Solvency II in Allianz SpA - ORSA. Risk Management - Allianz SpA Group Italy Milan 23 June 2010

Transcription

1 Solvency II in Allianz SpA - ORSA Risk Management - Allianz SpA Group Italy Milan 23 June 2010

2 2

3 3

4 4

5 Key elements of Qualitative framework Scoping Process, sub process, activities, definition and analysis Follow Up and Maintenance Risk evaluation back testing and action plan analysis Qualitative Risk Assessment Identification, analysis and evaluation of material risks in according with Reg 20 Isvap Qualitative Risk Management Action Plan Definition of action plan in case residual risk is above target risk Controls Framework Identification and definition of mitigation in place Controls Evaluation Controls evaluation to define (via robust WT & Testing) residual risk Qualitative Risk Management is based on Process, Control & Risk evaluation; In case of risk breaches immediate action plan in place. 5

6 ORSA Report Our End Goal ORSA Process Governance description for report submission Risk Governance Processes, controls, procedures and policies, Capital & Solvency Position (Including Plan Period) Regulatory and economic approach Company Context Legal and management organization, core business,.. Risk Assessment Processes and procedures for identifying and assessing key risks Stress test & Contingency Plan Capital evaluation under risk scenarios including contingency proposal Risk Philosophy Business managed via risk based metrics (profitability, product approval, SAA based on risk bearing capacity,..) Risk Appetite Risk management process within certain parameters (risk limits setting) Use Test Risk & Capital management activities are fully integrated into management decisions High level ORSA Report was in place in the end of the

7 CEIOPS International standards for Risk Management 1 Risk Management Top Management Responsibility 21. Management concept 32. Control process 43. Organisational framework Risk Strategy Risk Bearing Capacity Limits and Thresholds Identification Monitoring Governance and Communication Assessment Management Organisational structure Organisational procedure Internal Control 54. Internal Audit (and Compliance) Orsa based on 5 core elements 7

8 Solvency II Our End Goal Risk Management Management Responsibility 1. Management concept 2. Control process 3. Organisational framework Risk Strategy Risk Bearing Capacity Limits and Thresholds Identification Monitoring Governance and Communication Assessment Management Organisational structure Organisational procedure Internal Control 4. Internal Audit (and Compliance) Written specification and regular updating 8

9 Management Concept RISK STRATEGY Describes the management of risks Must be consistent and operatively connected with business strategy Must be correlated with risk type, risk source and risk time horizon Proportionality & Materiality RISK BEARING CAPACITY Describes the relation between overall available potential risk coverage and used capital for the coverage of material risks Must be connected with the risk strategy Potential Risk Coverage & Risk Capital Requirements should be consider: risk type; size of the company. Material risks are all risks, that can affect with negative effects economic, financial and profitability of a company. LIMIT SYSTEM Limits must be adequate and manageable for the operational units The potential risk coverage is the basis to determine an economic assessment. The risk bearing capital (risk capital budget) is determined by Company s risk appetite. This defines which amount of the economic capital is reserved to cover/bear risks and it forms an upper limit for taking risks. The regulators requirements on capital resources establish the lower limit of risk bearing capacity Limits are documented ex-ante and it must exist a set for all levels and for risk type. The respect of limits must be monitored. The breach of set threshold must be reported and appropriately escalated. The Risk Strategy must be assessed and documented by Management. This responsibility cannot be delegated. The risk bearing capacity must be considered for all risk relevant management decision. 9

10 Solvency II Our End Goal Risk Management Management Responsibility 1. Management concept 2. Control process 3. Organisational framework Risk Strateg y Risk Bearing Capacity Limits and Thresholds Identification Governance and Communication Monitoring Assessment Management Organisational structure Organisational procedure Internal Control 4. Internal Audit (and Compliance) Written specification and regular updating 10

11 Control Process IDENTIFICATION The risk identification starts with the strategic planning process. With the changes in the business strategy the results of the risk identification must be checked and eventually modified. Risks are to be defined consistently and as much as possible without overlapping, because the risk situation of the whole company has to be considered. ASSESSMENT The risk assessment establishes the results of risk identification and leads to quantitative/qualitative evaluation. Risk must be categorized and give them a priority by their own materiality Risk key figures are to be defined, to know in advance changes in the overall company's risk profile MONITORING The risk monitoring must be regularly performed and must be aligned to the existing company s overall risk profile, risk bearing capacity and limits. The monitoring is regularly performed by the risk controlling function, without results responsibility. MANAGEMENT The active risk management is performed by the business areas within the defined frameworks This active management is performed along KPIs (key performance indicators) which exist for all levels, KPIs must be monitored against the defined thresholds. GOVERNANCE AND COMMUNICATION The management has the assignment to establish a appropriate risk culture in the whole company and to ensure an adequate internal communication on all material risk (risk reporting) 11

12 Solvency II Our End Goal Risk Management Management Responsibility 1. Management concept 2. Control process 3. Organisational framework Risk Strateg y Risk Bearing Capacity Limits and Thresholds Identification Monitoring Governance and Communication Assessment Management Organisational structure Organisational procedure Internal Control 4. Internal Audit (and Compliance) Written specification and regular updating 12

13 Organizational Framework Consulting Committees Board of Directors (Consiglio di Amministrazione)... Risk Committee (Comitato Consultivo Rischi) Direct report Board of Directors Among the other tasks the Board defines: - the guidelines of the internal framework for risk controlling; - the strategy and policies for the risk taking and risk management of the most significant risks of the Company, based on the proposal of the Risk Committee. Risk Committee Has the goal to advise and formulate proposals to the Board of Directors on the definition of the strategy of the Company related to Risks that implies a significant amount of Capital requirement Operational Committees Top Management (Alta Direzione)... Executive Risk Committee CFO Preferred operational report Chief Risk Officer CRO The CRO of Allianz SpA Group has the key responsibility for the independent risk oversight. This encompasses quantifiable as well as the assessment of non-quantifiable risks. Top Management The Top Management has the ultimate responsibility for maintaining the planned risk strategy and financial results. Executive Risk Committee The Executive Risk Committee defines and monitors all relevant aspects related to the risk management. The Executive Risk Committee monitors the Risk Environment from a quantitative and a qualitative point of view. 13

14 Organizational Framework ORGANISATIONAL STRUCTURE Business and risk strategy must be reflected in the compensation system Incentive systems cannot be manipulated, must be oriented to the long term success of the overall company; negative compensations are to be avoided. Top Management Target of the business and risk strategy Compliance of risk bearing capacity and risk attitude Continuous monitoring of risk profile Link of risk management elements Definition of Roles and Responsibilities Delegation of task to the dedicated Risk Management Unit Risk Management Coordination of risk management processes Monitoring limits compliance Separation of risk taking and risk controlling function Operative business areas Accomplishment of risk control process for all operative business areas Documentations of assignments, responsibilities, delegation rules and competencies Outsourced functions and services Starting from a risk analysis, the company must determine which activities and processes can be outsourced, and the associated responsibilities must be clearly defined Monitoring of activities and regular assessment of performances Consideration of the outsourced functions in the risk management 14

15 Organizational Framework Pricind and U/W ORGANISATIONAL PROCEDURE Investments Underwriting guidelines for daily management of the business Reserves Tariffs calculations based on an adequate risk information Usage of relevant ratio to manage operational workflow Investment management must comply with all kinds of limits, regulations and laws accordingly to relevant principles Proof of potential improvement of risk management through: risk adequate data collection and improved evaluation method definition of responsibilities for process steps and quality assurance Passive Reinsurance Determination of an acceptable retention per business segment Considering multiple possible events and exclusions in reinsurance contracts In case assessment of alternative risk transfer instruments Together with material risks, also business procedure and process responsibilities must be determined and documented 15

16 Solvency II Our End Goal Risk Management Management Responsibility 1. Management concept 2. Control process 3. Organisational framework Risk Strateg y Risk Bearing Capacity Limits and Thresholds Identification Monitoring Governance and Communication Assessment Management Organisational structure Organisational procedure Internal Control 4. Internal Audit (and Compliance) Written specification and regular updating 16

17 Internal Control Internal audit reports only to the Board Internal audit s tasks are risk oriented and independent Internal Audit An illimited access to information must be granted to Internal Audit Audit employees must focus only to pure audit tasks Each Company needs an internal audit function All material activities (also risk management) must be audited The specified mitigations of determined deficiencies within agreed time plan must be monitored The internal audit can be outsourced. In this case, a regular quality check must be performed by internal audit commissaries Audit reports must be written and immediately provided to the management 17

18 Thank you for your attention.