New York Codes, Rules and Regulations › Title 11 - INSURANCE › Chapter IV - Financial Condition Of Insurer and Reports to Superintendent › Subchapter A - Rules of General Application › Part 82 - Enterprise Risk Management And Own Risk And Solvency Assessment › Section 82.2 - Enterprise risk management

Current through Register Vol. 46, No. 28, July 10, 2024
(a)
				  Pursuant to Insurance Law sections 1503(b), 1604(b), and 1717(b), an entity
				  shall adopt a formal enterprise risk management function that identifies,
				  assesses, monitors, and manages enterprise risk. Except as provided in
				  subdivision (c) of this section, a domestic insurer that is not a member of a
				  holding company system, an article 16 system, or an article 17 system also
				  shall adopt such a formal enterprise risk management function. The enterprise
				  risk management function shall be appropriate for the nature, scale, and
				  complexity of the risk and shall adhere to the following, as relevant:
(1) have an objective enterprise risk
				  management function headed by an appropriately experienced individual with the
				  requisite authority and who has access to the board of directors, or if there
				  is no board of directors, then the governing body, and senior
				  management;
(2) have a written risk
				  policy adopted by the respective board or a committee thereof, or if there is
				  no board of directors, then the governing body, that delineates the insurer's,
				  holding company system's, article 16 system's, or article 17 system's
				  risk/reward framework, risk tolerance levels, and risk limits;
(3) provide a process for the identification
				  and measurement of risk under a sufficiently wide range of outcomes using
				  techniques that are appropriate to the nature, scale, and complexity of the
				  risks the insurer, holding company system, article 16 system, or article 17
				  system bears and are adequate for capital management and solvency
				  purposes;
(4) have a process of
				  risk identification and measurement supported by documentation that provides
				  appropriately detailed descriptions and explanations of risks identified, the
				  measurement approaches used, key assumptions made, and outcomes of any
				  plausible adverse scenarios that were run;
(5) use prospective solvency assessments,
				  including scenario analysis and stress testing;
(6) incorporate risk tolerance levels and
				  limits in the policies and procedures, business strategy, and day-to-day
				  strategic decision-making processes;
(7) consider a risk and capital management
				  process to monitor the level of financial resources relative to economic
				  capital and regulatory capital requirements;
(8) incorporate investment policy,
				  asset-liability management policy, effective controls on internal models,
				  longer-term continuity analysis, and feedback loops to update and improve the
				  enterprise risk management function continuously;
(9) address all reasonably foreseeable and
				  relevant material risks including, as applicable, insurance, cybersecurity,
				  climate change, epidemic, pandemic, underwriting, asset-liability matching,
				  credit, market, operational, reputational, liquidity, and any other significant
				  risks;
(10) include an assessment
				  that identifies the relationship between risk management and the level and
				  quality of financial resources necessary as determined with quantitative and
				  qualitative metrics; and
(11)
				  identify, quantify, and manage any risks to which the insurer may be exposed by
				  transactions or affiliations with any other member of the holding company
				  system, article 16 system, or article 17 system of which the insurer is a
				  member.