Application Paper onGroup Corporate GovernanceNovember 2017

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 1 of 34

About the IAISThe International Association of Insurance Supervisors (IAIS) is a voluntary membershiporganisation of insurance supervisors and regulators from more than 200 jurisdictions.
The mission of the IAIS is to promote effective and globally consistent supervision of theinsurance industry in order to develop and maintain fair, safe and stable insurance
markets for the benefit and protection of policyholders and to contribute to global financial
stability.
Established in 1994, the IAIS is the international standard setting body responsible fordeveloping principles, standards and other supporting material for the supervision of theinsurance sector and assisting in their implementation. The IAIS also provides a forum forMembers to share their experiences and understanding of insurance supervision andinsurance markets. In addition to active participation of its Members, the IAIS benefits
from input in select IAIS activities from Observers representing international institutions,professional associations and insurance and reinsurance companies, as well as
consultants and other professionals.
The IAIS coordinates its work with other international financial policymakers andassociations of supervisors or regulators, and assists in shaping financial systems
globally. In particular, the IAIS is a member of the Financial Stability Board (FSB),
founding member and co-parent of the Joint Forum, along with the Basel Committee on
Banking Supervision (BCBS) and the International Organization of Securities
Commissions (IOSCO), member of the Standards Advisory Council of the International
Accounting Standards Board (IASB), and partner in the Access to Insurance Initiative(A2ii). In recognition of its collective expertise, the IAIS also is routinely called upon by theG20 leaders and other international standard setting bodies for input on insurance issues
as well as on issues related to the regulation and supervision of the global financial sector.

Application Papers provide additional material related to one or more ICPs, ComFrameor G-SII policy measures, including actual examples or case studies that help practicalapplication of supervisory material. Application Papers could be provided in circumstanceswhere the practical application of principles and standards may vary or where theirinterpretation and implementation may pose challenges Application Papers can provide
further advice, illustrations, recommendations or examples of good practice to supervisors
on how supervisory material may be implemented.

This paper was prepared by the Governance Working Group in consultation with IAIS
Members.
The publication is available free of charge on the IAIS website (www.iaisweb.org).
© International Association of Insurance Supervisors 2017. All rights reserved. Brief excerpts
may be reproduced or translated provided the source is stated.
Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 2 of 34

Application Paper on Group Corporate Governance
Table of Contents
1.

Introduction .............................................................................................................................................. 4

1.1

Objectives of the Application Paper ......................................................................................... 4

1.2

Inputs for this Paper ................................................................................................................. 4

2.

Glossary .................................................................................................................................................... 6

3.

Supervision of Insurance Group Governance ...................................................................................... 7
3.1

Supervisory coordination and cooperation ............................................................................... 8

3.1.1

Coordination arrangements ........................................................................................................ 8

3.1.2

Information exchange ................................................................................................................. 9

3.1.3

Impact of group structure ......................................................................................................... 10

3.2

Objectives and strategies ....................................................................................................... 12

3.2.1

Clear understanding of Objectives and Strategies ................................................................... 13

3.2.2

Consistency between group and insurance legal entity objectives and strategies .................. 13

3.3

Allocation of oversight and management responsibilities ...................................................... 15

3.3.1

Allocation roles and responsibilities of Board and Senior Management .................................. 15

3.3.2

Composition of Board ............................................................................................................... 16

3.4

Policies and processes .......................................................................................................... 18

3.4.1

Supervision of policies ............................................................................................................. 18

3.4.2

Setting of policies ..................................................................................................................... 19

3.4.3

Consistency of policies ............................................................................................................. 20

3.4.4

Policy content ........................................................................................................................... 20

3.4.5

Internal controls for policies ..................................................................................................... 22

3.5

Risk management .................................................................................................................. 23

3.5.1

A common risk culture across the group .................................................................................. 23

3.5.2

Risk Appetite ............................................................................................................................ 25

3.5.3

Risk management activities ..................................................................................................... 25

3.5.4

Risk aggregation and reporting ................................................................................................ 26

3.6

Compliance ............................................................................................................................ 28

3.7

Control functions .................................................................................................................... 30

3.7.1

Effectiveness of group Control Functions ................................................................................ 30

3.7.2

Effective communication between control functions at the group and entity level ................... 32

3.7.3

Outsourcing .............................................................................................................................. 33

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 3 of 34

1. Introduction
1.1 Objectives of the Application Paper
1.

This Application Paper aims to provide good supervisory practices and examples toaddress challenges specific to the governance of insurance groups. The purpose of the
Application Paper is also to create a common understanding among supervisors on
how to assess or evaluate the governance frameworks of insurance groups 1. It also
provides material for the practical application of existing principles, standards andguidance on group governance; however, it does not set new standards.

2.

The recommendations described in this Paper are applicable across supervisory
approaches among jurisdictions as well as across the spectrum of governancestructures. This Application Paper is relevant for all groups, but is particularly useful forthe supervisors of insurance groups with more complex structures that may require
heightened coordination between involved supervisors.

3.

As groups pose specific challenges to supervision, this Application Paper aims tocontribute to the effective supervision of group governance by providing guidance on
how supervisors can deal with these challenges.

4.

This Application Paper aims to provide good practices related to group governancerelevant to:• the supervision of the corporate governance framework, Board composition andthe allocation of responsibilities between the Board at the head of the group andBoards at the level of the insurance legal entities (ICP 7);• the supervision of the risk management system and the reporting lines between
control functions within the insurance group (ICP 8);• the allocation of responsibilities between the group-wide supervisor and other
involved supervisors (ICP 23); and• cooperation and coordination between involved supervisors with regard to groups(ICP 25).
1.2 Inputs for this Paper

5. This Application Paper relies on the main conclusions of the October 2014 IAIS Issues
Paper on Group Corporate Governance; Impact on Control Functions (Issues Paper)and aims to provide supervisory responses and best supervisory practices for the fivemain areas where insurance groups face challenges as identified in the Issues Paper:• setting objectives and strategies;• allocation of oversight and management responsibilities;• policies and processes;• risk management and compliance; and• control functions.

1 An insurance group may include multiple branch operations, which could give rise to the governance issues

discussed in this paper. For details regarding supervision of branch operations please refer to the IAIS Issues
Paper on Supervision of Cross-Border Operations through Branches (October 2013).

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 4 of 34

6. The Issues Paper identified two approaches to group governance structure – more
centralised and more decentralised – explaining that both approaches pose challenges
but can result in effective governance. This Application Paper also distinguishes
between more centralised and more decentralised governance models, whereappropriate, and highlights specific supervisory practices that are appropriate to eachapproach. The approach of most insurance groups falls somewhere between the two
extremes of more centralised and more decentralised; however, while the two poles arehighlighted in this paper, the whole spectrum of group governance approaches iscovered.
7. This Application Paper is based on the premise that good governance is achievable
regardless of the particular governance structure an insurance group adopts. While
IAIS material describes different group structures, it does not prescribe that insurancegroups use any particular approach. Accordingly, this Application Paper should not beread as advocating any preference for a specific approach.
8. Lastly, this Application Paper draws upon the results of a survey of IAIS members
launched in March 2016, to which 28 jurisdictions responded with descriptions ofsupervisory practices on group governance.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 5 of 34

2. Glossary
9.

Generally, terms used in this Paper are defined terms in the IAIS Glossary. For
convenience some of those terms are included here as well as other more generalterms defined for the purposes of this Paper:a) “Board" means the Board of Directors of any entity within the group, a body ofelected or appointed individuals ultimately responsible for the governance andoversight of the insurer; 2b) "Control functions" mean those functions that have a responsibility distinct frommanagement to provide objective assessment, reporting and/or assurance. This
includes the risk management, compliance, actuarial and internal audit
functions; 3c) "Governance" means "corporate governance," a set of relationships between an
insurer's Board, Senior Management, customers and other stakeholders; and astructure through which the objectives of the insurer are set, and the means ofattaining those objectives and monitoring performance are determined); 4d) "Group" means "insurance group";e) "Group level" means that the roles and key players of the group are organised
somewhere within the group. The term ‘group level’ does not necessarily mean
the insurance legal entity at the level of the head of the group;f)"Group-wide governance" means the governance of the head of the group andthe group-wide application of the group governance framework to all material
activities and entities of the group; 5g) "Group-wide supervisor" means the supervisor(s) responsible for promoting
effective and coordinated supervision of an insurance group including
coordinating the input of insurance legal entity supervisors in undertaking thesupervision of an insurance group on a group-wide basis, as a supplement toinsurance legal entity supervision; 6h) “Involved supervisors” means the supervisors engaged in the supervision of an
insurance group. Depending on the circumstances of the particular insurancegroup and the jurisdictions in which it operates, it could include all supervisors
engaged in the supervision of entities within the insurance group 7.
i)"Key Persons In Controls Functions" means persons responsible for heading
control functions; 8j)"Centralised or decentralised approach" means the type of governance structurea group uses (e.g., a more centralised or a more decentralised model); andk) "Senior Management" means the individuals or body responsible for managing
the business on a day-to-day basis in accordance with strategies, policies andprocedures set out by the Board. 92 See IAIS Glossary and ICP 7, Introductory Guidance 7.0.5 and 7.0.6.
3 See IAIS Glossary.
4 See IAIS Glossary.

5 Joint Forum Principles for the supervision of financial conglomerates: Explanatory comment 10.3.
6 See IAIS Glossary.
7 See IAIS Glossary.

8 See IAIS Glossary.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 6 of 34

3. Supervision of Insurance Group Governance
10.

Effective corporate governance at the group and insurance legal entity level isessential for all insurers, and may help insurance groups to mitigate the associatedrisks of carrying on businesses in complex conglomerates or group structures.

11.

Groups organise themselves in different ways, including through insurance legal
entities or along geographic and/or business lines that cut across insurance legal
entity boundaries. The Board of the head of the group has the responsibility toorganise the group in a way that is best suited to meet its overall objectives.

12.

A group adopts the corporate governance structure which it believes will mosteffectively support and enhance its ability to manage the business of the groupsoundly and prudently. As discussed in the Issues Paper, the extent to which thegroup adopts a more centralised or more decentralised approach will affect its
corporate governance structure. This determines the:• degree of authority or autonomy given to the group level and to different entities
within the group to set the objectives and strategy (section 3.2), policies andprocesses (section 3.4) and organise the risk management and internal controls(section 3.5);• allocation of responsibilities and accountabilities of Senior Management, Board
Members and Key Persons in Control Functions within the group (section 3.3);
and• control functions at different levels of the group, how they interact with each otherand with the group as a whole (section 3.7).

13.

It is good practice for the group-wide supervisor to verify that the head of the grouphas established, implemented and operates a corporate governance framework
appropriate to the business and risks of the group and its entities. To carry out its
supervisory responsibilities effectively, the group-wide supervisor should cooperateand coordinate with other involved supervisors. As supervisory cooperation andcoordination is good practice that affects all facets of group corporate governance, itis addressed as an initial matter below.

14.

At the beginning of each sub-section, a picture is included to illustrate the mainelements of the topic and the tools which supervisors should use to assess theseelements (for sub-section 3.1 and 3.6) or the factors for each element which thesupervisor should assess (for sub-section 3.2 - 3.7).

9 See IAIS Glossary.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 7 of 34

3.1 Supervisory coordination and cooperation

3.1.1

Coordination arrangements

15.

In order to facilitate the comprehensive oversight of insurance legal entities and on agroup-wide basis, supervisors should take steps to put in place adequate
coordination arrangements on cross-border issues 10.

16.

Whether a group has a more centralised or more decentralised governanceapproach, cooperation and coordination among supervisors is essential tounderstanding and assessing the inherent risks pertaining to interrelationships,
interconnections and interdependencies between the different entities of the group. In
a more decentralised group, other involved supervisors can provide the group-wide
supervisor with important information about governance at the insurance legal entity
level. In a more centralised group, it is good practice for the group-wide supervisor tokeep the other involved supervisors informed of governance concerns. In either case,cooperation and coordination between the involved supervisors help identify whether
the group and all insurance legal entities within the group are meeting governance

10 ICP 25.1.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 8 of 34

requirements. In addition, supervisory cooperation helps ensure that groups receive
consistent supervisory messages from all involved supervisors.
17.

Various mechanisms exist to foster cooperation between supervisors, promote
communication and information exchange, and facilitate enhanced coordination ofgroup-wide supervision. However, these mechanisms depend on the willingness ofsupervisors to engage with them. Supervisors should work together to arrange
adequate cooperation and coordination at all levels of the group as appropriate 11.
Supervisors may also need to work with other relevant authorities (such as law
enforcement personnel or other sectoral supervisors).

18.

Coordination arrangements, such as supervisory colleges, are tools that can be used
to enhance cross-border cooperation and coordination (see IAIS Application Paper
on Supervisory Colleges). Coordination arrangements are informed by the nature,scale and complexity of the group and the number and role of involved supervisors,
and are established and detailed through unilateral, bilateral or multilateralagreements, such as a memorandum of understanding (MoU).

19.

It is important that a strict confidentiality regime exists among all supervisors involvedin coordination arrangements. The confidentiality requirements set out in ICP 2 (TheSupervisor) and ICP 3 (Information Sharing and Confidentiality Requirements) apply
to all forms of communication and are applicable to the discussion of supervisory
practices in this Application Paper.

3.1.2

Information exchange

20.

Involved supervisors can use a variety of methods, in terms of frequency and form, toshare information about the group. According to the survey responses, mechanismsthat are used to facilitate effective communication with other involved supervisors
when their authority is the group-wide supervisor include regular means (e.g., inperson supervisory college meetings) and ad hoc means (e.g., bilateral calls). These
regular and ad hoc means of communication may be scheduled or unscheduled(e.g., unscheduled phone calls between operational/line supervisors). Both types ofmeans are considered to be important supervisory communication tools. Suchinformation-sharing methods should be used by supervisors to share significant
events that may affect the group.

21.

Where a governance issue involves a particular insurance legal entity within thegroup, the group-wide supervisor may decide to have a bilateral discussion only withthe supervisor of a particular insurance legal entity rather than with all other involved
supervisors. Similarly, it is good practice to facilitate meetings that include the Board
and/or Senior Management of both the group and the relevant insurance legal entity
within the group, as well as the group-wide supervisor and the relevant other involved
supervisor.

22.

To facilitate ad-hoc sharing of information and opinions it is important to build trust
and relationships between involved supervisors. It is good practice for involved
supervisors to aim at building relationships and trust by engaging in joint activities,
such as secondments between supervisors.

11 See paragraph 62 of the Issues Paper.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 9 of 34

3.1.3

Impact of group structure

23.

Whether an insurance group is more centralised or more decentralised will affect thedivision of roles between involved supervisors. For instance, in a more centralised
group, the group-wide supervisor will be best placed to have an overview of thegroup’s objectives and strategies (as these will be centrally set) and should ensurethat these are communicated to other involved supervisors, whether throughsupervisory colleges or other means of coordination arrangements. In more
decentralised group structures, it is likely that other involved supervisors will be better
placed to assess objectives and strategies as these will largely be set at lower levels
within the group.

24.

Involved supervisors may find that the potential issues arising from group structures
also impact on the relationship between supervisors of different parts of the group(for example over the amount of capital held at different levels within the group).
Where such issues arise, these should be resolved, for example, at college meetingsor through bilateral discussions.

25.

Certain complex group structures may create risks and can make it difficult for bothmanagement and supervisors to have a clear view of the group structure andassociated risks, thus hindering effective supervision. For example, the use ofmultiple holding companies located in different jurisdictions, affiliated reinsurance
arrangements, or shared service arrangements are circumstances which may make it
difficult for involved supervisors to organise appropriate group supervision.

26.

Insurance group structures should be sufficiently documented and transparent tomanage the business as well as reduce the likelihood that gaps or duplication in
regulatory oversight between jurisdictions occur and so enable effective group-wide
supervision. It is good practice for the group-wide supervisor to take into account thelegal and management structure of the group in evaluating its corporate governanceframework 12. It is good practice for group-wide supervisors to have a group
document its group structure. It is also considered to be good practice for group-wide
supervisors to require a group to make publicly available at least a simplified groupstructure, updating this information when necessary.

27.

The group-wide supervisor and other involved supervisors should review the
documentation of group structure at least annually. The review of this document, as
well as other interactions with the group, such as meetings with the Board of thehead of the group and insurance legal entities within the group, should help involved
supervisors to assess the risks that might arise from the group structure.

28.

It is considered as good practice for the group-wide supervisor to either approve or
be notified of any material acquisitions or disposals of entities or mergers or
restructuring within the group. The other involved supervisors should either approveor be notified of any direct or indirect change in the owners of insurance legal entities
under their supervision. Such notifications should be made by the relevant entity toits supervisor. The group-wide supervisor should also make other involved
supervisors aware of relevant changes and that these are discussed in supervisory
colleges where appropriate. To support effective supervision, the group-wide

12 See section 2.3 of the Issues Paper for a discussion of the interplay between legal and management
structures.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 10 of 34

supervisor needs to define clear materiality or threshold levels to obtain consistentand timely information, if not otherwise set by the jurisdiction.
29.

Involved supervisors should consider issues like actual and potential conflicts ofinterest between different legal entities within the group (for example, over capital
movement and dividend levels) or dependencies of different entities within the groupon each other (for example, through shared services or financial guarantees). Suchconflicts and dependencies may be between insurance legal entities or between
insurance legal entities and other legal entities within the group. It is goodsupervisory practice to identify and assess the effectiveness of the mechanisms
within the group to resolve such issues. In a more centralised group, thesemechanisms may occur through group level committees, whereas a more
decentralised group may place greater reliance on informal co-operation between
insurance legal entities and the head of the group. Where a group is reliant on
informal co-operation mechanisms, the group-wide supervisor should consider
whether more supervisory attention is necessary to ascertain whether thesemechanisms are working effectively. Involved supervisors may assess theeffectiveness of such arrangements through discussions with Board members andother staff involved in these arrangements and review of minutes of meetings.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 11 of 34

3.2 Objectives and strategies
30.

The establishment of specific group-wide objectives and strategies for achieving
those objectives is a Board responsibility for the head of the group. 13 These
objectives and strategies should be adequately documented and properly
communicated to Senior Management and control functions at all levels of the group.
Among other elements, these objectives and strategies should inform the group risk
appetite and risk limits. The Board should review the group’s objectives andstrategies at least annually and more frequently when required (for example, where
the group is embarking on a significant new business initiative such as a merger or
acquisition or entering new markets). 14

13 ICP 7.2.
The supervisor requires the insurer’s Board to set and oversee the implementation of the insurer’s
culture, business objectives and strategies for achieving those objectives, in line with the insurer’s long terminterests and viability.
14 ICP 7.2.6.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 12 of 34

3.2.1

Clear understanding of Objectives and Strategies

31.

The group-wide supervisor should have a clear view of the group-wide objectives andstrategies and how they are followed by the insurance legal entities within the group.
Other involved supervisors should have an understanding of the objectives andstrategies of the insurance legal entities they supervise, as well as an understandingof overall group-wide objectives and strategies to the extent that this is necessary for
their supervision of the insurance legal entities within the group. Further, other
involved supervisors should develop a clear understanding of the effect of groupwide objectives and strategies on the insurance legal entities within the group. In
particular, it is desirable that the group-wide supervisor and the other involved
supervisors have a clear understanding of the risks posed by the group-wide
objectives and strategies (e.g., expansion into new product lines or geographic
regions).

32.

To achieve the above, it is good practice for the group-wide supervisor and the other
involved supervisors to review annually clear statements of, respectively, group-wide
objectives and strategies and objectives and strategies of insurance legal entities
within the group, prepared at appropriate levels within the group.

33.

In more centralised groups it is likely that the main statement of strategies andobjectives will be prepared centrally with supplementary statements prepared asnecessary by individual insurance legal entities or business units to take account of
their specific circumstances. In a more decentralised group it is likely that the mainstatements will be prepared at insurance legal entity/business unit level with a groupstatement summarising high-level objectives common across the group. The
supervisors should review these statements to assess whether they adequatelyreflect the group’s objectives and strategies and risks related to, or arising from, suchobjectives and strategies. This could be done by assessing the proposed objectives
and strategies against the group or insurance legal entity’s business plan and risk
appetite. When there is inconsistency and disconnection between the objectives andstrategies and the results of the group, the group-wide supervisor should assess theprocess of setting those objectives and strategies.

34.

It is good practice to supplement these assessments with discussions with therelevant Boards and Senior Management within the group and/or review of bothpublic documents (e.g., annual reports) and documents reported to the supervisor(e.g., business plans and ORSAs). In addition, the group-wide supervisor andrelevant other involved supervisors should ask for and assess reviews undertaken by
the relevant Board when the group, or an insurance legal entity within the group,
embarks on a significant new business initiative.

3.2.2
35.

Consistency between group and insurance legal entity objectives and strategies

The Board of the head of the group and the Boards of individual insurance legal
entities within the group are responsible for ensuring that group objectives andstrategies are clearly set and effectively implemented, and that there is consistency
between group objectives and strategies and those of the insurance legal entities
within the group. 15

15 See particularly ICP 7.0.7 and 7.0.8.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 13 of 34

36.

Two key challenges in setting group objectives and strategies are: (1) balancing theneeds and interests of the group as a whole with those of insurance legal entities
within the group; and (2) ensuring that entities at all levels in the group are able tocomply with relevant jurisdictional requirements, as well as internal policies of thegroup. Group objectives and strategies may be set in different ways depending on
the manner in which the governance and control of the group is structured. For
instance, more decentralised models of governance may result in more generalgroup objectives and strategies than in a more centralised model. Group objectives
and strategies may be organised around corporate structures, business lines orgeographic locations/divisions within the group.

37.

The group-wide supervisor, in cooperation and coordination with other involved
supervisors, should review the objectives and strategies at the group level and at theinsurance legal entity level to assess whether these are implemented across thegroup and support effective corporate governance across the group.

38.

It is good practice for the group-wide supervisor to assess whether the group-wide
objectives and strategies are embedded into the group’s corporate governanceframeworks, and other involved supervisors should assess whether the same is doneat the insurance legal entity level within the group. Supervisors should use regular
reporting mechanisms for this purpose. It is also good practice for supervisors tohave the group inform them, through existing reporting frameworks where possible,
when the group introduces a significant change to its objectives and strategies. Such
reporting could be shared between involved supervisors through supervisory college
mechanisms if a supervisory college exists.

39.

The group-wide supervisor of a more centralised group should bring any concerns
about the consistency of objectives and strategies to the Board of the head of thegroup. One aspect of determining consistency is ascertaining whether groupobjectives and strategies are effectively aligned with the local culture andcircumstances of the insurance legal entities within the group. Likewise, the groupwide supervisor of a more decentralised group should assess whether the objectives
and strategies of the insurance legal entities within the group sufficiently support thegroup-wide objectives and strategies. To conduct such assessments, the group-wide
supervisor should rely on knowledge and information regarding insurance legal
entities of the other involved supervisors.

40.

Where a supervisor identifies inconsistency between its supervised insurance legal
entity’s objectives and strategies and the group objectives and strategies, it shouldraise the issue with the insurance legal entity and, if necessary, inform the groupwide supervisor. In these circumstances it is good practice to facilitate a meeting toresolve such an issue between the Boards and/or Senior Management of the groupand the insurance legal entity with the group-wide supervisor and the relevant other
involved supervisor.

41.

Involved supervisors should use the supervisory college (if one exists) to explore
conflicts between group objectives and strategies and local specificities, such as
culture. Alternatively, the group-wide supervisor can have bilateral or multilateral
discussions with other involved supervisors in such cases.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 14 of 34

3.3 Allocation of oversight and management responsibilities

3.3.1

Allocation roles and responsibilities of Board and Senior Management

42.

ICP 7.1 provides that the supervisor requires that an insurer’s Board: (1) ensures thatthe roles and responsibilities allocated to the Board, Senior Management and Key
Persons in Control Functions are clearly defined so as to promote an appropriate
separation of the oversight function from management responsibilities; and (2)provides oversight of the Senior Management.

43.

A clear allocation of roles and responsibilities assists the group in objectively holding
individuals within the group accountable to the risk appetite set out by the Board of
the head of the group as well as the Boards of the insurance legal entities within thegroup. Thus, formal documentation of roles and responsibilities provides clear
communication and accountability in a group. While groups with a more
decentralised approach may increase the risk that communication and accountability
is not aligned across its entities, it is equally important for groups with a more
centralised approach to provide clear lines of authority and effective communicationof decisions.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 15 of 34

44.

It is good practice for the group-wide supervisor to require the Board of the head of
the group to regularly assess the appropriateness and effectiveness of delegations ofauthority from the Board of the head of the group to the Senior Management of thegroup or the Board or Senior Management of individual legal entities set forth ingroup policies. It is also a good practice for the group-wide supervisor, in cooperation
with other involved supervisors, to consider the outcome of this assessment.

45.

The group-wide supervisor should understand the decision-making process of thegroup, including where in the group decisions are made, who is involved in making
decisions, the functional responsibilities of the Board and Senior Management, andhow decisions are communicated throughout the group.

46.

The group-wide supervisor should work with other involved supervisors to identify
and understand: (1) Board and Senior Management structures, including committees,and (2) whether responsibilities and roles are allocated in a more centralised or more
decentralised manner.

47.

In order to achieve this, the group-wide supervisor, with other involved supervisors,
should review the group’s documentation of decision-making and responsibilities androles for governance of the group as a whole, as well as all insurance legal entities
within the group – whether insurance legal entities are inside or outside of the groupwide supervisor’s jurisdiction. If the group-wide supervisor is unable to obtain
documentation from the head of the group, the group-wide supervisor should obtain
the information from the relevant other involved supervisor(s) who have access tosuch documentation. The group-wide supervisor can use the supervisory college –where one exists – to coordinate with other involved supervisors or coordinate on abilateral basis.

3.3.2

Composition of Board

48.

It is important for the group-wide supervisor and the other involved supervisors tounderstand the composition of the Board of the head of the group and of theinsurance legal entities within the group, and to determine if there are any potential
causes of conflicts of interest between the group and the insurance legal entities
within the group.

49.

The group structure can give rise to potential conflicts of interest between decision
makers for the group and the insurance legal entities within the group. Conflicts ofinterest for decision-makers can also be caused by both internal and external factors.
For example, insurers often have cross representation of Board and Senior
Management members within the insurance legal entity and group structure toensure consistency between the group and the insurance legal entities within thegroup. However, such cross-representation can result in conflicts of interest between
the group and the insurance legal entity. The composition of the group’s Board(s)and Senior Management can potentially exacerbate or minimise these risks.

50.

It is good practice for the group-wide supervisor and other involved supervisors todetermine if strategic decisions are aligned between insurance legal entities and thegroup. Particularly in the case of cross-representation of individuals on the Board ofboth the head of the group and insurance legal entities within the group, supervisors
should encourage insurers to have a sufficient number of independent Board

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 16 of 34

members at the insurance legal entity level as well as group-wide level to promote
objectivity. As part of their fiduciary duty to the legal entity that they serve as adirector, independent members of Boards should help identify when another Board
member may have a conflict. It is good practice for supervisors to speak with these
independent directors to gain their perspective.
51.

In addition, the supervisor should expect the Board members to assess their roles
outside of the group to identify if they have any conflicts of interest caused byexternal factors, and whether the Board members can allocate sufficient time to carryout their role.

52.

The group-wide supervisor should assess how conflicts of interest are covered (forinstance, through a specific policy or within other documents) and addressed within
the group, and whether measures taken to mitigate conflicts are effective. It is goodpractice to discuss these issues with Senior Management and the Board. As other
involved supervisors can obtain information on the entities within their jurisdiction,
they should provide this to the group-wide supervisor where appropriate and inaccordance with the confidentiality rules of the concerned jurisdiction.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 17 of 34

3.4 Policies and processes

3.4.1

Supervision of policies

53.

Appropriately documented policies which describe the processes and procedures tobe followed within the insurer, from operational employees to Senior Management
and the Board, help to support efficient governance framework 16. Notably, policies
should address the risk appetite framework, asset-liability management, investment,
and underwriting risk at both entity and group level 17. Misleading or unclear policies
can lead to operational and other errors that could potentially threaten the insurer’s
financial soundness or reputation.

54.

Group policies often describe the allocation of tasks and responsibilities between
insurance legal entities and the head of the group. The group-wide supervisor should
assess group policies, and may need to review with other involved supervisors thepolicies for insurance legal entities within the group. Other involved supervisors only
need to review policies for the group and for the insurance legal entities within theirjurisdiction. The way in which policies are assessed should vary depending onwhether the structure of the group is more centralised or more decentralised. In a

16 ICP 8.1.2.

17 ICP 8.1.12

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 18 of 34

more centralised group, supervisors should assess how policies are implemented byinsurance legal entities within the group, and verify that those insurance legal entities
have enough flexibility to deal with their specific environment, risks and challenges.
In a more decentralised group, supervisors should assess how policies are defined at
the insurance legal entity level, and verify that policies set effective reporting lines
between insurance legal entities and the head of the group, create a common risk
culture across the group, and align practices amongst insurance legal entities within
the group.
55.

However, according to the survey responses, although group-wide supervisors
usually have access to the policies of the head of the group and to the policies of theentities that operate in their jurisdiction, 18 they rarely receive policies from insurance
legal entities located in other jurisdictions, either on a regular basis or upon request.

56.

When the group-wide supervisor has difficulty in obtaining a policy from an insurance
legal entity outside of its jurisdiction, it should coordinate with the relevant other
involved supervisors to obtain the policy in accordance with the confidentiality rulesof the concerned jurisdiction. Where applicable, supervisory colleges or multilateralmeetings can be used to facilitate the exchange of policies between involved
supervisors.

57.

The group-wide supervisor could also consider requiring the head of the group to
regularly review the policies of insurance legal entities within the group in somemanner, such as by entity or by theme, or from a sample basis across all insurance
legal entities. The supervisor would then verify that the review is planned or has been
done, and that the Board has had access to the findings of the review, and where
necessary, adopted an action plan to ensure that all policies are properly
implemented across the group.

3.4.2

Setting of policies

58.

It is good practice for supervisors to understand how group policies are set. Groupwide supervisors can assess the process for establishing group policies, and other
involved supervisors can review that for insurance legal entities. To do so,supervisors could, for example, look at the minutes of the relevant Board meeting at
which policies are discussed or adopted. Such minutes provide relevant information
on how policies are adopted and can reveal if the Board challenges the processes of
establishing policies (by, for example, whether Senior Management consulted
interested parties in setting those policies). By looking at minutes of the Board
meetings, supervisors can assess whether insurance legal entities are involved in theprocess of setting group policies. In addition, supervisors also can organise meetings
with the relevant key functions, at either the group or insurance legal entity level, tounderstand how policies are set.

59.

It is good practice for the group-wide supervisor to assess whether group policies are
regularly updated to adapt to the groups’ business environment (such as changes toregulations, macro-economic factors, or risks). The supervisor should encourage thegroup to update policies both regularly (for instance, annually) and on an ad hoc
basis (as necessary).

18 For 88% of the supervisors who respond to the GWG survey in April 2016

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 19 of 34

60.

The group-wide supervisor should assess the processes, procedures and triggers for
updating the group policies and discuss them with the group’s Board or Senior
Management. In particular, the group-wide supervisor should also verify that thegroup effectively revises its policies after a significant change in its environment.

3.4.3

Consistency of policies

61.

It is good practice for the group-wide supervisor to establish a process to assess theconsistency between policies, such as regular review of policies by theme. In
addition, the group-wide supervisor should assess whether the group policies arealigned with the group’s strategy and risk appetite.

62.

While there should be consistency between insurance legal entity and group policies,
insurance legal entities within a group also need to define their own policies andprocesses to face local requirements and challenges. This tension should prompt
different supervisory responses for more decentralised groups and more centralised
groups.
• In a more decentralised model, the group-wide supervisor and other involved
supervisors should pay specific attention to potential discrepancies between
group and insurance legal entity policies. Other involved supervisors of insurance
legal entities within a group should verify that group policies are duly taken into
account in the establishment of local policies. A comparison between the groupand local policies could be made, preferably by other involved supervisors, toassess the consistency between insurance legal entity policies and the groupones.
• In a more centralised model, the group-wide supervisor and other involved
supervisors should assess whether that policies of local entities are not a simple
repetition of the group policy. Supervisors of insurance legal entities within an
insurance group should check that local issues, context and environment are duly
taken into account in the policy.

63.

Other involved supervisors should establish similar practices to assess that thepolicies of the insurance legal entities within their jurisdiction are consistent withgroup policies. Where distinctions exist between the policies of the insurance legal
entity and the group, the relevant involved supervisor should assess whether the
insurance legal entity’s deviations result from local challenges or requirements. In
that case, involved supervisors should inform the group-wide supervisor. If thedeviation is not due to local challenges or requirements, involved supervisors should
ask the group and the insurance legal entity to explain such deviations.

3.4.4
64.

Policy content

The group-wide supervisor and other involved supervisors should assess whether
the group has appropriate policies for all material issues. In some instances, certain
policies may be required by legislation, like risk management or investment
policies 19. In addition to these policies, the group-wide supervisor should verify thatthe group has prepared appropriate policies addressing the risks it faces. Suchpolicies need not be reported to the group-wide supervisor on a regular basis 20;

19 ICP 8.1.12.

20 See, e.g., ICP 7.9.2 (remuneration policy).

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 20 of 34

rather, they can be obtained by the group-wide supervisor on an ad hoc basis during
an on-site inspection or during thematic assessments.
65.

Both the group-wide supervisor and the other involved supervisors should assess
whether the policies clearly state objectives and the way to achieve them. Written
policies are expected to describe governance processes, and the allocation of tasks
and reporting lines that permit the group to accomplish its objectives 21. In addition,
the group-wide supervisor should, in cooperation with relevant other involved
supervisors, assess whether: (1) local entities are involved in the processes
described by the group policies; and (2) effective reporting lines between local
entities and the head of the group are documented. This can be determined, forexample, by reviewing who signed relevant policies and discussing with them asappropriate.

66.

It is good practice for both the group-wide supervisor and the other involved
supervisors to pay particular attention to the adequacy of the content of policies inplace supporting the group corporate governance framework. By way of example,
supervisors should assess whether the group has policies and processes in place toensure the suitability of the members of the Board, the Senior Management, Key
Persons in Control Functions and major risk-taking staff in the group:• Supervisors should verify that policies identify and set a framework for the
management of conflicts of interest within the group (for example, if the headof the group nominates one of the Board member as Executive Director of
one insurance legal entity within the group). Supervisors should assess theadequacy of the processes established by those policies to manage suchconflicts of interest.
• In a more centralised model, the Board or the Senior Management plays arole in the appointment of Key Persons within individual entities. Group andinsurance legal entities’ policies or processes should state the group’s role in
the appointment of Senior Management of an individual entity. As other
involved supervisors may have the power to reject a nomination, timely
cooperation and coordination between other involved supervisors and thegroup-wide supervisor is needed.
• In a more decentralised model, individual entities will be more independent inappointing Senior Management and Board Members. Regardless,supervisors of those entities should assess whether appointments are incompliance with suitability policies or processes.

67.

In assessing the content of the policies, supervisors could use a list identifying boththe substantive topics a policy is expected to cover (e.g., the risk management policy
should at least cover asset-liability management, investment, underwriting risks 22,
and how insurance legal entity risks are reported up to the head of the group) and theprocesses that should govern the policy (e.g., how often policies are to be revised).
Such a list ensures that different examiners look at similar issues for different groups
and insurance legal entities within a jurisdiction.

68.

Supervisors at both group-wide and insurance legal entity level should pay attention
to how conflicts of interest are addressed within a group’s policies and processes.
For example, it is good supervisory practice to review policies for how they address

21 ICP 8.0.4.

22 ICP 8.1.12.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 21 of 34

intragroup transactions, and then assess whether intragroup transactions are done ina manner consistent with the group’s policy. To facilitate this review, the group-wide
supervisor could obtain an annual report from auditors on transactions between
entities of the same group or entities with common board members and theconditions on which these transactions are concluded.
69.

The group-wide supervisor should assess whether the policies and processes of thegroup foster a common culture across the group. For example, a risk management
policy at the group level setting the risk appetite limit or a common compensation
policy may help to create a sound risk culture. The group-wide supervisor shouldseek the input from other involved supervisors, whether in a supervisory college orsome other multi- or bilateral basis, in making this assessment.

3.4.5

Internal controls for policies

70.

In addition to having well-established and updated policies, insurers should haveinternal controls in place to ensure that those policies are observed 23. Each policy
should also describe who in the group (or insurance legal entity) is responsible formaking sure the policy is appropriately designed, implemented and monitored.

71.

Furthermore, the compliance function can also have a role in verifying that the groupor the insurance legal entities respect the internal policies. The compliance function
at the head of the group should check that the group has adopted all policies
required by regulation. Likewise, the compliance functions of the insurance legal
entities should verify that the insurance legal entities established policies inaccordance with the local regulation and the group policies (especially in a more
centralised model).

72.

To assess how the insurer monitors compliance with its internal policies, supervisors
at both group-wide and insurance legal entity level should discuss these policies atleast annually with the internal audit function for the group and the insurance legal
entities within the group. In doing so, the group-wide supervisor should:• ask for the group internal audit plan and verify that the group policies areincluded in this plan;• review the group internal audit reports to check for issues related to group
policies and to verify that the group internal audit function effectively controls
the observance of the group policies; and• ask for the group compliance plan and report and check that group internal
policies are taken into account.
Likewise, other involved supervisors should do the same at the legal entity level.

73.

Other involved supervisors should report and discuss any significant violation of thegroup policy to the group-wide supervisor. Likewise, the group-wide supervisor
should inform other involved supervisors of any significant problem in respect ofgroup policies.

23 ICP 8.5 and 8.7.7.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 22 of 34

3.5 Risk management

3.5.1
74.

A common risk culture across the group

The values and behaviours of the group, as set by the Board and promoted by Senior
Management, shape the risk culture across the insurance legal entities within thegroup, provided that the insurance legal entities understand and utilise that risk
culture. For instance, it should naturally arise from that culture that the key persons inrisk management function – as well as other control functions – should be
independent, free from undue or inappropriate influence from the business lines andhave sufficient stature within the group to effectively challenge the business lines andmaintain its independent review of the group’s broader risk management controls,
processes and systems. 24

Joint Forum, Principles for the supervision of financial conglomerates, 22, Risk management culture,explanatory comments 22.2, September 2012. The Joint Forum refers to “risk management culture”, whereas the
IAIS uses the term “risk culture”.

24

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 23 of 34

75.

According to a majority of survey respondents, an effective way to supervise grouprisk culture for a group-wide supervisor is to assess the necessary documentation of
the group explaining how the group is organised, managed and overseen, how the
key tasks/activities are distributed and allocated between the group and theinsurance legal entities within the group, and how governance and control of thegroup is structured. In addition to formal documents from within the organization,other sources of information could be used as a complement to better understandrisk culture across the group, such as interviews with relevant representatives of thehead of the group (Board, Senior Management, relevant employees) or external
parties (analysts, stakeholders).

76.

It is good practice for the group-wide supervisor also to assess whether the group’s
risk culture has been implemented across the group, and the involved supervisors
should assess such implementation at the insurance legal entity level. In particular,
the group-wide supervisor should assess how Senior Management promotes astrong risk culture that takes into account the entirety of the group, including
regulated and unregulated entities. 25 To do so, it should assess that risk
management activities between the head of the group and the different insurance
legal entities are coordinated to the extent necessary. The presence (or the absence)of a document to engage and inform employees at all levels and part of the group,
such as a code of conduct, may help to understand whether risk culture is promoted
across the group.

77.

For both more centralised and more decentralised groups, the group-wide supervisor
should assess whether the risk culture is directed and led by the Board and Senior
Management of the head of the group. The Board should promote risk awarenessand encourage open communication and debate about risk-taking across the groupand its insurance legal entities, including by bringing such discussions to the Board
and Senior Management. The supervisor should expect insurers to promote effective
communication and information, for example, by:• setting clear reporting requirements to report locally identified risks (including
compliance risks) in a timely and comprehensive way at the group level;• providing for a Chief Risk Officer (CRO) or other person at entity level, who is
responsible for regularly reporting the CRO at the group level;• providing for, on an on-going basis, the reporting by control functions at the entity
level to control functions at the group level in order to make it possible for thehead of the group to identify risks emerging at entity level in a timely manner;and• assessing the representation of risk officers at the group level at risk committees
of entities to contribute to effective communication of the group risk approach toentities.

78.

In addition, as underlined in the Issues Paper and confirmed by survey respondents,
the group-wide supervisor should assess the effective alignment of the groupexpectations and the local culture and circumstances, and communicate its findings
to other involved supervisors.

Joint Forum, Principles for the supervision of financial conglomerates, 22, Risk management culture,explanatory comments 22.1, September 2012.

25

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 24 of 34

3.5.2 Risk Appetite79.

As per survey respondents, it is good practice for the group-wide supervisor to verify
that the head of the group has established group-wide policies, approved by the
Board, that appropriately address risk appetite.

80.

It is good practice for the group-wide supervisor to assess whether the group’s risk
appetite policy and risk appetite levels are clearly aligned with the group’s businessstrategy, risk profile and capital plan. The group-wide supervisor may question andchallenge the appropriateness of the risk appetite set at the group level and thegroup’s risk exposure alignment to that appetite. This may include looking at risks bygeographic or business lines, or by specific financial sector. It is good practice forgroup-wide supervisors to assess whether groups keep the risk appetite limits underreview so as to ensure that they remain relevant and take account of the changing
dynamics of the group. The group should also reassess its risk appetite regularly withrespect to new business opportunities, changes in risk capacity and tolerance, andoperating environment.

81.

Further, the group-wide supervisor should assess whether the head of the group’s
Board, Senior Management and Key Persons in Control Functions are aware of,understand and implement the group’s risk appetite. It is good practice for the groupwide supervisor to assess, in cooperation with other involved supervisors, whether
both the group and insurance legal entities within the group maintain, monitor andadequately report risk in a manner that distinguishes between group risks andmaterial risks at the legal entity level. Another good practice is to assess whether
both the group and insurance legal entities within the group maintain, monitor andadequately report risk dashboards that distinguish between group risks and local
risks. Other involved supervisors should review the dashboards of the insurance
legal entities within the group to verify that they adequately include all material local
risks.

3.5.3 Risk management activities
82.

Comprehensive and consistent corporate governance frameworks promote elements
such as:• effective assessment and consistent management of risks across the group;• timely reporting to group level to ensure good overview of risks;• availability of adequate aggregated information about all risks at the grouplevel;• timely reaction to risks at the group and legal entity level;• local circumstances and requirements being taken into account at the grouplevel; and• adequate communication of the risk management approach within thegroup. 26

83.

It is good practice for the group-wide supervisor to understand the group’s approach
to risk management. The group-wide supervisor should assess whether the Board of
the head of the group is aware of the material risks and issues that might affect both

26 IAIS Issues Paper on Approaches to Group Corporate Governance, Impact on control functions, Oct. 2014,
para 51 b-g).

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 25 of 34

the group as a whole and its insurance legal entities and is adequately supporting therisk management function across the group.
84.

The group-wide supervisor should assess the actual risk-taking across the entire
group by reviewing documentation provided by the head of the group. For example,
the group-wide supervisor should review group-wide strategy through the ORSA orother formal documentation. The group-wide supervisor should review group internal
audit reports and, where possible, those of insurance legal entities within the group,
focusing on recommendations from the internal audit and the resolution of any action
points derived from such internal audit review. If a group-wide supervisor does nothave access to internal audit reports of insurance legal entities within the group, it
should coordinate with the other involved supervisors to access those reports. Whenfacing limited access to reports, supervisors could also arrange interviews with theGroup Internal Auditor and other holders of key control functions.

85.

The group-wide supervisor should also assess whether the risk management
function establishes clear responsibilities and accountabilities of key personnel at thehead of the group and, through other involved supervisors, at all insurance legal
entities. 27 Examples of practices insurers may use to promote effective direction andcoordination include:• development and implementation of common risk management procedures
across the group to promote consistency of risk management; and• having consistent policies and oversight procedures so that a better overview,and quicker identification, of material risks arising at entity level can be made toaddress them adequately.

86.

The group-wide supervisor may use various indicators to assess efficiency of theinsurance groups’ risk management framework. As one indicator among others, it isgood practice to assess whether personnel and management have devoted sufficient
time and resources to risk management decisions. The group-wide supervisor also
may consider conducting peer reviews to compare time and resources different
groups devote to the risk management function.

87.

Regarding local specificities, the group-wide supervisor of a more centralised groupshould verify that the group risk management policy and the risk management
function take into account the risks faced by individual entities, notably by checking
how policies are applied, and how decisions are taken. The group-wide supervisor
should coordinate this assessment with other involved supervisors. It is good practice
to discuss the outcome of this assessment in the supervisory college.

3.5.4 Risk aggregation and reporting88.

Appropriate risk aggregation supports group-wide risk management. 28 Its role ineffective group-wide risk management is to support risk identification and monitoring,which enables the group to understand and explain its risks and the changes in those

27 IAIS Issues Paper on Approaches to Group Corporate Governance, Impact on control functions, Oct. 2014,
para 52 a)
28 ICP 8 Risk Management and Internal Controls, Guidance 8.4.4

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 26 of 34

risks. As such, risk aggregation provides appropriate risk information to the relevant
management to steer the business. 29
89.

It is good practice for the group-wide supervisor to assess how the group aggregates
the risks to which they are exposed in a prudent manner, regardless of whether thegroup operates in a more centralised or a more decentralised manner. In this context,group-wide supervisor should verify by reviewing the group’s ERM 30 methodology
and, where possible, conducting horizontal peer reviews that the group:• does not make overly ambitious diversification assumptions or imprudent
correlation claims, particularly for capital adequacy and solvency purposes; and• has adequate processes, resources and systems (including information
technology) for the purpose of aggregating risks.

90.

To assess the methodology and processes the group-wide supervisor should review
documents and have in-person meetings to assess a group’s risk aggregation. In
doing so, the group-wide supervisor should look for a comprehensive methodology
and process for identifying and aggregating risks across the group. Examples of
relevant documents include ERM documentation, risk appetite statements, ORSAs,
and related policies and tools such as heatmaps to assess risk aggregation. In
particular, the group-wide supervisor should assess whether heatmaps are regularly
updated; failure to do so may be an indication of substandard risk management.

91.

The group-wide supervisor and other involved supervisors should assess whether
risks are analysed at the group level as well as at insurance legal entity level.
Moreover risk aggregation should include a clear understanding of assumptions andbe robust enough to support a comprehensive assessment of risk. 31 The
interrelationships and interdependencies between risks could amplify the total
exposure of the group, especially in more centralised groups.

92.

The group-wide supervisor should verify, where appropriate in cooperation with other
involved supervisors, that policies on risk management, either at the group or entity
level, include a formal process for local entities to report the risks they have identified
which could have an impact on the group as a whole. Additionally, this policy should
provide a communication process between the risk management function of thegroup and the risk management functions of insurance legal entities within the group.

29 Bank for International Settlements, Basel Committee on Banking Supervision, Joint Forum: Developments inModelling Risk Aggregation, October, 2010.
30 Enterprise Risk Management, for further details please refer to ICP 16.
31 ICP 8 Risk Management and Internal Controls, Guidance 8.4.4

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 27 of 34

3.6 Compliance

93.

Under ICP 8.5, the supervisor requires the insurer to have an effective compliancefunction capable of assisting the insurer to: (1) meet its legal, regulatory andsupervisory obligations, and (2) promote and sustain a compliance approach,including through the monitoring of related internal policies.

94.

The group-wide supervisor should require the group to take into account the
obligations of its insurance legal entities to comply with both local laws andregulations while also meeting the requirements applicable to the group as a whole.
This highlights the importance of having a strong compliance across the group andits entities. A group can promote a common compliance approach and adequategroup compliance by ensuring that compliance personnel at the group level are
members of compliance oversight committees or their equivalent at the individual
entity level.

95.

It is good practice for the group-wide supervisor to understand the group’s approachto compliance. Regardless of whether the group has a more centralised or more
decentralised model, the group-wide supervisor should obtain the group complianceApplication Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 28 of 34

plan from the head of the group and assess it for effectiveness. In a more centralisedmodel the group-wide supervisor should make the group compliance plan available
to other involved supervisors. Other involved supervisors should assess whether thegroup compliance plan appropriately scopes and covers the compliance risks andmatters of the insurance legal entities under their purview.
96.

In a more centralised model, the compliance function of an insurance legal entity may
be performed by the group compliance function. In these cases the other involved
supervisor should engage the insurance legal entity Board or Board committee on
the appropriateness of such an arrangement. Furthermore, the other involved
supervisor should assess during on-site examinations whether the group compliancefunction has a proper understanding of the local regulatory compliance matters. If thesupervisory requirements at the insurance legal entity level are not met by the groupcompliance function performing the compliance function at an insurance legal entity
level, the relevant other involved supervisor should instruct the insurance legal
entity’s Board to address those issues or make alternative arrangements.

97.

It is good practice for involved supervisors to highlight and communicate to the groupand its insurance legal entities the importance of compliance. For example, thegroup-wide supervisor may have meetings with the group compliance officer and anyother relevant compliance personnel at the group to discuss any relevant issues. In
addition, it is good practice to allow the compliance function to initiate meetings withthe relevant supervisors of its own accord.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 29 of 34

3.7 Control functions

3.7.1
98.

Effectiveness of group Control Functions

The Issues Paper notes that, irrespective of whether the group is more centralised ormore decentralised, a good governance structure includes elements which promote:• the establishment of group-level Control Functions which are sufficiently robust;and• effective communication of group objectives, strategy and policies to Control
Functions of the legal entities; and• ensuring representation of the head of the group on entity-based risk
committees to promote better alignment with group-wide risk management andcompliance. 32
Paragraph 55 of the Issues Paper articulates the main roles and responsibilities ofControl Functions at the group and insurance legal entity level, covering areas ofauthority, direction and coordination, and communication and information.

32 IAIS Issues Paper on Approaches to Group Corporate Governance; Impact on control functions (October2014), para 52 b-e.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 30 of 34

99.

As part of its governance framework, and regardless of whether a more centralised
or more decentralised approach is used, groups should have effective group control
functions. At the group and insurance legal entity level, the Board has the ultimate
responsibility for ensuring that the roles and responsibilities allocated to Key Persons
in Control Functions are clearly defined so as to promote an appropriate separationof the oversight function from the management function. 33 The Board should
periodically assess the performance of each control function. This assessment canbe performed by the Board or an appropriate committee delegated by the Board.

100. It is good practice for the group-wide supervisor and the other involved supervisors tocoordinate to establish a collective understanding among all involved supervisors
regarding the appropriateness and effectiveness of the group control functions,
including Key Persons in Control Functions. Groups of varying size and complexity
will have control functions of different sophistication, and involved supervisors shouldhave an understanding of this.
101. The group-wide supervisor and the other involved supervisors should share theoutcomes of their respective assessments of the control functions. Where there is nosupervisory college in place, supervisors can share this information throughestablished memorandums of understanding or coordination agreements. In a more
decentralised model the group-wide supervisor places reliance on the other involved
supervisors to assist the group-wide supervisor to validate that control functions
within the insurance group are sufficiently robust to assist in the properly identifying
and addressing risks that impact the insurance group as a whole.
102. The group-wide supervisor should meet with or receive communication or reports
from Senior Management to verify that control functions are independent and havedirect access to the Board and when requested by the Board. The group-wide
supervisor, together with other involved supervisors, should assess whether and how
issues are escalated from an insurance legal entity within a group to the head of thegroup taking into consideration group-wide escalation policies and procedures. In
case of complex groups, involved supervisors should assess whether there is apossibility to escalate issues directly from the insurance legal entity control function
to the group’s Board. Checking policies, minutes and previous decisions could be agood starting point to help with this assessment.
103. In jurisdictions where the risk management function and the compliance function may
be combined, the supervisor should pay appropriate attention to the independence ofboth of these control functions. Where the involved supervisors have different
restrictions on the merging of risk management and compliance functions, the groupwide supervisor should verify with the group and coordinate with the other involved
supervisors that all insurance legal entities within the group are meeting all relevant
governance requirements, including those relating to independence.
104. The group-wide supervisor and the other involved supervisors should also verify
whether the group is devoting sufficient resources to the control functions, withgreater resources directed to the head of the group or the insurance legal entities
within the group depending on whether the group has a more centralised model or amore decentralised model.
33 ICP 7.1.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 31 of 34

105. In a more decentralised group structure, the involved supervisor should encourage
the group control function to perform regular effectiveness assessments of theinsurance legal entity control functions. The supervisor of an insurance legal entity
within a group should obtain the outcome of this assessment from the insurance legal
entity’s Board or Senior Management. Particularly in groups with a more centralisedmodel, the internal audit function should monitor and evaluate the effectiveness ofother group control functions (e.g., compliance and risk management). In such cases,
an objective external reviewer should conduct such an assessment as to the internal
audit function. Alternatively, the Board can direct an objective, external reviewer toperform such an assessment on all group control functions. The group-wide
supervisor should assess the effectiveness of such an assessment, whether
conducted by the group internal audit control function or an external review, paying
particular attention to whether the reviewer has the necessary skills andindependence to perform such an assessment.
3.7.2

Effective communication between control functions at the group and entity level

106. The Issues Paper highlights that there are some common practices that could
address challenges in respect of communication and information arising in a group.
The Issues Paper suggest the following:• regular periodic meetings between group-level control functions and entity level
control functions to communicate group-wide objectives and policies andfurthermore to inform group-level control functions better in order for them to
execute their roles effectively;• continuous reporting of entity level control functions to group-level control
functions to assist in ensuring adequate and timely information at group level
and to promote independence of entity level control functions; and• group-level control functions providing services and advice to insurance legal
entity and the entity level control function, as it contributes to developing acommon risk/compliance culture.
107. Regardless of whether the group has a more centralised or more decentralisedmodel of governance, it is good practice for the group-wide supervisor to check on aregular basis for the existence of effective communication between respective groupand entity internal audit functions, group and entity risk management functions, groupand entity audit functions and group and entity compliance functions.
108. The involved supervisors should assess the manner in which control functions’activities are communicated within the group, including through reporting lines and in
Board reports. For example, involved supervisors should obtain the reporting
provided from insurance legal entity control functions to the group control function, as
well as the insurance legal entity level control function reports to the local Board or
Board committee. The involved supervisors should also obtain reports regarding
insurance legal entity control functions made by Board committees to the Board as awhole, whether on the insurance legal entity or group level. Additionally, the involved
supervisors of insurance legal entities within a group should review relevant Board
committee documents to examine the information that is provided to the group,
following up with Board members to learn more if necessary. Fundamentally, theinvolved supervisors should verify that reporting lines are actually implemented as
described in policies and other documents. In doing so, it is good practice to meet not
only with Senior Management, but also with lower level personnel.
Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 32 of 34

109. Groups with a more decentralised approach sometimes may have problems withcoordinating between control functions at the group-level and insurance legal entity
level. It is good practice for the group-wide supervisor to encourage more
decentralised groups to establish a group control function forum that shares bestpractices within the insurance group on a range of operational, strategic andemerging topics that affects both the control functions specifically and, moregenerally, the insurance group as a whole. Where such a forum exists, the groupwide supervisor should specifically assess whether the forum promotes coordination
between the insurance legal entities (including their control functions) and group-wide
control functions to ensure the effectiveness of the system of risk management andinternal controls.
110. The group-wide supervisor and other involved supervisors should share experienceson the manner in which control functions’ activities are communicated within theinsurance group.
3.7.3

Outsourcing

111. Groups and insurance legal entities within the group may outsource control functions
to either third parties or to other insurance legal entities within the group. This latterform of outsourcing, referred to as “insourcing,” can apply downstream (e.g., withgroup-wide control functions conducted by so-called “centres of excellence” atinsurance legal entities within the group) or upstream (i.e., with insurance legal entity
control functions conducted by the group control function).
112. Pursuant to ICP 8, the Board of an insurer is required to retain at least the same
degree of oversight of, and are accountable for, any outsourced material activity orfunction (such as a control function) as applies to non-outsourced activities orfunctions. 34 Even if the relevant tasks of a control function can be outsourced, theresponsibility for those control functions continues to rest with the group or insurance
legal entity within the group, as relevant.
113. It is good practice for the group-wide and other involved supervisors to assess
whether a group has an outsourcing policy in place to ensure that risks are effectively
managed and regulatory obligations are met by reviewing such a policy, if available,
and speaking to members of Senior Management during on-site visits/inspections.
The involved supervisors can obtain an outsourcing policy as part of the regularsupervisory reporting requirements. The supervisor should require that the policy
clearly stipulates that the supervisor should have direct access to the outsourced
control functions. The group-wide supervisor should scrutinize that this policy isappropriate and implemented. To do so, the group-wide supervisor should discuss
outsourcing at in-person meetings, seeking information about how the groupoutsources control functions and whether the group has procedures in place
regarding the management of risk related to outsourcing.
114. Because of particular importance of control activities and control functions in agroup’s corporate governance framework, the group-wide supervisor should consider
issuing additional requirements for their outsourcing or dedicating more supervisoryattention to any such outsourcing. 35 It is good practice to conduct a full assessment
34 ICP 8.8.

35 ICP 8.8.4.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 33 of 34

and supervisory visits on any third party to whom the group outsources any material
activities and/or functions. For example, the group-wide supervisor should require
the group to perform regular reviews on the entity performing the outsourced activity,
whether inside the group or a third party, to ensure the appropriateness of theoutsourced partner and the outsourcing arrangement. The group-wide supervisor
should, among others, assess the service level agreements, key risk indicators,
conflicts of interest, penalties, escalation procedures, service logs and disclosures foreach outsourced activity.
115. Where a group control function is insourced, the group-wide supervisor should verify
that the head of the group’s Board assesses the effectiveness of the group control
functions. This verification can be obtained by requesting the head of the group toprovide copies of Board information packs and minutes of Board meetings to validatethat the Board discussed and assessed the effectiveness of the group control
functions. In addition, the group-supervisor can also request that the head of thegroup to provide the supervisory authority with a copy of any independent
assessment/review of the group control functions that was conducted by either thegroup internal audit function or an independent external party. In addition, the groupwide supervisor should corroborate the Board’s assessment with the involved
supervisor that directly supervises the insurance legal entity that is performing thegroup control function, as the other involved supervisors are better placed to performthe effectiveness assessment of the control function. Further, the group-wide
supervisor should perform a conflict of interest assessment on the insourcing
arrangement, coordinating with other involved supervisors as necessary to obtain
critical information from insurance legal entities within the group and keep themapprised of the status of group control functions.

Application Paper on Group Corporate Governance
Adopted by the Executive Committee on 1 November 2017

Page 34 of 34