Final Review Draft ISAP 6 – Enterprise Risk Management Programs 31 July 2018

and IAIS Insurance Core Principles

## Introduction

This International Standard of Actuarial Practice (ISAP) provides guidance to actuaries who provide actuarial services involving enterprise risk management (ERM) programs that address insurer risks and are within the scope of regulations consistent with two of the Insurance Core Principles (ICP 8 and ICP 16) of the International Association of Insurance Supervisors (IAIS). Regulation of financial services businesses has evolved rapidly in the years following the Global Financial Crisis in 2008. While the most radical changes have been applied to banks, insurers have also been subject to enhanced scrutiny. An important component of this higher level of regulation is the assessment of ERM programs. ERM programs include processes undertaken by insurers to identify, assess, measure, control, mitigate, monitor and communicate on risks in respect of the insurance enterprise. These programs have come to be seen by insurance supervisors globally as a critical activity of insurers. The IAIS has recognized the importance of ERM programs in two of the Insurance Core Principles (ICPs): ICP 8 Risk Management and Internal Controls and ICP 16 Enterprise Risk Management for Solvency Purposes. These ICPs are intended to encourage insurance supervisors around the world to incorporate the concepts expressed therein into the regulation of insurers. According to ICP 8 and ICP 16, an insurer’s management is responsible for establishing and operating frameworks to manage the risks to which the insurer is exposed, recognising that the intrinsic nature of insurance is to share or to manage risk. Depending on the level of sophistication, insurers’ approaches to risk management may range from simple consideration of the adequacy of current financial resources to integrated holistic consideration and management of a wide range of risks. ICP 8 and ICP 16 encourage a supervisory- led minimum standard for these activities. Insurers, their stakeholders and supervisors all therefore have a strong interest in the reliable operation and transparent governance by insurers of an effective risk management system. The risk management system envisaged by ICP 8 and ICP 16 includes the identification and measurement of risks, a risk management policy including an explicit Asset and Liability Management (ALM) policy, investment policy and underwriting risk policy, the development and maintenance of a risk tolerance framework, and the Own Risk and Solvency Assessment (ORSA). Many actuaries perform actuarial services in connection with ERM programs, including acting as an employee of an insurer, as an independent professional, as part of an external audit team or as a supervisor of insurers. In some jurisdictions, actuaries are called upon to give a professional opinion regarding the ERM program to the supervisor. This ISAP addresses ERM programs that often involve stress testing, scenario testing and other modeling techniques. ISAP 5 (Insurer Enterprise Risk Models) provides helpful guidance on these subjects and actuaries reading this ISAP may find ISAP 5 to be a valuable resource. Some terms, such as risk appetite, risk tolerance or risk limit, are used both in this ISAP and in ICP 8 and ICP 16. When such terms are referenced without definition in this ISAP or in the associated Glossary, they are intended to have the meaning in the context with which they are used in ICP 8 and ICP 16. This ISAP is intended to:

- • convergence in standards of actuarial practice within and across jurisdictions in • convergence in standards of actuarial practice within and across jurisdictions in connection with ERM programs that are within the scope of regulations consistent with ICP 8 and ICP 16;
- • public confidence in actuarial services for ERM purposes; and • public confidence in actuarial services for ERM purposes; and

iv