Public

Application Paper on
Supervision of Control Functions

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 1 of 27

Public

About the IAISThe International Association of Insurance Supervisors (IAIS) is a voluntary membershiporganisation of insurance supervisors and regulators from more than 200 jurisdictions. The
mission of the IAIS is to promote effective and globally consistent supervision of the insurance
industry in order to develop and maintain fair, safe and stable insurance markets for the benefit
and protection of policyholders and to contribute to global financial stability.
Established in 1994, the IAIS is the international standard setting body responsible fordeveloping principles, standards and other supporting material for the supervision of theinsurance sector and assisting in their implementation. The IAIS also provides a forum forMembers to share their experiences and understanding of insurance supervision andinsurance markets.
The IAIS coordinates its work with other international financial policymakers and associationsof supervisors or regulators, and assists in shaping financial systems globally. In particular,
the IAIS is a member of the Financial Stability Board (FSB), member of the Standards Advisory
Council of the International Accounting Standards Board (IASB), and partner in the Access to
Insurance Initiative (A2ii). In recognition of its collective expertise, the IAIS also is routinely
called upon by the G20 leaders and other international standard setting bodies for input on
insurance issues as well as on issues related to the regulation and supervision of the global
financial sector.
Application Papers provide supporting material related to supervisory material (ICPs or
ComFrame). Application Papers could be provided in circumstances where the practicalapplication of principles and standards may vary or where their interpretation andimplementation may pose challenges. Application Papers do not include new requirements,
but provide further advice, illustrations, recommendations or examples of good practice tosupervisors on how supervisory material may be implemented. The proportionality principle
applies also to the content of Application Papers.
International Association of Insurance Supervisors
c/o Bank for International Settlements
CH-4002 Basel
Switzerland
Tel: +41 61 280 8090 Fax: +41 61 280 9151
www.iaisweb.org
This document was prepared by the Governance Working Group in consultation with IAIS
Members.
This document is available on the IAIS website (www.iaisweb.org).
© International Association of Insurance Supervisors (IAIS), 2021.
All rights reserved. Brief excerpts may be reproduced or translated provided the source isstated.

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 2 of 27

Public

Contents
1

Introduction .................................................................................................................... 4

2

Role of control functions................................................................................................. 5

3

4

5

6

7

8

2.1

Identification and the role of control functions ......................................................... 5

2.2

Mapping particular control functions to the Three Lines Model ................................ 6

2.3

Role of control functions when business activities are outsourced .......................... 7

2.4

Importance of independence and stature for effective control systems ................... 8

Independence of control functions ................................................................................. 8
3.1

Positioning control functions in the internal structure of the insurer ......................... 9

3.2

Remuneration of control functions......................................................................... 11

Stature of control functions .......................................................................................... 12
4.1

Skills and experience ............................................................................................ 12

4.2

Resource stretch ................................................................................................... 14

4.3

Ability to challenge and raise concerns by control functions .................................. 14

4.4

Board engagement and reporting.......................................................................... 15

Internal audit function ................................................................................................... 16
5.1

Combination of the internal audit function with second line control functions......... 17

5.2

Supervisory use of the work of the internal audit function ..................................... 17

Combination of control functions .................................................................................. 18
6.1

Combination of second line control functions ........................................................ 19

6.2

Combination of control function and business responsibilities ............................... 20

6.3

Combination of control function and Senior Management responsibilities ............. 20

Outsourcing of control functions ................................................................................... 21
7.1

Challenges related to supervision of outsourced control functions ........................ 21

7.2

General good supervisory practices ...................................................................... 22Group-wide control functions........................................................................................ 24
8.1

Inadequate or inconsistently applied group policies .............................................. 24

8.2

Cross-sectoral and international groups ................................................................ 25

8.3

Inadequate communication ................................................................................... 26

8.4

Outsourcing of control functions within the group .................................................. 26

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 3 of 27

Public

1

Introduction1.
Effective control functions with necessary independence, stature and resources help
insurers identify and manage risks and are considered a crucial element of the corporate
governance framework. In contrast, ineffective control functions may weaken an insurer andrequire heightened supervisory attention. The work performed by control functions, inparticular internal audit, can also assist supervisors in identifying specific areas of concern or
patterns of weakness within an insurer, informing the supervisory plan and tailoring its
supervisory approach accordingly.
2.
This Application Paper describes practices aimed at helping supervisors address
issues related to the supervision of control functions as described in the Insurance Core
Principles (ICPs) and the Common Framework for the Supervision of Internationally Active
Insurance Groups (ComFrame). In particular, the Application Paper supports observance of
ICP 8 (Risk Management and Control Functions), and is relevant to ICP 5 (Suitability of
Persons) and ICP 7 (Corporate Governance) and supports supervisors in achieving theoutcomes stipulated in those ICPs.
3.
In addition to relevant literature and other publications, this Application Paper is largely
based on the results of a survey among IAIS Members of their experiences and supervisory
practices 1. The survey identified challenges in supervision of control functions and effective
supervisory practices for addressing these challenges, which largely shaped the content andorganisation of this Paper. This Application Paper also takes into consideration the outcomeof the Peer Review of Corporate and Risk-Governance relative to the standards set out in
ICPs 4, 5, 7 and 8. 2
4.
The IAIS recognises the need to investigate further challenges to supervision of control
functions identified in the survey, the Peer Review Process and other sources, and this paper
looks to address those challenges by sharing relevant good supervisory practices.
5.
As described in their Introduction, the ICPs establish the minimum requirements for
effective insurance supervision and are expected to be implemented and applied in a
proportionate manner. Therefore, proportionality underlies all the ICPs, including those related
to supervision of control functions, and this Paper should be read in the context of the
proportionality principle. Some practical examples of applying proportionality in supervision ofcontrol functions are described in this Application Paper. 3 In general, supervisors have theflexibility to tailor their implementation of supervisory requirements and their application of
insurance supervision to achieve the outcomes stipulated in the Principle Statements andStandards.
•

Implementation - proportionality allows the ICPs to be translated into a jurisdiction’s
supervisory framework in a manner appropriate to its legal structure, market conditions
and consumers.

•

Application - proportionality allows the supervisor to increase or decrease the intensityof supervision according to the risks inherent to insurers, and the risks posed by

1 The survey of IAIS Members, to which 28 jurisdictions responded, was launched in June 2019.

IAIS, Peer Review of Corporate and Risk-Governance relative to the standards set out in Insurance Core
Principles 4, 5, 7 and 8, June 2020, p. 23.
3 See, for example, Section 6 (Combination of control functions) and Section 7 (Outsourcing of control functions).
See also considerations in subsection 2.2 (Mapping particular control functions to the Three Lines Model).
2

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 4 of 27

Public

insurers to policyholders, the insurance sector or the financial system as a whole. A
proportionate application involves using a variety of supervisory techniques andpractices tailored to the insurer to achieve the outcomes of the ICPs. Such techniques
and practices should not go beyond what is necessary in order to achieve their
purpose. 4
6.
Risk-based supervision is a related concept but distinct from proportionality; it means
more supervisory activities and resources are allocated to insurers, lines of business or market
practices that pose the greatest risk to policyholders, the insurance sector or the financial
system as a whole. 5
7.
This Application Paper covers the following aspects of supervising control functions of
insurers 6:•

Role of control functions (Section 2);•

Independence of control functions (Section 3);•

Stature of control functions (Section 4);•

Internal audit function (Section 5);•

Combination of control functions (Section 6);•

Outsourcing of control functions (Section 7); and•Group-wide control functions (Section 8).

2

Role of control functions

2.1

Identification and the role of control functions

8.
As stated in ICP 8.2.1, an insurer’s internal controls system “should ensure effective
and efficient operations, adequate control of risks, prudent conduct of business, reliability offinancial and non-financial information reported (both internally and externally), andcompliance with laws, regulations, supervisory requirements and the insurer’s internal rules
and decisions.”
9.
A control function is defined in the IAIS Glossary as a: “Function (whether in the formof a person, unit or department) that has a responsibility in an insurer to provide objective
assessment, reporting and/or assurance; this includes the risk management, compliance,
actuarial and internal audit functions.” A control function is considered an independent
component of the insurer’s organisation with at least one natural person as a Key Person inControl Function. In addition, a number of other persons may be involved and assist in thework of the control function without being ultimately responsible for its outcome. Whenever

4 Introduction to ICPs, para. 9.

5 Introduction to ICPs, para. 10.

6 According to the IAIS Glossary, the term “insurer” refers to both insurance legal entities and insurance groups(including IAIGs, which are the focus of ComFrame). Therefore, unless stated otherwise, the challenges and goodsupervisory practices mentioned in this Application Paper apply to supervision of all insurers.
PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 5 of 27

Public

this document discusses requirements for control functions, these are addressed to the Key
Persons in Control Functions 7, unless otherwise indicated.
10.
Control functions, which are part of the internal controls system, are an importantelement in the overall management of an insurer and are critical for promoting good risk andcompliance culture within the insurer. The role of a control function is to “add to the governancechecks and balances of the insurer and provide the necessary assurance to the Board in thefulfilment of its oversight duties”. 8 Per ICP 8, an insurer should have control functions that
include: Risk Management, Compliance, Actuarial, and Internal Audit. Regardless of where acontrol function is situated within the organisational structure of the insurer, it should execute
its responsibilities so that the internal controls system in aggregate fulfils its objectives.
11.
Regardless of the organisational structure adopted by an insurer, the Board should
approve the authority and responsibilities of each control function to allow each control
function to have the authority and independence necessary to be effective. 9 A documented
and approved description of control functions’ responsibilities allows the internal audit function
and the Board (or a relevant committee of the Board) to evaluate their effectiveness andidentify any control gaps in the organisation. It is expected that supervisors do a similarevaluation, in addition to assessing the effectiveness of the insurer’s internal audit function.
2.2

Mapping particular control functions to the Three Lines Model

12.
Depending on the organisational structure of the insurer, business or other units shouldown, manage and report on risks and should be primarily accountable for establishing andmaintaining an effective internal controls system. Control functions should determine andassess the appropriateness of the controls used by the business or other units. The internal
audit function should provide to the Board independent assurance on the quality andeffectiveness of the internal controls system. This division of responsibilities between
business, risk management and compliance, and internal audit is typically referred to as theThree Lines Model. 10 While there are similarities between this model and the ICP Standards
on supervision of the internal controls system, including control functions, the Three Lines
Model is not required in ICPs. This model is designed to potentially fit various types oforganisations, whereas IAIS supervisory material is aimed at establishing standards focusedon achieving objectives of insurance supervision.
13.
The control functions, as described in IAIS supervisory material, can be broadly
mapped to this model in the following way:•

The first line role consists of the insurer’s business operations that own and manage
the risks they generate and own the controls; and•The control functions are within the second and third lines:oRisk management, actuarial and compliance functions are considered the secondline and are responsible for assessing the appropriateness of the controls used by
the first line roles.

7 According to the IAIS Glossary, Key Persons in Control Functions are persons responsible for heading control

functions.
8 ICP 8.3.1.
9 ICP 8.3.6.
10 See the Institute of Internal Auditors (IIA), The IIA's Three Lines Model, July 2020. This is an update of the ThreeLines of Defence model, which was originally introduced in 2013, as referenced also in ICP 8.
PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 6 of 27

Publico

The third line is the internal audit function, which is responsible for “providing theBoard with independent assurance in respect of the quality and effectiveness of
the insurer’s internal controls framework 11.” This includes providing assurance andadvice on the adequacy and effectiveness of governance and risk management.

14.
While well-defined on paper, the distinction between each of the three lines is notalways clear in practice, particularly regarding certain first line roles and the second linefunctions. The clear allocation of responsibilities helps avoid or mitigate bias, conflicts ofinterest or undue influence of one function on professional or business judgments of anotherfunction. This approach also supports objective, independent and accurate preparation andreporting of information. Actuarial activities, in particular, often straddle the first line roles andthe second line. The responsibilities related to pricing and product development are within thefirst line, but assessing the adequacy of the calculation of technical provisions is often
considered a second line responsibility. There was a consistent view among survey
participants that actuaries developing products and setting prices, and actuaries assessing
the adequacy of technical provisions for those products, should be independent from eachother. There was also agreement among the survey respondents on the need forindependence between those calculating technical provisions and those evaluating theadequacy of technical provisions. Similarly, as regards pricing, the role of the actuarial function
as part of the second line should be limited to evaluating and providing advice regarding
pricing. 12 The importance of, and reasons for, independence in this case are the same as
those discussed further in Section 3. In addition, efficient cooperation and communication
among control functions and of control functions with the business is an essential element ofan effective system of internal controls. For example, allowing control functions to have a “seatat the table” in relevant business line discussions enables Key Persons in Control Functions
to provide valuable input at all stages of the process, including initial discussions on
a proposed course of action.
2.3

Role of control functions when business activities are outsourced

15.
The responsibilities of Senior Management and control functions are not eliminated ordiminished when business activities are outsourced 13. On the contrary, the effectiveness ofcontrol functions is often more important precisely because business activities are outsourced
and therefore may be more challenging for the insurer’s Board and Senior Management tooversee. The insurer’s activities that are subject to evaluation by the actuarial function is anarea that is commonly outsourced, particularly by smaller insurers. This may create a numberof supervisory challenges.
16.
If an activity is outsourced, the control functions – within the scope of their
responsibilities – have the additional tasks to check whether and how internal quality control
mechanisms are applied to the outsourced activity. This includes verifying whether an internal
person is involved in assessing if the external provider is carrying out the task properly andwhether this internal person has the necessary qualifications and seniority for this task.

11 ICP 8.2.3.

12 See ICP 8.6 and 8.6.4, 10th bullet.

13 Outsourcing is defined in the IAIS Glossary as an arrangement between an insurer and a service provider,whether internal within a group or external, for the latter to perform a process, service or activity which would
otherwise be performed by the insurer itself.
PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 7 of 27

Public

17.
Supervisors should assess whether control functions understand their control
responsibilities related to outsourced business activities. The insurer is responsible for all of
its activities, including those that are outsourced, and its control functions should understandand monitor risks created by outsourcing business activities. Depending on the materiality ofoutsourced business activities, increased supervisory attention may be warranted for thecontrol functions with the responsibilities related to those outsourced business activities.
18.
Challenges related to control functions themselves being outsourced are covered in
Section 7.
2.4

Importance of independence and stature for effective control systems

19.
Assessing whether an insurer has effective systems of risk management and internal
controls can be more challenging than supervision of quantitative aspects of an insurer’sbusiness model. In order to make the determination that an insurer’s control functions are
effective, supervisors should be able to observe, among others, two fundamental qualities –independence and stature.
20.
A control function with appropriate independence and stature demonstrates both thewillingness to identify weaknesses within the organisation and the capability to recommend
necessary changes to the Board and Senior Management. Challenges related to assessing
independence and stature, along with practices used by supervisors to address challenges,
are covered in Sections 3 and 4 respectively.

3

Independence of control functions

21.
As noted in ICP 8.3, as part of the effective systems of risk management and internal
controls, “the supervisor requires the insurer to have effective control functions with thenecessary […] independence”.
22.
The central role and level of independence of control functions may be adversely
impacted depending how these functions are considered, established, and positioned in thereporting structure within the insurer. Additionally, remuneration practices and processes for
dealing with conflicts of interest may affect the independence of control functions. In thisregard, the supervisor should assess how well an insurer’s functions align with good practices
applied across the insurance sector and are compliant with governance requirements.
23.
Below are high-level questions supervisors should consider when assessing theindependence of an insurer’s control functions:•

Are the appointment, performance assessment, remuneration and dismissal of Key
Persons in Control Functions subject to the approval of, or the consultation with, theBoard or relevant Board Committees?

•

Are Key Persons in Control Functions suitable 14 to perform the function?

•

Are reporting lines clear and do they promote independence? 15

14 According to ICP 5, suitability of Key Persons in Control Functions consists of two components: competence andintegrity. Suitability should also be considered in the context of stature, see Section 4.
15 For more about reporting lines, see subsection 4.4.

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 8 of 27

Public•

Is remuneration for Key Persons in Control Functions and their staff heavily dependent
on the financial performance of the insurer, creating a potential conflict of interest? 16•

Are conflicts of interest identified and avoided where possible? Where they may be
unavoidable, are the risks from conflicts of interest transparent and properly mitigated?
For example, in case of internal staff moves into control functions, do policies take into
account potential conflicts of interest and, where relevant, are there mitigating controls
in place (such as time-limited restrictions when a person responsible for businessactivities takes over as a Key Person in Control Function responsible for assessing thecontrols in the same risk area)?

•

When the control functions are combined, what is the potential impact of the
combination on the independence of those control functions and whether the risk
mitigants applied by the insurers are sufficient to address a potential negative influenceon their independence? 17•

If the control function is outsourced, is the service provider too dependent on retaining
the insurer as a client such that it is wary of being appropriately critical?

3.1

Positioning control functions in the internal structure of the insurer

24.
The way in which control functions are established and positioned in the internal
structure of the insurer may negatively affect their independence.
25.
According to ICP 8.3.9, “insurers should organise each control function and its
associated reporting lines into the insurer’s organisational structure in a manner that enables
such function to operate and carry out their roles effectively.”
26.
There are a variety of signs that an insurer’s control functions may be lacking
independence, such as:•

The reporting position of the Key Persons in Control Functions within the organisational
structure causes interference from other parts of the insurer;•

The Key Persons in Control Functions are not given the opportunity to meet directlywith the Board or the relevant Board committees and committee Chairs to discuss theirwork and identify concerns, if any;•

The Key Persons in Control Functions are involved in other tasks and projects that
could introduce bias in their professional judgment to carry out their roles withindependence (for example, active participation in operational business lines’
executive decision making);•

The roles and responsibilities of Key Persons in Control Functions are not clearly
defined or potential conflicts of interest involving those persons are not properly
identified or managed;•

The control function lacks the resources and stature necessary to fulfil its
responsibilities 18;

16 For more about remuneration, see subsection 3.2.

17 For more about the combination of control functions, see Section 6 and subsection 5.1 regarding the combinationof the internal audit function with the second line control function.

18 Section 4 of this Application Paper describes issues related to stature of control functions.

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 9 of 27

Public•

The Key Persons in Control Functions are unsuitable to perform the function; and/or•

The Key Person in Control Function has a weak stature, or the person in charge of thebusiness line exercises an overly dominant personality.

27.
Another factor that may adversely impact the independence of control functions ispressure from the first line roles. This can happen when the first line role places the financial
performance of the insurer above the importance of effective risk management and internal
controls within the insurer. Such a situation may be difficult to detect. To detect and assess
the potential pressure, the supervisor should have a clear understanding of how the plans,
strategies and profit targets of the business line can affect risk management and internal
controls, and in this way give rise to such pressure. Additionally, special circumstances could
also generate pressure from the production line. For example, in a situation where an insurer
is losing market share, the emphasis of the insurer could be on boosting production at theexpense of weaker controls. A clear allocation of execution and control responsibilities is ofprimary importance in this case. In addition, assessing whether the Key Persons in Control
Functions exhibit comfort with speaking out may help supervisors to detect if such pressure
from the first line roles is occurring.
28.
The independence of the control function may be confronted in particular when one
person is responsible for more than one control function. Another situation is when different
people are responsible for particular control functions, but the responsibilities assigned tocontrol functions are not clearly defined and potentially conflict with responsibilities of otherfunctions. For example, the responsibilities of the risk management function and the actuarial
function could conflict as regards quantitative risk assessments, such as model risk.
Overlapping or underlapping responsibilities could create uncontrolled or grey areas, which
may result in inefficiencies or gaps that become a concern for the supervisor.
29.
Another challenging situation with independence could be created when a control
function is overshadowed by another control function having relatively more stature andresources. This may be the case for a newly established control function, when additional time
may be required to establish, embed and adequately delineate the responsibilities of therespective control function in the organisation. In order to address this challenge, cooperation
amongst different control functions should be promoted, where more mature control functions
support the less mature ones and share historical learnings for setting up an independent
control function.
30.
The above mentioned challenges can be mitigated to a certain extent by following
guidance ICP 8.3.7: “The authority and responsibilities of each control function should be set
out in writing and made part of, or referred to in, the governance documentation of the insurer.
The Key Persons in Control Functions should periodically review such documentation andsubmit suggestions for any changes to Senior Management and the Board for approval, whereappropriate.”
31.
In case of an overlap between control functions’ responsibilities, which cannot be
eliminated or avoided, the supervisor should expect control functions to cooperate while
maintaining their independence and be mindful of potential gaps. Under these circumstances,control functions should harmonise their activities to form a coherent system, ensuring
appropriate control coverage of all relevant areas and that an effective flow of information isin place. Clearly setting out in writing the authority and responsibilities of each control function,
as described under ICP 8.3.7, provides the necessary basis to harmonise responsibilities andPublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 10 of 27

Public

to identify potential overlaps or gaps between activities. However, the supervisor should be
attentive to situations where actual duties and responsibilities do not match the written policies
and allocation procedures.
32.
The independence of control functions can be jeopardised in case of a combination ofa control function with (i) other second line control functions, (ii) first line and other business
responsibilities or (iii) Senior Management responsibilities. These particular challenges are
discussed in more detail in the section 6.
3.2

Remuneration of control functions

33.
According to ICP 7.6.2: “As a part of effective risk management, an insurer should
adopt and implement a prudent and effective remuneration policy. Such a policy should notencourage individuals, particularly members of the Board and Senior Management, Key
Persons in Control Functions and major risk-taking staff, to take inappropriate or excessive
risks, especially where performance-based variable remuneration is used.” It is also importantto have relevant checks and balances in place, with proper Board engagement. 19
34.
As indicated in ICP 7.6.10: “To better align performance-based incentives with the longterm value creation and the time horizon of risks to which the insurer may be exposed, dueconsideration should be given to the following: […] There should be an appropriate mix of fixedand variable components, with adequate parameters set for allocating cash versus other formsof remuneration, such as shares.” As part of this, supervisors should gain comfort that variable
remuneration of the Key Persons in Control Functions is not overly tied to shorter-termbusiness performance.
35.
Supervisors may review the insurer’s approach to remuneration and its remuneration
policy to assess whether its scope includes Key Persons in Control Functions and that it does
not improperly rely on incentives that could result in conflicts of interest. 20 To avoid any
conflicts of interest and assure independence, the approach to control functions’ remuneration
should be defined with the approval of, or after consultation with, the Board or a relevant
committee of the Board. When analysing the remuneration policy, supervisors should assess
whether remuneration of the control functions is:•

Predominantly based on the effective achievement of objectives appropriate to suchcontrol functions. 21 Supervisors should pay very close attention to criteria used todetermine the variable share of remuneration of Key Persons in Control Functions inorder to make sure that these are closely related to their missions and not to financial
results, otherwise conflicts of interest are likely to arise. These criteria should beapproved by the Board and/or Senior Management;•

Where applicable, not tied to the performance of any business units subject to theircontrol or oversight 22 but rather to the insurer’s overall performance taking into accountall relevant risks to the insurer; and19 For more details, see ICP 7.6.3 – 7.6.8.
20 See ICP 7.6.

21 ICP 7.6.7, 1st bullet.

22 ICP 7.6.7, 2nd bullet.

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 11 of 27

Public•

4

Adequate to attract and retain staff with the requisite skills, competencies, knowledge,
and expertise to discharge those control functions effectively 23.

Stature of control functions

36.
While independence supports the control function’s willingness to identify issues andbring them to the attention of the Board and Senior Management, stature supports their ability
to do so. Appropriate stature within the organisation ensures that the control function’s
concerns and recommendations are given proper consideration within the insurer by the
Board, Senior Management and other functions/business units. Stature within the organisation
requires that those within the control function, particularly Key Persons, have the appropriate
skills, competence, knowledge, experience and level of authority to effect change. It is also
crucial that control functions are sufficiently staffed with appropriately trained individuals.
37.
Below are high-level questions supervisors should consider when assessing thestature of an insurer’s control functions:•

Do the Key Persons in Control Functions and their staff have the appropriate skills andexperience needed to be effective?

•

Do control functions have appropriate quantity of skilled staff?

•

Does the control function, and in particular the Key Person, have the ability toeffectively advise and challenge the insurer, including Senior Management and theBoard?

•

Does the insurer have in place adequate policies and processes to address
recommendations issued by control functions?

•

Are the concerns and recommendations of the control functions taken seriously andacted on in a timely manner?

•

Are the findings of the control functions always or mostly positive, which could suggest
those being reviewed regularly pushed back on potential issues identified?

38.
Supervisors should be mindful of these signs and be ready to challenge insurers toprovide information on each control functions’ stature.
4.1

Skills and experience

39.
According to ICP 5.2, in order to be suitable to fulfil their roles, Key Persons in Control
Functions are required to possess competence 24 and integrity 25. In case of Internationally
Active Insurance Groups (IAIGs), the group-wide supervisor also requires Key Persons inControl Functions to have the necessary competence to fulfil their role, taking into account thecomplexity and international nature of the IAIG, any specific features of the jurisdictions where
the IAIG operates and the risks to which it is exposed. 26
23 ICP 7.6.7, 3rd bullet.

24 As per ICP 5.2.1, competence is demonstrated generally through the level of an individual’s professional orformal qualifications and knowledge, skills and pertinent experience within the insurance and financial industries
or other businesses. Competence also includes having the appropriate level of commitment to perform the role.
25 As per ICP 5.2.2, integrity is demonstrated generally through character, personal behaviour and businessconduct.
26 CF 5.2.a.
PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 12 of 27

Public40.
ICP 8 also addresses the need for control function staff to have qualifications
necessary to fulfil their responsibilities. 27 Given limited resources, it may happen that insurers
choose to allocate staff with specialised skills first to business operations. This can leave ashortfall of necessary skills and expertise for the control function. It may also happen that thecontrol function, particularly the internal audit function, is expected to carry out reviews on
multiple areas while lacking all necessary expertise.
41.
It can be difficult for the Board and Senior Management to assess whether the control
functions have the necessary skills and expertise. In this regard, supervisors may need toquestion insurers on the appropriateness and adequacy of staffing for control functions,
including in the context of succession planning for Key Persons. This not only ensures thatthe control function can properly identify issues, but also supports the stature of the control
function throughout the organisation.
42.
Assessing a control function’s stature is not straightforward for most supervisors. Whenquestioned how they assess whether the control functions possess the stature, relevant skills,
and experience needed to challenge Senior Management and business units (in particular as
business models and risk profiles of insurers evolve and make greater use of FinTech, Artificial
Intelligence and outsourcing), most supervisors responded that they use a combination of
methods. These methods include primarily suitability assessments and on-site assessmentsthat are either control function-specific or as part of broader governance and risk management
reviews. Some supervisors focus primarily on document review, paying particular attention toassessment of governance arrangements of control functions.
43.
The summaries below expand on some of the supervisory methods and focus-points
adopted for assessing stature:•

Document review, including reports from control functions, or other relevant
governance materials and policy documents of the insurer (eg minutes, agendas,
terms of reference documents);•

Periodic reviews of the control functions, including through meetings with key
individuals such as Key Persons in Control Functions, and observations of Board andrelevant committee meetings;•

Requirement that an external expert undertakes assessments of the effectiveness ofcontrol functions when supervisors have strong concerns;•

Suitability assessments:oIn the area of control functions’ activities, most commonly undertaken for the
Key Persons in Control Functions and in some instances the Chairs of therelevant Board committees with oversight responsibilities. Factors typicallyconsidered include skills, education and experience;oConsideration of the overall skills mix, or collective suitability, of oversightbodies and the control functions; andoMany supervisors have a role in reviewing the suitability assessments that are
conducted by the insurer or have further powers for pre-approval of individuals
and/or assessments, including interviewing candidates.

27 ICP 8.3.13.

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 13 of 27

Public•

Reviewing the clarity of allocation of responsibilities to the senior individuals in control
functions and individuals with oversight responsibilities;•

Reviewing the remuneration policy covering staff in control functions for inappropriate
incentives (see also subsection 3.2); and•Reviewing the frequency and effectiveness of training for Key Persons in Control
Functions and staff supporting control functions’ activities.

44.
Assessing whether insurers’ control functions have the requisite skills and experience
to be effective can be difficult for supervisors who often face the same issues. Supervisorsthat lack specialists like those needed to assess insurers’ IT and actuarial controls, can find it
difficult to challenge insurers for their lack of expertise. More broadly, a lack of expertise canmake performing thorough assessments impossible. In order to address this challenge,
supervisors should consider recruiting relevant specialists and/or providing specialised
training to its staff. In some situations supervisors, similar to insurers, may need to rely on
external resources, even if only temporarily, to fill these shortfalls in expertise.
4.2

Resource stretch

45.
In addition to assessing whether control functions possess staff with the necessary
skills and experience, it is also important to assess whether they have appropriate quantity ofskilled staff. Insufficient staffing, even if the available resources are highly skilled, can weaken
the control function’s ability to perform effectively. This can be particularly challenging forsmaller insurers, where the oversight responsibilities of multiple control functions are often
combined. Supervisors should be aware of these cases and the potential strain this situation
can put on the control functions. If necessary, supervisors should emphasise to the Board andSenior Management the importance of appropriate staffing levels. Key Persons in Control
Functions should also have the stature within the organisation to raise concerns related tostaffing levels and to have those concerns appropriately addressed by the Board and Senior
Management.
46.
Staffing issues in control functions (and within supervisors) can also happen quickly
as the adoption of new business practices and the development of new products may create
new risks and require additional knowledge. Control functions and supervisors should keep
themselves aware of these changes and be agile in their approach.
47.
Supervisors should also be cognisant of control function resources stretched thin wheninsurers combine the responsibilities of multiple control functions. The Board and Senior
Management should understand that a scarcity of resources is not an acceptable reason for
ineffective control functions. As indicated in Section 6, control functions should not be
combined if doing so results in one or more of the functions being ineffective.
4.3

Ability to challenge and raise concerns by control functions

48.
Stature includes the ability of Key Persons in Control Functions to challenge Senior
Management and to raise awareness of concerns to relevant persons throughout theorganisation. Stature is also evidenced by the way and the urgency with which the organisation
responds to concerns raised by Key Persons in Control Functions.
49.
Key Persons in Control Functions should not only have a title and position within theorganisation structure commensurate with their responsibilities, but they also need to have theskills needed to effectively challenge the business. This is often difficult for supervisors to
PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 14 of 27

Public

assess, but can be done, for example, by meeting with Key Persons in Control Functions,
relevant members of the Board (eg Chair of Audit and Risk Committee) and Senior
Management. The supervisor may also analyse meeting minutes and other relevant records
to determine whether Key Persons in Control Functions are bringing concerns to the attentionof the Board and Senior Management, whether these concerns are discussed at the meetingand how they are addressed. In this regard, the supervisor should expect the insurer to coverthose aspects clearly in meeting minutes and other relevant records. Patterns of the Board
and Senior Management ignoring the concerns of control functions, particularly if thoseconcerns are identified by internal audit, are a key red flag for supervisors.
4.4

Board engagement and reporting

50.
“[T]he Board is ultimately responsible for ensuring that the insurer has in place effective
systems of risk management and internal controls and functions to address the key risks it
faces and for the key legal and regulatory obligations that apply to it”. 28 The insurer’s system
of internal controls “should be designed and operated to assist the Board and Senior
Management in the fulfilment of their respective responsibilities for oversight and managementof the insurer”. 29
51.
“The Board should grant the head of each control function the authority andresponsibility to report periodically to it or one of its committees.” 30 “In addition to periodic
reporting, the head of each control function should have the opportunity to communicate
directly and to meet periodically (without the presence of management) with the Chair of any
relevant Board committee (eg Audit or Risk Committee) and/or with the Chair of the full
Board.” 31
52.
A challenge cited by supervisors in the survey was difficulty in assessing whether
reporting to the Board included the right volume of information, the right level of detail, andwhether the information provided the right message about the insurer’s risks.
53.
Reporting to the Board should include all key risks, but those risks that are mostmaterial should be clearly prioritised. The supervisor should expect the control functions topresent realistic risk assessments to the Board and avoid overly positive messages. Relevant
information should be provided to the Board by the control function in a timely manner. Key
Persons in Control Functions should be given sufficient time to present issues to the Board,
with time for discussion and challenge to Senior Management. Reporting should also be
actionable with risk metrics being compared to the risk appetite defined in the risk
management strategy. Standardised and coordinated reporting can help ensure that the
information presented by different control functions is consistent, objective, and forwardlooking.
54.
Supervisors often rely on the same or similar reporting as that provided by control
functions to the Board, making these challenges relevant also for supervisors. This also
highlights the difficulty supervisors face if they have to make an assessment based on
document review alone. Many supervisors included in their survey response the value ofcomplementing a review of documents prepared by control functions with on-site
investigations, including interviews with Key Persons in Control Functions and the non28 ICP 8.0.1.
29 ICP 8.2.1.

30 ICP 8.3.16.
31 ICP 8.3.17.

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 15 of 27

Public

executive directors with oversight responsibilities. In order to be able to carry out
comprehensive analysis, supervisors may seek input from both the control functions
presenting their findings and the Board committees receiving these reports.
55.
Additionally, in some jurisdictions, the supervisor attends Board meetings and Board
committee meetings as an observer. This may help the supervisor assess the way in which
the Key Person in Control Function communicates with, reports to, and is regarded by the
Board and Board committees. Meeting observations – which can provide evidence on thequality of discussions, challenge, and broader dynamics – can be complemented withinterviews with relevant individuals.

5Internal audit function

56.
As stated in ICP 8.7, the supervisor requires the insurer to have an effective internal
audit function capable of providing the Board with independent assurance regarding thequality and effectiveness of the insurer’s corporate governance framework.
57.
ICP 8.7.2 indicates that the internal audit function should provide independent
assurance to the Board through general and specific audits, reviews, testing and othertechniques. 32
58.
For the internal audit function, the emphasis is on effective challenge, or the Key
Person in Control Function’s ability to provide informed critical analysis on risk management
policies and processes, and the status to elevate the analysis to the appropriate level within
the insurer to effect change. Whether through on-site inspection or other engagements, thesupervisor should assess whether the internal audit function has the necessary attributes(stature and independence) to challenge Senior Management to adopt effective controls,
including appropriate policies and processes.
59.
There may be a variety of indicators of problems related to effectiveness of the internal
audit function, such as:•

The insurer uses the internal audit function only for performance or quality
assessments and not as a control function that provides independent assurance inrespect of the quality and effectiveness of the insurer’s corporate governanceframework;•

Restricted areas of internal audit universe, including insufficient depth or scope of audit
work in higher risk or technical areas such as Information Technology, actuarial
valuation and fraud;•

Lack of internal audit findings or/and audit recommendation follow-ups;•

Poor scoping and planning of internal audit activities, using inexperienced teams andpoor quality reports;•

Execution of the audit plans not being completed or running very late;•

Lack of involvement and/or indifference by Senior Management;

32 More details on the responsibilities of the internal audit function are provided in guidance supporting ICP 8.7, inparticular ICP 8.7.7 and 8.7.8.

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 16 of 27

Public•

Limited access to information within the insurer;•Internal audit findings and conclusions are diluted to the extent that they no longer
reflect the true severity of an issue or are consistently positive and support thebusiness unit’s goals, plans and strategies;•

Internal audit reviews demonstrate a lack of relevant technical skills; and•Audit recommendations do not address root causes.

60.
In most cases, these matters can be addressed by the supervisor meeting with theinsurer, in particular with the Board. Some jurisdictions intensify their focus on the internal
audit function and/or require independent reviews.
5.1

Combination of the internal audit function with second line control functions33

61.
ICP 8.7.3 states that, in order to help ensure objectivity, the internal audit function is
independent from management and other control functions and is not involved operationallyin the business.
62.
Survey responses highlighted that the internal audit function should only be combinedwith other control function in exceptional circumstances. In these cases, specific safeguards
should be implemented to avoid conflicts of interest. In some jurisdictions, a combination of
the internal audit function with other control functions or business responsibilities is prohibited,
given that an internal audit function should be capable of providing the Board with independentand objective assurance.
63.
As part of supervisory consideration in assessing whether combination of the internal
audit function with the second line control function is justified and appropriate, supervisors
should consider how the insurer will safeguard the independence and objectivity of the internal
audit function. Furthermore, the insurer should demonstrate that the effectiveness of theinternal audit function would not be compromised with having these functions combined. The
insurer should demonstrate to the supervisor that the roles of the combined activities aretransparently communicated throughout the entire organisation and explicitly defined within
the approved audit charter to avoid any ambiguity regarding the roles of internal audit and thesecond line control function.
64.
When considering a combination, the supervisor’s decision should be based on properconsideration of both advantages and disadvantages, as well as potential consequences,including the impact on objectivity and independence of the internal audit function.
65.
In particular, the insurer should demonstrate a clear allocation of the internal audit
function-related responsibilities or roles, which should uphold the principle of independence(eg the internal auditor responsible for a particular item in another capacity should refrain fromauditing that objective).
5.2

Supervisory use of the work of the internal audit function

66.
The majority of survey participants indicated that they use the work performed by theinternal audit function as one of the ways to identify and measure risks within the insurer. In
33 See also Section 6, which is focused on the combination of the second line control functions, also with business

responsibilities and Senior Management responsibilities. Some of the challenges and good supervisory practices
described in that section may also be applicable to the combination of the internal audit function with second line
control functions.

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 17 of 27

Public

some cases, supervisors request the internal audit function to perform specific ad-hoc or
bespoke reviews with the scope set by the supervisor. This could be done after supervisors
have gained a positive assessment of the effectiveness of the internal audit function itself.
67.
External auditors also can place reliance on internal audit, after having confirmed thatthe work of the internal audit is suitable. In this context, the supervisor can verify areas ofinternal audit that overlap with external audit before placing reliance on the work of internal
audit.
68.
Supervisors use a variety of methods to assess the work of the internal audit function(both overall and to determine its ability to provide assurance on the work of other control
functions), such as:

6•

Suitability (competence and integrity) assessments of the Key Person in the internal
audit function and in some instances of the Chair the audit committee, or combined
audit and risk committee. In some jurisdictions, the head of the internal audit control
function is approved by the supervisory authority;•

On-site assessments specifically of the internal audit function or as part of broader
supervisory assessments, including regular meetings with the head of the internal audit
function;•

Document reviews – notably reviewing reports on audits of the other control functions;•

Review of internal audit plans and, in many cases, the Board audit reports;•

A review of independent third-party assessments of the internal audit function. In somejurisdictions, the internal audit function is subject to periodic required independent
reviews and these inform the supervisor of internal audit’s effectiveness;•

Interviews with the Chief Audit Executive and the senior audit managers; and•Requiring the audit committee to review the overall performance and effectiveness ofthe head of the internal audit function and the function as a whole.

Combination of control functions

69.
Typically, an insurer has Key Persons in Control Functions and control function staff
performing their duties without simultaneously performing the duties of another control
function or assuming first line or other business responsibilities. A decision about combining
control functions should take into account the risk and size of the insurer. For example, in caseof a large insurer with a complex business model, the supervisor might not allow any
combination of control functions, whereas in the case of smaller and less complex insurers, it
may be appropriate for more than one control function to be carried out by a single person ororganisational unit.
70.
To appropriately assess the effectiveness and performance of a combined control
function, supervisors may find it helpful to make a distinction between three situations:•

A single person simultaneously performs several second line control functions,covered by subsection 6.1;•

A single person simultaneously performs control function and business responsibilities,
covered by subsection 6.2; andPublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 18 of 27

Public•
6.1

A single person simultaneously performs control function and Senior Management
responsibilities, covered by subsection 6.3.
Combination of second line control functions

71.
As noted in ICP 8.3.10: “Notwithstanding the possibility for insurers to combine certain
control functions, a control function should be sufficiently independent from Senior
Management and from other functions to allow its staff to:•Serve as a component of the insurer’s checks and balances;•

Provide an objective perspective on strategies, issues, and potential violations related
to their areas of responsibility; and•Implement or oversee the implementation of corrective measures where necessary.”72.
In the case of IAIGs, ComFrame 8.3.c states: “The group-wide supervisor requires the
IAIG Board to ensure that the group-wide control functions [...] are not combined, unlessexceptional circumstances apply.” 34
73.
The majority of supervisory approaches allow combinations of second line control
functions in insurers other than IAIGs. When it occurs, where necessary, the supervisor may
require that certain conditions be fulfilled, such as:•

There are no conflicts of interest from a functional point of view between the secondline control functions performed simultaneously, which implies that the insurer should
avoid having the person who is developing a service assess the adequacy of the said
service (maker/checker principle);•

The Key Person combining multiple second line control functions possesses theknowledge and expertise needed to perform the responsibilities of the different control
functions effectively; and•The Key Person combining multiple second line control functions has the necessary
time and resources needed to perform the responsibilities of the different control
functions effectively.

74.
A vertical combination of control functions, ie the combination of control functions
between the head of the group and an insurance legal entity, may be allowed. This approach
may be efficient from a resourcing perspective and in terms of facilitating consistency acrossthe group. However, a pure legal entity view may be missing. Allocation of duties,
competences and responsibilities to the insurance legal entity may need to be maintained. In
this case, supervisors should take into account the underlying circumstances of the
combination, such as the:•Size, scope and nature of the insurance legal entity’s business;•

Governance model of the group (centralised / decentralised);•

Degree of strategic and operational dependence between the insurance legal entity
and the group;•

Insurance legal entity’s recovery and resolution plans, if any; and

34 See also guidance supporting this ComFrame standard.

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 19 of 27

Public•

Effectiveness of the governance of the insurance legal entity to take decisions in theinterests of the safety and soundness of that entity.

The difficulty may be resolved by requiring the clear allocation of duties for both the head of
the group and the insurance legal entity, and requiring arrangements that facilitate proper
reporting to the Board of the insurance legal entity. In such a situation, the identification andmanagement of conflicts of interest remains crucial.
6.2

Combination of control function and business responsibilities

75.
Combining business and control responsibilities should be avoided, as it raises anumber of issues related to risk management and conflicts of interest. However, this may not
be realistic for smaller insurers with more limited resources. When business and control
responsibilities are combined, most supervisors exercise proportionality when assessing therisks from potential conflicts of interest and the insurer’s techniques to identify, manage andmitigate these risks.
76.
For small and medium size insurers, issues related to the independence of the Key
Persons in Control Functions from the business units represent a challenge. Supervisors find
it difficult to require full segregation of functions for these entities but seem to still expect
independence, requiring explicit separation of risk management and risk-taking decisions forthe same risks.
77.
When a Key Person in Control Function also holds business responsibilities, it may beeasier for supervisors to gain comfort if these responsibilities are less risk-generating, like
Legal or Human Resources.
78.
Where necessary, supervisors may address issues created by the combination ofcontrol function and business responsibilities by requiring risk mitigation measures, such as:

6.3•

Performing an independent review;•

Suggesting modifications in the structure to avoid a situation where work done by one
person responsible for a certain business area is assessed by the same person, who
is at the same time a head of a control function;•

Requiring the establishment of a formal reporting process to the Board in the event ofconflicts of interest; and•Having more regular contact with the control function to assess its effectiveness.
Combination of control function and Senior Management responsibilities

79.
Depending on their position in the organisational structure of the insurer, Key Persons
in Control Functions may be considered as separate from, or as part of, Senior Management. 35
In the latter case, the individual’s Senior Management role would typically only involve control
responsibilities. Regardless of the organisational structure, where it is justified, the supervisor
may allow for combining a Key Person in Control Function and (other) Senior Management
roles. When this occurs, the supervisor may require that certain conditions be fulfilled, suchas:
35 According to the IAIS Glossary, the term “Senior Management” means the individuals or body responsible formanaging an insurer on a day-to-day basis in accordance with strategies, policies and procedures set out by the
Board. See ICP 7.10 for more details about responsibilities of Senior Management.
PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 20 of 27

Public•

The role of a Key Person in Control Function is not combined with risk-generating
responsibilities;•

Such a person has the necessary time and resources to correctly perform the tasks
conferred upon this person as a Key Person in Control Function; and•Such a combination is accompanied by specific policies and processes to avoid
conflicts of interest (providing in particular for escalation to the Board).

80.
Outcomes from the survey indicate the following are ways supervisors overcome
challenges that may be created by a combination of a Key Person in Control Function and(other) Senior Management roles:

7•

Maintaining relevant reporting lines: in this regard, the person combining those two
types of responsibilities continues to have a direct reporting line to the Board and isable to escalate directly issues to the Board in the capacity of a Key Person in Control
Function;•

Specifying limited assignment tasks when dealing with Senior Management
responsibilities: in this regard, a good practice can be to consider that a person can
only be responsible for the control function to the extent that control function and Senior
Management responsibilities are exercised separately from each other; and•Specifying that in case of combining the responsibilities of a control function with thoseof Senior Management, the control function’s responsibilities should always beprioritised.

Outsourcing of control functions

81.
In general, the reasons for outsourcing may include cost savings, improving
performance and access to skills, expertise and resources that are not available in-house.
Another driver of outsourcing are stretched resources caused by the insurer’s inability to keep
up with growth. Small insurers may not need a full time equivalent for performing their control
activities and therefore may consider outsourcing control functions to a third party.
82.
There are different supervisory approaches towards the extent of outsourcing control
functions. Some supervisors do not allow control functions to be completely outsourced,
whereas other supervisors apply the principle of proportionality, including allowing smaller
insurers to outsource control functions. For small insurers, for example, it may be sufficientthat, instead of maintaining a separate Key Person in Control Function in the insurer
outsourcing the control function, a member of executive management of such an insurer has
assigned responsibility for control functions and non-executive staff perform control tasks.
Some supervisors impose limitations of outsourcing in terms of content and extent (eg only
certain operative tasks of the control function may be outsourced).
7.1

Challenges related to supervision of outsourced control functions

83.
As stated in ICP 8.8: “The supervisor requires the insurer to retain at least the same
degree of oversight of, and accountability for, any outsourced material activity or function (suchas a control function) as applies to non-outsourced activities or functions.” Supervision ofoutsourced control functions creates a number of challenges, such as:•

Supervision of the process of outsourcing control functions;PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 21 of 27

Public•

The assessment of the effectiveness of the outsourced control functions; and•On-site inspections of control function that have been outsourced to other jurisdictions,
whether within or outside the group. These include logistical, resource-related andpotential legal challenges.

84.
The supervisor should also be mindful of the potential challenges for the insurer thatcan be created by outsourcing of control functions:•

Assessment and determination of which control function activities may be outsourced,
while ensuring that the overall responsibility for the control function remains with theinsurer;•

Identification and mitigation of potential conflicts of interest of the third-party service
provider (for example, the control function is outsourced to a service provider that also
provides other services to the insurer);•

Efficiency of cooperation between the outsourced control function and other control
functions, business lines, Senior Management and the Board;•

Ensuring that the external auditor remains independent if the insurer also outsources
its internal audit function to the same provider; and•A lack of understanding of local circumstances, for example in cases where an
insurance legal entity’s control function is outsourced to the group level or to an
external service provider in another jurisdiction.

7.2

General good supervisory practices

85.
According to ICP 9.3: “The supervisor reviews outsourced material activities orfunctions to the same level as non-outsourced material activities or functions.” Challenges withsupervising material activities or functions that have been outsourced, including those listed
in the previous subsection, may be addressed by supervisors in a variety of ways, such as
those listed below. 36••

Supervision of the selection of the service provider:o

Before entering into an outsourcing arrangement for a material activity orfunction, request the insurer to perform suitability assessments of service
providers;oBefore entering into an outsourcing arrangement for a material activity orfunction, request the insurer to provide an appropriate exit plan for a plannedor unexpected end to the outsourcing; andoAssess whether the insurer's due diligence process is comprehensive andeffective.

Activities related to the outsourcing contract:oRequire any outsourcing agreement to give the supervisor the same access tothe outsourced provider as to the insurer;

36 The list reflects a number of relevant examples of good supervisory practices provided in the Peer Review ofCorporate and Risk-Governance relative to the standards set out in ICPs 4, 5, 7 and 8, referenced in footnote 1.

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 22 of 27

Public••oRequire the insurer to report material outsourcing contracts to the supervisor
before inception. This may include a copy of the service level agreement if thesupervisor considers it appropriate in order to assess whether the insurer has
sufficient oversight rights; andoReview the content of the agreements in regard of specific clauses, in addition
to checking the existence of an appropriate outsourcing agreement (eg toaddress the insurer's monitoring and control). In some cases, for example,
where control functions are outsourced to a significant extent, supervisors
perform a more granular assessment of the outsourcing agreement (eg clauseby-clause review).

Supervision of internal arrangements related to ongoing management of material
outsourced functions:oReview whether the insurer has integrated the outsourced functions into its risk
management and the internal control system;oAssess whether the outsourced function is included in the scope of internal
audit’s work;oAssess the ongoing supervision by the insurer over the service provider’sperformance;oInterview the service provider to assess how the insurer monitors the service
provider’s performance; the expertise, knowledge and skills of the service
provider; as well as its service capability and financial viability;oAssess reporting to Senior Management and the Board covering theoutsourced control function and the insurer’s oversight of the outsourced
control function;oRequire that the Key Person in Control Function be employed by the insurer
and maintain overall responsibility for the outsourced control function;oAssess whether a nominated individual of sufficient seniority within the insurer
has responsibility for outsourced functions. The responsible person should besuitably qualified and have sufficient time to carry out the role; andoRequire mitigation measures if the outsourcing of control functions has thepotential for creating conflicts of interest or otherwise jeopardising theindependence of the control function.

Supervision of how risks associated with outsourcing of material activities or functions
are managed:oAssess the risks associated with outsourcing and reflect the results of such anassessment in the supervisor's risk rating of the insurer. In some cases,
supervisors compare the risk assessment with the insurer's assessment ofrelevant aspects of operational risks in the insurer’s Own Risk and Solvency
Assessment (ORSA);o

Check whether and how the insurer has carried out a risk analysis whenoutsourcing;

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 23 of 27

Public

8oRequire insurers to maintain a rigorous third party risk management
programme;oDiscuss with the Senior Management, the Board and the service provider theongoing management of the risks associated with the outsourcing
arrangement; andoRequest assessment reports by the insurer on the performance of the service
provider.

Group-wide control functions

86.
Most of the challenges described in previous sections of this Application Paper apply
to both insurance legal entities and insurance groups. In addition, group-wide supervisors may
encounter challenges that are specific to supervision of group-wide control functions. 37
8.1

Inadequate or inconsistently applied group policies

87.
Challenges specific to group-wide supervision include: group policies that are
inadequate or applied inconsistently throughout the group 38; and insufficient time andresources allocated to the group-wide control functions. Supervisors address these challenges
in various ways, including by:•

Discussing with the Key Persons in Control Functions the group’s approach towards
coordination of control function responsibilities between the group and business lines,
to assess whether there is appropriate consistency between policies of all the entities
within the group;•

Requesting rationale for specific decisions that may cause supervisory concerns
during these conversations;•

Making sure that suitability assessments of group-wide control functions are performedat the level of the group, ie taking into account the broader perimeter of the businessmodel and complexity of the group;•

Reviewing the documented roles and responsibilities of the group-wide control
functions, including how the group-wide and insurance legal entities’ control functions
are meant to interact 39, how the group-wide control functions, in their own fields,
ensure the harmonisation of the group’s methods and assess the proper
implementation of policies defined at group level, and compare them with observed
practices. If inadequate, requiring more comprehensive policies;

37 See also the IAIS Application Paper on Group Corporate Governance, in particular Section 3.7 Control functions.
38 Group policies might be inadequate if they do not take into account the obligations of its insurance legal entities

to comply with local laws and regulations.
39 As indicated in para. 62 of the Application Paper on Group Corporate Governance, while there should beconsistency between insurance legal entity and group policies, insurance legal entities within a group also need todefine their own policies and processes to face local requirements and challenges. This tension should prompt
different supervisory responses for more decentralised groups and more centralised groups. See also
paragraph 41 of the Application Paper on Group Corporate Governance, which states that involved supervisors
should use the supervisory college (if one exists) to explore conflicts between group objectives and strategies andlocal specificities, such as culture.
PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 24 of 27

Public•

Requiring the group-wide internal audit function to include in its audit plan a specificassessment of individual insurance legal entity’s/business line’s compliance withgroup-wide policies; and•Carrying out on-site inspections and off-site reviews, for example:

8.2

oOrganising interviews with Senior Management of the head of the group toassess whether they have sufficient knowledge of the organisational structureof subsidiaries and the relationships between these entities; andoObtaining evidence of communication between group-wide control functions
and legal entities’ control functions and a continuous feedback loop between
them.

Cross-sectoral and international groups

88.
Specific challenges may arise from the existence of different types of activities indifferent parts of the group (ie life and non-life insurance, as well as other financial sector
activities, such as banking or asset management). For international groups, jurisdictional
differences can create additional challenges, in particular for the group-wide control functions.
89.
Groups often enact minimum expectations in group-wide guiding policies and thencreate bespoke policies and processes in each of the business lines or insurance legal entities.
The process of adopting these policies at the insurance legal entity’s level can be hindered if
the group is slow to provide the insurance legal entity with relevant information on certain
business lines. It may also happen that the lines of business in particular insurance legal
entities do not fully understand the policies. Group-wide supervisors may address thesechallenges in various ways, including by:•

Verifying whether there is effective and timely cooperation and information sharing
between all the control functions active in different sectors or lines of business of thegroup; and•When suspecting issues in this regard, analysing internal audit reports, which may
point out these issues.

90.
Group-wide control functions of international groups often need to understandbusinesses in a range of jurisdictions as well as legal and regulatory frameworks of thosejurisdictions. This can be a challenge in terms of finding the right skills and expertise.
Sometimes the group-wide control functions do not have sufficient oversight of the insurance
legal entity’s businesses or the insurance legal entity’s control functions are under-resourcedor do not have sufficient stature in the context of the group.
91.
The group-wide supervisor may need to communicate to the head of the groupconcerns regarding the allocation of sufficient resources with relevant skills and expertise togroup-wide control functions. Other involved supervisors can also discuss these concerns with
their insurance legal entity’s Board and Key Persons in Control Functions to gain assurance
about their skills and independence. Involved supervisors may also discuss these issues
collectively, in order to reach a common understanding of existing challenges and potential
ways of addressing them.

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 25 of 27

Public

8.3

Inadequate communication

92.
Maintaining adequate communication between the group-wide control functions andthe insurance legal entities’ control functions can be a challenge for insurance groups.
A group’s specific organisational model may create additional challenges with communication.
For example, in groups with a more centralised governance model, supervisors have seencases of information diluted as it is communicated from the insurance legal entity to the headof the group, which can take time. In cases of more decentralised governance models, thelack of a central point of responsibility can sometimes lead to inefficiencies in the internal
control systems if certain areas are not covered by any specific entity in the group. These
challenges can be addressed in various ways, including by:•

Verifying that the tasks and responsibilities of each control function at the entity orgroup-wide level are clearly established within group-wide policies and internal audit
reports and that there is appropriate and effective reporting from insurance legal
entities to the head of the group;•

Verifying that there are effective channels for coordination and regular informationexchange between the group-wide control functions and the insurance legal entities’control functions;•

Verifying that the Key Person in Control Function at the group-wide level has thenecessary authority reflected in the insurers’ organisational structure and direct accessto the Board and Senior Management of the head of the group; and•Confirming that the corporate culture within the group allows for transparent reportingof information to the upper level without fear of retaliation.

8.4

Outsourcing of control functions within the group

93.
Some supervisors indicated that outsourcing of control functions, if allowed, may posechallenges. Conflicts of interest may arise when a Key Person in Control Function at the groupwide level also performs the control function outsourced by the insurance legal entity to thehead of the group.
94.
Supervisors may take various actions to address challenges created by outsourcing ofcontrol functions within the group, such as:•

Consider which roles for different insurance legal entities’ control functions are held by
one person at the group-wide level(especially their availability to assume all theirrespective functions);•

Require the head of the group to have a clear view and documentation showing which
control functions relate to which insurance legal entity within the group;•

Check that the tasks and responsibilities of control functions are clearly distinguishedand justified, in case of a combination of control functions of an insurance legal entity
and the ones of the group;•

Assess whether the insurance legal entity, whose control function has been
outsourced to the group level, has authority over the Key Person in Control Function
at the group-wide level as to the functioning of this insurance legal entity;

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 26 of 27

Public•

In case of outsourcing of a group-wide control function to an insurance legal entity,
assess whether the team assigned to the insurance legal entity is performing
adequately the coordination tasks belonging to a group-wide control function; and•Require that outsourcing of control functions within the group (either to the head of thegroup or another legal entity in the group) or outside the group to be subject toa notification to the relevant involved supervisor.

PublicApplication Paper on Supervision of Control Functions
Adopted by the Executive Committee on 22 June 2021

Page 27 of 27