e.g. Board at entity level give input to the Board at the group levelon strategy and direction)
Green arrow: direction (e.g. the Board at the group level gives direction to the Board
at entity level)
Red arrow: oversight / control (e.g. group Control Functions 34 oversee the entity
Control Functions).

31

Joint Forum Principles for the supervision of financial conglomerates: Explanatory comment 10.3.
ICP 7, Introductory Guidance 7.0.8
33
See also De Vuyst, Internal Governance bij financiële conglomeraten, para. 927.
34
As mentioned in the definition of ‘group level’ on page 4, the Group Control Functions are not necessarily
placed at the head of the group.
32

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 11 of 32

Group levelOversight

Group level
Strategy andDirection

Entity Strategy
and Direction

EntityOversight

EntityManagement

Entity Control
FunctionsGroup level
Management

Group level
Control
Functions

24. However, in practice the organizational structure of a group, and therefore thecorporate governance framework, can be more complex and contain variations due toa number of reasons:a) First, the diagram above is based on a simplified centralized model. As noted
before, groups usually adopt hybrid structures, in which the allocation of roles
and responsibilities, and therefore the degree of autonomy and authority at
different levels could vary.
b) Second, although group-wide policies and processes would be designed toachieve group-wide objectives and strategies, they may not align easily with all
strategies and objectives, risks, market conditions and applicable laws 35 at theentity level. Therefore, the group corporate governance framework would need tohave a group and local perspective.
c) Third, groups can have complex matrix structures, especially in case ofdiversified businesses or when the legal structure is not aligned with the business
units, product lines or geographic footprint.
d) Last, a group can evolve over time due to factors such as mergers andrestructuring, market developments, legal changes and the maturity of the group.

35

See also Joint Forum Principles for the supervision of financial conglomerates: Explanatory comment 10.4:"In the event the local corporate governance requirements applicable to any particular material entity in thefinancial conglomerate are below the group standards, the more stringent group corporate governance standards
should apply, except where this would lead to a violation of local law."
IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 12 of 32

3.3. Key characteristics
25. While group models cannot be strictly defined, a set of key characteristics, which
cover the roles and key players within a group as described above, can be identified
as forming the essential elements to promote good governance within groups. When
implementing these essential elements, the nature, scale and complexity of the groupshould be taken into account.
26. These are:a) setting group-wide objectives and strategies to achieve a coherent and common
view across the group;b) having clearly defined responsibilities and accountability at both group level andentity level, including oversight of Senior Management;c) having comprehensive and well-coordinated policies and processes at the groupand entity level, including standards for reporting, controls and performance;d) risk management having the ability to act both flexibly and in a timely manner tomanage risks and compliance being able to ensure adherence to the legal andregulatory obligations, including laws applicable at the group and entity level.
Risk management and compliance should also have the ability to promote asound risk 36 and compliance culture across the group. The culture across a groupis determined by the ‘tone at the top’ at every level within the group. Conflicting
cultures within a group may undermine the good governance of the group; ande) Control Functions undertaking risk management -, compliance -, internal audit and actuarial functions at the group and entity level, with appropriate authority
and accountability to carry out their roles.
27. Effective communication and an adequate flow of information are necessary for allthese key characteristics. Pressure on the corporate governance framework mightarise from the need to react in a timely and flexible way to developments both at thegroup and entity level, while at the same time requiring the corporate governanceframework to be transparent and contain appropriate systems, controls and limits. An
adequate and timely flow of management information and communication top down
and bottom up is therefore a prerequisite for the effectiveness of the roles andresponsibilities identified in paragraphs 19 and 20. 37
28. To fulfil their respective roles Board Members, Senior Management, and Key Persons
in Control Functions should have sufficient competence and integrity. 38The level ofknowledge, skills and expertise should be commensurate with the governancestructure. 39 This does not imply for example that in a certain model the Board at thegroup level or at the level of the entity could be less fit or proper, but only that different
knowledge or expertise could be required at different levels. The fit and proper
requirements should therefore be applied by the appropriate supervisor(s) to all key
players at all levels. Therefore, although fitness and propriety are essential for good
governance, it is not a key characteristic in relation to the discussion on centralized or
decentralized models.

36

Guidance on the need and promotion of risk culture can be found in the FSB consultative paper ‘Guidance on
Supervisory Interaction with Financial Institutions on Risk Culture’ (18 November 2013) and the report of the G30,
‘A new paradigm’ (October 2013).
37
ICP 8, Introductory Guidance 8.0.9: To facilitate informed decision-making within a group, it is important thatmaterial information is delivered to all relevant Boards and Senior Management in a timely manner on a groupwide basis as well as on a legal entity or line of business basis.
38
ICP 5. See also ICP 7, Standard 7.3 and ICP 8, Guidance 8.2.20.
39
ICP 7, Standard 7.3.
IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 13 of 32

3.4. Industry practice relating to governance models
Examples of group models from insurers worldwide are set out below to illustrate thedifferences between models with varying degrees of centralization of control andmanagement. These examples, while not exact replications of a model adopted by aparticular insurer, are designed to reflect the practices among groups, and focus on thechallenges and risks arising within such structures as discussed above. There are many
variations and many more models than are described below, thus these examples should
therefore not be considered as exhaustive.

Example 1: more decentralized model
An insurer/reinsurer group with subsidiaries in over 20 countries, with reinsurance
operations throughout the world of $35 billion in annual premiums in auto insurance,
personal property insurance and in many commercial lines for small, medium andlarge companies.
At the group level, there is a Board and management, which have the task of looking at theenterprise as a whole. The CEO is the Board chairman and the majority of the Board
members at the group level are independent. The Board at the group level has a
Compensation Committee, an Investment Committee, an Audit Committee, a Risk
Committee and a Nominations and Governance Committee. The group manages its
business through "strategic business units", depending on the line of insurance being
written. There are several legal entities under each strategic business unit and they are theconduits for providing coverage and related services subject to local law. Overall, eachstrategic business unit has what it needs to operate on its own with its centralized oversight,
subject to group-wide oversight. Investments are managed centrally by the group through aseparate unit.
There is a corporate actuary primarily responsible for setting reserves for run-off businessand for coordinating actuaries throughout the group. Each of the strategic business unit has
its own actuarial function responsible for setting reserves and pricing for all entities under theunit. Each strategic unit actuary reports quarterly to the actuary at the group level. There arecompliance officers in the strategic business units and corporate compliance officers thatprovide service to entities. The internal audit function is also performed by unit auditors andthey report up to the group’s head of internal audit, not to operations managers.
In conclusion, this group operates primarily through its strategic business units subject tooverall guidance from the Board and management at the group level. Investments are an
exception because they are managed separately. The critical Control Functions all exist but
are also largely managed at the strategic business unit level with reporting up to the head of
the function at the group level.

Example 2: collaborative model – in between centralized and decentralized
Small workers compensation insurer (less than $50 million in annual premium) that is
a wholly owned subsidiary of a large GroupThe subsidiary has its own Board of Directors largely made up of officers of the holding
company. The subsidiary is responsible for its “front line” compliance, including compliancewith all the applicable governance standards. However, it is subject to the group’s global
compliance policies. Accordingly, it has its own Control Functions, Compliance Committee
and CFO. However, the (external) audit function is performed by a firm that is retained by thegroup. The system is described as "collaborative” between the group and the subsidiary.
The holding company states that it has a Board with the necessary independent directors.
The Board Chairman and CEO jointly set the agenda, style and tone of the Board
IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 14 of 32

discussions and make sure that Board members have the information they need toeffectively make informed decisions. The Board has an audit committee, a nominating/governance committee and a compensation committee.
The governance guidelines for the group state that each “principal operating units isorganized under an independent legal entity with its own Board of directors and governancestructures… [the holding company] delegates to each operating unit sufficient authority topractice decentralized management and respects the autonomous structure thereof, subject
to appropriate monitoring and oversight by the Subsidiary Board, the Board of the Holding
company and management.” Further, the subsidiaries are to adopt appropriate policies andprocedures for governance (including an active Audit Committee and Compensation
Committee) and to submit for prior approval by the group its five-year plan, Senior
Management and compensation. The CEO of the subsidiary must meet with the Board of
Directors at the group level at least annually and the CEO at the group level must reportannually to the Board of Directors at the group level on the composition and performance ofsubsidiary Boards.

Example 3: more centralized model
Global primary insurer and reinsurer with significant operations throughout the world.
It has total annual premiums in excess of $14 billion.
At the group level, the Board of Directors has an Investment Committee, a Risk and CapitalCommittee, a Remuneration Committee, an Audit Committee and an Executive Committee
composed of a majority of non-executive directors. The group has a Chief Risk Officer, Chief
Actuary, and a general counsel and head of compliance who deal with group complianceissues, and internal and external audit functions at the group level. The Board structure
including committees, officers and functions are duplicated at the holding company level. So,for example, each holding company has a Chief Risk Officer, a Chief Legal Officer who may
be responsible for compliance, a Chief Actuary and external and internal audit functions.
Effective control by the group is maintained in several ways. First, a director at the grouplevel usually sits on each holding company Board. Second, each of the critical functions
exists at both the group and holding company level and the compliance function at the grouplevel assures compliance with group policies. At the same time, because each holding
company has the full panoply of officers and functions, full compliance with local regulation is
also assured. The head of function at the group level, for example the Chief Risk Officer at
the group level, meets periodically with the holding company Chief Risk Officer and provides
over-all supervision. The same is true for the heads of other functions. Third, there is regular
reporting up and down in functional areas.

Example 4: more decentralized conglomerate with a more centralized insurer
holding company
Within a larger conglomerate there is a global reinsurer and its holding company. The
reinsurer collects about $2 billion annually in premiums.
The insurance holding company is part of a conglomerate. At the top of the conglomerate isan entity that exists primarily to set financial targets and does not engage in insurance orreinsurance operations. The insurance holding company is allowed to manage its affairs
subject to meeting it financial targets.
The insurance holding company has a Board of Directors that includes some independent
directors, along with officers of the conglomerate. The holding company has a
Compensation Committee and an Audit Committee which are composed solely of
independent directors. The Audit Committee meets frequently and hears reports from theoutside independent auditor, the Chief Risk Officer, the internal audit department, among
IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 15 of 32

others. The holding company reports up to the conglomerate, which has its own Audit
Committee.
The reinsurer has a Board of Directors composed of the CEO, CFO and the CRO function,
which mostly functions by writing and unanimous consent. It has a CEO, CFO, CRO, internal
audit function and the General Counsel and CRO, who are responsible for compliance. The
reinsurer has designated the holding company’s Audit Committee as its own and the top
management of the reinsurer also serves on the holding company’s Audit Committee. The
CFO of the reinsurer is the financial controller of the holding company. Each of the othersubsidiaries has its own Board of Directors made up of executives.
Under this example, the structures in the holding company and reinsurer reflect each otherand are very comprehensive. Control is assured by officers serving in key positions in boththe holding company and reinsurer and by continuous reporting.

Example 5: more centralized insurer
Insurer has annual premium exceeding $30 billion and subsidiaries and branches ofvarious levels of importance in multiple regions around the world.
The holding company of this group has a 100% independent Board of Directors with nomanagement or executive members on it. The Chairman and CEO positions by definition are
fully separate. The Board of Directors has active audit, risk, remuneration and othercommittees to help it carry out its work effectively and provide oversight of the entire group.
The heads of the Control Functions (including Internal Audit, Risk Management, andCompliance) of the group report independently to the relevant committees of the Board of
Directors and such functions have group-wide authorities and responsibilities. The
management of the group is done through a separate Executive Board led by the CEO at
the group level and comprising the most senior executives at the group level. This Board isalso subject to certain internal governance rules, including on it makes decision as a body.
The top subsidiaries of the group also have independent Board of Directors members,
though the Boards of Directors of most other subsidiaries are occupied by members ofmanagement from within the group. However, even at the entity level there are Control
Functions that also report in most cases to these various Boards of Directors and help
provide checks-and-balances.
The group would not define itself as "centralized" but as having the needed degree ofcentral leadership, policies, processes and controls for the group to be effective and forgroup-wide interests to be appropriately pursued, all while allowing subsidiaries to be close
to their markets, to innovate and to make decisions consistent with the needs of thosemarkets.

Example 6: hybrid mutual group
Mutual group, consisting of two central parallel mutuals (one for life and one for nonlife insurance) and a network of 19 more (regional) non-life mutuals. The group isalmost exclusively active in its home market and writes a premium volume of
approximately $2 billion.
This is a hybrid insofar as the basis of its group treatment under current national legislation
is based on:• the identity of the Management Board of the two central parallel mutuals;• the ownership by the central non-life mutual of the guarantee capital of all othergroup mutuals; andIAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 16 of 32

•

contractual relationships within the group on centralized services, on branding andmarketing, the development of products and, importantly, an agreement on financial
stability with the aim of meeting solvency requirements and targets for the wholegroup.

The central life and non-life mutuals have identical Management Boards, called "the group
Board". In these two, a two-tier system is in place; the respective Supervisory Boards aredifferent as they are elected by the annual general meetings of policy-holder members of theindividual mutuals. In line with current and future requirements, the non-life mutual is seenas the “head” of the group. In addition to the identity of the Management Board, tightcoordination is secured through the creation of a "Cooperation Committee of the Supervisory
Boards" consisting of the chairs and their deputies of the Supervisory Boards. Their
coordinating role is defined in the articles of each mutual.
The Cooperation Committee has set up an audit and a remuneration committee to assist the
Coordination Committee in its coordination and controlling duties. The legislation in thejurisdiction of the head of the group requires a "responsible actuary" in every single
undertaking. The life mutual has its own in-house actuarial function while the non-life
mutuals have a joint function (in the central non-life mutual) with responsible actuaries fromthat function appointed to each of the non-life mutuals. The risk management andcompliance functions for life and non-life activities are centralized in joint independent units,providing services for all companies in the group.
At the regional level, there are 19 non-life mutuals underwriting only retail, non-obligatory(i.e. not motor third party liability, not workers’ compensation) insurance. The roll-out of thegroup model of the existing mutual group to include these is an ongoing project and not all
details and practises are yet defined. Representatives from the group "head" may be sent tosit on the regional mutuals’ Boards, but this option may be reserved for exceptional
circumstances only. The central non-life mutual holds guarantee capital in all other mutualsof the group. In addition to the coordination role of the governance structures and the bondcreated through the signing of guarantee capital by the central non-life mutual (the "head" ofthe group), there exist the contractual relationships as described.

4. How challenges to good governance and control
within groups can be addressed
29. The analysis and industry examples set out above highlight that there are no easily
definable models of governance and control within groups. As noted in paragraph 24,
different groups adopt models with divergent levels of centralization anddecentralization, based on their own business objectives and needs, such as centresof excellence/expertise (e.g. risk management) or product lines (as in the case ofindustry Example 1). This section explores how good governance and control can beachieved, regardless of the differences in the models adopted.
30. In order to achieve good governance and control within groups, the challenges that
can arise within group models need to be properly identified and addressed. In a more
centralized approach there is more comprehensive authority at the group level, while
in a decentralized approach the entities have more autonomy. From a groupperspective the challenges of each approach therefore differ. First this section
identifies the challenges for a more centralized model and a more decentralized
model. After identifying the challenges, this section then goes on to describe from agroup perspective the essential elements of good governance for each key
characteristic of governance identified under paragraphs 25 and 26, and to identify
practices which could be used to address the challenges for each model in respect of
IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 17 of 32

these key characteristics. There are many variations of hybrid models, thus thepractices mentioned below should therefore not be considered as exhaustive. Besides
the principle of proportionality could be taken into account when taking measures toaddress the identified challenges.

4.1

Challenges in a more centralized and in a more decentralizedgroup

31. From a group perspective a more centralized approach could contribute to a common
and consistent approach at the group level. This could better facilitate alignment withcentrally set objectives, strategies, policies and to enable timely response to risks at
the group level. For example, more centralized risk management has the potential
advantage of aggregation and analysis of data at the group level, enabling effective
assessment and mitigation of risks across the group. This could contribute toconsistency of risk management at the group level and to flexible and timely reaction
to risks at the group level. More centralized Control Functions may also haveeconomies of scale that will enable them to be undertaken more efficiently.
32. However, such a more centralized approach relies on there being comprehensive
authority and control at the group level; sufficient regard of local obligations and risks;and strong lines of communication. This raises the following challenges (per key
characteristic) for group-wide governance from a group perspective:
Group-wide objectives and strategiesa) to ensure alignment of centrally set objectives, policies or measures with local
requirements, circumstances or cultural aspects;
Clearly defined responsibilities and accountability key players, including oversightb) to have clear allocation of responsibilities and accountability of the management
body of the entities vis-à-vis group management;c) to ensure effective oversight of Senior Management in individual entities;
Comprehensive and well-coordinated policies and processesd) to ensure effective implementation of group-wide policies and the common
approach of the group by all entities;
Control functionse) to ascertain by Control Functions at the group level the extent to which thecommon approach of the group is being followed in practice. For example, it may
be difficult for the compliance function at the group level to monitor and enforce
locally compliance of entities with centrally set policies or requirements. Or it
could be difficult for the risk management function to ensure a common risk
culture or consistency of risk management;f)Limited authority and ability of Control Functions at entity level to takeresponsibility for issues at the group level. This could affect implementation orcompliance at the entity level;

Risk management and Complianceg) to ensure risk tolerance levels of the group take into account the risk tolerance
capacity of entities within the group. Entities may have different risk tolerance
capacity depending on factors such as the line of business and the locality of
their operations;

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 18 of 32h) to ensure the risk culture at the group level sets effectively the example for all
levels in the group;i)to ensure effective implementation of group governance requirements by all
entities;j)to ensure the compliance culture at the group level sets effectively the example
for all levels in the group;

Communication and informationk) to effectively communicate the common approach (e.g. centrally set objectives,
strategies, risk culture and policies) in a timely manner across the group and toensure that these are understood at the entity level;l)to obtain information in a timely manner on a group-wide basis as well as on an
entity basis 40 and to respond in a timely manner to this information. Within acentralized approach the challenge could be to take into account the problems
and risks at entity level when setting group objectives or policies, because
reporting lines are longer and more complex. Decision making within groups
requires a flow of material information to and from all Boards and to Senior
Management within entities in the group. If this is not ensured, problems andconcerns at entity level could not be relayed to the group level in time for it toreact quickly or effectively to opportunities and threats that emerge at entity level.
Timely information is also a necessary requirement for Control Functions at eachlevel of a group to fulfil their responsibilities effectively.

33. In a group that adopts a more decentralized approach from a group perspective amore decentralized approach could contribute to clear responsibility andaccountability and shorter reporting lines at the entity level. This could better facilitate
compliance with local regulatory requirements and changes and enable timely
response to market changes and opportunities at entity level. For example, prime
responsibility of the Control Functions at the entity level enables them to focus on(and put in place mitigating actions for) those issues and risks that might impact on
the entity. This could contribute to aligning risk management better with the risks
arising at the entity level, thereby enabling the entity to react flexibly and in a timely
manner to such risks. A more decentralized approach may also facilitate oversightover Senior Management of the entity, as the prime responsibility would lie with the
management body of the entity.
34. However, to achieve group-wide objectives and to manage risks at the group level a
certain degree of group-wide coordination and consistency is required. Therefore adecentralized approach raises the following challenges (per key characteristic) forgroup-wide governance from a group perspective:
Group-wide objectives and strategiesa) to ensure that the objectives and strategies (including risk appetite) set at entity
level are effective from a group-wide perspective. Different entities of the groupmay pursue strategies that conflict with the overall group requirements;
Clearly defined responsibilities and accountability key players, including oversightb) to have clear allocation of responsibility and accountability at the group level;c) to coordinate the accountability of the entities;d) to coordinate the oversight of Senior management of the entities;

40

ICP 8 Introductory Guidance 8.0.9.

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 19 of 32

Comprehensive and well-coordinated policies and processese) to coordinate effective implementation of group-wide policies and to ensure acommon approach of the group by all entities;
Control functionsf)to ensure that the Control Functions at entity level are sufficiently independent
from the business of the entities;g) to ascertain by Control Functions at the group level the extent to which thecommon approach of the group is being followed in practice. For example, it may
be difficult for the compliance function at the group level to monitor and enforce
locally compliance of entities with centrally set policies or requirements. Or it
could be difficult for the risk management function to ensure a common risk
culture or consistency of risk management;
Risk management and Complianceh) to ensure risks are treated consistently across the group and that the group-widerisks are properly identified, aggregated and mitigated. Policies and processes ofentities may not be aligned with centrally set policies and processes at the grouplevel, which could create operational problems (e.g. IT problems) or a lack ofoverview at the group level. Risk tolerance levels of entities may not be
consistent with the risk tolerance capacity of the group;i)to ensure a group-wide consistent risk culture
an adequate group oversight of compliance obligations;

in

all

j)

to ensure an adequate group oversight of compliance obligations;entitiesandk) to ensure a group-wide consistent compliance culture in all entities;
Communication and informationl)to adopt, communicate and implement group-wide policies and to ensurecommunication to the group level of issues at entity level which may impact on
the group as a whole; andm) to obtain information on entities in a timely manner which may impact on thegroup as a whole. In a decentralized model the challenge could be to aggregate
all data of the entities and to get an adequate overview of all issues and risks
which have to be dealt with at the group level. This could mean that problems
and concerns at entity level are not relayed to the centre in time for it to react
quickly to opportunities and threats that emerge at entity level.
35. From the paragraphs above it can be concluded that, although the challenges from agroup perspective all relate to potential conflicts between group-wide and entity levelinterests, the focus of the challenges of each approach differ. In a centralized model,
the focus of the challenges is the balance which needs to be struck between effective
direction at the group level on the one hand and sufficient regard for local obligations,risks and circumstances on the other. In a centralized model sufficient information andauthority for group key players and autonomy for the key players at entity level areneeded to achieve good governance. In a more decentralized group the focus of thechallenges is on the implementation of group governance requirements and thecoordination of the objectives and policies of the entities to ensure that the entities
and their key players take sufficiently into account the group perspective, without
which there might be a risk of entities pursuing separate and incompatible goals andtaking risks that the group would find unacceptable. Therefore to achieve effective
governance within such a group, sufficient coordination and oversight from the grouplevel and adequate information flows are needed.
IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 20 of 32

36. The challenges for both more centralized and more decentralized models describedabove stem mainly from the following four factors:
1. division of authority and responsibilities of key players at the group and entity
level;
2. effective group-wide direction and coordination;
3. proper consideration of both entity and group perspective;
4. effective communication within the group and availability of adequate information
at all levels.
37. These four factors are thus also relevant for the measures which could address theidentified challenges. To identify these, this paper focusses on each key characteristicof governance set out in paragraphs 25 and 26 above. For each key characteristic it isexplained which elements are essential for a good governance structure. The paper
also provides examples of practices which could address the likely challenges.
38. Although they are considered separately, it should be noted that the key
characteristics have to be considered as integrated and interactive elements that
underpin the group corporate governance framework as a whole. For example, amore decentralized group may use mechanisms to strengthen other governanceelements (e.g. board, control functions, or reporting requirements) to address risks toeffective group-wide governance arising from the autonomy of management at theentity level. Such a holistic view also helps solve the challenges arising within
particular models. As the degree of centralization and decentralization varies, a caseby-case analysis of the effectiveness of the checks and balances of the governanceframework is necessary. This also implies that there are varying solutions to different
models.

4.2. Setting objectives and strategies for achieving thoseobjectives of the group (including setting risk appetite)
39. The establishment of specific objectives and strategies for achieving those objectives
across the group is a responsibility of the Board. 41 These objectives and strategies
should be adequately documented and properly communicated to Senior
Management and Control Functions at all levels of the group. Setting the risk appetite
and risk tolerance limits for the group is an integral part of developing the group’sbusiness objectives and strategies for achieving those objectives.
40. Regardless of whether a centralized or decentralized approach is used, a good
governance framework would include elements which promote:a) to the greatest extent possible, clearly and centrally set overall businessobjectives and strategies (reflecting the group’s risk appetite and risk tolerance
levels). This recognizes that every group is set up with specific businessobjectives and generally to gain advantages of synergy and economies of scalearising within groups, even in more decentralized groups. To do so, they needoverall group-wide objectives and strategies, even if they are set at a moregeneral and less detailed level than in a more centralized model. The objectives
and strategies may be set for different lines of business or geographic
locations/divisions within the group, or across the whole group, as appropriate to
the manner in which the governance and control of the group is structured;41 As stated previously, in some jurisdictions senior management may be involved in setting the strategy andobjectives.

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 21 of 32b) proper alignment between the group-wide objectives and strategies and theobjectives and strategies of individual entities or business lines within the group;c) clear allocation of responsibilities and clear accountability at all levels regarding
the setting and implementation of the strategy and objectives;d) the ability and accountability at the group level to identify and address any
conflicting objectives and strategies between group-wide objectives andstrategies and those at the entity level. Such measures may include removing
those conflicts or providing mechanisms for mitigating the adverse impact of suchconflicts;e) effective and close communication between the group level and individual entities
in order to successfully implement the objectives and strategies, withinparameters of risk appetite and risk tolerance levels applicable at the group level
and/or at the entity level, as appropriate; andf)adequate information flows for setting the objectives and strategies, both at thegroup level and at entity level, including when setting risk appetite and risk
tolerance levels, and for effective monitoring.

41. As explained above each group structure, whether it is more centralized or more
decentralized, presents particular challenges in setting and implementing objectives
and strategies. Measures to address these challenges apply equally when setting risk
appetite and risk tolerance levels of the group for the purposes of setting its overall
objectives and strategies.
42. Regardless of whether the model is more centralized or more decentralized, there aresome common practices which could address the likely challenges arising in a group.
These may enhance a group’s ability to have well-coordinated and cohesive
objectives and strategies for the group. These practices, arranged in the 4 categories
mentioned above, include:
Authority and responsibilities of key players group-widea) where the group adopts objectives and strategies along business lines orgeographic locations/divisions, allocating to the relevant business units and theirrespective Senior Management the responsibilities and accountability for setting
the objectives and strategies for specific products. Group-wide oversight could
help to align of the objectives and strategies for specific products with theobjectives and strategies adopted by the group.
Group-wide direction and coordinationb) adequate representation of entities at the Board of the group level andrepresentation of the group level at the Boards of (major) entities to enhancecommunication between the group level and the respective entities. This could
enhance the knowledge of conditions, needs and requirements of each level areproperly taken into account when setting and reviewing objectives and strategies;andc) A governance memorandum for the group could describe the group-wide
objectives and strategies, and to the extent those differ from any entity specificobjectives or strategies, such variations and the rationale.
Consideration of both entity and group perspectived) each entity submitting its long term and annual business plans for review orapproval by the group to promote better alignment of the entity level businessobjectives and strategies with those at the group level.

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 22 of 32

Communication and informatione) establishing effective channels of communication between risk officers at thegroup and entity level to exchange information to facilitate setting and monitoring
the group and entity objectives and strategies, as well as their risk appetites.

4.3. Appropriate allocation of oversight and management
responsibilities
43. Oversight of the Senior Management to ensure that they are carrying out the day-today management of the relevant entities is a key function of the Boards at both groupand entity level. It is particularly important because the Senior Management has theprimary executive responsibility in respect of risk, compliance and related areas.
44. Regardless whether a more centralized or more decentralized approach is used, agood governance structure would include elements which promote:a) clear allocation of responsibilities and clear accountability at all levels;b) effective oversight of the Senior Management of the entities by the respective
Boards and the Board at the group level; andc) satisfactory and timely communication and reporting across the group to ensurethat all levels have the necessary information to fulfil their roles.
45. Regardless of whether the model is more centralized or more decentralized, there aresome common practices which could address the likely challenges arising in a group.
These practices, arranged in the 4 categories mentioned earlier, include:
Authority and responsibilities of key players group-widea) clearly defining, allocating and documenting responsibilities and accountabilities
at all levels. For this purpose, a governance memorandum could document theway the group is organised, managed and overseen; and the division of key tasks
and responsibilities between the group and entity levels;b) requiring the composition of the Senior Management at entity level to be subject
to prior approval by the Board at the group level; andc) within a decentralized group, it would be especially important to establish clear
responsibilities at the Board at the group level with regard to monitoring andoversight of the entities. This would provide a balance against the higher degreeof authority and autonomy of the Boards and Senior Management at the entity
level.
Group-wide direction and coordinationd) requiring the Board of the entity to indicate and document how its decisions andpolicies are related to group-wide decisions and policies;e) providing for direct access of the Board of the entity / group to the Board at thegroup / entity level; andf)(especially for decentralized models) providing an incentive for the Board of theentity to be more involved with the development and implementation of group
policies, and to align policies at entity level with the group-wide policies.

Consideration of both entity and group perspectiveg) having representatives of the entities on the executive management committee atthe group level to facilitate that interests and objectives of the entity areadequately taken into account at the group level. Or having representatives of the
IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 23 of 32

group on the executive management committee at the entity level to ensureinterests and objectives of the group are adequately taken into account at theentity level;h) having some common Board members at the group and entity level;i)having a sufficient number of independent Board members at entity level, so thatthey can take interests and objectives of the entity adequately into account at theentity level; andj)(especially for decentralized models) establishing a group role, with clear
responsibility for providing oversight of the Senior Management of entities,
subject to the overall guidance of the head of the group. For this purpose, each
entity within the group could be required to submit to the group role its long termplans and proposed compensation arrangements for assessment as to whether
they are consistent with the group-wide objectives and strategies.

Communication and informationk) having a procedure for escalating issues arising at the entity level to the Board oraudit or risk committee at the group level, including where there are conflicts ofinterest between group level and entity level;l)requiring regular reporting by the entities within the group to the Board at thegroup level, including annual meetings of the CEO of entities with the Board at
the group level. This could facilitate proper communication and escalation ofissues which arise at the entity level to the group level, thereby influencing theattention at the group level to such issues; andm) requiring annual reports of the CEO at the group level to the Board at the grouplevel covering the composition and performance of entity level Boards.

4.4. Policies and processes at the group and entity level
46. Policies and procedures applicable to the Board, Senior Management, Control
Functions and other staff are an important element of the internal controls system.
Examples of such key policies and procedures are standards for reporting, policies
and procedures for outsourcing and compensation policies. These policies andprocedures have the aim of managing risks and contributing to the proper functioningof the group and the entities within the group.
47. Regardless whether a more centralized or more decentralized approach is used, agood governance structure would include elements which promote:a) a group-wide approach in terms of policies and procedures;b) effective and timely communication of policies and procedures group-wide;c) effective implementation of group-wide policies and procedures at entity level;
andd) a proper alignment of group-wide policies and procedures with local
circumstances and cultural aspects.
48. Regardless of whether the model is more centralized or more decentralized, there aresome common practices which could address the likely challenges arising in a group.
These practices, arranged to the 4 categories mentioned earlier, include:
Authority and responsibilities of key players group-wide

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 24 of 32

a) Senior Management of the entities having specific responsibility (keyperformance measures built into their employment contracts) to ensure theimplementation of group-wide policies and processes; andb) Control Functions, especially internal audit, at the entity level having the
responsibility of supporting Senior Management at the group level in order toensure the implementation of group-wide policies.
Group-wide direction and coordinationc) having representatives of the entities on the executive management committee atthe group level to ensure the implementation of group policies;d) compliance and audit at the group level reviewing whether policies of entities fit
within group-wide policies and that the group-wide procedures are followed atentity level;e) entities adopting appropriate policies and procedures for governance (including
an active audit committee and compensation committee) and submitting these forprior approval at the group level; andf)a person or a function being designated to support the advancement,
coordination and/or management of the overall internal controls system on amore regular basis (the internal controls system manager). 42 This would help toachieve appropriate documented controls for the appropriate areas and at theappropriate levels, locally and on a group-wide basis.

Consideration of both entity and group perspectiveg) members of the audit committee at the group level also being members of theaudit committees at entity level.
Communication and informationh) internal audit staff at the group and entity level having regular exchanges of
information with regard to new policies and monitoring results in order to achieve
proper application and monitoring of the group-wide policies and processes;i)

the internal audit function at entity level reporting jointly with audit at the grouplevel to the audit committee or the Board at the group level;j)internal audit officers and compliance officers at entity level having the
responsibility to identify relevant group decisions and practices that impact on theentity and to report these to the Board of the entity;k) having a regular line of communication below Board level between group leveland entity management and Control Functions to achieve mutual understanding
and good working relationships to facilitate understanding of the risks faced at
different levels; andl)an external auditor assessing the effectiveness of the policies and procedures,and reporting on major findings to the Board or audit committee at both the groupand the entity level (including to the external auditor at the group level).

4.5. Risk management and compliance
49. Management of risks (including compliance risks) at the group level as well as at theentity level is key to effective control and proper management of every group. Groupwide risks may affect entities within a group, while risks at entity level could also have42

ICP 8 Guidance 8.2.7

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 25 of 32

ramifications for the risk profile of the group as a whole, and (some or all) otherentities within the group.
50. All groups, whether more centralized or more decentralized, are required to comply
with both local laws and regulations while also meeting the requirements applicable togroups. For this purpose, amongst other things, they need to promote a strong
compliance culture at all levels.
51. Regardless of whether a more centralized or more decentralized approach is used, agood governance structure would include elements which promote:a) a common risk and compliance culture across the group;b) effective assessment and consistent management of risks across the group;c) timely reporting to group level to ensure good overview of risks;d) availability of adequate aggregated information about all risks at the group level;e) timely reaction to risks at the group and entity level;f)local circumstances and requirements being taken into account at the grouplevel; andg) adequate communication of risk management and compliance approach within
the group.
52. Regardless of whether the model is more centralized or more decentralized, there aresome common practices which could address the likely challenges arising in a group.
These practices, arranged to the 4 categories mentioned earlier, include:
Authority and responsibilities of key players group-widea) clearly defining, allocating and documenting responsibilities and accountabilities
at all levels.
Group-wide direction and coordinationb) development and implementation of manuals setting out common risk
management procedures across the group to promote consistency of risk
management;c) having consistent policies and oversight procedures so that a better overview andquicker identification of risks arising at entity level can be made to address themadequately;d) ensuring representation of the head of the group on entity risk committees topromote better alignment with the group-wide risk management and compliance;ande) ensuring that compliance personnel at the group level are members of entity
compliance oversight committees or their equivalent to contribute to developing acommon compliance culture and adequate group compliance.
Consideration of both entity and group perspectivef)

Having representatives of the entities on the risk and compliance committee atthe group level to take risk and compliance issues at entity level adequately into
account at the group level.

Communication and informationg) setting clear reporting requirements to report locally identified risks (including
compliance risks) in a timely and comprehensive way at the group level;

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 26 of 32h) providing for a CRO or other person at entity level, who is responsible forregularly reporting the CRO at the group level;i)on-going reporting by Control Functions at entity level to Control Functions at thegroup level to make it possible for the head of the group to identify risks emerging
at entity level in a timely manner;j)representation of risk officers at the group level at risk committees of entities tocontribute to effective communication of the group risk approach to entities; andk) ensuring that compliance personnel at the group level are members of entity
compliance oversight committees or their equivalent to contribute to developing acommon compliance culture and adequate group compliance.

4.6. Control Functions – Risk Management, Compliance, Internal
Audit, Actuarial
53. Control Functions are essential for providing expertise, leadership, objectivity andindependence with regard to the management of risks. Therefore, it is essential thatall groups have in place robust Control Functions that are capable of identifying,aggregating and taking action to mitigate the risks faced by the group.
54. As noted before, the way in which groups choose to organise these functions vary
according to the organizational structure of the group with some organisations
adopting a more centralized and others a more decentralized approach. Regardlessof whether a more centralized or more decentralized approach is used, a good
governance structure would include elements which promote:a) the establishment of group level Control Functions (risk management,compliance, internal audit and actuarial functions) which are sufficiently strong so
as to be able to properly identify and address risks that impact on the group as awhole;b) timely and adequate action being taken at all necessary levels;c) adequate monitoring of implementation of group-wide policies and actions;d) timely and accurate information flow within the group, bottom-up and top-down;e) effective communication of group objectives, strategies and policies to Control
Functions of the entities or to entities; andf)a group-wide common risk and compliance culture.

55. Regardless of whether the model is more centralized or more decentralized, there aresome common practices which could address the likely challenges arising in a group.
These practices, arranged to the 4 categories mentioned earlier, include:
Authority and responsibilities of key players group-widea) Control Functions at the group level having clear responsibility and authority to beable to undertake overall group-wide supervision;b) officers holding key positions at both group and entity level having clear lines ofaccountability to achieve effective control of the group and implementation ofgroup-wide policies and strategies;
Group-wide direction and coordinationc) Control Function at the group level having the responsibility for coordinating
Control Functions across the group;

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 27 of 32d) Control Functions at entity level providing sufficient and timely information to thegroup Control Functions, to achieve group-wide objectives and to manage risks
at the group level; ande) outsourcing activities of the entity Control Functions to the Control Functions at
the group level.
f)Consideration of both entity and group perspective having full panoply of officers
and functions at entity level with sufficient authority to achieve that the Control
Functions operate effectively at entity level. This could, for example, strengthen
the position of the compliance functions at entity level to achieve effective
compliance with local laws and safeguarding and achieving entity based
interests;g) requiring the annual external audit to be conducted by an independent auditor
approved or chosen by the head of the group to include an assessment whether
the entity complies with the applicable group-wide policies;
Communication and informationh) having regular periodic meetings between Control Functions at the group level
and Control Functions at entity level to communicate group-wide objectives andpolicies easily and properly downwards and to inform Control Functions at thegroup level better so they can carry out their roles effectively;i)continuous reporting of Control Functions at entity level to Control Functions at
the group level to help to ensure adequate and timely information at the grouplevel (bottom-up), and to promote independence of Control Functions at entity
levels; andj)Control Functions at the group level providing services and advice to entities
and/or Control Functions at entity level, as it contributes to developing a common
risk/compliance culture.

5. Supervisory review and cooperation
56. ICP 25 provides that the group supervisor should put in place adequate coordination
arrangements with other involved supervisors in order to facilitate the comprehensive
oversight of individual entities within the group and the group as a whole.
Coordination mechanisms might include supervisory colleges and memoranda ofunderstandings between supervisors.
57. Adequate governance, including risk management and internal controls, should be inplace within a group. ICP 8 requires that this should be assessed by the supervisor ona group-wide basis as well as on a legal entity basis so as to have a group-wide viewand enhance the assessment of the entities. 43 Supervisors have to take into accountthe management structure of the group in evaluating the effectiveness of its
governance. ICP 8 states:"Particularly when the management structure differs from the legal entity structure, it
is not sufficient to address governance or risk only at the legal entity level. In such acase, it is important that appropriate governance exists across the group and thatrisks are being identified, assessed, monitored and managed appropriately also on agroup-wide basis." 4443
44

ICP 8 Introductory Guidance 8.0.7
ICP 8 Introductory Guidance 8.0.8

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 28 of 32

58. As can be seen from the above analysis, both more centralized and more
decentralized models of governance present challenges for the supervision of groups.
Ensuring that Control Functions operate effectively within a group is a core concern
for supervisors.
59. In a group with a more centralized approach to governance, a major concern that is
likely to arise is whether the Control Functions at the entity level are effective.
However, in more centralized groups, supervisors at the group level have a clear
single point of contact for dealing with the issues linked to the group level. While amore centralized group has the benefit of common standards across the group, it
would be a challenge for the supervisors to ascertain the extent to which these arebeing followed in practice at entity level. Supervisors of individual entities may also
not be fully aware of group-wide issues and may not be able to assess the adherence
by entities with group-wide standards.
60. In a group with a more decentralized approach to governance, a major concern thatis likely to arise is whether there is effective assessment and control of group-widerisks at entity level. While a more decentralized group may facilitate supervision ofissues at the entity level, group supervisors may not have clear visibility of thestrategies which are being pursued by individual entities. Similarly, while hostsupervisors are likely to have clear visibility about the effectiveness of Senior
Management’s oversight within specific entities, they may not have the ability to relate
this to the overall group approach. Conversely, group supervisors may not be able toascertain the extent to which group-wide policies are being implemented at the entity
level.
61. The Board of the Head of the Group is responsible for ensuring the establishment ofcomprehensive and consistent group governance. However, supervisors have an
important role to assess whether appropriate governance arrangements are in place
and are being operated effectively regardless of the group structure. To achieve thisobjective, it is important for supervisors to:a) establish, implement and maintain a comprehensive framework of risk-basedminimum prudential standardsb) ensure standards are clear in their application to various entities of the group;c) provide guidance to groups on expectations for sound governance taking accountof the structure of the group. It should be possible to apply such guidance tomore centralized as well as more decentralized models of governance, including
any variations thereof;d) share industry best practice and alert groups to emerging risks; ande) ensure that remedial action is taken where weaknesses are identified.
62. In a group context, it is important that supervisors work together to arrange adequate
cooperation and coordination at all levels as appropriate. The exchange of informationand good communication between supervisors is especially important in case ofcross-border groups. ICP 25 requires supervisors to put in place adequate
coordination arrangements with other relevant supervisors and authorities. When
doing so, the supervisors should take into account the nature, scale and complexity of
the group. In order to achieve the effective group supervision described and theeffective coordination and cooperation between the group supervisor and other
involved supervisors, supervisors should ensure that: 45
45This section is based upon the principles set out in section II of the ‘Principles for the supervision of financial
conglomerates’ issued by the Joint Forum in September 2012. The principles are as applicable to the supervisionof insurance groups as to financial conglomerates.
IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 29 of 32a) a clear process is in place for coordinating various roles and responsibilities withclearly delineated responsibility for ensuring effective and comprehensive grouplevel supervision, including a coordination process to identify a group-levelsupervisor (this should result in a single group-level supervisor with responsibility
for effective group-level supervision and for facilitating coordination between
relevant supervisors to enable effective group-wide supervision).
b) measures are taken to establish coordination arrangements in order to enableeffective group-wide supervision, including, as appropriate, sharing information,
participating in supervisory colleges, drafting memoranda of understanding,cooperating in on-site and off-site supervision and stress testing, and taking
enforcement actions. A host supervisor can provide information on local
obligations and circumstances to the home supervisor 46 , while the homesupervisor can give input to a host supervisor in case a branch is established in aforeign jurisdiction 47.
c) a sound understanding of the operations of groups is developed and maintained
through undertaking a range of appropriate supervisory activities. These should
include:•The collection, review and analysis of relevant information from thegroup as a whole and its constituent entities, including where relevant,unregulated entities;•

Review of the group’s own assessment of its risks at the appropriate
levels within the group;•

Sufficient interaction with the Board and Senior Management of thehead of the group and of material and relevant entities within thegroup; and•On-site and off-site supervision of entities within the group andassessment of compliance with the prudential framework.

d) supervisory tools are used, when appropriate, to compel timely corrective actions
and/or enforce compliance with the prudential framework. Supervisors will do thisby imposing sanctions on or require corrective actions to be taken by the group or
its constituent entities, subject to appropriate due process.

6. Conclusions
63. The checks and balances included within a group corporate governance framework
should contain sufficient systems and controls, including policies and procedures,
which enable the group to be flexible and transparent, to take timely decisions and toensure that powers are not unduly concentrated. For this purpose, group-widesystems and controls should have an adequate and appropriate division of
responsibilities (for strategy and direction; management and oversight) within thegroup, with a clear allocation of responsibilities to key players within the corporate
governance framework.
64. This paper has been developed due to the growing awareness of the variety of
approaches to group governance adopted within groups, and the possible impact
those approaches can have on Control Functions which form a key element of good
governance. While both ICPs and ComFrame require individual insurers and groups
46
47

ICP 4 Guidance 4.1.2
ICP 4 Standard 4.4 and 4.5

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 30 of 32

to put in place an appropriate corporate governance framework, neither of themrecommends or mandates a centralized or decentralized model. Consistent with thatapproach, this Issues Paper also does not advocate any particular model ofgovernance, but has instead tried to identify how good governance standards can beeffectively achieved within different models.
65. The paper analyses how good governance can be ensured when an insurance grouppursues a more centralized model or a more decentralized model. In practice groups
will adopt more hybrid models between centralized and decentralized, which cannot
be strictly defined. However, a set of key characteristics has been identified in thispaper, which form the essential elements of good governance regardless of the model
chosen. Although they are considered separately for the purpose of this paper, thesekey characteristics are integrated and interrelated elements of the corporate
governance framework:a) setting of objectives and strategies;b) allocation and oversight of management responsibilities;c) setting policies and procedures at both group and entity level;d) risk management and compliance; ande) operation of Control Functions.
66. There is a need for strong governance at all levels within a group but specificchallenges or issues might arise depending on the model adopted by a group. To
illustrate this, the paper has considered the challenges and issues that might arise
from more centralized or more decentralized models of governance, while recognizingthat in practice most groups will adopt a hybrid approach somewhere along thespectrum between purely centralized and purely decentralized. A group with a more
centralized approach has the advantage of a common culture, policies and processes
which will help secure effective governance of the group. However, such an approach
may constrain its ability to effectively monitor management at entity level and react torisks arising at the entity level, which could impact on the group as a whole. On theother hand, in a group adopting a more decentralized approach, there is typicallymore autonomy and authority at the legal entity level which generally means that it will
be more responsive to changing local requirements. However, in such a model, it may
be more difficult to achieve implementation and monitoring of compliance with grouprequirements and managing of group risks.
67. As there are varying degrees of centralization and decentralization in terms ofmanagement and control of groups, a tailored approach based on a case-by-caseanalysis and understanding of the group and its structure would be needed to identify
and address challenges to good governance that may arise within its model.
68. The Issues Paper identifies the challenges for centralized and decentralized models
and the main elements of each key characteristic needed to ensure good governancewithin groups. To address the challenges identified, the paper describes practices,deriving from industry examples or supervisory experience that may be applied topromote good governance within groups, whether a more centralized or more
decentralized model is adopted. These practices should only be considered as
examples, as the varying hybrid models and the principle of proportionality require acase-by-case analysis. The main factors underlying the challenges and suggested
practices are:a) division of authority and responsibilities of key players at the group and entity
level;b) effective group-wide direction and coordination;
IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 31 of 32c) proper consideration of both entity and group perspective; andd) effective communication within the group and availability of adequate information
at all levels.
69. Insurance groups should look carefully at those factors, when setting up or assessing
their corporate governance framework. The factors should be considered also by
supervisors in applying the ICPs and ComFrame.
70. Supervisors are responsible for setting requirements and assessing the establishmentof comprehensive and consistent group governance. Approaches to governancereflected in a group model present challenges to the supervisors of groups. Effective
Control Functions within a group are a core concern for supervisors and assessing
the effectiveness of these requires appropriate supervisory cooperation andcoordination. Regardless of whether a more centralized or more decentralized model(or any variation thereof) is adopted in a group, supervisors should assess whether
appropriate governance arrangements are in place to allow the group to be operated
effectively and in a transparent manner.
71. Effective communication and exchange of information between supervisors are
essential for the supervision of cross-border groups. Supervisors should have a clear
process in place for coordinating various roles and responsibilities of home and hostsupervisors; they should provide guidance to groups on expectations for soundgovernance taking account of the model of the group. Supervisory cooperation
through memoranda of understanding, through supervisory colleges or otherarrangements is key to supervisors’ understanding of groups and the governanceapproaches they use.
***

IAIS Issues Paper on Approaches to Group Corporate GovernanceOctober 2014

Page 32 of 32